Data transmission between two data processing units

Abstract

The invention relates to a method for transmitting data between two data processing units (100, 200). In this case, a secret key is generated, which is encrypted by an additional key (12) provided by the first external storage medium (10), and the encrypted secret key (14) is stored on the first external storage medium (10). The data (1) stored in the first data processing unit (100) is encrypted with a secret key, and the data (2) encrypted with the secret key is provided to the second data processing unit (200). The encrypted secret key (14) and the additional key (12) are read by the second data processing unit (200) from the first external storage medium (10), and the encrypted secret key (14) is decrypted by the second data processing unit (200) using the additional key (12). The second data processing unit (200) decrypts the data (2) encrypted with the secret key using the secret key.

Description

[0001] Regardless of the part of speech of a particular term, the term includes words with a positive, negative or other connotation. TECHNICAL FIELD

[0002] The invention relates to a method for data transmission between two data processing units.

[0003] In particular, the invention relates to a method for transmitting sensitive data which requires a read permission for reading between two data processing units. Before the transmission, such data is transmitted from a first data processing unit to a second data processing unit in an encrypted manner. The data processing units carry out a decryption. For this purpose, the second data processing unit must know or be informed of a key for decrypting the data. SUMMARY

[0004] The object of the invention is to propose an improved data transmission method in terms of encryption and decryption of the data to be transmitted, in which it must be ensured that the data processed is protected with integrity.

[0005] This object is achieved according to the invention by a data transmission method having the features of claim 1.

[0006] Advantageous embodiments of the invention form the subject of the dependent claims.

[0007] In the method according to the invention, data is transmitted by a first data processing unit to a second data processing unit, wherein

[0008] - a secret key is generated,

[0009] - the secret key is encrypted with an additional key provided by a first external storage medium and the encrypted secret key is stored on the first external storage medium,

[0010] - the data stored on the first data processing unit is encrypted with the secret key and the data encrypted with the secret key is provided to the second data processing unit,

[0011] - the encrypted secret key and the additional key are read by the second data processing unit from the first storage medium,

[0012] - the encrypted secret key is decrypted by the second data processing unit with the additional key, and

[0013] - the data encrypted with the secret key is decrypted by the second data processing unit with the secret key.

[0014] According to the method of the present application, therefore, the data transmitted from the first data processing unit to the second data processing unit is encrypted with the secret key prior to the data transmission. The encrypted data is provided to the second data processing unit. The second data processing unit therefore requires the secret key to decrypt the data.

[0015] For decrypting the data, the present application provides a first storage medium. The first storage medium provides an additional key for encrypting the secret key. The secret key is encrypted with the additional key and the encrypted secret key is stored in the first storage medium. The encrypted secret key is therefore preferably stored in a copy-protected manner only in the first storage medium, so that it is bound to the first storage medium.

[0016] Thereby, the encrypted data can be decrypted by means of the first storage medium without the secret key having to be known.

[0017] In an embodiment of the present application, the encrypted data is first copied from the first data processing unit to the first external storage medium or to the second external storage medium and the encrypted data is provided by the first external storage medium or by the second external storage medium to the second data processing unit, so that the data encrypted with the secret key is provided to the second data processing unit.

[0018] According to the above-mentioned embodiment of the present application, the encrypted data is stored in the first external storage medium or in the second external storage medium. Thereby, the data is protected on the first external storage medium or on the second external storage medium and can also be provided by the first external storage medium or by the second external storage medium to a different data processing unit.

[0019] In a further embodiment of the present application, the additional key is a salt. The salt is for example a specific string stored on the first external storage medium, for example a serial number of the first external storage medium. Alternatively, the salt is a random string generated by the first external storage medium. Preferably, the salt complies with the relevant guidelines of internationally recognized or recommended minimum security standards.

[0020] Here, it is preferred that a random string is generated by the first external storage medium as the salt, instead of a specific string stored on the first external storage medium, in particular if the first external storage medium is used to encrypt different secret keys. In this case, a random string can be generated as the salt for each secret key that needs to be encrypted, so that the security of the encryption of the secret key is advantageously increased.

[0021] In a further embodiment of the present application, the additional key is stored in a secure storage area of the first external storage medium. The secure storage area referred to here is a so-called Secure storage area, which in particular has a copy protection function.

[0022] In a further embodiment of the application, the key is generated by the first data processing unit and stored in a secure storage area of the first data processing unit.

[0023] Storing the key in a secure storage area of the first data processing unit is advantageous for increasing the security of the data encryption.

[0024] In a further embodiment of the application, the key is stored in a secure storage area of the second data processing unit.

[0025] Storing the key in a secure storage area of the second data processing unit is also advantageous for increasing the security of the data encryption.

[0026] In a further embodiment of the application, the first external storage medium is a memory card, in particular a memory card with a secure storage area, wherein the encrypted key is stored in the secure storage area. The second external storage medium can also be a memory card. Alternatively, the second external storage medium can be any other storage device, for example a hard disk. BRIEF DESCRIPTION OF DRAWINGS

[0027] The above mentioned features, characteristics and advantages of the application, as well as its implementation, will be more clearly and detailed understood with the following description of embodiments, in connection with the attached drawings. In the drawings:

[0028] Figure 1 is a block diagram of the data encryption according to an embodiment of the method of the application,

[0029] Figure 2 is a block diagram of the data decryption according to an embodiment of the method of the application.

[0030] Corresponding components are denoted by the same reference signs in the figures. DETAILED DESCRIPTION

[0031] Figure 1 and Figure 2 An embodiment of the method according to the application for transmitting data from a first data processing unit 100 to a second data processing unit 200 is shown. In the method, the data 1 to be transmitted is encrypted by the first data processing unit 100 and the encrypted data 2 is decrypted by the second data processing unit 20. Figure 1 is a block diagram of the data encryption, Figure 2 is a block diagram of the data decryption.

[0032] For encrypting the data 1, a secret key is generated by the first data processing unit 100 using a method 102. The method 102 is invoked by a user input 3 of a user of the first data processing unit 100.

[0033] The secret key is stored in a secure storage area 104 of the first data processing unit 100.

[0034] In order to protect the secret key on the first external storage medium 10, the secret key is read by the first data processing unit 100 from the secure storage area 104 of the first data processing unit 100 using a method 106 and encrypted using an additional key 12 provided by the first external storage medium 10. The encrypted key 14 is stored in a secure storage area 16 of the first external storage medium 10. The method 106 is invoked by a user input 5 of a user of the first data processing unit 100. The additional key 12 is for example a salt. The salt can be a specific string stored on the first external storage medium 10 or a random string generated by the first external storage medium 10.

[0035] The data 1 is encrypted using the secret key using a method 108. For this purpose, the secret key is read from the secure storage area 104 of the first data processing unit 100. The method 108 is invoked by a user input 7 of a user of the first data processing unit 100.

[0036] The encrypted data 2 is copied onto the second external storage medium 20.

[0037] In order to transfer the data 1 to the second data processing unit 200, the first external storage medium 10 and the second external storage medium 20 are connected with the second data processing unit 200.

[0038] The encrypted secret key 14 and the additional key 12 are read by the second data processing unit 200 from the first external storage medium 10. Subsequently, the encrypted secret key 14 is decrypted by the second data processing unit 200 using a method 202 and the secret key is stored in a secure storage area 204 of the second data processing unit 200.

[0039] Using the secret key, the second data processing unit 200 decrypts the encrypted data 2 read from the second external storage medium 20 using a method 206 and the decrypted data 1 is stored by the second data processing unit 200.

[0040] Each of the methods 102, 106, 108, 202, 206 is a computer program which is executed on the respective data processing unit 100, 200.

[0041] According to Figure 1 and Figure 2 the described methods, for example the following modifications are possible: The encrypted data 2 is copied onto the first external storage medium 10 instead of the second external storage medium 20 and read by the second data processing unit 200 from the first external storage medium 10.

[0042] While the application has been described and illustrated in detail, it should be understood that the application is not limited to the disclosed examples, and that other variations can be made without departing from the scope of the application.

[0043] Regardless of the gender of the particular term, the term includes words with masculine, feminine, or other gender.

Claims

1. A method for data transmission between two data processing units (100, 200), wherein - a secret key is generated, - the secret key is encrypted with an additional key (12) provided by a first external storage medium (10) and the encrypted secret key (14) is stored on the first external storage medium (10), - data (1) stored on the first data processing unit (100) are encrypted with the secret key and the data (2) encrypted with the secret key are provided to a second data processing unit (200), - the encrypted secret key (14) and the additional key (12) are read by the second data processing unit (200) from the first external storage medium (10), - the encrypted secret key (14) is decrypted by the second data processing unit (200) by means of the additional key (12), and - the data (2) encrypted with the secret key are decrypted by the second data processing unit (200) by means of the secret key.

2. The method of claim 1, wherein, The data (2) encrypted are first copied from the first data processing unit (100) to the first external storage medium (10) or to a second external storage medium (20) and provided by the first external storage medium (10) or the second external storage medium (20) to the second data processing unit (200), so that the data (2) encrypted with the secret key are provided to the second data processing unit (200).

3. The method of claim 1 or 2, wherein, The additional key (12) is a salt.

4. The method of claim 3, wherein, The salt is a specific string stored on the first external storage medium (10).

5. The method of claim 3, wherein, The salt is a random string generated by the first external storage medium (10).

6. The method according to any one of the preceding claims, wherein, The encrypted secret key (14) is stored in a secure storage area (16) of the first external storage medium (10).

7. The method according to any of the preceding claims, wherein, The secret key is generated by the first data processing unit (100) and stored in a secure storage area (104) of the first data processing unit (100).

8. The method of any of the preceding claims, wherein, The secret key is stored in a secure storage area (204) of the second data processing unit (200).

9. The method of any of the preceding claims, wherein, The first external storage medium (10) is a memory card.

Images