METHOD FOR AUTHENTICATING A COMPUTER SYSTEM

Description

[0001] The invention relates to a method and an authentication computer system for authenticating a first computer system to a second computer system for cryptographically secured communication between the first and the second computer system.

[0002] Common certificates used to establish cryptographically secure connections between computer systems, for example, using the TLS (Transport Layer Security) or SSL (Secure Sockets Layer) protocol, combine elements of the transport and application layers according to the TCP / IP reference model. This is especially true for TLS / SSL certificates of the Organization Validated (OV) or Extended Validated (EV) type.

[0003] The corresponding certificates include, for example, an X.509 certificate, which a server uses to authenticate itself to a client during the TLS / SSL protocol. In addition to verifying the trustworthiness of the X.509 certificate, the client checks whether the server name matches the certificate owner, i.e., the server name, confirmed by the certificate. The certificate also confirms a public cryptographic key, which, during the TLS / SSL protocol, is used, for example, to negotiate an ephemeral symmetric session key for encrypting client-server communication. The certificate assigns the public key to an identity, i.e., the server.

[0004] US 2002 / 062438 A1 describes a method for managing trust in an electronic transaction system, which includes a certification authority that issues a primary certificate to a recipient and forwards information about the issued primary certificate to a trust server. The trust server manages the forwarded information about the issued primary certificate. The recipient forms a transaction and then makes the transaction available to a relying party. The transaction contains the primary certificate or a reference to it. The relying party sends a security request to the trust server based on the transaction received from the recipient. The trust server determines whether to provide the requested security based on the information about the issued primary certificate and the requested security.Based on the determination, the trust server issues a secondary certificate to the relying party, which provides security to the relying party.

[0005] US 2013 / 007460 A1 describes a method for providing data, including creating a first digital certificate (authorization certificate) signed with the electronic signature of a first signing entity. The authorization certificate contains attributes of a described entity, information identifying the first signing entity, details of data related to the described entity, details of a data source, and details of a trusting entity to which the data can be delivered. The trusting entity forwards the authorization certificate to a source that provides the data specified in the authorization certificate. The data can be transmitted to the trusting entity using a second digital certificate (custom certificate) signed with the electronic signature of a second signing entity.Custom certificates can be displayed in custom certificate revocation lists.

[0006] The entry "Validation authority" in Wikipedia from August 31, 2017, describes certificate revocation using a Certificate Revocation List (CRL) by a Validation Authority (VA) of a Public Key Infrastructure (PKI).

[0007] The invention is based on the object of creating an improved method for authenticating a first computer system to a second computer system for cryptographically secured communication between the two computer systems.

[0008] The problem underlying the invention is solved by the features of the independent patent claims. Embodiments of the invention are specified in the dependent patent claims.

[0009] Embodiments relate to a method for authenticating a first computer system to a second computer system for cryptographically secured communication between the two computer systems. The method comprises: Providing an authentication file with authentication data for authenticating the first computer system by a third computer system, wherein the authentication data is retrievable via a network, wherein a certificate issued for the first computer system comprises a reference for identifying the authentication data for authenticating the first computer system, wherein the authenticity and integrity of the corresponding reference is secured by the certificate signature included in the certificate, receiving a read request from the second computer system for reading the authentication data by the third computer system via the network, wherein the read request identifies the authentication data using the reference, in response to receiving the read request, sending the requested authentication data for authenticating the first computer system from the third computer system via the network to the second computer system..

[0010] Embodiments may have the advantage that authentication data of the computer system to be authenticated (first computer system) is decoupled from the certificate in that the certificate, by means of a certificate signature, secures a trusted source in the form of the reference from which the authentication data can be retrieved, but not the content of the authentication data. Thus, embodiments allow, as long as the reference remains unchanged, the contents of the certificate to be changed without requiring changes on the part of the authenticating computer system (third computer system). On the other hand, authentication data can be changed without necessitating changes to the certificate.The authenticity and integrity of the certificate contents are secured by the certificate issuer's certificate signature, while the authenticity and integrity of the provided authentication data are secured by the third computer system.

[0011] In particular, the authentication data remains under the control of the third computer system and is only issued upon request when specifically needed. This allows changes to the authentication data to be made directly in real time, without having to first propagate the corresponding changes or wait for the remaining validity period of certificates.

[0012] The certificate can be an end-entity certificate, an intermediate certificate, or a root certificate. An end certificate is a certificate that references another certificate, such as an intermediate certificate or root certificate, while not being referenced itself. To prove the authenticity and integrity of its authentication data, an end certificate references an intermediate certificate or root certificate with a public cryptographic key of the issuer of the end certificate as the signature verification key. In this case, a corresponding reference to such an issuer certificate (intermediate certificate or root certificate) is included in the certificate itself and / or the authentication data referenced by the certificate.An intermediate certificate is a certificate that both references another certificate, such as a further intermediate certificate or root certificate, and is itself referenced by one or more other certificates, such as an end certificate or another intermediate certificate. To prove the authenticity and integrity of its authentication data, an intermediate certificate references another intermediate certificate or root certificate with a public cryptographic key of the issuer of the intermediate certificate as the signature verification key. In this case, a corresponding reference to such an issuer certificate (another intermediate certificate or root certificate) is included in the certificate itself and / or the authentication data referenced by the certificate.A root certificate is a certificate that does not reference any other certificate, while itself being referenced by one or more certificates, such as an intermediate certificate or end certificate. Such a root certificate is issued by the issuer of the root certificate for itself without the use of any other certificate. This means that the root certificate includes (either as part of the certificate itself or as part of the authentication data referenced by the root certificate) a public cryptographic key of the issuer, the authenticity and integrity of which are verified by the root certificate itself.

[0013] In the case of a root certificate, this means that the certificate is issued by the first computer system for itself. Furthermore, the authentication data can also be provided by the first computer system for itself. In this case, the first computer system is its own authentication computer system, meaning the first and third computer systems are identical. Alternatively, in the case of a root certificate issued by the first computer system for itself, the authentication computer system can also be a computer system independent of the first computer system.

[0014] According to embodiments, the certificate can generally serve for any use case, such as an SSL procedure, for signing and / or encrypting email, or as a certificate on a chip to prove the authenticity and integrity of the chip and / or data contained on the chip. However, the possible use cases are not limited to these examples.

[0015] According to embodiments, the authentication computer system (third computer system) creates the provided authentication data and / or checks it for correctness. According to further embodiments, the authentication computer system receives the authentication data completely or at least partially from one or more fourth computer systems. The authentication computer system does not check the content of this received authentication data, but instead only forwards it or makes it available for query by other (second) computer systems. A trust relationship with regard to the content of the provided authentication data is achieved by classifying the fourth computer system as fundamentally trustworthy. This trustworthiness of the fourth computer system is checked and guaranteed by the authentication computer system.For example, the fourth computer system is an official and / or governmental registry, e.g., an official registry, or another publicly trusted party. The authentication computer system guarantees to provide only data from such trusted sources as authentication data. In this case, the data records transmitted by the fourth computer system, for example, identify their own validity period and / or scope.

[0016] Embodiments can have the advantage of enabling exchange mechanisms or modification mechanisms independently of each other for both the transport layer and the application layer. In the case of known TLS-ZSSL certificates, such exchange mechanisms or modification mechanisms are complex to implement for both the transport layer and the application layer, as they can also directly impact the application layer elements, for example, with regard to attribute validation, and vice versa.

[0017] Such well-known certificates serve as independent proof for both authentication and encryption purposes. They therefore include elements of transport encryption at the transport layer and identity verification information at the application layer, thus blending both layers.

[0018] Furthermore, one of the basic principles of a certificate is that the information elements contained in the certificate are integrated into the corresponding certificate in an immutable form. Generally, a hash value is calculated for the entire content of the certificate, and the resulting hash value is signed with a private cryptographic key of the certificate issuer. This allows the signature to be verified for authenticity and integrity using a public cryptographic key of the certificate issuer as the signature verification key. Therefore, any change to the information elements contained in the certificate requires a reissue of the certificate.

[0019] Embodiments can have the advantage of breaking the fixed link between information at the transport layer and the application layer. This enables automated renewal of individual elements for securing the transport layer and / or the application layer independently of each other, without the need to automatically renew all elements or re-prove their authenticity and integrity. Furthermore, by making the access functions dynamic, a high degree of flexibility can be realized to immediately apply changing information, such as registry entries, and make it available, for example, to a certificate-evaluating party (relying party).

[0020] Embodiments provide a certificate with a reference to an external data source. The authenticity and integrity of the corresponding reference is secured by the certificate signature; however, in contrast to the state of the art, the actual application-relevant data is no longer contained in the certificate itself. Rather, the application-relevant data is provided by a remote system referenced by the corresponding reference, which is operated by the certificate issuer, e.g., a certificate-issuing trust service provider. A relying party, i.e., the party evaluating the certificate, can extract the reference from the certificate and validate it by verifying the signature of the certificate. By calling the reference, the relying party can retrieve trusted attributes, such as organizational details of the certificate owner, using a suitable technical calling scheme.

[0021] Embodiments can have the advantage of ensuring a consistent separation of the application and transport layers within a certificate-based trust system. This allows, for example, the issuance of a certificate to secure communication with a validated domain to be completely automated, as the required verification steps can all be performed automatically, while the verification of additional attributes, which can be made accessible via a reference stored in the certificate, can be performed separately, both technically and procedurally. This also allows, for example, the updating of the actual certificates to be automated and repeated at short intervals without the need for revalidation of the associated attributes accessible via the reference.The corresponding certificate in this case is a domain-validated certificate (DV certificate), which is used, for example, for Transport Layer Security (TLS), where the domain name of a requestor is validated by demonstrating a certain degree of control over a DNS domain. The certification authority checks whether the actual requestor is also the owner of the domain. The information about the certificate owner can either be provided in full as referenced authentication data in addition to the certificate, or the certificate can include, for example, the name of the DNS domain, while further information about the certificate owner is outsourced to the external authentication data.This external authentication data can also be used to upgrade the certificate from a DV certificate to an Organization Validated Certificate (OV certificate) or Extended Validation Certificate (EV certificate) if the external authentication data provides the necessary additional information.

[0022] For example, the issuance of an OV certificate requires the fulfillment of the following two criteria: proof of the right to administratively manage the domain name in question, and the actual existence of the organization as a legal entity. A certificate issuer publishes its OV verification criteria, for example, in its certification guidelines. For example, a commercial register extract is requested, bank details are verified, and / or contact is made by telephone. In addition to the domain name, this certificate type also specifies the company name and registered office under "Certificate Owner."

[0023] The issuance of an EV certificate is subject to stricter award criteria, which require a detailed review of the applicant, i.e., the future certificate owner, by the certification authority. The issuance of an EV certificate requires, among other things, the following: Establishing the applicant's identity and business address; Ensuring that the applicant is the exclusive owner of the domain for which the certificate is to be issued or has exclusive rights of use; Ensuring that the applicants are authorized and that legally binding documents are signed by authorized signatories. A certificate issuer publishes its EV review criteria, for example, in its certification guidelines.

[0024] The authentication data therefore includes, for example, a domain name, company name and / or company headquarters.

[0025] According to embodiments, the authentication data comprises one or more public cryptographic keys assigned to the first computer system, the authenticity and integrity of which are verified by the certificate. In this case, the first computer system comprises one or more private cryptographic keys, each of which forms an asymmetric cryptographic key pair with one of the public cryptographic keys. For example, a certificate issuer generates several such cryptographic key pairs for an entity or the first computer system, which is assigned to the corresponding entity, for example, and delivers the private keys to this entity (for example physically, i.e., on a secure data medium), but issues only a single certificate for these multiple key pairs, with this entity as the key holder.According to alternative embodiments, the cryptographic key pairs are generated and / or managed, for example, by the first computer system, i.e., the future certificate holder or the computer system assigned to the corresponding entity, or a provider of the corresponding first computer system. The certificate issuer provides the entity or the first computer system with the certificate, which in turn includes a reference to the authentication data with the one or more public keys of the one or more cryptographic key pairs. If generated by the provider, the cryptographic key pairs are stored on the first computer system, for example, during the provision process.Using the authentication data, the certificate issuer and / or the authentication computer system can determine, by including appropriate information as part of the authentication data, which cryptographic key pairs of the key holder are valid for how long, when, and / or for which purposes, without the corresponding certificate having to be renewed within its validity period. In particular, additional cryptographic key pairs for the same certificate can also be subsequently issued in this way by supplementing the corresponding public cryptographic keys in the authentication data with additional information, such as the validity period and / or the scope of validity.

[0026] Depending on the implementation, the certificate can also be issued without a validated domain. The domain(s) associated with the certificate are also managed externally by the trust service provider as part of the authentication data and can be modified there as required. In this case, domain information about the domains associated with the certificate is also accessible, for example, via the reference stored in the certificate as authentication data.

[0027] The consistent separation of transport and application levels enables the highest possible automation at the transport level with regard to validation and issuance, while the attributes required at the application level can be validated, introduced, updated and provided separately.

[0028] If a cryptographically secure connection is to be established using the TLS / SSL protocol, the process could be as follows: When accessing an https-protected website, the server hosting the website sends a certificate to the client's browser. The client checks the certificate signature and retrieves the server's authentication data using a reference provided by the certificate. The received authentication data is also checked and displayed if necessary. Using the server's public key provided by the certificate, the browser negotiates a secret session key with the server. To do this, the client generates a secret (pre-master secret) that can only be decrypted by the server that has the matching private key.If RSA is used as the cipher suite, the pre-master secret generated by the client is encrypted with the server's public key. Alternatively, the Diffie-Hellman algorithm can be used to generate a shared pre-master secret. From this pre-master secret, a master secret is then derived by both the client and the server, and from this, a unique session key is derived. The session key is confirmed by the server and used to secure the actual communication or data transfer.

[0029] For illustrative purposes, let us consider a bank website as an example, which is to be protected using a certificate. The protection goals are both the encrypted transmission of confidential data between the user and the bank's server, as well as proof of trustworthy identity data and other application-relevant information on the part of the bank. According to embodiments, the user connects using a suitable application (app) or via a browser to a server application provided by a bank server via the Internet. In this case, an encrypted and authenticated connection is established between the user application or browser application and the server application in accordance with the TLS protocol and using a bank's server certificate, so that the transmitted data is protected in terms of its integrity and confidentiality.The browser application also checks whether it is actually communicating with the bank's genuine server application. In other words, the authenticity of the server application or server is verified. To do this, the required attributes are retrieved via a reference contained in the bank's server certificate. The necessary attributes are provided, and the authenticity of the provider is verified using a suitable challenge-response protocol. For this purpose, the protocol uses suitable keys and / or certificates, which are made available, for example, via a trusted list of the calling server application, with integrity assurance.

[0030] Retrieving the authentication data using the reference provided by the certificate can be implemented using SAMLE, OPENID or OAuth, for example.

[0031] Cryptographically secured communication between two computer systems generally refers to the transfer of data between the two computer systems whose authenticity and integrity are secured by cryptographic methods. Additionally or alternatively, the data can be protected against unauthorized access by encryption. Thus, according to embodiments, cryptographically secured communication includes, for example, a digital signature generated by the first computer system and provided to the second computer system, a secured communication connection between the two computer systems using network protocols such as TLS / SSL or IPsec or SSH, the sending of encrypted messages, e.g., S / MIME or PGP for emails, or authentication and access control for chip cards.

[0032] Digital data can be cryptographically secured, for example, by asymmetric encryption with an asymmetric key pair, i.e., a private or public cryptographic key, or symmetric encryption with a symmetric cryptographic key. Cryptographic security may additionally or alternatively include a signature with a signature key, e.g., a private cryptographic key of an asymmetric key pair.

[0033] For example, a cryptographically secured data transmission can involve transmission via an encrypted end-to-end connection. An encrypted end-to-end connection or an encrypted end-to-end transmission channel is understood here as a connection between a sender and a receiver with end-to-end encryption, in which the data to be transmitted is encrypted by the sender and only decrypted again by the receiver. The encryption of transmitted data thus occurs across all transmission stations, so that intermediate stations cannot gain knowledge of the content of the transmitted data due to the encryption. The connection is cryptographically secured by encryption to prevent spying and / or manipulation of the transmission; for this purpose, a so-called secure messaging procedure can also be used.For example, end-to-end encryption is based on two symmetric cryptographic keys, with a first symmetric key being used to encrypt messages and a second symmetric key being used to authenticate the sender of the message.

[0034] The key for authenticating the message sender can, for example, be used to create a message authentication code (MAC). Using a MAC, certainty about the origin of messages can be obtained and their integrity verified. MAC algorithms require two input parameters: first, the data to be protected and second, a secret key. From these two, a message authentication code is calculated in the form of a checksum. The sender of a message calculates a MAC for the data to be transmitted in the message and sends the message along with the MAC to the receiver. The receiver calculates the MAC for the received message using its key and compares the calculated MAC with the received MAC.If both values ​​match, it follows that the message was sent by a party that has access to the secret key and the message was not altered during transmission.

[0035] A certificate is understood here as a digital certificate, also known as a public key certificate. Such certificates based on asymmetric key pairs create a so-called public key infrastructure (PKI). Such a certificate consists of structured data that serves to assign a public key of an asymmetric cryptosystem to an identity, such as a person or a device. A certificate can, for example, contain a public key and be signed. Alternatively, certificates based on zero-knowledge cryptosystems are also possible.

[0036] Embodiments use modified certificates that contain no or only rudimentary information about the certificate owner, e.g., a "Distinguished Name" or an "Alternative Name," such as an email address or a DNS entry. The actual authentication data for authenticating and / or identifying the owner is provided externally and identified by a reference stored in the certificate.

[0037] The PKI provides a system for issuing, distributing, and verifying digital certificates. In an asymmetric cryptosystem, a digital certificate serves to confirm the authenticity of a public key and its permissible scope of application and validity. The digital certificate itself is protected by a digital signature, the authenticity of which can be verified using the public key of the certificate issuer. To verify the authenticity of the issuer key, a digital certificate is used. In this way, a chain of digital certificates can be established, each of which confirms the authenticity of the public key with which the previous certificate can be verified. Such a chain of certificates forms a so-called validation path or certification path.PKI participants must be able to rely on the authenticity of the last certificate, the so-called root certificate, and the key certified by this certificate without the need for any additional certificates. The root certificate is managed by a so-called root certification authority, whose assumed authenticity underlies the authenticity of all PKI certificates.

[0038] Digital certificates are a proven means of proving authorization when securing electronic communication using asymmetric cryptographic methods. Certificates are structured data that document the authenticity and / or other properties / authorizations of the owner of a public key (signature verification key) and are confirmed by an independent, credible authority (certification service provider / CSP or trust service provider / TSP), generally the certification authority that issued the certificate. Certificates are generally made available to a wide audience to enable them to verify electronic signatures for authenticity and validity.

[0039] A certificate can be associated with an electronic signature if the private key associated with the public key was used to generate the electronic signature to be verified. By making a certificate associated with a public key available to the public, a CSP / CSP enables users of asymmetric cryptosystems to assign the corresponding public key to an identity, such as a person, organization, or computer system.

[0040] Asymmetric key pairs are used for a variety of cryptosystems and also play an important role in the signature of electronic documents. An asymmetric key pair consists of a public key, which is used to encrypt and / or decrypt data and may be passed on to third parties, such as a service provider and / or a central processing unit (CSP), and a private key, which is used to encrypt and / or decrypt data and must generally be kept secret. The public key allows anyone to encrypt data for the owner of the private key, verify digital signatures on their documents, or authenticate them. A private key allows its owner to decrypt data encrypted with the public key or to create digital signatures for electronic documents.A signature created with a private key can be verified with the corresponding public key.

[0041] Digital signatures are used for secure electronic data exchange, for example, on the Internet, and enable the verification of identities and / or authorizations, as well as the authenticity of the exchanged data. To ensure this, a public key infrastructure is usually required, which confirms the validity of the keys used through certificates.

[0042] The creation of a digital signature, also referred to simply as a signature, is a cryptographic process in which an additional data value, known as a signature, is calculated for any data, for example, an electronic document. The signature can, for example, be an encrypted hash value of the electronic document, in particular a hash value encrypted with a private key of a cryptographic key pair associated with a certificate. The special feature of such a signature is that its authorship and affiliation with a specific person or entity can be verified by any third party.

[0043] A challenge-response protocol is a secure authentication method based on shared knowledge. According to the challenge-response protocol, for example, a first participant in a two-way communication sends a challenge to the second participant, which the second participant must solve in order to prove that they possess certain knowledge without revealing this knowledge to third parties. After the second participant solves the challenge, they respond with a response. For example, the first participant sends a random number N (nonce) to the second participant as a challenge. The second participant adds the shared secret to this random number N, applies a cryptographic hash function or encryption to this combination, and sends the result back to the first participant as a response.The first participant, who knows both the random number and the shared secret, as well as the hash function or encryption used, performs the same calculation and compares its result with the response. If the result and the response are identical, the second participant has successfully authenticated.

[0044] A computer or computer system is understood here to be a device that processes data using programmable computing rules. A program or program instructions is understood here, without limitation, to be any type of computer program that includes machine-readable instructions for controlling a computer's functionality. A computer or computer system can include a communications interface for connecting to the network, which can be a private or public network, in particular the Internet or another communications network. Depending on the embodiment, this connection can also be established via a mobile network.

[0045] A computer system can be a stationary computer system, such as a personal computer (PC), or a client or server integrated in a client-server environment. Furthermore, a computer system can be, for example, a mobile telecommunications device, in particular a smartphone, a portable computer, such as a laptop PC or palmtop PC, a tablet PC, a personal digital assistant, or the like.

[0046] The term “memory” refers here to both volatile and non-volatile electronic memories or digital storage media.

[0047] Non-volatile memory is defined here as electronic memory for the permanent storage of data. Non-volatile memory can be configured as non-modifiable memory, also known as read-only memory (ROM), or as modifiable memory, also known as non-volatile memory (NVM). In particular, this can be an EEPROM, such as a flash EEPROM, also known as flash. Non-volatile memory is characterized by the fact that the data stored on it is retained even after the power supply is turned off.

[0048] A volatile electronic memory is defined here as a memory for temporarily storing data, characterized by the fact that all data is lost after the power supply is turned off. In particular, this can be a volatile random-access memory (RAM) or a volatile processor memory.

[0049] A protected memory area is understood here to be an area of ​​an electronic memory to which access, i.e., read or write access, is only possible via a processor of the corresponding computer system. According to embodiments, access from the processor coupled to the memory is only possible if a necessary condition is met. This can be, for example, a cryptographic condition, in particular, successful authentication and / or successful authorization verification.

[0050] Here and below, a processor is understood to be a logic circuit used to execute program instructions. The logic circuit can be implemented on one or more discrete components, in particular on a chip. In particular, a processor is understood to be a microprocessor or a microprocessor system comprising multiple processor cores and / or multiple microprocessors.

[0051] An interface or communication interface is understood here to be an interface via which data can be received and sent, whereby the communication interface can be configured to be contact-based or contactless. The communication interface can be an internal interface or an external interface which is connected to an associated device, for example, by means of a cable or wirelessly. A communication interface for wireless communication is a communication interface which is configured for the contactless sending and receiving of data. Communication can, for example, take place according to an RFID and / or NFC standard, such as Bluetooth. Furthermore, the communication interface can be configured for communication via a local radio network, for example according to a standard of the IEEE 802.11 family and / or Wi-Fi.

[0052] Communication can, for example, take place via a network. A network is defined here as any transmission medium with a connection for communication, in particular a local connection between two or more computer systems, a local area network (LAN), a private network, in particular an intranet, and a virtual private network (VPN). It can also be a public network, such as the Internet.

[0053] According to embodiments, the certificate further comprises cryptographic parameters for establishing a cryptographically secured connection between the first and second computer systems. Embodiments may have the advantage of enabling changes to the cryptographic parameters, such as key lengths and / or encryption algorithms, independent of the authentication data.

[0054] According to embodiments, the certificate comprises, as a cryptographic parameter, a public cryptographic key assigned to the first computer system for establishing a connection between the first and the second computer system that is cryptographically secured by means of encryption.

[0055] According to embodiments, the reference includes a network address under which the authentication data for authenticating the first computer system can be retrieved. Embodiments can have the advantage that the authentication data can be retrieved directly by the authenticating computer system (second computer system) using the specified network address if the certificate is present. The reference can be, for example, a UUID (Universally Unique Identifier) ​​or an IP address, such as IPv4 or IPv6.

[0056] According to embodiments, the reference includes an identifier that identifies the authentication data to be retrieved for authenticating the first computer system. Embodiments may have the advantage that the reference can be used to identify which authentication data is required. For example, the reference is included in the read request for this purpose.

[0057] According to embodiments, the authentication file comprises a plurality of data records with authentication data for authenticating the first computer system. The data records are each assigned to different security levels for the authentication of the first computer system. Based on the received read request, the third computer system determines which security level is to be met for the authentication of the first computer system and from which of the data records the authentication data is to be sent to the second computer system in response to the received read request.

[0058] Embodiments may have the advantage that the authentication computer system maintains different authentication data for different authentication purposes, which differ from one another, for example, in terms of their scope, level of detail involved, and the underlying verification effort or verification method. For example, if a lower security level is to be met, less authentication data, such as only a server name or domain name, can be returned, thereby accelerating the entire verification and reducing the amount of data to be processed.

[0059] According to embodiments, the reference identifies the security level for the authentication of the first computer system. Embodiments can have the advantage that a plurality of certificates can be issued for a computer system to be authenticated, each of which is assigned to a different security level and correspondingly comprises different references. The computer system to be authenticated and / or the authenticating computer system can thus be enabled to specify a security level to be met as needed and to use a certificate assigned to this level.

[0060] According to embodiments, the authentication data is sent signed by the third computer system to the second computer system. Embodiments can have the advantage that the signature allows the authentication computer system to effectively verify the authenticity and integrity of the transmitted authentication data.

[0061] According to some embodiments, these attributes are signed using additional cryptographic keys, so-called assertion keys, which enable cryptographic validation of the authenticity and integrity of the accessed attributes. According to some embodiments, this cryptographic validation of authenticity and integrity is performed using different cryptographic keys than those required to issue the certificate itself. To protect against replay attacks, data is retrieved using the reference provided by the certificate in conjunction with a challenge-response protocol, so that an unauthorized attacker cannot simply copy the trusted attributes.

[0062] Depending on the embodiment, the required keys and / or certificates for the different checks can be taken from different trust sources, such as a browser truststore for transport layer data or the EU Trusted List for application layer data.

[0063] According to embodiments, the authentication data is sent in encrypted form from the third computer system to the second computer system. Embodiments can have the advantage that the transmitted authentication data can be effectively protected against unauthorized access.

[0064] According to embodiments, the third computer system authenticates itself to the second computer system by means of a challenge-response method.

[0065] Embodiments may have the advantage that cryptographically secured authentication can be implemented between the authentication computer system and the authenticating computer system. In particular, a challenge-response method enables efficient protection against replay attacks by using a timestamp or a replay counter.

[0066] According to embodiments, the method further comprises changing at least part of the authentication data for authenticating the first computer system by the third computer system, while maintaining the certificate issued for the first computer system in unchanged form. Embodiments may have the advantage that the changes to the authentication data can be implemented independently of changes to the certificate.

[0067] According to embodiments, the method further comprises issuing the certificate with the reference for identifying the authentication data for authenticating the first computer system by the third computer system, and creating the authentication file with the corresponding authentication data by the third computer system for retrieval over the network. Embodiments may have the advantage that the authentication computer system can simultaneously function as a certificate issuer.

[0068] According to embodiments, the certificate of the first computer system is provided with a limited validity period, and the method further comprises issuing an updated successor certificate with an updated validity period for replacement, while the authentication file is retained unchanged by the third computer system for retrieval over the network. Embodiments may have the advantage that certificates with a very short validity period, e.g., one, two, three months, one, two, three weeks, one, two, three days, or just a few hours, can be issued and updated at a correspondingly high frequency by successor certificates, without the need to verify the authentication data at an equally high frequency.

[0069] According to embodiments, the method further comprises issuing a replacement certificate with modified cryptographic parameters to replace the previous certificate of the first computer system, while the authentication file is retained unchanged by the third computer system for retrieval via the network. Embodiments can have the advantage that the cryptographic parameters can be changed by issuing a new certificate that replaces the previous certificate, without any actions being necessary by the authentication computer system with regard to the authentication data. The only requirement is that the replacement certificate has the same reference as the certificate it replaces. During the replacement process, the certificate to be replaced can be actively revoked, e.g.by placing it on a revocation list, deleting it from a whitelist, or a corresponding change in the cryptographic parameters can be implemented in combination with a new validity period when the validity period of the previous certificate is approaching its end.

[0070] According to embodiments, the method further comprises blocking the authentication of the first computer system. Blocking the authentication of the first computer system comprises replacing the authentication data with a revocation notice that can be retrieved via the network by the third computer system. In the case of a revocation, the revocation notice is sent via the network to the second computer system in response to receiving the read request from the third computer system. Embodiments can have the advantage of implementing effective authentication blocking. In the case of a certificate, revocation occurs either by placing the corresponding certificate on a revocation list, removing it from a whitelist, or by the validity of the corresponding certificate expiring. In the case of a revocation list or a whitelist, however, it is necessary that this be queried in addition to checking the certificate itself.If the revocation list or whitelist is not checked, it is possible that a certificate will be mistakenly recognized as valid despite being revoked. The certificate itself is under the control of the certificate issuer, which is why it cannot be revoked directly. In contrast, according to embodiments, the authentication data remains under the control of the authentication computer system. The corresponding authentication computer system can therefore revoke the authentication data directly, without providing the authenticating computer system with a way to access the corresponding authentication data independently of the authentication computer system in the event of an authentication attempt.Rather, querying the authentication computer system is an essential part of authentication, which is why no additional steps are necessary for revocation checking, which could potentially be omitted.

[0071] Embodiments relate to an authentication computer system for authenticating a first computer system to a second computer system for cryptographically secured communication between the first and second computer systems. The authentication computer system comprises a processor, a communication interface for communicating over a network, and an electronic memory with machine-readable instructions. Execution of the machine-readable instructions by the processor causes the authentication computer system to execute a method comprising: Providing an authentication file with authentication data for authenticating the first computer system by the authentication computer system, wherein the authentication data is retrievable via the network, wherein a certificate issued for the first computer system comprises a reference for identifying the authentication data for authenticating the first computer system, wherein the authenticity and integrity of the corresponding reference is secured by the certificate signature included in the certificate, receiving a read request from the second computer system for reading the authentication data by the authentication computer system via the network, wherein the read request identifies the authentication data using the reference,in response to receiving the read request, sending the requested authentication data for authenticating the first computer system from the authentication computer system to the second computer system via the network.

[0072] According to embodiments, the authentication computer system is configured to execute one or more of the aforementioned embodiments of the method for authenticating the first computer system to the second computer system for cryptographically secured communication between the first and second computer systems.

[0073] The term "authentication computer system" refers here to a computer system that provides authentication data to a second computer system for authenticating a first computer system. The authentication data is data about the identity of the certificate owner, whose reference refers to or identifies the corresponding authentication data. The authenticity and integrity of this data about the identity of the certificate owner or the first computer system is confirmed or guaranteed by the third computer system.

[0074] Embodiments of the invention will be explained in more detail below with reference to the drawings. They show: Figure 1 is a schematic block diagram of embodiments of exemplary computer systems, Figure 2 is a schematic block diagram of embodiments of exemplary computer systems, Figure 3 is a schematic block diagram of embodiments of exemplary certificates, Figure 4 is a flowchart of an embodiment of an exemplary method, and Figure 5 is a flowchart of an embodiment of an exemplary method.

[0075] Elements of the following embodiments that correspond to one another are identified by the same reference numerals.

[0076] The Figure 1shows a first and a second computer system 100, 200, between which a cryptographically secured communication is carried out. For example, a cryptographically secured connection is established between them using the TLS / SSL protocol. The first computer system 100 comprises a memory 102 with a certificate 112 issued for the first computer system 100. Furthermore, the memory 102 comprises, for example, a protected storage area 104 in which a private cryptographic key 106 of the first computer system 100 is stored. The private cryptographic key 106 belongs to an asymmetric key pair that is assigned to the first computer system 100 and, in addition to the private cryptographic key 106, also comprises a public cryptographic key.The assignment of the public cryptographic key to the first computer system 100 is implemented, for example, by the certificate 112, which includes the public cryptographic key and a reference that identifies authentication data of an authentication file 310 for authenticating the first computer system 100. The corresponding authentication file 310 is provided, for example, by a third computer system 300, which serves as the authentication computer system. Furthermore, the first computer system 100 includes a processor 114 and a communication interface 118 for communication via the network 150, for example, with the second and third computer systems 200, 300. The processor 114 executes a cryptographic protocol 116 for establishing or executing cryptographically secured communication with the second computer system 200.

[0077] The second computer system 200 comprises a memory 202. For example, the certificate 112 issued for the first computer system 100 is stored in the memory 202, which the first computer system receives from the first computer system 100 during the establishment of the cryptographically secured communication with the first computer system 100. Furthermore, the second computer system 200 comprises a processor 214 and a communication interface 218 for communication via the network 150, for example, with the first and third computer systems 100, 300. The processor 214 executes a cryptographic protocol 216 for establishing or executing the cryptographically secured communication with the first computer system 100.

[0078] The establishment or execution of the cryptographically secured communication between the first computer system 100 and the second computer system 200 requires authentication of the first computer system 100 to the second computer system 200. For this purpose, the third computer system 300 is provided.

[0079] The certificate 112 includes no, or at most insufficient, data for authenticating the computer system 100, which identifies the owner of the certificate 112. For example, the certificate 112 includes no owner information, or at most rudimentary owner information, such as a "Distinguished Name" or an "Alternative Name," such as an email address or a DNS entry of the first computer system 100. Rather, authentication data is provided by the third computer system 300 and identified by the certificate 112 using a corresponding reference. The authenticity and integrity of the source information, i.e., the reference, is confirmed by the certificate signature of the certificate 112.

[0080] The third computer system 300 serves as an authentication computer system for authenticating a first computer system 100 to a second computer system 200 for cryptographically secured communication between the first and second computer systems 100, 200. The third computer system 300 includes a memory 302. According to embodiments, the third computer system 300 is also the issuer of the certificate 112, i.e., a certification authority (Certificate Authority / CA). In this case, the memory 302 stores, for example, the certificate 112 issued by the third computer system 300 for the first computer system 100. Alternatively, the certificate can be issued by a fourth computer system (not shown) of an independent certification authority. In this case, there is generally no need for the third computer system 300 to have the certificate 112.

[0081] Furthermore, the third computer system 300 provides in the memory 302 one or more authentication files 310 with authentication data for authenticating one or more computer systems, such as the first computer system 100.

[0082] According to embodiments, the memory 302 further comprises, for example, a protected storage area 304 in which a first and a second private cryptographic key 306, 308 of the third computer system 300 are stored. The private cryptographic keys 306, 308 belong to two asymmetric key pairs that are assigned to the third computer system 300 and, in addition to the private cryptographic keys 306, 308, each further comprise a public cryptographic key. The first private cryptographic key 306 serves, for example, as a signature key for signing certificates, such as certificate 112, if the third computer system 300 is configured as a certification authority.In this case, the public cryptographic key associated with the private cryptographic key 306 serves as a signature verification key for verifying the authenticity and integrity of the corresponding certificates, such as certificate 112. The second private cryptographic key 308 serves, for example, as an assertion key for confirming the authenticity and integrity of authentication data of the authentication files 310, which the third computer system 300 sends, for example, in response to a corresponding read request from the second computer system 200. For example, the sent authentication data can be signed and / or encrypted with the private cryptographic key 308. The public cryptographic key associated with the private cryptographic key 308 serves, in this case, as a verification key for verifying the authenticity and integrity of the sent authentication data.

[0083] Furthermore, the third computer system 300 comprises a processor 314 and a communication interface 318 for communication via the network 150, for example, with the first and second computer systems 100, 200. The memory 302 provides program instructions 312, which are executed by the processor 314 and cause the computer system 300 to execute a method for authenticating the first computer system 100 to the second computer system 200. The corresponding method comprises sending authentication data from the authentication files 310 for authenticating the first computer system 100 to the second computer system 200. During this method, the processor 314 executes a cryptographic protocol 316 for cryptographically securing the authentication data sent to the second computer system 200.Furthermore, the cryptographic protocol 316 can also be used to sign certificates, such as the certificate 112, if the third computer system 300 also serves as a certification authority for issuing digital certificates.

[0084] The Figure 2 shows an extension of the configuration from Figure 1 , which in addition to the first, second and third computer systems 100, 200, 300 from Figure 1additionally comprises a fourth computer system 400. The fourth computer system 400 provides the third computer system 300, as the authentication computer system, with authentication data 410 for authenticating the first computer system 100 against a second computer system 200. The provided authentication data 410 corresponds to part and / or the entire authentication file 310 for authenticating the first computer system 100. In response to a read request for the corresponding authentication data by the second computer system 200, the third computer system 300 forwards the requested authentication data 410 to the second computer system (200) via the network 150.

[0085] The third computer system 300 receives the authentication data 410 via the network 150 from the fourth computer system 400. According to embodiments, the third computer system 300 does not check the content of the received authentication data 410, but instead simply forwards it or makes it available for query to the second computer system 200. A trust relationship with regard to the content of the provided authentication data 410 is achieved by classifying the fourth computer system 400 as fundamentally trustworthy. This trustworthiness of the fourth computer system 400 is checked and guaranteed by the third computer system 300. In other words, the third computer system 300 checks and guarantees that the authentication data 410 originates from a trustworthy source, not that its content is correct. For example, the fourth computer system 400 is an official and / or government register, e.g.an official register, or another publicly trusted party. The third computer system 300 guarantees to provide only data 410 from such trusted sources as authentication data of the authentication files 310. In this case, the data records transmitted by the fourth computer system 400, for example, identify their own validity period and / or their scope. That the corresponding authentication data 410 actually originates from the fourth computer system 400 can be ensured, for example, by a signature of the fourth computer system 400 or by transmission via a cryptographically protected communication channel, during the establishment of which the fourth computer system 400 is authenticated by the third computer system 300.

[0086] The fourth computer system 400 comprises a memory 402 with authentication data 410 for authenticating the first computer system 100, as well as a processor 414 and a communication interface 418 for communicating with the third computer system 300 via the network 150. The memory 402 further provides program instructions 412, which are executed by the processor 414 and cause the computer system 400 to provide the third computer system 300 with authentication data 410 for authenticating the first computer system 100 to the second computer system 200. The corresponding method comprises sending the authentication data 410 for authenticating the first computer system 100 to the third computer system 300. The sending of the authentication data 410 can occur, for example, in response to a request from the third computer system 300.Alternatively, the transmission may occur upon a request from the first computer system 100 to the fourth computer system to provide the corresponding authentication data for use by the third computer system 300. In the course of this method, the processor 414 executes a cryptographic protocol 416 to cryptographically secure the authentication data 410 sent to the third computer system 300.

[0087] The Figures 3A and 3B show two exemplary embodiments of modified certificates 112 for cryptographically secured communication between two computer systems, for example by establishing a cryptographically secured connection between these computer systems. Figure 3AThe certificate 112 shown comprises the following information: Information 120 about the issuer of the certificate 112, i.e. the certification authority that signed the certificate 112. This information 120 can be, for example, a name or another unique designation or another unique identifier. Information 122 about the rules and procedures in accordance with which the certificate 112 was issued, as well as, for example, a version number, serial number and / or algorithm ID. Information about the validity period 124 of the certificate 112, such as a start date and an end date of validity. A public key 105 about which the certificate 112 provides information or which the certificate 112 links to the owner of the certificate 112. Furthermore, information about the permissible scope of application and validity of the public key 105 can be included.Rudimentary owner information 126, such as a "Distinguished Name" or an "Alternative Name," such as an email address or a DNS entry. A reference for identifying authentication data for authenticating the computer system to be authenticated, provided by the authenticating computer system. Finally, the certificate 112 includes a certificate signature 130, by which the certificate authority issuing the certificate confirms the authenticity and integrity of the information 105, 120, 122, 124, 126, 128 of the certificate 112. The issuer's digital signature 130 is formed, for example, by hashing the information 105, 120, 122, 124, 126, 128 of the certificate 112 and encrypting the resulting hash value with a private key of the certification authority.

[0088] The alternative embodiment of certificate 112 is described in Figure 3Bwhich is identical to the embodiment of certificate 112 in Figure 3A except for the fact that certificate 112 in Figure 3B except for the reference 125, it does not contain any information that could be used to identify or authenticate the owner of the certificate 112. In particular, the certificate 112 in Figure 3B no owner information 126. Rather, authentication data is provided exclusively by an authentication computer system.

[0089] Figure 4shows a flowchart of an embodiment of an exemplary method for authenticating a first computer system to a second computer system by a third computer system. For example, a cryptographically secured connection is established between the first and second computer systems using the TLS / SSL protocol. In block 500, the third computer system serving as a certification authority issues a certificate for the first computer system. In addition to cryptographic parameters, such as a public cryptographic key, for establishing a cryptographically secured connection between the first and second computer systems, the certificate includes a reference that identifies authentication data provided by the third computer system for authenticating the first computer system.Through the certificate signature, the certification authority confirms the authenticity and integrity of the cryptographic parameters provided by the certificate as well as the source of the authentication data identified by the reference. In block 502, the third computer system serving as the authentication computer system provides an authentication file with authentication data for authenticating the first computer system. In block 504, the third computer system receives a read request from the second computer system via a network to read the authentication data. The read request identifies the required authentication data using the reference from the certificate of the first computer system, which the second computer system previously received.In block 506, in response to receiving the read request in block 504, the third computer system sends the requested authentication data for authenticating the first computer system to the requesting second computer system over the network.

[0090] Figure 5 shows a flowchart of an embodiment of the exemplary method of Figure 4from the perspective of the second computer system. In block 600, the second computer system receives the certificate of the first computer system from the first computer system. In block 602, the second computer system checks the certificate signature of the received certificate. To do this, for example, the second computer system calculates a hash value for the entire content of the certificate and decrypts the certificate signature with a signature verification key, i.e., a public key of the certification authority. The two results are compared, and if they match, the certificate signature is recognized as valid. Thus, the authenticity and integrity of the data provided by the certificate are confirmed.

[0091] In block 604, the second computer system sends a read request over the network to the third computer system using a reference included in the certificate. The reference identifies the authentication data required by the third computer system to authenticate the first computer system. In block 606, the second computer system receives the authentication data identified by the reference in response to the sending of the read request in block 604. In block 608, the second computer system checks the received authentication data for its authenticity and integrity. For example, the authentication data is signed and / or encrypted with a private cryptographic key of the third computer system, which serves as an assertion key.Using the associated public cryptographic key of the third computer system, the signature of the authentication data can be verified by the second computer system and / or the encryption can be decrypted. In block 610, upon successful authentication of the first computer system by the second computer system, the cryptographically secured connection between the first and second computer systems is established using the cryptographic parameters provided by the certificate, e.g., a public key of the first computer system. The cryptographically secured connection is established, for example, using the TLS / SSL protocol. Reference symbol list

[0092] 100 first computer system 102 memory 104 protected memory area 105 public key 106 private key 112 certificate 114 processor 116 cryptographic protocol 118 communication interface 120 certificate issuer 122 issuance rules 124 validity period 126 owner 128 reference 130 certificate signature 150 network 200 second computer system 202 memory 214 processor 216 cryptographic protocol 218 communication interface 300 third computer system 302 memory 304 protected memory area 306 private key 308 private key 310 authentication files 312 program instructions 314 processor 316 cryptographic protocol 318 communication interface 400 fourth computer system 402 memory 410 Authentication data 412 Program instructions 414 Processor 416 Cryptographic protocol 418 Communication interface

Claims

1. A method for authenticating a first computer system (100) to a second computer system (200) for cryptographically secured communication between the two computer systems (100, 200), wherein the method comprises: • providing an authentication file containing authentication data for authentication of the first computer system (100), wherein the authentication file is provided by a third computer system (300), from which the authentication data are retrievable via a network (150), wherein a certificate (112) issued for the first computer system (100) comprises a reference (128) for identifying the authentication data for authentication of the first computer system (100), wherein the authenticity and integrity of the corresponding reference (128) are secured by the certificate signature (130) comprised by the certificate (112), and wherein the authentication data contain details relating to the holder of the certificate (112), • receiving, by the third computer system (300) via the network (150), a read request from the second computer system (200) for reading the authentication data, wherein the read request identifies the authentication data by using the reference (128), • in response to the receipt of the read request, sending the requested authentication data to the second computer system (200) by the third computer system (300) via the network (150) for authentication of the first computer system (100), wherein the certificate (112) further comprises a cryptographic parameter for establishing a cryptographically secured connection between the first and the second computer system (100, 200), wherein the method further comprises issuing a replacement certificate with altered cryptographic parameters for replacing the previous certificate (112) of the first computer system (100), whilst the authentication file is retained, unaltered, by the third computer system (300) for retrieval via the network (150).

2. The method according to claim 1, wherein the certificate (112), as cryptographic parameter, comprises a public cryptographic key (105) associated with the first computer system (100) for establishing a connection, cryptographically secured by means of encryption, between the first and the second computer system (200).

3. The method according to any one of the preceding claims, wherein the reference (128) comprises a network address under which the authentication data for authentication of the first computer system (100) are retrievable, and / or an identifier which identifies the authentication data to be retrieved for authentication of the first computer system (100).

4. The method according to any one of the preceding claims, wherein the authentication file comprises a plurality of datasets containing authentication data for authentication of the first computer system (100), wherein the datasets are each associated with different security stages for the authentication of the first computer system (100), wherein the third computer system (300), on the basis of the received read request, determines which security stage is to be satisfied for the authentication of the first computer system (100) and from which of the datasets the authentication data are to be sent to the second computer system (200) in response to the received read request.

5. The method according to claim 4, wherein the reference (128) identifies the security stage for the authentication of the first computer system (100).

6. The method according to any one of the preceding claims, wherein the authentication data are sent from the third computer system (300), signed, to the second computer system (200).

7. The method according to any one of the preceding claims, wherein the authentication data are sent from the third computer system (300), encrypted, to the second computer system (200).

8. The method according to any one of the preceding claims, wherein the third computer system (300) authenticates itself to the second computer system (200) by means of a challenge-response method.

9. The method according to any one of the preceding claims, wherein the method further comprises altering at least part of the authentication data for authentication of the first computer system (100) by the third computer system (300), whilst the certificate (112) issued for the first computer system (100) is retained in unaltered form.

10. The method according to any one of the preceding claims, wherein the method further comprises, by the third computer system (300), issuing the certificate (112) with the reference (128) for identifying the authentication data for authentication of the first computer system (100) and issuing the authentication file containing the corresponding authentication data for retrieval via the network (150).

11. The method according to any one of the preceding claims, wherein the certificate (112) of the first computer system (100) is provided with a limited duration of validity (124) and the method further comprises issuing an updated successor certificate with an updated duration of validity for replacement, whilst the authentication file is retained, unaltered, by the third computer system (300) for retrieval via the network (150).

12. The method according to any one of the preceding claims, wherein the method further comprises a blocking of the authentication of the first computer system (100), wherein the blocking of the authentication of the first computer system (100) comprises a replacement, by the third computer system (300), of the authentication data by a blocking instruction retrievable via the network (150), and wherein, in the event of blocking, in response to the receipt of the read request from the third computer system (300), the blocking instruction is sent via the network (150) to the second computer system (200).

13. An authentication computer system (300) for authentication of a first computer system (100) to a second computer system (200) for cryptographically secured communication between the first and the second computer systems (100, 200), wherein the authentication computer system (300) comprises a processor (314), communication interface (318) for communication via a network (150), and an electronic memory (302) containing machine-readable instructions (312), wherein execution of the machine-readable instructions (312) by the processor (314) prompts the authentication computer system (300) to carry out a method which comprises: • providing an authentication file (310) containing authentication data for authentication of the first computer system (100) by the authentication computer system (300), wherein the authentication data are retrievable via the network (150), wherein a certificate (112) issued for the first computer system (100) comprises a reference (128) for identifying the authentication data for authentication of the first computer system (100), wherein the authenticity and integrity of the corresponding reference (128) are secured by the certificate signature (130) comprised by the certificate (112), and wherein the authentication data contain details relating to the holder of the certificate (112), • receiving, by the authentication computer system (300) via the network (150), a read request from the second computer system (200) for reading the authentication data, wherein the read request identifies the authentication data by using the reference (128), • in response to the receipt of the read request, sending the requested authentication data to the second computer system (200) by the authentication computer system (300) via the network (150) for authentication of the first computer system (100), wherein the certificate (112) further comprises a cryptographic parameter for establishing a cryptographically secured connection between the first and the second computer system (100, 200), wherein the method further comprises issuing a replacement certificate with altered cryptographic parameters for replacing the previous certificate (112) of the first computer system (100), whilst the authentication file is retained, unaltered, by the third computer system (300) for retrieval via the network (150).