MICROCONTROLLER- OR MICROPROCESSOR-BASED SYSTEM WITH AUTHORIZATION CHECK FOR REQUESTS

Description

Technical area

[0001] The present presentations concern microcontroller- or microprocessor-based data processing systems and in particular the access control to their functionality by external systems. State of the art

[0002] Microprocessors, and especially microcontrollers, are critical components of most connected devices. These components support the implementation of millions of "end nodes" for the Internet of Things (IoT). The IoT refers to technologies of a global IT infrastructure that enables physical and virtual objects to be networked and collaborated using information and communication technologies. The Internet of Things describes the linking of uniquely identifiable physical objects (things) with a virtual representation in an internet-like structure. IoT end nodes can be very diverse elements, such as measuring devices, sensors, wearable devices, displays, and preprocessors, as well as complex devices, appliances, vehicles, and building components that combine multiple functions in a single device.IoT end nodes often require a small size and weight due to their function and / or use. For example, increasingly small embedded computers are often used to assist people without distracting or even attracting attention. For example, miniaturized computers, so-called wearables, with various sensors are being integrated directly into clothing.

[0003] Given the often small size of IoT end nodes, their computing power and / or storage capacity is also typically very limited. Furthermore, IoT end nodes are often battery-operated, requiring the use of very energy-efficient processors, which also comes at the expense of computing power.

[0004] When operating on the global internet, IoT devices must ensure the security of the often sensitive data stored on them. An IoT device must therefore be able to protect the sensitive data stored on it from attacks and only release it to authorized entities.

[0005] One problem here is that checking access rights often requires significant computational resources, which IoT end nodes typically don't have. IoT microcontrollers were designed for devices optimized for either low power or high performance, but not both.

[0006] This problem has steadily increased over the years, as the Internet of Things has grown in importance, making IoT endpoints vulnerable to various types of attacks. For example, attacks have already been observed on internet-enabled TVs, set-top boxes, baby monitors, surveillance cameras, and watches. These devices often ship with default passwords and their firmware is rarely updated, making them attractive targets for automated attacks from the internet. Once infected, they can be orchestrated similarly to botnet computers.

[0007] One specific form of attack, the Denial of Service (DoS), has proven particularly problematic. A DoS attack is defined as an attack on a computing unit using a large number of requests within a short time window, the goal of which is to render the computing unit unavailable due to overloading the data network or the computing unit's CPUs. A deliberate blockage of service caused by a large number of targeted requests is referred to as a Denial of Service attack, and if the requests are made from a large number of computers, it is referred to as a Distributed Denial of Service attack (DDoS). Because the requests originate from a multitude of sources in a DDoS attack, it is impossible to block the attacker without completely shutting down communication with the network.

[0008] DoS attacks are technically comparatively simple, as their goal is not to penetrate the IoT device, but rather to disable it. However, protecting against such attacks is particularly difficult for internet-enabled IoT devices, as disconnecting the network connection often results in a functional failure of the IoT end node. Furthermore, IoT end nodes are particularly vulnerable to DoS attacks due to their low computing capacity.

[0009] The published patent application DE102016221959 A1 discloses a method for controlling access to data records. It comprises linking a first owner certificate, which is assigned to a payload database, to a first user, and providing a first and a second interface. Via the first interface, the first user can create a second owner certificate for the payload database and link this to a second user to enable the second user to create data records in the payload database. Via the second interface, the second user who has created a data record in the payload database can create an access certificate and link it to the user certificate of a user who is to be granted access to this data record.The payload database grants the first user access to a data set created by the second user only if the first user is assigned both an owner certificate for the payload database and an access certificate for accessing the data set. Published patent application US2004215771 A1 discloses a method and apparatus for concealing a network device. In a preferred embodiment of the invention, a network client inserts a validation key into the SEQ and ACK fields of a TCP connection request (TCP-SYN). The TCP connection request is sent to a validating server. The validation server extracts the validation key and uses it, along with other implicit and explicit data contained in the TCP connection request, to validate the connection establishment request.If the connection request is validated, the validating server responds with a TCP SYN / ACK, as described in the TCP protocol specification. If the TCP connection request is denied, the request is discarded, and nothing is sent back to the requester, in this case, the network client. Technical problem and basic solutions

[0010] With familiar IoT devices and other forms of microcontroller- or microprocessor-based data management systems, the technical challenge is to grant only trusted individuals or devices access to sensitive data or functions of the device or system, while at the same time only limited computing capacity is available for the potentially complex access control. Furthermore, these scarce resources must be robust against DoS attacks.

[0011] Against this background, there is a need for improved microcontroller-based and microprocessor-based data processing systems and corresponding methods for controlling access to data or functions of such a system in such a way that the disadvantages mentioned above can thereby be at least partially avoided.

[0012] The invention is based on the object of creating an improved method for operating a microcontroller-based or microprocessor-based data processing system, as well as a corresponding data processing system.

[0013] The objects underlying the invention are achieved with the features of the independent patent claims. Embodiments of the invention are specified in the dependent claims. The embodiments listed below can be freely combined with one another, provided they are not mutually exclusive.

[0014] In one aspect, the invention relates to a data processing system, referred to here as a "data processing system." The data processing system comprises at least one computing unit embodied as a microprocessor and / or microcontroller, a non-volatile storage medium with one or more reference credentials, and an interface for receiving requests via a network. The network can, in particular, be the Internet. Each reference credential is in the form of a numerical data value.

[0015] The IT system is designed to perform the following procedure: Receiving a request via the interface from a requesting unit; checking whether the request contains an authorization credential that is identical to one of the reference authorization credentials by the at least one computing unit; if the check shows that the request does not contain this authorization credential, aborting the check without returning any response to the requesting unit, and disconnecting the network connection to the requesting unit by the IT system.

[0016] Embodiments of the invention can have the advantage that this initial check can be performed in a very resource-efficient manner. The reference authorization is a numeric value. A check for the identity of two values ​​can be performed by processors, and in particular microprocessors, in a highly efficient, resource-efficient manner. Thus, by comparing a value received with the request with several reference authorizations stored in the IT system, the IT system can identify attackers and a multitude of other unauthorized systems, because they are unaware of the reference authorization. Even a low-performance microprocessor can perform several of these numerical value comparisons in a short period of time.

[0017] Embodiments of the invention can also have the advantage that if the first check is negative, the IT system does not return a response, not even an error message. This can prevent a potential attacker from drawing conclusions about the authentication process based on the error message. In any case, the response informs the attacker that a IT system can actually be reached at the address used by the attacker. Because the IT system does not return any response, the attacker is left in the dark as to whether their attack has even hit a real IT system. This increases security because the attacker is deprived of the motivation and opportunity to examine the IT system's response more closely and adapt the next attack accordingly.

[0018] According to the invention, the IT system disconnects the network connection to the requesting unit if the check shows that the request does not contain this authorization credential. The network connection between the IT system and the requesting unit can, for example, exist at a higher level of the OSI model, in particular the application level.

[0019] The invention has the advantage that the connection termination ensures that, at least initially, no further requests can be sent from the requesting unit that could potentially contain malicious code. First, a network connection, e.g., an SSH connection or a connection using another data exchange protocol, must be re-established. For example, the IT system can be configured to only allow a renewed data transmission connection to the same requesting unit after a minimum time interval, e.g., 5 minutes or one hour. This ensures that the microprocessor or microcontroller of the IT system is not blocked by repeatedly closing and re-establishing a data exchange connection to the requesting unit.

[0020] For example, the IT system can be connected to other IT systems and / or the request unit via a network connection. The network connection can be implemented, for example, as a wireless connection. Additionally or alternatively, the network connection can also be established via Bluetooth Low Energy (BLE) and Wi-Fi.

[0021] According to embodiments of the invention, the data processing system is an embedded system.

[0022] An embedded system is an electronic computer that is integrated (embedded) into a technical context, whereby the computer either performs monitoring, control or regulation functions and / or is responsible for some form of data or signal processing. This data or signal processing can, for example, involve the encryption or decryption, coding or decoding or filtering of data, particularly measurement data. An embedded system can, for example, be a medical device, a household appliance such as a washing machine, a vehicle or aircraft, a television set, a router, a mobile phone or, in general, any consumer electronics device.

[0023] Embedded systems are often specifically adapted to a specific task. For cost reasons, an optimized, mixed hardware-software implementation is chosen. This design combines the great flexibility of software with the performance of hardware. The software serves both to control the system itself and to enable the system to interact with the outside world via defined interfaces or protocols (e.g., LIN bus, CAN bus, ZigBee for wireless communication, or IP over Ethernet).

[0024] According to embodiments, a plurality of otherwise autonomous, embedded systems are networked together to provide a complex overall system (e.g. in a vehicle or aircraft).

[0025] According to embodiments, the IT system further comprises a software- or hardware-based functionality. The IT system is configured to perform a further authorization check only if the check reveals that the request contains this authorization credential. The IT system is configured to execute the functionality only if the further authorization check reveals that the requesting entity is authorized to initiate the execution of the functionality.

[0026] A software-based functionality can, for example, be implemented in instructions executable by the at least one computing unit ("software"). For example, the software-based functionality can provide that the request unit receives data from the IT system, e.g. sensor data that one or more sensors of the IT system have recorded and stored locally, or a trained ML model that was trained on locally recorded data of the IT system, or a prediction that software of the IT system has calculated, e.g. based on data contained in the request and / or locally available on the IT system. The software-based functionality can also be the functionality to write data to the memory of the IT system. The data can, for example, be data contained in the request.For example, the data contained in the request may be a trained ML model of another IT system or of the request unit, where the request serves, for example, to synchronize several ML models between the IT systems and / or between the IT system and the request unit.

[0027] A hardware-based functionality can, for example, consist of the start of sensor data acquisition by a sensor of the IT system and / or a change in the state of a hardware component of the IT system or of an object controlled by it, initiated by the IT system. For example, the change in state can be a mechanical change, e.g., the opening of a gate, the closing of a locking system, etc.

[0028] Embodiments can have the advantage that the further check is only carried out if the first check showed that the authorization credential of the display is known to the IT system and is stored in the IT system in the form of an identical reference authorization credential. This saves the computing capacity of the IT system. While the first check only involved one or more comparisons of numerical values ​​for identity, the subsequent check can be quite complex and thus comparatively computationally intensive. However, since the further check is only carried out if the first check was already positive, this effort only arises for requests from request units that are reasonably likely to be sufficiently authorized to have the desired function performed by the IT system.This allows for a good compromise between the desire for low computing load on the one hand and the desire to carry out complex and correspondingly secure authentication procedures on the other.

[0029] According to embodiments of the invention, the IT system is configured to return results of the execution of the functionality to the request unit.

[0030] For example, measured values ​​recorded by a sensor of the IT system, predictions calculated by software of the IT system, results of a control command to open or close doors or gates can be returned to the request unit.

[0031] According to embodiments, the storage medium of the data processing system contains a payload database. The payload database contains multiple data records. Access to at least one of the data records is required to perform the function; in some embodiments, the storage medium can also contain multiple such payload databases.

[0032] The IT system's storage medium also includes an ID database. The ID database stores a variety of user certificates and access certificates.

[0033] A user certificate is a data value uniquely assigned to a user. For example, the user certificate can be a number or, preferably, a certificate issued by a certification authority, such as an X.509 certificate.

[0034] An access certificate is a numeric data value that grants a user a specific type of record access to records in the payload database by assigning this access certificate to their user certificate in the ID database.

[0035] Embodiments may be advantageous in that the separation of payload data and user certificates as well as associated access rights can enable very complex, flexible and fine-grained access rights management.

[0036] For example, a specific user or their user certificate in the ID database can be assigned three different access certificates in the form of three different numeric values. The first access certificate authorizes reading of records created by that user. The second access certificate authorizes writing to or modifying the record created by that user. And the third access certificate allows access to an index containing field values ​​of that record.

[0037] The further authorization check includes checking whether the request contains a user certificate that is assigned to one of the access certificates in the ID database, which authorizes the requesting unit to initiate the execution of the functionality. The IT system is configured to initiate the execution of this functionality only if the request contains such a user certificate.

[0038] Embodiments can be advantageous because the use of different access certificates for different types of access can enable highly fine-grained access management. For example, the IT system can distinguish between three different types of access rights, each of which can be configured as a unique numeric value. The type of access granted by the corresponding access certificate can be specified, for example, by the storage location or field of this access certificate in the ID database and / or in metadata of the access certificates and / or by numeric prefixes or suffixes.

[0039] According to embodiments, each of the reference credentials is one of the access certificates of the ID database.

[0040] For example, all access certificates can be configured as purely numeric values. Each user can be assigned as many unique numeric values ​​as access certificates throughout the IT system as there are access types that are to be individually permitted or denied. The use of numeric values ​​has the advantage that checking whether access rights exist can be performed very quickly and with minimal computational effort by comparing two numbers.

[0041] According to embodiments, the access certificate is selected from a group comprising: a read access certificate that allows a user to have read access to the at least one data record; a write access certificate that allows a user to have modifying access to the at least one data record; the write access can, for example, include deleting (DELETE) or changing (UPDATE) a data record; an index access certificate that allows a user to know the existence of the at least one data record in the payload database and to have read access to metadata of the at least one data record.

[0042] For example, an index access certificate allows a user or a requesting system to obtain a statistical evaluation of several data records, such as how many records in a payload database a particular user has read or write access to, or how many records in the payload field contain the words "calibration error."

[0043] A "user" can be a person, but also another IT system and / or the requesting unit, since such an IT system can be regarded as a "virtual user".

[0044] The use of several different types of access certificates for different types of access and the individual assignment of these certificate types to individual users in order to enable them to access the data created by a user can be advantageous, as this enables particularly fine-grained control of access to the data.

[0045] Depending on the implementation, the request includes a user certificate, referred to here as the request user certificate. The data records in the user database each contain the access certificate of the user who created the data record, as part of the data record in a separate field within the data record.

[0046] Preferably, the access certificates stored in the corresponding fields of the data record are pure numeric values, not complex x509 certificates. Metadata regarding validity and other aspects can be stored separately from the actual access certificate in the ID database. Preferably, each data record created by a specific user in a payload database contains, in its corresponding fields, all access certificates of the user creating this data record. For example, if a data record DS is created by user (e.g., user, local process, or external IT system) "U1," and user U1 has exactly three types of certificates according to the contents of the ID database (a read access certificate "U1.Z-Cert[R]," a write access certificate "U1.Z-Cert[W]," and an index access certificate "U1.Z-Zert[S]"), copies of exactly these three access certificates are created during the storage of the DS data set from the ID database and stored in the corresponding fields of the DS data set. If user U1 now grants another user U2 read rights to the DS data set, this means that an assignment of this read access certificate "U1.Z-Zert[R]" of user U1 and the user certificate of user U2 is stored in the ID database. If the user (e.g., user, local process, or external IT system) "U2" now wishes to access the DS data set at a later time, the payload database containing the DS data set automatically sends an authorization request to the ID database in response to the access request from user U2, along with the access rights of the creator U1 stored in the DS data set.The ID database then checks whether a user certificate assigned to user U2 is stored in the ID database linked to one or more of the access rights of the creator U1 stored in the data set DS. Only if this is the case is the user U1 permitted to access the data set.

[0047] According to embodiments, the at least one access certificate, which is preferably stored as part of the created data set, comprises multiple access certificates for different access types. The multiple access certificates include, for example, a write access certificate Z.Zert_U2[W] of the creating user, and / or a read access certificate Z.Zert_U2[R] of the creating user, and / or an index access certificate Z.Zert_U2[S].

[0048] According to embodiments, the checking and / or management of access authorizations, e.g. the generation and checking of user certificates, owner certificates, access certificates and / or corresponding chain objects, is implemented by an access management system instantiated on the IT system, which can be designed, e.g., as an access management program.

[0049] According to embodiments of the invention, the access management system automatically generates an index structure for each access type from the access certificates of all data records that specify this access type. For example, a first index can be created for the write access certificates, a second index for the read access certificates, a third index for the index access certificates, and another index for the payload data itself. In response to a database query from a user accessing one or more of the access certificate indices created for the payload data database, the access management system checks whether the user is assigned an index access certificate (Z.Zert_U2[S]), which allows a user to know the existence of the data record in the payload data database and to read access to the data record's metadata.This verification can be performed, in particular, by the payload database in interaction with the ID database and, if applicable, other modules, such as the ID management module. The payload database allows the requesting user to use one or more indices to execute the database query only if the requesting user has been assigned the index access certificate.

[0050] This can be advantageous because the index allows for a quick query of access authorization statistics for a database's records for several different users. This then reveals, for example, which of the users registered with the access management system has read, write, and / or index access rights for which records. However, a query enabled by the index access certificate only provides statistical information about several records; read or write access to the payload data of the records is not included in the rights granted by an index access certificate.

[0051] Embodiments may have the advantage that the access certificate can be indexed separately from the other payload data, so that the index allows for a quick search for records created by a specific user.

[0052] A plurality of access authorization chain objects are stored in the ID database. Each access authorization chain object contains one of the access certificates and one or more of the user certificates. The sequence of user certificates in the access authorization chain object reflects the sequence of users who have assigned this access certificate to another user whose user certificate is contained in the access authorization chain object. The sequence of user certificates in the access authorization chain object indicates the sequence of granting the right specified in the access certificate, starting from the user represented by the first user certificate in the access authorization chain object.

[0053] The further authorization check includes a check as to whether an access authorization chain object exists in the ID database that contains an access certificate that is identical to the credential contained in the request, whereby this access authorization chain object assigns this access certificate to the request user certificate directly or via a chain of one or more further user certificates, whereby this assignment proves the granting of the right specified in the access certificate to the request user represented by the request user certificate.

[0054] Further authorization checks only result in the query unit being authorized to initiate the execution of the functionality if the ID database contains an access authorization chain object.

[0055] Embodiments of the invention may have the advantage that individual users or IT systems can be given the opportunity to grant access rights to their own (self-created) data records to other users in a delegable or non-delegable form by means of access authorization chain objects.

[0056] According to embodiments, the execution of the functionality involves creating one or more new data records in the payload database. An owner certificate is assigned to the payload database. The owner certificate in the ID database is assigned to a user certificate of a user. An owner certificate is a certificate that is assigned to one or more payload databases and grants each user to whom it is assigned the right to create data records in this payload database.

[0057] The further authorization check includes a check as to whether the request contains a user certificate that is assigned in the ID database to the owner certificate of the payload database, whereby the further authorization check only shows that the request unit is authorized to initiate the execution of the functionality if this is the case.

[0058] This can be advantageous because every user or IT system assigned a user certificate in the ID database, even at the lowest "rights level," gains full control over the data records they create in the payload database. Even if another user, e.g., another IT system, must first grant the user to whom the IT system is assigned an owner certificate to create data in a payload database, this does not mean that they automatically have read or manipulate access to the data created by this user. This greatly increases data protection, because the user or external IT system generating the data may be external systems that are not fully trusted.For example, the first owner certificate for a payload database can be issued to an owner of the IT system, who then issues further owner certificates to the personnel entrusted with the technical maintenance of the IT system and / or to an external IT system. However, this does not automatically mean that this owner can read the data that the technical personnel or the external IT system then creates in this payload database. Rather, this is only possible if a user who creates a specific data record explicitly assigns one or more access rights to the owner regarding the data records created by this user. In an advantageous aspect, some embodiments can therefore ensure a high degree of data protection because two independent parameters are checked before access is granted (both regarding ownership and access authorization).

[0059] In a further aspect, embodiments of the invention can ensure that technical administrators who, for example, provide and administer the IT system do not have special access rights with regard to access rights to the information stored in these databases.

[0060] According to embodiments, the payload data database of the IT system is free of access authorization chain objects and the data records of the payload data database contain, in addition to the payload data, only the access certificates that grant the user who created this data record access to this data record.

[0061] According to embodiments, the ID database is configured to generate authorization tokens for a requesting user (e.g., for a requesting IT system to which a user certificate is assigned) upon request. The payload database is configured to verify authorization based on the authorization token.

[0062] Embodiments can have the advantage that the separation of user data storage in one database and the storage of access and user certificates in another database, combined with the issuance and verification of authorization tokens in the interaction of the two databases, enables very fine-grained access control. The associated computing operations are only performed during the further authorization check, i.e., only after the initial check has been successfully completed. Furthermore, embodiments can have the advantage that user data can be exported to other IT systems without transferring the entire access rights management used in a specific IT system, which is essentially stored in the ID database, to the other IT system, so that each IT system can continue to maintain its own rights management.

[0063] According to embodiments, the request comprises an access request from a request user (request unit or a user to whom it is assigned) to a data record created by a creator user in the payload database. The IT system is configured to: Determining the access certificates of the creator user (i.e. a user or IT system that initially created this data record and stored it in the payload database), which are stored in the payload database as part of the one data record, by the payload database; sending the request user certificate assigned to the user of the request unit and the determined access certificates to the ID database; in response to receiving the request user certificate and the determined access certificates, generating an authorization token by the ID database, wherein the authorization token indicates whether the request user is assigned to the one data record by at least one of the access authorization chain objects; transmitting the authorization token from the ID database to the payload database;Checking, by the payload database, based on the authorization token, whether the requesting user has been assigned the necessary access rights in the form of access certificates with regard to the one data set; ;

[0064] The payload database is configured to grant the requesting user access to the one data set only to the extent of the access certificates assigned to the requesting user in the authorization token.

[0065] In some embodiments, the presence of an owner certificate is also included in the check. For example, the request includes an access request from a request user to a data record created by a creator user in the payload database. The IT system is configured to: Determining the access certificates of the creator user (i.e., a user or IT system that initially created this data record and stored it in the payload database) that are stored in the payload database as part of the one data record, by the payload database; sending the request user certificate assigned to the user of the request unit and the determined access certificates to the ID database; in response to receiving the request user certificate and the determined access certificates, generating an authorization token by the ID database, wherein the authorization token indicates whether the request user is assigned to an owner certificate of the payload database by at least one of the ownership authorization chain objects and whether the request user is assigned to the one data record by at least one of the access authorization chain objects;Transmission of the authorization token from the ID database to the payload database; checking, by the payload database, based on the authorization token, whether the requesting user is assigned an owner certificate for the payload database and whether the requesting user is assigned the necessary access rights in the form of access certificates with regard to the one data set; ;

[0066] The payload database is configured to allow the requesting user to establish a database connection to the payload database only if the requesting user is assigned an owner certificate for the payload database and to allow the requesting user access to the data record only to the extent that the access certificates assigned to the requesting user in the authorization token grant the requesting user.

[0067] This can be advantageous, as a user who does not have an owner certificate is denied access to the database from the outset. This provides a simple global way to ensure (e.g., by revoking the owner certificate) that a specific user (or specific local process, external IT system, or query unit) can no longer access any data in a specific user data database, without requiring a large number of users who have granted this user access rights to the data they have created to revoke access rights individually from this one user. By assigning or revoking (e.g., invalidating or refusing to reissue a certificate after the expiration of a current owner certificate (typical validity period, e.g.,within a few days, weeks or months)) a relatively extensive, globally well-controlled access protection can be provided for all data stored in a database.

[0068] For example, the request may be to predict and return a future technical parameter value. The dataset to which access is requested may, for example, be a machine learning model that has learned, through a training process on local training data, to predict this future parameter value based on other parameter values. For example, the parameter value to be predicted could be the expected time when a specific component functioning as a data processing system needs to be replaced due to material fatigue, whereby the parameter values ​​on which this prediction is based are current vibration parameter values ​​recorded by sensors of this component.

[0069] According to embodiments, each of the owner certificates includes a delegability parameter, which can take either the data value "DELEGABLE" or the data value "NOT DELEGABLE". A program logic used to create the owner certificates, e.g., an ID management module, is configured to A user assigned an owner certificate for the payload database who creates an owner certificate for another user for this payload database can set the delegability parameter of the created owner certificate to "NOT DELEGABLE" regardless of the delegability parameter of the owner certificate assigned to them, but can only set the delegability parameter of the created owner certificate to "DELEGABLE" if the delegability parameter of their owner certificate has the value "DELEGABLE"; and a user assigned an owner certificate for a payload database whose delegability parameter has the value "NOT DELEGABLE" cannot create further owner certificates for other users for this payload database.

[0070] According to alternative embodiments, a data object that assigns an owner certificate to a specific user or that assigns the owner certificate to a chain of two or more users who have assigned themselves the owner right contains the delegability parameter. Such an object, also referred to below as an ownership authorization chain object, can be created, for example, in the form of a new copy and stored in the ID database as soon as a chain of users who have assigned themselves the owner right for a payload database is extended by a chain link (e.g., another user certificate). The delegability parameter can assume either the data value "DELEGABLE" or the data value "NOT DELEGABLE."

[0071] Embodiments can have the advantage of enabling a high degree of dynamism and flexibility with regard to the allocation of access rights: typically, a specific user, for example, the managing director, is assigned an owner certificate for a specific payload database. This "first / initial" owner certificate preferably has the delegability parameter value "DELEGABLE." This user can then assign this first owner certificate, in an identical or modified copy, to one or more additional users via the first interface, so that these additional users also receive owner rights with regard to the payload database and can create data records.The owner of the first owner certificate can decide whether the owner certificates assigned to the other users for this payload database should also be delegable, meaning that these other users should also have the ability to grant owner rights to this payload database to other users. If a modified copy of the owner certificate is created for one or more additional users, which has the delegability parameter value "NOT DELEGABLE," the additional users can create a database connection to the payload database and create records there, but cannot issue further owner certificates for other users for this payload database.The chain of issued owner certificates therefore necessarily ends with the issuance of non-delegable owner certificates. It is, of course, possible for a specific user to be issued a delegable owner certificate by one database owner and a non-delegable owner certificate by another database owner. In this case, the user can issue further owner certificates for third parties. However, the chronological chain of users issuing an owner certificate is preferably stored, for example, in the form of authorization objects and / or log entries, so that the path of the chain of responsibility is documented. This chronological chain is preferably stored in a special database, hereinafter referred to as the "ID database." Similarly, the delegability parameter can be defined within an assignment object, e.g.of an ownership authorization chain object, and specify whether a user may create further assignment objects (further ownership authorization chain objects) to assign an owner certificate to other users).

[0072] According to embodiments, the ID database includes a private signing key. The payload database includes a public signature verification key, which is designed to verify the signatures created with the signing key. The IT system is configured to: Signing of the authorization token by the ID database with the signing key, whereby the authorization token is transmitted in signed form to the payload database; and checking, by the payload database using the signature verification key, whether the signature of the authorization token is valid, whereby the establishment of the database connection between the request unit and the payload database and data record access are only permitted if the signature is valid.

[0073] Embodiments may have the advantage that the payload database can use the signature to verify that an authorization token was actually generated by the ID database and not by an untrusted third party.

[0074] According to embodiments, the ID database of the IT system performs a certificate chain check during the generation of the authorization token containing one of the owner certificates to determine whether this owner certificate is verifiably integrated into the certificate chain of the user certificate to which this owner certificate is assigned in one of the owner authorization chain objects. The authorization token is only signed if a successful integration is determined.

[0075] Additionally or alternatively, during the generation of the authorization token containing one or more access certificates of a generating user (generator of a data set), the ID database performs a certificate chain check to determine for each of the user's access certificates whether this access certificate is verifiably integrated into the certificate chain of the user certificate to which this access certificate is assigned in one of the access authorization chain objects, whereby the authorization token is only signed if a successful integration is determined.

[0076] According to embodiments, the access management system provides a graphical user interface (GUI) that enables users of an organization to create additional owner certificates for other, manually selected users (e.g., IT systems) for a specific payload database, provided that the issuing user is assigned a corresponding owner certificate in the ID database. Additionally, this user interface can enable the user who created a specific data record to grant one or more other users manually selected via the GUI one or more selected access rights to this data record. For example, the GUI can graphically represent several people belonging to the organization in the form of a selectable list of people, so that a GUI user can specify the recipients of the owner and access rights to be granted by selecting one or more people from this list of people.Additional selectable GUI elements, such as radio buttons or checkboxes, can allow the GUI user to determine the delegability parameter of the issued access or owner certificate (delegable or non-delegable) by selecting this element, provided the user has sufficient authorization to do so. The GUI can also contain selectable GUI elements that allow a user to revoke access rights granted to other users. The GUI is configured to automatically create or invalidate new certificates and / or certificate assignments in the background based on the user's input via the GUI and to update the contents of the ID database accordingly.

[0077] According to embodiments, the one or more user data databases and the ID database are each a NoSQL database. Preferably, the NoSQL databases are each a so-called "structureless" database that supports a free definition of the type and number of data fields. Preferably, the NoSQL database is configured such that the content of all data fields of each new data record is automatically indexed and that changes to the database content are saved as new versions ("versioned database"). Preferably, the generation of new access and / or owner certificates, as well as the chronological sequence of users who have assigned these certificates to other users, is stored in a log (e.g., log file) of the ID database.

[0078] According to some embodiments, the access management system is a database system. However, it is also possible for the access management system to be implemented in the firmware or software of the microcontroller, in whose memory the certificates and authorization chain objects, as well as the program logic described here, can be implemented.

[0079] According to embodiments, the payload database and / or the ID database is a database of a NoSQL database system.

[0080] Depending on the embodiment, a first user is assigned to the IT system receiving the request, or the IT system itself is treated as the first (virtual) user. A first user certificate is assigned to the first user. The first user certificate can, for example, be a root certificate issued by a certification authority (CA). The first user certificate is verifiably integrated into a first certificate chain issued by a certification authority (i.e., it is verifiable up to the root certificate of the certification authority). This can be advantageous because certification authorities are already widely accepted as independent trust guarantors and are already used by many existing technical systems to verify the authenticity of certain users and user actions.

[0081] According to embodiments, the owner certificate for the first user, which certifies their ownership of the payload database, is created such that it is included in a first certificate chain and can be verified by the first user certificate. For example, the owner certificate is signed by the access management system using the private key of the first user certificate. Similarly, the first user can also sign copies of access certificates that grant other users (e.g., other IT systems or the requesting unit) access to the data records created by the first user with the private key of their user certificate (here, the first user certificate).

[0082] According to embodiments, a second user certificate is assigned to a second user (also called "request user", e.g. other IT systems or the request unit), wherein the second user certificate is verifiably included in a second certificate chain issued by a certification authority.

[0083] According to embodiments, the method comprises creating a third owner certificate by the second user and linking the third owner certificate to a third user to enable the third user to create data records in the payload database.

[0084] According to embodiments, access certificates or the access authorization chain objects, as already described for the owner certificates, are also created as delegable or non-delegable access certificates and assigned to other users, or the assignment itself, i.e., the access authorization chain objects, can be delegable or non-delegable. Thus, each creator of a data set and each holder of a delegable access certificate of another user who has created a data set can flexibly decide for themselves whether and to what extent they transfer access responsibility and related duties and activities to other users. This can be advantageous because it enables a high degree of flexibility and complexity in granting access.

[0085] According to embodiments, a plurality of user certificates, a plurality of access certificates, and a plurality of owner certificates are stored in an ID database. The method includes storing ownership authorization chain objects and / or access authorization chain objects in the ID database.

[0086] According to embodiments, each ownership authorization chain object is a data object that contains (and thereby associates) one of the owner certificates and one or more of the user certificates. The ordering of the user certificates in the ownership authorization chain object reflects the sequence of users who created this ownership certificate for other users whose user certificates are contained in the ownership authorization chain object.

[0087] Each access authorization chain object is a data object that contains (and thereby associates with) one of the access certificates and one or more of the user certificates. The ordering of the user certificates in the access authorization chain object reflects the sequence of users who have issued this access certificate to other users whose user certificates are contained in the access authorization chain object.

[0088] According to embodiments, the payload databases are free of access authorization chain objects and contain for each data record only the access certificates that grant access to the user who created that data record.

[0089] The linking of these access rights of the data record creator with one or more other users to grant them access to the data record is not stored in the payload database, but in the ID database. Conversely, the ID database does not contain any references to individual data records in the payload databases. This can be advantageous because it limits the size and complexity of the individual data records in the payload database and largely decouples them logically from the management of access rights. The size of the data records is also limited by not storing the entire chain of authorization transfers as part of the data records. This can significantly reduce the storage space required by the database, particularly when dealing with a large number of small data records with identical authorization structures.

[0090] According to embodiments, the ID database performs a certificate chain check during the generation of the authorization token containing one of the owner certificates. This is done to determine whether this owner certificate is verifiably integrated into the certificate chain of the user certificate to which this owner certificate is assigned in one of the owner authorization chain objects. The ID database only signs the authorization token if it determines that it has been successfully integrated into the certificate chain of the owner certificate. This certificate chain check can therefore be performed, in particular, along the certificate chain of the certification authority that issued the user certificate as the root certificate.Additionally or alternatively, when generating an authorization token containing one or more access certificates of a user for accessing data records created by that user, the ID database performs a certificate chain check to determine, for each of the user's access certificates, whether this access certificate is verifiably integrated into the certificate chain of the user certificate to which this access certificate is assigned in one of the access authorization chain objects. The ID database only signs the authorization token if successful integration is determined.

[0091] According to embodiments, the second user (e.g., the requesting unit or another external IT system) who created a specific data record in the payload database of the IT system, or a third user to whom one or more access certificates of the second database user are assigned via an access authorization chain object, creates a further access authorization chain object. In this further access authorization chain object, one or more access certificates of the creator (i.e., the second user) are assigned to the fourth user. The payload database is configured to check whether one or more of these access certificates are assigned to the fourth user before granting the fourth user access to the data record created by the second user.

[0092] According to one embodiment, each of the data records in the payload database is assigned one or more access certificates of the user creating the data record.

[0093] According to embodiments, the data records are stored in the payload database in a format that precludes extraction of the information contained in the data records without access via a database connection to the payload database. For example, the data records can be stored as binary objects or in encrypted form. Backups of the payload database are performed by the administrator user (i.e., the digital representation of a technical-administrative person without special access rights to the data records) or the access management system by copying the payload database to another storage medium. The administrator user does not have an owner certificate for this payload database.

[0094] This can be advantageous because, while the administrator user can still perform the typically assigned activities, such as creating backups, they can no longer access the contents of the user data stored in the database. This protects the organization from the administrator user's improper disclosure of sensitive data to third parties. According to embodiments of the invention, the administrator user of the access management system or IT system therefore has significantly fewer access rights than is the case in conventional IT systems.

[0095] According to embodiments, each or at least some of the data records in the payload database represent a software or hardware functionality that the IT system provides and / or controls. Only a user (e.g., requesting unit or other external IT system) who is assigned both an owner certificate of the payload database and an access certificate for accessing the function object is authorized by the access management system of the IT system receiving the request to perform the functionality or initiate the execution of the function. The function can be, for example, starting a device, activating or moving a hardware component, opening or closing a door for buildings, rooms, or vehicles, opening or closing other access barriers or locking devices for containers, or a specific software functionality.

[0096] Thus, the advantageous, flexible and fine-grained access control described above can be used not only to control access to data records, but also to control access to a variety of other functions, including hardware functionalities.

[0097] In a further unclaimed aspect, the invention relates to a distributed system. The distributed system comprises a plurality of computing systems according to one of the embodiments and examples described herein. Each of the computing systems includes a prediction program. Each of the prediction programs includes a machine learning (ML) model trained to calculate the same type of prediction. The trained models of the prediction programs are different. Each of the ML models includes pairs of associated inputs and outputs.

[0098] Each of the IT systems is configured to: Synchronization of the input-output pairs of the models such that each model contains the same set of input-output pairs after synchronization; input of input data to one of the prediction programs; and calculation of a prediction based on the input data by one prediction program using the synchronized model of that one prediction program.

[0099] In a further unclaimed aspect, the invention relates to a system comprising an infrastructure object and a monitoring system. The monitoring system can be operatively coupled to the infrastructure object and configured to log and / or control states of the infrastructure object via a network connection. The monitoring system is a data processing system according to one of the embodiments described here. The infrastructure object can in particular be a building, a power generation plant, a military installation, a device, a machine or a component of the aforementioned infrastructure objects. A monitoring system according to embodiments of the invention is a data processing system that performs monitoring functions with regard to a monitored physical object, e.g. an infrastructure object. Monitoring can consist of capturing state data of the monitored physical object, e.g.by means of a sensor of the monitoring system, and / or a change in the state of the monitored object, e.g. by means of a control unit of the IT system.

[0100] Embodiments may have the advantage that such a system or such a monitoring system is robust against DoS attacks.

[0101] The operational connectivity can, for example, consist in the IT system containing one or more sensors that, after a corresponding mechanical coupling or a purely software-based configuration, are designed to detect states, in particular performance and error parameters, of the infrastructure object. The operational connectivity can additionally or alternatively mean that the monitoring system has a control unit that is designed to cause the infrastructure object to execute one or more functions by generating and sending control commands to the infrastructure object. The coupling can therefore consist in establishing a communication connection for the exchange of measurement data and / or control commands.

[0102] In a further aspect, the invention relates to a method for operating a data processing system, referred to here as a data processing system. The method comprises: Provision of the DV system, wherein the DV system comprises: at least one computing unit embodied as a microprocessor and / or microcontroller, a non-volatile storage medium with one or more reference credentials, wherein each reference credential is embodied in the form of a numerical data value, and an interface for receiving requests via a network; receipt of a request via the interface from a request unit by the DV system; checking, by the at least one computing unit, whether the request contains a credential that is identical to one of the reference credentials; if the check shows that the request does not contain this credential, aborting the check by the DV system without returning a response of any kind to the request unit, and disconnecting the network connection to the request unit by the DV system.

[0103] Embodiments can have the advantage of enabling independent control and rights allocation with regard to two technical functionalities, namely a) the functionality of creating data records in a database and b) the functionality of accessing data records within the database. This enables highly flexible and fine-grained rights allocation. The initial owner of a database, e.g. technical personnel who manufactured the KV system or installed it at the customer's site, can freely determine which other users should be granted ownership rights. In a similar way, each user (or individual processes or modules of the IT system, e.g. individual sensors that have generated or recorded new data) is free to grant any other user (orlocal modules or processes or external IT systems) access rights to this data by assigning appropriate access rights, without superior persons and / or technical-administrative staff automatically having access to the created data.

[0104] According to embodiments, the method further comprises logging and / or controlling the states of an infrastructure object by the IT system via the network, e.g., the Internet. The infrastructure object can, in particular, be a building, a power generation plant, a military facility, a device, a machine, or a component of the aforementioned infrastructure object.

[0105] According to embodiments, the method is used to protect the IT system against denial-of-service attacks.

[0106] Under a "Data processing system"(Data processing system) is understood here to mean an electronic system designed to process data volumes with the aim of obtaining information about these data volumes or modifying these data volumes. In particular, the data processing system can be a digital computer based on one or more integrated circuits, in particular a microcontroller-based or microprocessor-based data processing system.

[0107] Under a "Chain object"is understood here as a data structure that contains multiple elements arranged in the data structure in a specific sequence ("chain") and thus assigned to the respective neighboring element(s). The assignment can be based purely on the positioning of the elements within the sequence as neighboring elements. In some embodiments, some or all of the elements consist of certificates, wherein the certificates within the sequence are assigned to one another not only based on their position but also because the certificates form a certificate chain that can be verified by a so-called certificate chain verification along the certificate sequence. The sequence of elements is preferably determined by a user, e.g., a human user or software, hardware, or a software- or hardware-based process that acts as the "user."For example, chain objects can contain a first element that represents a right, e.g., an access right (the first element can then be, for example, an access certificate) or an owner right (the first element can then be, for example, an ownership certificate). The chain object can also contain a sequence of further elements, e.g., elements that each represent a user (where these elements can be implemented as a user certificate, e.g., an X.509 certificate). The sequence of user certificates in the chain object represents the sequence of users who have each transferred the right represented in the first element belonging to them to another user. For example, an "access authorization chain object" is a chain object that represents an access right and a sequence of users who have each transferred this access right to one of the other users according to this sequence.For example, an "ownership authorization chain object" is a chain object that represents an owner right and a sequence of users who have transferred this owner right to one of the other users according to this sequence.

[0108] Under a "Request unit"is understood here to mean a physical object, e.g. a data processing system or software, which is configured to send a request to a data processing system via a network. The request can, for example, have the purpose of causing the data processing system to perform a specific software-based or hardware-based functionality. The request unit can be, for example, a standard computer or a microcontroller-based and / or microprocessor-based data processing system. The latter can be a data processing system according to embodiments of the invention, which in turn can receive requests from other data processing systems acting as a request unit and process them as described. Embodiments of the invention can have the advantage of providing a network of data processing systems that form a network of IoT end nodes, wherein each end node can dynamically act as a request unit and receiver for the requests of other data processing systems.For example, the network can be used to exchange measured values ​​recorded locally by the IT systems and / or to synchronize ML models obtained between the IT systems based on these measured values ​​during a local training process.

[0109] Under a "Proof of authorization" "Data value" refers to a data value, particularly a numeric data value, whose function is to identify the transmitting party of this data value to the recipient as authorized to perform a specific function or process (e.g., a further verification step) on the recipient's side. Preferably, this is a numeric value of sufficient length and complexity so that it cannot be easily guessed using a random generator in a few query cycles. For example, the numeric value can contain at least 5, preferably at least 8 digits.

[0110] According to embodiments, after receiving a minimum number of requests from the same request unit, all of which did not contain a valid authorization credential, the IT system blocks the request unit permanently or for a certain minimum period, e.g., a few minutes, a few hours, or a few days. Embodiments can have the advantage of effectively preventing random guessing of the authorization credential, e.g., using random generators.

[0111] Under a "Reference eligibility certificate"This refers to a data value, particularly a numeric data value, that is stored in a recipient IT system and that authorizes a transmitting party of a data value identical to this reference credential as authorized to initiate the execution of a specific function or process (e.g., a further verification step) on the recipient side. For example, reference credentials can be the sum of all access certificates that were assigned to these registered users during the registration of various users (e.g., IT systems) with the recipient IT system or at a later point in time, and that were stored in the recipient IT system.

[0112] A "microcontroller" (also µController, µC, MCU) refers to semiconductor chips that contain at least a processor and peripheral functions. These peripheral functions can include, for example, sensors, control units, CAN (Controller Area Network), LIN (Local Interconnect Network), USB (Universal Serial Bus), I2C (Inter-Integrated Circuit), SPI (Serial Peripheral Interface), serial or Ethernet interfaces, PWM outputs, LCD controllers and drivers, and analog-to-digital converters. Some microcontrollers also have programmable digital and / or analog or hybrid function blocks. In many cases, the main memory and program memory are located partially or entirely on the same chip. A microcontroller is a single-chip computer system. Some microcontrollers are also referred to as a system-on-a-chip, or SoC.Microcontrollers are designed to be customized in terms of performance and features for the specific application. Therefore, they have advantages over "conventional" computers in terms of cost and power consumption. Small microcontrollers are available in larger quantities for just a few cents.

[0113] Examples of microcontrollers currently or previously available on the market include the Intel 80186 (derived from the 8086), the XScale family (ARM), and ColdFire (MC680xx) from Freescale (formerly Motorola). A microcontroller can be based on 8-bit processors, for example, but there are also 4-, 16-, and 32-bit microcontrollers.

[0114] Under a "Microcontroller-based IT system" This refers to a data processing system whose functionality is based essentially or entirely on one or more microcontrollers.

[0115] Microcontrollers are sometimes used as part of a multi-chip module (MCM), where the MCM represents the computing system or forms an essential part of the computing system. For example, such MCM-based computing systems can be used to combine different semiconductor processes that are difficult or impossible to combine on a single chip. Examples include combinations of microcontrollers with high-frequency circuits for wireless connections (e.g., Atmel, Cypress, Microchip manufacture such MCMs), with power electronics (e.g., Freescale, ST), or with Flash ROM in its early days (e.g., Micronas Intermetall). The MCM solution is sometimes also used when existing chips are to be combined but the effort of a new design is to be avoided. Examples include combinations with network controllers or the connection drivers for networks (PHY) or LCD controllers.

[0116] In contrast, a data processing system according to embodiments can also be based on a "classic" microcontroller architecture, which was not conceived from the outset as a pure microprocessor system, but primarily aimed at control tasks. Such an architecture is characterized, for example, by the fact that it also enables single-chip operation entirely without external memory components, just as the CPU instruction set usually offers specialized instructions for controlling individual signal lines (using so-called bit manipulation). Such microcontroller-based data processing systems are often characterized by a very short interrupt latency, i.e., the time required by the controller to respond to an interrupt request from a signal source (timer, peripheral component, etc.). Typical examples of this type include the 8051 from Intel and the C166 from Siemens (now Infineon) and Infineon TriCore.To monitor the function of microcontroller controls, so-called watchdog circuits can be used, some of which are already integrated into the microcontroller.

[0117] Under a "Microprocessor" A microprocessor (also called a microprocessor) refers to a processor (typically on a very small scale) in which all of the processor's components are combined on a microchip (integrated circuit, IC). Additional components, such as peripheral components, can also be located outside the chip in a microprocessor-based IT system.

[0118] In some embodiments, the chip includes additional peripheral components in addition to the microprocessor. Such a chip with one or more microprocessors and one or more peripheral components (such as

[0119] Sensors and / or control units for chip-internal or chip-external functions) is called a microcontroller, also known as a "System-on-a-Chip (SoC)".

[0120] Under a "Microprocessor-based IT system" is understood here to be a data processing system that contains one or more microprocessors and uses these to control other components of the data processing system, such as sensors and / or control units for internal and / or external functions of the monitoring system.

[0121] Under a "embedded system"(also "embedded system") refers here to a microcontroller-based and / or microprocessor-based IT system that is integrated into a physical object with a specific function. For example, the IT system can be implemented in the form of an embedded system in a technical consumer product, vehicle, building components, machines, machine components, especially sensors or control units. Washing machines, chip cards (cash cards, telephone cards), entertainment electronics (video recorders, CD / DVD players, radios, televisions, remote controls), office electronics, Segways, motor vehicles (control units for e.g., ABS, airbags, engines, instrument clusters, ESP, etc.), mobile phones, and clocks and wristwatches are examples of embedded systems. Furthermore, embedded systems are included in virtually all computer peripherals (keyboards, mice, printers, monitors, scanners, and many more).

[0122] Under a "Infrastructure object"is understood here to be a physical object that is part of the infrastructure of a human collective (e.g. organization, company, village, city, nation, etc.). The physical object can be, for example, a building, building technology components, a power generation plant, a military facility, a device, a machine, a piece of equipment or a component of the aforementioned infrastructure objects. An infrastructure object typically implements one or more functions that are necessary or beneficial for the functioning of the respective infrastructure. This function can be, for example, control functions, monitoring functions, data exchange functions and other computation functions.

[0123] Under "Payroll data""User data" refers here to data that is relevant to a user, a workflow, or a hardware or software functionality outside of the access management system that contains it, and which does not serve to manage the access rights of different users of an access management system. User data can include, in particular, measured values, text, characters, images, and sounds.

[0124] One "NoSQL"A NoSQL database (English for Not only SQL) is a database that follows a non-relational approach and does not require fixed table schemas. NoSQL databases include, in particular, document-oriented databases such as Apache Jackrabbit, BaseX, CouchDB, IBM Notes, MongoDB; graph databases such as Neo4j, OrientDB, InfoGrid, HyperGraphDB, Core Data, DEX, AllegroGraph, and 4store; distributed ACID databases such as MySQL Cluster; key-value databases such as Chordless, Google BigTable, GT.M, InterSystems Caché, Membase, and Redis; sorted key-value stores; multivalue databases; object databases such as Db4o and ZODB; column-oriented databases; and temporal databases such as Cortex DB.

[0125] Under a "Access Management System"In the following, "access management system" refers to an electronic system or software for storing and retrieving data. For example, the access management system may be a "database management system" (DBMS). In some embodiments, the access management system is stored in a program memory of a data processing system. Preferably, the data in the access management system is stored consistently and permanently and efficiently made available to various application programs and users in a form that meets their needs. A database management system can typically contain one or more databases and manage the data records contained therein.

[0126] Under a "data set"In the following, "database" refers to a content-related set of data that is managed jointly by a database management system. A data record typically represents the smallest structural unit of the data set of a particular database.

[0127] Under a "Database" In the following, data is understood to mean a (typically large) amount of data that is managed in a computer system by an access management system according to certain criteria.

[0128] Under a "ID database" In the following, a database is understood as a database that contains and manages user-related information, such as user certificates, as well as rights assigned to these users in the form of additional certificates. In contrast to user data databases, which primarily serve to store user data, the ID database primarily serves to manage the ownership and access rights assigned to users with regard to the user data.

[0129] Under a "User" In the following, "digital representation" refers to the digital representation of a human person or a physical object, in particular a software program or a data processing system, in particular a microcontroller-based and / or microprocessor-based data processing system. For example, a user can send a request to a data processing system, whereby the further processing of the request by the data processing system may depend on whether the sending user is "known" to the receiving data processing system, i.e., whether the sending user is registered with the data processing system that receives the request. The digital representation can, for example, be registered with an access management system that is instantiated on this data processing system.

[0130] Under a "Certificate"In the following, a certificate is understood to mean a data value that represents a property (e.g., a user's identity) or a right (e.g., access right) and authenticates ("certifies") it to third parties. The certificate either contains the data required for its verification itself or is stored linked to certificate-related metadata, so that the data required for its verification can be obtained from the metadata.

[0131] A certificate can be a simple data value, especially a numeric value. In particular, an access certificate can be represented as a simple numeric value.

[0132] For example, the certificate can be configured as a numeric value to which metadata is assigned in the ID database. The use of numeric values ​​can be advantageous because they are easy to index and are not subject to variation due to slightly modified metadata. Preferably, the access certificates of individual users are configured as attribute certificates, specifically as numeric values. Attribute certificates do not contain a public key, but rather refer to a public-key certificate and define its scope more precisely.

[0133] Alternatively, a certificate can also be a more complex digital data set that confirms certain properties of users or other objects and makes its authenticity and integrity verifiable using cryptographic methods. The certificate can, for example, be designed according to the X.509 standard, i.e., it can contain a public key and confirm the identity of the holder as well as other properties of the certificate's public cryptographic key.

[0134] The certificate can be issued - e.g. in the case of user certificates - by an official certification authority, the Certification Authority (CA).

[0135] A certificate may, but does not necessarily have to, refer to a cryptographic key, but may generally contain data for verifying an electronic signature or be stored linked to this data.

[0136] Under a "Root certificate" The "root certificate" or "root certificate" is the certificate that represents the trust anchor of a PKI. Since the root certificate, and thus the entire certificate hierarchy, remains trustworthy only as long as its private key is known exclusively to the issuing party, protecting the root CA is of utmost importance.

[0137] According to some embodiments, the user certificate of the user who is at the top of the hierarchy of an organization represents the root certificate of that organization's PKI. The user certificates of all other members of that organization are signed by the private key of that root certificate and are thus dependent on it according to a certificate chain hierarchy.

[0138] Due to the high level of protection required for the root certificate, signature or encryption requests are automatically processed using subcertificates signed with the root certificate and with a shorter validity period (usually a few months to years) than the root certificate (which is generally valid for several years or decades). For example, the user certificates of other users and / or the owner certificates, access certificates, and / or attribute certificates issued or transferred by individual users may have a limited validity period of a few days or months. The validity of the subcertificates is chosen such that it can be considered unlikely that the private keys belonging to the subcertificates can be calculated within the selected validity period using currently available computing capacity.This creates a certificate chain, each of which references the signing certificate as the issuing authority. This chain is typically delivered as part of a certificate to enable verification of trustworthiness, validity, and any certificate revocation along the entire certificate chain.

[0139] An "owner" or "proprietor" is defined below as a user who, through the assignment of an owner certificate, has been granted the right to create records in a specific payload database and to establish a database connection with that database. According to the implementation, all owner certificates issued for the payload databases of the IT system are derived from the user certificate ("CEO certificate") of the user who holds the highest position within the organization operating the IT system. Derivation from this user certificate means that every copy of this owner certificate can be verified for validity via certificate chain verification, whereby the certificate chain used for the certificate chain verification includes the "CEO user certificate."

[0140] Under a with regard to a specific data set "authorized user"is understood below to mean a user who, by assigning an access certificate, has been granted the right to access a data set containing this access certificate in the manner specified in this access certificate or in metadata of this access certificate, provided that, optionally, any other necessary criteria, such as ownership of the database containing the data set, are met.

[0141] The use of ordinal numbers such as first, second, third, etc. serves solely to distinguish between elements and / or persons with otherwise identical names and is not intended to imply a specific order. Furthermore, elements and / or persons whose names differ solely by an ordinal number may be identical or different elements or persons, unless the specific context clearly indicates otherwise. Short description of the characters

[0142] Various embodiments of an inventive data processing system and a corresponding method for operating such a data processing system are illustrated in the following drawings. In the drawings: Figure 1 shows a block diagram of an embodiment of a data processing system according to the invention; Figure 2 shows a flowchart of an embodiment of a method according to the invention; Figure 3 shows a block diagram of a system with a critical infrastructure building according to an embodiment, which is controlled by a data processing system; Figure 4 shows a block diagram of a distributed system with multiple data processing systems according to an embodiment, which synchronize ML models of prediction programs;Figure 5 shows a block diagram of a data processing system with multiple databases, Figure 6 shows the process of creating authorization tokens for two users according to one embodiment, Figure 7 shows the process of granting access rights across a sequence of users, Figure 8 shows an example of user data that is part of a data set, Figure 9 shows two dynamically and independently generated hierarchies along which access rights and owner rights were assigned via a cascade of data processing systems, and Figure 10 shows a flow diagram of a method for transferring owner rights and access rights from one data processing system to another. Detailed description

[0143] Figure 1shows a block diagram of an embodiment of a data processing system 300 according to the invention. The data processing system 300 can be designed, in particular, as an end node of an IoT application, e.g., as a so-called "embedded system." The data processing system includes one or more input / output ports 308, via which the data processing system 300 can exchange data with one or more other data processing systems, for example, a request unit 328, via a network 326. The network 326 can, in particular, be an internet connection, which can be implemented, for example, via a mobile network or other telecommunications technologies.

[0144] For example, the DV system 300 can be used to continuously monitor the cooling water pump of a power plant and, in the event of a deviation in the pump performance that is greater than a predefined permissible maximum deviation, send a warning to higher-level systems and / or independently correct the problem by generating and sending corresponding control commands to the pump.

[0145] The IT system 300 includes at least one microcontroller 302, on which one or more microprocessors 304, a working memory 306, and a non-volatile program memory 310 are located. The program memory contains at least one or more reference credentials 312 in the form of numerical data values, as well as a test program 316. The test program 316 is designed to check requests that the IT system 300 receives via a network 326 and to answer or not answer them depending on the test result.

[0146] For example, another IT system 328, referred to here as request unit 328, can send a request 322 for read access to a specific data record 106 of the IT system 300 via the network 326 to the IT system 300. The request includes an authorization credential 324 in the form of a numeric data value.

[0147] The verification program 316 is configured to initially perform only an initial check in response to receiving the request 322. The first check consists of checking whether a numerical data value, referred to here as reference credential 312, is stored in the IT system 300 that is identical to the received credential 324. For example, the reference credential 312 can be stored within an ID database 136, and the data record 106 to which the access request refers can be stored within a payload database 102. Both the ID database 136 and the payload database can be stored in the program memory 310 of the microcontroller 302.

[0148] If this initial check reveals that the IT system 300 has not stored a value identical to the authorization credential 324, the IT system 300 does not respond to the request. In particular, it does not send an error message to the request unit 328, so a potential attacker does not receive any information about the IT system 300 in response to a request.

[0149] The test program 316 is configured to perform a further check only if the first check reveals that the IT system 300 has stored a value identical to the authorization credential 324. For example, the further check may be computationally significantly more complex and include a check to determine whether the request contains additional data values ​​that authorize the requesting system to perform the requested functionality or to read or write the requested data. Only if the further check also reveals that the requesting system has the appropriate rights does the IT system 300 execute the requested functionality 314. For example, the functionality 314 may consist of reading the requested data record 106 and returning it to the requesting unit via the network.

[0150] For example, the payload data database 102 can store the pump's performance figures (vibration parameter values, revolutions per minute, temperature, flow resistance, etc.) recorded continuously over a longer period of several years. The functionality 314 requested by the query unit in the query 322 can consist of the IT system 300 reading and returning the pump's performance figures recorded within a specific period, for example, the performance figures for the last month, or only those performance figures that were outside a specified standard range.

[0151] In other embodiments, however, functionality 314 may also consist of the IT system 300 sending a control command to the pump, causing the pump to stop or increase its activity. Such manipulations of important components of safety-critical infrastructure objects, such as power plants, must be securely protected from unauthorized access. Embodiments of the invention may be advantageous because they can provide a highly complex yet secure system and method for protecting such components from unauthorized access. At the same time, IT systems according to embodiments of the invention may also be advantageous because they can provide reliable protection against DOS attacks.

[0152] Figure 2 shows a flowchart of an embodiment of a method according to the invention for operating a microcontroller-based DV system, as described, for example, in Figure 1is shown.

[0153] In a first step 802, the microcontroller-based IT system and optionally additional IT systems are deployed. For example, the IT system may be an IoT end node connected to other IoT end nodes via a network and deployed together with the end node. For example, deployment may involve delivering the IT system to a customer or installing it at the customer's site.

[0154] In a next step 804, the IT system 300 receives a request 322 from a request unit 328. The request unit may be a trusted IT system that was deployed together with the IT system 300 and together with it forms an IoT. However, it may also be a device of an attacker whose goal is to penetrate the IT system or to disable its functionality through a DOS or DDOS attack.

[0155] To protect against such attacks, the IT system 300 performs an initial check in step 806, which can be performed very quickly and with minimal computational load. The initial check simply involves analyzing whether the request contains a credential 324 in the form of a numeric data value that is identical to a reference credential stored in the IT system 300.

[0156] If this is not the case, the IT system 300 aborts the check in step 808 without sending a response, error message, or other message to the requesting unit. Preferably, the network connection to the requesting unit is also interrupted, at least for a certain period of time. An attacker therefore receives no information about the IT system 300; ultimately, they don't even know whether the IT system 300 even exists.

[0157] However, if the first check results in a positive result, the IT system performs a further check in step 810. This check is more computationally intensive than the first check and includes, for example, the verification of additional characteristics using cryptographic methods and / or certificate chain verification. If this check results in the requesting entity not possessing the necessary rights to perform the requested function, the IT system can return an error message in step 814. For example, the IT system can assume that the requesting entity is trustworthy in itself, since the request did, after all, contain the authorization credential. However, there may be a misconfiguration, or the required additional rights may no longer be available due to the passage of time or an active withdrawal of rights.In this case, it may be useful to communicate the reason for the negative result of the further check to the requesting unit so that it can correct the error if necessary and, for example, have a new user certificate issued for the requesting unit.

[0158] If the further check is also positive, i.e., if the additional required rights are present, the IT system 300 enables a person or the requesting unit to perform the requested function in step 816. Alternatively, the IT system can also perform the function itself.

[0159] In a further optional step 818, the IT system returns the result of the function execution to the request unit. For example, the function may involve sending a control command to a machine or machine component, and the returned result includes a message that the control command was sent and implemented.

[0160] Figure 3 shows a block diagram of a system 340 that includes a safety-critical infrastructure object, e.g., a hospital 330, and one or more data processing systems 336, 300. The data processing system(s) are configured to monitor and / or control components of the infrastructure object, wherein the data processing systems are networked with each other and exchange data via requests.

[0161] In one example, a hospital building 330 contains several emergency power generators 334, 332, each of which is monitored and controlled by one of the networked data processing systems. In the event of a failure of the normal power supply, only one 332 of the two emergency power generators should be activated, the second 334 should only be activated if the first emergency power generator cannot be activated or fails. The two emergency power generators are each monitored by one of the data processing systems. To ensure that in the event of a failure of the normal power supply, the first emergency power generator 332 is activated first and only if the second emergency power generator 334 fails or cannot be activated, the first data processing system 300, which controls the first emergency power generator 332, continuously exchanges data with the second data processing system 336, which controls the second generator 334. For example, the first data processing system can, at regular intervals, e.g.once a second, send requests to the second computing system 336, with each request received from the second computing system 334 being processed in a . Figure 2If the first DV system 300 is classified as valid in the multi-stage test process shown, a "suppression function" is activated. This means that a "normally" functioning first DV system 300 actively suppresses the activation of the second DV system 336 and thus also the activation of the second emergency power generator 334. The successful function call here therefore suppresses the activation of the second emergency power generator. However, if the first DV system or the first emergency power generator 332 cannot be activated or fails during operation, the first DV system 300 can no longer send "suppression requests" to the second DV system 336. The second DV system is configured to send a control command to the second emergency power generator 334 via its control unit 344 if no suppression request is received for a certain minimum period of time. The control command leads to the activation of the generator 334.

[0162] This is just one example of how direct communication between IoT end nodes can be particularly advantageous, especially in the context of safety-critical infrastructure objects and emergency situations: if important components such as the normal power supply fail, central control of several components by a central computer may not be possible. The fact that the individual IT systems, which are preferably battery-operated and can therefore operate largely autonomously, communicate directly with one another makes the entire system considerably more robust. Using the multi-stage testing procedure described, embodiments of the invention can ensure that sensitive functions can only be triggered by authorized IT systems and / or that the interoperability of the IT systems does not come with the disadvantage of providing an easy target for DoS attacks.

[0163] Figure 4shows a block diagram of a distributed system 900 with multiple data processing systems 902.1, 902.2, 902.3, each of which is interconnected via a network, for example, the Internet. Each of the data processing systems includes a microcontroller with one or more microprocessors 904.1, 904.2, 904.3.

[0164] The IT systems can be essentially of the same or similar type. For example, the IT systems can each be so-called "smart speakers" with a built-in microphone, represented here as sensors 916.1, 916.2, and 916.3. Similar systems are commercially available from several manufacturers, for example, Amazon's Alexa or Medion P61110. The smart speakers can each have virtual AI assistants installed or simpler software products limited to solving specific individual tasks.

[0165] For example, each of the IT systems can contain a prediction program 906.1, 906.2, 906.3. Each of the prediction programs contains several modules and / or functions to perform different tasks. For example, each prediction program contains a statistical model 919.1, 919.2, 919.3, which can be used to solve a specific prediction problem. The statistical model can, in particular, be a predictive model that, as part of a training process based on training data, has learned to recognize statistical relationships and correlations within the training data and to store the knowledge thus learned in the model so that the model is able to calculate a reliable prediction based on new input data not contained in the training data set. The prediction programs 906.1, 906.2, 906.3 can therefore each contain various functions and in particular machine learning (ML) algorithms that can be used to train the model (also called ML model) during the training phase.

[0166] According to embodiments of the invention, each of the prediction programs also includes a module or function for continuously capturing and storing data used as training data 914.1, 914.2, 914.3 during the training process of the ML models. For example, the captured data can be voice inputs from various people 920, 922, 924, with the voice inputs each being captured by a microphone 916.1, 916.2, 916.3 of the respective IT system.

[0167] For example, each of the IT systems can be specifically assigned to a person. For example, IT system 902.1 can be located in the home of person 920, IT systems 902.2 in the home of person 922, and IT system 902.3 in the home of person 924. Over time, the various IT systems will therefore collect different training data depending on which speech inputs the individual people enter into their respective IT systems. The diversity of the speech inputs can, for example, relate to the content, i.e., the semantics of the words and sentences, but also to differences in the accentuation, pitch, dialect, or other characteristics of a particular person's pronunciation and voice. Which of these features are evaluated during the training process and used to train the model depends on the respective model and the prediction task it is to solve.

[0168] For example, the prediction problem may be the problem of calculating a correct translation of a natural language text input in a source language into a target language. For example, each of the persons 920, 922, 924 may be a translator who inputs the source text in the source language via a microphone and / or reads recorded dictation in the source language as a file via an appropriate interface, e.g., USB.

[0169] Each of the prediction programs can be a pre-trained, ML-based translation software used to translate the input text from the source language (e.g., German) into the target language (e.g., English). The translator then manually checks the translation calculated by the prediction program, makes corrections if necessary, and saves the correct translation of the input text in a data storage of the IT system such that the translation text is associated with the source text. For example, the stored data can contain additional data in addition to the source text and the correct translation, such as mappings of individual words and word sequences in the source language to the corresponding words and word sequences in the target language, which were calculated by the respective prediction program during the automatic translation.The mappings can be stored, for example, in the form of one or more tables 912.1, 912.2, and 912.3. These translation data and mappings, acquired over time, are stored locally as training data 914.1, 914.2, and 914.3.

[0170] According to embodiments, each of the IT systems regularly retrains its ML model 919.1, 919.2, 919.3 on the training dataset expanded due to the newly added translation data. This can have the advantage of increasing the quality of the ML model and thus the quality of the translations generated by it, because the more extensive the training dataset, the higher the quality of a predictive model trained on it.

[0171] According to preferred embodiments, each of the prediction programs includes a module 908.1, 908.2, 908.3 for synchronizing the training data and / or the trained model with the other prediction programs. For example, each of the IT systems can be registered in the form of a virtual user with a corresponding account in an ID database of the other IT system. Furthermore, each of the IT systems can store the training data locally acquired by them in the form of one or more data records in a payload database. Each of these data records can contain one or more access certificates.

[0172] The ID database of the respective IT systems can store user certificates, owner certificates, and / or access certificates, as well as corresponding chain objects that assign owner rights and / or access rights to individual users (and thus IT systems). During synchronization, each of the IT systems sends a synchronization request to each of the other IT systems, with the IT system acting as the recipient of this request being configured to perform a check of the request according to the embodiments of the invention described here. For example, the synchronization request includes at least one access certificate that authorizes read and / or write access to a specific data record of the recipient IT system. The access certificate is a simple numeric value, for example, "29347293892877172."Upon receiving the request, the receiving IT system first checks whether such a value exists in its ID database. Since this step only involves comparing a numeric number for identity, it can be performed very quickly.

[0173] If the receiving IT system does not know this value, no further check is performed and the request is not answered. According to embodiments, the receiving IT system interrupts the network connection to the sender IT system, at least for a certain period of time.

[0174] Only if a corresponding value is contained in the ID database does the receiving IT system perform further verification steps, which in particular include a complex check to determine whether the requesting IT system has the necessary rights to perform the requested access action on the data record or database. For example, a complex and computationally intensive certificate chain check may be performed during this additional check. For example, in addition to the credential "29347293892877172," the request may contain a user certificate issued by a certification authority (CA) for the sending IT system.

[0175] During further verification, the receiving IT system can identify an access authorization chain object within the ID database that assigns the access certificate "29347293892877172" to this user certificate via a chain of several additional user certificates. These additional user certificates represent users or IT systems that ultimately indirectly assigned the access right "29347293892877172" to the requesting IT system. The user certificates of these users or IT systems were issued, for example, by the same certification authority. Through the certificate chain verification, the receiving system can reliably verify whether the requesting IT system actually received its access right from users known to the receiving IT system and considered trustworthy, and who themselves had this access right.If the further check is also positive, the requesting IT system may synchronize the locally acquired training data and / or the locally trained and improved ML model with the local training data or the model of the receiving IT system.

[0176] Figure 5 shows a block diagram of a data processing system 100 with multiple user data databases 102 DB1, 104 DB2, and an ID database 136. The data processing system includes an access management system in the form of access management software configured to control the access of multiple users U1, U2, U3, ..., to multiple data records 112, 114, 116. Each of the users U1, U2, U3 represents a data processing system, e.g., the present data processing system 100 as well as external data processing systems.

[0177] For example, a first user U1 is assigned a user certificate 134. The user certificate 134 was issued by a certification authority 140 as a root certificate for the user U1. User U1 can, for example, represent the IT system 100; users U2 and U3 could each represent external IT systems that can send requests to the IT system 100 to read or create payload data in the payload database or to trigger the execution of a functionality associated with a payload data set. Similarly, the other IT systems could also be assigned user certificates 132 and 124, which were issued by the certification authority as root certificates. The user certificates 134, 132, and 124 can be verified by certificate chain verification up to the corresponding red certificate of the certification authority.

[0178] The first user U1 could, for example, be the IT system 100 itself or a technical administrator for the payload databases DB1, DB2 of the IT system 100. Accordingly, the first user U1 can be assigned an owner certificate 128 for the first payload database DB1. The assignment, also called a "link," can be implemented, for example, in the form of an authorization chain object 139 and stored in an ID database 136.

[0179] The access management system is thus configured to link a first owner certificate, for example, owner certificate 128 for DB1 or owner certificate 130 for DB2, to the first user U1. This can be done by storing the owner certificate 128 and the user certificate 134 of the first user U1 in an ownership authorization chain object 139 or by storing the owner certificate 130 and the user certificate 134 of the first user U1 in an ownership authorization chain object 141. An owner certificate is a certificate that is assigned to one or more user data databases and grants each user to whom it is linked the right to create data records in this user data database. For example, the owner certificate 128 grants each user to whom it is assigned (for example, through an ownership authorization chain object) the right to create one or more records in the database DB1.

[0180] The IT system 100 includes a first interface 142 that enables the first user U1, to whom the owner certificate 128 for the database DB1 is assigned, to create a second owner certificate for the payload database DB1 and to link this second owner certificate to a second user U2. This link to the second owner certificate enables the second user to create data records in the payload database DB1. The second user can also use this first interface, provided the second owner certificate is delegable according to its delegability parameter, to issue identical or modified copies of the owner certificate for the database DB1 to other trusted users and, in conjunction with a user certificate, to store these other users in the ID database, for example, in the form of additional ownership authorization chain objects 139, 141.

[0181] The IT system 100 includes a second interface 144 that enables the second user U2, who has created a data record 106, 108 in the payload database 102 (after having already been issued an owner certificate for DB1 by the first or another user), to create at least one access certificate and link it to the user certificate of a user who is to be granted access to this data record. The user who is to be granted access can be any other user (e.g., any other IT system) who is registered with the access management system and who is trusted by the second user (data record creator). The access certificates of the second user U2 can be, for example, a write access certificate Z.Zert_U2[W], a read access certificate Z.Zert_U2[R], and / or an index access certificate Z.Zert_U2[S].An access certificate can therefore specify a type of record access to the record created by the second user.

[0182] If the first user U1 now wants to access a data record 106, 108 that the second user U2 has created, the access management system checks the access authorization of the first user to a data record 106, 108 created by the second user. The desired access is only granted to the first user if the access management system determines that the first user U1 is assigned both an owner certificate for the payload database 102 and an access certificate Z.Zert U2 [W] (or [R] or [S]) for accessing the data record.

[0183] The individual data records 106, 108, 110, 112, 114, 116 contain only access certificates that the user who created the respective data record assigns to these data records during the creation process. For example, during the process of creating a new data record, the IT system 100 can automatically check in the background which access rights are stored in the ID database for the user who is currently creating a data record. This can be particularly advantageous if each user is assigned a predefined set of access certificates (for example, for read, write, and index access rights), which should also be automatically assigned in full to each newly created data record. This situation is Figure 5shown. Alternatively, it is also possible for each user to be assigned several different access certificates (of the same access type, for example, read access) in the ID database, and for the user to manually select which of these access certificates should be assigned to the new data record via a GUI during data record creation. This can be advantageous because the user can assign the same set of access certificates during creation for a large number of data records that they have access to and which, for example, have similar content or a similar level of confidentiality. However, if the user manages ten different credit cards, for example, and stores the confidential credit card numbers in ten different data records, the user also has the option of assigning a different access certificate to each of these data records.This has the advantage that the creator of each of these credit card number data records can selectively grant other users access only for a specific credit card number data record, i.e., without automatically granting the other users in question access rights to the other credit card data records. For the sake of simplicity, most of the embodiments and examples described here refer to a user being assigned three access certificates for read, write, and index access rights, which are automatically integrated into this data record when the user creates a data record. However, these examples should be understood to mean that, according to alternative embodiments and examples, the user who creates a data record can also manually select a specific subset from predefined access certificates assigned to them and integrate them into the created data record.

[0184] The Figure 5The data records shown show that, for example, data records 106, 108, and 112 were created by user U2. Data record 110 was created by user U1. Data record 116 was created by user U3. The predefined access certificates of the respective creators were integrated into the data records. At least the creators therefore have full access to their data records, provided they also have an owner certificate for the respective payload database. However, it is quite possible that other users have access to individual data records. This information, however, is not contained in the payload database, but is stored in the form of access authorization chain objects 143 in the ID database.For example, it is clear from object 143 that an access certificate of user U1, which specifies a read right, was assigned by the creator U1 to user U2 by linking the user certificate 132 of this user U2 within object 143 with the read access certificate of U1. Furthermore, it is clear from object 143 that user U2 transferred (passed on) this read right to another user U3 by linking the user certificate 124 of user U3 within object 143 with the read access certificate of U1. During the course of each transfer of an access right or, concomitantly, during the course of each assignment of a further user certificate to a specific access certificate, a new access authorization chain object is created in the ID database by the access management system. The human user is preferably offered an intuitive GUI in order to grant users access orTo transfer owner rights and thereby initiate the creation of additional certificates or additional links between access or owner certificates and user certificates in the background. The access authorization chain object 143 thus implies that both user U2 and user U3 (and, of course, user U1) have read access to the data records created by user U1, for example, data record 110.

[0185] Similarly, ownership authorization chain objects 139, 141 specify a chain of one or more users who have assigned owner certificates to other users and thereby transferred owner rights. For example, object 139 indicates that user U1 has owner rights with respect to the payload database DB1, since user certificate 134 of user U1 in object 139 is assigned to owner certificate 128 of DB1. Object 141 specifies that user U1 has transferred the owner rights for the database DB2 to another user U2.

[0186] If a user submits an access request to a specific payload database 102, the access management system 100 or a component thereof, for example, the database 102 in question, checks whether the user originating the request is assigned an owner certificate in the ID database. For example, this step could include analyzing all ownership authorization chain objects related to this payload database 102. Only if the requesting user has these owner rights will they be granted the establishment of a database connection to the payload database 102 and, if requested, the creation of new records in this database.However, in order for these users to be able to read or write to individual records, or to use an index to determine whether a particular record even exists, they must also be assigned the appropriate rights in the ID database (as is the case with a user certificate). The access management system therefore additionally checks whether the user has the required access rights before each access attempt by a user with ownership rights.

[0187] According to some embodiments (not shown here), each data record of a specific payload database has one or more additional fields for access certificates assigned to other users or functions (i.e., not specifically to the user who created the data record). For example, a payload database may be a database containing sensor data recorded by one or more sensors of the IT system. To increase security, each data record of the sensor measurement database may, for example, contain an additional field in which a sensor measurement type certificate is stored. For example, the IT system may contain several sensors of different types to record the current state of the IT system, which may, for example, be a device or a component. The sensors may include, for example, temperature sensors, vibration sensors, humidity sensors, turbine speed sensors, etc.If the payload database is a generic sensor database that includes the measured values ​​of all these sensors, each record in the sensor measurement database can contain an additional field in which a sensor type certificate is stored. Each record can contain multiple such fields, and for certain types of payload databases, the access management system can automatically store the corresponding access certificates in the fields when a new record is created. For example, when a new sensor measurement record is created for a temperature sensor, the access management system automatically inserts a temperature sensor certificate into the corresponding field.A user who wishes to access such a data set must therefore, in addition to the ownership rights to the sensor measurement database and in addition to the access authorization from the creator or a user authorized by them, also prove that they have been assigned a temperature sensor certificate. This can increase security, as it allows certain users to be denied access to certain data in a relatively generic and global manner, even if it can be assumed that they are not necessary for the user's work. For example, temperature data could be considered sensitive because it provides information about the environment in which the IT system was used, whereas the turbine speed only provides information about the condition of the turbine. Depending on the application scenario, it can therefore be advantageous for certain users orOther IT systems can only access certain measured values ​​that are considered less sensitive from a security perspective, but not others. This allows for very fine-grained rights management for IoT applications, while still not placing excessive strain on the microprocessors of the IT systems used as IoT end nodes.

[0188] Preferably, the entire set of access certificates of a data set is linked by one or more logical operators such as "AND" or "OR", resulting in a complex, logically connected expression that specifies which access certificates must be assigned to a user in order for that user to have access to a data set.The access certificates of a data set preferably include a mix of access certificates that are personally assigned to the creator of the data set and that must be personally assigned to other users to grant access, and access certificates that are automatically or manually assigned by the access management system or a human user to each data set of a specific payload database upon creation (e.g., a sensor-type-specific access certificate or a control object-specific access certificate, where a control object is a hardware-based or software-based unit controlled by a functionality of the IT system). These access certificates are also referred to as "attribute certificates."

[0189] Optionally, the individual authorization objects 139, 141, 143 can be signed with the private signature key 107 of the IT system 100 (which can be implemented, for example, as the signature key of the access management system instantiated thereon). Additionally or alternatively, authorization tokens that are dynamically created by the ID database for the requesting user in response to a user's access request (e.g., a request from the requesting unit) to a payload database can be signed (see description Fig. 6 ).

[0190] Figure 6illustrates the process of creating authorization tokens for two users U2, U3 according to a further embodiment of the method according to the invention. User U2 can be, for example, the request unit, and user U3 can be another data processing system, which can also send a request to data processing system 100 if necessary. The data processing system U2 and / or U3 can, for example, be configured essentially like the data processing system 300 according to Figure 1 that receives the request.

[0191] In the ID database, a plurality of users 202, each of which may, for example, represent a data processing system according to embodiments of the invention, are each assigned a user certificate 204. The user certificates are preferably issued by a certification authority 140 and signed with a private signing key 212 of the certification authority. The certification authority also provides a public signature verification key 210 (for example, via corresponding public key directories that are accessible via the Internet). This means that the ID database 136 can verify the validity of a user certificate by certificate chain verification, including the public signature verification key 210 of the certification authority. Identifiers 216 of several user data databases can be stored in the ID database, each of which, in turn, can be assigned one or more of its own certificates.Preferably, however, the ID database does not contain any payload data or references to individual records in payload databases.

[0192] If a user U2 requests access to data records stored in the user data database DB1, for example via a corresponding request to the IT system 300, 100, the IT system 100 automatically generates an authorization request for this user U2 (who, for example, represents a request unit) and sends it to the ID database. This database analyzes a set of authorization chain objects 137 to determine which owner certificates and access certificates are assigned to the user certificate 132 of the user U2 and, in response to this authorization request, dynamically creates an authorization token 220 for the user U2. This authorization verification indicates that the user U2 is assigned an owner certificate 128 for the database DB1, thus the user is authorized to establish a database connection to DB1.Furthermore, the authorization token indicates that user U2 is authorized to write to all data records created by user U1 (who, for example, represents the IT system 100 or 300).

[0193] For example, the authorization token can be divided into a connectivity credential 206 for the user U2 with regard to the creation of a database connection to DB1 and an access authorization credential with regard to a specific access type and with regard to all data records created by a specific user.

[0194] The authorization token 220 and / or the respective partial authorization tokens 206, 225 can contain a signature 237, 236 that was dynamically generated with the private signing key 107 of the ID database in response to the authorization request. Each of the payload databases contains a public signature verification key 105, which forms an asymmetric cryptographic key pair with the private signing key 107. Before the payload database DB1 allows the user U2 to establish a database connection and / or access individual data records, the validity of the signatures 237, 236 is checked in addition to the presence of the corresponding certificates, and the connection establishment or data record access is only permitted if the signature is valid.

[0195] Similarly, in response to an access request from user U3, the ID database generates and signs authorization token 222, which indicates that user U3 is authorized to establish a connection to database DB1. Furthermore, authorization tokens 226 and 242 indicate that user U3 has read and write access to the data records created by user U2 and is also permitted to perform an index query to determine whether a specific data record created by the user even exists. Furthermore, user U3 is permitted to perform a corresponding index query for data records created by user U1, but not to perform read or write access.

[0196] The fact that user U2 is only allowed to read and write user U1's records, but not via index access, is evident from the lack of a corresponding access certificate in a corresponding access authorization chain object. This absence is indicated by Box 228.

[0197] Boxes 229 and 230 indicate that user U3 is not permitted to read or write to the records of user U1. If a user in the ID database is not assigned access rights in the form of corresponding access certificates, the dynamically generated authorization token 220 and 222 will also not contain the corresponding rights.

[0198] Preferably, the dynamically generated authorization tokens 220, 222 do not contain the entire chain of user certificates of those users who have assigned corresponding owner certificates or access certificates to other users, but only the owner and access certificates assigned to the requesting user, and optionally also the user certificate of the requesting user. Documentation of the rights transmission chain is not relevant for proving authorization. Because the authorization tokens are free of the user certificates in the transmission chain, the size of the authorization tokens can be reduced, the process accelerated, and data traffic reduced.

[0199] Figure 7shows, by way of example, for four users 402, 420, 422, 438, each of which can represent a data processing system according to embodiments of the invention, a software program, a device, another IoT end node, or a natural person, which access certificates and user certificates can be assigned to these users in the ID database. For example, user 402 is assigned a user certificate 412. Furthermore, the user is assigned three access certificates for different types of access to the data records created by this user, namely access certificate 404 for read access, access certificate 406 for write access, and access certificate 408 for accessing one or more indices of a payload database to determine whether and how many data records this user has created in the payload database.In an analogous manner, the other users 420, 422, 438 are also assigned corresponding user certificates and access certificates.

[0200] Figure 7 also illustrates a possible sequence of transferring access rights across a chain of multiple users.

[0201] In a first step, the user 402 creates a data record 410 in a user data database DB1. During the creation process, in addition to the actual user data, such as Figure 7 shown, the three access certificates 404, 406, and 408, which are assigned to the creating user 402, are automatically stored in the background in the corresponding fields of the data record.

[0202] In a next step, the creator 402 transfers read rights to the record 410 (as well as to all other records created by the user 402 with this special read access certificate 404) to another user 420 using a GUI or other suitable interface. This means that the access management system in the ID database assigns this special read access certificate 404 to the user, for example, by storing this certificate 404 linked to the user certificate 414 of the user 420, for example, within the same access authorization chain object.

[0203] The creator of data record 410 can also grant access rights to another user. For example, in the next step, user 402 grants another user 422 (user certificate 418) read and write rights for all data records created by user 402 that contain certificates 404 and 406. The ID database or authorization chain objects are supplemented by a new access authorization chain object for each access certificate 404, 406 to be assigned to user certificate 418, which specifies that user 402 has assigned access certificates 404 and 406 to user 422. A copy of the assigned access certificate(s) can be stored in each of the newly generated access authorization chain objects, which differs from the original access certificate at least with regard to the value of a delegability parameter.This allows each user in the chain to control whether another user, to whom they grant certain rights, can pass these rights on or not. In the . Figure 6 In the example shown, user 422 was assigned access rights 404 and 406 in a delegable form. Alternatively, it is also possible to create only a single access authorization chain object, which contains both access certificates 404, 406 and the user certificate 418.

[0204] User 418 can therefore pass these rights on to others, which is illustrated in the next step: user 422 now assigns the access rights 404 and 406 assigned to him to user 438. This assignment results in the creation of a new access authorization chain object in the ID database for each of the access certificates 404, 406, in which the user certificate chain contained therein is extended by one link by appending another user certificate 436 of the user to whom the rights were assigned. According to an alternative implementation, for two or more access certificates linked to the same chain of user certificates, only one new access authorization chain object is created per rights transfer to another user. In the example of Figure 7bCertificates 404 and 406 would be stored in the same access authorization chain object, which also contains user certificates 418 and 436.

[0205] According to embodiments of the invention, the chain of user certificates documented in the authorization chain objects documents the transfer of ownership or access rights across a sequence of multiple users. The sequence can consist of a mere sequence of user certificates, where, for example, the position of the user certificates within the chain objects represents the chronological sequence of the transfers. Optionally, according to some embodiments, the chain of user certificates within an authorization chain object can be generated by the ID database using the private keys assigned to the individual user certificates in such a way that the last user certificate in the chain signs the new user certificate newly attached to it, thus enabling certificate chain verification within the chain of user certificates of the individual authorization chain objects.

[0206] Figure 8shows an example of payload data 500, which can be part of a data set 106, 108. The payload data is specified in JSON format. However, any other data format can also be used.

[0207] Figure 9 two hierarchies generated dynamically and independently by several users, along which access rights and owner rights were assigned via a cascade of users.

[0208] Thus, the Figure 9AThe hierarchy shown represents a cascade of access rights to one or more data sets created by DV system H. For example, DV system H represents a turbine containing several sensors for temperature and several sensors for vibration states, as well as a sensor for the current rotation speed of the turbine. Each of these sensors, as well as the control board of the turbine itself, can be implemented as a DV system according to embodiments of the invention, which can exchange data with all other DV systems after appropriate proof of authorization. For example, all sensors can write their measurement data to the user database of the controller board or DV system H after appropriate proof of write authorization, whereby the sensors each act as a request unit and must prove, based on a method according to embodiments of the invention, that they have the necessary write authorization.

[0209] For example, depending on the sensor type, the access right can include not only a write right [W] but also a read right [R] and index access [S]. The various access rights can be transferred to other IT systems, e.g., IT system H, using three different access certificates. For the initial authorization check, it is sufficient that at least one of the access certificates is present in the ID database of IT system H as a reference authorization. If this is the case, a further authorization check can be performed to determine whether further access certificates are present in the request and for which access types these certificates grant access rights.

[0210] For example, in the present case, IT system H has created a data set containing three access certificates for the three access rights mentioned (in the payload database). IT system H assigns these access rights to IT systems B and P via the three access certificates, with IT system P in turn passing these access rights to the data sets created by IT system H to IT system D. Thus, IT system D obtains its access rights to the data of IT system H via the "intermediary system" "P."

[0211] The Figure 9BThe hierarchy shown represents a cascade of owner rights to one or more user data databases DB1, DB2. The technical specialist (maintenance user) responsible for maintaining the turbine (DV system H) and other turbines (DV system A), for example, has owner certificates for both database DB1 and DB2. He transfers these owner rights in such a way that DV system H is assigned an owner certificate for database DB1 and DV system A is assigned an owner certificate for database DB2. DV system H, in turn, transfers ownership rights for database DB1 to DV systems B, P and D. Each DV system that is assigned an owner certificate for, for example, DB1 is thereby authorized to establish a database connection to the corresponding user data database and to create its own data records in this. In the present case, the IT system D has received ownership rights for the database DB1 via the IT system H from the maintenance user.The transfer of access rights via access certificates as in . Figure 9A and the transfer of owner rights via owner certificates as in Figure 9B represented take place along a chain of trust defined dynamically between human users and / or IT systems.

[0212] Figure 10shows a flowchart of a further embodiment of a method according to the invention for access control to data records 106, 108, 110, 112, 114, 116 of a plurality of user data databases of an access management system 100. In a first step 952 of the method, a first owner certificate 128, 13), which is assigned to a user data database 102, is linked to a first IT system U1. An owner certificate is a certificate that is assigned to one or more user data databases and that grants each IT system with which it is linked the right to create data records in this user data database. The linking can be performed, for example, manually by a human user via a GUI of the access management system of a IT system 100, which contains the user data database and the ID database, or automatically and implicitly by the access management system of this IT system, e.g.when an external IT system creates a new user data database within the system 100.

[0213] In a further step 954, a first interface 142 is provided, which enables the first IT system U1 to create a second owner certificate for the payload database 102 and to link this to a second IT system U2 in order to enable the second IT system U2 to create data records in the payload database 102. The first interface can be implemented, for example, in the form of a GUI, which has access to the ID database and stores the certificates created by the IT system and / or the assignment of owner certificates to other users created by a correspondingly authorized user in the form of owner and user certificate assignments in the ID database.

[0214] In a further step 956, a second interface 144 is provided, which enables the second IT system U2, which has created a data record 106, 108 in the payload database 102, to create at least one access certificate Z.Zert_U2[W], Z.Zert_U2[R], Z.Zert_U2[S], which specifies a type of data record access to the data record created by the second IT system, and to link it to the user certificate of a IT system that is to be granted access to this data record. The second interface can, for example, also be implemented in the form of a GUI or part of the aforementioned GUI. The access certificates and / or the assignment of access certificates to other IT systems created by a correspondingly authorized IT system in the form of access and user certificate assignments are stored in the ID database.

[0215] In response to an access request from the first IT system regarding the data records stored in the payload data database 102, the access management system checks in step 958 whether the first IT system has access authorization to a data record created by the second IT system, i.e., whether the first IT system has been assigned a corresponding access certificate for the data records created by the second IT system by the second IT system. The payload data database grants the first IT system access to the data records created by the second IT system only if the first IT system is assigned both an owner certificate for the payload data database 102 and an access certificate for accessing the data record in the ID database. List of reference symbols

[0216] 100 IT system 102 Payload database DB1 104 Payload database DB2 105 Public signature verification key 106 Data record 107 Private signing key 108 Data record 110 Data record 111 Signature 112 Data record 113 Signature 114 Data record 115 Signature 116 Data record 118 Delegate parameter 122 Authorization token 123 Certificate chain verification module 124 Third user certificate 125 Log 126 User 128 Owner certificate for database DB1 132 Second user certificate 134 First user certificate 136 ID database 137 Access and ownership authorization chain objects 138 Certificate chain 139 Ownership authorization chain object 140 Certification authority 141Ownership authorization chain object 142First interface 143Access authorization chain object 144Second interface 202Users, e.g. registered IT systems 204User certificates 206Connectivity authorization token for specific users and DB 208Signature of a private key of a certification authority 210Public signature verification key of aCertification authority 212Private signature key of the certification authority 214Trust center 216IDs of payload databases 220Authorization token for user U2 222Authorization token for user U3 225Access authorization token for specific user and data set 226Access authorization token for specific user and data set 227Connectivity authorization token for specific User and DB 228 Lack of [S] access right for user U2 regarding data created by user U1 229 Lack of [W] access right for user U3 regarding data created by user U1 230 Lack of [R] access right for user U3 regarding data created by user U1 232 [W] and [R] access rights of user U2 to data created by user U1 234 Access rights of user U3 to data created by users U1 and U2 236 Signature of authorization token 225 237 Signature of authorization token 206 238 Signature of authorization token 226 239 Signature of authorization token 227240Signature of authorization token 242 242Access authorization token for certain. User and Dataset 300 IT System 302 Microcontroller 304 Microprocessor(s) 306 Memory 308 Input / Output Ports 310 Non-Volatile Program Memory 312 Reference Credential 314 Hardware or Software Functionality 316 Test Program 318 Maintenance User 320 Attacker 322 Request 324 Credential within Request 326 Network 328 Request Unit 330 Hospital Building 332 Emergency Power Generator 334 Emergency Power Generator 336 IT System 340 System 402 User H 404-408 Access Certificates for Data Created by H 410 Dataset 412 User Certificate for User H 420 User B 424-428 Access Certificates for Data Created by B 414 User Certificate for User B 422User P 430-434Access certificates for data created by P 418User certificate for user P 436User D 440-444Access certificates for data created by D 438User certificate for user D 500Payload data 702ID management module 802-818Steps900Distributed system consisting of multiple computing systems 902Computer system 904Microprocessor 906Prediction program 908Model synchronization module 914Training data (collected by local sensor) 916Sensor 919Machine learning model 920-924User 952-958Steps

Claims

1. A data processing system (300, 902.1, 902.2, 902.3), herein referred to as DP system: - at least one computing unit, wherein the computing unit is configured as a microprocessor (304, 904.1, 904.2, 904.3) and / or microcontroller; - a non-volatile storage medium (310) with one or more reference credentials (312), wherein each reference credential is in the form of a numerical data value; - an interface (308) for receiving requests over a network; wherein the DP system is configured to: • receive (804) a request (322) via the interface from a request unit (328); • check (806) whether the request contains a credential (324) that is identical to one of the reference credential by the at least one computing unit; • if the check shows that the request does not contain this credential, terminate (808) the check without returning a response of any kind to the request unit, and disconnect (812) the network connection to the request unit by the DP system.

2. The DP system according to claim 1, wherein the DP system is an embedded system.

3. The DP system according to any one of the preceding claims, wherein the DP system further comprises: - a software or hardware-based functionality (314); wherein the DP system is configured to: - only if the check shows that the request contains this credential, perform (810) a further authorisation check by the at least one computing unit and execute (816) the functionality only if the further authorisation check shows that the request unit is authorised to initiate the execution of the functionality.

4. The DP system according to claim 3, wherein the storage medium of the DP system includes: - a first payload database (102, 104), wherein the payload database includes a plurality of data records (106, 108, 110, 112, 114, 116), wherein access to at least one of the data records is required to perform the function; - an ID database (136), wherein a plurality of user certificates (412, 414, 418, 436, 412, 414) and a plurality of access certificates (404, 406, 408, 424, 426, 444) are stored in the ID database, • wherein a user certificate is a data value uniquely assigned to a user, • wherein an access certificate (Z.Zert_U2[W], Z.Zert_U2[R], Z.Zert_U2[S]) is a numerical data value that grants a user a specific type of data record access to data records in the payload database by assigning this access certificate to the user's user certificate in the ID database; - wherein the further authorisation check comprises a check as to whether the request contains a user certificate to which, in the ID database, one of the access certificates is assigned which authorises the request unit to initiate the execution of the functionality, wherein the DP system is configured to initiate the execution of this functionality only if the request contains such a user certificate.

5. The DP system according to claim 4, wherein each of the reference credentials (312) is one of the access certificates of the ID database.

6. The DP system according to claim 4 or 5, wherein the access certificate is selected from a group comprising: - a read access certificate (Z.Zert_U2[R]), which enables a user to send access to the at least one data record; - a write access certificate (Z.Zert_U2[W]), which allows a user modifying access to at least one data record; - an index access certificate (Z.Zert_U2[S]), which enables a user to know the existence of the at least one data record in the payload database and read access to metadata of the at least one data record.

7. The DP system according to any one of claims 4-6, - wherein the request includes a user certificate, herein referred to as request user certificate, - wherein the data records of the payload database each contain the access certificate of the user who created the data record as part of the data record in a separate field of the data record; - wherein a plurality of access authorisation chain objects (143) are stored in the ID database (136), wherein each access authorisation chain object includes one of the access certificates and one or more of the user certificates, wherein the order of the user certificates in the access authorisation chain object reflects the sequence of users who have assigned that access certificate to a respective other user whose user certificate is included in the access authorisation chain object, wherein the order of the user certificates in the access authorisation chain object reflects the sequence of the granting of the right specified in the access certificate starting from the user represented by the first user certificate in the access authorisation chain object; - wherein the further authorisation check comprises a check as to whether, in the ID database, there exits an access authorisation chain object which contains an access certificate that is identical to the credential contained in the request, wherein this access authorisation chain object assigns this access certificate to the request user certificate directly or via a chain of one or more further user certificates, wherein this assignment confirms the granting of the right specified in the access certificate to the request user represented by the request user certificate, - wherein the further authorisation check only shows that the request unit is authorised to initiate the execution of the functionality if the ID database contains such an access authorisation chain object.

8. The DP system according to any one of claims 4-7, wherein the execution of the functionality comprises a generation of one or more new data records in the payload database, - wherein an owner certificate (128, 130) is assigned to the payload database, - wherein the owner certificate is assigned to a user certificate of a user (U1) in the ID database; - wherein an owner certificate is a certificate that is assigned to one or more payload databases and grants each user to whom it is assigned the right to create data records in this payload database, - wherein the further authorisation check comprises a check as to whether the request contains a user certificate which is assigned to the owner certificate of the payload database in the ID database, wherein only if this is the case will the further authorisation check show that the request unit is authorised to initiate the execution of the functionality.

9. The DP system according to claim 9, - wherein the payload database of the DP system is free of access authorisation chain objects and the data records of the payload database, in addition to the payload, only contain the access certificates that grant the user who created this data record access to this data record.

10. The DP system according to any one of preceding claims 4-9, wherein the request comprises an access request of a request user (U1) to a data record (108) created by a creator user (U2) in the payload database, wherein the DP system is configured to: - determine the access certificates (Z.Zert_U2[W], Z.Zert_U2[R], Z.Zert_U2[S]) of the creator user, which are stored in the payload database as part of the one data record (108), by the payload database; - send the request user certificate, which is assigned to the user of the request unit, and the determined access certificates to the ID database; - in response to receiving the request user certificate and the determined access certificates, generate a credential (220, 222) by the ID database, wherein the credential indicates whether the request user is assigned to the one data record (108) by at least one of the access authorisation chain objects; - transmit the credential from the ID database to the payload database; - check by the payload database, on the basis of the credential, whether the request user has been assigned the necessary access rights in the form of access certificates in relation to the data record (108) ; - wherein the payload database is configured to grant the request user access to the one data record only to the extent that the access certificates assigned to the request user in the credential grant said user access.

11. The DP system according to claim 10, wherein the ID database comprises a private signature key (107), wherein the payload database (102, 104) comprises a public signature verification key (105), which is configured to verify the signatures created with the signature key, wherein the DP system is configured to: - sign the credential by the ID database with the signature key, wherein the credential is transmitted in signed form to the payload database; and - check by the payload database using the signature verification key whether the signature of the credential is valid, wherein the establishment of the database connection between the request unit and the payload database and data record access is only permitted if the signature is valid.

12. A method for operating a data processing system (300, 902.1, 902.2, 902.3), referred to here as a DP system, said method comprising the steps of - providing the DP system, wherein the DP system comprises: at least one computing unit (304, 904.1, 904.2, 904.3), wherein the computing unit is configured as a microcontroller and / or microprocessor, a non-volatile storage medium (310) with one or more reference credentials (312), wherein each reference credential is in the form of a numerical data value, and an interface (308) for receiving requests over a network; - receiving (804) a request (322) via the interface from a request unit (328) by the DP system; - checking (806) whether the request contains a credential (324) that is identical to one of the reference credentials by the at least one computing unit; - if the check shows that the request does not contain this credential, terminating (808) the check by the DP system without returning a response of any kind to the request unit, and disconnecting (812) the network connection to the request unit by the DP system.

13. The method according to claim 12, - wherein the method is used to protect the DP system against denial-of-service attacks.