Data organization unit and data organization system for organizing data access authorizations

Abstract

The invention relates to a data organization unit (100) comprising: i) a memory unit for storing data access authorizations (D_Z) and a private key (K_P); and ii) a processor unit for: a) obtaining a data request (D_A) of a data-requesting unit (120) with respect to at least one item of data (D) of a data-providing unit (110), the data request (D_A) containing an encrypted session key (K_ES), b) validating a data access authorization of the data-requesting unit (120) on the basis of the stored data access authorizations (D_Z), and, if the data access authorization is provided: c) decrypting the encrypted session key (K_ES) by means of the stored private key (K_P), and d) providing a decrypted session key (K_DS) to the data-requesting unit (120).

Description

[0001] 202415403

[0002] 1

[0003] Description

[0004] Data organizational unit and data organizational system for organizing data access permissions

[0005] Technical field

[0006] The invention relates to a data organization unit for receiving a data request with an encrypted key from a data-requesting unit regarding at least one piece of data from a data-providing unit, validating the data access authorization of the data-requesting unit based on stored data access authorizations, and, if the data access authorization is granted, decrypting the encrypted key using a stored access key, and providing the decrypted key to the data-requesting unit. The invention further relates to a data organization system comprising the data organization unit and a method for organizing data.

[0007] The invention can therefore relate to the technical field of data organization, in particular data access rights.

[0008] Technical background

[0009] With increasing automation and digitalization, the quantity and value of data also rise (keyword: "Big Data"). The growing interest in data analysis and data analytics functions necessitates ever-increasing data from data analysts and devices. Consequently, vast amounts of data must be collected and made available. For example, axle counter devices in the rail vehicle sector provide a large number of data points (and datasets) that are requested, used, and analyzed by rail vehicle operators and their equipment.

[0010] However, data access permissions play an important role here; firstly, because data is also provided for monetization purposes, and secondly, because data ownership and related obligations are increasingly regulated by law (see, for example, the General Data Protection Regulation and the EU Data Protection Act). 202415403

[0011] 2

[0012] For monetization, it is helpful if access to features can be provided specifically, for example, through the licensing of specific functions. This allows the solution to be tailored to the customer's needs, ensuring the customer has all the features they require and only pays for those specific functionalities. Regarding data ownership, it is crucial to give users control over their data.

[0013] To make data available to an external system (for organizational purposes), strong guarantees regarding security and data usage are necessary. In other words, it can be crucial to specifically control which data is made available to whom. In particular, third-party access should only be licensed to specific data points, and access to all available data should explicitly not be granted. Due to security and technical concerns, much data is currently not made accessible (via a network) at all.

[0014] Summary of the invention

[0015] There may be a need to organize data access efficiently and securely. A data organizational unit, a data organizational system, and a procedure are described below.

[0016] According to a first aspect of the invention, a data organization unit (in particular a functionally / spatially independent unit) is described, comprising: i) a storage unit (or storage functionality) for storing data access authorizations (e.g., regarding data access authorizations of data-requesting units to specific data of a data-providing unit; e.g., in the form of a database) and (at least) one (access) key (in particular a private key); and ii) a processor unit (e.g., one or more processors, a control system, an integrated circuit, etc.) for: a) receiving a data request (e.g., to obtain specific data) from a data-requesting unit regarding at least one piece of data (e.g.,multiple data points or data sets) of a data-providing entity (where the requested data is stored at the data-providing entity), wherein the data request includes an encrypted key (in particular a session key, e.g. the requested data was provided by the data-providing entity 202415403.

[0017] 3. encrypted with a session key, which in turn was encrypted by a public key), b) Validating (verifying, authenticating) a data access authorization of the data-requesting entity based on the stored data access authorizations (in other words, the data organizational unit checks whether the data-requesting entity is authorized to receive the requested data from the data-providing entity), and, if the data access authorization is granted: c) Decrypting the encrypted key using the stored (access) (in particular, private) key, and d) Providing a decrypted key to the data-requesting entity (so that the data-requesting entity can open the data encrypted with the key).

[0018] According to a second aspect of the invention, a data organization system is described which comprises: a data organization unit as described above, and at least one data-providing unit (e.g. a data provider) and a data-requesting unit (e.g. a data consumer).

[0019] According to a third aspect of the invention, a method for organizing data using a data organization unit is described, comprising: i) receiving a data request from a data-requesting unit regarding at least one piece of data from a data-providing unit at the data organization unit, wherein the data request contains an encrypted key; ii) validating a data access authorization of the data-requesting unit using the data organization unit, and, if the data access authorization is granted: iii) decrypting the received encrypted key using an (access) key of the data organization unit; and iv) providing the decrypted key to the data-requesting unit.

[0020] According to a fourth aspect of the invention, a computer program product is described which has instructions which, when the program is executed by a computer, cause it to perform the method described above.

[0021] In the context of this document, the term "data organizational unit" or "data access organizational unit" can refer, in particular, to any functionality suitable for checking / verifying a data request from a data-requesting unit with regard to data access authorizations. Furthermore, the data- 202415403

[0022] 4

[0023] The organizational unit must be configured to provide a means of unlocking the data (specifically, an access key) upon successful verification. In this example, the data organizational unit serves to manage data access permissions and does not participate in the actual data transfer. A variety of implementations of the data organizational unit are possible, such as software / hardware-based, local, or cloud-based. In a simple example, the data organizational unit has storage functionality (for access permissions) and processing functionality (for verifying the request). In a more complex example, the data organizational unit can have multiple (geographically distributed) units used by different operators.

[0024] In the context of this document, the term "data access authorization" can refer specifically to the authorization of a data-requesting entity to open / use a particular data point or record from a data-providing entity. In light of new legal regulations such as the GDPR and the EU Data Protection Act, numerous aspects of data access authorizations arise that must be considered. Furthermore, certain data records may be freely available while others are licensed (for a limited time). To maintain an overview of all these aspects, a database of data access authorizations can be particularly useful, showing which entity has access to which data, when, and to what extent. Changes to these data access authorizations can then be made with corresponding flexibility.

[0025] According to an exemplary embodiment, the invention can be based on the idea that data access rights can be organized efficiently and securely if a data organization unit is provided, which is provided separately, and in particular independently, by a data-requesting unit and a data-providing unit. Preferably, the data organization unit itself is not involved in the data traffic or handles the requested data at any time, but only handles requests regarding access rights to this data. In this way, the data organization unit can receive a data request from the data-requesting unit and verify whether the data-requesting unit actually has access (and to what extent) to the requested data.

[0026] The data itself can be stored at the data-providing unit. Thus, the actual data exchange takes place between the data-providing unit and the data recipient. 202415403

[0027] 5. Requesting entity. The data-providing entity can make the encrypted data available to the data-requesting entity at any time and without further verification. However, the data-requesting entity can only decrypt this data once the data organizational unit, based on stored data access permissions, has determined that the data-requesting entity is authorized to access the data and provides a corresponding key.

[0028] In a preferred embodiment, the data is symmetrically encrypted by the data-providing unit in a computationally efficient manner using a session key. This session key can then be further encrypted in a more secure and complex manner, which can only be recovered by the data organization unit. For this latter step, asymmetric encryption using a public / private key of the data organization unit is particularly suitable.

[0029] The data organizational unit enables particularly efficient and flexible data management. For example, data access permissions can be changed quickly and easily, such as to adapt to new licensing terms. In one example, a data provider can precisely control which data is made available to which data consumer, either on-premises or in the cloud. In another example, the functionality of a product (a data-requesting unit) can be restricted based on data access permissions (e.g., licensing of data points), for example, granting access only to volume values. In yet another example, specific data accessible via an API can be directly licensed to third parties, instead of simply licensing a generic API function.

[0030] The following are some further advantages of the described data organizational unit: Data source and destination do not need to implement a specific licensing or access scheme; they can be managed centrally on a license and control server. Licensing and access control per data point can be enabled. This high data resolution allows for precise control over what is made available or licensed to whom. If the license terms or access control (e.g., license expires) change, a corresponding change is only necessary centrally on the license and control server, not per device. Data can be freely transferred across the network and even to the cloud, as it is encrypted, thus ensuring the security of the data.

[0031] 6

[0032] Communication can be significantly facilitated. Furthermore, security can be increased because no unencrypted data can be directly accessed from the data sources.

[0033] Exemplary implementation examples

[0034] According to one embodiment, the data organizational unit is independent, in particular functionally and / or spatially independent, from the data-providing unit and / or the data-requesting unit. This can have the advantage that the data organizational unit can be used as a neutral interface specialized in organizing access permissions. The data organizational unit can, for example, be assigned to or operated by the data-providing unit or the data-requesting unit. However, the data organizational unit then does not participate in the data transport and thus remains independent.

[0035] According to one embodiment, the data organization unit is free of the requested data and / or free of any data traffic relating to at least one piece of requested data. This can have the advantage of enabling fast and efficient data packet traffic directly between the data-providing unit and the data-requesting unit. In other words, the data does not need to be routed through the data organization unit. This can also have the advantage of allowing the data organization unit to operate more efficiently and with less computing power. Data traffic security can also be significantly increased. A particular advantage is that access permissions to the data organization unit can be changed / adjusted efficiently and flexibly without affecting the data itself.

[0036] According to one embodiment, at least one piece of data is encrypted using a session key of the data-providing entity. In another embodiment, the (session) key is encrypted with a public key of the data organization unit. This can enable particularly efficient organization. For example, a large number of (symmetric) session keys can be generated with minimal computational effort. Asymmetric key pairs are usually easier and more secure to distribute via certificates, but require higher computing power. Accordingly, it can be advantageous to implement only the key encryption asymmetrically. 202415403

[0037] 7

[0038] In one embodiment, at least one data point, and in particular each data point, is encrypted with its own session key. In another embodiment, a data record is encrypted with the session key. Depending on the desired application, one approach may be preferred.

[0039] According to one embodiment, the data-providing unit is configured to generate the (session) key. According to another embodiment, the data-providing unit is configured to encrypt one or more data items using the session key and then provide the encrypted data. This can have the advantage that the encryption of the data can be performed (completely) on the data-providing unit's side. The data organization unit therefore does not require access to the actual data.

[0040] In one embodiment, the data-providing unit is configured to receive the public key from the data organization. In another embodiment, the data-providing unit is configured to encrypt the session key using the public key. This allows encryption to be implemented by the data organization in a simple, secure, and efficient manner without requiring the data organization itself to be directly involved.

[0041] According to one embodiment, the data-providing unit is configured to receive the public key from the data organization unit and, in particular, to verify the authenticity of the public key. According to another embodiment, the data-providing unit is configured to provide a data identifier (unique identifier) ​​with at least one encrypted session key from the data request. This can significantly improve organization and efficiency.

[0042] According to one embodiment, the data-requesting unit is configured to receive the encrypted data and / or the encrypted session key from the data-providing unit. This can have the advantage of enabling direct and secure data communication between the data-requesting and data-providing units. The issue of data access authorization, on the other hand, is completely outsourced to the data organization unit. 202415403

[0043] 8

[0044] In one embodiment, the data-requesting unit is configured to send the data request to the data organization unit. In another embodiment, the data-requesting unit is configured to receive the decrypted session key from the data organization unit. In yet another embodiment, the data-requesting unit is configured to decrypt the encrypted data using the decrypted session key from the data organization unit. In this way, the data organization unit can efficiently and quickly (after successful verification) provide data access without having to decrypt the data itself.

[0045] According to one embodiment, a data point or record is encrypted with a new session key when the data point or record is changed.

[0046] According to one embodiment, at least one of the data organization unit, the data-providing unit, and the data-requesting unit is implemented locally or in the cloud. This can enable particularly high flexibility.

[0047] According to one example implementation, the requested data is not transferred to the data organizational unit. This enables a particularly efficient, direct, and secure data transfer, where access authorization issues are outsourced to the data organizational unit.

[0048] It should be noted that embodiments of the invention have been described with reference to different subject matter. In particular, some embodiments have been described with reference to method claims, while other embodiments have been described with reference to apparatus claims. However, a person skilled in the art will understand from the foregoing and the following description that, unless otherwise stated, in addition to any combination of features belonging to one type of subject matter, any combination of features relating to different subject matter is also deemed to be disclosed by this document. This applies in particular to features of the method claims and features of the apparatus claims.

[0049] The aspects defined above and further aspects of the present invention will become apparent from the examples of embodiments described below and will be explained with reference to these examples. The invention is described in 202415403

[0050] 9

[0051] The following describes in more detail with reference to embodiments to which the invention is not limited.

[0052] Brief description of the drawings

[0053] Figure 1 schematically shows a data organization system according to an exemplary embodiment of the invention.

[0054] Figure 2 schematically shows a data organization system according to a further exemplary embodiment of the invention.

[0055] Detailed description of the drawings

[0056] The representations in the drawings are schematic. It should be noted that in different illustrations, similar or identical elements or features are designated with the same reference numerals or with reference numerals that differ from the corresponding reference numerals only in the first digit. To avoid unnecessary repetition, elements or features that have already been explained in relation to a previously described embodiment will not be explained again later in this description.

[0057] Furthermore, spatially relative terms such as "front" and "back," "top" and "bottom," "left" and "right," etc., are used to describe the relationship of one element to another, as illustrated in the figures. Thus, these spatially relative terms may apply to orientations used that differ from the orientation shown in the figures. Obviously, these spatially relative terms merely serve to simplify the description and the orientation shown in the figures and are not necessarily restrictive, since a device according to an embodiment of the invention may assume orientations other than those shown in the figures, particularly when in use.

[0058] Figure 1 schematically shows a data organization system 150 according to an exemplary embodiment of the invention. The data organization system 150 comprises the following three units: i) a data-providing unit 110, e.g., a data provider, which stores data locally and / or in a cloud. In an exemplary example, the data- 202415403

[0059] 10. Data-providing unit 110: 1) Axle counter data (or data points) from a multitude of axle counter devices. ii) Data-requesting unit 120, e.g., a data consumer such as a data analyzer or a device that uses the data for its own purposes. iii) Data organization unit 100, which is set up to organize the access rights of one or more data-requesting units 120 with respect to the data of the data-providing unit 110. The data organization unit 100 thus forms an interface between the other units 110 and 120, whereby the data organization unit 100 only handles the organization of access rights and does not itself participate in the data traffic. In other words, the requested or exchanged data is not transferred to or stored by the data organization unit 100.

[0060] A clear example of a data query in the data organization system shown might look like this:

[0061] The data-requesting unit 120 first submits a data request to the data-providing unit 110. The data-providing unit 110 has stored a large number of data records, e.g., record D. The data D is encrypted using a key K_S from the data-providing unit 110 to obtain encrypted data D_E. This can be done per data point (with multiple keys K_S) or per record (with one key K_S). In a preferred example, symmetric encryption is used, and the key K_S is, for example, a session key.

[0062] In a further step, the key K_S is encrypted using an access key K_PUB of data organizational unit 100. In a preferred example, asymmetric encryption is used, and the key K_PUB is, for example, a public key of data organizational unit 100. Optionally, the data-providing unit 110 can check / verify that the access key K_PUB actually originates from data organizational unit 100 and that data organizational unit 100 is trustworthy (e.g., via the trust anchor and / or the x.509 certificate).

[0063] The encrypted data D_E and the encrypted key K_ES can now be sent to the data-requesting unit 120. Optionally, a data identifier (encrypted or unencrypted) can be included. Data-requesting unit 120 202415403

[0064] Unit 11 can thus obtain the data in a simple and efficient manner. However, this data cannot be opened due to encryption. In the next step, the data-requesting unit 120 therefore sends a request D_A to the data organization unit 100. This request D_A contains the encrypted key K_ES, which would need to be decrypted to open the encrypted data D_E and the data identifier.

[0065] Data organizational unit 100 first checks the request D_A to determine whether the requesting unit 120 is authorized to access or use the requested data. To do this, data organizational unit 100 consults a database of access permissions D_Z, which may also depend on the data identifier. For example, this database might show that the requesting unit 120 has acquired a valid license to use axle counter data for analysis. In this case, the requesting unit 120 is only authorized to receive precisely this data.

[0066] If the data access authorization check D_Z is successful, data organizational unit 100 will decrypt the encrypted key K_ES. For this, a private key K_P of data organizational unit 100 can be used, which, together with the public key K_PUB, forms an asymmetric key pair. The decrypted key K_DS can then be provided to the data-requesting unit 120. In the final step, data-requesting unit 120 can decrypt the encrypted data D_E using the decrypted key K_DS to obtain the data D.

[0067] Figure 2 schematically shows a data organization system 150 according to a further exemplary embodiment of the invention. As described for Figure 1, the data organization system 150 comprises the following three units: data-providing unit 110, data-requesting unit 120, and data organization unit 100. In this example, the data-providing unit 110 and the data organization unit 100 are installed locally (on-premise), while the data-requesting unit 120 is implemented in the cloud. In this example, the data organization unit 100 is operated by the same company as the data-providing unit 110, so that access to the provided data can be managed. Nevertheless, the data organization unit 100 is functionally independent of the data-providing unit 110.

[0068] The data-providing unit 110 provides at least one diagnostic data point (data provider), the data organization unit 100 acts as a license or 202415403

[0069] 12

[0070] The control component and the data-requesting unit 120 process the diagnostic data (data consumer). Process steps 1 to 9 can be described as follows:

[0071] 1. The data-providing unit 110 has access to an asymmetric public key (K_PUB) of the data organizational unit 100 and can verify that it actually originates from the data organizational unit 100 and that the data organizational unit 100 is trustworthy (e.g., via the trust anchor and the x.509 certificate).

[0072] 2. The data-providing unit 110 generates an encryption key K_S per data point.

[0073] 3. The data-providing unit 110 uses the corresponding K_S for each data point to encrypt the contained data (optionally, a single key for all data points is also possible).

[0074] 4. The data-providing unit 110 uses the public key (K_PUB) to encrypt K_S and identifying information (e.g., a unique identifier) ​​about the data point, resulting in an encrypted key K_ES for each data point (or optionally one K_ES for all data).

[0075] 5. The data-providing unit 110 makes the encrypted data D_E together with K_ES available to the data-requesting unit 120 (e.g. via OPC UA).

[0076] 6. The data-providing unit 110 authenticates itself with the data organizational unit 100 and sends the encrypted key K_ES for each data point it wants to access (or only one K_ES if optionally only one was used for all data points).

[0077] 7. Data organizational unit 100 checks, using a data access authorization D_Z, whether the data-requesting unit 120 is permitted to access the data (e.g., in a licensing case via a license file, or in a data ownership use case via a whitelist, etc.). 202415403

[0078] 13

[0079] 8. If the data-requesting unit 110 is allowed to access the data, the data organizational unit 100 sends the unencrypted keys K_DS to the data-requesting unit 110.

[0080] 9. The data-requesting unit 110 uses the unencrypted key K_DS to decrypt all data it is interested in and authorized to access. Optionally, the data points are encrypted with a different key K_S2 each time their value changes, or the same key is used for a longer period (either indefinitely or for a specific interval). For example, the data-requesting unit 110 must contact the data organizational unit 100 each time the data or the key K_S changes.

[0081] It should be noted that the term "comprising" does not exclude other elements or steps, and the use of the article "a" does not exclude a plurality. Elements described in connection with different embodiments may also be combined. It should also be noted that reference numerals in the claims should not be interpreted as limiting the scope of the claims.

[0082] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

[0083] 202415403

[0084] 14

[0085] Reference sign

[0086] 100 Data Organizational Unit

[0087] 110 Data-providing unit

[0088] 120 data-requesting units

[0089] 150 Data Organization System

[0090] D Date, data, record, data point

[0091] D_A Data Request

[0092] D_E Encrypted Data

[0093] D_Z Data Access Permissions

[0094] K_P Private Key

[0095] K_PUB Public Key

[0096] K_S session key

[0097] K_S2 New session key

[0098] K_DS Decrypted Session Key

[0099] K_ES Encrypted Session Key

Claims

202415403 15 Patent claims 1. A data organizational unit (100) comprising: a storage unit for storing data access permissions (D_Z) and a key (K_P), in particular a private key; and a processor unit for: Receiving a data request (D_A) from a data-requesting entity (120) regarding at least one data (D) from a data-providing entity (110), wherein the data request (D_A) contains an encrypted key, in particular an encrypted session key (K_ES), Validating a data access authorization of the data-requesting entity (120) based on the stored data access authorizations (D_Z), and, if the data access authorization is granted, Decrypting the encrypted key (K_ES) using the stored key (K_P), and Providing a decrypted key (K_DS) to the data-requesting unit (120).

2. The data organization unit (100) according to claim 1, wherein the data organization unit (100) is independent, in particular functionally and / or spatially independent, from the data-providing unit (110) and / or the data-requesting unit (120).

3. The data organization unit (100) according to one of the preceding claims, wherein the data organization unit (100) is free of the requested data and / or free of data traffic relating to at least one requested data (D).

4. The data organization unit (100) according to one of the preceding claims, wherein the at least one data (D) is encrypted using a session key (K_S) of the data-providing unit (110) (D_E), and wherein the session key (K_S) is encrypted with a public key (K_PUB) of the data organization unit (100) (K_ES).

5. The data organization unit (100) according to one of the preceding claims, wherein a data point, in particular each data point, (D) is encrypted with its own session key (K_S); or 202415403 16 where a data record (D) is encrypted with the session key (K_S).

6. A data organization system (150) comprising: a data organization unit (100) according to any one of the preceding claims; the data-providing unit (110); and / or the data-requesting unit (120).

7. The data organization system (150) according to claim 6, wherein the data-providing unit (110) is configured to: Generating the session key (K_S), and Encrypting one or more data items (D) using the session key (K_S) to provide one or more encrypted data items (D_E).

8. The data organization system (150) according to claim 6 or 7, wherein the data-providing unit (110) is configured to: Obtain the public key (K_PUB) from the data organizational unit (100), and Encrypting the session key (K_S) using the public key (K_PUB).

9. The data organization system (150) according to one of claims 6 to 8, wherein the data-providing unit (110) is configured to: Obtaining the public key (K_PUB) from the data organizational unit (100), and in particular verifying the authenticity of the public key (K_PUB); and / or Providing a data identifier with at least one of the data request (D_A), the encrypted data (D_E), and the encrypted session key (K_ES).

10. The data organization system (150) according to any one of claims 6 to 9, wherein the data requesting unit (120) is configured to: Receipt of the encrypted data (D_E) and / or the encrypted session key (K_ES) from the data-providing entity (110).

11. The data organization system (150) according to any one of claims 6 to 10, wherein the data requesting unit (120) is configured to: Sending the data request (D_A) to the data organizational unit (100), 202415403 17 Receiving the decrypted session key (K_DS) from the data organizational unit (100), and Decrypting the encrypted data (D_E) using the decrypted session key (K_DS) from the data organizational unit (100).

12. The data organization system (150) according to any one of claims 6 to 11, wherein a data point or a record (D) is encrypted with a new session key (K_S2) when the data point or record (D) is changed.

13. The data organization system (150) according to any one of claims 6 to 12, wherein at least one of the data organization unit (100), the data providing unit (110) and the data requesting unit (120) is implemented locally or in the cloud.

14. A method for organizing data using a data organization unit (100), comprising the method: Receiving a data request (D_A) from a data-requesting entity (120) regarding at least one data (D) from a data-providing entity (110) at the data organization unit (100), wherein the data request (D_A) contains an encrypted key (K_ES); Validating the data access authorization of the data-requesting unit (120) by means of the data organizational unit (100), and, if the data access authorization is granted: Decrypting the received encrypted key (K_ES) using a key (K_P) of the data organizational unit (100); and Providing a decrypted key (K_DS) to the data-requesting unit (120).

15. The method according to claim 14, wherein the requested data (D) is not transferred to the data organization unit (100).

Images