Transmission of Data Streams Between a Terminal Device and a Security Module

• US 20150074236A1
• Filed: 01/08/2013
• Published: 03/12/2015
• Est. Priority Date: 02/15/2012
• Status: Active Grant

• Current Assignee: Giesecke + Devrient Mobile Security GmBH (Giesecke & Devrient GmbH)
• Original Assignee: Giesecke & Devrient GmbH
• Inventors: Ulbricht, Thorsten, Pham Nguyen, Huy, Kramposthuber, Georg
• Granted Patent: US 9,602,588 B2
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In a method for transmitting data streams (20, 22) between a terminal device (12) and a portable security module (10) having a web server, the security module (10) receives a first request (26) announcing a processing data stream (20), and a second request (28) containing the processing data stream (20). The security module (10) generates a result data stream (22) on the basis of already received data of the processing data stream (20) during the receipt of the processing data stream (20), and sends a first response (30) to the first request (26) while the result data stream (22) is being generated, wherein the first response (30) contains the result data stream (22). Given the limited memory of the security module (10), it is thereby made possible to process larger data streams (20, 22) nevertheless.

Claims

1-15. -15. (canceled)

16. A method for transmitting data streams between a terminal device and a portable security module having a web server, wherein the method comprises the following steps executed by the security module utilizing the web server:

receiving a first request announcing a processing data stream;

receiving a second request containing the processing data stream;

generating a result data stream on the basis of the already received data of the processing data stream during the receipt of the processing data stream;

sending a first response to the first request during the generation of the result data stream, wherein the first response contains the result data stream.

17. The method according to claim 16, further containing:

sending a second response to the second request after the end of sending of the result data stream, wherein the second response signals the conclusion of the method.

18. The method according to claim 16, wherein the communication between the terminal device and the security module is based on the hypertext transfer protocol (HTTP).

19. The method according to claim 16, wherein

the first request contains an HTTP GET method;

the second request contains an HTTP PUT method or an HTTP POST method; and

the processing data stream is received in the message body of the second request, and the result data stream is sent in the message body of the first response.

20. The method according to claim 16, wherein the first and the second request contain respectively one address (URL1, URL2), and that the security module is adapted to distinguish these requests at least partly on the basis of their addresses (URL1, URL2).

21. The method according to claim 20, wherein the security module receives a preparatory request utilizing the web server, and sends a preparatory response to the preparatory request, wherein the preparatory response contains a first address (URL1) for the first request and a second address (URL2) for the second request.

22. The method according to claim 16, wherein the start of sending of the first response takes place chronologically before the end of receiving the second request.

23. The method according to claim 16, wherein the security module has a buffer memory for intermediately storing data of the processing data stream and/or of the result data stream, wherein, during the sequence of the process, parts of the processing data stream and/or of the result data stream are continuously stored intermediately in the buffer memory and overwritten by subsequent parts, so that the length of the processing data stream and/or of the result data stream that is maximally processable by the security module is greater than the capacity of the buffer memory.

24. The method according to claim 16, wherein the generating of the result data stream comprises an encryption or decryption of data of the processing data stream already received.

25. The method according to claim 16, wherein the security module is configured as a chip card or a chip module or a USB data carrier.

28. A portable security module having a processor and at least one memory, wherein the security module is adapted to execute a method according to claim 16.

29. A computer program product having program commands for at least one processor of a security module, wherein the program commands cause the at least one processor to execute a method according to claim 16.

26. A method for transmitting data streams between a terminal device having a web browser, and a portable security module, wherein the method comprises the following steps executed by the terminal device utilizing the web browser:

sending a first request announcing a processing data stream for the security module;

sending a second request containing the processing data stream;

receiving a first response to the first request during the sending of the processing data stream in the second request, wherein the first response contains a result data stream generated by the security module from the processing data stream.

27. The method according to claim 26, wherein

the first request contains an HTTP GET method;

the second request contains an HTTP PUT method or an HTTP POST method; and

the processing data stream is sent in the message body of the second request, and the result data stream is received in the message body of the first response.

30. A computer program product having program commands for at least one processor of a terminal device, wherein the program commands cause the at least one processor to execute a method according to claim 26.