DE19645006B4 - Process for communication between processes - Google Patents

Abstract

Method for client-server communication between a first process (P _c ) running on a first computer that functions as a client and a second process (P _s ) running on a second computer that functions as a server, characterized by the following steps:
Establishing a first client-server connection between the first process and a third process running on the first computer, in which the third process represents the server;
Establishing a second client-server connection between the third process and a fourth process running on the second computer, in which the third process represents the client and the fourth process the server;
Establishment of a third client-server connection between the fourth process and the second process, in which the fourth process represents the client and the second process the server, so that the third and fourth processes each work against your different communication partner as a server or as Client occur, whereby the establishment of a client-server connection includes:
Generation of a ...

Description

The present invention relates to a method of communication between processes that take place on a or run on different computers, as well as one on one Process running on a computer for establishing client-server connections.

In modern computer systems it often the case that a Communication between different on one or on different Computer running processes is required. In particular, this is always the case when a process, the so-called client, of another process the so-called server, requests a service that the server then he brings. With the requested or to be provided services can it is a wide variety of applications, for example Word processing, more complicated computing applications, the making about print jobs, managing files (file servers) etc. In most cases the client and server can be found on different computers and the Connection between the two computers is via a communication line manufactured. It can however, both also run on the same computer.

The main applications in which require communication between two processes, are those where a client is on a first machine from one server on a second one Remote connection accessible computer requests a service such as for example on the World Wide Web WWW or online banking. With these client / server applications it may be necessary that the over the Remote connection transmitted Data encrypted are, e.g. B. to give the unauthorized user access to the To be able to refuse server services or to prevent the existence unauthorized user using the "intercepted" transmission data pretends to be an authorized user and requests a service. Below are brief basics of communication between Processes explained the often for client-server applications via a long-distance connection, for example a telephone line, takes place.

Establishing a connection between a first computer and a second computer or between two processes across a remote data connection takes place with the help of a transmission protocol, such as TCP / IP. The basics are briefly described below this protocol as well as those required to establish a connection Steps shown. A connection via the Internet explained.

Every computer on the Internet owns a unique address (the Internet address). This address can be as Quadruples of numbers can be represented (e.g. 130.149.1.1). Specific Internet services ensure that this spelling that is difficult to read, even as separated by dots Names can be displayed (e.g. www.versand.de). The chosen names are totally arbitrarily and have no relation to special services known from the Internet (Www).

You can now on these computers certain services available be put. To be able to distinguish them - because the Internet address is enough for that do not become so-called ports introduced. On Port is a number in the range from 0 to 65535. So it's a service to be able to use needed the Internet address of the computer on which the service is running and whose port.

Agreement between service users and Service providers to an Internet address and a port is mandatory for this necessary, to be able to use the service.

Certain services have been on the Internet already assigned port numbers (e.g. WWW port 80, ftp port 21 ...). Knowledge is already sufficient to be able to use these standard services the Internet address. There are also special ports for services in the intranet area reserved (e.g. SQL server - port 3180, Lotus Notes server - 1352).

If a service is used, two so-called sockets necessary, that relate when establishing a connection. A socket is a Communication endpoint.

To a service on a computer To be able to offer, you have to create a socket and assign a port to it. That can lead to an error if the port is already through another service on this machine is occupied.

In the client-server world the process, that offers a service on the computer represents a server Client uses the service of the server by establishing a network connection to the server socket. For this, the client must first on his Computer also create a socket and any one Assign free port. Arbitrary because the port is the distinction of services, but most of all gives the possibility of services at all to find. However, the client does not offer a service, so it will no specific port is required either, the port can be assigned dynamically become.

The following actions are taken to a network connection up and down dismantle.

• - The server is started. - The server process creates a socket. - The server process assigns the agreed port number to the socket. The server process "listens" to the socket and waits for client service requests.
• - The Client is started. - The Client process created a socket. - The Client process used a free, arbitrary port number. - The client process determines the Internet address of the computer on which the service is offered. - The client process determines the port number of the service on the server computer (possibly defined). - The client establishes the connection to the remote server (connect). Doing so A copy of the server's socket is created, using the socket of the client is connected.
• - The Connection exists. - The Network connection is through the quadruple [client internet address, Client port, server internet address, server port] clearly described. Multiple clients can establish a connection to the same service ([client internet address 2, Client port2, server internet address, Server port]). - Data can can be exchanged bidirectionally. - The connection is made by the client or terminated by the server (only the socket copy on the server side is closed).
• - The Client process will completed.
• - Further Client service requests are being processed. - The one above mentioned steps can repeat themselves as often as you like.
• - The Server stops working. - The socket is closed. - The process is ended.

According to the protocol described Most of the time, connections are established in so-called client-server applications, the basics of which are briefly described below.

Client-server applications are known divisible into two processes, one process - the server services a second process - the client. Since the processes are mostly spatial are separated for this a network connection between client and server using a common network protocol. The resulting one Connection is bidirectional, which means that data can be exchanged in both directions become. The client transmits in the Usually a request to the server, the server generates an answer and transmits it back to the client. When service usage is complete, the client builds or server disconnects and the server waits for further Client requests. Depending on the design of the server, you can several client requests in parallel or quasi-parallel (file server, Databases) are processed.

Because the service usage usually only takes place at certain times and no assumptions about the When service usage is feasible, the server process is usually constantly started to respond to client requests to be able to react. The client also knows rules that localize the server to be able to. Therefor exist for different network protocols different approaches. Whichever approach Can be used by the actual client-server application can be assumed as given.

An important basis for systematization or classification of the functions and functionalities of network applications offers the so-called OSI layer model.

The components of a network application (Client-server application) can be in the OSI layer model classify. This abstracts from concrete protocols and offers a uniform basis for the functional description of these components. Be in this model specified seven different layers, each a different one Show level of abstraction when viewing the data. Use it higher Layers of services of lower layers.

When client-server applications are mentioned and they communicate via a network, all seven levels are traversed during the communication. 1 shows such a process as an example in a schematic representation. If both applications are started on one computer, the lower 3 layers of communication can be omitted.

In contrast, become client-server applications over large networks. intermediate processes or system services are required that perform protocol adaptations or address conversion tasks. These are located in the lower OSI layers and in 2 shown by way of example using a router and a modem arranged in the OSI layer model.

Becomes a client-server application for example about uses the internet, so here are several processes on communication involved. On the one hand, routers are used to get different Connect networks. On the other hand, serve (not shown) Firewalls protecting against unauthorized intruders. In the OSI layer model these processes are located on the lower levels. A router needed only the network address to be able to forward data.

Modems also modify the transmitted data. This happens in the layers 1 and 2 of the OSI model, like from 2 can be seen.

A so-called firewall mentioned above is a packet filter. It analyzes data packets and assigns certain ones Packages from if necessary. Differentiate between simple firewall systems here also only after the computer addresses. An authentication at user level is not possible. More complicated systems with support at session level are also known. This is a separate one Network connection to the firewall computer established. The user authenticates itself and thus unlocks the actual service, which, however, takes place in the lower protocol layers. This specialized firewall systems are however on the modification the client-server software instructed the special registration process perform.

Firewalls prevent the intrusion from the outside at the system level. System administration rights are therefore required for their installation ertorderlich. However, firewalls are unable to work at the application level to prevent unauthorized access.

For data security purposes now encryption of data to be exchanged between processes or computers is desirable or even be required.

The one required for secure communication encoding can, according to the prior art, essentially in two ways happen, namely using a hardware solution or by means of a software solution. In the first case, for example, special hardware with a keyboard connected to the computer and thus encrypts the data directly the input. This creates the risk of spying on the keystrokes switched off by a virus infiltrated into the computer. The key disadvantage, however, is aside from the compared to higher software Production costs that this process is a low flexibility having. An application must be special to this hardware solution be adjusted, so that one Use of existing applications is either excluded or is only possible with high adaptation costs. In this hardware solution are e.g. also the so-called chip card solutions classify, in which the application specifically to the hardware of the used chip card must be tailored.

On the software side there is in the essentially three different solutions. The so-called stand-alone encryption programs are programs with which certain files can be encrypted in dialog. In order to is a high operator effort and poor usability connected. So-called plug-ins are encryption solutions that act as extensions have been developed for certain browsers and they are always on the host product bound. Some software products have inherent applications encryption connected. However, these are also related to the particular product tailored and not usable for any application.

EP 0 709 994 A2 describes the communication management between client and server processes. In the case of a remote call procedure (RPC), which starts from a client that is located on a host, it is first checked whether the server process is arranged on the host. If this is the case, instead of forming a path through the transport and network layers of the physical network, an interprocess communication between the client and the server process is established. This avoids running through the deeper layers of the OSI layer model.

It is a task of the present Invention, an encryption concept deploy between a client and a server that is based on run different computers, whereby it can be avoided that itself encryption in the deeper layers of the OSI layer model to avoid a Intervention in the operating system is required to complete the encryption to implement.

The object of the invention is in essentially solved by the characteristics of the independent Claims. The dependent Expectations describe specific embodiments the invention.

According to one embodiment comprises Invention the provision of at least one intermediate process, which is preferred at the application or presentation level of the OSI layer model expires, and forwards the data to be transferred between two processes and modified or logged as necessary without making any change of the two processes or the system itself on which they run, is required. This is achieved in that the intermediate process or processes across from a process as Server and opposite a process other than Client can occur. The intermediate process can by responding like a server to a client’s request he can then meet this requirement or represent it Modify data if necessary, and he can then act as a client to the actual server from which the client requests a service. The intermediate process poses a communication bridge between a client and a server that enables the ones to be transferred Modify or log data in each case.

In contrast to the actual client requesting a service, the intermediate process acts as a server ver, compared to the actual server for which the service request of the actual clients is intended, the intermediate process occurs as a client. The intermediate process transmits or transmits the data to be transmitted for the service request from the actual client to the actual server, it being able to modify and / or log this data if necessary. The intermediate process can be configured so that both the actual client and the actual server do not notice anything about the existence of the intermediate process. The intermediate process can thus be integrated or implemented in a simple manner in existing client-server application environments without having to make any changes or modifications to the actual client-server applications.

By being the intermediate process one on the application or presentation layer of the process running in the OSI layer model are for his No system administration rights for implementation or integration into an existing system required. Also, there are no further modifications in the lower Layers of the OSI layer model below the presentation level required. Due to its hermaphrodite function, the Intermediate process like this the implementation client-server applications with simultaneous modification and / or logging of the exchanged between client and server Data. The bridge function the intermediate process is bidirectional, i.e. also from Server to be transferred to the client Data can from the intermediate process if necessary, modified and / or logged.

According to one embodiment two such intermediate processes are envisaged, one on the side of the server and one on the client side. In this case the client-side intermediate process can modify the data to be transferred Make data and the server-side process a corresponding back modification. The data exchanged by the intermediate processes can now encrypted by these and decrypted again be without a Intervention in the lower OSI layers or at the system level is required is, since both processes are application processes that are based on ordinary ones commercially available Client-server applications react as a client or server and one Encryption / decryption can make.

It is particularly advantageous if the client-side intermediate process in addition to encryption the one to be transferred Data also user or application-specific data, preferably also encrypted, transfers to the server or the server-side intermediate process. This allows then authentication of the user or the client itself by servers where this is not actually intended. Thereby z. For example, access security to applications can be increased.

Below is the present Invention based on specific embodiments and described in detail with reference to the accompanying drawings. Show it:

1 a client-server application in the OSI layer model,

2 a client-server application with router and modem in the OSI layer model,

3 a client-server connection with an intermediate process according to the invention in the OSI layer model,

4 a client and a server with an intermediate process according to the invention, all three processes running on different computers,

5 a client and a server with an intermediate process according to the invention, the server and intermediate process running on a different computer than the client,

6 the data flow between a client, a server and an intermediate process,

7 the schematic splitting of the connection using two intermediate processes and a remote connection,

8th a client-server connection with two intermediate processes according to the invention in the OSI layer model,

9 the data flow via two intermediate processes, each running on the same computer as the server or the client,

10 the flow diagram for the intermediate processes according to the invention,

11 the scheme for establishing a connection in the client-side intermediate process according to the invention,

12 the scheme for establishing a connection in the server-side intermediate process according to the invention,

13 the simultaneous use of services by two clients,

14 the simultaneous use of services by two clients with intermediate processes according to the invention,

15 adding a parameter when applying the invention.

• – P_m ist ein Anwendungsprozeß
• – P_m ist in der Lage, als Client gegenüber einem gegebenen Server P_s auftreten zu können (er ist Client bezüglich P_s) und kann damit dessen Dienste nutzen.
• – P_m ist in der Lage, Clientverbindungen (z.B. von P_c) zu akzeptieren, erbringt jedoch selbst keine Dienste, oder besser gesagt, er erbringt nicht den Dienst, den der Client P_c von dem Serverprozeß P_s anfordert
• – Die Erbringung des Dienstes erfolgt durch die Dienstnutzung am Server-Prozeß, das heißt, die Client-Anforderung wird lediglich zwischengespeichert, eine Verbindung zum eigentlichen Server aufgebaut, die Anfrage an den Server-Prozeß geschickt und die erhaltene Antwort an den Client P_c weitergeleitet.

In the first exemplary embodiment, a client-server application is carried out as in 3 shown by means of an intermediate process P _m . How out 3 can be seen, all layers of the OSI model are also run through by the intermediate process P _m , since this runs at the application level, as well like the actual client P _c and the actual server P _s . The client process P _c requests the server P _s to provide a service. The intermediate process P _m , which has the following properties, now responds to this requirement:

• - P _m is an application process
• - P _m is able to act as a client in relation to a given server P _s (it is a client with regard to P _s ) and can therefore use its services.
• - P _m is able to accept client connections (eg from P _c ), but does not itself provide any services, or rather, does not provide the service that the client P _c requests from the server process P _s
• - The service is provided through the use of the service on the server process, that is, the client request is only temporarily stored, a connection is established to the actual server, the request is sent to the server process and the response received is forwarded to the client P _c ,

This hermaphrodite property leads to transparency compared to process P _s and P _c1 , since exactly the same protocols are used for establishing and clearing the connection or for communication. A kind of data bridge between P _s and P _c is created in the process P _m . In the present example from 3 the processes P _c and P _{m run} on the same computer, the process P _s on a different computer. If all three processes run on the same computers, only a local connection between the processes is necessary (no deeper network layers are required).

The specific coupling of the processes is irrelevant (except for speed aspects) and is as diverse as the possibilities of the original network connection between client and server. It is understood that the intermediate process and also the client must be configured so that, for. B. the client also finds the intermediate process and sends its service request to be sent to the server P _c to the intermediate process. However, this is done using conventional configuration methods, such as those used to configure the client and server without an intermediate process, and can be assumed to be known here.

The intermediate process P _m is located at the same protocol level as the processes P _s and P _{c of} the application itself, as from 3 can be seen. It is therefore also an application and does not require any intervention in system layers to which the user normally does not have access. If the invention described here is to be used for an existing application, then only the “communication hulls” of the original software have to be implemented in order to enable the connection to be established. Neither an implementation of the services to be provided nor an intervention in deeper system layers by driver software or the like is necessary.

4 shows again schematically the three processes, which according to 4 run on different computers. In the basic state, the processes P _c and P _s are now running. P _s is configured as usual and listens on the previously defined, well-known port P _SI to offer its service. The process P _m is now configured so that it also creates and listens to a socket. The port number P _MI used is assigned so that a potential client can also find this port.

When building according to 4 it is possible to use the same port number P _SI , since all three processes run on different computers. When building according to 5 however, this is not possible because P _m and P _{s run} on the same computer and each port (for listening) can only be assigned once.

The P _c , P _s and P _m processes do not have to be started on different computers. A client can also use the server service on the same computer as in 5 for P _m and P _{s is} shown ..

The data flow between the processes is now in 6 shown. The client P _c is now configured such that it uses the service on the computer of the process P _m with the port P _MI . In the case of an incoming connection (from port P _CO ), the process P _m now creates a new socket and assigns it a free port P _MO . He now sets up a network connection to the process P _s with the port P _SI . All data that are actually sent from the process P _c to the server P _s now go to the process P _m . This logs the data and sends it unchanged to process P _s (port P _SI ). Similarly, the data in the opposite direction (from port P _SI to P _MO ) is logged by process P _m and forwarded to port P _CO via port P _MI . None of the processes P _c and P _s notice the logging. For process P _c , process P _{m is} the server and for process P _s process P _{m is} the client. However, the server or client property of the intermediate process does not consist in the provision of a requested service or the request for a service, but only in a bridge property, i.e. the transfer, possibly logging, modification, or the like, between the actual client and the actual server data to be transferred. The client and server property essentially consists of the ability to set up a connection with another process in a corresponding manner, ie the other process, ie a client or server, by corresponding port number assignment, socket creation, in short, by fulfilling the corresponding rules for the connection establishment, "pretend", which then only serves as a bridge to another process. The intermediate process can be configured in such a way that it provides a service, but this then expediently consists in modifying or logging the data to be transmitted and maintaining the connection as an intermediary between client and server.

In a further exemplary embodiment, two additional processes P _m and P _{m '} are now introduced. 7 shows schematically the communication of an SQL server P _s with a client P _c via the intermediate processes P _m , P _{m '} . In this exemplary embodiment there is therefore an intermediate process on the server side and one on the client side. This opens up new possibilities for using the intermediate processes, for example for the purpose of encryption. With the modification of the transmitted service request from P _c to P _{m in} such a way that the possibility of unauthorized access to the transmitted data between process P _m and P _{m 'is} excluded by encryption methods, or the identity of the two communication partners (P _m and P _{m '} ) is ensured, and the subsequent recovery of the original data in process P _m' and forwarding to process P _s1 , existing client-server applications can be used safely over insecure transmission channels, such as here via a telephone connection. Analogously, the response of the server P _s in P _{m 'is} modified in such a way that decryption and authentication can take place in the process P _m and the data can again be passed unencrypted to the client requesting the service.

This means that existing applications can also be backed up without having to adapt them. It is also important here that the intermediate processes are application processes, that is to say they run at the application level or at least at the presentation level of the OSI layer model, as is the case, for example, for the process at the application level in 8th is shown. Compared to the prior art, this means that it is necessary to go through more layers of the OSI model, but this is only of minor importance in applications that are time-consuming and computational, such as cryptography.

Previously known procedures operate in principle in the lower protocol layers of the OSI reference model. At a Main application of the exemplary embodiment described here, cryptography, which requires a lot of computing time, plays the additional one Communication overhead between the intermediate processes and the actual ones Application, however, is of secondary importance.

The data flow for two intermediate processes is in 9 shown. Contrary to the representation of 6 However, the first intermediate process P _m with its port P _MO does not address the port P _{SI of} the server directly but rather the input port P _M'I at which the server-side intermediate process listens for client requests. Only the output port P _M'O then _connects to the port P _SI at which the actual server listens for service requests.

In 10 the flow diagram of the processes P _m and P _{m 'is} shown. This shows that a software P "communication bridge" between input and output is created by a process P _c for each client request. As a rule, the data is modified and forwarded to the corresponding opposite party. If one of the communication partners ends the connection, all 3 intermediate connections are terminated. The intermediate processes never end the connection themselves. They only react to the closing of the communication between the client and server processes. The flowchart also shows that several client connections can exist without any problems. If data is on a communication bridge - on any side - it is modified according to the direction (encrypted or decrypted).

In a further embodiment, the computer address is used for a first authentication. The corresponding scheme for establishing a connection in the process P _m is shown in 11 , for the process P _{m '} in 12 shown. This scheme can be expanded depending on the specific underlying protocol. As a rule, the procedures that the client-server application itself provides as authentication mechanisms are used here. If, for example, a database server uses the computer address to analyze the client requesting the service and, depending on it, allows access to the data, this can already be done in the process P _{m '} . In a first stage, all clients that are not authorized are denied. The server itself is now configured so that it only runs clients from the computer address of the computer running on the process P _{m '} . This prevents the protection mechanism from being circumvented by direct access by another client P _{c '} to the server. Firewalls are an important addition to the concept described here.

The search methods used the communication partners in the intermediate processes are practical identical to those of the client software and can therefore be assumed to be known become. Likewise are the protocols with which the additional processes communicate with the original client or server software, identical with their actual connection protocols, and are therefore not closer described.

The case of the simultaneous use of services by several clients is explained in more detail below. In 13 a general case is shown for this, in which two clients use the services of one server.

Several clients use the services of one server - using the Er described here finding - accordingly, a corresponding number of additional processes P _{m are} required and connections are established between these and P _{m '} per service request from the clients. This is shown schematically in 15 shown. It can be seen here that process P _{m 'occurs} as a double client compared to P _s , two internal "communication bridges" are active. For the server process P _s , this is not a special case and does not change the transparency of the client and server processes on the client side there is an intermediate process P _m1 and P _m2 for both clients P _c1 and P _c2 , from which the connection to the server-side intermediate process P _{m 'is then made} .

In a further special embodiment allows the present invention additionally for encryption authentication of the user. This can be done using a machine readable Disk, for example a chip or magnetic card, which is an electronic counterpart ordinary Represents credit and loyalty cards and information about the Owner includes, happen. Through a special signature process is the disk protected against manipulation.

The user-specific data can now attached to the data to be transferred by the client-side intermediate process and, if necessary also encrypted become. The data is then decrypted on the server side and can used to authenticate the user.

For example, the provision of the service can be refused if the user is not an authorized user for whom the provision of the service is intended. However, usage processes of different users can also be logged in this way, for example, without such a function being provided by the actual server P _s .

However, authentication is also possible using a software solution. Here, for example, the client-side intermediate process can be personalized with the aid of a password set, in analogy to conventional credit cards. This is done by activating a personal key on the client side, which ensures its authenticity. When the connection is established between P _m and P _{m '} , a check can thus be carried out by the process P _m' .

Another special embodiment the invention consists in its application to client-server applications on the World Wide Web WWW. The following is a special form of Data modification described using a special client-server application is based and describes a further application of the invention.

The world wide web is made by a Network formed by WWW servers, the data in the form of text and graphics Clients - the WWW browsers - for disposal put. The network protocol used is called Hyper Text Transfer Protocol, short http. Again, this protocol is based on TCP / IP.

The client (WWW browser, commercially available) now sends requests to the server (eg the Internet Information Server from Microsoft ^® ) via http. These requests contain a reference to the requested HTML page (Hypertext Markup Language, a kind of page description language). HTML also offers the option of using certain language elements to display forms (input fields) that the user can fill with data. This data can then be transferred to the server, which then triggers certain actions (search queries, orders, information).

An example should make this clear. For this purpose, a server "www.server.de" is given. An input field should enable the search for terms. The HTML tags could look like this:

These commands create an input field in which 20 characters can be entered. In addition, a button is shown with "Search". If the search term "Patent" is entered in the text field and the button is pressed, a request is sent to the server via http:
www.server.de/cgi-bin/suche.pl?begriff=Patent

Any other parameters (e.g. search methods to be used) are appended with the character "&". This The entire procedure is known and is sufficient in the literature (e.g. Rainer Klute, Addison-Wesley: "The World Wide Web", pages 112 and 128 ff.) In this example, adding the Parameters "concept" described with the value "patent".

The connection scheme for this embodiment is in 15 shown. If the process P _{m 'identifies} a user M authenticated with the aid of cryptographic algorithms when establishing a connection from the process P _m , a new parameter is automatically created in the process P _m' , for example "user = M", added:
www.server.de/cgi-bin/suche.pl?begriff=Patent&Benutzer=M

That means that although no input field was on the page, a parameter - practically invisible - was added, which can be evaluated by the downstream 1NWW server. With The "User" parameter can now be used specifically respond to the client request, including with WWW servers that do not allow user authentication.

This is just one example of that explained above Modification of the data flow between the processes in this Trap within the http protocol.

For Those skilled in the art can easily make further modifications to the present Invention, in addition to the exemplary embodiments described here. In particular, it is possible, for example, that all four processes, client, Server and the two intermediate processes on the same or also run on different computers. Also, in addition to logging and / or encryption still further modifications conceivable to the intermediate processes the one to be transferred Make data, for example a format change, a protocol or Language adaptation or the like. You can also any number of intermediate processes can be chained together, the possibly make different modifications.

Claims (9)

Method for client-server communication between a first process (P _c ) running on a first computer that functions as a client and a second process (P _s ) running on a second computer that functions as a server, characterized by the following steps: setup a first client-server connection between the first process and a third process running on the first computer, in which the third process represents the server; Establishing a second client-server connection between the third process and a fourth process running on the second computer, in which the third process represents the client and the fourth process the server; Establishment of a third client-server connection between the fourth process and the second process, in which the fourth process represents the client and the second process the server, so that the third and fourth processes each work against your different communication partner as a server or as Client occur, the establishment of a client-server connection each comprising: creation of a socket by the respective server process; Assigning a port to the socket; Listening to the server on the server socket for a service request from the client; Establishment of the connection to the server by the client using a previously created client socket; wherein the first and second processes run at the application level of the OSI layer model and the third and fourth processes run at the application or presentation level of the OSI layer model, and furthermore the third and fourth processes each act as a bridge process between the first and the second process of existing client-server connection, the third process performing encryption and the fourth process performing decryption of the data to be transmitted between the first and second processes. The method of claim 1, further comprising: Carry out an authentication of the third process against the fourth process. Method according to one of Claims 1 to 2, in which the first (P _c ) and the third process (P _m ) run on a computer and the second (P _{m '} ) and the fourth process (P _s ) run on a second computer and that the transmission of the modified data from the third to the fourth process takes place via a remote connection, the transmission and the connection setup and clearing down being regulated by a transmission protocol. The method of claim 2 or 3, wherein the authentication includes at least one of the following: Addition of user-specific data on the data to be transmitted, Addition of computer-specific data on the data to be transferred, modification the one to be transferred Data added Data together with these. A method according to claim 4, wherein the verification of authentication by the fourth process (P _{m '} ) comprises at least one of the following steps: reverse modification of the added data, checking the added data for their authenticity. A method as claimed in claim 4 or 5, wherein the verification comprises: Check whether for the existing authentication data the provision of a requested Service is provided Unlock or provide the requested Service in case of successful authentication, Unlock or provision of the requested service in the case of successful authentication Method according to one of claims 4 or 5, wherein the user-specific Authentication data on a user-specific machine-readable disk forgery-proof are accommodated. A method according to claim 7, wherein the data carrier by means of a digital signature by forming a checksum (hash function) on the disk housed information and digital signature of the checksum tamper-proof is made. Data carrier readable by a digital computer, thereby characterized that on data that can be read by the computer and him are stored enable a method according to any of the preceding Expectations perform.