TESTING THE INTEGRITY OF AN ELECTRONIC DEVICE

Description

[0001] The invention relates to the field of integrity control of an electronic device.

[0002] The invention more specifically relates to a method for controlling the integrity of an electronic device, such an electronic device capable of implementing this method and uses of such an electronic device implementing this method. Hereinafter, the electronic device will sometimes be referred to by ellipsis as "device".

[0003] A device such as that of the invention may be a card payment system, this example and this application not being exclusive of others. By "card payment system" is meant the functional combination of a payment terminal and a bank payment chip card.

[0004] In a known manner, a device of the type of the invention comprises at least: a processor (commonly referred to as MPU for “micro-processor unit”), a secure element (which may be, in particular, a smart card) capable of storing and managing data and into which a public key intended to verify an electronic signature has been loaded, and a means of storing data (such as a memory).

[0005] Furthermore, it is also known to be able to authenticate in advance the content of a storage means so that its integrity can be verified by a public key, corresponding to the private key used for this authentication. In the context of the present invention, this public key can be the one loaded into the memory of the secure element.

[0006] In the context of the invention, "integrity control" means the verification that the data has not been modified or destroyed in an unauthorized manner, in accordance with the definition given by ISO standard No. 7498-2.

[0007] As is known, in a phase prior to making it available to the user, a phase which may be at the level of the manufacture of the device in question or its configuration by a supplier of products or services, its constituent elements may be authenticated by an ad hoc certification authority, whether governmental or private.

[0008] In a later phase of deployment, it is important that the device can always be implemented by the user with complete confidence, that is to say with the guarantee of preserving its integrity.

[0009] This is the purpose of the invention.

[0010] We know about electronic signatures, which guarantee the integrity of an electronic document or information and authenticate its author. However, the electronic signature mechanism alone does not guarantee that a program that has provided a signature executes exactly what it claims to execute.

[0011] In bank card payment systems, there is a challenge-response authentication between the bank card / authentication server and the payment terminal / authentication server, as well as a validation that the payment terminal actually has the private key that it is supposed to have for the card used. However, the user cannot know, and therefore has no certainty, as to the identity between the transaction he carries out using the payment terminal and the transaction actually carried out by the payment terminal. The certifications provided by the EMVCo ®< group or similar organizations do not prevent the use of a counterfeit or cloned payment terminal.

[0012] The state of the art is also illustrated by documents US 6,830,840 and US 5,721,781.

[0013] Document US 6,839,840 describes a method for authenticating a memory card and a terminal, in which all algorithmic calculations are performed by the terminal to which the memory card is connected. These operations relating to authentication are performed before the start of a transaction itself and after the end of this transaction for the purpose of authentication at the start of the next transaction.

[0014] US 5,721,781 describes a method for authenticating a transaction between a portable information device and a terminal, the portable information device storing a device-related certificate unique to the device and the terminal storing a terminal-related certificate unique to the terminal that includes information regarding a terminal type.The method comprising the steps of: exchanging the terminal-bound and terminal-bound certificates between the portable information device and the terminal during a transaction; authenticating the portable information device and the terminal to each other using the exchanged device-bound and terminal-bound certificates; determining, on the portable information device, a security level for the terminal based on the terminal type information contained in the terminal-bound certificate received from the terminal, the security level having an associated limit value for a value of the transaction performed during the transaction; and restricting the value of the transaction to the value limit associated with the determined security level.

[0015] US 2002 / 023032 relates to a method for enabling a financial transaction to be conducted using an electronic system, comprising interrogating an electronic transaction terminal with an electronic security device to obtain an integrity metric for the financial transaction terminal; determining whether the transaction terminal is a trusted terminal based on the integrity metric; enabling financial transaction data to be entered into the transaction terminal if the transaction terminal is identified as a trusted terminal.US 2002 / 023032 also relates to a financial transaction system comprising an electronic financial terminal; an electronic security device having an interrogation means for interrogating the electronic financial transaction terminal to obtain an integrity metric for the electronic financial transaction terminal, a determination means for determining whether the transaction terminal is a trusted terminal based on the integrity metric, a means for authorizing financial transaction data to enter the transaction terminal if the transaction terminal is identified as a trusted terminal. The method and system described in US 2002 / 023032 does not prevent the entire memory of the transaction terminal from being subjected to hashing by the secure element. However, subjecting only a certificate and a checksum to hashing implies that they may have been tampered with.The method and system described in US 2002 / 023032 do not allow the functionality level of the secure element to be adjusted based on the integrity metric.

[0016] US 9,177,152 relates to a method for authenticating and decrypting an encrypted program file intended to be executed by a secure element, which comprises receiving the program file and a digital certificate associated with the program file from an external device. The method stores the program file and the associated certificate in a secure random access memory disposed in the secure element and hashes the program file to obtain a hash. The method authenticates the program file by comparing the obtained hash to a checksum stored in the certificate. In addition, the method writes the execution configuration information stored in the certificate to the corresponding configuration registers disposed in the secure element.; the method further generates an encryption key using a seed value stored in the certificate and a unique identifier disposed in the secure element and decrypts the program file using the generated encryption key. The method according to document US 9,177,152 does not allow the secure element to hash a program that would not be storable in its secure RAM. In addition, this document does not provide for authorizing or not the execution of the program by another microprocessor.

[0017] The methods and systems described in US 2002 / 023032 and US 9,177,152 are such that the secure element is presented with a checksum or complete but relatively small content whose integrity it verifies.

[0018] On the contrary, in the spirit of the invention, it is desired that it is the secure element which decides the functionalities which it can perform according to the result of the integrity check of the rest of the platform, which implies controlling the entire memory of the rest of the microprocessors.

[0019] This desire faces two obstacles. On the one hand, controlling the integrity of a large amount of information securely requires that the content be sent and hashed by the secure element, which constitutes a performance bottleneck for this integrity control operation. On the other hand, the fact that the other microprocessor is still operating when the full contents of its memory are transmitted requires ensuring that it has not modified the transmitted data on the fly in order to mask a possible modification by a malicious third party wishing to compromise the system.

[0020] These two obstacles explain why existing solutions today do not proceed in this direction but rather carry out a verification of the content either before their execution, or via a simple integrity check and an associated certificate.

[0021] However, the solutions to these two obstacles, as presented by the invention, allow for the addition of advanced functionalities to the system. For example, the fact that depending on the level of integrity observed, the secure element is not reduced to the binary choice of delivering or not delivering the service, but to a gradient of functionalities.

[0022] Thus, there is the general problem of allowing a user to control the integrity of a transaction validation device, namely the integrity of a chip card / payment terminal pair (taking into account the heterogeneity of the fleet of these) and the particular problem of overcoming the two obstacles which have just been stated.

[0023] The invention aims to provide a solution to these problems by taking advantage of the secure element. Thus, in the later deployed phase of the device, it can still be implemented by the user with complete confidence.

[0024] To this end, the public key / private key pair used in the previous phase (manufacturing or configuration) is implemented in the later deployed phase. The two phases are therefore interdependent.

[0025] Below is a description of the invention.

[0026] According to a first aspect, the invention relates to a method for controlling the integrity of an electronic device, in particular a card payment system, comprising at least: a processor, a secure element capable of storing and managing data and into which a public key has been loaded for verifying an electronic signature, and a means of storing data, the content of which has been previously authenticated and the integrity of which can be verified by the public key. such that an integrity check command causes the following steps to be performed: the secure element performs, via the processor, an authenticity check on the content received from the memory of the data storage means, in order to verify using the public key that its content could not have been modified since its initial authentication, when the authenticity check has succeeded, the device is considered to be intact.

[0027] The process is such that an integrity check command causes the following successive steps to be executed: the processor of the device requests the secure element, in response, the secure element addresses, via the processor, by means of data storage a request in order to have the full content of its memory addressed to it, the secure element then executes said authenticity verification.

[0028] According to one embodiment, when the device is considered to be intact, this device is capable of operating according to the nominal behavior which has been assigned to it,

[0029] According to one embodiment, when the authenticity verification is not successful, the device is programmed to operate in a suitable mode taking into account the failure of the verification.

[0030] According to one embodiment, the method comprises, in addition to the steps executed each time an integrity control command is sent to the device, a preliminary phase of configuring the electronic device, in which the initial content of the memory of the data storage means is validated using a digital authentication means such as in particular an electronic signature system using the private key corresponding to the public key loaded into the secure element. In particular, the electronic signature initially produced during the preliminary phase of manufacturing or configuring the electronic device is loaded either into the data storage means or into the memory of the secure element.

[0031] According to one embodiment, an integrity control command is carried out either when the device is started or when its user requests control of its integrity.

[0032] According to one embodiment, after at least one or a determined number of executions of the integrity control steps not having resulted in confirming the integrity of the memory with respect to its initial state, the failure of the authenticity verification of the contents of the memory results in one or more of the following degraded operating conditions: notification of failure of integrity verification to the user, blocking of access to data loaded into the secure element, blocking of access to the electronic device, erasure of all or part of the data stored in the electronic device and the elements that compose it.

[0033] According to one embodiment, the secure element has in memory a reference time interval T which is chosen to be less than the maximum time necessary for this secure element to recover the entire contents of the memory to be authenticated, and in which, each integrity control command addressed to the device causes the execution of the following successive steps: the secure element addresses, via the processor, a request to the data storage means so that it addresses to it one or more data sequences extracted from its memory, the secure element identifies the time which elapses between the sending of the request and the reception, via the processor, of the requested sequence(s) and compares it to the reference time interval T, if the time elapsed is greater than the interval T, the secure element refuses the authentication of the memory content of the data storage means and interrupts the execution of the following steps of the integrity control method.

[0034] According to one embodiment, when the time elapsed between the sending of the request by the secure element and the reception of the requested sequence(s) is less than the interval T, the secure element executes the integrity control steps, while verifying the integrity of the sequences received with respect to the authenticity of the content of the memory that it must validate.

[0035] According to one embodiment, the function of the processor is provided by a microcontroller.

[0036] According to a second aspect, the invention relates to an electronic device, in particular a payment terminal, comprising at least: a processor, a secure element capable of storing and managing data and into which a public key has been loaded for verifying an electronic signature, and a means of storing data, the content of which has been previously authenticated and the integrity of which can be verified by the public key, suitable and intended to implement an integrity control method as previously described, in that an integrity control command causes the execution of the following successive steps: the processor requests the secure element, in response, the secure element addresses, via the processor, to the data storage means a request in order to have the full content of its memory addressed to it, the secure element then executes, via the processor, on the content received from the memory of the data storage means an authenticity check, in order to verify using the public key that its content could not have been modified since its initial authentication, when the authenticity check has succeeded, the device is considered to be intact.

[0037] More generally, the device implements the other steps and / or characteristics of the process previously described.

[0038] According to one embodiment, the device comprises a microcontroller whose memory comprises all or part of the data storage means and whose processor performs the function of the processor.

[0039] Depending on the case, the device also includes one or both of the following additional means: a human-machine interface, including a keyboard or screen, a communication interface with external digital devices, including a computer, a communications network or a remote server.

[0040] According to a third aspect, the invention relates to uses of such an electronic device implementing such an integrity control method.

[0041] These uses are authentication, encryption or secure remote exchange of data stored either within the device itself or remotely and accessible through a communications network, or the execution of transactions, particularly financial ones.

[0042] The figures in the drawings are now briefly described. There figure 1 is a diagram illustrating the electronic device according to the invention. The figure 2 is a diagram illustrating the preliminary phase of manufacturing or configuration of the device in question. The figure 3 is a sequence diagram illustrating the steps of the deployed phase of the integrity control process of the device in question.

[0043] The invention relates to a method for controlling the integrity of an electronic device DE. As indicated, the electronic device DE will sometimes be referred to by ellipsis as “device”. It also relates to an electronic device DE capable of and intended to implement this integrity control method.

[0044] It also relates to uses of the electronic device DE in that it implements the integrity control method.

[0045] The DE device may be a card payment system, i.e. the functional combination of a payment terminal and a payment bank chip card.

[0046] However, this example and application are not exclusive of others.

[0047] As is known, a DE device comprises at least: a processor MPU, a secure element SE, capable of storing and managing data and in which a public key KP has been loaded for verifying an electronic signature, and a data storage means MEM, the content of which has been previously authenticated and the integrity of which can be verified by the public key KP. This data storage means MEM comprises all or part of the internal memory of a microcontroller.

[0048] The DE device may also include a human-machine interface, in particular a keyboard or a screen. It may also include a communication interface with external digital devices, in particular a computer, a communications network or a remote server.

[0049] The DE device can be in the form of a flat, thin box, a few centimeters on each side, or in the form of a USB key.

[0050] Such a DE device may, by implementing the integrity control method, be implemented for security functions, such as in particular authentication, encryption or secure remote exchange of data stored either within the DE device itself or remotely and accessible through a communication network. The DE device may therefore be implemented autonomously, or by communicating with other electronic means. A typical use of the DE device is the execution of transactions, in particular financial transactions and including for cryptocurrencies, in a secure manner.

[0051] In the context of the invention, "integrity control" means the verification that the data has not been modified or destroyed in an unauthorized manner in accordance with the definition given by ISO standard No. 7498-2.

[0052] In a preliminary phase of manufacturing or FAB configuration of the DE device, its constituent elements are authenticated by an ad hoc authority, whether governmental or private. The DE device is thus configured for the implementation of the process, thanks to this initial authentication.

[0053] In a subsequent phase deployed USE, the integrity control method of the invention is implemented.

[0054] Several possible embodiments of the invention are now described.

[0055] We will now describe more specifically the preliminary phase of manufacturing or FAB parameterization of the DE device, with reference to the figure 2 . This phase occurs at the very moment of physical manufacture of the device DE, or later, but before the subsequent deployed phase USE. This transition from the preliminary manufacturing or configuration phase FAB to the deployed phase USE is definitive. In this preliminary configuration phase of the electronic device, the initial content CO of the memory of the data storage means MEM is validated using a digital authentication means such as in particular an electronic signature system using the private key Kd corresponding to the public key KP loaded into the secure element SE. Depending on the case, the electronic signature SIGN is loaded either into the data storage means MEM (as illustrated by the figure 3 ), or in the memory of the SE secure element.

[0056] The method of checking the integrity of the electronic device DE in the subsequent deployed phase USE is now described more specifically with reference to the figure 3 . This integrity control method is such that an integrity control command A causes the execution of the successive steps and operations described below (each step is illustrated on the figure 3 by an arrow with a reference that identifies the step).

[0057] First, the device's MPU processor requests the secure element SE (arrow B).

[0058] In response, the secure element SE sends, via the MPU processor (arrow C), a request (arrow D) to the data storage means MEM in order to have the full contents of its memory arrow E sent to it.

[0059] The invention has the advantages of allowing complete and uncompromising control of the memories of the various microprocessors of the system.

[0060] The secure element must delegate display and user interaction operations to the MPU processor, and for this, it needs the assistance of validated code running on the MPU processor. Therefore, the MPU processor must execute code with integrity in order to avoid a mismatch between the information displayed and actually manipulated by the SE secure element for the user.

[0061] Due to the fact that the entire memory of the MPU processor collaborating with the SE secure element is controlled, the security effect is total, the MPU processor having no room for maneuver to operate non-integrated procedures, and the functionality level of the SE secure element is adapted.

[0062] The SE secure element can, for example, decide on a set of the following security levels: full: the MPU memory is known to be intact and countermeasures to detect a tampered MPU have no positive results. partial (authentication function only): the MPU memory is known to be intact, but some countermeasures to detect a tampered MPU have positive results, the SE secure element will only accept content authentication requests via the user's secrets, but will reject any other requests. null: the MPU memory is not known to be intact. In this case, the SE secure element will not grant any requests using the user's secrets, but will nevertheless allow other cryptographic operations to be performed (importing external secrets, manipulating them). In this case, the SE secure element can optionally decide to erase the user's secrets for greater confidentiality.

[0063] From these security levels, it appears that the secure element SE is not only controlled by the system that submits requests to it, but can decide, based on these requests, the responses to its own requests to the system and the level of functionality that it will be able to deliver.

[0064] Then the secure element SE performs an authenticity check (arrow G) on the content received (arrow F) from the memory of the data storage medium MEM, in order to verify using the public key KP that its content could not have been modified since its initial authentication.

[0065] When the authenticity verification is successful, the DE device is considered healthy.

[0066] Depending on the case, depending on the capabilities of the constituent elements of the device DE, the steps and operations corresponding to arrows C, D, E and F relate either to the entire contents of the memory of the data storage means MEM or to parts of this content, in which case these steps and operations corresponding to arrows C, D, E and F are repeated until the entire contents have been received by the secure element SE, so that it can then carry out the integrity check (arrow G).

[0067] Depending on the case, an integrity control command A is carried out either when the device DE is started or when its user requests a check of its integrity.

[0068] When the DE device is considered to be intact, it is capable of operating according to the nominal behavior assigned to it.

[0069] When, on the other hand, the authenticity verification is not successful, the DE device is programmed to operate in a suitable mode taking into account the failure of the verification. Such a suitable mode may, for example, include a process for alerting the user involving a positive action on their part to continue implementing the DE device despite everything or, on the contrary, not to continue.

[0070] In one embodiment, it is provided that after at least one, or a determined number of executions of the integrity control steps not having resulted in confirming the integrity of the memory of the data storage means MEM with respect to its initial state, the failure of the verification of the authenticity of the content of the memory of the data storage means MEM results in one or more of the following degraded operating conditions: notification of the failure of integrity verification to the user, blocking of access to data loaded into the SE secure element, blocking of access to the DE device, erasure of all or part of the data stored in the DE device and the elements that compose it.

[0071] In one realization (see figure 3 ), it is provided that the secure element SE has in memory a reference time interval T which is chosen to be less than the maximum time necessary for the execution of a sequence of steps corresponding to arrows C, D, E and F, and in which, each integrity control command addressed to the device DE causes the execution of the following successive steps: the secure element SE addresses, via the processor MPU, a request to the data storage means MEM so that it addresses to it one or more data sequences extracted from its memory, the secure element SE identifies the time which elapses between the sending of the request and the reception, via the processor (MPU), of the requested sequence(s) and compares it to the reference time interval T, if the time elapsed is greater than the interval T, the secure element SE refuses the authentication of the memory content of the data storage means MEM and interrupts the execution of the following steps of the integrity control method.

[0072] When the time elapsed between the sending of the request by the secure element SE and the reception of the requested sequence(s) is less than the interval T, the secure element SE executes the steps of the integrity control method, while verifying the integrity of the sequences received with respect to the authenticity of the contents of the memory that it must validate.

Claims

1. A method for checking the integrity of an electronic device (DE), the electronic device comprising: - a secure element (SE), capable of storing and managing data and onto which a public key (KP) has been loaded, intended for verifying an electronic signature, - a processor (MPU) configured to collaborate with the secure element, and - a means of storing data (MEM) comprising a memory whose entire content has been previously authenticated during an initial authentication step and the integrity of which can be verified by means of the public key, the memory comprising code executable by the processor, wherein the checking method comprises: in response to a request (B) from the processor, the secure element (SE) performs, on the content of the memory of the data storage means (MEM) received via the processor (MPU), an authentication check step of the entire memory content, in order to verify using the public key (KP) that its content has not been modified since its initial authentication, the device being considered to be integral by the secure element when the authentication check has been successful, wherein the method is characterised in that: the secure element has in memory a reference time interval T which is chosen to be less than the maximum time required for the secure element to retrieve via the processor the entire content of the memory to be authenticated, and wherein the authentication check step of the memory comprises the following successive steps which are repeated by the secure element until the entire content of the memory has been received: - the secure element addresses to the data storage means (MEM), via (C) the processor, a request (D) to receive one or more sequences of data (E) extracted from its memory, - the secure element identifies the time which elapses between sending the request and receipt of the sequence or sequences requested, and compares this with the reference time interval T, and - if the elapsed time is greater than interval T, the secure element refuses to authenticate the memory content of the data storage means and interrupts execution of the subsequent steps of the integrity check procedure.

2. The method for checking the integrity of an electronic device according to claim 1, wherein, when the device is considered to be integral, the secure element is able to operate according to the nominal behaviour which has been attributed to it.

3. The method for checking the integrity of an electronic device according to one of claims 1 and 2, in which when the authentication check fails, the secure element is programmed to operate in a suitable mode taking into account the failure of the verification.

4. The method according to one of claims 1 to 3, comprising a preliminary phase for the configuration of the electronic device, in which the initial content of the memory of the data storage means is validated using an electronic signature (SIGN) using a private key (Kd) corresponding to the public key (KP) loaded on the secure element.

5. The method for checking the integrity of an electronic device according to claim 4, in which the electronic signature (SIGN) initially produced during the preliminary configuration phase of the electronic device is loaded either into the data storage means, or into a memory of the secure element.

6. The method for checking the integrity of an electronic device according to one of claims 1 to 5, in which the integrity check is performed either when the device is started or when it receives a request from the user for an integrity check.

7. The method according to one of claims 1 to 6, wherein, after at least one, but a determined number of executions of the integrity control steps do not result in confirmation of the integrity of the memory with respect to its initial state, the failure of the authentication check on the content of the memory leads to the use of one or more of the following degraded operating modes: - notification of the failure of the integrity check to the user, - blocking access to the data loaded on the secure element, - blocking access to the electronic device, - erasing all or part of the data stored in the electronic device and the elements that comprise it.

8. The method according to one of claims 1 to 7, in which, when the time elapsed between the sending by the secure element of the request to receive one or more sequences of data and the receipt of the requested sequence or sequences is less than interval T, the secure element executes the steps of the integrity check method, while verifying the integrity of the sequences received with respect to the authenticity of the content of the memory which it must validate.

9. The method according to one of claims 1 to 8, in which the processor (MPU) is a microcontroller and in which the memory of the data storage means is a memory of the microcontroller.

10. The method according to one of claims 1 to 9, in which the electronic device has the form of a flat and thin housing, and is configured for the execution of financial transactions concerning cryptocurrencies.

11. An electronic device (DE), comprising: - a secure element (SE) capable of storing and managing data and into which a public key (KP) intended to verify an electronic signature has been loaded, - a processor (MPU) configured to collaborate with the secure element, and - a means of data storage (MEM) comprising a memory whose entire content has been previously authenticated during an initial authentication step and the integrity of which can be verified by means of the public key, the memory comprising code executable by the processor, wherein the secure element (SE) is configured to execute, in response to a request (B) from the processor (MPU) during a device boot, on the content of the memory of the data storage means received via the processor, an authentication check step of the entire memory content, in order to verify using the public key (KP) that its content has not been modified since its initial authentication, the device being considered to be integral by the secure element when the authentication check has been successful, wherein the electronic device (DE) is characterised in that: - the secure element stores in memory a reference time interval T which is chosen to be less than the maximum time required for the secure element to retrieve via the processor the entire content of the memory to be authenticated, - the secure element is configured to execute the following successive steps and to repeat them until the entire content of the memory has been received: - address to the data storage means, via (C) the processor, a request (D) to receive one or more sequences of data (E) extracted from its memory, - identify the time which elapses between sending the request and receipt of the sequence or sequences requested, and compare this with the reference time interval T, and - if the elapsed time is greater than interval T, refuse authentication of the content of memory of the data storage means and interrupt execution of the subsequent steps of the authentication check of the memory.

12. The electronic device according to claim 11, in which the processor is a microcontroller and the memory of the data storage means is a memory of the microcontroller.

13. The electronic device according to one of claims 11 and 12, having the form of a flat and thin housing.

14. The electronic device according to one of claims 11 and 12, comprising also one and / or the other of the following complementary means: - a human / machine interface, in particular a keyboard or screen, - a communication interface with external digital devices, in particular a computer, a communication network or a remote server.

15. A use of an electronic device according to one of claims 11 to 14, for the implementation of security functions, such as, in particular, the authentication, encryption or secure remote exchange of data stored either inside the device itself, or remotely when accessible via a communication network.

16. A use of an electronic device according to one of claims 11 to 14, for the execution of financial transactions concerning cryptocurrencies.