One-time key update

Abstract

The present invention relates to updating of one-time encryption keys. A method for protecting communications within a system is disclosed, the system comprising at least one server and at least two devices capable of communicating with the server and with each other, wherein a pair of devices communicating together and having at least one shared one-time encryption key for protecting communications between them have at least one other shared one-time encryption key, which is provided by the server after only one of the two devices is connected to the server.

Description

Technical Field

[0001] The present invention relates to digital cryptography and the security of computers and electronic devices. Background Art

[0002] Computers and electronic devices are typically connected to a network physically, wirelessly, via RFID or by any other secure or insecure means, and sometimes there is a need to identify the identity of a device that has sent some data to these computers and electronic devices, for example to ensure that these data are not transmitted by other devices (which may have intercepted and modified them before resending them to the legitimate recipient), or simply to clearly identify the sender of the data.

[0003] To this end, some software is usually installed on each device used for communication, which encrypts or signs the data so that the encrypted or signed data can be transmitted to another device over an insecure line. The term "signing" data should be understood to mean hashing the data and then encrypting the hashed data.

[0004] Encryption is intended to ensure that encrypted data can only be decrypted by a device equipped with the appropriate encryption key, and signing allows a receiving device to verify the identity of the device that sent the data by comparing a hash value derived from the decrypted signature with a hash value that can be recalculated based on the received data.

[0005] Encryption and signature software typically use symmetric and asymmetric encryption keys, as well as encryption and decryption algorithms. However, such encryption and signature algorithms are primarily based on the difficulty, or even impossibility, of having the computing power required to recalculate the encryption keys, which is typically greater than what is available on mainstream consumer computers. However, the computing power of computers continues to increase, and can be greatly increased by using multiple computers performing the same task. Sometimes, cryptography experts have also found ways to reduce the power required to find encryption keys by using mathematical properties that are suitable for some algorithms. Finally, as quantum computers are designed for high-speed resolution of equations (such as searching for encryption keys for signatures), the advent of quantum computers risks making all of these algorithms and keys obsolete.

[0006] Therefore, one-time keys must be used to secure the data exchange between two devices. These keys can only be used once or a limited number of times in order to provide a certain level of confidentiality to the data exchanged, as changing the key usually increases the cost involved in recalculating the key for a computer hacker. If the keys change frequently enough, the time required to recalculate the keys will be too long to be a problem for the security of the system using them, especially when the receiving peripheral device has enough time to verify the identity of the sender and take action before the signing key is recalculated, or when the confidentiality of the encrypted data is no longer required after the encryption key has been found.

[0007] Furthermore, encryption performed using a key having a number of bits at least equal to the number of bits of the data to be encrypted may not be decrypted.

[0008] The use of one-time keys by electronic devices requires a large amount of memory and requires the key to be present on each of the two communicating devices, but it can be deleted from them after they have been used.

[0009] Patent US 5907620 relates to a cryptographic method providing unified cryptographic functionality, which operates in a manner compatible with individual national, regional or industrial cryptographic policies.

[0010] Patent US 6072876 discloses a method for archiving a private key used in an RSA cryptographic system, which method can store the private key in a more secure manner without requiring the user to always have a storage medium.

[0011] Patent US 5675648 discloses a communication method using quantum cryptography, in particular some physical quantum properties of transmitted photons.

[0012] Patent US 5124117 relates to a method and system using a protocol for establishing a secure secret between two or more terminals via a network.

[0013] US application 2005 / 0226420 discloses a data communication network including at least two terminal devices for managing a set of index encryption keys, wherein the first terminal device is at least one transmitter and the second terminal device is at least one receiver. The communication method can be operated in an unsecured environment only if the users who have access to the local area network are controlled. Summary of the invention

[0014] There is a need to further improve system security by providing a one-time encryption key to each pair of elements that may need to exchange data with complete confidentiality.

[0015] The object of the present invention is in particular to respond to this need and it achieves this object by a method for protecting communications within a system comprising at least one server and at least two devices capable of communicating with the server and with each other, wherein communications are securely carried out between the two devices using a one-time encryption key shared with the two devices, in which method, after using said key, a one-time encryption key that has not been used but is already present on one of the two devices is sent by the server to the other device after the device has been connected to the server, for subsequent secure communications between the two devices.

[0016] Another object of the present invention is a method for protecting communications within a system comprising at least one server and at least two devices capable of communicating with the server and with each other, wherein a pair of devices that communicate together and have at least one shared one-time encryption key for protecting communications between the two devices have at least one other shared one-time encryption key provided by the server after connecting only one of the two devices to the server.

[0017] Preferably, the first device connects to the server in an unsecured environment and obtains from the server an encrypted copy of an encryption key initially allocated for protecting communications between the server and the second device for use in protecting communications between the two devices.

[0018] Throughout the rest of the description, the term "one-time key" will be used and it will mean a one-time encryption key.

[0019] The terms "encrypt / encrypt" and "encrypted" are interchangeable.

[0020] The key is formed by a number which is advantageously computer-encoded by a series of bits, the number of bits forming the key being the size of the key.

[0021] The expression "sending a normal message" means sending a message without encrypting the message. However, any message described as being sent as a normal message may alternatively be encrypted using a conventional encryption method that does not require changing the key used for each transmission, without reiterating.

[0022] Preferably, the one-time encryption key that is not in use but present on one of the two devices is initially randomly generated by a server (eg, a quantum random number generator) and then obtained by the device after the device connects to the server.

[0023] Preferably, the method according to the invention is used for exchanging messages, wherein said at least one server and said at least two devices save in a memory their last sent message of the same type (but not the receipt) using a one-time key until they have received the receipt of said message.

[0024] In the present invention, two types of messages are defined, the first type relating to messages transmitted from a first device to a second device and requiring, in addition to any information, sufficient keys to send a receipt of the message sent by the first device to the second device, the second type incorporating any other messages; the number of keys required to send a receipt is the number of keys required to sign the receipt, optionally increased by the number of keys required to compile the receipt, in particular the number of keys used for possible encryption of the information contained in the receipt.

[0025] The at least one server and the at least two devices preferably keep a register of acknowledgements sent after receiving the last message of the same type, so that they can resend the acknowledgements when they need to receive the same message again.

[0026] Preferably, said at least one server and said at least two devices also maintain a register of messages corresponding to reserved receipts, or another means of confirming said messages so as to be able to verify whether a received message has resulted in the preparation of a receipt, such as a hash value of said message.

[0027] Preferably, the registers modified by the creation and signing of the message are modified simultaneously, said registers comprising the register containing the last message sent for which no acknowledgement has been received.

[0028] Preferably, the registers that must be modified upon receipt of a message are modified simultaneously, including a register containing the receipt and the means for confirming the message corresponding to said receipt.

[0029] According to another aspect of the invention, another object of the invention is two versions of a system for implementing the method according to the invention.

[0030] The keys in a first version of the invention are placed one after another in a register forming a list, each key preferably being referenced by its position in the list; the position of a key may be the count of the keys preceding it in the list, or even conversely, the count of subsequent keys, or any other method for locating a number, wherein the list is preferably expandable, in that keys may be added to it, and dynamic, in that keys already used at the beginning or end of the list are preferably deleted from it.

[0031] The keys in the second version of the invention are placed on a register, each key comprising a unique identifier, the list preferably being extensible in that keys can be added to it, and dynamic in that used keys can be deleted from the list. The keys can be of different sizes.

[0032] register

[0033] The system includes a set of registers, a register being defined by a memory location internal to the processor or preferably by a permanent memory location (such as flash memory) that retains information even when the device is turned off. These registers are preferably protected physically and logically so that the information found therein cannot be modified or copied by elements outside the system.

[0034] Although some registers used by the present invention have the same functions in both versions, some registers associated with keys have functions specific to each version. Each register is given a name that begins with S to indicate a server register or A to indicate a device register, so some registers exist in both versions of the present invention, while other registers exist only in one of its versions.

[0035] The invention allows organizing one-time keys into different sets placed on registers within the system to guarantee the security of communications and to facilitate the synchronization of keys between the various elements of the system, and also involves a protocol for using these keys.

[0036] Registers specific to the first version

[0037] According to the present invention, the system may include at least one of the following:

[0038] a register S1 for each device but located on the server, containing an ordered list of random numbers associated with the device, which can be used as a shared one-time key for protecting the communication between the device and the server and as a one-time key for protecting the communication between the device and another device; thus, there are as many lists (registers S1) as there are devices; the keys at the beginning of the list are preferably used to encrypt data sent to the device or are even assigned to encrypt and decrypt data exchanged by the device with another device, while the keys at the end of the list are preferably used to decrypt data originating from the device. In another alternative embodiment of the invention, the system can have multiple servers, each device then having as many registers A1 as there are servers;

[0039] at least one register S3 for each device but located on a server, containing, for that device, a reference to the key allocated for protecting the communication between that device and another device, said references preferably being accompanied by a copy in register S39 of an extract from the register S1 they indicate. This reference may indicate from which register S1 of the first or second device the key was extracted, as well as the position of the key in said register S1 and the number of its components, and, if there are several servers in the system, a reference to the server holding said register S1;

[0040] a register S11 for each device but located on the server, comprising a reference to the first key of register S1 that has not yet been used or allocated for communication between devices;

[0041] a register S12 for each device but located on the server, comprising a reference to the first key of register S1 allocated for decrypting data originating from the device;

[0042] a register S13 for each device but located on the server, preferably comprising the last key of register S1 not yet used, allocated for decrypting data originating from the device;

[0043] at least one register S31 associated with each register S3 for each device but located on the server and comprising a reference to the first key of the register S3 not yet used by the device;

[0044] at least one register S32 associated with each register S3, for each device but located on the server, comprising a reference to the first key of the register S3 assigned to decrypt (if the first key of the register S3 is assigned for encryption) or even to encrypt (if the first key of the register S3 is assigned for decryption) data received from another device;

[0045] at least one register S33 associated with each register S3 , for each device but located on the server, comprising a reference to the last key of register S3 that follows the key indicated by register S32 and has not yet been used;

[0046] a register A1 located on each device, containing an ordered list of random numbers that can be used as a shared one-time key for protecting communications between the device and a server and as a one-time key for protecting communications between the device and another device, the keys at the beginning of the list being preferably used to decrypt data originating from a server or being allocated for encryption and decryption of data exchanged between the device and another device, while the keys at the end of the list are preferably used to encrypt data sent to the server;

[0047] at least one register A3 located on each device, containing one or more lists of references to keys assigned to protect communications between the device and another device, these keys being extracted from the device's register A1 or from another device's register A1, said references preferably being accompanied by a copy on register A39 of the extract from the register A1 they indicate. The reference indicates whether the key was extracted from the device's register A1 or from another device's register A1, as well as the position of the key in said register A1 and the random number of its composition. If the system has multiple servers, the reference also indicates the identifier of the server associated with register S1;

[0048] a register A11 stored on each device, which contains a reference to the first key of register A1 that has not yet been used or allocated for communication between devices;

[0049] a register A12 present on each device, comprising a reference to the first key of register A1 (starting from the beginning of said register) allocated for encrypting data sent to the server;

[0050] a register A13 present on each device, which contains, starting from the beginning of said register, the reference to the last key of register A1, which was allocated for encrypting data sent to the server and which has not yet been used;

[0051] at least one register A31 associated with each register A3 present on each device, comprising the reference to the first key of register A3 (starting from the beginning of register A3) which has not yet been used;

[0052] at least one register A32 associated with each register A3 present on each device, preferably comprising the first key of register A3, starting from the beginning of register A3, assigned for decrypting data sent to another device;

[0053] At least one register A33 associated with each register A3 present on each device, comprising the last key of register A3, starting from the beginning of register A3, allocated for decrypting data originating from another device and not yet used, this decryption key being taken from the end of the list.

[0054] Registers specific to version 2

[0055] The system according to the present invention may include at least one of the following:

[0056] a set S1' of disposable keys for communication between the server and the at least two devices or between the at least two devices, the set S1' being used for each device but present on the server, each key having an identifier S11' and a randomly generated number S10';

[0057] at least one set S3' of identifiers of single-use keys used for communication between two devices and (if the system comprises several servers) of identifiers of servers keeping a register S1' from which the keys are extracted, the set S3' being one for each device but present on the server, a copy of which can be found in a register S39';

[0058] a set A1' of disposable keys for communication between the server and the associated device or from the device to at least one other device, the set A1' being present on each device, each key having an identifier A11' and a randomly generated number A10'. In another alternative embodiment of the invention, the system may have a plurality of servers, each device having as many registers A1' as servers;

[0059] at least one set A3' of identifiers of single-use keys used for communication between the device in question and another device, the set A3' being present on each device, the identifiers optionally being accompanied by said keys;

[0060] ·Preferably and respectively, each disposable key belonging to the set S1' has a first flag S17' indicating whether the key has been used, a second flag S18' indicating whether the identifier of the key exists in the set S3', and a respective third flag S12' indicating whether the key is used to encrypt or decrypt messages on the server, and each disposable key belonging to the set A1' has a first flag A17' indicating whether the key has been used, a second flag A18' indicating whether the identifier of the key exists in the set A3', and a respective third flag A12' indicating whether the key is used to encrypt or decrypt messages on the server.

[0061] The set S1' may contain one-time keys of different sizes. For example, the size of the one-time key is expressed as the number of bits, preferably greater than or equal to the size of the data it encrypts.

[0062] The set S3' containing identifiers of one-time keys for communication between two devices is preferably organized so that the key identifiers are sorted by the identifier of the first device, with an optional index allowing quick access to information related to the second device, or so that even the information can be copied, with the identifiers of the two devices being interchanged for the copied version.

[0063] The date and time each key is used may also be recorded.

[0064] The set A1 ' of devices preferably contains the same information as the set S1 ' of servers, but the set A1 ' is limited to the communication of keys used or to be used by said devices.

[0065] The set A3' of devices preferably contains the same information as the set S3' of servers, but the set A3' is limited to the communication of keys used or to be used by the devices.

[0066] Preferably, each one-time key identifier belonging to the set A3' has a flag A32' indicating whether the key is used to encrypt or decrypt messages on the device.

[0067] Registers shared by both versions

[0068] The system according to the present invention may include at least one of the following:

[0069] Preferably, for each device, a register S14 located on the server comprises the total number of keys of register S1 or S1 ′;

[0070] two registers S15 and S15bis for each device but located on the server, each register containing messages sent to a device that did not occur upon receipt of a receipt originating from that device, requesting such a receipt; register S15bis is reserved for messages containing a key allowing the device receiving said message to send a receipt;

[0071] two registers S16 and S16bis for each device but located on the server, comprising the acknowledgement of a message and the identifier of the message associated with it (for example the message itself, or preferably a hash of the message), the register S16bis being reserved for the acknowledgement of a message containing a key allowing the device receiving said message to send an acknowledgement;

[0072] at least one register S30 for each device but located on the server, associated with each register S3, each register S3 consisting of a flag indicating whether the key originates from a register S1 or S1 ′ of the device or even from a register S1 or S1 ′ of another device, and an identifier of the same key on this same register S1 or S1 ′;

[0073] a register S2 for each device but located on the server, containing the identifier of the device referred to by the set of registers associated with said device;

[0074] a register S4 for each device but located on the server, containing operational statistics of the one-time keys and, preferably, for each other device, an optimal number of one-time keys associated with that other device. This optimal number may be determined by the server or the device and may, for example, be a multiple of the number of times the two devices have communicated in the last week, plus a multiple of the number of times the two devices have communicated in the last three weeks, plus a fixed number; this fixed number, which depends on each pair of devices, may, for example, be larger for devices that are considered to be in the same geographical area. The server's set S4 may contain, in a non-limiting manner, the identifiers of the other devices for each device with which the device has communicated within a given period of time, and the number of one-time keys used in the current week or in the past three weeks. The device may also include a register A4 comprising key usage and communication statistics, including the date and time of their use;

[0075] Preferably, a register S5 for each device but located on the server, containing a list of identifiers of other devices that must be removed from the register A3 or A3' of the device when the device next connects to the server, said identifiers possibly having been added to the list, for example for security reasons, to prevent the device of the system from communicating with said at least one other device. The device may also comprise a register A5 containing this information;

[0076] at least one register S34 associated with each register S3 or S3', preferably for each device but located on the server, comprising the total number of keys of the register S3 or S3';

[0077] at least one register S35 associated with each register S3 or S3' for each device but located on the server, indicating whether this register S3 has been copied to the device;

[0078] at least one register S36 associated with each register S3 or S3' for each device but located on the server, indicating whether this register S3 or S3' has been copied to another device;

[0079] Preferably, the identifier of each one-time key belonging to the set S3 or S3' has a flag S37 indicating whether the key must not be used again;

[0080] at least one register S38 indicating the identifier of another device, and preferably a register S38bis indicating the identifier of a third device, associated to each register S3 or S3′ for each device but located on the server, the key of the corresponding register S3 (if it is not empty) being specific to the communication between said other device and the third device and not between said device and said other device, and having to be transmitted by said device to said other device;

[0081] two registers S42 and S42bis, preferably for each device but located on the server and associated with each other device, used as flags to indicate whether a request for a key intended for or originating from the other device or a request for a role exchange of keys, respectively, must be signed;

[0082] a register A2 present on each device, which contains the identifier of the relevant device;

[0083] a register A14 preferably present on each device, which contains the total number of keys of register A1;

[0084] two registers A15 and A15bis present on each device, each of which contains a message sent to the server that does not occur upon receipt of a receipt originating from it, but requests such a receipt;

[0085] Two registers A16 and A16bis present on each device, each register comprising a receipt of a message and the message to which the receipt refers or, alternatively, a hash value of the message;

[0086] a register A30 consisting of a flag indicating whether the key originates from register S1 or S1 ′ of the device or from register S1 or S1 ′ of another device and an identifier of the same key on the same register S1 or S1 ′;

[0087] a register A34 associated with each register A3 present on each device, preferably, comprising the total number of keys of the register A3 or A3';

[0088] a register A35 associated with each register A3, preferably present on each device, containing a "server" flag indicating whether one of the other registers associated with register A3 or A3' has been modified since the last connection of the device concerned with the server;

[0089] a register A36 associated with each register A3 or A3' present on each device, preferably including a flag indicating whether this register A3 or A3' is present on another device;

[0090] Preferably, the identifier of each one-time key belonging to the set A3 or A3' has a flag A37' indicating whether the key is no longer used;

[0091] a register A38 associated with each register A3 or A3′ present on each device, comprising the identifier of another device associated with register A3 or A3′, and preferably a register A38bis indicating the identifier of a third device, the register A3 being dedicated, if it is not empty, to the protection of communications between the third device and another device, the identifier of which is recorded in register A38;

[0092] two registers A40 and A40bis present on each device and associated with each other device, each register comprising a message sent to said other device which did not result in receipt of a receipt originating from said other device, but which requested such a receipt; the message is preferably associated with the identifier of the device receiving the message. The register A40bis may preferably contain a message conveying or exchanging a key, thus allowing the device receiving the message to confirm receipt of the message;

[0093] a register A41 and another register A41bis present on each device and associated with each other device, each register comprising a receipt of a message and the message to which the receipt refers or, alternatively, a hash value of the message; the register A41bis may preferably contain a receipt of a key transfer message;

[0094] Two registers A42 and A42bis, preferably associated with each other device or server, used as flags to indicate whether a request for a key or a role exchange of keys, respectively intended for or originating from said other device, must be signed.

[0095] A set of registers may additionally be arranged on the server and / or on the device, while allowing the aforementioned information to be extracted therefrom.

[0096] Each of the above lists can be arranged so that registers, in particular registers occupied by the used random numbers, can be deleted or reallocated for similar or different purposes. The registers containing random numbers can contain, for example:

[0097] sub-registers, the sub-registers comprising a random number of pages or parts of pages, each page or part of a page pointing to a following or previous page or part of a following or previous page, and for which a first bit contained in each page or part of each page indicates whether the part of the page or the page can be deleted;

[0098] Another sub-register containing the addresses of the first and last pages that cannot be deleted, and an indication allowing finding the random number corresponding to the location referenced by register A11, A12, A13, A31, A32 or A33.

[0099] In this case, the count of random numbers contained in each register will preferably count the deleted numbers as still present, advantageously other registers can be introduced to count the number of keys actually present on registers S1, S3, A1 or A3.

[0100] Devices and servers may include other registers that can be selectively updated during their use, such as indexes, allowing them to negotiate and update themselves faster. A server or device may also include a process that allows a series of random numbers contained in a page to be moved to other pages if this allows various random number pages that are not in use to be merged onto the same page, freeing up pages that can be reused later.

[0101] Register Summary Table

[0102]

[0103]

[0104] Data compression and decompression algorithms can be used to send and receive, respectively, any data exchanged between two elements of a system.

[0105] The steps related to sending and receiving data can be performed using the same communication protocol or using different communication protocols; the protocol can be, for example, wired transmission in a non-exclusive manner or transmission through a contactor allowing establishment of a wired link, wireless transmission, such as Wi-Fi, 4G, 5G, WiMAX, Lora or Sigfox.

[0106] Device Group

[0107] Intermediary Device

[0108] According to the invention, the server and the devices can be configured to limit secure communication between some devices by associating a one-time key only with pairs of devices that comply with some rules, such as (in a non-limiting way) pairs of devices that are authorized to communicate securely, or groups of devices that are authorized to communicate together. The use of devices that must be introduced into the communication between two standard devices, in particular intermediary devices (such as "dual readers"), can actually reduce the number of pairs of devices whose communication needs to be protected; the intermediary devices and the standard devices then belong to two different groups, respectively. If there are only n standard devices communicating with the intermediary device and the server, and N intermediary devices communicating with the server and each standard device together, the number of links to be protected (including the link with the server) is: (N+n)+N*n+N*(N-1) / 2, while if the standard devices communicate directly with each other, there are n+n*(n-1) / 2=n*(n+1) / 2 links to be protected; for example, if a standard device has x intermediary devices, the ratio of the number of links to be protected to the number of links to be protected in the absence of intermediary devices is almost 2x+x if n is large. 2 .

[0109] Thus, by using a small x, the invention allows considerable savings in the number of keys provided on a device, in particular on a standard device; indeed, x can be very small if the intermediary device is, for example, a cash machine and the standard device is a credit card, or can be only slightly smaller if the intermediary device is, for example, a portable device allowing communication between two standard devices, the standard devices being in the form of a credit card.

[0110] Groups or user groups per zone

[0111] In another configuration, standard devices may all communicate directly within the same group, but may also all communicate with a set of shared intermediaries. Such a configuration may be used directly for device-to-device money transfer purposes within the same country, where the devices are, for example, in the form of calculators with keyboards, but require an intermediary, such as in the form of a merchant payment terminal, in order to operate abroad.

[0112] Groups for each group of users using mediation

[0113] In yet another configuration, devices may belong to three types of groups: devices of a first type of group may communicate together, may communicate together within the same group by using intermediary devices belonging to a second type of group, or may even communicate together through intermediary devices belonging to a single group of a third type. A first type of group may be, for example, a group of smart cards from the same country containing registers for recording monetary amounts or representing official or commercial documents, requiring secure communication between them to transfer said documents or monetary amounts between devices; a second type of group is a group of readers from the same country, which allows smart cards from that country to communicate with each other and read the information they hold; devices from a third type of group allow devices from any group of the first type to communicate with each other and allow information on them to be read, for example, devices of the third group are owned by banks, foreign exchange offices or merchants around the world who may have foreign customers. Devices of the second and third types may be kept low in number while retaining the possibility of secure communication with the server if they contain only information that may be lost and then may be actively excluded from their groups, for example, by a system operator.

[0114] equipment

[0115] Some of the processes described in this disclosure sometimes communicate between two devices, sometimes communicate between a device and a server, and sometimes communicate between a device and a server and between devices. A device represents an object that can be equally a server or a device.

[0116] encryption

[0117] A predictable encrypted message sent by a device or server over an unsecured line can be intercepted, and then the encryption key can be calculated by a malicious party, who has no interest in keeping the message they know secret, but rather in using the device's real key to sign the message they have composed. Furthermore, the malicious party does not have to have the opportunity to predict the exact message, but only needs to be able to limit the potential range of messages sent, or even to be able to limit the range of messages sent to a potential range of messages sent (i.e., the probability that the message belongs to this range is high), because the malicious party can then predict from these potential ranges of messages sent the potential range of keys that they can use to form encrypted messages that they can send to the devices of the system one by one until the system accepts one of the messages; the probability of success within a reasonable period of time for the method is also important.

[0118] However, the system may use a different set of keys to encrypt messages that can be predicted, using a set of keys for signatures between devices that are technically similar to the set of keys intended for signatures used for communications between devices (but reserved for encrypting data between devices if these encrypted communications are also signed), so that any encryption key is used only once by the system.

[0119] Alternatively, data can be encrypted between devices so that the used key is not revealed when an encrypted message that can be predicted is intercepted. This is possible if the encryption is performed by encrypting the exchanged data in succession using at least two keys. For example, a first key encrypts a message for the first time, and then a second key encrypts this encrypted message. The interception of a predictable message encrypted multiple times can still indicate a link between the keys used.

[0120] Therefore, the encryption of the predictable message is preferably performed by using an encryption function that is applied to the entire message continuously, preferably twice, by a one-time key, the size of which is at least equal to the size of the message and is extracted from the same key set as the key assigned to the signature between the devices, and the key is preferably used only once by the system to perform this encryption. However, the XOR function can also be used as an encryption function, such as a symmetric or asymmetric encryption function, such as AES, Blowfish, DES, Triple DES, Serpent or Twofish or any other combination or other encryption function using a one-time key. Two different functions can also be used for each of the two consecutive encryption operations. The information sent encrypted by the one-time key is preferably preceded by the common identifier of the key used for encryption. If the encrypted message is longer than the key that can be used for this encryption, multiple keys can also be used to form a single large key once associated. In this case, the identifier of the key used for encryption must contain the identifiers of all the keys used.

[0121] The encryption of the message is performed in an unpredictable manner, preferably using an XOR function applied once to the message to be encrypted with a one-time key of the same size as the message, or by another encryption function using a one-time key (such as ES, Blowfish, DES, Triple DES, Serpent or Twofish) or any other combination or other encryption function.

[0122] sign

[0123] Modern cryptographic techniques currently use "signatures" that are used to verify that data originated from a known sender of the device receiving the data. These signature techniques typically use asymmetric key systems. In the present invention, and in order to overcome any weaknesses associated with the use of asymmetric keys, a signature system that utilizes a one-time key is preferably used.

[0124] The signature of a message that cannot be predicted, based on the encryption of, for example, a number that has been randomly generated, is less complex than the signature of a message that can be predicted by a third party. In fact, knowledge of the message and its signature can provide information about the one-time key used for the signature and thus optionally allow a third party to intercept the message and its signature and then replace them with something else that has also been signed. The message can be predicted by intercepting it, but it can also be predicted by making assumptions about its composition: for example, if the message concerns a meter reading, this reading can be predicted, or even chosen randomly from one of a few possible readings of said meter.

[0125] Therefore, the signature of the message which cannot be predicted is preferably formed by a hash value encrypted by a one-time key associated with an identifier of the key.

[0126] The signature of a predictable message is preferably formed by the encryption of a number randomly generated by the sender of the message, and the encryption of a hash value of a combination of the message to be signed and the number randomly generated by the sender, the sender being associated with an identifier of the two keys used for the two encryptions. The signature can be verified by decrypting the random number, then recombining it with the signed message, and then verifying that the hash value of this combination is indeed the decryption of the received hash value. The signature then requires the use of two disposable keys: one for encrypting the random number and the other for encrypting the hash value.

[0127] The random number can be replaced by a one-time key, which no longer needs to be encrypted and is not included in the signature except for its identifier; the signature is then formed by combining the encryption of the hash value of the message with the one-time key, and the signature is associated with the identifier of the one-time key and the identifier of the one-time key used to encrypt the hash value.

[0128] Encryption is understood to mean the encryption of an element encrypted by a one-time key preceded or followed by an identifier of said key.

[0129] Combining two elements is to be understood as any message formed by two combined elements, for example one element is associated with the other element or one element is symmetrically encrypted by a symmetric encryption method using the other element as a key.

[0130] receipt

[0131] Benefits of having a receipt for regular messages

[0132] The process implemented by the present invention includes transmitting an identifier of a key from one device or server to another device, and also marking the key as used. Therefore, an electronic device external to the system may maliciously request that a device or server of the system only send it a message that has been signed or encrypted, so as to exhaust the available reserve of one-time keys in the system device. An electronic device external to the system may also intercept a sent or signed encrypted message intended for a device of the system or server in order to resend the initial message, thereby helping to exhaust the reserve of keys. Therefore, the system is preferably designed so that a device or server does not resend a normal message (i.e., a message that is not a receipt) using a one-time key directed to the same device or the same server before receiving a receipt for a previous normal message. In order to limit the number of keys present on each device for communicating with each other device of the system, the system can still allow a signed message to be sent from a first device to a second device, even if the second device does not necessarily have a key for sending a receipt. If the first device wishes to be able to subsequently add a key to the second device, thereby allowing the second device to send a receipt, the first device must (if possible) be able to send a key transfer message, even if the first device has not yet received a receipt for the previous message. Two types of normal messages are then identified, the first type being messages capable of transmitting information and transmitting the key required to resend the receipt, and the second type being messages that merge all other normal messages. Preferably, a message of the same type is only sent if a previous message of the same type has already appeared when the receipt is received; a key transfer message can transfer enough keys to add the necessary keys to the receipt, and the transfer message can be of the same type. The term transfer key is understood in this context to mean sending a one-time key reference assigned by a server to another device for securing communications with the other device.

[0133] Keep sent messages until receipt is received

[0134] Preferably, the device and server keep in memory the last message of the same type they sent until a receipt for that message has been received.

[0135] Keep the last sent receipt

[0136] Preferably, the device and server maintain a register of receipts sent after the last message of the same type was received, so that they can resend the receipt when the same message is received again. Preferably, the device and server also maintain a register of messages corresponding to the retained receipts, or alternatively, another means for confirming the message, such as a hash value of the message, so as to be able to verify whether the received message has resulted in the preparation of the receipt.

[0137] Delete the last sent receipt

[0138] The device deletes the previously sent receipt from its register by composing a new receipt. In addition, if a message is received for which a receipt is required to be sent, but the device receiving the message does not have sufficient keys to confirm its receipt, an unsigned receipt is registered in the register of the last receipt and a reference to the message it refers to is registered in the register provided for this purpose, without sending an unsigned receipt. This allows a device receiving a new key to sign and then send a receipt for a previously received message for which a receipt has not yet been sent.

[0139] Content of the receipt message

[0140] The receipt will preferably be a signed message. Preferably, it will contain an identifier of the message it confirms receipt, which may be a hash of the message. The receipt may also contain other information, such as a response to a message sent, information about the state of the system, or information about the role of the key used to transfer or exchange it, the role of the key being to encrypt or decrypt messages depending on the device it is on.

[0141] Companion between composing a received message and registering its receipt

[0142] In order to prevent the same message from attempting to modify the same register multiple times, if the server or even the device receiving the message must modify its register after receiving the message, all these modifications will preferably be confirmed when the receipt is registered in the register provided for this purpose, whether or not it is signed.

[0143] Verify the modification of another device's registers

[0144] To ensure that any modification to the register initiated by a first device, apparatus or server has been taken into account by a second device to which a message is sent instead of a receipt, the first device verifies that it has definitely received a receipt for a previous message it sent to the second device.

[0145] When an error is detected in encryption

[0146] Messages sent from a device or server to another device or server can be intercepted and modified, which can result in inconsistencies or attempts at fraud when these messages are received. These messages can even be intercepted, modified, and sent multiple times to other devices or servers. However, if the message consists of a sufficiently large cryptographic random number (e.g. 128 bits), or if the random number used to form the signature is sufficiently large (e.g. 128 bits) even in the case of a "predictable" message, the time required to decode a large number of fake messages transmitted to a device so that there is a small chance that at least one of the fraudulent messages will not be recognized as fraudulent by the device will be (if the device can perform 1 billion verifications per second) about 4.10 18 Days. Alternatively, if the time allotted for computing the decryption is limited to, for example, 1 / 100 of a second after the transmission of a command sent to the device by the user when he presses a button, and limited to, for example, a total of 1 second per day, then using a 64-bit key, the device would need to be used for 50 years so that it would have a small chance of accepting as a non-fraudulent message a fraudulent message sent to the device during the full number of operations of the device's encryption processor. Therefore, a device or server that receives such a fraudulent message will preferably not mark the key used for the message as fraudulent. However, they can send a message instead of sending a receipt to notify other devices or servers that they have received such a message.

[0147] Key

[0148] Roles assigned to keys

[0149] Two devices, or even a device and a server, can send messages to each other at the same time, i.e. before receiving a message sent by the other device or server, and therefore do not know which keys the other device or server has already used. In order to avoid that two devices or servers use the same key to exchange messages, the system according to the present invention is preferably organized so that unused keys can be identified on each device as keys that can be used to encrypt data rather than decrypt data. This identification will preferably be reversible, wherein a device or server can mark any key or any key group that was originally identified as reserved for encryption as reserved for decryption, and can notify the other device or server of this by a message that is preferably signed and optionally encrypted, wherein the device identifies the key or key group as being usable for encryption after receiving the message.

[0150] This change of key identification will preferably be performed after an ordinary request sent by another device or server, but may also be performed spontaneously or after a request to encrypt then sign or sign then encrypt. Advantageously, a device or server can verify before performing such a change that the device or server will still have at least one key that can be used to send a signed receipt to the next message (that the device or server will receive). Preferably, a device or server will not change the marking of a sufficient number of keys reserved for encryption with another device to provide the number of keys required to respond to or confirm the receipt of possible future messages.

[0151] Location of the key

[0152] The invention allows a server to assign to a second device keys already found on a first device. Thus, a situation may occur in which a device has used keys to encrypt or sign a message without notifying the second device, the recipient of the message, that the first device can use these keys. In this way, the keys used by the first device will not be found in registers A3 or A3' of the second device, but in registers A1 or A1' that it can use to encrypt keys for communication with the server. A device verifying a signature or decrypting a message can use these keys placed on registers A1 or A1' and can confirm the signature as if one or more keys used keys obtained from registers A3 or A3' and dedicated to communication with another device.

[0153] Key Delivery Message

[0154] Key transfer messages allow a new key to be transferred to a device, or even allow another device to be informed that a particular key is dedicated for communication with it, or to change the role of a key assigned for decryption to a key assigned for encryption. In order to prevent a lack of keys for transmitting a receipt of said message in a device receiving such a key transfer message, these messages each preferably transfer a quantity of keys at least sufficient to enable the device receiving said message to resend a receipt.

[0155] Request Key

[0156] The invention allows a server to assign to a second device a key that has already been found on a first device. Thus, it may happen that a key has been assigned to a second device without the first device being informed, and the first device wishes to communicate with the second device without knowing which key can be used to ensure the communication. For this reason or for any other reason, the first device can preferably make a general request for a list of disposable keys shared by the two devices, which request can be signed or unsigned. The request can optionally match the ideal number of keys required, but can also match the minimum number of keys required. The second device that receives such a request for a key identifier sends a message in response, which is preferably signed and optionally encrypted and contains the identifier of the required key. In order to prevent malicious devices from continuously requesting that keys be transferred to a third device, a mechanism for limiting the number of keys transferred can be introduced. Such a mechanism can involve a limited number (for example ten) of keys that can be transferred after the third device receives the first request. Any subsequent request must then be signed, and the device and the server retain information indicating whether the request must be signed on registers S42, S42bis, A42 or A42bis. If the key request is signed, the key may be delivered in the receipt message.

[0157] Use of token keys

[0158] Preferably, the keys used to encrypt the message are marked as used by the device that encrypts the data and then used by the device that decrypts them after receiving the message. Preferably, the roles assigned to the used keys cannot be modified. The marking, in particular for the first version of the invention, can be achieved by the relative position of the keys with respect to a dynamic cursor, wherein the cursor separates the used keys from the keys that have not yet been used.

[0159] In a first version of the invention, the key used for encryption is marked as used by modifying its associated register S11, A11 or A31; the key used for decryption is marked as used by modifying its associated register S13, A13 or A33. Preferably, registers S35 and S37 or A37 are also activated.

[0160] In a second version of the invention, a key used for encryption or even for decryption is marked as used by modifying its usage flag S17', A17', S37 or A37, this modification preferably being accompanied by the activation of a server flag.

[0161] Non-parallel process

[0162] Preferably, the secure communication process described below is accessed in a centralized manner to prevent two concurrent processes accessing the same key register from being able to send keys to a device or server for one process while another process requests to receive keys from the same device or server.

[0163] Accompany

[0164] Some electronic devices offer the possibility to modify several registers accompanying. Preparing and sending messages between various devices and servers sometimes requires modifying the registers described in this system and registering the prepared message in the register containing the last sent message for which no receipt has been received.

[0165] In order to prevent these registers from being modified again if a message has to be prepared again, the registers modified by creating and signing the message are preferably modified simultaneously, including the register containing the last message sent for which no acknowledgement has yet been received.

[0166] Similarly, a received message may result in the modification of registers including the register containing the last receipt.Preferably, the registers that must be modified when receiving a message are modified simultaneously, including the register containing the last message for which an acknowledgement has been sent.

[0167] process

[0168] The process of distributing and synchronizing one-time keys used to communicate between devices over an insecure link

[0169] The invention also relates to a process for distributing and synchronizing one-time keys for communication between devices over an unsecured link, the purpose of which is to install on a device a one-time key allowing it to communicate with other devices, said devices and a server belonging to a system, the method comprising:

[0170] 1. Preferably, the device establishes a set of one-time key identifiers based on its set of keys A3 or A3' dedicated to security between devices, and the "server flag" A35 of the set of key identifiers is activated;

[0171] 2. Preferably, registering in the register A15 of the device a signed message containing the set of identifiers established in the previous step and information relating to registers A3 or A3' (A31, A32, A33, A34, A36, A37 or A32', A36 and A37) with the server flag activated, and then sending said message;

[0172] 3. When the device receives the receipt, it deletes its register A15;

[0173] 4. When the device receives a new one-time key from the server: verify the signature of the received message, decrypt the received key and mark the key used for signing and encryption as used, and register the received key into the device's register A3 or A3' and its related registers (A31 to A38, or A32', A34, A37 and A38);

[0174] 5. Register the receipt in the device's register A16 and then send the receipt to the server.

[0175] These exchanges are preferably performed as normal exchanges, accompanied by the signature of the device or server sending the information, which is verified by the device receiving the information, the key received in step 4 preferably being encrypted using the one-time key of register S1 or S1 'used to encrypt communications between the device and the server.

[0176] If the device receives multiple messages holding keys, steps 3 and 4 may be repeated multiple times.

[0177] The method preferably comprises between step 2 and step 3:

[0178] After receiving the set of key identifiers established in step 1, verifying the signature of the message, the server updates its set S3 or S3' and registers S30, S31, S32, S33, S34, S36, S37, or S32', S36 and S37 and S4, and sends a receipt;

[0179] Then, between steps 2 and 4 include:

[0180] i. using, among others, the set S4 and taking into account the keys S1 required on the server for signing the message being prepared and taking into account the fact that any key transmitted from the register S1 of another device will require a key of the same size from the register S1 of the device in order to be encrypted, the server calculates or recalculates the optimal number of one-time keys used by the device to communicate with each other device; this number may, for example, correspond to a certain multiple of the number of keys used last week, and if this number is greater, to the number of keys used last month and a further constant, which number, once calculated, may be registered on the same register S4;

[0181] ii. the server uses this optimal number and a calculation of the number of unused one-time keys for each other device based on registers S31, S32, S33 and S34 or S37 to determine the number of keys to be associated with the device for communication with each other device in the system in addition to the keys already associated with the device for this purpose;

[0182] iii. the server associates the one-time key with a device present on the set S1 or S1' of other devices identified in the previous step and which must obtain a new communication key using the one-time key, the server associating the key preferably involving: 1) adjusting registers S3 or S3', S31, S32, S33, S34, S35 and S38 of the other devices to take into account the newly allocated key, and adjusting registers S11 or S17' of the other devices to reflect the availability of the key to the other devices, these adjustments to registers S3, S31, S32, S33, S34, S35 and S38 involving the creation of a new register S3 or S3' by allocating storage space to the new register, and for a first version of the invention: by directing register S3 towards the number of registers S1 allocated to it, by setting registers S31 and S32 to "0" and register S33 to the number of keys formed, by setting register S35 to a "false" Boolean value and registering in S38 the identifier of the device communicating with the server; and, for a second version of the invention: by registering in register S3' the identifier of the key assigned to it of register S1', by setting to true a Boolean register S18' indicating whether the key of S1' is used on register S3', by setting to a "false" Boolean value register S35 indicating whether the key has been copied to the device, and by registering in S38 the identifier of the device communicating with the server; and 2) for each register S3 or S3' created in the previous step, creating, associated with the device, a register S3 or S3' containing the same information as the register S3 or S3' of the other device, but wherein the register S38 of the identifier of the other device includes the identifier of the other device, and wherein, in register S39, a copy of the random number of register S1 or S1' referenced by the key is registered;

[0183] iv. Based on the list of sets S3 or S3' modified in the previous step, a set of keys associated with the device is established by the server and marked as not present in its set A3 but present in the set S1 or set S3 (S1' or S3') of other devices;

[0184] v. associating the keys with their identifiers, i.e. their position and size in the register A1 (A1') of the device and with the identifier of the device associated with each of these keys, and optionally merging this information into groups in each of which the information relating to each key is found;

[0185] vi. For a group for which a message has not yet been compiled, a message containing the elements determined in the previous step is compiled into a message, the key (but not its identifier) ​​is encrypted, the message is then signed, the keys used for encryption and for signing of register S1 or S1 ' are marked as used and the message is registered in register S15 of the server;

[0186] vii. Send the aforementioned message;

[0187] vii. After receiving a receipt for the aforementioned message, one of the messages for which a receipt has not yet been received is deleted from its register S15, and the server updates its register S35 or S36;

[0188] ix. By repeating steps vii and viii of the process, other groups formed in step vi that remain to be sent are sent, if some groups remain to be sent.

[0189] The process can be limited to keys belonging to a limited subset of other devices, such as the last two other devices that communicated with the device using a one-time key, or devices waiting for receipt, or even devices that do not have any associated keys, because one of the two devices has recently been introduced into the system of devices that can communicate with the server, or because secure communication has already occurred between the two devices; for example, in the first case, there can be 8 keys, meaning that 2 keys will be retained on one device and the other 2 keys can be transmitted to the other device via a message containing 4 keys; or there can be 28 keys (if the two devices have been communicating), meaning that 12 keys will be retained on one device and the other 12 keys can be transmitted to the other device via a message containing 4 keys; or there can be even more keys if the two devices communicate frequently.

[0190] The process used to exchange keys

[0191] In the case where keys are assigned for encryption or decryption, a situation may occur where a key shared between two devices (devices A and B, or servers A and B) is assigned for encryption on device A and decryption on device B, while data must be encrypted on device B in order to be sent to device A.

[0192] In this case, the roles of the keys may be interchanged, and thus hereinafter reference will be made equally to key role interchange and key interchange.

[0193] The keys can be exchanged according to the following process:

[0194] 1. Device A verifies that its register S15bis, A15bis or A40bis, which contains the last message sent to device B for which no receipt has been received, is empty;

[0195] 2. Device A forms a list of keys that are marked for encryption and present in the key register dedicated to communication between devices of the other device, which device A wishes to mark for decryption, identifying the keys required to sign the message that device A wishes to send and, if register A42 or S42 must sign a request message indicating a key intended for another device, an additional number of keys that allow such a signature, so as not to interchange their roles. In the list of keys whose roles it wishes to change, device A includes the keys that will be useful when device B sends a receipt for the message being prepared; and finally, if device A does not have a key with which to interchange roles, device A cancels the process;

[0196] 3. Device A composes a message formed by the aforementioned list, signs said message, places it in the register S15bis, A15bis, S15bis or A40bis of the key exchange message sent but not yet received, then exchanges the direction of use of the sent key in its own register and marks the key used for signing as used;

[0197] 4. Device A sends a message;

[0198] 5. Device A receives the receipt and deletes the message placed in register S15bis, A15bis, S15bis or A40bis in step 3.

[0199] Preferably, after receiving the message sent in step 4, device B:

[0200] a. verifying whether a receipt for the received message is not already prepared, and if so, sending said receipt, and then terminating the process;

[0201] b. verifying the signature of the message and rejecting it if it is invalid, wherein the signature can use the keys present in its registers S1 or S1 'which also contain the keys dedicated to the communication between the server and the device;

[0202] c. Mark the key corresponding to the sent quote as an encryption key, prepare the receipt, compile the signature of the receipt of the received message using one of the keys, thereby marking the key as used, and then register the receipt in the register S16bis, A16bis, S16bis or A41bis of receipts of key exchange or key transfer messages. At the end of this step, all modifications of the registers on device B are preferably verified simultaneously;

[0203] d. Device B sends the message prepared in the previous step.

[0204] Key transfer process

[0205] In some cases, a key may exist in a register of device, apparatus or server A as allocated for data encryption by device B without informing device B as such; although the key is not allocated for communication with device A, it still exists on device B, and device A may send a message to device B to instruct it to mark the key as dedicated for communication with device A. The following process is preferably used for this purpose:

[0206] 1. If necessary, device A receives a receipt for a previous message dedicated to sending a key for which a receipt has not yet been received, and stops the process if a receipt has not been received;

[0207] 2. If device A is connected to the server, it may perform a process to synchronize the keys between the server and the device, optionally by limiting the process to keys dedicated to communication with device B, or to keys dedicated to communication with devices for which device A has received n messages and for which device A does not have sufficient keys to send a receipt;

[0208] 3. Device A extracts, from the keys it has marked for communication with device B but which are not present on device B, the keys necessary for the transmission of the signature of the message prepared by this procedure and, if register A42 indicates that a message requesting keys intended for other devices must be signed, identifies an additional number of keys that allow this signature so that these keys are not sent;

[0209] 4. Device A optionally changes the role of some of its marked keys used for communication with device B but not present on device B by marking them as reserved for encryption by device A;

[0210] 5. Device A creates a list of keys marked as encrypted by device B and another list of keys marked as encrypted by device A, where the keys of these lists are marked for communication with device B but are not present on device B;

[0211] 6. Device A signs the message consisting of the two lists prepared above using the key determined in step 2, and registers the signed message in the register allocated for key-transmitted messages for which no receipt has been received;

[0212] 7. Device A sends a message;

[0213] 8. Device A receives the acknowledgement and deletes the message from the register allocated for key transfer messages for which an acknowledgement has not been received.

[0214] Preferably, at the end of step 6, all entries in the registers generated in steps 4 to 6 are determined.

[0215] Preferably, after receiving the message sent by device A in step 7:

[0216] a. If the received message is a message for which a receipt has been placed in the receipt register, the device B resends the receipt in the receipt register dedicated to the message sending the key;

[0217] b. Device B verifies the signature of the message, the key used for the signature can be found in the register of keys used for exchanges between servers and devices, and rejects the message if the signature is invalid;

[0218] c. Device B deletes the receipt register dedicated to the message sent with the key;

[0219] d. Device B registers the keys used for signing in its register of keys used for communicating with another device by marking these keys as used;

[0220] e. Device B registers the keys received in the message in its register of keys for communication with another device by marking them as unused, and also registers the role of the received key according to the received message;

[0221] f. Device B prepares a receipt of the message, optionally a marked receipt of the received key assigned for encryption, and registers the receipt in a receipt register assigned for the key received message;

[0222] g. Device B sends a receipt.

[0223] Preferably, at the end of step d, all entries in the registers generated in steps b to d are determined.

[0224] The process of placing a new one-time key from the server on the device

[0225] According to another aspect of the invention, another object of the invention is a method for placing a new one-time key from a server on a device, the method comprising:

[0226] 1. Preferably, connect the device to the server in a secure environment and physically keep the device in said environment until the process terminates, then calculate the number of keys remaining in the key register S1 or S1' in order to know if there is enough surplus to send at least 2 signed messages, and finally, send a secure message to the device to indicate that the device is secure;

[0227] 2. If sufficient keys remain on register S1 or S1' for communication with the device so that, after a possible synchronization, the device and the server can exchange signed messages, a synchronization process is preferably performed between the device and the server by omitting the encryption of the keys, then verifying that the message for sending or exchanging the role of the keys sent to the device has appeared after receipt of the receipt, by verifying that the register S15bis of the server containing the last key message sent to the device has been deleted; otherwise, the last message is resent and the receipt is awaited, then the process is restarted from step 1);

[0228] 3. Preferably, the device deletes the used key from its set A1' and A3' or A1 and A3 containing keys for communicating with the server or with the device, then releases the storage space occupied by the deleted key on the device and the server, and notifies the server of the available storage space on the device using a signed message;

[0229] 4. Using the set of registers located on the server, the server calculates the number of new one-time keys that can be placed on the device in the list of keys A1 'or A1 dedicated to communication with the server, the number of keys to be placed on the device being derived from the register S4, the storage space available on the device received in the signed message, and the space that needs to be kept available for creating a new register A3 or A3 'dedicated to protecting communication between devices;

[0230] 5. Generate a new key preferably by a random number generator;

[0231] 6. Create a normal but preferably signed message, which is preferably placed in register S15bis containing these keys;

[0232] 7. Send the message prepared in the previous step to the device;

[0233] 8. The device receives the message and copies the key registered on the message to register A1' or A1 containing the key for communicating with the server, and possibly updates registers A11, A12, A13 and A14, then registers the receipt in register A16bis of the device, and finally sends the receipt to the server;

[0234] 9. Receive the preferably signed receipt sent by the device, and this may use the key sent in step 7, and the device records the key registered in the message in register S1 or set S1' (located on the server for communication between the server and the device), and optionally updates registers S11, S12, S13 and S14, and deletes register S15bis from the server;

[0235] 10. Preferably, repeating the synchronization process between the device and the server while omitting encryption of the key;

[0236] 11. Terminate the connection in the secure environment and then authorize the device to leave the secure environment.

[0237] The modification of the register (consisting of registering the message or the receipt in the register A15bis, S15bis, A16 or S16bis of the device or server in which it was placed before being sent) is preferably carried out concomitantly in each of the above steps.

[0238] If the keys created in step 5 are divided into multiple groups, steps 6 to 9 may be repeated, each of which is sent in a separate message.

[0239] The "connection in a secure environment" between a device and a server is understood to mean that the device and the server communicate via a secure transmission channel, for example, directly connected in an environment that prevents possible communication interception, or even connected in a secure environment via a secure connection (such as a quantum wire) to the device communicating with the server. The protected environment can be, for example and by way of illustration, a room protected by guards and surrounded by metal fences, thereby isolating the room from radio waves.

[0240] Preferably, the method for placing a new key in a system according to the first version of the invention comprises between step 2 and step 3:

[0241] i. Optionally, the server sends to the device, preferably in a signed message, a list of devices for which said device can delete the record on the register A3 or A3' of the keys it intends to use for protecting communications between devices, wherein the list comprises the identifier of the device for which the register S5 indicates that it must no longer communicate with said device, or even indicates that the device is associated with an excessive number of keys, i.e. for example more than 40% of the optimal number of keys registered on the register S4;

[0242] ii. Optionally, the device deletes from its register A3 or A3' the information relating to the means indicated in step i.

[0243] Process for sending a receipt for a received message for which a receipt has not yet been sent

[0244] Preferably, the following steps will be implemented by a first device having received a first message from a second device, for which an unsigned and therefore unsent receipt has been prepared:

[0245] 1. If the first device does not have sufficient keys to send a receipt for the first message, the first device requests a role reversal or requests that the keys be transmitted to the second device via a second message (the second message is signed if the register A42 or S42 associated with the second device indicates that such a request must be signed), and if the keys are received, the first device associates these keys with the communication with the second device and then optionally compiles a receipt for the received second message transmitting the keys. If no keys are received, the process stops;

[0246] 2. The first device prepares and sends a receipt for the first message.

[0247] A second device in communication with a first device, an apparatus or a server, in particular in step 1, can verify the signature of the received second message if the register S42bis or A42bis associated with the second device indicates that a signature is required in the case of a request for one or more receipts. Then, if the verification result is positive, the second device responds to the request by sending a signed third receipt message, which includes a sufficient number of keys requested for the receipt. If such a request has been made and a receipt has been sent in the form of a third message, the second device resends the third message. If the request is not signed, but the register S42bis or A42bis allows the acceptance of this request without compiling the third message, the second device compiles a fourth message for exchanging the role or transfer key of the key (the key includes the key that allows the first device to sign the receipt prepared for the first message), then puts the fourth message into the register S15bis, A15bis or A40bis of the message to be sent (these registers include the key for the receipt), and finally sends the fourth message.

[0248] The process of resending a message for which a receipt has not yet been received

[0249] Preferably, the following steps will be implemented by a first device having sent a message to a second device, for which a receipt has not yet been received:

[0250] 1. If a message previously sent by the first device and placed in register S15bis or A40bis and containing the key required for its receipt has not received an acknowledgement, the first device resends the message and then, when the second device can communicate normally with the first device, waits the time it will take to receive the acknowledgement; otherwise, the process goes to step 3;

[0251] 2. If there is no response to the message in the previous step, the process is canceled, because the message including the key required for receipt should have resulted in receipt;

[0252] 3. If another message placed in the register S15 or A40 of messages previously sent by the first device has not received a receipt, the first device resends the other message and waits for the time normally taken to resend the receipt, and then, after receiving the receipt, the first device deletes the message corresponding to the received receipt from the register of receipts of messages that have not yet been received, and then completes the process;

[0253] 4. If the previous message placed in register S15 or A40 of sent messages and sent by the first device in the previous step has not received a receipt, if the first device has sufficient keys, the first device sends a key transfer or role exchange message, thereby providing the second device with sufficient keys to send a receipt for the message located in register S15 or A40 and the key transfer or role exchange message; then, when the second device can communicate normally with the first device, the first device waits for the time it will take to receive the receipt. In fact, the sent keys must allow the receipt to be sent.

[0254] 5. After receiving the expected receipt after sending the message in the previous step, the first device deletes the message from the list of sent messages waiting for receipt;

[0255] 6. If a receipt for the previous message has not yet been received, the first device cancels the process.

[0256] In particular, a second device in communication with a first device, apparatus or server may:

[0257] a) after step 1, receiving a message and, if the message has resulted in the preparation of a receipt, resending the receipt, otherwise associating the key optionally included in the received message with the communication with the first device and preparing and sending the receipt;

[0258] b) Between steps 3 and 4, a message is received and, if it has resulted in the preparation of a receipt, said receipt is resent, otherwise, a key included in the received message is associated with the communication with the first device, a receipt is prepared for said message and for other messages in a register containing unsigned receipt messages, and then the receipt is sent. Then, if a message originating from the same device is received, this is responded to by sending a receipt.

[0259] Process used to send a message signed by one device to another

[0260] 1. Before creating a new message to be sent to the second device, the first device preferably ensures that all receipts of messages originating from the second device have been sent and that any message that has been sent to the second device has resulted in a receipt being received. During the preparation of the message and until the sending process is cancelled or completed, the first device may also block the reception and sending of any message originating from the second device or intended for the second device, other than any message required in the process of sending the message. The process of sending the message then preferably includes the following steps: the first device calculates the number of keys required to send the message, calculates the number of keys required to send the receipt, and queries the register S42 or A42 indicating that the message requesting the key intended for the second device must be signed, because the first device then preferably must keep enough keys available for encryption intended for the second device in order to be able to request other keys from it;

[0261] 2. If the first device does not have sufficient keys to send the message, it requests the second device to transfer the missing keys or to exchange the roles of the missing keys, by sending a signed message if the register S42 or A42 associated with the second device indicates that such a request must be signed, otherwise the process goes to step 5;

[0262] 3. If the first device does not receive the number of missing keys, cancel sending the message;

[0263] 4. If the first device receives the number of missing keys, it adjusts the registers A3, A3', A1, A1', S1 or S1' provided for this purpose, compiles the receipt of the message that transmits the key, and then marks the key used to compile said message as being in use, accompanying these actions. The first device then sends said receipt message; otherwise, it cancels the sending process. The adjustment of the registers A3, A3', A1, A1', S1 or S1' involves modifying the registers A32, A12 or S12 for the first version of the system that separate the keys associated with encryption from the keys associated with decryption, or even exchanging the value of the flag A12' or S1' indicating the role of the key for the second version of the system (if the key is received by exchanging the roles of the keys, or even by creating the registers A3 or A3' if the key is transmitted), registering the received key therein as the key used for encryption with the other device. In register A32, A12 or S12, a key is assigned to encrypt a specific location and then a key is assigned to decrypt, the location being modifiable so as to convert an encryption key into a decryption key and vice versa;

[0264] 5. The first device optionally encrypts the part to be encrypted, creates and signs the message to be sent, marks the key used for this creation and this signature as used, and registers this created and this signed message in a register of sent messages for which no receipt has yet been received. Preferably, the registration of the modification of the register of this step is concomitant;

[0265] 6. The first device sends the message registered in the register in the previous step;

[0266] 7. Optionally, the first device collects the receipt and deletes the message from the register where the message was placed in step 5.

[0267] In particular, a second device in communication with a first device, apparatus or server may:

[0268] a) after step 2, if the register S42bis or A42bis associated with the first device indicates that a signature is necessary, verify the signature of the received message and then, if the verification result is positive, respond by sending a signed message for exchanging the roles of the keys or for transmitting the requested number of keys (increased by the amount necessary to send an acknowledgement of receipt of said message), if the keys are available, after optionally exchanging the roles of some keys in order to distribute them for decryption, this message also being an acknowledgement if the request received was signed;

[0269] b) after step 4: upon receipt of the receipt, deleting from the register the message awaiting receipt, the message corresponding to the received receipt;

[0270] c) after step 6, upon receipt of the message, verify whether the message has not already resulted in a response or receipt by comparing it with the message registered in the register associated with the last receipt sent. If this is the case, resend the response or receipt located in the register provided for this purpose;

[0271] d) if step c) has determined that the message is a new message, verifying a possible signature of the message and rejecting the message if the signature is invalid;

[0272] e) gather any keys that may be received, copy the message into the register of the last message received, decrypt said message, and clear the receipt register;

[0273] f) registering the received message or even its summary in a register attached to the no-receipt register and preparing a receipt; otherwise, ignoring the message;

[0274] g) It then signs the receipt in its register A41, A41bis, S15, A15, S15bis or A15bis, if it has sufficient keys to do so, and sends it to the first device initiating the communication.

[0275] Method for encrypted communication of long messages between two devices

[0276] Messages exchanged between devices are sometimes very long, i.e., it is very likely that interruptions will be encountered in the communication of exchanging the messages. Then, it is necessary to divide the long message into a plurality of small messages, and the interruption of the transmission of the small messages does not require the retransmission of the small messages that have already been correctly transmitted. Therefore, according to another aspect of the present invention, another object of the present invention is a method for performing encrypted communication between a first device and a second device to send a long message M from the first device to the second device, the method comprising:

[0277] a) Preferably, the first device divides the message M into a plurality of small messages, each small message having a sequence number and, if possible, the size of each small message corresponds to the size of a one-time key that can be used to communicate with another device;

[0278] b) preferably, the first device generates an identifier of the message M which may be incremental but preferably random, the identifier of the message M, the sequence number of each small message, and the total number of small messages are associated with each small message;

[0279] c) For each small message, the "process for sending a message signed by one device or server to another device or server" is applied. If the message only needs to be encrypted instead of encrypted and signed, the signing of the small message will be omitted in step 5;

[0280] d) If the process has to be interrupted due to, for example, lack of a key or by breaking the link between the two devices, the sending of the unsent small message is resumed after receipt of the acknowledgment of the previous small message.

[0281] The identifier of the message M may be a series of alphanumeric characters and / or symbols which may be converted into a numeric word by ASCII code or other means.

[0282] The identifier of the message M may be a number generated in a random or pseudo-random manner.

[0283] The identifier of the message M is preferably generated by the first device. As an alternative, the identifier of the message M is generated by another trusted device.

[0284] The identifier of message M, the sequence number of each small message, and the total number of small messages are preferably sent unencrypted, and then each small message is preferably signed, and the signature also carries the identifier of message M, the sequence number of each small message, and the total number of small messages.

[0285] After receiving all the messages sent, the second device reconstructs the message M.

[0286] Usage Examples

[0287] For example, the present invention may be used to securely transmit an electronic key identifier, either through a physical connection or through a wireless connection, to a secure electronic door lock or door opening command, which door lock is capable of opening upon receipt of an approved identifier.

[0288] The invention can also be used to transmit some information stored on a card equipped with a small screen and a tool for selecting documents stored on the card. When approaching the first card from a second card, optionally after the use has been authorized by entering a password or one or more biometric means (e.g. verifying a fingerprint), the document selected by the selection tool can be securely transferred to the second card via the NFC connection.

[0289] The present invention can also be used to securely transmit text messages from one phone to another via a digital phone network. If the phone is connected to a data network when the message is sent, the present invention is implemented after pressing a message transfer button for sending the message to an intermediate server or directly to another phone. The present invention can also be used to register a phone on a network, where secure communications allow the network and the phone to exchange their identifiers.

[0290] When implemented in a system comprising a temperature or pressure recording sensor or in a system comprising an electricity, gas, water or heat meter, the invention can be used to securely read such a meter, which communicates with a remote data center via a wireless network (e.g., Wi-Fi or 3G network), or communicates with an electronic device for collecting measurement data via NFC or Bluetooth. Meters or specially designed sensors that communicate according to the method of the invention can be used in medical devices implanted in the body, for example, to monitor medical conditions, batteries or cardiac implants.

[0291] When implemented in a system including vehicles, the present invention can be used to establish a secure data link between vehicles in close proximity to each other. A one-time key can be used to encrypt a hash value of transmitted data, thereby ensuring the authenticity of the data. Data can be transmitted via Bluetooth, and a secure communication channel can be established for all vehicles within Bluetooth range and share the one-time key.

[0292] The present invention can also be used when sending emails, encrypting emails or even encrypting their signatures, especially when the sender and recipient devices of the emails are mobile devices, or even when the sender and recipient devices have modules or software that allow encryption and authentication operations as described according to the present invention to be performed. In general, the present invention can be used whenever a secure data communication link is required between devices, the security of which involves keeping the transmitted data confidential and / or ensuring that the data has not been modified during transmission, the communication being wired, wireless, or a combination of both.

[0293] According to another aspect of the present invention, another object of the present invention is a computer program product comprising instructions which can be read by a processor of a device for implementing the method according to the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0294] The present invention may be better understood by reading the following detailed description of non-limiting embodiments of the invention and by referring to the accompanying drawings, in which:

[0295] Figures 1a to 1f Schematically illustrates various links between the device and the server;

[0296] Figure 2 is a table showing which process of the present invention uses which other process;

[0297] Figure 3 Schematically showing register A1 and its associated registers according to a first version of the present invention;

[0298] Figure 4 An example of the use of the invention is shown, in which the device of the system is of the credit card type, or of the dual reader type, in particular of the international dual reader type;

[0299] Figure 5a schematically illustrates a first step of an example of a process for transmitting a signed message between two devices;

[0300] Figure 5b Shown in Figure 5a The steps following the steps described in;

[0301] Figure 5c Shown in Figure 5b The steps following the steps described in;

[0302] Figure 5d Shown in Figure 5c The steps following the steps described in;

[0303] Figure 6ashows a first step in distributing and synchronizing one-time keys for communication between devices; and

[0304] Figure 6b Shown in Figure 6a Follow the steps described in . DETAILED DESCRIPTION

[0305] Figures 1a to 1f : Various links between devices and servers

[0306] Figures 1a to 1f Various links between the device and the server are shown.

[0307] A is a device and S is a server. For example, device A is a personal computer or a smart phone or a smart card.

[0308] Both device A and server S can be equipped with a processor for executing the steps of the method according to the present invention, as well as a memory for storing data required for the execution and other memories for containing the registers described in the present invention, which memories are preferably permanent, such as a hard disk or a flash memory.

[0309] exist Figure 1a In the process, the key is added to the device by the server in a secure space close to the server.

[0310] exist Figure 1b In the example, the key is added to the device by the server in a secure space away from the server. The computer link L is secure, for example a quantum link.

[0311] exist Figure 1c In the example, the key present on device A is distributed by server S to ensure communication with other devices.

[0312] exist Figure 1d In the example, two devices A1 and A2 exchange security data.

[0313] exist Figure 1e In the example, server S exchanges security messages with device A.

[0314] Figure 1f It shows the communication of a key using a first device A1 to a second device A2 so that the second device can communicate with a third device.

[0315] Figure 2 : Process table

[0316] Figure 2is a table indicating which process of the present invention uses which other process. For each process written on the row of the table, these processes identify the process written on the column that they can use directly (indicated by "TRUE") or indirectly (indicated by 1). The last column indicates the type of device with which the process exchanges data.

[0317] Figure 3 : Register A1

[0318] Figure 3 A register A1 and its associated registers according to a first version of the invention are schematically shown.

[0319] 301 represents a number that has been used for encryption or is being used by register A3.

[0320] 302 indicates a number that has not yet been used as an encryption key.

[0321] 303 indicates a number that has not yet been used as a decryption key.

[0322] 304 indicates a number that has been used as a decryption key.

[0323] Figure 4 : National Dual Reader and International Dual Reader

[0324] Figure 4 An example of using the invention is shown, where the devices of the system are either of the credit card type, of the national dual reader type, or of the international dual reader type. The national reader can communicate with all cards belonging to the same national group, while the international reader can communicate with all cards in the system. For example, a national reader can be assigned to all residents of the same country, while an international reader can be assigned to all merchants in multiple countries.

[0325] 401: Two cards from the same country communicating using a National Dual Reader II.

[0326] 402: Two cards (optionally from different countries) communicate via International Dual Reader III.

[0327] Figure 5a to Figure 5d : Transmission of a message according to the first version of the invention

[0328] Figure 5a to Figure 5d An example of transmission of a signed message between two devices A is schematically shown. When the second version of the register is different from the first version of the register, the name of the modified register indicates the second version of the register in brackets.

[0329] - In step 501, the first device A receives a message optionally sent by the second device "a", and optionally also conveying a key required for its receipt.

[0330] In step 502, the first device A registers the identifier of the key optionally used in the received message as used, by modifying the register A33 (A37) associated with the used key, and then optionally registers the key sent in the key transfer message as interchanged, by modifying the register A32 (A32') associated with the said interchanged key or by adding a new register A3 (A3') for the received key, and compiles it, and then signs the receipt of the possible key transfer message on register A41bis before sending the message.

[0331] ·In step 503-1, A verifies whether there are enough keys for sending the receipt (two keys are required to send a signed receipt, but the device must also keep another 4 keys to request more keys from another device (if such a request must be signed)), then proceeds to step 504, otherwise, in step 503-2, if register A40bis is not empty, resend the message from register A40bis (then receive the receipt and delete the said register A40bis), then prepare the key transfer request message on register A40bis, (if the register A42 associated with the other device indicates that the key request must be signed) sign the message (and mark the key used for signing as used by modifying its register A31 (A37)), finally send the message in step 503-3, then receive and concentrate the key by modifying register A3 or A32 in step 503-4, and proceed to step 504, or do not receive the key and stop the process.

[0332] In step 504, a receipt is prepared for the first message received in step 501, the preparation of which modifies register A31 (A37) and registers the receipt in register A41. The first device A confirms the modification of its register and then sends a receipt message.

[0333] In step 505, continue to execute steps 501 to 504 until no message is received from the other device.

[0334] In step 506 , A verifies that the last message sent from its register A40bis, which includes the key required to send the receipt, has been received by verifying that the register A40bis is not empty. If the register A40bis is empty, the process proceeds to step 508 .

[0335] In step 507-1, the first device A sends the last message including the key required to send the receipt located in its register A40bis to the second device a; the second device a receives the message in step 507-2 and responds by preparing and sending the receipt, while marking the key used for the receipt as used. Then, the first device A receives the receipt and deletes its register A40bis of the sent message, while marking the key used in the receipt as used; or it stops the process if it does not receive the receipt.

[0336] In step 508-1, the first device A verifies whether its register A40 is empty, and if so, switches to step 512; otherwise, the first device A sends the last message placed in its register A40 to send the message in step 508-2.

[0337] In step 508 - 3 , the second device responds by sending a receipt and the first device goes to step 510 , or the second device does not respond and the first device goes to step 509 .

[0338] In step 509-1, if its register A40 is not empty, the first device A prepares a message to be sent and places it in its register A40bis, the message containing sufficient keys for its own receipt and for the receipt of the message of register A40; then confirms the register modification and sends the message; otherwise, goes to step 511.

[0339] In step 509-2, the first device A receives the receipt, deletes the sent message for which the receipt has not been received from its registers A40 and A40bis, and marks the key used for signing as used in register A33 (A37), and then goes to step 510, or if the first device A does not receive the receipt, sets to stop the process.

[0340] In step 510, the first device A deletes from register A40 the sent messages for which no acknowledgement has been received and marks register A33 (A37) containing the key used to sign the received messages.

[0341] In step 511, device A calculates the number of keys needed to send the message, calculates the number of keys needed to send a receipt, and consults register A42 indicating that a message requesting keys intended for another device must be signed, since the device must then hold enough keys available for encryption intended for that device.

[0342] In step 512-1, if the first device A does not have enough keys to send a message, it requests the second device "a" to transfer keys to it or request a role reversal for the missing keys, and if the register S42 or A42 associated with the other device indicates that such a request must be signed, the request is made by sending a signed message. Otherwise, go to step 516.

[0343] In step 512-2, device A receives the missing key, registers the received key in its register A3, and sends a receipt.

[0344] • In step 512-3, if device A has not received sufficient keys, then device A will stop the process.

[0345] In step 513, device A creates a message to be sent and signs it, marks the key used for the creation and the signature as used, and registers the created and signed message in register A40 of sent messages for which no receipt has been received. The registration and modification of the register of this step are concomitant; A then sends the message registered in register A40.

[0346] After receiving the message, the second device "a" verifies in step 514-1 whether the received message has not resulted in a response or receipt by comparing it with the message registered in the register associated with the last receipt sent. If this is the case, it resends in step 514-2 the response or receipt located in the register A41 provided for this purpose, and the process proceeds to step 515.

[0347] If in step 514-1 the second device "a" has determined that the message is new, it verifies in step 514-3 the possible signature of the message and, if the signature is invalid, rejects the message, otherwise the second device "a" collects the possible keys received in its register A3 and, if there are sufficient keys to do so, prepares a receipt, otherwise the second device "a" prepares a receipt without keys and copies said receipt in step 514-4 to the register A41 provided for this purpose. It then determines in step 514-5 whether it will sign the receipt and, if it has not yet signed the receipt, stops the process in step 514-6, otherwise it sends the receipt in step 514-7.

[0348] In step 515, A collects the receipt and in step 518 deletes the message from the register A40 where the message was placed.

[0349] Figure 6a and Figure 6b : Distribution and synchronization of one-time keys for communication between devices

[0350] Figure 6a and Figure 6b This represents an example in which a server distributes keys intended for protecting communications between devices and then transmits these keys to the devices.

[0351] Device A verifies that it has received a receipt for the message sent to the server in the past, then builds in step 601 a set of one-time key identifiers for which it activates a "server flag" A35 from its set of keys A3 intended for security between devices.

[0352] Then, in step 602-1, device A registers in register S15 of the message to be sent to the server a signed message containing the identifier in the set established in the previous step and information A31, A32, A33, A34 (A37, A32') related to register A3 that its server flag is activated, the signature of the message requiring modification of register A13 (A17') of the used key, and sends the message to the server.

[0353] After receiving the key identifier in the set established in step 602-1, the server verifies the signature of the message and marks the key used for the signature as used by modifying register S13 (S17') in step 602-2, then in step 602-3, the server updates its set S3 (S3') and its related registers as well as S4, and compiles the receipt of the message in register S16, which is then sent in step 602-4.

[0354] The device receives the acknowledgement message in step 603, which deletes the message registered in its register S15.

[0355] The server, preferably using, inter alia, the set S4 and its set S3 (S3'), and the sets S3 (S3') of further devices and their associated registers, and taking into account the number of keys of S1 (S1') required on the server to sign the message being prepared, and taking into account the fact that any key transmitted from the register S1 (S1') of another device will require a key of the same size to be encrypted, calculates, in step 602-5, for each of the other devices, the optimal number of one-time keys to be used by the device to communicate with each of the other devices; this number may, for example, correspond to a certain multiple of the number of keys used last week, and if this number is higher, increase the number of keys used last month and then increase by a constant.

[0356] The server uses this optimal number and calculates the number of unused one-time keys for each other device based on registers S31, S32, S33 and S34 (S37) to determine the number of additional keys to be associated with the device for communication with each other device of the system.

[0357] In step 602-6, the server associates the one-time key with the device present on the set S1 (S1') of other devices identified in the previous step and with which a new communication key must be obtained, this association of the key by the server preferably involves:

[0358] - adjusting the register S11 (S18') of the other devices to take into account the newly assigned key, that is, for the first version of the invention, registering in the register S11 of each of the other devices that for the other devices one or more keys of the register S1 are used to protect the communication with the first device, the address of the next key of the register S1 not yet used and not yet associated with another device, or, even for the second version of the system, marking "TRUE" on the register S18', which indicates whether the register S3' uses the key of S1' for the key of the register S1' of the other devices assigned to communicate with the first device;

[0359] - adding the keys and their locations in registers S1 (S1') of other devices to the device's register S3 (S3') and marking these new keys as not copied to this or another device (registers S35 and S36); and

[0360] - Adding the identifier of the key in question to the register S3 (S3') of the other device, while adjusting the register S11 of the used key (S18').

[0361] In step 602-7, the server S builds a list of keys that are not present in its set A3 (A3') but are present in the register A1 (A1') or A3' (A3') of another device, this list may be non-zero, in particular after associating the keys with the devices of step 602-6 of the process, and the server S associates the keys with their identifiers and with the identifier of the device associated with each of these keys; to this list are added the keys that are present and located on the register S3 (S3') associated with the device, but have not yet been copied to this device, these keys having been placed on this register S3 (S3') by this same process used by some other devices of the system.

[0362] In step 602-8, the server compiles a message on its register S15 incorporating keys associated with a certain number of other devices 20, for example keys from the list defined in the previous step that have not yet been sent to the device, then signs this message and sends it to the device.

[0363] When the device receives a new key from the server:

[0364] In step 603, the device verifies the signature of the received message and decrypts the key therein, while marking the key used for signing and encryption as used (register A13 (A17')). The device registers the received key in the device's register A3 (A3') (where register A36 adopts the value of register S36), then modifies the register A11 (A17') of the key from the device that has been used, and then compiles the receipt registered in its register A16 for the server in step 606, marking the key used to sign the message as used; then, finally, sends the receipt.

[0365] On receipt of the receipt, after verifying its signature, the server deletes its register S15 and updates its register S35 or S36 in step 605 to be copied to the device or to another device. The server then continues in step 602-8 as long as all the keys in the list defined in step 602-7 have not yet been sent.

[0366] The invention is not limited to the above described embodiments or the applications shown. The invention may be used in particular for securing financial transactions, or in any process that allows a one-time key to be provided to an apparatus using a communication device.

Claims

1. A method for protecting communications within a system comprising at least one server and at least two devices capable of communicating with the server and with each other, wherein: Communication between two devices is securely performed using a one-time encryption key shared with the two devices. In the method, after using the key, the one-time encryption key that has not been used but already exists on one of the two devices is sent by the server to the other device after the device has been connected to the server for subsequent secure communication between the two devices. The one-time encryption key that has not been used but already exists on one of the two devices is initially randomly generated by the server. The connection between the server and the at least two devices is performed in an insecure environment. The key that exists on one of the devices is allocated by the server to ensure communication with the other device.

2. A method according to claim 1, wherein the method is used to exchange messages and is designed so that the at least one server and the at least two devices save in a memory the last message of the same type that they sent until a receipt for the last message has been received.

3. The method according to claim 1, wherein: The at least one server and the at least two devices keep a register of receipts sent after receiving a last message of the same type, so that they can resend the receipts when they receive the same message again.

4. The method according to claim 3, wherein: The at least one server and the at least two devices also maintain a register of messages corresponding to reserved receipts, or alternatively another means of acknowledging said messages in order to be able to verify whether a received message has resulted in a prepared receipt.

5. The method according to claim 1, wherein: The registers modified by the creation and signing of the message are modified simultaneously, including the register containing the last message sent for which no receipt has yet been received.

6. The method according to claim 1, wherein: At the same time, the registers that must be modified when a message is received are modified, including the register containing the last sent receipt message.

7. A system for implementing the method according to claim 1, wherein: A set of registers exists on the server (S), and the set of registers includes: a register S1 for each device but located on the server, containing an ordered list of random numbers associated with the device, which can be used as a shared one-time key for protecting communications between the device and the server and a one-time key for protecting communications between the device and another device; • At least one register S3 for each device but located on the server, containing for said device a reference to a key allocated for protecting communications between said device and another device.

8. The system according to claim 7, wherein the set of registers comprises: a register S11 for each device but located on the server, said register S11 comprising a reference to a first key of said register S1 that has not yet been used or allocated for communication between said devices; a register S12 for each device but located on the server, said register S12 comprising a reference to a first key of said register S1 allocated for decrypting data originating from said device; A register S13 for each device but located on the server; at least one register S31 associated with each register S3, for each device but located on said server, said register S31 comprising a reference to the first key of said register S3 not yet used by said device; at least one register S32 associated with each register S3, for each device but located on the server, said register S32 comprising a reference to the first key of said register S3 allocated for decryption if the first key of said register S3 is allocated for encryption, or allocated for encryption of data received from another device if the first key of said register S3 is allocated for decryption; at least one register S33 associated with each register S3, for each device but located on said server, said register S33 comprising a reference to the last key of said register S3 that follows the key indicated by said register S32 and has not yet been used; a register A1 located on each device, containing an ordered list of random numbers that can be used as a shared one-time key for protecting communications between the device and the server and as a one-time key for protecting communications between the device and another device; at least one register A3 located on each device, said register A3 containing one or more lists of references to keys allocated for protecting communications between said device and another device, these keys being extracted from the register A1 of said device or from the register A1 of another device; a register A11 present on each device, said register A11 comprising a reference to the first key of said register A1 that has not yet been used or allocated for communication between devices; a register A12 present on each device, said register A12 comprising a reference to the first key of said register A1 , starting from the beginning of said register A1 , allocated for encrypting data sent to said server, this key not yet used; a register A13 present on each device, said register A13 comprising the reference to the last key of said register A1 , starting from the beginning of said register A1 , allocated for encrypting data sent to said server, this key not yet used; at least one register A31 present on each device, associated with each register A3, said register A31 comprising the reference to the first key of said register A3, starting from the beginning of said register A3, which key has not yet been used; at least one register A32 associated with each register A3 present on each device, said register A32 comprising the first key of said register A3, starting from the beginning of said register A3, allocated for decrypting data sent to another device; as well as at least one register A33 present on each device, associated with each register A3, said register A33 comprising the last key of said register A3, starting from the beginning of said register A3, allocated for decrypting data originating from another device and not yet used, the decryption key being extracted from the end of said list.

9. The system of claim 7, wherein the signature of the unpredictable message is formed by a hash value encrypted by a one-time key associated with an identifier of the key.

10. According to the system of claim 7, the signature of a message that can be predicted is formed by the encryption of a number randomly generated by a message sender and the encryption of a hash value of a combination of the message to be signed and the number randomly generated by the message sender, and the message sender is associated with identifiers of the two keys used for the above two encryptions.

11. The system of claim 7, wherein the signature of the predictable message is formed by an encryption of a hash value of the message combined with a one-time key, the one-time key being associated with an identifier of the one-time key and an identifier of the one-time key used to encrypt the hash value.

12. A system according to claim 7, encrypting a predictable message by using an encryption function, which is applied successively to the entire message using a one-time key, which is at least the same size as the message and is extracted from a set of keys that are the same as the keys assigned for signatures between devices.

13. The system of claim 7, having a set of keys arranged one after another in a register, the set of keys forming a list, each key being referenced by its position in the list.

14. The system of claim 13, wherein keys can be added to the list.

15. The system of claim 13, wherein a key at the beginning or end of the list that has been used is deleted from the list.

16. The system according to claim 8, comprising: - two registers S42 and S42bis for each device but located on the server and associated with each other device, serving as a flag to indicate whether a request for a key or a role exchange of keys, respectively intended for or originating from said other device, must be signed; as well as - Two registers A42 and A42bis associated with each other device or said server, used as flags to indicate whether a request for a key or a role exchange of keys respectively intended for or originating from said other device must be signed.

17. A method for sending a message signed by a first device to a second device, the first device and the second device belonging to the system according to claim 16, the method comprising the following steps: a. The first device calculates the number of keys required to send the message, calculates the number of keys required to send a receipt, and consults a register S42 or A42 indicating that a message requesting keys intended for the second device must be signed, since the first device must then hold sufficient keys available for encryption intended for the second device; b. If the first device does not have enough keys to send the message, the first device requests the second device to transfer the missing keys or to exchange the roles of the missing keys, if the register S42 or A42 associated with the second device indicates that such a request must be signed, the request is made by sending a signed message, otherwise, the method goes to step e; c. If the first device does not receive the number of missing keys, the first device cancels sending the message; d. If the first device receives the number of missing keys, it adjusts the register S3 or A3 provided for this purpose, compiles the receipt of the message conveying the key, then marks the key used to compile the message as being in use, and accompanying these actions, it then sends the receipt message; otherwise, it cancels the sending process; e. the first device encrypts the part to be encrypted, creates and signs the message to be sent, marks the key used for this creation and this signature as used, and registers the created and signed message in a register of sent messages for which a receipt has not yet been received; and f. The first device sends the message registered in the register in the previous step.

18. A computer program product comprising instructions readable by a processor of a device to cause the device to perform the method according to claim 1.

19. A system for implementing the method according to claim 1, wherein: A set of registers exists on the server (S), and the set of registers includes: a set S1' of one-time keys for each device but present on the server, used for communication between the server and the at least two devices or between the at least two devices, each key having an identifier S11' and a randomly generated number S10'; at least one set S3' of identifiers of single-use keys used for communication between two devices and of the servers holding the register S1' from which this key is extracted, if the system comprises several servers, said set S3' being one for each device but present on the servers, a copy of which key can be found in a register S39'.

20. The system of claim 19, wherein the set of registers comprises: a set A1 ' of disposable keys present on each device for communication between the server and the device in question or for communication from that device with at least one other device, each key having an identifier A11 ' and a randomly generated number A10 '; as well as • At least one set A3' of identifiers of one-time keys present on each device used for communication between the device in question and another device.

Images