IMPROVED EXECUTION OF AN OPERATION IN A SAFE ELEMENT

Description

Technical field

[0001] The present invention relates, in general, to the field of secure elements and more particularly to the management of the execution of computer tasks or operations, such as cryptographic processing, in secure elements. Prior art

[0002] ETSI (European Telecommunications Standards Institute) is currently working on technical specifications for 5th generation (5G) networks.

[0003] 5G provides in particular that each subscriber to a given service of a communications network, for example radio or wifi (trademark), has a globally unique 5G identifier, noted SUPI (for "SUbscriber Permanent Identifier"), embedded in a secure element, such as a SIM card (for "Subscriber Identity Module").

[0004] This subscriber identifier includes for example the IMSI (for “International Mobile Subscriber Identity”) which is a unique identifier allocated to each mobile subscriber of a GSM (2G), UMTS (3G) or LTE (4G) mobile network, or the NAI (for “NetworkAccess Identifier”) introduced by RFC 4282.

[0005] In an effort to improve security, the ETSI TS 133 501 V15.1.0 (2018-07) technical specification provides for subscriber authentication, using this unique identifier, on multiple occasions, including during the authentication and key exchange process between a host user equipment - and more specifically the secure element inserted or soldered into it - and the network, i.e. at each connection to the network.

[0006] More specifically, the specification recommends encrypting this identifier on elliptic curves, before sending it to the network.

[0007] It is possible to provide, for example during the personalization of the secure element of the host user equipment, a set of pre-encrypted identifiers to be used for these authentications and thus to connect to the network. However, the memory of the secure element is limited and it is not possible to provide a sufficient number of already encrypted identifiers for all the connections that will take place.

[0008] The secure element must therefore regularly encrypt the identifier "on the fly." However, such an encryption operation, carried out by software, is expensive in terms of computing resources, especially if it is carried out frequently. Also, it monopolizes resources for a long time.

[0009] The encryption operation is just one example of a computationally expensive operation. Periodic memory cleanup operations, known as garbage collection, are also computationally intensive.

[0010] Generally speaking, a secure element is faced with numerous operations which monopolize processing resources for long periods of time.

[0011] This immobilization of the secure element's resources significantly reduces the responsiveness of the secure element to requests from the host user equipment or the mobile telephone network. This situation is therefore not suitable for 5G, which aims to address the increased needs of complex applications requiring high responsiveness.

[0012] There is therefore a need to improve the management of this type of operation within secure elements.

[0013] CN 112 214 291 A discloses a task management method comprising the following steps: executing each basic task according to the expected execution time for each basic task, and executing a tedious task within the remaining expected execution time of the basic task whose actual execution time is less than the expected execution time.

[0014] CN 102 053 917 A discloses a method of a smart card that includes receiving instructions (APDUs) sent by a server, and determining whether a smart card is already busy and whether the instructions need to be processed immediately. If the instructions need to be processed immediately, the card's resources are used to execute them. Otherwise, the APDU instructions are cached in the smart card's internal memory and are processed when the card is no longer busy.

[0015] EE DONGKYU ET AL: "Scrambling Technique of Instruction Power Consumption for Side-Channel Attack Protection", 2020 INTERNATIONAL CONFERENCE ON ELECTRONICS, INFORMATION, AND COMMUNICATION (ICEIC), IEEE, January 19, 2020 (2020-01-19), pages 1-2, DOI: 10.1109 / ICEIC49074.2020.9051111 [retrieved 2020-03-30] discloses a clock scrambling technique for hiding the execution time of an operation executed in an embedded system. The method protects embedded devices from timing analysis attacks by randomizing the instruction execution time. Statement of the invention

[0016] The present invention thus aims to overcome at least one of the aforementioned drawbacks. In this context, a first aspect of the invention relates to a method for managing the execution of a main operation by a secure element, the method being characterized in that: the main operation is formed of a plurality of elementary operations, and the method comprises the following steps: a. receiving, from a host device, a command in Application Protocol Data Unit, APDU, format, b. triggering a time counter during the execution of the APDU command in order to determine an actual processing time of the APDU command by the secure element; c. determining whether the actual processing time indicated by the time counter is less than a predefined duration associated with the APDU command; and d. in the event of a positive determination, executing one or more of said elementary operations during the remaining time of said predefined duration.

[0017] Correlatively, a second aspect of the invention relates to a secure element configured to execute a main operation formed from a plurality of elementary operations, the secure element comprising a processor configured to: a. receiving, from a host device, a command in Application Protocol Data Unit, APDU, format, b. triggering a time counter during execution of the APDU command in order to determine an actual processing time of the APDU command by the secure element; c. determining whether the actual processing time indicated by the time counter is less than a predefined duration associated with the APDU command; and d. in the event of a positive determination, executing one or more of said elementary operations during the remaining time of said predefined duration.

[0018] The invention thus claimed makes it possible to improve the management of operations implemented within secure elements.

[0019] In fact, the main operation, for example, which is resource-intensive, is performed in parts during the time remaining after the execution of the received APDU command.

[0020] Also, the main operation can be carried out several times during a plurality of successive APDU command execution iterations, without having prevented the implementation of other processing (APDU commands) before the end of the main operation.

[0021] The invention thus restores a high degree of responsiveness of the secure element.

[0022] According to the invention, the method further comprises a step e. of sending a response to the APDU command to the host equipment, after step d.

[0023] In a particular embodiment, the response to the command is sent upon expiration of the predefined duration associated with the APDU command.

[0024] By controlling the time at which the APDU response is sent to the host device, the secure element artificially extends the time allocated to processing the APDU command in order to allow elementary operations to be executed after this processing. This allocated time corresponds to the predefined duration associated with the APDU command.

[0025] This controlled elongation also has security advantages. Indeed, it allows the modification (and therefore hiding) of the actual processing or execution time of an APDU command, seen from outside the secure element, because this time is conventionally defined between sending the command and receiving its response. The processing performance of the secure element is therefore not revealed; a malicious person is no longer able to identify the processing actually implemented.

[0026] Other features of the method and the secure element according to embodiments of the invention are described in the dependent claims.

[0027] In another embodiment, the time counter is triggered upon receipt of the APDU command. This makes it possible to track the execution time of the APDU command as seen from outside the secure element, for example to more easily comply with standardized maximum durations. Of course, as an alternative, it could be triggered at the same time as the execution of the APDU command by the secure element, after its receipt.

[0028] In another embodiment, the method comprises a plurality of iterations of steps a. to d. so as to execute said plurality of elementary operations forming the main operation. All the elementary operations can be executed during the remaining times following the execution of several successive APDU commands.

[0029] Alternatively, some of the elementary operations may however be executed by the secure element between the management of two successive APDU commands. In particular, the method may comprise, after sending a response to a received APDU command and before receiving a subsequent APDU command, the additional execution of one or more of said elementary operations. Also, as soon as the secure element is no longer requested by APDU commands, it can advance the execution of the elementary operations comprising the main operations to be performed.

[0030] In a particular embodiment, the additional execution of one or more of said elementary operations comprises the successive execution of one or more elementary operations until receipt of the next APDU command. In other words, the secure element executes elementary operations as long as no new APDU command is received, which it must process. In this case, it stops processing the elementary operations, and processes the new APDU command received according to steps a. to d. above.

[0031] In one embodiment, the main operation is pre-divided into said plurality of elementary operations, each being associated with an elementary processing duration, and step d. comprises selecting one or more of said elementary operations to be executed according to their associated elementary processing durations and said remaining time.

[0032] In this mode, the elementary operations are known in advance and therefore predefined, with their associated costs (theoretical processing times). When remaining time is available after execution of an APDU command, the secure element can then draw, preferably in a logical order, elementary operations that it can execute during this remaining time, taking into account the time cost of each elementary operation.

[0033] This makes it possible to execute several main operations "simultaneously". In this case, step d. may include the execution of at least two elementary operations from at least two distinct main operations. Indeed, the secure element can draw elementary operations from several main operations in order to optimize the use of the time remaining after execution of the APDU command.

[0034] In an embodiment other than the main operation splitting (resource-intensive), step d. comprises continuing an execution of the main operation from a previous suspension point (initially the start of the operation), said execution of the main operation being suspended at a next suspension point which is a function of the remaining time.

[0035] In this case, the main operation is not cut out a priori but is progressively executed by continuing, by successive suspensions, its execution. This execution is therefore resumed at the end of the execution of the APDU command, for the remaining time, then is suspended again at the end of the remaining time, preferably at a suspension point which does not compromise the overall execution of the main operation.

[0036] Also, the so-called "previous" suspension point during a new iteration of steps a. to d. may be the so-called "next" suspension point resulting from the last iteration of steps a. to d. Of course, if the secure element were to execute part of the main operation between the processing of two APDU commands, the "previous" suspension point during a new iteration of steps a. to d. would be the point where this execution would have been stopped upon receipt of the new APDU command to be processed.

[0037] The advantages, purposes and particular characteristics of the secure element are similar to those of the aforementioned method. A system may comprise the secure element and a host device for said secure element.

[0038] In a particular embodiment, the different steps of the aforementioned method are determined by computer program instructions.

[0039] Accordingly, the invention also relates to a non-transitory computer-readable medium storing a computer program which, when executed by a secure element provided with a processor, causes the secure element to carry out the method as defined above.

[0040] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0041] The information carrier may be any entity or device capable of storing the program. For example, the carrier may include a storage medium, such as a ROM, for example a microcircuit ROM, or a magnetic recording medium, for example a hard disk, or a flash memory.

[0042] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question. Brief description of the drawings

[0043] Other features and advantages of the invention will appear in the description below, illustrated by the attached figures which illustrate exemplary embodiments which are not limiting in nature. [ Fig. 1 ] There Figure 1 represents, schematically, a secure element in which the present invention can be implemented. Fig. 2 ] There Figure 2 illustrates, schematically, functional modules of the secure element for an implementation of the invention. Fig. 3 ] There Figure 3 illustrates, using a flowchart, general steps of a method according to the invention. Fig. 4 ] There Figure 4 illustrates, using a flowchart, general steps of an alternative method in accordance with the invention. Fig. 5 ] There Figure 5 illustrates a chronological sequencing of the processing of several successive APDU commands while main operations are to be processed, in accordance with implementations of the invention. Detailed description

[0044] A secure element, SE, is a tamper-proof hardware component or platform (typically a chip or smart card) used in a host device or terminal (typically a mobile terminal) and capable of securely hosting applications and data under the control of a card operating system, in compliance with security rules and requirements set by trusted authorities. Secure elements are notably used for cryptographic processing for purposes of identification, authentication, signature, etc.

[0045] A widely used form factor of the SE is the embedded secure element (eSE). This embedded secure element is usually soldered to the host terminal.

[0046] Secure elements are programmed according to the desired applications.

[0047] For example, an eSE can form the secure element necessary for many uses or services based on NFC (for "Near Field Communication" in English) communication implemented by a host mobile terminal. For example, an NFC payment service requires secret banking information from the user which is advantageously stored in the eSE, protected from any untimely access. This is also the case for a public transport service where the eSE makes it possible to identify the user at gates.

[0048] Another example of a secure element is the embedded UICC (for "Universal Integrated Circuit Card"), which provides a subscriber's credentials to authenticate on a mobile phone network. This is, for example, an eSE configured as a SIM card (for "Subscriber Identity Module"). This is called an eUICC (for "embedded Universal Integrated Circuit Card").

[0049] There Figure 1 schematically represents a secure element 100 in which the present invention can be implemented. This secure element 100 comprises a microprocessor 101, with which are associated on the one hand one or more random access memories 102 (for example of the RAM type, for “Random Access Memory”), for example by means of a bus 103, and on the other hand one or more non-volatile memories 104 (for example of the ROM (for “Read Only Memory”) and / or EEPROM (for “Electrically Erasable Programmable Read Only Memory”) and / or flash type), for example through a bus 105. The non-volatile storage memory 104 stores data and software intended to implement the invention but also any data necessary for the execution of the programs. The volatile working memory 102 stores the executable code of the computer programs as well as the registers adapted to record variables and parameters necessary for their execution.

[0050] Buses 103 and 105 may be a single bus. Microprocessor 101 may be a secure cryptoprocessor.

[0051] The secure element 100 further comprises, connected to the bus(es), one or more communication interfaces 106 with the host terminal (not shown) carrying the secure element.

[0052] The communication interface 106 is implemented for example by means of contacts provided on the secure element (typically a smart card) conforming to the ISO 7816 standard and / or by means of a radiofrequency antenna (contactless) conforming to the ISO 14443 standard.

[0053] The secure element 100 communicates, via the communication interface 106, with a card reader (compliant with the ISO 7816 and / or 14443 standard) equipping the host terminal, typically in a master-slave scheme where the reader is master. Also, the reader of the host terminal sends a command X, typically in APDU (for “Application Protocol Data Unit”) format, and receives in return a response Y, typically in APDU format, which is the result of the execution of the command X. Such a command is hereinafter called “APDU command”.

[0054] An APDU command is also known as an APDU instruction due to the presence of an instruction code "INS" in the command.

[0055] In practice, the reader can only send a new APDU command after receiving a response to the previous APDU command.

[0056] The secure element 100 may be an eSE (“embedded SE”), an eUICC (“embedded Universal Integrated Circuit Card”), an eSIM (“embedded SIM”), intended to be integrated, by soldering for example, into a host terminal such as a smartphone, a digital tablet, a laptop, a personal assistant, an entertainment device (e.g. game console).

[0057] There Figure 2 illustrates, schematically, functional modules of the secure element 100 for an implementation of the invention. Of course, additional functions not shown may exist, as will emerge from the description which follows.

[0058] The secure element 100 comprises a processing or execution module 110, an estimator of duration allocated by APDU command 120, a time counter 130, a stack or buffer of main tasks / operations 140 and optionally a manager of sub-tasks or “elementary operations” 150. This manager 150 comprises a module for cutting and estimating processing time 152, a stack or buffer of elementary operations 154 and a selector of elementary operations 156. A stack or buffer is a memory area temporarily storing data. It can be of the FIFO type (for “first in, first out”).

[0059] The processing or execution module 110 controls a method for managing the execution of a main operation stored in the stack 140 in accordance with the invention. Typically, it can implement the operations of the Figure 3 described below.

[0060] The processing module 110 is connected to the communication interface 106 for the purpose of receiving APDU X commands from the host terminal, executing these commands and providing APDU Y responses in return.

[0061] The processing module 110 may request the duration estimator 120 for the purpose of obtaining an allocated duration for a received APDU command X.

[0062] The duration estimator 120 can simply comprise a correspondence table associating an allocated duration T max with an APDU command or an APDU command type. For example, the same allocated duration T max can be provided for all APDU commands. Alternatively, a different allocated duration T max can be defined for each APDU command type, typically by instruction code “INS” (18 different codes are defined in part 3 of the ISO / IEC 7816 standard, for example “read binary”, “read record”, “write binary”, “open channel”, “select file”, “external authenticate”, etc.). Of course, other definitions of “APDU command type” can be envisaged, such as for example the four different APDU command structures (short format, write-oriented format, read-oriented format, complete format).

[0063] The allocated time T max can be defined relative to a maximum response time defined in ISO / IEC 7816 (see for example section 10.5.3.2 of ISO / IEC 7816-3). T max can be equal to this maximum response time or a percentage of it, for example 70% or 80%. The percentage can vary from one APDU command type to another, or even from one APDU command to another.

[0064] Alternatively, the allocated duration T max may be calculated from an average execution time of an APDU command, an APDU command type or all APDU commands. T max may be equal to this average response time increased by a percentage, for example 10%, 15%, 20%, 25% or even 50%. The percentage may vary from one APDU command type to another, or even from one APDU command to another. The average time may be determined in advance or during the lifetime of the secure element.

[0065] The duration estimator 120 may also comprise a learning sub-module aimed at adjusting or updating the allocated duration T max over time, in particular as a function of the actual execution durations of the APDU commands that the secure element 100 executes. The learning is carried out with the same granularity as the assignment of the durations allocated to the APDU commands, namely by APDU command, by APDU command type or globally for all the APDU commands.

[0066] One of the T max durations defined above can be used as the initial duration.

[0067] An average of the actual execution times (possibly including the initial time) increased by a percentage, for example 10%, 15%, 20%, 25% or even 50%, can define the allocated time T max for the next APDU command (or the type of APDU command, or the set of APDU commands). As an alternative to using the average, the maximum actual execution time can be used (depending on the granularity chosen).

[0068] The update of the allocated durations T max can be carried out for each APDU command X processed, or after a predefined number of APDU commands processed (possibly identical or of the same type), or periodically.

[0069] This learning makes it possible to “profile” the estimator 120 to the characteristics of the secure element 100.

[0070] As an alternative to autonomous learning, the allocated durations T max can be updated (periodically or on demand) by remote transfer (over-the-air or OTA) in particular when the host terminal is a mobile communication terminal, or by file loaded directly by the host terminal into the secure element 100.

[0071] The processing module 110 may request the time counter 130 for the purpose of measuring the actual duration of execution or processing of a received APDU X command.

[0072] The time counter 130 is typically connected to the CLK clock line of the secure element, which is generally provided by the host terminal.

[0073] The time counter 130 can be triggered upon receipt of a new APDU X command. Alternatively, it can be triggered only when the processing module 110 begins to read the command (therefore the header “CLA”, “INS”, “P1” and “P2” followed by the body “Lc”, “DATA”, “Le”).

[0074] The time counter 130 is stopped when the execution result is obtained by the processing module 110 or the APDU response Y is ready to be transmitted. In both cases, the APDU response Y has not yet been transmitted to the host terminal.

[0075] As described below, the duration measured by the time counter 130 allows the processing module 110 to easily know whether there is still processing time available with regard to the duration T max allocated to the APDU command being processed. This available time makes it possible to partially advance the execution of a main operation stored in the buffer 140.

[0076] As described above, this measured duration also makes it possible, in certain embodiments, to update the duration T max allocated to this APDU command (or to a particular type of command, or even to all APDU commands).

[0077] The buffer 140 is a memory area in which the secure element 100 stores operations that it wishes to perform when processing resources are available. Typically, a routine of the secure element 100 stores resource-intensive operations there.

[0078] For example, the generation of encrypted identifiers, for example SUPI or IMSI, monopolizes the microprocessor 101 for a long time. A pool of encrypted identifiers (according to conventional techniques) may be present in the secure element 100 to facilitate authentication operations with a mobile communication network. Any encrypted identifier used is deleted from the pool. A routine can then ensure that the pool permanently contains at least N encrypted identifiers. Also, when this number falls to N, the routine can launch an operation to generate M new encrypted identifiers. This operation is recorded in the buffer 140. Similarly, encryption, decryption, signature operations, etc. may be composed of multiple elementary operations.

[0079] In another example, the operations, for example periodic, of the garbage collector (GC) responsible for recycling previously allocated then unused memory can be indicated in the buffer 140.

[0080] These so-called "main" operations are generally composed of a plurality of elementary tasks or operations. For example, the encryption of an identifier is a piecewise or blockwise encryption: the encryption of each block composing the identifier can be likened to an elementary operation. Similarly, the garbage collector can process the memory by block or zone: the cleaning of each zone composing the memory to be cleaned can be likened to an elementary operation. More generally, a main operation is a sequence of operations or steps that can be carried out progressively.

[0081] A preemptive execution environment (in the secure element) is in particular capable of suspending the execution of an operation and resuming it later. This suspension can, for example, be carried out at the boundary of each elementary operation or step constituting the main operation. More generally, suspension points can be identified in these main operations, where the execution can be interrupted and suspended without damaging the execution as a whole (in particular without impacting the final result of the execution). The suspension may optionally require the recording of an execution environment (registers, parameters or intermediate values).

[0082] Also, the elementary operations manager 150 can, using the processing time cutting and estimation module 152, convert a main operation of the buffer 140 into a plurality of elementary operations to be executed. In the examples above, this involves in particular defining several elementary operations for the encryption of all the blocks of an identifier to be encrypted, or defining several elementary operations for the cleaning of all the memory areas.

[0083] The module 152 also estimates a processing time required for each elementary operation obtained. In a similar manner to the module 120, a correspondence table can be provided which associates a time T estim with each elementary operation (or type of elementary operation). A default time can be provided for any non-referenced operation. Learning over time can make it possible to refine these times, or even to define them for operations not initially referenced. In this case, the time counter 130 can be used to calculate the actual execution time of each elementary operation.

[0084] This learning makes it possible to “profile” the estimator 152 to the characteristics of the secure element 100.

[0085] Depending on the cutting techniques of the main operation, the elementary operations can have different sizes (in the sense of the quantity of processing required) and therefore be associated with different estimated processing times T estim.

[0086] The elementary operations buffer 154 stores these elementary operations to be executed, with their associated estimated time T estim. Preferably, it stores them in a logical order of execution corresponding to their order in the main operation. This may be necessary if certain elementary operations use the result of previous elementary operations. To ensure that the selection of elementary operations respects this order, the buffer 154 may be of the FIFO type (for "First In, First Out"). A FIFO may be provided per main operation in the case of a plurality of such main operations.

[0087] In one embodiment, the buffer 154 simultaneously stores elementary operations of two or more main operations. This allows for the simultaneous progressive execution of several main operations.

[0088] The processing module 110 can then request the elementary operation selector 156 to choose which elementary operations to execute when processing time is available in an implementation of the invention.

[0089] Typically, the processing module 110 indicates to the selector 156 an available time T dispo . The selector 156 can thus select elementary operations according to their own estimated times T estim and the available time T dispo .

[0090] If the allocated time T max includes the sending time T sending the APDU response Y, the available time T dispo is reduced by this time T sending before selecting the elementary operations. The sending time T sending can alternatively be negligible.

[0091] Typically, the selector 156 selects a maximum number of elementary operations for which the sum of the corresponding estimated processing times does not exceed the available time: sum(T estim ) ≤ T dispo .

[0092] During a selection operation for an available time T dipso , the selector 156 can select elementary operations associated with a single main operation. Alternatively, the selector 156 can select elementary operations associated with a second main operation only if there are no more elementary operations to be executed for a first main operation. Alternatively, the selector 156 can select elementary operations associated with two or more main operations.

[0093] The selector 156 can respect the order of the elementary operations in the main operation(s), and thus select only the first element(s) (elementary operation(s)) in the FIFO buffer(s).

[0094] The main operations may optionally be associated with priorities. The selector 156 may then select the maximum number of elementary operations of the main operation having the highest priority that satisfy T dispo , then select the maximum number of elementary operations of the next main operation having the highest priority that satisfy the remaining time (T dispo reduced by the estimated times for the elementary operations already selected), and so on.

[0095] There Figure 3 illustrates, using a flowchart, general steps of a method according to the invention. These steps are controlled by the processing module 110.

[0096] In step 300, the processing module 110 receives an APDU X command from the host terminal.

[0097] In step 305, the processing module 110 triggers the time counter 130 during the execution of the APDU command in order to determine an actual duration of processing of the APDU command. As indicated previously, this triggering can be in reaction to the reception 300 of the APDU command or be concomitant with the start of the execution 310 of the APDU command.

[0098] In step 310, the processing module 110 executes the APDU X command according to conventional mechanisms. For example, for a “read binary” command, this involves reading bytes from a file in memory. For a “write binary” command, this involves writing bytes to a file in memory.

[0099] The execution of the APDU command ends when the requested operation has been performed and the result (e.g. writing performed or bytes read) has been obtained, and optionally when the APDU Y response including this result is ready to be sent.

[0100] Step 315 occurs at this end of execution instant, by stopping the time counter 130 and thus obtaining the actual duration T of processing execution of the APDU command X.

[0101] In step 320, the processing module 110 recovers from the estimator 120 the duration T max allocated to the processing of this APDU command X. In one embodiment, this duration defines the instant at which the processing module 110 will return the APDU response Y and thus close the processing of the APDU command X seen from the outside (i.e. from the host terminal).

[0102] Once the duration T max has been retrieved, the processing module 110 compares it to the execution duration of the command T execution . In particular, it determines whether the actual processing duration indicated by the time counter (therefore T execution ) is less than the predefined duration T max associated with the APDU command, in order to determine whether there is still available processing time T dispo : T dispo = T max - T execution .

[0103] If not (no time available), the processing module 110 sends the APDU response Y to the host equipment in step 330.

[0104] If so (available time), the processing module 110 executes one or more of said elementary operations during the remaining time T available of said predefined duration T max.

[0105] In an embodiment where the main operations are pre-divided into pluralities of elementary operations by the module 152, the processing module 110 requests the selector 156 by indicating to it the available duration T dispo for the purpose of obtaining the elementary operation(s) to be executed. Mechanisms for selecting the elementary operations are described above in connection with the Figure 2 In particular, the selector 156 selects one or more of said elementary operations to be executed according to their associated elementary processing times T estim and said time T available remaining after the execution of the APDU command.

[0106] The selection and thus the subsequent execution may include the selection and execution of elementary operations from distinct main operations.

[0107] Step 325 then consists of executing these elementary operations selected and returned by the selector 156.

[0108] The time counter 130 can be used on this occasion to measure the actual execution time of each of the elementary operations, in particular for the purpose of adjusting, if necessary, the estimated time T estim for these elementary operations.

[0109] Note that if the selector 156 indicates that there is no elementary operation to be executed (either the buffer 154 is empty, or no elementary operation at the output of the FIFO buffer satisfies the available duration - T estim > T dispo ), the method can go directly to step 330.

[0110] In another embodiment, without prior division of the main operations, step 325 may consist of continuing, during the available time T dispo , the execution of a previously suspended main operation.

[0111] If no main operation has yet been partially executed (and therefore suspended), step 325 consists of starting the execution of a main operation stored in the buffer 140, for example the main operation having the highest priority.

[0112] Once a main operation has already been partially executed, the step may consist of continuing the execution of this main operation from a previous suspension point. The execution of the main operation is carried out during the available time T dispo , that is to say, it is suspended again at a following suspension point which is a function of the remaining time T dispo . Thus, one or more elementary operations within the main operation will have been executed.

[0113] Upon suspension, the new suspension point is stored, along with any data or register values ​​needed to resume execution. Upon resuming execution (i.e., at a later step 325), the data or values ​​are then restored.

[0114] Following step 325 of executing elementary operations, step 330 consists for the secure element 100 in sending the APDU response Y to the host equipment. It can be seen that this sending is subsequent to step 325 of executing the elementary operations. Preferably, the APDU response Y is sent at the expiration of the predefined duration T max associated with the APDU command. By shifting the sending of this response to the end of the duration T max, the execution duration of the APDU command is artificially extended, seen from the outside (host terminal). In this way, no other APDU command is received from the host terminal during the period T max . This ultimately allows the secure element to always be able to execute (progressively) a main operation without blocking the APDU command processing but also without being blocked by a continuous series of APDU commands.

[0115] It should be noted that the process of the Figure 3 can be implemented upon receipt of any new APDU command. In this case, the management of the execution of a main operation by the secure element 100 comprises a plurality of iterations of the above steps so as to execute (progressively) the plurality of elementary operations forming the main operation.

[0116] There Figure 4 illustrates, using a flowchart, another embodiment of a method according to the invention. In this embodiment, one or more elementary operations can be executed between the processing of two APDU commands seen by the host terminal. In other words, the additional execution of one or more of said elementary operations is carried out after sending a response to a received APDU command and before receiving a subsequent APDU command.

[0117] This embodiment also illustrates the successive iterations (via the arrow from step 330 to step 400) of processing received APDU commands in order to progressively execute a main operation.

[0118] In step 400, the processing module 110 determines whether an APDU command has been received.

[0119] If so, steps 305 to 330 described above are implemented, noting that if there is no main operation to be executed, step 325 is reduced to doing nothing, and the APDU response Y can be transmitted, during step 330, directly after the execution of the command, i.e. without waiting for the end of the allocated duration time T max . In other words, an extended duration T max is allocated to an APDU command by the estimator 120 only when there are one or more main operations to be executed.

[0120] If not, the processing module 110 determines in step 450 whether there is a main operation to be executed, whether it has already been partially executed (and therefore suspended) or not. This amounts, for example, to checking whether the buffer 140 or 154 is empty or not.

[0121] If not, the method returns to step 400. Also, as long as no APDU command or main operation is received, the processing module 110 does not perform any processing.

[0122] If test 450 is successful, processing module 110 executes, in step 455, an elementary operation in a manner similar to that described above for step 325 for one or more elementary operations.

[0123] In case of splitting of the main operation, step 455 consists of recovering the first elementary operation from buffer 154 and executing it.

[0124] In the absence of a split, step 455 may consist of resuming execution of the main operation from the last suspension point and continuing it until the next possible suspension point.

[0125] Following this execution, the method returns to step 400. This makes it possible to check whether a new APDU command is received in the interval.

[0126] Of course, step 455 may provide for the execution of N (two or more) elementary operations, instead of just one, or the continuation of execution until the Nth (second or more) next suspension point ahead, before returning to step 400.

[0127] If an APDU command is received during execution 455, the secure element 100 may indicate to the host terminal that it will process the command sometime later.

[0128] The skilled person is familiar with the standards for mechanisms for providing this indication. For example, the secure element may return a status word 9300 indicating a busy state. Alternatively, it may return a Procedure Byte of type “NULL” (value '60'). Alternatively, it may use the proactive command “MORE TIME” via one or more 91xx / FETCH / MORE TIME / Terminal Response[9000 / 91xx] sequences.

[0129] The secure element can then execute the APDU command after the time extension.

[0130] Preferably, the secure element returning this indication as a response to the APDU command, waits for the host terminal to resend the APDU command, which command will be taken into account during the next step 400 (without the secure element requesting a further extension of the time).

[0131] Looping steps 400-450-455 allows the successive execution of one or more elementary operations until a new APDU command is received.

[0132] There Figure 5 illustrates a chronological sequencing of the processing of several successive APDU commands while two main operations OP1 and OP2 require processing, for example two identifier encryptions, two garbage collection operations (on two different memory areas) or two operations of different natures.

[0133] Although the two main operations must be performed at the same time here, one may appear later than the other.

[0134] The two main operations OP1 and OP2 are represented at the bottom of the figure as being formed respectively of n and m elementary operations. These elementary operations are for example stored in two FIFO buffers 154.

[0135] Upon receipt of an APDU X1 command (step 300), the secure element 100 obtains the associated time T max1, triggers the counter 130 (step 305), executes the APDU X1 command (step 310) without sending the APDU Y1 response, then calculates the remaining available time T dispo (steps 315, 320). In the example, the available time allows the selector 156 to select the elementary operations 1 and 2 of OP1 (OP1_1 and OP1_2) and the elementary operation 1 of OP2, denoted OP2_1 (because for example the elementary operation 3 of OP1 requires a time T estim greater than the remaining time).

[0136] These three elementary operations are then executed (step 325). At the end of the allocated time T max1, the secure element 100 sends the APDU Y1 response to the APDU X1 command.

[0137] Then a second APDU X2 command is received (step 300), the secure element 100 obtains the associated time T max2, triggers the counter 130 (step 305), executes the APDU X2 command (step 310) without sending the corresponding APDU Y2 response, then calculates the remaining available time T dispo (steps 315, 320). In the example, the available time T dispo allows the selector 156 to select a single elementary operation (elementary operation 3 of OP1, denoted OP1_3). This elementary operation is then executed (step 325). At the expiration of the allocated time T max2 , the secure element 100 sends the APDU Y2 response to the APDU X2 command.

[0138] The same steps are performed for APDU command X3 and the following ones. Thus, gradually the elementary operations of OP1 and OP2 are executed.

[0139] The APDU XN command arrives (step 300). The secure element 100 obtains the associated time T maxN, triggers the counter 130 (step 305), executes the APDU XN command (step 310) without sending the corresponding APDU YN response, then calculates the remaining available time T dispo (steps 315, 320). In the example, the available time T dispo allows the selector 156 to select the last two elementary operations of OP1 (OP1_n-1 and OP1_n) and the elementary operation j of OP2, denoted OP2_j. These elementary operations are then executed (step 325). At the end of the allocated time T maxN , the secure element 100 sends the APDU YN response to the APDU XN command.

[0140] At this point, the execution of the main operation OP1 is complete because all its elementary operations have been executed. The result of the main operation can then be used by the secure element. For example, the latter has one or more new encrypted identifiers, or has new recycled memory areas.

[0141] Of course, subsequent APDU commands will complete the progressive execution of OP2.

[0142] The preceding examples are only embodiments of the invention.

Claims

1. Method for managing the execution of a main operation (OP1, OP2) by a secure element (100), the method being characterized in that: the main operation is formed of a plurality of elementary operations (OP1_1, OP1_2, OP1-n), and the method comprises the following steps: a. receiving (300, 400), from a host equipment, a command (X, X1, X2, XN) in the Application Protocol Data Unit, APDU, format, b. triggering (305) a time counter (130) when the APDU command is executed in order to determine an actual processing duration for the secure element to process the APDU command; c. determining (320) whether the actual processing duration (Texecution) indicated by the time counter is less than a predefined duration (Tmax) associated with the APDU command; d. in the event of a positive determination, executing (325) one or more of said elementary operations during the remaining time (Tavail) of said predefined duration; and e. sending (330) a response (Y, Y1, Y2, YN) to the APDU command to the host equipment after step d.

2. Method according to Claim 1, wherein the response (Y, Y1, Y2, YN) to the command is sent upon expiry of the predefined duration (Tmax) associated with the APDU command.

3. Method according to either of the preceding claims, wherein the time counter (130) is triggered upon receipt (300, 400) of the APDU command.

4. Method according to one of the preceding claims, comprising a plurality of iterations of steps a. to d. so as to execute said plurality of elementary operations forming the main operation.

5. Method according to one of the preceding claims, comprising, after sending a response (Y, Y1, Y2, YN) to a received APDU command and before receiving a following APDU command (X, X1, X2, XN), additionally executing (455) one or more of said elementary operations.

6. Method according to the preceding claim, wherein the additional execution of one or more of said elementary operations comprises successively executing one or more elementary operations until the following APDU command is received.

7. Method according to one of Claims 1 to 6, wherein the main operation (OP1, OP2) is predivided into said plurality of elementary operations (OP1_1, OP1_2, OP1_n), each being associated with an elementary processing duration (Testim), and step d. comprises selecting the one or more of said elementary operations to be executed on the basis of their associated elementary processing durations and said remaining time (Tavail).

8. Method according to the preceding claim, wherein step d. comprises executing at least two elementary operations originating from at least two distinct main operations.

9. Method according to one of Claims 1 to 6, wherein step d. comprises continuing to execute the main operation from a previous suspension point, said execution of the main operation being suspended at a following suspension point that depends on the remaining time.

10. Secure element (100) configured to execute a main operation (OP1, OP2) formed of a plurality of elementary operations (OP1_1, OP1_2, OP1_n), the secure element comprising a processor configured to: a. receive, from a host equipment, a command (X, X1, X2, XN) in the Application Protocol Data Unit, APDU, format, b. trigger a time counter (130) when the APDU command is executed in order to determine an actual duration for the secure element to process the APDU command; c. determine whether the actual processing duration (Texecution) indicated by the time counter is less than a predefined duration (Tmax) associated with the APDU command; d. in the event of a positive determination, execute one or more of said elementary operations during the remaining time (Tavail) of said predefined duration; and e. send a response (Y, Y1, Y2, YN) to the APDU command to the host equipment after step d.

11. Non-transient computer-readable medium storing a computer program that, when it is executed by a secure element equipped with a processor, causes the secure element to perform the method according to one of Claims 1 to 9.