Method for securely transmitting a secret element between a first telecommunication device and at least one second telecommunication device

Abstract

The invention relates to a secure transmission of a secret element between a key server (SERV) and a telecommunication device (DEV1) comprising a secure cryptographic module (SE) with mutual authentication comprising in particular: by the server: generating a first random value; encrypting the first random value with the public key of the device; determining, by using the private key of the server, a first signature of the encrypted first random value; transmitting to the device a message including the encrypted first random value and the first signature; and by the device, in secure mode: - verifying the authenticity of the server on the basis of the encrypted first random value, the first signature and the public key of the device; then decrypting the encrypted first random value by the secure cryptographic module (SE) by means of the private key of the server, and storing the decrypted first random value in the secure memory; - encrypting a second random value with the public key of the server; and determining, by the secure cryptographic module (SE), with the private key of the device stored in the module, a second signature of the encrypted second random value.

Description

DESCRIPTION Title: Method for secure transmission of a secret element between a first telecommunications device and at least one second telecommunications device Technical field:

[0001] The invention relates to the establishment of a secure communication channel between two devices, allowing secret data, for example a temporary key, to be exchanged between the two devices, without the intervention of a third party, as opposed to the distribution of a key by a trusted authority.

[0002] The invention applies particularly to critical embedded systems (CES). Previous technique:

[0003] Industrial control systems (ICS), for example, such as SCADA, are distributed systems by nature, connecting sensors and actuators to a supervisor via specialized buses (field buses). Historically, all of this equipment formed an isolated network and was confined to a secure area of ​​a company building, where physical and organizational measures ensured their physical and IT security. From the 1990s, Industrial Ethernet enabled greater interoperability of these systems and their opening onto IT networks. From around 2010, the maturation of lightweight and decentralized communication protocols such as OPC UA PubSub or MQTT made it possible to envisage an Industrial Internet of Things (HoT), where industrial equipment is present outside the control of its operators and communicates with each other via public, unsecured networks.

[0004] Establishing a secure channel for the exchange of a secret element such as the Diffie-Hellman key exchange is applicable in IT systems in most industries such as automotive, railway or automation. It is of particular interest in the case of so-called "HoT" (Industrial Internet of Things) infrastructures, where the connectivity of the equipment cannot be established before the deployment phase, and may evolve during the life cycle. The security of this communication channel is particularly critical when it is established for the purpose of enrolling a connected device (one of the devices participating in the channel is then a key server distributing the session keys then allowing the other equipment to establish communication sessions with the other members of the group).

[0005] However, embedded systems are now deployed in an environment that is less and less controlled by their legitimate operators, and increasingly accessible to attackers. While a set of techniques at both the network level (firewall, DMZ, etc.) and the equipment level (execution flow control) has considerably increased the security of these systems, the risk of equipment being compromised remains significant, given the inherent criticality of SECs. The compromise (reading or modification) of a session key by an attacker allows the latter to control all exchanges between two devices. Existing key exchange techniques (Diffie-Hellman RSA or ECC) are generally effective in protecting the security of communications against an attacker present on the network but do not offer protection against an attacker with the ability to access the equipment's memory (for example, via the compromise of a process on it).In fact, the participants in the communication calculate a temporary encryption key, which is stored in its memory. Once the temporary encryption key is read by an attacker, they will be able to read or falsify information passing through this channel - for example, session keys, as part of a communication with a key server. The attacker will then be able to provide or falsify any data passing over the network from or to the compromised machine. In the case where the session keys are group keys, this power will extend to all machines in the group.

[0006] There is therefore a need to increase the protection of telecommunications in telecommunications systems, particularly of the SEC type. Summary of the invention:

[0007] To this end, according to a first aspect, the present invention describes a method for the secure transmission of a secret element between a first telecommunications device and at least one second telecommunications device, a respective private key - public key pair being associated with each of said first and second devices, the second device comprising a secure cryptographic module, adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the second device and to not be able to deliver at least some of said stored cryptographic information; the second equipment comprising a processor, at least two memory areas comprising a secure memory and a common memory and software functions executing on the processor, said second equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory; said method comprising the following steps: i / reciprocal authentication between the first equipment and the second equipment, said authentication comprising: i-1 / by the first equipment: generation of a first random value and storage of said first random value;encryption of said first random value with the public key of the second device previously obtained; determination of a first signature by using the private key of the first device of said first encrypted random value; transmission to the second device of a message comprising said first encrypted random value and said first signature; i-2 / by the second device: in the non-secure mode: reception of the message and copying of said message into the common memory; then in secure mode: verification of the authenticity of the first device according to said first encrypted random value, the first signature and the public key of the first device previously obtained;then if the authenticity has been verified, decryption, by the secure cryptographic module and by means of the private key of the second equipment stored in said module, of said first encrypted random value and storage of the first decrypted random value in the secure memory; obtaining a second random value and storing said second random value in the secure memory; encryption of said second random value with the public key of the first equipment previously obtained; determination of a second signature by the secure cryptographic module, with the private key of the second equipment stored in said module, of said second encrypted random value; copy; in the common memory of said second encrypted random value and said second signature; in the non-secure mode: preparation, for transmission to the first device, of a message comprising said second encrypted random value and said second signature; transmission to the first device, of the message; i-3 / by the first device: reception of the message containing said second encrypted random value and said second signature; verification of the authenticity of the second device according to said second encrypted random value, said second signature and the public key of the second device previously obtained; then if the authenticity has been verified, decryption of said second encrypted random value according to the private key of the first device;ii / determination by the first device of a symmetric encryption key, called the initialization key, as a function of the first random value stored in step i-1 and the second random value decrypted in step i-3, by implementing an initialization key calculation function having as variables said first and second random values; iii / determination by the second device in secure mode of said initialization key as a function of the first random value stored in step i-2 and the second random value stored in step i-2, by implementing said initialization key calculation function having as variables said first and second random values ​​and the result of which will be in a strictly deterministic manner the initialization key also calculated by the first device; and storage of said initialization key in the secure memory;iv / encryption of the secret element by the first device with said initialization key determined in step ii; and transmission of said encrypted secret element to the second device; v / reception by the second device of said encrypted secret element; decryption, in secure mode, of said secret element using the initialization key stored in step iii and storage of said secret element in the secure memory or in the secure cryptographic module.;

[0008] A secret information element is understood to mean sensitive data, typically cryptographic keys, used by cryptographic functions, for example to encrypt, decrypt, sign and / or authenticate a signature and the obtaining of which by a malicious third party would undermine the security of communications implemented in particular by the second device.

[0009] Such a method makes it possible to increase the protection of telecommunications in telecommunications systems, particularly second SEC equipment.

[0010] The principle of the invention is to propose a security architecture based on hardware element capabilities and which ensures the mitigation of software and / or hardware compromise of a second device, including in the event of undetected takeover. In particular, the invention provides a telecommunications system comprising second networked devices and which implement the invention with the following properties: - a second device, compromised or not, cannot disclose the secret element (typically a temporary key); - in the context of use for the enrollment of second devices: a second device, compromised or not, cannot disclose the encryption key (typically encrypted session key of the secret element); a device, compromised or not, can only receive a key to communicate with other second devices from a valid key server.

[0011] In embodiments, such a method will further comprise at least one of the following features:

[0012] the first equipment is a key server, the secret element comprises at least one session key and said method further comprising the following steps: steps i / to v / are implemented by the key server with a plurality of second equipments to transmit to said second equipments said same session key; a telecommunications session is then established between at least two of said second equipments as a function of said session key stored in each of said second equipments following their transmission by the key server;

[0013] - the first equipment is a key server, the secret element comprises at least one session key and said method further comprising the following steps: steps 1 / to v / are implemented by the server with a plurality of software applications of the same second equipment to transmit to said applications said same session key; a telecommunications session is then established between at least two of said applications based on at least said copies of said session key stored following their transmission by the key server;

[0014] - the secure cryptographic module of the second device is a discrete module and / or the secure cryptographic module of the second device is adapted to be able to exchange only within the second device and only in secure mode;

[0015] - the secure transmission method comprises, before step i-1, a step i-0 comprising: the transmission by the second equipment to the first equipment of the certificate of the second equipment established by a certification authority and comprising at least the public key of the second equipment and a signature of said public key by the private key of the certification authority; by the first equipment: verification of the validity of the certificate of the second equipment transmitted and storage of the public key of the second equipment; and the message transmitted by the first equipment further comprises the certificate of the first equipment comprising the public key of the first equipment;and in step i-2, after switching to secure mode: before implementing the verification of the authenticity of the first device, the certificate of the first device received in the message is verified using the secure cryptographic module, based on the public key of the certification authority previously stored in secure mode in the secure cryptographic module;

[0016] - the first equipment comprising a secure cryptographic module, adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the first equipment and to not be able to deliver at least some of said stored cryptographic information; the first equipment comprising a processor, at least two memory areas comprising a secure memory and a common memory and software functions executing on the processor, said first equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory; and the steps described in relation to the first device, respectively to the second device, are further implemented symmetrically, i.e. this time by the second device, respectively by the first device.

[0017] According to another aspect, the invention describes a telecommunications system comprising a first telecommunications device and at least one second telecommunications device, a respective private key - public key pair being associated with each of said first and second devices, the second device comprising a secure cryptographic module, adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the second device and to not be able to deliver at least some of said stored cryptographic information;the second equipment comprising a processor, at least two memory areas comprising a secure memory and a common memory and software functions executing on the processor, said second equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory;said first telecommunications equipment and at least second telecommunications equipment being adapted to implement between them an authentication operation during which the first equipment is adapted to generate a first random value and to store said first random value, to encrypt said first random value with the public key of the second equipment previously obtained, to determine a first signature, by use of the private key of the first equipment, of said first encrypted random value, to transmit to the second equipment a message comprising said first encrypted random value and said first signature; - the second equipment is adapted, in the non-secure mode, to receive said message and copy said message into the common memory, - then the second equipment is adapted, in secure mode, to verify the authenticity of the first equipment based on said first encrypted random value, of the first signature and the public key of the first device previously obtained, then if the authenticity has been verified, so that the secure cryptographic module decrypts, by means of the private key of the second device stored in said module, said first encrypted random value, to store the first decrypted random value in the secure memory; the second device being adapted to, in secure mode, obtain a second random value and store said second random value in the secure memory, to encrypt said second random value with the public key of the first device previously obtained, so that the secure cryptographic module determines a second signature, with the private key of the second device stored in said module, of said second encrypted random value, and to copy said second encrypted random value and said second signature into the common memory;the second equipment is adapted to, in the non-secure mode, prepare, for transmission to the first equipment, a message comprising said second encrypted random value and said second signature, transmit said message to the first equipment; the first equipment being adapted to receive said message containing said second encrypted random value and said second signature, to verify the authenticity of the second equipment as a function of said second encrypted random value, said second signature and the public key of the second equipment previously obtained, then if the authenticity has been verified, to decrypt said second encrypted random value as a function of the private key of the first equipment;the first equipment being adapted to determine a symmetric encryption key, called initialization key as a function of said first stored random value and said second decrypted random value, by implementing an initialization key calculation function having as variables said first and second random values; the second equipment is adapted to, in secure mode, determine said initialization key as a function of said first stored random value and the second stored random value, by implementing said initialization key calculation function having as variables said first and second random values ​​and the result of which will be in a strictly deterministic manner the initialization key also calculated by the first equipment, and store said initialization key in the secure memory;the first equipment being adapted to encrypt the secret element with said initialization key which it has determined, and to transmit said encrypted secret element to the second equipment; the second equipment being adapted to receive said encrypted secret element, to decrypt, in secure mode, said secret element using the stored initialization key and to store said secret element in the secure memory or in the secure cryptographic module.

[0018] In embodiments, the telecommunications system will further comprise at least one of the following features:

[0019] - the first equipment is a key server, the secret element comprises at least one session key and the authentication operation is implemented by the key server with a plurality of second equipments to transmit to said second equipments said same session key; at least two of said second equipments being adapted to establish between them a telecommunications session as a function of said session key stored in each of said second equipments following their transmission by the key server;

[0020] - the first equipment is a key server, the secret element comprises at least one session key and the authentication operation is implemented by the server with a plurality of software applications of the same second equipment to transmit to said applications said same session key; at least two of said applications being adapted to establish between them a telecommunications session as a function of at least said copies of said session key stored following their transmission by the key server;

[0021] - the secure cryptographic module of the second device is a discrete module and / or the secure cryptographic module of the second device is adapted to be able to exchange only within the second device and only in secure mode. Brief description of the figures:

[0022] The invention will be better understood and other characteristics, details and advantages will appear more clearly on reading the following description, given without limitation, and thanks to the appended figures, given by way of example.

[0023] [Fig. 1] Figure 1 is an illustration of a telecommunications system in one embodiment of the invention;

[0024] [Fig. 2] Figure 2 represents the steps of a method for secure transmission of a secret element in one embodiment of the invention;

[0025] [Fig. 3] Figure 3 illustrates an application to the railway field of an embodiment of the invention.

[0026] Identical references may be used in different figures when they designate the same or comparable elements. Detailed description:

[0027] Figure 1 shows a distributed telecommunications system 1 in one embodiment of the invention. This system 1 comprises a plurality of telecommunications devices 10, a server (named SERV) 20 and a network of telecommunications links 40.

[0028] In a known manner, each of the server 20 and the devices 10 is associated with a private key / public key pair allowing an asymmetric encryption mechanism: the public key can be distributed to the public while the private key must imperatively remain secret and be used only by the equipment 10 (or its user) to which it has been assigned. The property of asymmetric algorithms is that a message encrypted by a private key will be readable by all those who possess the corresponding public key. Conversely, a message encrypted by a public key is only readable by the owner of the corresponding private key. Typically the private key also makes it possible to sign messages.

[0029] In the embodiment considered, the server 20 and each device 10 have a respective digital certificate, signed and issued by a third-party certification authority CA, which makes it possible to verify their authenticity. A certificate contains information uniquely identifying the owner of the certificate, such as the name, its public key, the distinguished name of the certification authority CA, a digital signature, by the certification authority, using its own private key, or by a trusted third party affiliated with the preceding information (indeed, the verification of this signature, using the public key of the CA thus makes it possible to subsequently validate that the certificate was issued by a recognized certification authority).

[0030] The network 40 is adapted to provide wired and / or wireless telecommunications links to the telecommunications devices 10 and to the server 20.

[0031] The telecommunication devices 10, for example named DISPO1, DISPO2, etc., are electronic devices adapted to establish telecommunication sessions between them via the telecommunication network 40, for example to exchange useful data (of the type provided by sensors in devices 10 or intended for actuators in devices 10 or data stored in a remote database included in a device 10). One or more business applications 15 (APP1 in DISPO1, APP2 in DISPO2) running in the electronic device 10 exchange(s) with one or more business applications of other devices 10 or of the server 20. These telecommunication devices 10 (DISPO1, DISPO2, etc.) perform calculation operations using their calculator(s), on the data received in operational mode (as part of the execution of these business applications). These operations are performed in unsecured mode on the clear data.

[0032] Each telecommunications device 10 is further adapted to exchange with the server 20 via the telecommunications network 40.

[0033] The server 20 comprises a random generator, a memory, a processor, a telecommunications block including in particular, in the embodiment considered, a modem, an RF transmission-reception antenna, (not shown).

[0034] Each device 10 comprises a TEE 11, a Secure Element (SE) 12, a common memory 13 and a secure memory 14, a business application 15, an operating system 16 and a Modem 17 (,) and not shown: a processor allowing the execution of the business application, the TEE, the OS, etc., an RF stage and a random generator.

[0035] The TEE 11 is a secure execution environment (“Trusted Execution Environment”) adapted to allow the execution of critical functions in the secure memory 14 (for example by means of a control bit in the addressing field, for example then set to 0) and which is separated from the rest of the system (corresponding to the control bit set to 1).

[0036] The device 10 and in particular its processor, is thus provided with a mechanism allowing it to switch between two alternative operating modes: a non-secure mode and a secure TEE mode, such that in the non-secure mode, the processor and the software functions executed are prohibited from accessing the secure memory area 14 and access the common memory 13 while in the secure mode, only a very reduced, predefined subset of available functionalities is authorized to execute (making it easier to analyze the behavior of the critical functions) on the processor, and the secure memory 14 and the common memory 13 are accessible.For example, in the present case, this subset comprises exclusively the cryptographic and logical operations necessary for receiving a key from a key server, including all the verifications which are the subject of the present invention, as well as the use of this key to establish and secure communication with other second equipment.

[0037] The SE 12 (“Secure Element”) is an electronic module, for example discreet (on its own electronic chip for example, separate from the rest of the components of the device), which provides basic cryptographic operations (encryption, decryption, signature, signature verification) using secrets and makes it possible to store, in a tamper-proof memory of the SE 12, and to use, secrets (in particular the private key of the device 10) without them being able to be accessed by any user (for example, because the SE 12 is adapted to not deliver these secrets: no interfaces, no functionalities allowing it). The provisioning of secrets in the SE 12 is for example carried out in the factory where the secrets are generated in the SE 12; it is also possible to dynamically add a secret. No direct connection from the business application 15 to the SE 12 is authorized. In the embodiment considered, optional, it is only possible to exchange with the SE 12 within the device 10 in TEE mode.The business application 15 communicates via the common memory 13 with a “TEE Trusted Application” application executed in the TEE 11, which is itself connected to the SE 12 responsible for carrying out the cryptographic operations.

[0038] Typically, a TPM security element is used to implement the OS. There are several types of OS that can be used: STM's ST33®, NXP's A700x® chip, etc.

[0039] In the embodiment of the invention considered, it is desired to establish secure telecommunications channels between the devices 10 via the network 40, and on which encrypted messages will be exchanged. A secure communication channel will protect the security of communications against an attacker present on the network or against an attacker having physical access to them.

[0040] Establishing the secure communication channel between the devices 10 involves two phases, with reference to Figure 2: - recovery of the session keys by the devices 10 (phase 1), which involves three steps that each device 10 must perform independently: mutual authentication between the device 10 and the server (step 10Oi); construction of a temporary secure communication channel between the server and the device 10 (sub-steps 10Oii and 10Oiii); transmission of the session keys (sub-steps 10Oiv and 10Ov); - exploitation of the secure communication channel by the devices 10 using session keys (phase 2).

[0041] Mutual authenticity (step 10Oi) can be the subject of numerous more or less simplifying hypotheses. We place ourselves here in the most general framework - and the more secure - where device 10 knows server 20, but does not trust it (i.e. it does not yet have its certificate), and where the server does not know device 10, but knows (and trusts) its CA.

[0042] Below is a mutual authentication mechanism reflecting a particular implementation (namely the OPC UA security model), but the main steps are found regardless of the approaches, even if the order of execution may vary: Identification of the device 10 (typically in the form of sending a certificate) and verification of the validity of the device 10 by the server 20 (with the certification authority CA); Proof of authenticity of server 20 (by sending a signed message); - Verification of the validity and proof of authenticity of the server 20 by the device 10 (verification of the signature); Proof of authenticity of device 10 (by sending a signed message); - Verification of the proof of authenticity of the device 10 by the server 20 (verification of the signature).

[0043] Thus, with reference to Figure 2, the steps of a method according to the invention are now detailed. The device 10 DISPO1 comprises its private key CS21 as well as the public key of the CA, both stored in its SE 12.

[0044] During the process, if at any point an authentication or verification of validity, signature etc. fails, the process ends and subsequent steps are not carried out.

[0045] A step 100i-0 of identifying the device 10 (typically in the form of sending a certificate) and verifying the validity of the device 10 by the server 20 (with a certification authority) comprises: - the transmission by the device 10 DISPO1 to the server 20 of the certificate of the device 10 established by the certification authority CA and comprising at least the public key CP21 of the device 10 and a signature of in particular said public key by the private key of the certification authority CA; - verification by the server 20 of the validity of the certificate of the device 10 transmitted (by authenticating it with the CA or with the public key of the CA stored in the server 20) and storage of the public key of the device 10 by the server 20. In one embodiment, the certificate of the device 10 is stored in the SE 12 which extracts it in TEE mode before sending it to the server 20, which ensures the integrity of the certificate in the device 10. In another embodiment, it is stored in the secure memory 14 or the common memory 13 (in this case the hash of the certificate must be stored in the secure memory or in the SE).

[0046] A step 100i-1 of proof of authenticity of the server 20 (by sending a signed message) implemented by the server 20 comprises: generation of a first random value, aleal, and storage of said first random value aleal; - encryption of said first random value with the public key CP21 of the device 10 DISPO1 previously obtained in the certificate received; - determination of a first signature by encryption with the private key CS1 of the server of the aggregate of said first encrypted random value; - transmission to the device 10 of a message comprising said first encrypted random value, said first signature and the certificate of the server 20.

[0047] A step 100i-2-1 of verification of the validity and proof of authenticity of the server 20 by the device 10 (verification of the signature) implemented by the device 10 DISPO1 includes the reception of the message, and after switching to TEE mode: - the certificate of the server 20 received in the message is provided to the SE 12 for authentication of said certificate by the SE 12 based on the public key of the certification authority CA previously stored in the SE 12 (in an alternative embodiment, the CA is stored in the secure memory, and the SE is not involved in the authentication of the server and is involved in the authentication of the client with the server);verification of the authenticity of the server 20 as a function of said first encrypted random value, of the first signature and of the public key of the server 20 appearing in the certificate of the server 20 authenticity: the device 10 in turn calculates an aggregate of the random value, then compares it with the signature decrypted by the public key of the server CP1 contained in the certificate): this makes it possible to confirm, in the event of equality of the compared terms, that the server had the private key necessary to carry out the signature and prove its authenticity; then; - only if the authenticity has been successfully verified, decryption by the SE 12, based on the private key, CS21, of the device 10 stored in the SE 12, of said first encrypted random value aleal and storage of the first decrypted random value, aleal, in the secure memory 14.

[0048] By using the SE proposed in the invention, the integrity of the public key of the CA and the private key CS21 of the device 10 is ensured, as well as the confidentiality of the latter. In addition, by using the TEE, the random secret transmitted by the server 20 remains confidential (applications not associated with the TEE in the device 10 do not have access to it) and the sequence of operations is executed atomically (in that the sequence of operations of the process implemented in TEE mode cannot be compromised).

[0049] In a step 100i-2-2 of proof of authenticity of the device 10 (by sending a signed message), the latter implements the following steps, in TEE mode: - generation of a second random value, alea2, (optionally the SE can be used to generate at least partially this value and optionally, this second random value is for single use) and storage of said second random value in the secure memory 14; - encryption of said second random value alea2 with the public key CP1 of the server 20 contained in the certificate received; - determination of a second cryptographic signature by the SE 12 with the private key of the device 10, stored in the SE 12, of said second encrypted random value alea2.

[0050] A message comprising said second encrypted random value and said second signature is provided, for example via the common memory 13, to the business application 15.

[0051] Then the business application 15, in non-secure mode, transmits to the server 20 a message comprising said second encrypted random value and said second signature.

[0052] Thanks to the use of the SE 12 proposed in the invention, the integrity and confidentiality of the private key CS21 of the device 10 are ensured. Thanks to the use of the TEE 11, the confidentiality of the generated secret alea2 remains ensured; again, no application in the device 10 can know the content of the secret because the latter is manipulated in the TEE 11 and the SE 12. Finally, the atomic execution of all operations is ensured by the TEE according to the invention.

[0053] In a step 100i-3 of verification of the proof of authenticity of the device 10 by the server 20 (verification of the signature), the server 20 implements the following steps: - verification of the authenticity of the device 10 based on said second encrypted random value alea2 and said second signature present in the message received and the public key CP21 of the device 10 previously obtained (to verify that the device 10 has indeed used the corresponding private key CS21 to sign); then - only if the authenticity has been successfully verified, decryption of said second random value alea2 encrypted according to the private key CS1 of the server 20 then storage.

[0054] In a step of constructing a temporary secure communication channel between the server 20 and the device 10, the sub-steps 10Oii and 10Oiii are implemented, in parallel or not. This “construction” corresponds to that of an initialization key, for example symmetric (typically AES256). We speak of “secure channel construction” for all the operations which allow several participants (two or more) to share a key without it being exposed online. These exchanges are based on the possession of a common secret, calculated (and not exchanged) by each participant.

[0055] Thus in sub-step 100ii, the server 20 determines an encryption key, here symmetrical, called the initialization key, named K init, depending on the first random value random stored in step 100i-1 and the second random value random2 decrypted in step 100i-3, by implementing an initialization key calculation function having as variables the first and second random values ​​random and random2.

[0056] And in sub-step 10Oiii, the device 10 also determines, in TEE mode, the initialization key K init based on the first random value random stored in step 100i-2-1 and the second random value random2 stored in step 100i-2-2, by implementing said initialization key calculation function which is common to the server and the devices 10; and storing the initialization key K init in the secure memory 14 or in the secure cryptographic module (SE12). Thanks to the calculation in TEE mode and the storage thus secured, the confidentiality of the key K initis superior to purely software implementations.

[0057] In a step of transmitting the session keys {K s} In the temporary secure channel comprising sub-steps 10Oiv and 100v, the session keys encrypted with the initialization key are transmitted. A man-in-the-middle attacker will only obtain encrypted information, and therefore unusable if the encryption level is sufficient and the exchanged data is unknown.

[0058] In sub-step 10Oiv, the server 20 encrypts the session keys {K s} with initialization key K init determined in sub-step 10Oii and transmits the session keys thus encrypted to the device 1.

[0059] In sub-step 100v, the device 10 receives the encrypted session keys, then decrypts them, in TEE mode, using the initialization key K initstored in substep 10Oiii, then stores the decrypted session keys {K s} in secure memory 14 or in OS 12.

[0060] The information exchanged in this context must therefore have sufficient entropy (unpredictability in order to resist cryptanalysis). Typically, this initial exchange is limited to a set of encryption and / or signature key(s), which have been collectively referred to as "session keys". These keys are, for example, symmetrical, for performance reasons, but not necessarily identical (for two distinct devices 10 in particular) in the case of signature keys.

[0061] Failing this step (typically the consequence of failing the previous key calculation step) interrupts all possibility of communication with the third party, unless the authentication process is started again from the beginning.

[0062] In an embodiment of the invention applying to the class of low-speed communicating objects, the session keys are then provisioned in the SE 12 and any trace in memory (including in the TEE 11) is erased. In an embodiment of the invention applying to the class of high-speed communicating objects, the key is kept in the memory space (the secure memory 14 for persistence).

[0063] The difference between these classes is recalled below.

[0064] Some SECs communicate via low or very low data rate networks, for reasons of range, cost, autonomy or robustness to electromagnetic disturbances (including in the face of threats such as electronic warfare). In addition, hardware platforms may have only limited computing resources - always for the same reasons. As a result, data encryption may not be necessary or possible given the capabilities and needs of the system. Data integrity, however, is all the more necessary since the criticality of these systems is typically higher than that of the more generic SECs described below.

[0065] Examples of applications falling under this class of needs are equipment involved in the connected battlefield, sensors and actuators in environments with high electromagnetic activity (nuclear, space) or invasive medical equipment (pacemaker type).

[0066] The class of high-speed connected SECs, more widespread than the previous one, concerns systems communicating confidential data and offering sufficient resources (computing capacity, high-speed communication) to implement encryption.

[0067] The steps of phase 1 described previously having been implemented between the server 20 and several devices 10, the latter have thus obtained the session keys allowing them, in a phase 2, to set up a communication session between them.

[0068] For example, a secure communication channel 30 is implemented between the devices DISPO1 and DISPO2, such that the data exchanged between them on the network 30 between the business applications APP1 and APP2 are encrypted, in TEE mode, using one of the session keys, and / or are signed using another session key. For example, for the class of high-speed communicating objects, the decryption / encryption is carried out in the TEE by exploiting the session keys and in the case of the class of low-speed communicating objects, the decryption / encryption is not carried out in TEE, but in the SE 12 which alone keeps the session key. Access to the Secure Element is, on the other hand, carried out in TEE mode.

[0069] The TEE 11 and the SE 12 in the device 10 are exploited by the invention to ensure strong confidentiality and integrity of the various secrets involved in the steps of the method including the session keys.

[0070] It has been described above, in a particular embodiment of the present invention, a method for the secure transmission of session keys between a first device, of the key server type, and a second device, of the communication device type of a network of communication terminals, thus allowing increased protection of subsequent communications implemented between the devices of the network. The invention can of course be implemented for the transmission of secret elements other than session keys between two telecommunications devices: for example information concerning the configuration of a device and / or the updating of its software.

[0071] As seen previously, to protect the secrecy of communications and the integrity of equipment, a certain number of secrets are necessary. These secrets are, depending on the case, shared with third parties or exclusive to the device 10.

[0072] A classification of secrets according to their persistence and use is proposed here:

[0073] [Table 1]

[0074] Several elements emerge from this classification:

[0075] The source secret / target secret pair (called random1 / random2 above) and the initialization key are not kept in an SE in one embodiment of the invention because the loading times for these would be too long today in relation to their lifespan (at least for TPM2s - this point could change with the evolution of SEs);

[0076] Arbitrary operations applied to the source secret / target secret pair are difficult to reconcile with the operation of an SE (except for customization, which would harm the trust that could be placed in the SE);

[0077] The lifespan of private keys makes the use of an OS ideal;

[0078] Session keys, which have a very variable lifespan, could be protected by an SE or in the TEE depending on the operational need.

[0079] Generally speaking, the more ephemeral a secret is, the less it is protected in current architectures. However, ephemeral secrets allow more permanent secrets to be inferred: the target secret / source secret pair allows the temporary key to be calculated with certainty, which allows the session key to be decrypted. The invention makes it possible to protect all secrets (the protection of the equipment's private key in a Secure Element is not sufficient: this protects this key, but does not prevent access to the session keys): whatever their lifetime, with means compatible with their operational use and without inducing significant restrictions on the real-time and / or embedded capabilities for the final system.

[0080] Furthermore, the invention makes it possible to protect the integrity of certificates, which in the prior art are rarely protected, because they are not confidential (neglecting that an attacker who would modify these certificates could however initiate a connection with malicious equipment: a classic and particularly critical example is to authorize a malicious update server, which makes it possible to transform the compromise of a process into the installation of malicious software - and therefore to make the compromise persistent).

[0081] The invention provides the connected equipment that implements it with the benefit of a secure channel protected by the SE and TEE pair.

[0082] In the general case where the secure channel is used to exchange a secret, the invention offers the following benefits: - execution of cryptographic operations in the TEE and the SE: ability to implement checks on the nature of the data, the source and / or the destination in a trusted environment, protection against the risk of private key theft; - certificate integrity protection: protection against certificate injection.

[0083] Application to key distribution: all the general advantages of the invention described above are also provided, with the additional following advantages: ► in the main case (SEC Connected high confidentiality high bandwidth): protection of keys throughout the life cycle: mitigation of the risk of equipment compromise, better protection of secrets received, better protection of remote equipment against data counterfeiting, better protection against theft of the equipment's private key; protection of the integrity of certificates: mitigation of the risk of equipment compromise, protection against certificate injection; coupled with a level 4 firewall solution, the invention also ensures better protection against information exfiltration from the equipment; Trusted Datalake: by protecting the integrity of data on equipment and in transit, the invention allows for trust in the data present in the datalake, and therefore for its use in critical applications. ► in the variant case (SEC Connected high integrity low bandwidth), the properties described in the main case are ensured, apart from the improvement of the property of key protection throughout the lifecycle, because the session key is stored in the SE 12 rather than in the TEE 14. In both cases, these benefits apply even if the attacker has physical access to the device's memory.

[0084] The invention also makes it possible to adapt to the life cycle of secrets. It allows logical isolation of wireless communication flows, and makes it possible not only to encrypt one or more communications between two remote devices, but also between two applications located on the same device 10, or between an application on a device 10 and a database local to the device 10 or remote.

[0085] In such a case, the steps described above are implemented by the server with these software applications of the same equipment to transmit to said applications said same session key; a telecommunications session is then established between the two applications based on at least said copies of said session key stored following their transmission by the key server. The distribution of keys is carried out via primitives accessible by the applications running on the same hardware platform (i.e. the same execution core) as that on which the secure world is running. The applications submit via these primitives a secret specific to them in addition to the certificate linked to the platform (typically provided by the publication server, and accessible by all applications having the right to communicate with each other).In this specific case (that of applications running on the same platform), the secure world adds a step of verifying the secret provided by the source or destination application. A simple implementation of this mechanism is the use of an x509 certificate provided to the application by the TEE during a provisioning phase, and for which the TEE has the corresponding private key (so the TEE is in this case the certification authority). It is then not necessary to encrypt the data exchanged between several applications, because this data passes only through the TEE, and not through unencrypted system files.

[0086] In a non-standard manner compared to normal practices of public key architectures, this certificate is a secret, which must not be known to other applications, otherwise the latter could usurp its identity with the TEE and read or write messages of which it would be the source or destination. It is possible to ensure the confidentiality of this secret by relying on various levels of the execution platform (e.g. use of UNIX read rights, use of encrypted virtual machines, use of a hypervisor running several distinct OS, etc.) as is known to those skilled in the art.

[0087] In one embodiment, the invention is implemented to secure communications in a producer-consumer architecture (also called publisher / subscriber), where information is organized by groups (or topics) that can admit one or more producers, and one or more consumers. In this type of architecture, the encryption keys are shared between the different devices subscribed to the group, which makes the compromise of a device particularly interesting for an attacker (because it allows him to then compromise the entire group). The use of our invention, thanks to the judicious use of secure hardware elements (TEE and SE) in the calculator ideally of all the communicating entities, makes it possible to secure the exchange and confidentiality at execution, including against an attacker having physical access to one of the devices protected by the invention.

[0088] The OPC UA PubSub protocol (OPC UA Specification, part 14, version 1.04, 2018 / 02 https: / / reference.opcfoundation.org / v104 / Core / docs / Part14 / ) is used to implement communications. It describes the mechanism for distributing encryption keys using a dedicated server, the Security Key Service. This authenticates clients requesting a subscription to data, establishes a secure communication channel, and distributes encryption keys via this channel. Communications are then encrypted by producers using these keys, sent to a broker 204 (potentially implemented via multicast transmissions), transmitted by the latter to consumers, and decrypted by consumers. The broker only handles encrypted messages, and therefore plays no role in maintaining data integrity.

[0089] In the case of high-speed high-confidentiality connected SEC, a hardware platform in each communicating device (producer and / or consumer) comprises an NXP i.MX8M card (including an ARM TrustZone TEE) and the TPM2 ST33 secure element.

[0090] This platform is operated with the following software stack (in unsecured mode): Operating System: Embedded Linux Cryptographic library: mbedTLS Communications: UDP / IP + OPC UA PubSub + MQTT

[0091] In secure mode, several options are possible, for example OP-TEE. In addition, access to the TPM must be performed in the TrustZone. To this end, it is proposed to perform this access from an open-source TSS2 or WolfTPM stack.

[0092] In this context, the different keys are protected and used in the following way, following the main implementation mode:

[0093] [Table 2]

[0094] The cryptographic parameters are as follows:

[0095] The TPM2 of the equipment protected by the invention will use its private key to sign the connection initiating the secure channel with RSA2048 asymmetric encryption.

[0096] The TPM2 of the equipment protected by the invention will use its private key to decrypt random number 1 sent by the remote equipment with RSA2048 asymmetric encryption.

[0097] The TrustZone of the equipment protected by the invention will generate the random secret 2, and use the public key of the remote equipment to encrypt this secret.

[0098] The TrustZone of the equipment protected by the invention will calculate the temporary key using the secrets aleal and alea2.

[0099] The TrustZone of the equipment protected by the invention will use its temporary key to encrypt the secure channel with AES256 symmetric encryption.

[0100] The TrustZone of the equipment protected by the invention will use its session (or group) key to encrypt messages with AES256 symmetric encryption.

[0101] The TrustZone of the equipment protected by the invention will use its session (or group) key to sign messages with the OPC UA PubSub Basic256Sha256 policy.

[0102] In the case of a high-integrity, low-throughput, connected SEC carrying long-lived keys (two parameters that are generally closely linked), a different placement of functions is proposed. The session key, instead of being stored in the TrustZone, only passes through this memory and is loaded, then stored and used in the TPM2.

[0103] This variant can be realized with the same hardware and software architecture as the previous one.

[0104] In this context, the use of the session key (for encryption, decryption, verification and signing) is carried out by the TPM2.

[0105] [Table 3]

[0106] Compared to the general case, the session key is less exposed to covert channels (it is only present for a few milliseconds in the TrustZone, before loading into the TPM2). However, since the TPM2 is typically less efficient than a cryptographic accelerator or a CPU, it will only be able to handle a limited frequency of data throughput - which is why we limit this architecture to low-bandwidth SECs.

[0107] The cryptographic parameters are as follows:

[0108] The TPM2 of the equipment protected by our invention will use its private key to sign the connection initiating the secure channel with RSA2048 asymmetric encryption.

[0109] The TPM2 of the equipment protected by the invention will use its private key to decrypt random number 1 sent by the remote equipment with RSA2048 asymmetric encryption.

[0110] The TrustZone of the equipment protected by the invention will generate the random secret 2, and use the public key of the remote equipment to encrypt this secret.

[0111] The TrustZone of the equipment protected by the invention will calculate the temporary key using the secrets aleal and alea2.

[0112] The TrustZone of the equipment protected by our invention will use its temporary key to encrypt the secure channel with AES256 symmetric encryption.

[0113] The TPM2 of the equipment protected by our invention will use its session (or group) key to encrypt messages with AES256 symmetric encryption.

[0114] The TPM2 of the equipment protected by the invention will use its session (or group) key to sign messages with the OPC UA PubSub Basic256Sha256 security policy.

[0115] In the architecture chosen for the equipment 10, a secure gateway application 205 executes the application code in non-secure mode, within a system general-purpose operating system. TEE Trusted Application executes the critical code for establishing communication, while asymmetric encryption operations are performed only by the OS upon request from the TEE. In unsecured mode, an application firewall filters all data sent, and only accepts messages signed by a valid encryption key. For this, the verification of this key is delegated to the TEE (TrustZone). This protection is not absolute, since the firewall can be compromised, but it limits the risk of information exfiltration, and therefore adds a layer of defense in depth.

[0116] Let us consider the implementation of this application of the invention in the railway field, for a predictive maintenance application, with reference to Figure 3. A big data type application 202 uses data fed back from sensors 206 in order to present to a maintenance expert a flexible real-time view of the state of railway tracks (rails, catenaries, etc.). The railway operator has expressed the need to secure communications on the public network, including between the secure gateway 205 and the APN 203 (Access Public Network, provided by a telecom operator), without sacrificing the flexibility of the architecture (ease of deployment and enrollment of the equipment). For this, the secure gateway must connect to a key server, the Security Key Server 201 (SKS), following the OPC UA PubSub protocol. This exchange allows the new client to obtain the group keys (or session keys).In this context, session keys are particularly sensitive, since they are shared between all members of a group and the implementation of the invention makes it possible to benefit from the advantages mentioned above.

[0117] At the operational level, by protecting the confidentiality of the data, the invention ensures compliance with the client's confidentiality requirements, as well as protection against the theft of a company asset, which can then be valued (including sold). By protecting the integrity of the data on the equipment and in transit, the invention makes it possible to have confidence in the data present in the data lake, and therefore to use them for the maintenance and optimization of the system 200 thus presented with reference to Figure 3.

[0118] The concept of a "secure microprocessor" is fundamentally different from that of "secure mode (of a processor equipped with a TEE)" considered in the invention. In the first case, the entire processor is deemed secure, which implies either: (1) securing the vast software package that constitutes the operating system, the drivers and the current services necessary for carrying out possible calculation operations (at a minimum: communication stacks, which are known to often host vulnerabilities, e.g. https: / / www.cert.ssi.gouv.fr / avis / CERTFR-2019-AVI-367); or (2) waiving these services. In the solution according to the invention, the secure mode has a reduced set services, but the insecure mode can host a standard operating service without weakening the security of the device.

Claims

CLAIMS 1. Method for secure transmission of a secret element between a first telecommunications device (SERV) and at least one second telecommunications device (DISPO1), a respective private key - public key pair being associated with each of said first and second devices, the second device comprising a secure cryptographic module (SE), adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the second device and to not be able to deliver at least some of said stored cryptographic information;the second equipment comprising a processor, at least two memory areas comprising a secure memory (14) and a common memory (13) and software functions executing on the processor, said second equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory; said method comprising the following steps: i / reciprocal authentication between the first equipment (SERV) and the second equipment (DISPO1), said authentication comprising: i-1 / by the first equipment (SERV): generation of a first random value and storage of said first random value;encryption of said first random value with the public key of the second device previously obtained; determination of a first signature by using the private key of the first device (SERV) of said first encrypted random value; transmission to the second device (DISPO1) of a message comprising said first encrypted random value and said first signature; i-2 / by the second device (DISPO1): in the non-secure mode:; - reception of the message and copy of said message into the common memory; then in secure mode: verification of the authenticity of the first equipment based on said first encrypted random value, the first signature and the public key of the first equipment previously obtained; then - if the authenticity has been verified, decryption, by the secure cryptographic module (SE) and by means of the private key of the second device stored in said module, of said first encrypted random value and storage of the first decrypted random value in the secure memory; - obtaining a second random value and storing said second random value in the secure memory; encrypting said second random value with the previously obtained public key of the first device; determining a second signature by the secure cryptographic module (SE), with the private key of the second device stored in said module, of said second encrypted random value; copying into the common memory of said second encrypted random value and said second signature; in the non-secure mode: preparing, for transmission to the first device (SERV), a message comprising said second encrypted random value and said second signature; - transmission to the first device (SERV), of the message; i-3 / by the first device (SERV): - reception of the message containing said second encrypted random value and said second signature; - verification of the authenticity of the second equipment as a function of said second encrypted random value, said second signature and the public key of the second equipment previously obtained; then if the authenticity has been verified, decryption of said second encrypted random value as a function of the private key of the first equipment; ii / determination by the first equipment of a symmetric encryption key, called initialization key as a function of the first random value stored in step i-1 and the second random value decrypted in step i-3, by implementing an initialization key calculation function having as variables said first and second random values; iii / determination by the second equipment in secure mode of said initialization key as a function of the first random value stored in step i-2 and the second random value stored in step i-2, by implementing said initialization key calculation function having as variables said first and second random values ​​and the result of which will be in a strictly deterministic manner the initialization key also calculated by the first equipment; and storage of said initialization key in the secure memory; iv / encryption of the secret element by the first equipment (SERV) with said initialization key determined in step ii; and transmission of said encrypted secret element to the second equipment (DISPO1); v / reception by the second equipment (DISPO1) of said encrypted secret element;decryption, in secure mode, of said secret element using the initialization key stored in step iii and storage of said secret element in the secure memory or in the secure cryptographic module (SE).; 2. Secure transmission method according to claim 1, according to which the first equipment (SERV) is a key server, the secret element comprises at least one session key and said method further comprising the following steps: - steps i / to v / are implemented by the key server with a plurality of second devices (DISPO1, DISPO2, ...) to transmit to said second devices said same session key; - a telecommunications session is then established between at least two of said second devices (DISPO1, DISPO2, etc.) based on said session key stored in each of said second devices following their transmission by the key server.

3. Secure transmission method according to claim 1 or 2, according to which the first equipment (SERV) is a key server, the secret element comprises at least one session key and said method further comprising the following steps: - steps i / to v / are implemented by the server with a plurality of software applications of the same second equipment to transmit to said applications said same session key; a telecommunications session is then established between at least two of said applications based on at least said copies of said session key stored following their transmission by the key server.

4. Secure transmission method according to any one of the preceding claims, according to which the secure cryptographic module (SE) of the second equipment (DISPO1) is a discrete module and / or the secure cryptographic module (SE) of the second equipment (DISPO1) is adapted to be able to exchange only within the second equipment and only in secure mode.

5. Secure transmission method according to any one of the preceding claims, comprising before step i-1, a step i-0 comprising: - the transmission by the second device (DISPO1) to the first device (SERV) of the certificate of the second device established by a certification authority and comprising at least the public key of the second device and a signature of said public key by the private key of the certification authority; - by the first device: verification of the validity of the certificate of the second device transmitted and storage of the public key of the second device; and according to which the message transmitted by the first device (SERV) further comprises the certificate of the first device comprising the public key of the first device; and in step i-2, after switching to secure mode: - before implementing the verification of the authenticity of the first equipment, the certificate of the first equipment received in the message is verified using the secure cryptographic module (SE), based on the public key of the certification authority previously stored in secure mode in the secure cryptographic module (SE).

6. Secure transmission method according to any one of the preceding claims, the first equipment comprising a secure cryptographic module (SE), adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the first equipment and to not be able to deliver at least some of said stored cryptographic information; first equipment comprising a processor, at least two memory areas comprising a secure memory (14) and a common memory (13) and software functions executing on the processor, said first equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory; and the steps described in relation to the first equipment, respectively to the second equipment, are furthermore implemented symmetrically, i.e. this time by the second equipment, respectively by the first equipment.

7. Telecommunication system (1) comprising a first telecommunication device (SERV) and at least one second telecommunication device (DISPO1), a respective private key - public key pair being associated with each of said first and second devices, the second device comprising a secure cryptographic module (SE), adapted to execute predefined cryptographic functions, to store cryptographic information including the private key of the second device and to not be able to deliver at least some of said stored cryptographic information;the second equipment comprising a processor, at least two memory areas comprising a secure memory (14) and a common memory (13) and software functions executing on the processor, said second equipment being adapted to operate alternately according to a first mode called non-secure mode and a second mode called secure mode, such that the software functions executing in the non-secure mode of the processor can only access the common memory, while conversely, the software functions executing in the secure mode of the processor can access the secure memory and the common memory;said first telecommunications equipment (SERV) and at least second telecommunications equipment (DISPO1) being adapted to implement between them an authentication operation during which the first equipment (SERV) is adapted to generate a first random value and to store said first random value, to encrypt said first; random value with the public key of the second device previously obtained, to determine a first signature, by using the private key of the first device (SERV), of said first encrypted random value, to transmit to the second device (DISPO1) a message comprising said first encrypted random value and said first signature; - the second equipment (DISPO1) is adapted, in the non-secure mode, to receive said message and copy said message into the common memory, - then the second equipment (DISPO1) is adapted, in secure mode, to verify the authenticity of the first equipment according to said first encrypted random value, the first signature and the public key of the first equipment previously obtained, then if the authenticity has been verified, so that the secure cryptographic module (SE) decrypts, by means of the private key of the second equipment stored in said module, said first encrypted random value, to store the first decrypted random value in the secure memory;the second equipment (DISPO1) being adapted to, in secure mode, obtain a second random value and store said second random value in the secure memory, to encrypt said second random value with the public key of the first equipment previously obtained, so that the secure cryptographic module (SE) determines a second signature, with the private key of the second equipment stored in said module, of said second encrypted random value, and to copy said second encrypted random value and said second signature into the common memory; the second equipment (DISPO1) is adapted to, in the non-secure mode, prepare, for transmission to the first equipment (SERV), a message comprising said second encrypted random value and said second signature, transmit said message to the first equipment (SERV);the first equipment (SERV) being adapted to receive said message containing said second encrypted random value and said second signature, to verify the authenticity of the second equipment as a function of said second encrypted random value, said second signature and the public key of the second equipment previously obtained, then if the authenticity has been verified, to decrypt said second encrypted random value as a function of the private key of the first equipment; the first equipment (SERV) being adapted to determine a symmetric encryption key, called initialization key as a function of said first stored random value and said second decrypted random value, by implementing a function of; initialization key calculation having as variables said first and second random values; the second equipment is adapted to, in secure mode, determine said initialization key as a function of said first stored random value and of the second stored random value, by implementing said initialization key calculation function having as variables said first and second random values ​​and the result of which will be in a strictly deterministic manner the initialization key also calculated by the first equipment, and storing said initialization key in the secure memory; the first equipment (SERV) being adapted to encrypt the secret element with said initialization key that it has determined, and to transmit said encrypted secret element to the second equipment (DISPO1);the second equipment (DISPO1) being adapted to receive said encrypted secret element, to decrypt, in secure mode, said secret element using the stored initialization key and to store said secret element in the secure memory or in the secure cryptographic module (SE).; 8. Telecommunication system (1) according to claim 7, wherein the first equipment (SERV) is a key server, the secret element comprises at least one session key and the authentication operation is implemented by the key server with a plurality of second equipments (DISPO1, DISPO2, ...) to transmit to said second equipments said same session key; at least two of said second equipments (DISPO1, DISPO2, ...) being adapted to establish between them a telecommunication session as a function of said session key stored in each of said second equipments following their transmission by the key server.

9. Telecommunication system (1) according to claim 7 or 8, in which the first equipment (SERV) is a key server, the secret element comprises at least one session key and the authentication operation is implemented by the server with a plurality of software applications of the same second equipment to transmit to said applications said same session key; at least two of said applications being adapted to establish between them a telecommunications session as a function of at least said copies of said session key stored following their transmission by the key server.

10. Telecommunications system (1) according to any one of claims 7 to 9, in which the secure cryptographic module (SE) of the second equipment (DISPO1) is a discrete module and / or the secure cryptographic module (SE) of the second equipment (DISPO1) is adapted to be able to exchange only within the second equipment and only in secure mode.

Images