Method for performing a secure function and associated system.

Abstract

A method for performing a secure function that maps an input message to an output message, the method being implemented by a system comprising a secure element and a white-box implementation, the method comprising: - the calculation (E100) by the white-box implementation of a processing data item from the input message, - the encryption (E200) by the white-box implementation of the processing data item, - the sending (E300) of the encrypted processing data item to the secure element, - the obtaining (E400) by the secure element of a result data item from the encrypted processing data item, the result data item being the image of the processing data item by an intermediate function, - the calculation (E500) of the output message from the result data item. Figure for the abstract: Fig. 2

Description

Title of the invention: Method for performing a secure function and associated system.

[0001] The present invention relates to a method for performing a secure function matching an input message to an output message, as well as an associated system.

[0002] A secure function, for example a cryptographic function, conventionally uses data intended to remain secret, for example an underlying cryptographic key.

[0003] When a secure function is implemented by means of software running in an insecure environment, special measures must be taken to prevent an attacker from gaining access to the secret data.

[0004] The search for techniques for securing the implementation of a function in an insecure environment is known as white box cryptography.

[0005] Software implementations that enable the secure implementation of a function in an insecure environment are known as white-box implementations.

[0006] The article "White Box Cryptography and an AES implementation", by S. Chow et al. in, Post-Proceedings of the 9th Annual Workshop on Selected Areas in Cryptography (SAC'02), August 15-16, 2002, for example, proposes a technique for producing AES-type algorithms each adapted to a particular cryptographic key.

[0007] For the solutions generally proposed in this context, the secure function is broken down into a series of elementary processes and look-up tables (in English: "Look-Up Tables") associated respectively with these elementary processes are used to manipulate hidden data.

[0008] However, a white box implementation may not guarantee a sufficient level of security.

[0009] Certain secure functions are intended to be executed in authorized environments. For example, a secure function allowing access to a vehicle is intended to be executed only under the environment of an authorized user.

[0010] To guess the secret data of the secure function, a so-called "cloning" attack ("code lifting" in English) consists of copying the white box implementation of the secure function to an unsecured environment under the complete control of an attacker.

[0011] In such an environment, the attacker can execute very many iterations of the secure function and / or use tools, typically a debugging tool, to execute the secure function in stages. In addition, with such an attack the attacker can impersonate the authorized user and substitute an environment under his control for the authorized environment, for example to access a vehicle of said user.

[0012] To counter this type of attack, a first solution described in patent application US2019312718 consists of a white box implementation which uses in decrypted form a coded encryption key received from a trusted execution environment.

[0013] This solution, however, has the disadvantage of being insufficiently secure or requiring a connection with a server to receive a key.

[0014] A second known solution consists of a white box implementation which sends data to a secure element. The secure element calculates a result of the application of a function on said data and the white box implementation then verifies that the result calculated by the secure element corresponds to the application of the function on said data (for example by calculating another result of the application of the function on said data or of the application of the inverse of said function on the result).

[0015] This second solution has the disadvantage of also being insufficiently secure and being costly in resources, typically in computing time and memory size, for the unsecured environment implementing the solution.

[0016] A third solution is to use a secure element to update the white box implementation and thus modify the behavior of said white box implementation.

[0017] Unfortunately, the implementation of this solution requires the replacement of a correspondence table of the white box implementation, which is costly in resources for the system implementing this solution, in particular for the secure element.

[0018] To overcome these drawbacks, the present invention proposes, according to a first aspect, a method for performing a secure function matching an input message with an output message, the method being implemented by a system comprising a secure element and a white-box implementation in an unsecured execution environment, the method being characterized in that it comprises the following steps: - calculation of processing data from the input message by the white-box implementation, - encryption of the processing data using an encryption key, by white-box implementation, - sending the encrypted processing data to the secure element, - obtaining by the secure element of a result data from the encrypted processing data and a decryption key associated with the encryption key, the result data being the image of the processing data by an intermediate function different from the identity function, - calculation of the output message from the result data.

[0019] Other advantageous and non-limiting characteristics of the method according to the invention, taken individually or in all technically possible combinations, are the following: - the output message includes the result data; - the method further comprising a step of calculating at least one other processing data by the white-box implementation, and the output message further comprises the other processing data; - - the white box implementation has a first part and a second part, the calculation of a processing data from the input message and the encryption of the processing data using an encryption key are implemented by the first part of the white box implementation, the calculation of the output message from the result data is implemented by the second part of the white box implementation, and the method further comprises a step of sending the result data to the second part of the white box implementation; - the method further comprises calculating at least one further processing data by the first part of the white-box implementation, and using the at least one further processing data by the second part of the white-box implementation for calculating the output message from the result data; - obtaining by the secure element of the result data, is by functional decryption of the encrypted processing data using a functional decryption key for the intermediate function, the decryption key being said functional decryption key for the intermediate function; - the encryption key is a public key of an RSA algorithm and the functional decryption key is obtained from a private key of said RSA algorithm, the private key being associated with the public key, the RSA algorithm having a determined encryption modulo and the intermediate function being a modular exponentiation raising the processing data to a determined exponent modulo the determined encryption modulo; - the encryption key comprises an encryption exponent and the functional decryption key comprises a modular inverse of the encryption exponent and the determined exponent, or the result of the product of the encryption exponent and the determined exponent; - the encryption key only intervenes in the data encryption stage processing by the white-box implementation, and the decryption key only intervenes in the step of obtaining a result data by the secure element; - the secure function consists of a sequence of operations and the intermediate function is a part of said sequence of operations; - the secure function is a cryptographic function matching the input message with the output message using a predetermined cryptographic key; - the predetermined cryptographic key is a key distinct from the encryption key and the decryption key.

[0020] At least a portion of the methods of the invention may be computer-implemented. Accordingly, the present invention may take the form of an embodiment combining software (including firmware, resident software, microcode, etc.) and hardware aspects, all of which may be collectively referred to herein as a "component."

[0021] According to a second aspect, the invention proposes a system for performing a secure function matching an input message with an output message, the system being characterized in that it comprises: - a first component comprising all or part of a white box implementation in an unsecured execution environment, said all or part of the white box implementation being configured to calculate processing data from the input message and encrypt the processing data using an encryption key, - a secure element configured to receive the encrypted processing data and obtain a result data from the encrypted processing data and a decryption key associated with the encryption key, the result data being the image of the processing data by an intermediate function different from the identity function, - a second component configured to receive the result data and calculate the output message from the result data.

[0022] Other advantageous and non-limiting characteristics of the system according to the invention, taken individually or in all technically possible combinations, are the following: - the output message includes the result data; - the white box implementation has a first part and a second part, said all or part of the white box implementation of the first component is the first part of the white box implementation, the second component comprises the second part of the white box implementation in the unsecured execution environment, the second part of the white box implementation being configured to receive the result data and calculate the message of output from the result data.

[0023] This system can be configured to implement each of the embodiment possibilities envisaged for the method as defined previously.

[0024] Of course, the various features, variants and embodiments of the invention may be combined with each other in various combinations to the extent that they are not incompatible or mutually exclusive.

[0025] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended figures which illustrate exemplary embodiments thereof which are not limiting in nature.

[0026] In the figures:

[0027] [Fig.l] schematically represents a preferred embodiment of a system according to the invention, in particular for the implementation of a method according to the invention;

[0028] [Fig.2] illustrates in the form of a flowchart the main steps of a method for carrying out a secure function according to the invention;

[0029] [Fig.3] illustrates an example of a secure function performed by a method or system according to the invention.

[0030] Unless otherwise indicated, elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity.

[0031] In the context of the present description, the qualifiers “first”, “second”, “third” and “fourth” are only indicative to distinguish elements that they qualify, but do not imply an order between them.

[0032] [Fig.l] schematically represents a preferred embodiment of a system 1 according to the invention.

[0033] The system 1 comprises an unsecured execution environment 2 and a secure element 3.

[0034] The system 1 is adapted to perform a secure function matching an input message with an output message.

[0035] The unsecured execution environment 2 comprises a processor-type data processing means 20, a data storage means 21, a random access memory 22, a first communication interface 23 and a second communication interface 24.

[0036] The data storage means 21 and the RAM 22 of the unsecured execution environment 2 are each linked to the data processing means 20 of said unsecured execution environment 2, so that the data processing means 20 can read or write data in the data storage means 21 and / or the RAM 22.

[0037] The data storage means 21 stores computer program instructions, some of which are designed to implement steps of a method for performing a secure function as described with reference to [Fig.2] when these instructions are executed by the data processing means 20.

[0038] The data storage means 21 is for example in practice a hard disk or a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used English term).

[0039] Furthermore, the data storage means 21 and the RAM 22 can store at least some of the elements (in particular the encrypted processing data and the result data as described below with reference to [Fig.2]) manipulated during the various processing operations carried out during the method described below.

[0040] In the remainder of the description, the term memory refers to any one of the data storage means 21 and the random access memory 22.

[0041] The unsecured execution environment 2 also includes several components not shown.

[0042] Typically, the unsecured execution environment 2 comprises a first component and a second component.

[0043] These components can in practice be realized by a combination of hardware elements and software elements.

[0044] Each component is configured to carry out a step of a method according to the invention, and therefore has a functionality described in the method according to the invention and set out below.

[0045] The first component comprises all or part of a white box implementation.

[0046] System 1 therefore comprises a white-box implementation in the unsecured execution environment 2. System 1, typically the unsecured execution environment 2, stores the white-box implementation.

[0047] According to a first exemplary embodiment of the components, the white box implementation has a first part and a second part, said all or part of the white box implementation of the first component is the first part of the white box implementation, and the second component comprises the second part of the white box implementation.

[0048] According to a second example of embodiment of the components, the first component comprises all or part of the white box implementation, and the second component does not comprise all or part of the white box implementation.

[0049] For each component, the unsecured execution environment 2 stores by example software instructions (also called computer program instructions) executable by the processing means of 20 in order to use a hardware element (for example a memory) and thus implement the functionality offered by the component.

[0050] According to one possible embodiment, the computer program instructions stored in the data storage means 21 were received (for example from a remote computer via the second communication interface 24) during an operating phase of the non-secure execution environment 2, prior to the method described with reference to [Fig.2].

[0051] The data processing means 20 is therefore configured to implement certain steps of the method for performing a secure function, which will be described later.

[0052] The data processing means 20 may have any structure. The data processing means 20 comprises one or more cores, each core being configured to execute code instructions of a program so as to implement the aforementioned steps.

[0053] The first communication interface 23 is connected to the data processing means 20 so as to allow the non-secure execution environment 2 to communicate with the secure element 3 via another communication interface 33 of the secure element 3.

[0054] The first communication interface is of any type. It is for example a wired interface using any communication protocol, for example of the OPC type (for “Open Platform Communications” in English terminology), or according to the ISO / IEC 7816 standard in one of its already published versions.

[0055] The first communication interface 23 allows the non-secure execution environment 2 to send data to the secure element 3, for example encrypted processing data as described with reference to [Fig. 2], and / or to receive data from the secure element 3, for example result data as described with reference to [Fig. 2].

[0056] The second communication interface 24 is connected to the data processing means 20 so as to enable the data processing means 20 to receive an input message from an electronic device not shown and / or to send an output message to said electronic device not shown.

[0057] The second communication interface 24 is of any type. It is for example wired (Ethernet) or of the wireless radio type using any communication protocol (Wi-Fi, Bluetooth, NFC, etc.).

[0058] The secure element 3 comprises another data processing means 30 of the type processor, another data storage means 31, another RAM 32 and the other communication interface 33.

[0059] The other data storage means 31 and the other RAM 32 of the secure element 3 are each linked to the other data processing means 30 of said secure element 3, so that the other data processing means 30 can read or write data in the other data storage means 31 and / or the other RAM 32.

[0060] The other data storage means 31 stores computer program instructions, some of which are designed to implement steps of a method for performing a secure function as described with reference to [Fig.2] when these instructions are executed by the other data processing means 30.

[0061] The other data storage means 31 is for example in practice a non-volatile memory, possibly rewritable, for example of the EEPROM type (for "Electrically Erasable and Programmable Read-Only Memory" according to the commonly used English term).

[0062] Furthermore, the other data storage means 31 and the other RAM 32 can store at least some of the elements (in particular the encrypted processing data and the result data as described below with reference to [Fig.2]) manipulated during the various processing operations carried out during the method described below.

[0063] In the remainder of the description, any one of the other data storage means 31 and the other RAM 32 is called other memory.

[0064] The secure element 3 stores, for example, software instructions executable by the other processing means 30 in order to use a hardware element (for example another memory) and thus implement one or more steps of the methods according to the invention, and therefore one or more functionalities described in the method according to the invention and set out below.

[0065] According to one possible embodiment, the computer program instructions stored in the other data storage means 31 have been received (for example from another remote computer, or from the non-secure execution environment 2, via the other communication interface 33) during an operating phase of the secure element 3 prior to the method described with reference to [Fig.2].

[0066] The other data processing means 30 is therefore configured to implement certain steps of the method for performing a secure function, which will be described later.

[0067] The other data processing means 30 may have any structure. The other data processing means 30 comprises one or more cores, each core being configured to execute code instructions of a program of way to implement the above steps.

[0068] The other communication interface 33 is connected to the other data processing means 30 so as to allow the secure element 3 to communicate with the non-secure execution environment 2 via the first communication interface 23 of the non-secure execution environment 2.

[0069] The other communication interface 33 is of the same type as the first communication interface 23. It is for example a wired interface using a communication protocol, for example of the OPC type (for “Open Platform Communications” in English terminology), or according to the ISO / IEC 7816 standard in one of its versions already published.

[0070] The other communication interface 33 allows the secure element 3 to send data to the non-secure execution environment 2, for example a result data item as described with reference to [Fig.2], and / or to receive data from the non-secure execution environment 2, for example an encrypted processing data item as described with reference to [Fig.2].

[0071] According to a first example, the unsecured environment 2 is a communication terminal, a personal computer, a tablet or a server, and the secure element 3 is a chip integrated into a smart card, such as an identity card, a bank card or a universal integrated circuit card (also known as a UICC card for “Universal Integrated Circuit Card” in English terminology) such as a subscriber card for a cellular network, typically a SIM card.

[0072] According to a second example, the system 1 is a communication terminal, a personal computer, a tablet or a server, and the secure element 3 is a secure microcontroller or a trusted execution environment (“Trusted Execution Environment” in English terminology, also referred to by the acronym TEE) which is integrated into said communication terminal, personal computer, tablet or server.

[0073] [Fig.2] illustrates in the form of a flowchart the main steps of a method for carrying out a secure function according to the invention.

[0074] This method is implemented by system 1.

[0075] The secure function matches an input message with an output message.

[0076] The secure function may be a cryptographic function matching the input message to the output message using a predetermined cryptographic key.

[0077] The cryptographic function comprises for example an encryption function, a decryption function, a signature function or a signature verification function with the predetermined cryptographic key. The predetermined cryptographic key completed is then preferably a key distinct from the encryption key and the decryption key described below.

[0078] According to a step of calculating a processing data item (step E100), a processing data item is calculated from the input message by the white-box implementation.

[0079] According to one possibility, the processing data may be the input message or a first part of the input message.

[0080] Alternatively, the processing data may be the result of applying a first other function to the input message or to a first part of the input message.

[0081] The method may then comprise a step of calculating at least one other processing data item (step E1 10) during which at least one other processing data item is calculated by the white-box implementation.

[0082] According to a first possibility, the other processing data may be the input message or a second part of the input message.

[0083] According to a second possibility, the other processing data may be the result of the application of a second other function to the input message, to a second part of the input message, to the processing data or to a first part of the processing data.

[0084] This step of calculating at least one other processing data is optional and can be omitted.

[0085] The method then comprises an encryption step (step E200) during which the white-box implementation encrypts the processing data using an encryption key.

[0086] Typically, the encryption is according to an asymmetric cryptographic algorithm, for example RSA or elliptic curve based, or a symmetric cryptographic algorithm, for example DES, 3DES or AES.

[0087] When the encryption is according to an asymmetric cryptographic algorithm, the encryption key is a public key within the meaning of said asymmetric cryptographic algorithm.

[0088] The method then comprises a step (step E300) of sending the encrypted processing data to the secure element 3 of the system 1, the encrypted processing data being the result of the encryption implemented by the white-box implementation during the encryption step (step E200).

[0089] Typically, the unsecured execution environment 2 of the system 1 sends the encrypted processing data to the secure element 3 via the first communication interface 23, and the secure element 3 receives the encrypted processing data via the other communication interface 33.

[0090] The method then comprises an obtaining step (step E400) during which the secure element 3 obtains a result data item from the encrypted processing data item and a decryption key associated with the encryption key, the result data item being the image of the processing data item, i.e. of the unencrypted processing data item, by an intermediate function different from the identity function.

[0091] Typically, when the encryption of the encryption step (step E200) is according to a symmetric cryptographic algorithm, for example DES, 3DES or AES, the secure element 3 obtains the result data from the encrypted processing data and a decryption key associated with the encryption key, by decrypting the encrypted processing data according to said symmetric cryptographic algorithm with said decryption key then by applying the intermediate function to the result of the decryption.

[0092] When the encryption of the encryption step (step E200) is according to an asymmetric cryptographic algorithm, for example RSA or based on elliptic curves, the secure element 3 can obtain the result data from the encrypted processing data and a decryption key associated with the encryption key, by decrypting the encrypted processing data according to said asymmetric cryptographic algorithm with said decryption key and then by applying the intermediate function to the result of the decryption. The decryption key is then a private key within the meaning of said asymmetric cryptographic algorithm.

[0093] Preferably, the asymmetric cryptographic algorithm is a functional encryption algorithm.

[0094] In this case, obtaining the result data by the secure element 3 is by functional decryption of the encrypted processing data using a functional decryption key for the intermediate function, the decryption key being said functional decryption key for the intermediate function.

[0095] The process is thus more secure. The intermediate function is hidden in the functional decryption key, which reinforces its confidentiality.

[0096] The method also makes it possible to limit the calculation times and the memory space consumed for the secure element, the implementation of the decryption applying the intermediate function to the processing data.

[0097] Examples of functional encryption algorithms are described in the document “Simple Functional Encryption Schemes for Inner Products”, Michel Abdalla, Florian Bourse, Angelo De Caro, and David Pointcheval, DOI: 10.1007 / 978-3-662-46447-2-33.

[0098] The algorithm in section 3 of this document, called “Inner-Product from DDH”, thus allows the obtaining of intermediate data having a generator value 8 raised to a power equal to the product of the processing data (x in the cited document) by another predetermined data ()' in the cited document), the generator 8 belonging to a group of order P with P a prime number. The result data can be the intermediate data, the intermediate function then being the raising of the generator 8 to a power equal to the product of the processing data (r in the cited document) by another predetermined data (3' in the cited document). According to another possibility, the result data can be obtained by the secure element 3 from the intermediate data, for example by discrete logarithm of the intermediate data, the result data then having as its value the result of the product of the processing data by the other predetermined data and the intermediate function being the product of the processing data by the other predetermined data.Note that the decryption key and encryption key are sky and mpk respectively in section 3 of the cited document.

[0099] Preferably, the functional encryption algorithm is an RSA algorithm having a determined encryption modulo N and the intermediate function is a modular exponentiation raising the processing data to a determined exponent modulo the determined encryption modulo.

[0100] Thus, the encryption key is a public key of an RSA algorithm and the functional decryption key is obtained from a private key of said RSA algorithm, the private key being associated with the public key, the RSA algorithm having a determined encryption modulo and the intermediate function being a modular exponentiation raising the processing data to a determined exponent modulo the determined encryption modulo.

[0101] The method thus allows a simple and inexpensive implementation in terms of resources of the intermediate function by functional decryption.

[0102] Typically, the encryption key comprises an encryption exponent and the functional decryption key comprises a modular inverse d of the encryption exponent e and the determined exponent a, or the result of the product of the encryption exponent and the determined exponent, i.e., "x d.

[0103] Thus, during the encryption step (step E200), the white-box implementation can encrypt the processing data as follows: w = xe mod N, with x the processing data and u the encrypted processing data.

[0104] During the obtaining step (step E400) the secure element 3 can obtain the result data as follows: z = mod N, with the result data.

[0105] The result data therefore has the value x“ mod N . In other words, the intermediate function is a modular exponentiation raising the processing data x to the determined exponent a modulo the determined encryption module N.

[0106] The determined exponent a is an integer, for example 2.

[0107] Preferably, the intermediate function does not implement all or part of the cryptographic key.

[0108] This gives us more freedom to choose the secure function and the cryptographic key, deploy the cryptographic key, and manage the associated accesses.

[0109] The method then comprises a step of calculating the output message (step E500), during which the system 1 calculates the output message from the result data.

[0110] According to a particular embodiment of the method, typically when the first component and the second component of the system 1 are produced according to the first example of embodiment of the components described with reference to [Fig.l], the white box implementation has a first part and a second part, the calculation (step E100) of a processing data item from the input message and the encryption (step E200) of the processing data item using an encryption key, are implemented by the first part of the white box implementation, and the calculation (step E500) of the output message from the result data item is implemented by the second part of the white box implementation.

[0111] The method then comprises, typically between the obtaining step (step E400) and the step of calculating the output message (step E500), a step (not shown) of sending the result data to the second part of the white box implementation.

[0112] Typically, the secure element 3 of the system 1 sends the result data to the second part of the white-box implementation, by sending the result data to the unsecured execution environment 2 of the system 1 via the other communication interface 33, the unsecured execution environment, and the second part of the white-box implementation, receiving the result data via the first communication interface 23.

[0113] According to another particular embodiment of the method, typically when the first component and the second component of the system 1 are produced according to the second example of production of the components described with reference to [Fig.l], the calculation (step E500) of the output message from the result data is not implemented by all or part of the white box implementation.

[0114] The method can then comprise, typically between the obtaining step (step E400) and the step of calculating the output message (step E500), a step (not shown) of sending the result data to the non-secure environment 2.

[0115] Typically, the secure element 3 of the system 1 can send the result data to the non-secure environment 2 of the system 1 via the other communication interface 33, the non-secure execution environment 2 receiving the result data via the first communication interface 23.

[0116] Preferably, when the method is according to the other particular embodiment, the output message comprises the result data. The output message may be the result data.

[0117] The method, in particular according to the particular embodiment or the other particular embodiment described above, makes it possible to limit the calculation times and the memory space consumed, in particular by the white box implementation.

[0118] The output message is calculated from the result data.

[0119] The obtaining step (step E400) implemented by the secure element 3 contributes to the calculations of the secure function by obtaining the result data from the processing data.

[0120] System 1, in particular the second part of the white-box implementation, does not need to verify that the result data corresponds to the result of the application of the intermediate function to the processing data. If the result data does not correspond to the result of the application of the intermediate function to the processing data, the output message obtained will be erroneous. Indeed, the output message will not be the image of the input message by the secure function.

[0121] The calculation of the step of calculating a processing data item (step E100), the intermediate function and the calculation of the step of calculating the output message (E500) are therefore chosen so as to implement the secure function.

[0122] The method is also particularly secure.

[0123] An attacker observing the data exchanges between the white box implementation (and / or the unsecured environment 2) and the secure element 3 does not access the processing data and cannot deduce the intermediate function, because the processing data is encrypted.

[0124] Within system 1, the encryption key is preferably only integrated into the white-box implementation and is not stored as such in the memory of system 1.

[0125] When the method is according to the particular embodiment described above, the encryption key is preferably only integrated in the first part of the white box implementation and is not stored as such in the memory of the system 1.

[0126] Within system 1, the decryption key is preferably stored only in secure element 3 and is not integrated into the white box implementation.

[0127] Also preferably, the encryption key only intervenes in the step of encrypting the processing data (step E200) by the white box implementation, and the decryption key only intervenes in the step of obtaining (step E400) a result data by the secure element.

[0128] The process is thus more secure.

[0129] As already mentioned, system 1, in particular the second part of the white-box implementation, does not need to verify that the result data corresponds to the result of the application of the intermediate function to the processing data. If the result data does not correspond to the result of the application of the intermediate function to the processing data, the output message obtained will be erroneous. Indeed, the output message will not be the image of the input message by the secure function.

[0130] Preferably, the calculation of the output message from the result data during the step of calculating the output message (step E500), differs from an application to the result data, of an inverse function of the intermediate function.

[0131] Furthermore, when the method is according to the particular embodiment described above, the calculation (step E500) of the output message from the result data differs from the identity function.

[0132] The process is thus more secure.

[0133] When the method is according to the particular embodiment and the method comprises the step of calculating at least one other processing data item (step E1 10), said step of calculating at least one other processing data item (step E1 10) is implemented by the first part of the white box implementation, and the second part of the white box implementation advantageously uses the at least one other processing data item for calculating the output message from the result data item (step E500).

[0134] Also advantageously, when the method is according to the other particular embodiment described above and the method comprises the step of calculating at least one other processing data item (step E1 10), the output message further comprises the other processing data item.

[0135] The process is thus more secure.

[0136] The step of calculating at least one other processing data (step E1 10) contributes to the calculations of the secure function by obtaining the other processing data. The calculation of the at least one other processing data, where appropriate the second other function, is chosen so as to implement the secure function.

[0137] It will be noted that in the method for performing a secure function according to the invention, and / or in the system 1 according to the invention, the secure function may consist of a series of operations, the intermediate function being a part of said series of operations.

[0138] Typically, the secure function consists of a sequence of operations implemented on input data.

[0139] An operation may be an arithmetic operation or a Boolean arithmetic operation, for example an addition, a subtraction, a multiplication, a division, exponentiation, logarithm.

[0140] An operation can also be a logical operation, for example disjunction, conjunction or negation.

[0141] An input data item may comprise all or part of the input message, and / or all or part of at least one intermediate data item.

[0142] An intermediate data item is the result of applying an operation of said sequence of operations to at least one input data item.

[0143] The calculation (step E100) of the processing data from the input message, by the white box implementation, then consists of the application of a first part of the sequence of operations which make up the secure function.

[0144] The processing data is thus intermediate data.

[0145] The first part of the sequence of operations which make up the secure function, comprises at least one operation of said sequence of operations which make up the secure function.

[0146] Typically, applying a first other function to the input message or to a first part of the input message consists of the first part of the sequence of operations that compose the secure function.

[0147] The obtaining step (step E400) implemented by the secure element then carries out a second part of the series of operations which make up the secure function, said second part of the series of operations which make up the secure function constituting the intermediate function applied to the processing data.

[0148] The second part of the sequence of operations which make up the secure function, comprises at least one operation of said sequence of operations which make up the secure function.

[0149] The second part of the sequence of operations which make up the secure function is typically disjoint from the first part of the sequence of operations described above.

[0150] The processing data is an input data for the intermediate function.

[0151] The result data is the result of the implementation of said second part of the sequence of operations that make up the secure function. The result data is therefore intermediate data.

[0152] When the method is according to the particular embodiment described above, the result data is then used for an input data of at least one operation of a third part of the sequence of operations which make up the secure function.

[0153] Said at least one operation of a third part of the sequence of operations is implemented in the calculation (step E500) of the output message from the result data, by the second part of the white-box implementation.

[0154] The third part of the sequence of operations which make up the secure function is typically disjoint from the first part of said sequence of operations and from the second part of the said series of operations, described above.

[0155] When the method is according to the other particular embodiment described above, the result data can be used for an input data of at least one operation of a third part of the sequence of operations which make up the secure function. Said at least one operation of a third part of the sequence of operations is implemented in the calculation (step E500) of the output message from the result data, typically by the second module of the system 1.

[0156] It will be noted that the step of calculating (El 10) at least one other processing data by the white box implementation may consist of the implementation of a fourth part of the sequence of operations which make up the secure function.

[0157] Typically, the application of a second other function to the input message, to a second part of the input message, to the processing data or to a first part of the processing data consists of said fourth part of the sequence of operations which compose the secure function.

[0158] The fourth part of the sequence of operations which make up the secure function, comprises at least one operation of said sequence of operations which make up the secure function.

[0159] The fourth part of the sequence of operations which make up the secure function is typically disjoint from the first part of said sequence of operations, from the second part of said sequence of operations, and from the third part described above.

[0160] [Fig.3] illustrates an example of a secure function performed by a method or system according to the invention.

[0161] The secure function illustrated in this figure maps an input message I to an output message O, and allows the execution of a symmetric encryption algorithm Ek with a predetermined cryptographic key K, said execution being secured against faults by using an infectious countermeasure.

[0162] The secure function comprises obtaining a first provisional result by a first execution of the encryption Ek applied to the input message I, and obtaining a second provisional result by a first execution of a diffusion function DR applied to the first provisional result.

[0163] The secure function also comprises obtaining a third provisional result by a second execution of the encryption Ek applied to the input message I, and obtaining a fourth provisional result by a second execution of the diffusion function DR applied to the third provisional result.

[0164] The secure function then obtains the output message O by a combination of the “exclusive or” type between the second provisional result, the fourth provisional result and another provisional result among the first provisional result and the third provisional result.

[0165] The DR diffusion function is typically a hash function parameterized with a value R.

[0166] The secure function illustrated in [Fig.3] is described in the document “A high-Order infectious Countermeasure Framework”, Guillaume Barbu; Luk Bettale; Laurent Castelnovi; Thomas Chabrier; Nicolas Débandé; Christophe Giraud; Nathan Reboud, DOI: 10.1109 / FDTC53659.2021.00012.

[0167] An example of a method according to the invention, for performing this secure function, consists in that the two executions of the encryption Ek and one of the executions of the diffusion function DR are implemented by the white-box implementation, typically during the step of calculating a processing data item (step E100) and the step of calculating at least one other processing data item (step E110).

[0168] The other processing data includes the first provisional result or the third provisional result.

[0169] If the white-box implementation implements the first execution of the broadcast function DR, the processing data includes the third provisional result and the value R, the other processing data further includes the second provisional result, the intermediate function is the broadcast function, and the result data is the fourth provisional result.

[0170] If the white-box implementation implements the second execution of the broadcast function DR, the processing data includes the first provisional result and the value R, the other processing data further includes the fourth provisional result, the intermediate function is the broadcast function, and the result data is the second provisional result.

[0171] The calculation (step E500) of the output message from the result data is then implemented by the second part of the white box implementation, and obtains the output message by the “exclusive or” type combination of the second provisional result, the fourth provisional result and another provisional result among the first provisional result and the third provisional result, the other provisional result being the first provisional result, or the third provisional result, included in the other processing data.

[0172] According to a variant of this example, the other processing data has the value of the combination by “exclusive or” of a provisional result among the first provisional result or the third provisional result, with the second provisional result if the white box implementation implements the first execution of the broadcast function DR, or with the fourth provisional result if the white box implementation implements the second execution of the broadcast function DR, and the calculation (step E500) of the output message from the result data obtains the output message by the combination of type “exclusive or” between the result data and the other processing data.

[0173] A person skilled in the art will understand that the embodiments, variations, and various features described above may be combined with each other in various combinations to the extent that they are not incompatible or mutually exclusive.

Claims

Claims

1. Method for performing a secure function matching an input message with an output message, the method being implemented by a system (1) comprising a secure element (3) and a white-box implementation in an unsecured execution environment (2), the method being characterized in that it comprises the following steps: - calculating (E100) a processing datum from the input message by the white-box implementation, - encrypting (E200) the processing datum using an encryption key, by the white-box implementation, - sending (E300) the encrypted processing datum to the secure element, - obtaining (E400) by the secure element a result datum from the encrypted processing datum and a decryption key associated with the encryption key, the result datum being the image of the processing datum by an intermediate function different from the identity function,- calculation (E500) of the output message from the result data.,

2. Method for performing a secure function according to the preceding claim in which the output message comprises the result data.

3. Method for performing a secure function according to any one of the preceding claims, - the method further comprising a step of calculating (El 10) at least one other processing data by the white-box implementation, - and the output message further comprising the other processing data.

4. A method for performing a secure function according to claim 1 wherein: - the white box implementation has a first part and a second part; - the calculation (E100) of a processing data item from the input message and the encryption (E200) of the processing data item using an encryption key are implemented by the first part of the white box implementation; - the calculation (E500) of the output message from the result data item is implemented by the second part of the white box implementation white; the method further comprising a step of sending the result data to the second part of the white box implementation.

5. Method for performing a secure function according to the preceding claim, the method further comprising: - the calculation (El 10) of at least one other processing data by the first part of the white-box implementation, and - the use of the at least one other processing data by the second part of the white-box implementation for the calculation of the output message from the result data.

6. Method for performing a secure function according to any one of the preceding claims wherein: obtaining (E400) by the secure element (3) of the result data, is by functional decryption of the encrypted processing data using a functional decryption key for the intermediate function, the decryption key being said functional decryption key for the intermediate function.

7. Method for performing a secure function according to the preceding claim in which the encryption key is a public key of an RSA algorithm and the functional decryption key is obtained from a private key of said RSA algorithm, the private key being associated with the public key, the RSA algorithm having a determined encryption modulo and the intermediate function being a modular exponentiation raising the processing data to a determined exponent modulo the determined encryption modulo.

8. A method for performing a secure function according to the preceding claim wherein the encryption key comprises an encryption exponent and the functional decryption key comprises a modular inverse of the encryption exponent and the determined exponent, or the result of the product of the encryption exponent and the determined exponent.

9. Method for performing a secure function according to any one of the preceding claims in which: - the encryption key only intervenes in the step (E200) of encryption of the processing data by the white box implementation, and - the decryption key only intervenes in the step of obtaining (E400) a result data by the secure element.

10. A method for performing a secure function according to any preceding claim wherein the secure function consists of a sequence of operations and the intermediate function is part of said sequence of operations.

11. A method for performing a secure function according to any preceding claim wherein the secure function is a cryptographic function matching the input message to the output message using a predetermined cryptographic key.

12. A method for performing a secure function according to the preceding claim wherein the predetermined cryptographic key is a key distinct from the encryption key and the decryption key.

13. System (1) for performing a secure function matching an input message with an output message, the system being characterized in that it comprises: - a first component comprising all or part of a white box implementation in an unsecured execution environment (2), said all or part of the white box implementation being configured to calculate processing data from the input message and encrypt the processing data using an encryption key, - a secure element (3) configured to receive the encrypted processing data and obtain result data from the encrypted processing data and a decryption key associated with the encryption key, the result data being the image of the processing data by an intermediate function different from the identity function,- a second component configured to receive the result data and calculate the output message from the result data.,

14. System (1) for performing a secure function according to the preceding claim, wherein the output message comprises the result data.

15. A system (1) for performing a secure function according to claim 13, wherein: - the white box implementation has a first part and a second part; - said all or part of the white box implementation of the first component is the first part of the white box implementation; - the second component comprises the second part of the white-box implementation in the untrusted execution environment (2), the second part of the white-box implementation being configured to receive the result data and calculate the output message from the result data.