How to securely process digital information in a secure element

Abstract

A method for securely processing digital information is implemented by a secure element (100) having a secure processor (102), - a step (S10) of loading digital information (Si'') from an external memory (200) into a secure element (100), - segmenting the digital information (Si) into words of digital information (Wij,k) and extracting an error detection code (EDCj,k) or an error correction code (ECC j,k ) and associating an error detection code with the corresponding word (S13); - words (Wij,k) of digital information and associated error detection codes (EDCj,k) or error correction codes (ECC j,k ) to the secure processor (102); In the secure processor (102), before processing the digital information contained in the word (Wij,k), an associated error detection code (EDCj,k) or error correction code (ECC j,k ) based on the Word of Digital Information (Wi j,k ) and a step (S16) of checking whether the

Description

[Technical field]

[0001] The present disclosure relates to the field of computer security, and more precisely to the secure processing of digital information such as code and / or data with secure elements, for example smart cards. [Background technology]

[0002] In general, a secure element such as a smart card includes hardware resources such as a secure processing unit (SCPU), a volatile memory, and a non-volatile memory. The non-volatile memory stores one or more codes (applications) and data, and when the code and / or data needs to be executed or processed, they can be loaded into the volatile memory. The secure element can be embedded in a System on the Chip (SoC) that has several processing units, several memories, and several functions. The SoC can be integrated into a larger module.

[0003] In a constrained environment such as an IoT system (i.e., Internet of Things system), the secure element may only have a small non-volatile memory, such as a one time programmable (OTP) memory, used to store a limited amount of information, e.g., counters and / or keys. The secure element is not used to store code and data. To keep the cost of the secure element low, the code and data are stored in an external non-volatile memory, which is outside the secure element, e.g., in the SoC or in a module outside the SoC. When the code and / or data needs to be executed or processed, it is loaded into the volatile memory of the secure element.

[0004] In such a constrained context, it is important to make the digital information (code and / or data) secure when stored in the external memory, when it is loaded from the external memory into the internal memory of the secure element and when it is processed or executed by the secure element. In particular, the digital information must be protected against physical attacks.

[0005] Such physical attacks involve discrete elements such as smart cards and SoCs. They can be performed remotely. There are two main types of physical attacks known today:

[0006] A first type of physical attack is named "side channel attack". A side channel attack is any attack based on information obtained from the implementation of a computer system, for example a secure element. Timing information, power consumption, electromagnetic leakage, sound can provide additional sources of information that can be exploited. During the operation of the secure element, for example during the execution of an encryption algorithm by the CPU or the transfer of data from one memory to another, an attacker can listen to the electromagnetic emanations or power consumption to capture the physical behavior of the secure element. Such listening makes it possible to obtain secret information, such as a key. For example, if a processing unit executes an encryption algorithm using secret information, it has a certain power consumption that can be captured by an oscilloscope to obtain the secret information.

[0007] The second type of physical attack is called a "fault attack". Fault attacks are a family of techniques that involve intentionally generating errors in an encryption system or any sensitive system. These attacks can be related to hardware, such as a cryptographic processor, or software components. They are intended to cause abnormal behavior of encryption or sensitive operations in order to extract secret information, such as encryption keys. Faults can be injected during operations performed by the secure element, for example, by modifying the power supply, changing the clock, or injecting a laser pulse. The injected fault can result in changing the behavior of some electronic hardware of the secure element. For example, during an encryption operation, an attacker can inject a fault that cuts off the encryption. This means that the output is in plaintext and not encrypted. It is a simple attack. A fault can also be injected during PIN verification, allowing the PIN to be considered valid even if it is a wrong value. In another example, during a command to output data, a fault can change the output buffer pointer, making it possible to dump an internal value that should be kept secret.

[0008] Fault attacks and physical attacks can also be combined. Summary of the Invention [Problem to be solved by the invention]

[0009] The situation needs to be improved, more precisely, digital information needs to be made secure at any point in time: when it is stored in an external non-volatile memory, when it is loaded from the external memory into the secure element, and when it is processed by the secure element.

[0010] The present disclosure relates to a method for securely processing digital information, the method being implemented by a secure element including a secure processor and at least one internal memory and a code association unit, both external to the secure processor, - loading digital information from an external memory into at least one internal memory of the secure element; - segmenting, in a code association unit, the digital information into words of digital information, generating codes, either error detection codes or error correction codes, from the words of digital information, and associating the codes with corresponding words in at least one internal memory; - transferring words of digital information and associated codes from at least one internal memory to a secure processor; - in a secure processor, validating a word of digital information based on an associated error detection or correction code before processing the digital information contained in the word.

[0011] The addition of an error-detection code (EDC) or an error-correction code (ECC) to small words of digital information makes it possible to ensure that the digital information has not been modified by an attack in the secure element before transferring the word to the secure processor. Indeed, the EDC or ECC associated with a given word makes it possible to detect one or more errors in this word.

[0012] If an error correcting code is generated, the ECC associated with a given word can be used not only to detect errors in the word, but also to correct one or more bits of the word.

[0013] Advantageously, the method further comprises a step of verifying the integrity of the digital information, performed after the step of associating an error detection or error correction code with a corresponding word and before transferring the word of digital information and the associated error detection or error correction code to the secure processor.

[0014] The integrity check can be performed after segmenting the digital information into words and using the words of the digital information themselves, ensuring that the words transferred to the secure processor with associated error detection or correction codes are not corrupted.

[0015] Advantageously, the method further comprises the step of decrypting the digital information loaded from the external memory to obtain plaintext digital information, the step of segmenting into words being performed on the plaintext digital information.

[0016] Encryption makes it possible to protect digital information when it is stored in the external memory and when it is transferred from the external memory to the secure element.

[0017] Advantageously, the method further comprises the step of verifying the integrity of the digital information in encrypted form, thereby ensuring that an attacker does not alter the encryption.

[0018] Thus, in some embodiments, the protection of the digital information is based on the well-known "Encrypt-then-MAC" (EtM) approach and can be of type "MAC-then-Encrypt-then-MAC". The EtM approach is considered the most robust approach to authenticated encryption, but only protects data up to a certain level. In this disclosure, plaintext digital information can also be authenticated. In that case, the digital information is encrypted using a key K. 0 Calculate a first MAC of the plaintext value with key K 1 encrypting the authenticated digital information with a first MAC, and then performing a MAC on the authenticated and encrypted digital information. 2 The digital information is protected by computing a second MAC with the first MAC of the encrypted form. In this way, the digital information is authenticated by the first MAC in plaintext form and the second MAC in encrypted form, ensuring that the digital information has not been altered or corrupted during storage and transfer from the external memory to the secure element.

[0019] Advantageously, the word of digital information is stored in the internal memory of the secure element in association with the error detection or error correction code, and in a step of verifying the integrity of the digital information performed after the step of associating the word of digital information with the error detection or error correction code, the word of digital information is read from the internal memory to perform the integrity verification.

[0020] This makes it possible to verify the integrity of a word of digital information stored in the internal memory of the secure element that is to be transferred to the secure processor. This ensures that the word ready to be transferred to the secure processor has not been altered. It provides end-to-end security from storage in external memory to processing by the secure processor in the secure element.

[0021] Advantageously, the word of digital information and the associated error detection or correction code are transferred to the secure processor only if the integrity of the digital information has been successfully verified after the step of associating the error detection or correction code with the corresponding word.

[0022] The digital information may be segmented into words of a given size that depends on the working format of the secure processor or the capacity of the registers of the secure processor.

[0023] The size of the word to which the error detection code or the error correction code is added is adapted to the architecture of the secure processor. Typically, it corresponds to the format used by the secure processor (i.e. the size of the digital blocks handled by the secure processor). The size of the word may correspond to the size of the registers of the secure processor. For example, the secure processor can be an 8-bit or 16-bit or 32-bit or 64-bit processor (indicated bit values ​​corresponding to the size of its registers). In that case, the size of the word can be set to the size of the processor registers (i.e. 8-bit or 16-bit or 32-bit or 64-bit, respectively). However, in some calculations, the working format of the secure processor (i.e. the size or format of the digital blocks manipulated or processed by the secure processor during the execution of the calculation) may be smaller than the size of the processor registers. For example, the working format of the secure processor can be 8-bit and the registers of the secure processor are 32-bit. The size of the word is adapted.

[0024] In some embodiments, the digital information is stored in segments in the external memory, and the steps of loading the digital information and segmenting the digital information into words are performed repeatedly for each of the segments.

[0025] In certain embodiments, - during the step of loading each segment from the external memory, the secure element loads the digital information in encrypted form and the integrity element; - In a step of verifying the integrity of the digital information in encrypted form, the secure element calculates an integrity factor by chain calculation on L+1 blocks of a predetermined number of bytes in the encrypted form and compares the calculated integrity factor with the loaded integrity factor.

[0026] Advantageously, - in a decryption step, the N+1 blocks of encrypted form are decrypted into N blocks of plaintext digital information and another integrity factor, - In the segmenting step, each of the N blocks of plaintext digital information is divided into words of digital information.

[0027] Advantageously, in a step of verifying the integrity of the digital information, which is carried out after the step of associating an error detection or correction code with the corresponding word, the secure element calculates an integrity factor by chain calculation on the L blocks of plaintext digital information and compares the calculated integrity factor with other integrity factors resulting from the decryption step.

[0028] The method comprises the steps of: - segmenting the plaintext digital information into segments; -For each digital information segment, computing a first integrity factor for the plaintext digital information; - encrypting the digital information and the first integrity element; - calculating a second integrity factor of the result of the encryption and concatenating the result of the encryption and the second integrity factor; Storing the result of the encryption concatenated with the second integrity in an external memory.

[0029] Furthermore, when the segment of digital information is modified by the secure element, the secure element performs the steps of: computing a first integrity factor for the plaintext digital information; - encrypting the digital information and the first integrity element; - calculating a second integrity factor of the result of the encryption and concatenating the result of the encryption and the second integrity factor; updating the segment of digital information in the external memory by performing the steps of: updating the segment currently stored in the external memory with the result of the encryption concatenated with the second integrity element.

[0030] Optionally, each word of each block may have its own error detection or correction code stored in the secure element, which may be checked after computing the first integrity element and before encrypting the N blocks of digital information, so that the encryption path is more resistant to fault attacks.

[0031] Advantageously, the word of digital information is processed by the secure processor only if no errors are detected in the word of digital information.

[0032] If the step of validating the word of digital information by the secure processor based on the associated error detection or error correction code fails, the word of digital information may be treated as not relevant by the secure processor or the method for securely processing digital information may be aborted by the secure element.

[0033] A second aspect of the present disclosure is a secure element for securely processing digital information, comprising: A secure processor; -At least one internal memory; a communications interface for loading digital information from an external memory into at least one internal memory of the secure element; a code associating unit for segmenting the digital information into words of digital information, generating error detection or correction codes from the words of digital information, and associating the generated codes with corresponding words in at least one internal memory, The present invention relates to a secure element for securely processing digital information, wherein a secure processor is configured to load a word of digital information and an associated error detection or correction code from at least one internal memory, and to validate the word of digital information based on the associated error detection or correction code before processing the digital information contained in the word.

[0034] Advantageously, the electronic device further comprises an integrity checking unit adapted to check the integrity of the digital information based on the words of digital information read from the at least one internal memory.

[0035] The secure element may further include an integrity verification unit for verifying the integrity of the digital information in encrypted form, and a decryption unit for decrypting the loaded digital information to obtain the plaintext digital information.

[0036] A third aspect of the present disclosure relates to a system on a chip including a secure element as previously defined.

[0037] The system on chip may have an external memory located outside the secure element.

[0038] A fourth embodiment of the present disclosure relates to a module including a system-on-chip.

[0039] Advantageously, in the module, the external memory located outside the secure element is located either inside the system-on-chip or outside the system-on-chip.

[0040] A fifth aspect of the present disclosure relates to a non-transitory computer-readable medium comprising program instructions for causing a secure element for securely processing digital information, the secure element comprising a secure processor, to perform the steps of the method previously defined. [Brief description of the drawings]

[0041] Other features, objects and advantages of the present disclosure will become more apparent from a reading of the detailed description of the non-limiting embodiments, which is made with reference to the accompanying drawings. [Figure 1] FIG. 1 illustrates a module embedding a system-on-chip (SoC) with a secure element according to an exemplary embodiment. [Diagram 2] FIG. 2 illustrates operations for preparing digital information to be stored in external memory (ie, external to the secure element) and loaded into the secure element, according to an exemplary embodiment. [Diagram 3] FIG. 3 illustrates operations for processing digital information by a secure element after it has been loaded into the secure element from an external memory, according to an exemplary embodiment. [Figure 4] FIG. 4 depicts a secure element according to an exemplary embodiment. [Diagram 5] FIG. 5 depicts a flowchart of a method for preparing digital information to be stored in an external memory, according to an exemplary embodiment. [Figure 6] FIG. 6 represents a flowchart of a method for securely processing digital information stored in an external memory, performed by a secure element, according to an exemplary embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0042] 1 shows a system including a secure element 100 and an external memory 200 (i.e. external to the secure element). The secure element is for example a smart card or a chip. It can be embedded in a SoC (system on chip) 110 having several processing units, several memories and several functions (not shown). The SoC 110 can be integrated into a larger module 120. For example, this larger module 120 can be an IoT device (typically with a unique identifier and the ability to transfer data over a network), a telecommunication device, a location system, a vehicle such as a car or an aircraft, etc.

[0043] The secure element 100 comprises a secure processing unit 102, for example an integrated hardware intellectual property core (IP core).

[0044] Different typical and illustrative (non-limiting) use cases of the secure element 100 are given below.

[0045] In a first typical use case, the secure element 100 may be integrated into a modem of a telecommunications system or device. In such a case, the secure element 100 may handle network authentication and download secure applications.

[0046] In a second typical use case, the secure element 100 is integrated into a tachograph and is able to handle the location data securely.

[0047] In a third typical use case, the secure element 100 is integrated into a vehicle, for example a car or an airplane, and is able to ensure and manage secure data transport.

[0048] The external memory 200 stores digital information. The term "digital information" refers to data liable to be loaded into the secure element 100, such as executable code, or information generated by or used by executable code, or any other data used or processed by the secure element 100.

[0049] The secure element 100 is intended to load and process (or use) digital information stored in the external memory 200 .

[0050] In an exemplary embodiment, memory segmentation is used in the external memory 200. Digital information is segmented and stored in segments.

[0051] A segment consists of several blocks of a predefined number of bytes. For example, a block can be 16 bytes long (16B or 128 bits). A segment of digital information can, for example, contain 64 blocks of 16 bytes, which roughly corresponds to a segment of 1 kilobyte long (1 KB). Each segment has a set of attributes associated with it (type of data contained in the segment, length of the segment, address of the segment, version of the data, etc.). These attributes are recorded in a header attached to the segment. There are two main different types of segments: code segments, which contain executable code, and data segments, which contain code segments or digital information that can be used by or generated by an application.

[0052] Digital information is prepared to be stored in the external memory 200. The method of preparing digital information to be stored in the external memory 200 is first performed by a digital information provider (ie, a system for providing digital information).

[0053] An exemplary embodiment of a method for preparing digital information to be stored in external memory 200 will now be described with reference to FIGS.

[0054] In a first step S1, the plaintext digital information is divided into M segments of digital information referred to as "Si", where 1≦i≦M.

[0055] Each segment Si of plaintext digital information may consist of multiple blocks of a predetermined number of bytes. For example, the blocks are each 16 bytes long (128 bits). The size of the blocks may vary depending on the operations to be performed on the segment. For example, the size of the blocks used to apply a MAC function (or for other authentication functions or algorithms) may be different from the size of the blocks used for encryption or decryption.

[0056] Then, in order to ensure confidentiality and authenticity of the digital information, each of the segments of the digital information is subjected to authenticated encryption in step S2. In this embodiment, the authenticated encryption is based on the well-known authenticated encryption "Encrypt-then-MAC" (EtM) and follows an approach of the type "MAC-then-Encrypt-then-MAC". More precisely, for each segment Si of plaintext digital information, a first integrity element is generated based on the plaintext digital information in step S20, then the plaintext digital information combined with the first integrity element is encrypted in step S21, then a second integrity element is generated based on the result of the encryption in step S22.

[0057] Each of the first and second integrity elements is a short piece of information used to authenticate digital information, such as a message authentication code (MAC). In this disclosure, the first and second integrity elements associated with a segment Si are referred to as "MACi" for 1≦i≦M. 1 " and "MACi 2 " is referred to as

[0058] MACi on plaintext segment Si 1 In step S20 of generating the first MAC, the first MAC is generated by using a MAC function (the MAC * ) to generate L blocks of plaintext digital information Pi 0 ,...,Pi L-1 A block of plaintext digital information is computed by chaining MAC computations of Pi 0 ,...,Pi L-1 In this exemplary embodiment, each block Pi 0 ,...,Pi L-1 is 128 bits long, and each segment Si has L blocks of plaintext digital information (or possibly less than L blocks for incomplete segments), where L is, for example, equal to 64 (this value is an illustrative example only).

[0059] The MAC function is a first secret key K 0 , for example, using a 256-bit key. The resulting MACi 1 is, for example, 16 bytes long (128 bits). 1 is concatenated (combined) with a segment Si of the plaintext digital information to form a new authentication segment Si' = Si|MACi1 (where "|" denotes concatenation). Segment Si' is combined with the integrity element MACi 1 The plaintext digital information segment Si is concatenated with

[0060] In an encryption step S21, the authenticated segment S i ' resulting from step S20 is encrypted by running an encryption algorithm, which is applied on the N+1 blocks forming the segment S i ' to form an authenticated and encrypted segment C i ', referred to as [S i '] (brackets denote encryption). 0 ,...,Ci N (The letter "C" stands for "ciphertext") to produce N+1 encrypted blocks.

[0061] The number N of blocks associated with encryption can be the same as or different from the number L associated with authentication, depending on the type of authentication function and the type of encryption algorithm used.

[0062] In this exemplary embodiment shown in Figures 2 and 3, N and L are the same and equal to 64. 0 ,...,Ci N are here each 16 bytes long (128 bits).

[0063] The encryption is performed using a second secret key K 1 In this embodiment, the second key K 1 is the first key K 0 (However, K 0 and K 1 can be the same key).

[0064] MACi 2 In step S22, the second MAC is performed by using a MAC function (referred to as “MAC” in FIG. 2) to generate the L+1 encrypted block Ci 0 ,...,Ci L This MAC function is computed by chaining MAC calculations on a third key K, e.g. a 256-bit key. 2 In this embodiment, a third key K 2 is the first key K 0 and a second key K 1 (However, K 2 is K 0 and / or K 1 (It can be the same as MACi, but this is less secure). 2 is, for example, 16 bytes long (128 bits). 2 is concatenated (combined) with the authenticated encrypted segment [Si'] to produce a new authenticated segment Si'' (Si'' = [Si']MACi 2The authentication and encryption segment is referred to as the

[0065] Optionally, an integrity element MACi 2 may be protected by encryption.

[0066] Optionally, an integrity element MACi 2 Only a portion of the bits of S i ' may be added to the authenticated and encrypted segment [Si'], for example only a few bits "LSB" (least significant bits).

[0067] Then, in step S3, the segments Si'' of digital information, 1≦i≦M, are stored in a protected form (here authenticated, then encrypted, then authenticated) in the external memory 200.

[0068] Steps S2 and S3 are also repeated for each segment Si of digital information, for 1≦i≦M.

[0069] Once stored in the external memory 200 , the digital information can be loaded and processed (or used) by the secure element 100 .

[0070] Referring to FIG. 4, the secure element 100 comprises a communication interface 101, a processing unit (CPU) 102, a first integrity verification unit 103, a decryption unit 104, a second integrity verification unit 105, a code association unit 106, and at least one internal memory 107.

[0071] The processing unit (CPU) 102 is, for example, a secure processor (ie, a processor having security features with high assurance level certification for security-critical applications), for example a processor of type RISCV or ARMSC300.

[0072] At least one internal memory 107 is, for example, a volatile memory. It can be connected to the processing unit 102 by a bus. It can have local scrambling and encryption to protect it.

[0073] To use the digital information stored in the external memory 200, the secure element 100 executes a method for securely processing digital information, which is described with reference to Figures 3 and 6 according to a first exemplary embodiment.

[0074] In a first step S10, the secure element 100 loads, via the communication interface 101, a segment of digital information in protected form, previously referred to as Si'', from the external memory 200 into the internal memory 107 of the secure element 100. The segment Si'' is then encoded by a second integrity element MACi 2 the authenticated and encrypted segment [Si'] concatenated with the 2 Includes.

[0075] In a second step S11, the secure element 100 verifies the integrity of the loaded segment Si″ of digital information in encrypted form. For this purpose, the first MAC unit 103 verifies the integrity of the L first blocks Ci 0 ,...,Ci L The first integrity verification unit 103 calculates a MAC from the loaded segment S″ by chaining the MAC function and the key K 2 It then uses the calculated MAC to the integrity element MACi 2 The calculated MAC is compared with the loaded MACi 2 If it matches, the integrity of [Si'] is checked successfully. In that case, the decryption and post-decryption integrity check are valid (step S19 in FIG. 3). The calculated MAC is added to the loaded MACi 2If it does not match, the integrity of [Si'] is rejected. In that case, processing of the digital information is followed by an error step S18, which stops processing of the digital information. Alternatively, the error step S18 may result in segment Si'' being irrelevant and discard it (i.e., do not process or use it).

[0076] In a third step S12, after the integrity of [Si′] has been successfully verified, the secure element 100 extracts N+1 blocks Ci 0 ,...,Ci N The decryption is performed by the decryption unit 104 using the key K 1 The result of the decryption step S12 is the plaintext digital information and the integrity element MACi 1 More precisely, the decryption unit 104 decrypts N blocks of plaintext digital information Pi 0 ,...,Pi N-1 and the integrity element MACi 1 Output.

[0077] As mentioned above, depending on the integrity checking function and the decoding algorithm, the number L used for integrity checking can be equal to or different from N used for decoding.

[0078] In a fourth step S13, the code association unit 106 first segments the plaintext digital information (i.e. the digital information resulting from the decryption step S12) into words of digital information. For example, the code association unit 106 segments N blocks of digital information Pi 0 ,...,Pi N-1 As input, we segment each block into words of smaller size. For each block Pi, 0≦j≦N-1, j Let x be the number of words Wi, where 1≦k≦x. j,k is divided into

[0079] By definition, a "word" has a certain number of bytes. The size of the word may depend on the working format of the secure processor 102 or on the capacity of the registers of the secure processor 102. The working format may be smaller than the capacity of the registers. In some embodiments, the word Wi j,k The size of the word is equal to the working format of the secure processor or equal to the size of the processor register. The size of the word can be equal to or less than the number of bytes of the block. In a first illustrative example, the secure processor 102 has 32-bit registers and the code association unit 106 segments each block of 16 bytes length (128 bits) into four words of 32 bits. In a second illustrative example, the secure processor 102 has an 8-bit working format and the code association unit 106 segments each block of 16 bytes length into 16 words of 8 bits length. In a particular embodiment, the size of the word is equal to the minimum of the sizes of the registers and the working format of the processing unit 102. Alternatively, the size of the word may be smaller than the working format of the secure processor or smaller than the size of the processor register.

[0080] Then, in the first embodiment, in step S13, the code association unit 106 j,k For each of the EDC j,k and generating an error detection code (EDC) referred to as j,k The corresponding word Wi j,k In other words, the code EDC j,k The word Wi j,k Then, the word Wi j,k is attached to.

[0081] The calculation of the error detection code is based on a mathematical function. For example, the error detection code is a parity code or a Hamming code. Advantageously, it may not be a cryptographic function, which results in fewer computing resources. Error Detection Code EDC j,k is the data received when the data was transferred (i.e., the word Wi j,k ) to detect errors present in the EDC code. j,k is the original data (i.e., the word Wi j,k ) contains some bits attached to the code EDC j,k The original data j,k This allows errors to be detected if they occur during transmission.

[0082] Their respective error detection codes EDC j,k A word of plaintext digital information Wi (with 0≦j≦N-1 and 1≦k≦X) associated with j,k is stored in the internal memory 107 of the secure element 100.

[0083] Error detection code EDC j,k Let Wi be a word of digital information (with 0≦j≦N-1 and 1≦k≦X). j,k After step S13 of associating the words with their associated error detection codes in the internal memory 107, the secure element 100 checks the integrity of the plaintext digital information in step S14. The integrity of the plaintext digital information is checked by checking the associated error detection codes EDC j,k The word Wi of digital information read from the internal memory 107 (which does not have j,k More precisely, the second integrity verification unit 105 reads the word Wi from the internal memory 107. j,k , reconstruct the segment Si of the plaintext digital information, and use the MAC function and key K 0 L blocks of plaintext digital information Pi 0 ,...,Pi L-1The second integrity verification unit 105 then calculates an integrity element (here a MAC) by chaining calculations on the integrity elements MACi resulting from the decryption step S12. 1 Compare with.

[0084] The calculated MAC is MACi 1 If the word matches the plaintext digital information, the integrity of the plaintext digital information is successfully verified. j,k The transfer of MACi is enabled (step S18 in FIG. 3) and the method proceeds to the next steps S15 to S17 shown in FIG. 6. 1 If it does not match, the integrity of the plaintext digital information is rejected and processing of the digital information is followed by an error step S2. This error step S18 can result in stopping the processing of the digital information. Alternatively, the error step S18 can result in treating the segment Si as not relevant and discarding it (i.e. not processing it or erasing it without using it).

[0085] Here, the following steps S15 to S17 are carried out by using the word Wi (with 0≦j≦N−1 and 1≦k≦X) stored in the internal memory 107. j,k is performed successively for each of the

[0086] In this step S15, each word of digital information Wi (with 0≦j≦N-1 and 1≦k≦X) is j,k and its associated error detection code are forwarded to the secure processor 102. j,k and its associated error detection code are transferred to the secure processor 102 only once the integrity of the plaintext digital information has been successfully verified in step S14.

[0087] Then, in step S16, the secure processor 102 detects the received word Wi by using the associated error detection code. j,kIf no error is detected in the word in step S16, the word Wi of the digital information is j,k is processed (or used) by the secure processor 102 in step S17. If an error is detected in step S16, the method proceeds to error step S18, which may result in the processing of the digital information being stopped, or in the erroneous word being considered as irrelevant and discarded.

[0088] Steps S10 to S17 or S18 are repeatedly executed for the multiple segments Si″ of the protected digital information loaded from the external memory 200.

[0089] During the processing or use of digital information by the secure element, the segment Si may be modified. The modified segment is called Si. In such a case, the secure element 100 writes a segment Si to the external memory 200. C 2. To update a modified segment referenced as ",'' the following steps are performed: -Corrected plaintext digital information Si C The first integrity element for MACi C_1 and calculating -First integrity element MAC C_1 Digital information Si C Encrypt it and write it as [Si C ']]=[Si C ]|[MACi C_1 ]; and -Encryption [Si C ']=[Si C ]|[MACi C_1 The second integrity element of the result of MACi C_2 and concatenate the result of the encryption and the second integrity element to obtain Si C ''=[Si C ]|[MACi C-1 ]|MACi C_2 forming a the result of the encryption Si concatenated with the second integrity factor C2. updating the segments currently stored in the external memory (200) with the results of ''.

[0090] Optionally, for each block of index j (Pi 0 ,...,Pi N-1 ) each word Wi j,k Each word may have its own error detection code stored in the internal memory 107 of the secure element 100. The error detection code of each word is determined by the first integrity element MACi C_1 can be checked after computing ,and before performing the encryption step, making the encryption path more resistant to fault attacks.

[0091] The updated segment is then downloaded from the secure element 100 to the external memory 200 and the currently stored segment is replaced by the updated segment.

[0092] As described in steps S10 to S17 or S18, the processing of digital information is performed by the secure element under the control of program instructions. The program instructions are stored in one or more storage modules, such as a volatile memory, e.g. a RAM, and / or a non-volatile memory, such as a ROM, Flash, NAND, etc., permanently or removably integrated in the secure element. Thus, the present disclosure provides a secure element for securely processing digital information, the secure element having a secure processor, comprising the steps described above, in particular: - loading digital information from an external memory into a secure element; - segmenting the digital information into words of the digital information, generating error detection codes from the words of the digital information, and associating the error detection codes with corresponding words; - transferring the word of digital information and the associated error detection code to a secure processor; The present invention also relates to a non-transitory computer-readable medium comprising program instructions for causing a secure processor to perform the steps of: validating a word of digital information based on an associated error detection code before processing the digital information contained in the word.

[0093] A second exemplary embodiment of the method for processing digital information executed by the secure element 100 is based on the first exemplary embodiment, in which the code generated in step S13 by the code association unit 106 corresponds to the word Wi j,k For each of the ECC j,k This code is called ECC. j,k corresponds to the word Wi j,k Combined with Error Correction Code ECC j,k The original data j,k In a second exemplary embodiment, in the case of the detection of an error in a word Wij,k, the correction of one or more bits of this word Wij,k is carried out by detecting and correcting one or more bit errors in the corresponding word Wij,k if they occur during the transmission of the word Wij,k. j,k may be executed by the secure element 100, for example a correction unit, before being transferred to the secure processor 102.

[0094] In the present disclosure, digital information stored in the external memory 200 and intended to be processed (used) by the secure processor 102 in the secure element 100 is protected by authenticated encryption according to an approach of the type "MAC-then-Encrypt-then-MAC". This means that a first MAC is calculated on the plaintext digital information, then encryption is applied to the digital information and the first MAC, after which a second MAC is calculated on the result of the encryption. The digital information thus protected is loaded from the external memory into the secure element. In the secure element, the integrity of the digital information in protected form is verified before decryption. After decryption, the plaintext digital information is segmented (divided) into words with a size adapted to the secure processor and an error detection or correction code is added to these words. The words of the plaintext digital information and the associated error detection code (EDC) or error correction code (ECC) are stored in the internal memory of the secure element and are ready to be transferred to the secure processor. Before transferring the words and their associated codes (EDC or ECC) to the secure processor, the integrity of the plaintext digital information is verified by computing a MAC (or integrity factor) of the plaintext digital information, obtained by reading the words stored in the internal memory and comparing the computed MAC with a reference MAC computed in the secure environment.

[0095] Such an arrangement provides end-to-end security in the processing of digital information from storage in the external memory to processing by a secure processor in the secure element, ensuring that the digital information is not altered during storage in the external memory, during transfer from the external memory to the secure element, and up until the point of transferring the digital information to the secure processor in the secure element.

[0096] Different types of MAC functions can be used to generate the integrity element of digital information and to verify the integrity of digital information. For example, the CMAC function (Cipher-based Message Authentication Code), which is a block cipher-based Message Authentication Code algorithm, or the HMAC algorithm (Hash-based Message Authentication Code), which is a specific type of Message Authentication Code (MAC) that includes a cryptographic hash function and a secret cryptographic key, can be used. In that case, the block size may not have the same number of bytes as the one used for encryption. Instead of the MAC function, any other authentication function can be used.

Claims

1. A method for securely processing digital information, the method being implemented by a secure element (100) comprising a secure processor (102) and at least one internal memory (107) and a code association unit (106), both external to said secure processor (102), - a step (S10) of loading digital information (Si'') from an external memory (200) into said at least one internal memory (107) of said secure element (100), - in said code association unit (106), said digital information (Si) is converted into words of digital information (Wi ｊ，ｋ ) and an error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ from said words of digital information and associating said error detection or correction codes with corresponding words in said at least one internal memory (107); - the word of said digital information (Wi ｊ，ｋ ) and the associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) from said at least one internal memory (107) to said secure processor (102); In the secure processor (102), the word (Wi ｊ，ｋ ) before processing the digital information contained in the associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) based on the word (Wi ｊ，ｋ and (S16) checking whether the

2. After the step (S13) of associating the error detection or error correction code with the corresponding word, and after the step (S14) of associating the word of digital information and the associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ 2. The method of claim 1, further comprising a step (S14) of verifying the integrity of the digital information performed before transferring (S15) the digital information to the secure processor (102).

3. 3. The method of claim 1 or 2, further comprising a step (S12) of decrypting the digital information loaded from the external memory (200) to obtain the digital information in plaintext, and wherein the step (S13) of segmenting into words is performed on the digital information in plaintext.

4. 3. The method of claim 2, further comprising the step (S11) of verifying the integrity of the digital information in encrypted form.

5. The word of digital information (Wi ｊ，ｋ ) is the error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) in the internal memory (106) of the secure element (100), and in the step (S14) of verifying the integrity of the digital information, which is carried out after the step of associating the word of digital information with the error detection or correction code, the word of digital information (Wi ｊ，ｋ 3. The method of claim 2, wherein the internal memory (106) is read from the internal memory (106).

6. The word of digital information (Wi ｊ，ｋ ) and the associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ 3. The method according to claim 2, characterized in that the associated error detection or error correction code is transferred to the secure processor (102) only if the integrity of the digital information has been successfully verified after the step (S13) of associating the associated error detection or error correction code with the corresponding word.

7. The digital information is stored in words (Wi) of a given size that depends on the working format of the secure processor (102) or the capacity of the registers of the secure processor (102). ｊ，ｋ 7. The method according to claim 1, wherein the signal is segmented into:

8. Method according to any one of claims 1 to 7, characterized in that the digital information is stored in the external memory (200) in segments (Si''), and the steps (S10) of loading the digital information and (S13) of segmenting the digital information into words are repeatedly performed for each of the segments.

9. During the step (S10) of loading each segment from the external memory (200), the secure element (100) loads the digital information in encrypted form and an integrity element (MACi ２ ) and In said step (S11) of verifying the integrity of said digital information in encrypted form, said secure element (100) checks a predetermined number of bytes (Ci ０ , . . . , Ci Ｌ ) L+1 blocks (Ci ０ , . . . , Ci Ｌ ), and combine the calculated integrity element with the loaded integrity element (MACi ２ 9. The method of claim 8 when dependent on claim 4, characterized in that the comparison is made with

10. In said step of decryption (S12), N+1 blocks (Ci ０ , . . . , Ci Ｎ ) is a set of N blocks of plaintext digital information (Pi ０ , . . . , Pi Ｎ－１ ) and another integrity element (MACi １ ) In said step of segmenting (S13), each of said N blocks of plaintext digital information (Pi ０ , . . . , Pi Ｎ－１ ) is the word of digital information (Wi ｊ，ｋ 10. The method according to claim 3 or 9, characterized in that the mixture is divided into

11. - the error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) to the corresponding word (Wi ｊ，ｋ In the step (S14) of verifying the integrity of the digital information, which is performed after the step (S13) of associating L blocks (Pi0 , . . . , Pi Ｌ－１ ) and decrypting the integrity element calculated by the chaining calculation in step (S12) with the other integrity element (MACi １ 3. The method of claim 2, further comprising comparing the

12. carried out by digital information providers; - segmenting said plaintext digital information into segments (Si); - for each segment (Si) of digital information, A first integrity element (MACi) for the plaintext digital information １ ) and The digital information and the first integrity element (MACi １ ) and encrypt it. A second integrity factor of the result of the encryption (MACi ２ ), and calculating the result of the encryption and the second integrity factor (MACi ２ ) are concatenated, The method of claim 3, 10 or 11, further comprising the step of: storing the result of the encryption concatenated with a second integrity in the external memory (200).

13. The secure element (100) receives a segment of digital information (Si Ｃ ) is modified, said secure element (100) A first integrity element (MACi) for the plaintext digital information Ｃ＿１ ) and The digital information and the first integrity element ([Si Ｃ ']] = [Si Ｃ ]|[MACi Ｃ＿１ ]; Calculate a second integrity factor (MACi 2) of the encryption result, and combine the encryption result and the second integrity factor (MACi ２ ) - updating the segment currently stored in the external memory (200) with the result of the encryption concatenated with the second integrity element (MACi 2).

14. The word of digital information (Wi ｊ，ｋ 14. The method according to claim 1, wherein the word of digital information is processed by the secure processor (102) only if no errors are detected in the first and second bits of the digital information.

15. The associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) by the secure processor (102) based on the word of digital information (Wi ｊ，ｋ If the step (S16) of checking the word (Wi ｊ、ｋ 15. The method according to claim 1, wherein said digital information is treated as irrelevant or said method for securely processing said digital information is discontinued.

16. A secure element (100) for securely processing digital information, comprising: a secure processor (102), at least one internal memory (107); a communications interface (101) for loading said digital information from an external memory (200) into said at least one internal memory of said secure element (100); - the digital information is converted into a word of digital information (Wi ｊ，ｋ ) and extracting an error detection code (EDCj,k) or an error correction code (ECC ｊ，ｋ ), and generating the error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) to a corresponding word (Wi ｊ，ｋ a code associating unit (106) for associating the code with the The secure processor (102) reads the word of digital information (Wi ｊ，ｋ ) and the associated error detection code (EDC ｊ，ｋ ) or Error Correction Code (ECC ｊ，ｋ ) and validating the word of digital information based on the associated error detection or correction code before processing the digital information contained in the word.

17. 17. The secure element of claim 16, further comprising an integrity verification unit (105) configured to verify the integrity of said digital information based on the words of said digital information read from said at least one internal memory (107).

18. 18. A secure element according to claim 16 or 17, further comprising an integrity verification unit (103) for verifying the integrity of the digital information in encrypted form, and a decryption unit (104) for decrypting the loaded digital information to obtain the digital information in plaintext.

19. A system-on-chip comprising a secure element according to any one of claims 16 to 18.

20. 20. The system on chip of claim 19, further comprising an external memory (200) located outside the secure element (100).

21. A module comprising the system-on-chip of claim 20.

22. 22. The module of claim 21, wherein the external memory (200) located outside the secure element (100) is located inside the system-on-chip.

23. 13. A non-transitory computer readable medium, the non-transitory computer readable medium comprising program instructions for causing a secure element for securely processing digital information to perform the steps of the method of claim 1, the secure element having a secure processor.

Images