EP3539253A1

EP3539253A1 - Method and device for transmitting encrypted data, method and device for extracting data

Info

Publication number: EP3539253A1
Application number: EP17793981.6A
Authority: EP
Inventors: Guillaume Larignon
Original assignee: Sigfox SA
Current assignee: UNABIZ
Priority date: 2016-11-09
Filing date: 2017-11-09
Publication date: 2019-09-18
Also published as: US20190349754A1; WO2018087255A1; FR3058604A1; FR3058604B1; JP2020511063A; US11070975B2; JP7100654B2; CN110089072A; CN110089072B

Abstract

The present invention relates to a method (50) for transmitting, by means of a transmitter device (20), a packet to a receiver device (30) of a communication system, said packet including data encrypted according to a symmetric key encryption protocol, including: - determining (51) the value of an item of generation information; - determining (52) an encryption key according to the value of the generation information; - encrypting (53) the data to be included in the encrypted packet to be transmitted according to the encryption key; - calculating (54) a truncated item of information on the basis of the generation information; - calculating (55) a verification code for the encrypted packet according to the encrypted data and the first portion of the generation information; - forming (56) the encrypted packet to be transmitted on the basis of the truncated information, the verification code and the encrypted data.

Description

Method and device for transmitting encrypted data, method and device for extracting data

TECHNICAL AREA

The present invention belongs to the field of digital telecommunications, and more particularly relates to a method of transmitting a packet comprising encrypted data, as well as a method for extracting data included in such a packet.

STATE OF THE ART

The present invention finds a particularly advantageous, though in no way limiting, application in ultra-narrowband wireless communication systems. By "ultra narrow band" ("Ultra Narrow Band" or UNB in the English literature), it is meant that the instantaneous frequency spectrum of the radio signals emitted by terminals, to an access network, is of width frequency less than two kilohertz, or even less than one kilohertz.

Such UNB wireless communication systems are particularly suitable for applications of the type M2M (acronym for machine-to-machine) or the Internet of Things ("Internet of Things" or loT in the literature Anglo-Saxon).

In such a UNB wireless communication system, the data exchanges are mainly on a link rising from terminals to an access network of said system.

The terminals transmit packets that are collected by base stations of the access network, without first having to associate with one or more base stations of the access network. In other words, the packets transmitted by a terminal are not intended for a specific base station of the access network, and the terminal sends its packets assuming that they can be received by at least one base station.

Such provisions are advantageous in that the terminal does not need to perform regular measurements, particularly greedy in terms of power consumption, to determine the most appropriate base station to receive its packets. Complexity rests on the network access, which must be able to receive packets that can be transmitted at arbitrary times, and at arbitrary central frequencies within a frequency band multiplexing the different terminals.

In many applications, it may be necessary to encrypt the data included in the packets, to ensure the confidentiality on the upstream link between the terminals and the access network.

There are many encryption protocols. For example, in a symmetric key encryption protocol, the same key is used to encrypt and decrypt the data. Said key must therefore be known or can be determined both by the terminal that transmits the data, and by the access network that receives said data.

In addition, to improve the confidentiality of exchanges, it is desirable to vary the key used over time, for example at each new issue of a packet.

In such a case, means must be provided to ensure that the terminal and the access network each use the same key for respectively encrypting and decrypting the data.

For example, it is possible to change the key to each packet, according to a predefined key generation method known prior to the terminal and the access network. The access network, when receiving a packet, updates the key by applying the same key generation method as the terminal.

A disadvantage of such an approach is that, in a UNB wireless communication system, the access network does not necessarily receive all the packets transmitted by the terminal, so that the access network does not know a priori how much times the key has been changed between the previous packet received from the same terminal and the current packet.

Alternatively, it is possible to include, in the packet sent by the terminal, information from which the access network can determine the key used, according to the predefined key generation method. However, since the number of possible different keys is preferentially very high to improve the confidentiality of exchanges, the amount of information to be included in a packet can be important. However, in a UNB wireless communication system, the amount of information can be included in a package is very limited.

STATEMENT OF THE INVENTION

The present invention aims to remedy all or part of the limitations of the solutions of the prior art, including those described above, by proposing a solution that ensures good confidentiality of trade while limiting the amount of information to include in packages.

For this purpose, and according to a first aspect, the invention relates to a method of sending, by a transmitting device, packets destined for a receiving device of a communication system, comprising, for the transmission of a packet, called "encrypted packet", comprising data encrypted according to a symmetric key encryption protocol:

a determination of the value of a generation information,

a determination of an encryption key, to be used to encrypt the data to be included in the encrypted packet to be transmitted, according to the value of the generation information,

an encryption of the data to be included in the encrypted packet to be transmitted according to the encryption key,

a calculation of a truncated information by decomposing the generation information into a first part and a second part, the first part varying more slowly over time than the second part, the truncated information being representative of said second part; part of the generation information,

a calculation of a verification code of the encrypted packet based on the encrypted data and the first part of the generation information,

a formation of the encrypted packet to be transmitted from the truncated information, the verification code, and encrypted data.

Thus, according to the invention, the encryption key is determined according to the value of a variable generation information over time. Therefore, the encryption key changes each time the value of the generation information changes, and can take as many different values as the generation information.

However, the generation information is not included as it is in the encrypted packet to be transmitted, and it is truncated information that is included in the transmitted encrypted packet. Advantageously, the generation information being decomposed into a first part and a second part, the first part varying more slowly than the second part, the truncated information is calculated according to the second part, without taking into account the first part. Typically, the first part of the generation information corresponds to a part that does not vary or little over the duration of transmission of several consecutive packets, while the second part is likely to vary from one packet to another.

Therefore, the number of different values that the encryption key may take may be chosen according to the desired level of confidentiality, without affecting the amount of information to be transmitted in the encrypted packet to enable the receiving device to determine the key. encryption. Indeed, the amount of information to be transmitted can be limited to the amount of information needed to encode the truncated information.

On the other hand, the receiving device must, when receiving an encrypted packet transmitted by the transmitting device, estimate the value of the first part of the generation information of said encrypted packet (not included in said encrypted packet) in order to deducing, from the truncated information, the value of the generation information and thus be able to determine the encryption key used by the transmitting device. The verification code, which is calculated by the sending device according to the encrypted data and the first part of the generation information, is then used by the receiving device to determine whether the estimated value of the first part of the information generation is correct, that is to say if it corresponds to the first part of the generation information used by the sending device, by evaluating the integrity of the encrypted packet based on the encrypted data and the estimated value of the first part of the generation information. If the encrypted packet is considered as integrity, then it means furthermore that the estimated value of the first part of the generation information corresponds to the first part of the generation information used by the transmitting device.

In particular modes of implementation, the method of transmission may further comprise one or more of the following features, taken singly or in any technically feasible combination.

In particular modes of implementation, the verification code is further calculated based on an authentication key of the transmitting device, so that the verification code also makes it possible to verify the authenticity of the encrypted packet.

In particular modes of implementation, the transmission method also comprises a formation and a transmission of a packet, called "registration packet", including a registration information representative of the first part of the generation information. This registration packet can be issued recurrently, for example periodically, or whenever the first part of the generation information varies, or whenever the transmitting device transmits a predetermined number of encrypted packets. . Upon receiving, by the receiving device, an encrypted packet transmitted by the transmitting device, estimating a candidate value of the first part of the generation information of said encrypted packet is performed in addition to reset information extracted from a previously received registration packet.

In particular modes of implementation, the generation information is a packet counter corresponding to the number of packets transmitted by the transmitting device or a generation date of the packet to be transmitted.

According to a second aspect, the present invention relates to a transmitting device for sending packets to a receiving device of a communication system, comprising, for the transmission of a packet, said "encrypted packet", comprising data encrypted according to a symmetric key encryption protocol:

means configured to determine the value of a generation information,

means configured to determine an encryption key, to be used for encrypting the data to be included in the encrypted packet to be transmitted, as a function of the value of the generation information,

means configured to encrypt data to be included in the encrypted packet to be transmitted according to the encryption key, means configured to calculate a truncated information by decomposing the generation information into a first portion and a second portion, the first portion varying more slowly over time than the second portion, the truncated information being representative of said second party,

means configured to calculate a verification code of the encrypted packet based on the encrypted data and the first part of the generation information,

means configured to form the encrypted packet to be transmitted from the truncated information, the verification code, and encrypted data.

In particular embodiments, the transmitter device may further comprise one or more of the following characteristics, taken separately or in any technically possible combination.

In particular embodiments, the verification code is further calculated according to an authentication key of the transmitting device, so that the verification code also makes it possible to verify the authenticity of the encrypted packet.

In particular embodiments, the transmitter device further comprises means configured to form and transmit a packet, called "registration packet", including a registration information representative of the first part of the generation information.

In particular embodiments, the generation information is a packet counter corresponding to the number of packets transmitted by said transmitting device or a generation date of the packet to be transmitted.

According to a third aspect, the present invention relates to a method of extraction, by a receiver device, of data included in an encrypted packet, called "encrypted packet in progress", transmitted by a device that transmits a communication system in accordance with a transmission method according to any one of the embodiments of the invention. Said extraction process comprises:

an extraction, from the current encrypted packet, of the truncated information, the verification code, and the encrypted data, an estimate of a candidate value for the first part of the generating information of the transmitting device for the current encrypted packet as a function of the truncated information extracted from said current encrypted packet,

a determination if the estimated candidate value is correct by evaluating the integrity of the current encrypted packet as a function of the estimated candidate value, the encrypted data, and the verification code extracted from said current encrypted packet,

- when the estimated candidate value is considered correct:

a determination of a decryption key as a function of the estimated candidate value and as a function of the extracted truncated information,

o a decryption of the extracted encrypted data according to the decryption key.

In particular modes of implementation, the extraction method may further comprise one or more of the following characteristics, taken separately or in any technically possible combination.

In particular modes of implementation, the integrity of the current encrypted packet is evaluated in addition to an authentication key of the transmitting device.

In particular modes of implementation, the extraction method further comprises an extraction of registration information included in a packet transmitted by the transmitting device, called "registration packet". The estimate of the candidate value of the first part of the generation information for the current encrypted packet is then further performed according to this registration information.

In particular embodiments, several candidate values for the first part of the generation information are estimated, and the integrity of the current encrypted packet is evaluated for each estimated candidate value until a criterion of stop is checked.

In particular modes of implementation, information from generation is a packet counter of the transmitting device whose value of the first part for the current encrypted packet is further estimated based on the value of the estimated first part and verified for a previous packet received from the same transmitting device.

In particular modes of implementation, the generation information corresponds to a generation date of the packet transmitted by the transmitting device whose value of the first part is estimated as a function also of the first part of the date of receipt of said encrypted packet in progress by the receiving device.

According to a fourth aspect, the present invention relates to a receiver device for receiving packets of a transmitting device of a communication system according to any one of the embodiments of the invention. To extract the data included in a current encrypted packet, said receiver device comprises:

means configured to extract, from the current encrypted packet, the truncated information, the verification code, and the encrypted data,

means configured to estimate a candidate value of the first part of a generation information of the transmitting device for the current encrypted packet as a function of the truncated information extracted from said current encrypted packet,

means configured to determine whether the estimated candidate value is correct by evaluating the integrity of the current encrypted packet as a function of the estimated candidate value, the encrypted data, and the verification code extracted from said current encrypted packet,

means configured to determine a decryption key as a function of the value of the generation information of the estimated transmitter device for the current encrypted packet,

means configured to decrypt the encrypted data extracted from the current encrypted packet as a function of the decryption key.

In particular embodiments, the receiving device can in addition, include one or more of the following characteristics, taken separately or in any technically feasible combination.

In particular embodiments, the integrity of the current encrypted packet is evaluated in addition to an authentication key of the transmitting device.

In particular embodiments, the receiver device further comprises means configured to extract the registration information from a registration packet transmitted by the transmitting device. The candidate value of the first portion of the generation information for the current encrypted packet is then further estimated based on this registration information.

In particular embodiments, several candidate values for the first portion of the generation information are estimated, and the integrity of the current encrypted packet is evaluated for each estimated candidate value until a stopping criterion be checked.

In particular embodiments, the generation information corresponds to a packet counter of said transmitting device whose value of the first part for the current encrypted packet is estimated in addition to the value of the first estimated and verified part. for a previous packet received from the same transmitting device.

In particular embodiments, the generation information corresponds to a generation date of the packet transmitted by the sending device whose value of the first part is estimated in addition to the first part of the date of receipt of said encrypted packet. in progress by the receiving device.

According to a fifth aspect, the present invention relates to a communication system comprising at least one transmitting device according to any one of the embodiments of the invention, and at least one receiving device according to any one of the embodiments of the invention. 'invention.

PRESENTATION OF FIGURES

The invention will be better understood on reading the following description, given by way of non-limiting example, and with reference to FIGS. that represent :

- Figure 1: a schematic representation of a wireless communication system,

FIG. 2: a diagram illustrating the main steps of a method of sending a packet containing encrypted data,

FIG. 3 is a diagram illustrating the main steps of a preferred embodiment of the transmission method of FIG. 2, with the transmission of a registration packet,

FIG. 4: a diagram illustrating the main steps of a data extraction method included in an encrypted packet,

FIG. 5: a diagram illustrating the main steps of a preferred mode of implementation of the extraction method of FIG. 4, and highlighting the use of a registration packet,

FIG. 6: a diagram illustrating the main steps of evaluating the integrity of an encrypted packet,

- Figure 7: a diagram illustrating the main steps of a preferred embodiment of the extraction method of Figure 5, and highlighting the estimation of several candidate values.

In these figures, identical references from one figure to another designate identical or similar elements. For the sake of clarity, the elements shown are not to scale unless otherwise stated.

DETAILED DESCRIPTION OF EMBODIMENTS

FIG. 1 schematically represents a wireless communication system 10, for example of the UNB type, comprising several terminals 20 and an access network 30. In the example illustrated in FIG. 1, the access network 30 comprises several base stations 31 and a server 32.

The terminals 20 and the base stations 31 of the access network 30 exchange data in the form of radio signals. By "radio signal" is meant an electromagnetic wave propagating via non-wired means, the frequencies of which are included in the traditional spectrum of radio waves (a few hertz to several hundred gigahertz).

In particular, the terminals 20 are adapted to transmit packets on an uplink link to the access network 30.

For example, packets are sent asynchronously. By "asynchronously transmitting" is meant that the terminals 20 determine autonomously when they transmit and / or on which central frequency they transmit, without coordination of said terminals 20 to each other and to the base stations 31 of the access network. 30.

In the remainder of the description, one places oneself in a nonlimiting manner in the case where the terminals 20 are at least asynchronous in time, so that the packets are transmitted at times not known a priori of the access network 30. Nothing However, according to other examples, this does not exclude the consideration of terminals 20 synchronized temporally with the base stations 31.

Each base station 31 is adapted to receive the packets of the terminals 20 which are within range. Each packet thus received is for example transmitted to the server 32 of the access network 30, possibly accompanied by other information such as an identifier of the base station 31 which received it, the measured power of said received packet, the date of reception. measured from said packet, the measured center frequency of said received packet, etc. The server 32 processes, for example, all the packets received from the various base stations 31.

A) Method of sending packets

FIG. 2 diagrammatically represents the main steps of a method 50 for sending, by a terminal 20 and destined for the access network 30, packets comprising data encrypted according to a symmetric key encryption protocol.

For example, the terminal 20 comprises a processing circuit (not shown in the figures), comprising one or more processors and storage means (magnetic hard disk, electronic memory, optical disk, etc.) in which a program product is stored. computer, in the form of a set of program code instructions to be executed to implement the different steps of the packet sending method. Alternatively or in addition, the processing circuit includes one or more programmable logic circuits (FPGA, PLD, etc.), and / or one or more specialized integrated circuits (ASICs), and / or a set discrete electronic components, etc., adapted to implement all or part of said steps of the method of transmitting packets.

In other words, the processing circuit comprises a set of means configured in software (specific computer program product) and / or hardware (FPGA, PLD, ASIC, discrete electronic components, etc.) to implement the steps of the packet sending method 50 to the access network 30.

The terminal 20 also comprises wireless communication means, considered as known to those skilled in the art, enabling the terminal 20 to send packets to the base stations 31 of the access network 30, under the form of radio signals.

As illustrated in FIG. 2, the method for transmitting encrypted packets comprises the following steps, all executed by the terminal 20, which will be described in detail below:

- 51 determining the value of a generation information,

Determining an encryption key according to the value of the generation information,

Encryption of the data to be included in the encrypted packet to be transmitted according to the encryption key,

Computing a truncated information from the generation information,

Computing a verification code of the encrypted packet based on the encrypted data and the first part of the generation information,

The formation of the encrypted packet to be transmitted from the truncated information, the verification code, and the encrypted data.

Thus, the encryption key is determined according to the value of a generation information that is variable over time. As a result, the encryption key changes each time the value of the generation information changes. On the other hand, the generation information is not included as it is in the encrypted packet to be transmitted, and it is truncated information that is included in the transmitted encrypted packet.

Generation information can be any variable information at course of time that can be broken down into a first part and a second part, the first part varying more slowly than the second part. Therefore, the first part, which does not vary or little over the transmission duration of several consecutive packets, does not have to be included in the encrypted packet to be transmitted. On the other hand, the second part, which varies from one packet to another, is included in the encrypted packet to be transmitted in any suitable form, and the truncated information is calculated from said second part only, that is to say to say without taking into account the first part.

For example, the generation information is the generation date of the encrypted packet to be transmitted. The generation date is for example expressed as year-month-day-hour-minute-second, and is therefore decomposable into a first part that varies slowly, such as the part corresponding to year-month-day, while the second part, which varies more rapidly, is the part corresponding to hour-minute-second. The truncated information is therefore, in this example, representative of the part corresponding to hour-minute-second, and is for example calculated from the hour-minute-second part by means of an invertible calculation function known to the priori of the terminal 20 and the access network 30.

In the remainder of the description, reference is non-limiting in the case where the generation information is a packet counter corresponding to the number of packets transmitted by the terminal 20. The truncated information is hereinafter referred to as " truncated counter ".

A.1) Determination of the value of the packet counter

During the determining step 51, the terminal 20 updates the value of a packet counter, which corresponds to the number of packets transmitted by said terminal 20.

Preferably, the value of said packet counter is incremented with each new packet transmission. However, there is nothing to preclude, according to other examples, incrementing said value of the packet counter only for certain packets. For example, it is possible, in order to increase the probability of reception, by the access network 30, of the data included in a packet, of duplicating Nr times said data in order to include them in Nr packets sent successively, for example on different central frequencies, with all the same data. In such a case, for example, it is possible to increment the value of said packet counter only all Nr packets, that is to say only when new data must be sent by the terminal 20.

In the remainder of the description, one places oneself in a nonlimiting manner in the case where the value of the packet counter is incremented with each new transmission of a packet.

The value of the packet counter is, for example, incremented modulo Ne, Ne being a predetermined positive integer. Thus, the packet counter of the terminal 20 can take Ne different values. For example, the number Ne is equal to 2 ^Nb1 , Nb1 being a predetermined positive integer, so that the value of the packet counter can be encoded by means of Nb1 bits. For example, Nb1 is equal to 128, so that the packet counter of the terminal 20 can take more than 10 ³⁸ different values.

A.2) Determination of the encryption key

During the determination step 52, the encryption key, to be used for encrypting the data to be included in the encrypted packet to be transmitted, is determined according to the value of the packet counter.

Thus, the encryption key to be used is changed each time the value of the packet counter is incremented. In addition, as the packet counter may take different values, it follows that the encryption key may also take different values.

Consequently, the number Ne is advantageously predetermined so as to ensure in particular a good level of confidentiality of exchanges. For example, considering the number Ne equal to 2 ^Nb1 and Nb1 equal to 128, then the encryption key can take more than 10 ³⁸ different values, which ensures a good level of confidentiality.

The encryption key is determined, from the value of the packet counter, according to a predefined key generation method, known a priori from the terminal 20 and the access network 30. The invention can implement any type of adapted key generation method known to those skilled in the art, and the choice of a particular key generation method is only an alternative embodiment of the invention. In addition, the encryption key can It can also be determined from additional information which, if necessary, is for example concatenated with the packet counter to obtain a generation word of greater size than that of the single packet counter. For example, it may be envisaged to concatenate with the packet counter a static sequence generated in a pseudo-random manner, unique for a given terminal 20 and known a priori by the access network 30.

A.3) Data encryption

During the encryption step 53, the data to be included in the encrypted packet to be transmitted is encrypted according to the encryption key, according to the symmetric key encryption protocol considered.

In general, the invention is applicable to any type of symmetric key encryption protocol known to those skilled in the art, and the choice of a particular symmetric key encryption protocol is only a variant of implementation of the invention.

In preferred modes of implementation, the symmetric key encryption protocol used is a stream encryption protocol (also known as stream cipher in the English literature) possibly emulated from a block encryption protocol like AES (Advanced Encryption Standard).

In fact, unlike block encryption protocols, a stream encryption protocol makes it possible to encrypt data regardless of their size relative to the size of the encryption key. Therefore, it is possible to choose long encryption keys, which can take a very large number of different values, without having to increase by the same amount of data to include in a package.

In the remainder of the description, one places oneself in a nonlimiting manner in the case of a flow encryption protocol. Conventionally, the data is for example in the form of bits, as is the encryption key which comprises at least Nb1 bits. The encrypted data are for example obtained by combining one by one the successive bits of the data and the encryption key, for example by means of a logic function of the type "EXCLUSIVE OR" ("XOR" in the English-language literature) .

A.4) Truncated counter calculation During the calculation step 54, a truncated counter is determined from the value of the packet counter of the terminal 20.

For this purpose, as indicated above, the packet counter is decomposed into a first part and a second part.

For example, the second part of the packet counter corresponds to the value of said modulo packet counter Nt, where Nt is a predetermined positive integer less than Ne. In other words, the second part corresponds to the rest of the Euclidean division of the packet counter value by Nt, while the first part corresponds to the quotient of the Euclidean division of the packet counter value by Nt.

For example, the number Nt is equal to 2 ^Nb2 , Nb2 being a predetermined positive integer less than Nb1, so that the second part then corresponds to the Nb2 least significant bits ("Least Significant Bits" or LSB in the English literature). Saxon) among the Nb1 bits of the packet counter. For example, Nb2 is equal to 12, so that the second part corresponds to the value of the modulo packet counter 4096. The number Nt can for example be chosen such that the probability, for the access network 30, of Missing consecutive packets transmitted by the same terminal 20 is less than a predefined threshold value, for example less than 10 ^-6 .

The truncated counter is representative of the second part of the packet counter, and is for example calculated from said second part according to an invariable calculation function known prior to the terminal 20 and the access network 30. In the following description, it is placed in a nonlimiting manner in the case where the truncated counter is chosen equal to the second part, so that said truncated counter corresponds to the value of the packet counter modulo Nt.

A.5) Calculation of the verification code

During the calculation step 55, a verification code is determined from the encrypted data and the first part of the packet counter.

Indeed, the access network 30 must, when receiving an encrypted packet transmitted by the terminal 20, estimate the value of the first part of the packet counter for said encrypted packet in order to deduce, from the truncated counter, the value of generation information, and so power determining the decryption key to be able to decrypt the encrypted data contained in said encrypted packet.

The verification code, which is calculated by the terminal 20 based on the encrypted data and the first part of the packet counter, is then used by the access network 30 to evaluate the integrity of the encrypted packet. If the encrypted packet is considered integrity, then it means that the encrypted data extracted from the encrypted packet and the estimated value of the first part of the packet counter are correct. If not, it means that the encrypted data extracted from the encrypted packet and / or the estimated value of the first part of the packet counter are not correct.

The use of such a verification code, calculated according to the first part of the truncated information that is not included in the encrypted packet, thus makes it possible to check the value of the first part of the estimated packet counter by the access network 30, and therefore avoids the case where the encrypted data of an encrypted packet would be decrypted from an incorrect decryption key due to an error in the estimation of the first part of the packet counter.

Various more or less robust methods are known to those skilled in the art for verifying the integrity of data, such as for example the use of a parity bit, or a cyclic redundancy check (CRC). In the remainder of the description, one places oneself in a nonlimiting manner in the case where the verification code is a Message Authentication Code (CAM) or MAC ("Message Authentication Code" or MAC in English literature) calculated according to in addition to an authentication key of the terminal 20 which is also known a priori by the access network 30.

It is indeed common in a communication system to use a message authentication code to simultaneously check the authenticity of a received packet and the integrity of the data contained in this packet. In our example, since this code is further calculated based on the first part of the packet counter, it also allows, without increasing the amount of information to be included in the encrypted packet, to check at the access network 30 the estimate of the first part of the counter packets of a received packet. Thus, such a verification code enables the access network 30:

- verify the integrity of the received encrypted data;

to check the estimated value of the first part of the packet counter;

- Authenticate the terminal 20 that issued the encrypted packet.

A.6) Formation of the encrypted packet to be transmitted

During the training step 56, the encrypted packet to be transmitted is formed from the encrypted data, the verification code, and the truncated counter. In other words, the value of the packet counter is not included in the encrypted packet to be transmitted, which includes only the truncated counter.

It is therefore understood that the quantity of information included in the encrypted packet for encoding the truncated counter is less than that necessary to encode the value of the packet counter, since the truncated counter corresponds, for example, to the Nb2 least significant bits among the Nb1 bits of the packet counter. Therefore, the (Nb1 - Nb2) most significant bits (MSB) of the packet counter, which correspond to the first part of said packet counter, are not included in the packet counter. coded packet to be transmitted, which corresponds to 1 1 6 bits not included in the case where Nb1 is equal to 128 and Nb2 is equal to 12.

Thus, it is possible to ensure a good level of confidentiality, by choosing a high Ne value, while limiting the amount of information to be included in the encrypted packet, by choosing a significantly lower value Nt.

The encrypted packet thus formed is then transmitted by the terminal 20 to the access network 30.

A.7) Embodiment variant using a recalibration package

FIG. 3 represents the main steps of an implementation variant of the transmission method 50 comprising, in addition to the steps described above with reference to FIG. 2, a step 56 of forming a registration packet from a registration information representative of the first part of the packet counter.

This registration packet may be issued recurrently, for example periodically, or whenever the value of the first part of the packet counter varies, or whenever the terminal 20 transmits a predetermined number of encrypted packets. etc.

As will be explained in more detail below, the registration information makes it possible, when receiving an encrypted packet by the access network 30, to improve the estimate of the value of the first part of the counter. packets.

It should be noted that the packet counter of the terminal 20 can count only the encrypted packets, just as it can also count the set of transmitted packets, including the registration packets. This choice of behavior of the packet counter is only one variant of implementation of the invention.

It should also be noted that the registration packet may comprise only the registration information, just as it may also include other information, such as for example encrypted data, or the second part of the packet counter (for example if the packet counter is incremented when issuing a registration packet).

In the remainder of the description, one places oneself in a nonlimiting manner in the case where;

the registration information is the first part of the packet counter, that is to say the (Nb1-Nb2) most significant bits of the packet counter in the example considered,

a reset packet is sent each time the counter has been incremented exactly one time, that is to say each time the second part of the packet counter (the Nb2 least significant bits) returns to zero, that is to say also whenever the first part of the packet counter (the (Nb1 - Nb2) most significant bits) is incremented,

- The packet counter of the terminal 20 is incremented when issuing a registration packet.

To enable the access network 30 to discriminate between different received packet types (encrypted packet, registration packet, or other), information identifying the type of packet may be included in the packet. This aspect is outside the scope of the invention.

B) Method of extracting the data included in the packet

FIG. 4 schematically represents the main steps of a method 60 for extracting, by the access network 30, data included in a packet received from a terminal 20, said packet having been transmitted in accordance with a method 50 of FIG. emission according to one of the embodiments of the invention. In the remainder of the description, the encrypted packet is designated from which it is sought to extract data by "encrypted packet in progress", in order to distinguish it from other packets previously received from the same terminal 20.

As illustrated in FIG. 4, the data extraction method 60 comprises the following steps, which will be described in detail below:

Extracting, from the current encrypted packet, the truncated information, the verification code, and the encrypted data included in the current encrypted packet,

Estimating a candidate value for the first part of the generation information of the terminal for the current encrypted packet as a function of the truncated information extracted from the current encrypted packet,

- 63 evaluation of the integrity of the current encrypted packet based on the estimated candidate value, the encrypted data, and the verification code extracted from said current encrypted packet,

- when the current encrypted packet is considered to include:

determining a decryption key as a function of the value of the estimated terminal generation information for the current encrypted packet,

decryption of the encrypted data extracted from the current encrypted packet according to the decryption key.

It should be noted that the steps represented by FIG. 4 are all implemented by the access network 30.

In the example described with reference to FIG. 1, in which the access network 30 comprises a plurality of base stations 31 and a server 32, the encrypted packet in progress, from which one seeks to extract the data, is initially received by one or more base stations 31.

Each base station 31 comprises for this purpose wireless communication means, considered as known to those skilled in the art, allowing said base station to receive packets transmitted by one or more terminals 20 in the form of signals. radio.

On the other hand, the steps of the data extraction method 60, shown in FIG. 4, can be executed by the base station (s) 31 having received the current encrypted packet and / or by the server 32.

In the remainder of the description, one places oneself in a nonlimiting manner in the case where the steps listed above are all implemented by the server 32, after having received the current encrypted packet of the base station (s). having initially received said current encrypted packet on the up link.

For this purpose, the base stations 31 and the server 32 comprise respective network communication means, considered as known to those skilled in the art, allowing the base stations 31 to transmit each received packet to the server 32.

The server 32 comprises for example a processing circuit (not shown in the figures), comprising one or more processors and storage means (magnetic hard disk, electronic memory, optical disk, etc.) in which a program product is stored. computer, in the form of a set of program code instructions to be executed to implement the different steps of the data extraction method 60. Alternatively or in addition, the processing circuit comprises one or more programmable logic circuits (FPGA, PLD, etc.), and / or one or more specialized integrated circuits (ASIC), and / or a set of discrete electronic components, etc. , adapted to implement all or part of said steps of the data extraction method 60.

In other words, the processing circuit comprises a set of means configured in software (specific computer program product) and / or hardware (FPGA, PLD, ASIC, discrete electronic components, etc.) to implement the steps of the method 60 of extracting data from the current encrypted packet received from the terminal 20. As indicated above, different types of generation information can be considered. In the remainder of the description, one places oneself in a nonlimiting manner in the case where the generation information is the packet counter of the terminal 20. In addition, one places oneself in the case where the truncated information included by the terminal 20 in the transmitted packet is a truncated counter which corresponds to the value of said modulo packet counter Nt. In other words, the truncated counter is equal to the second part of the packet counter of the terminal 20. For the other cases, in which the truncated counter is not directly equal to the second part of the packet counter, it is sufficient to obtain said second part of the packet counter, to apply to the truncated counter of the current encrypted packet the inverse function of the calculation function used by the terminal 20.

B.1) Extraction of truncated counter, verification code, and encrypted data

During the extraction step 61, the server 32 extracts from the current encrypted packet the truncated counter, the verification code, and the encrypted data. The extraction of the truncated counter, the verification code, and the encrypted data depends on the manner in which they have been incorporated into the current encrypted packet, and is beyond the scope of the invention.

B.2) Estimation of a candidate value of the first part of the packet counter

In the estimation step 62, the server 32 estimates a candidate value of the first portion of the packet counter of the terminal 20 that has issued the current encrypted packet.

Indeed, as indicated above, the current encrypted packet comprises only the truncated counter of the terminal 20 that sent it, and therefore does not fully include the value of the packet counter of said terminal 20, since the truncated counter only corresponds to to the Nb2 least significant bits among the Nb1 bits of the packet counter.

However, since the encryption key, used by said terminal 20 to encrypt the data included in the current encrypted packet, has been determined according to the value of the packet counter of said terminal 20, the server 32 must estimate the value. of the first part of said counter of packets of the terminal 20 to deduce the full value of the packet counter, and thus be able to determine in turn the decryption key to use, which is identical to the encryption key.

In practice, the server 32 can estimate the value of the first part of the packet counter of the terminal 20 when transmitting the current encrypted packet, depending on:

the truncated counter extracted from said current encrypted packet and

the value of the first part of the packet counter of said estimated and verified terminal for a previous packet received from the same terminal 20.

By "previous packet received", it is understood the last packet received from the terminal 20 before the current encrypted packet, among the packets for which the packet counter of the terminal 20 is incremented, and for which the value of the first part of the counter of packages could be estimated and verified. It should be noted that it may therefore be another encrypted packet, or another type of packet such as a registration packet.

Thus, the server 32 stores the estimated value of the first part of the packet counter used by the terminal 20 when transmitting the previous packet received from said terminal 20, and updates the estimated value of said first part of the packet counter each time a new packet is received from said terminal 20. To initialize this process, it is for example possible to force the terminal 20 to use a predefined initial value of the first part of the packet counter during its very first broadcast. packet, preferably zero. If necessary, the server 32 considers, when it receives for the first time a packet transmitted by this terminal 20 (which is not necessarily the first packet sent by the terminal 20 if some packets have been missed by the network of access 30), that the estimated value of the first part of the packet counter for the previous packet received from the same terminal 20 is equal to said predefined initial value.

From the value of the first part of the estimated packet counter for the previous packet received from the terminal 20, and from the truncated counter extracted from the current encrypted packet, it is then possible for the server 32 to estimate the value of said packet counter of said terminal 20 for the encrypted package in progress.

For example, the value of the first part of the packet counter of the terminal 20 for the current encrypted packet is estimated according to the following expression:

C ₁ (n) = (C ₁ (n-1) + k) modulo 2 ^{(Nb 1 "Nb 2)} and the value of the packet counter of the terminal 20 for the current encrypted packet is estimated according to the following expression:

C (n) = (C ₁ (n) Nt + C ₂ (n))

expressions in which:

C (n) is the value of the packet counter of the estimated terminal for the current encrypted packet,

- C-i (n) is the first part of the packet counter for the current encrypted packet,

C ₂ (n) corresponds to the truncated counter extracted from the current encrypted packet,

Ci (n-1) corresponds to the value of the first part of the packet counter of the terminal 20 estimated and verified for the preceding packet,

k is an integer to be determined.

In our example, the value k corresponds to the number of returns to zero of the second part of the packet counter of the terminal 20 from the previous packet received. Indeed, the value of the first part of the packet counter (corresponding to the (Nb1 - Nb2) most significant bits of the counter) is incremented each time the value of the second part of the packet counter (the truncated part, corresponding the Nb2 low-order bits of the counter) returns to zero.

For example, it is possible to consider ex officio that the number of packets possibly missed by the access network 30, between the current encrypted packet and the previous packet received from the same terminal 20, is less than Nt.

In this case, if the truncated counter of the current encrypted packet is greater than the truncated counter of the previous packet, then the number k is equal at zero (k = 0). To obtain the estimated value of the packet counter for the current encrypted packet, it is sufficient to replace, in the estimated packet counter value for the previous packet, the Nb2 least significant bits by the Nb2 bits of the truncated counter extracted from the packet. encrypted in progress.

On the other hand, if the truncated counter of the current encrypted packet is smaller than the truncated counter of the previous packet, then the number k is equal to one (k = 1) because there has been a return to zero. To obtain the estimated value of the packet counter for the current encrypted packet, it is then necessary to replace, in the estimated packet counter value for the previous packet, the Nb2 least significant bits by the Nb2 bits of the truncated counter extracted from the packet. encrypted in progress, but also add one (1) to the (Nb1 - Nb2) most significant bits of the value of the estimated packet counter for the previous packet.

FIG. 5 represents the main steps of an implementation variant of the data extraction method 60 comprising, besides the steps described above with reference to FIG. 4, a step 66 of extraction, starting from a registration packet, a registration information representative of the first part of the packet counter.

Indeed, the estimate of the value of the first part of the packet counter of an encrypted packet in progress may be erroneous, particularly in the case where a large number, for example greater than Nt, of consecutive packets would be missed by the access network. Such an error is all the more serious as it leads to an estimation error for all subsequent packets.

It is therefore appropriate to correct this situation where the value stored by the server 32 of an estimated value of the first part of the packet counter of the terminal 20 is "out of sync" with the actual value of the first part of the packet counter of the terminal 20 for a given packet. This is the goal of the registration package.

Indeed, the registration information included in the registration packet is representative of the first part of the packet counter. It must therefore make it possible to determine with a good accuracy the value of the first part of the packet counter. At best, and as is the case in the embodiment described, it allows to determine without error the value of the first part of the packet counter. Generally, the value of the generation information for a current encrypted packet can be estimated by concatenating the first part of the generation information determined using the registration information, with the truncated information extracted from the encrypted packet by Classes.

In the embodiment considered, described by way of nonlimiting example, the registration information is the first part of the packet counter, a reset packet is sent each time the packet counter of the terminal 20 has It has been incremented exactly one time, that is to say each time the first part of the counter changes, and the packet counter of the terminal 20 is incremented each time a reset packet is transmitted. It is therefore easy, on receiving a registration packet, to determine the value of the packet counter of the terminal 20 since it corresponds, for its (Nb1 - Nb2) most significant bits, to the value of the information for resetting, and for its Nb2 low-order bits, to a zero value. As a result, a registration packet may play the role of a "previous received packet" for which the value of the packet counter has been determined without error.

Upon receiving a registration packet, a "desynchronization" may be detected if the value of the first portion of the estimated packet counter for the registration packet from a previous packet is different from the value of the first packet. part of the packet counter determined from the registration information. The system 10 is then resynchronized for the terminal 20 by resetting the value of the first part of the packet counter of the terminal 20 stored by the server 32 with the value of the registration information.

B.3) Evaluation of the integrity of the current encrypted packet

FIG. 6 details a preferred mode of implementation of step 63 of evaluating the integrity of the current encrypted packet.

As illustrated in FIG. 6, step 63 includes a step 631 of calculating a verification code from the encrypted data and the estimated candidate value of the first part of the packet counter. This calculation is carried out according to the same method as that used by the terminal 20 to calculate the verification code on issue of the encrypted packet. Step 63 then comprises a step 632 comparing the verification code calculated by the server 32 with the verification code extracted from the current encrypted packet, it is possible to evaluate the integrity of the current encrypted packet. The encrypted packet is considered integral only if the verification code extracted from the current encrypted packet and the calculated verification code are identical.

If the current encrypted packet is considered integrity, then the estimated candidate value of the first part of the packet counter is considered correct, and the server 32 can perform the step 64 of determining the decryption key, and the step 65 of decryption of the encrypted data.

If the current encrypted packet is not considered integrity, then the estimated candidate value of the first part of the packet counter is considered incorrect, and therefore it is not possible to determine the decryption key. In this case, the current encrypted packet may, for example, simply be ignored, or it may possibly be memorized in order to revert later by a new step of estimating a candidate value of the first part of the packet counter, for example following upon receipt of a registration package.

In the implementation mode considered, described by way of non-limiting example, the verification code is a Message Authentication Code (CAM) or MAC ("Message Authentication Code" or MAC in English literature) calculated according to in addition to an authentication key which is known by both the terminal 20 and the server 32. The server 32 may for example determine the authentication key to use through information included in the current encrypted packet which makes it possible to uniquely identify the terminal 20 that sent the packet. More generally, the determination by the server 32 of the authentication key to be used can implement any method known to those skilled in the art and is beyond the scope of the invention.

In such a case, the verification code makes it possible simultaneously to verify the authenticity of the current encrypted packet, the integrity of the encrypted data contained in this encrypted packet, and also the candidate value. estimated from the first part of the packet counter of the current encrypted packet.

B.4) Determination of the decryption key

During the determination step 64, the server 32 determines the decryption key to be used for decrypting the encrypted data extracted from the current encrypted packet.

The value of the packet counter of the terminal 20 for the current encrypted packet is derived from the estimated and verified candidate value of the first portion, and from the truncated information. The decryption key is then determined from the packet counter value of the terminal 20 for the current encrypted packet using the same key generation method used by the terminal 20 to generate the encryption key. In the absence of errors, the decryption key is identical to the encryption key.

B.5) Decryption of encrypted data

During the decryption step 65, the server 32 decrypts the encrypted data extracted from the current encrypted packet, as a function of the decryption key obtained at the end of the determination step 64.

The decryption of the encrypted data depends on the symmetric key encryption protocol considered, and is outside the scope of the invention. For example, in the case of a stream encryption protocol in which the encrypted data is obtained by combining one by one the successive bits of the data and the encryption key by means of an "EXCLUSIVE OR" logical function. , then the unencrypted data is also obtained by combining one by one the successive bits of the encrypted data and the decryption key by means of an "EXCLUSIVE OR" type logical function. B.6) Estimation of several candidate values

FIG. 7 represents the main steps of an implementation variant of the data extraction method 60 comprising, besides the steps described above with reference to FIG. 5, the estimation and verification of several candidate values of the first part of the packet counter until a stop criterion is verified. Thus, a set of several candidate values of the first part of the packet counter of the current encrypted packet is defined, and each estimated candidate value is iteratively verified using the verification code. The stopping criterion is for example checked when, for a given candidate value, the integrity of the current encrypted packet is verified, or as soon as the set of candidate values is exhausted without any candidate value being able to be satisfied. allow to consider the current encrypted packet as integrity.

This implementation variant overcomes the possibility that a large number, for example greater than Nt, consecutive packets are missed by the access network 30. In fact, in such a case the estimate of the candidate value of the first part of the packet counter for the current encrypted packet as presented in section B.3 is false, and it is then advantageous to estimate several different candidate values of the first part of the packet counter , to allow the extraction of data.

In the embodiment considered, and described by way of non-limiting example, the variable k introduced in section B.3 represents, for an encrypted packet in progress, the number of returns to zero of the second part of the counter. of packets of the terminal 20 since the last previous received packet for which the value of the first part of the packet counter could be estimated and verified.

To obtain different candidate values, it is possible to incrementally increment the value of k, starting from a null value, and proceed until the integrity of the current encrypted packet is checked for a given candidate value. .

The current encrypted packet can, however, be considered as not being integrated due to a transmission error altering the encrypted data (for example due to interference) or if a bad authentication key has been used. In such a case, it would be unfortunate to iterate indefinitely on candidate values for which the encrypted packet can not be considered as integrity. Also, it is necessary to limit all the possible candidate values. For this purpose, it is possible, for example, to define the maximum frequency at which the terminal 20 can send packets to the access network 30. By memorizing the reception date of the last packet received, and by calculating the maximum number of packets that could have been sent by the terminal 20 since this date on the date of receipt of the current encrypted packet, it is possible to define the maximum number of returns that could have made the second part of the packet counter of the terminal 20 during this period of time as follows:

expression in which:

t (n-1) is the date of receipt of the previous packet,

t (n) is the date of receipt of the current packet,

- F _max is the maximum frequency of transmission of packets,

- E [x] corresponds to the integer part of x,

k _max is the maximum number of zero returns of the second part of the packet counter of the terminal 20 during the period of time between t (n-1) and t (n).

The set of candidate values of the first part of the packet counter to be considered is then defined by:

C ₁ (n) = (C ₁ (n - 1) + k) modulo 2 ^{(Nb1 "Nb2)} , with k varying between 0 and k _max .

However, it is understood that there are other methods for defining a set of candidate values of the first part of the packet counter. In particular, it is for example possible to estimate the most probable value of the first part of the packet counter as a function of an average packet transmission time by the terminal 20. Other candidate values can then be defined from the most likely value, and checked iteratively in descending order of probability. The choice of a particular method is only a variant of implementation of the invention.

Indeed, although, in the example considered here without limitation, the terminals 20 transmit their packets asynchronously, said terminals 20 can nevertheless issue their packets with a certain regularity. By For example, a terminal 20 may transmit a predetermined number of packets per day, without, however, transmitting said packets in a strictly periodic manner. In such a case, said packets will nevertheless be transmitted, on average, substantially periodically. In such a case, in particular, it is advantageous to estimate the average transmission period between consecutive packet transmissions by said terminal 20, since this can make it possible to improve the estimate of the value of the first part of the packet. packet counter.

For example, the average transmission period of said terminal 20 is calculated according to the following expression: expression in which:

Tem corresponds to the estimated average emission period for the terminal 20,

- C (m) is the value of the packet counter of the terminal

Estimated for the rank of packet received from said terminal 20,

t (m) corresponds to the date of reception measured for the packet of rank m received from said terminal 20,

C (m-1) corresponds to the value of the packet counter of the terminal 20 estimated for the rank packet (m-1) received from said terminal 20,

t (m-1) corresponds to the measured reception date for the rank packet (m-1) received from said terminal 20,

M is the total number of packets received from the terminal 20. Once the average transmission period of the terminal 20 has been estimated, the value noted k _pr0 b most likely to calculate the first part of the packet counter for the current encrypted packet is for example estimated according to the following expression:

expression where (t (n) - t (n-1)) is the time elapsed between the date of receipt of the current encrypted packet and the date of receipt of the packet previous, and p is an integer which is determined as follows:

- p = 0 if C ₂ (n)> C ₂ (n-1),

- p = 1 if C ₂ (n) <C ₂ (n-1).

The candidate values to be iterated can then be, for example, defined by the set:

k = k _prob ± i, i N, k≥0, k≤ k _prob + k _max

B.7) Other types of generation information

In the exemplary embodiments of the extraction method 60 described above, the case in which the generation information is the packet counter of the terminal 20 has been considered in a nonlimiting manner.

However, as indicated above, other types of generation information can be considered, and the choice of a particular type of generation information, variable over time, is only a variant of implementation. of the invention.

It is also understood that the estimation of the value of the first part of the generation information of the terminal 20 for the current encrypted packet may depend on the type of generation information considered.

For example, in the case where the generation information corresponds to the packet counter of the terminal 20, the estimation of the first part of the value of said packet counter of the terminal 20 for the current encrypted packet advantageously takes account of the value of the first part of said estimated packet counter for the previous packet received from the same terminal

20.

In the case where the generation information considered corresponds to the generation date, by the terminal 20, of the packet to be transmitted, then it is not necessary to take into account the value of the first part of the estimated generation date. for the previous packet received from the same terminal 20, and the value of the first part of the date of generation of the current encrypted packet by the terminal 20 is for example estimated according to the date of receipt of said current encrypted packet. Indeed, the generation date of the current encrypted packet by the terminal 20 and the date of receipt of said current encrypted packet by the access network 30 have, in principle, respective first portions. substantially identical, and differ mainly in their respective second parts. Since the truncated information extracted from the current encrypted packet is representative of the second part of the date of generation of said current encrypted packet by the terminal 20, it is understood that it is possible to estimate the value of the date of generating said current encrypted packet based on the truncated information extracted from said current encrypted packet and depending on the date of receipt of said current encrypted packet by the access network 30. For example, the value of the generation date the current encrypted packet is obtained by combining the first part of the date of receipt of the current encrypted packet with the second part of the generation date determined from the truncated information extracted from said current encrypted packet.

The use of a packet generation date as generation information, however, assumes that the current dates of the terminal 20 and the access network 30 are synchronized with sufficient accuracy.

More generally, it should be noted that the modes of implementation and realization considered above have been described by way of non-limiting examples, and that other variants are therefore possible.

In particular, the invention has been described by considering only packets transmitted on the uplink from the terminals 20 to the access network 30. The invention is however applicable, alternatively or in addition, on a downlink from the network. In other words, the invention is more generally applicable to the transmission, by a transmitting device, of a packet containing encrypted data and to the extraction, by a receiving device, data included in such a package.

In addition, the invention has been described by considering a UNB wireless communication system. However, there is nothing to preclude, in other examples, considering other types of communication systems, including wired communication systems. However, the invention finds a particularly advantageous application in low speed wireless communication systems, that is to say with a flow rate of less than 1 kilobit / s.

Claims

Method (50) for sending, by a transmitting device (20), packets to a receiving device (30) of a communication system, characterized in that it comprises, for the transmission of a packet, called "encrypted packet", comprising data encrypted according to a symmetric key encryption protocol:

a determination (51) of the value of a generation information,

a determination (52) of an encryption key, to be used for encrypting the data to be included in the encrypted packet to be transmitted, as a function of the value of the generation information,

an encryption (53) of the data to be included in the encrypted packet to be transmitted according to the encryption key,

a computation (54) of a truncated information by decomposing the generation information into a first part and a second part, the first part varying more slowly over time than the second part, the truncated information being representative the second part of the generation information,

a calculation (55) of a verification code of the encrypted packet based on the encrypted data and the first part of the generation information,

a training (56) of the encrypted packet to be transmitted from the truncated information, the verification code and the encrypted data.

The method (50) of claim 1, wherein the verification code is further calculated based on an authentication key of the transmitting device (20).

Method according to one of the preceding claims, further comprising a formation (57) and a transmission of a packet, called "registration packet", including a registration information representative of the first part of the generation information.

Method (50) according to one of the preceding claims, wherein the generation information is a packet counter corresponding to the number of packets transmitted by said transmitting device (20) or a generation date of the packet to be transmitted.

Transmitting device (20) for transmitting packets to a receiving device (30) of a communication system, characterized in that it comprises, for the transmission of a packet, said "encrypted packet", comprising encrypted data according to a symmetric key encryption protocol:

means configured to determine the value of a generation information,

means configured to encrypt data to be included in the encrypted packet to be transmitted according to the encryption key,

means configured to calculate a truncated information by decomposing the generation information into a first portion and a second portion, the first portion varying more slowly over time than the second portion, the truncated information being representative of said second party,

Transmitting device (20) according to claim 5, wherein the verification code is further calculated according to an authentication key of the transmitter device (20).

Transmitting device (20) according to one of claims 5 or 6, further comprising means configured to form and transmit a packet, called "registration packet", including a registration information representative of the first part of the information of generation.

Transmitting device (20) according to one of claims 5 to 7, wherein the generation information is a packet counter corresponding to the number of packets transmitted by said transmitting device (20) or a generation date of the packet to be transmitted.

- Method (60) of extraction, by a receiver device (30), of data included in an encrypted packet, called "encrypted packet in progress", transmitted by a transmitting device (20) according to a transmission method according to the one of the preceding claims, characterized in that it comprises:

an extraction (61), from the current encrypted packet, of the truncated information, the verification code and the encrypted data,

an estimate (62), based on the extracted truncated information, of a candidate value for the first part of the generation information of the transmitting device (20) for the current encrypted packet,

a determination whether the estimated candidate value is correct by evaluating the integrity of the current encrypted packet as a function of the estimated candidate value, the encrypted data, and the verification code extracted from said current encrypted packet,

- when the estimated candidate value is considered correct:

a determination (64) of a decryption key as a function of the estimated candidate value and as a function of the extracted truncated information,

a decryption (65) of the extracted encrypted data as a function of the decryption key.

The method (60) of claim 9, wherein the integrity of the current encrypted packet is further evaluated based on an authentication key of the transmitting device (20).

- Method according to one of claims 9 and 10, further comprising an extraction (66) of a registration information included in a packet transmitted by the transmitting device (20), called "registration packet", the candidate value of the first part of the generation information of the current encrypted packet being estimated further depending on the information of the recaling extracted from said registration packet.

- Method (60) according to one of claims 9 to 11, wherein several candidate values for the first part of the generation information are estimated, and wherein the integrity of the current encrypted packet is evaluated for each value estimated candidate until a stop criterion is verified.

- Method (60) according to one of claims 9 to 12, wherein the generation information is a packet counter of the transmitting device (20) whose value of the first part for the current encrypted packet is estimated according to in addition to the value of the first portion estimated and verified for a previous packet received from the same transmitting device (20).

- Method (60) according to one of claims 9 to 12, wherein the generation information corresponds to a generation date of the packet transmitted by the transmitting device (20) whose value of the first part is estimated and verified in also functions from the first part of the date of reception of said current encrypted packet by the receiving device (30).

- Receiving device (30) for receiving packets transmitted by a transmitting device (20) according to a reception method according to one of claims 9 to 14, characterized in that it comprises, for the extraction of data included in an encrypted package in progress:

means configured to estimate a candidate value for the first part of the generation information of the transmitting device (20) for the current encrypted packet as a function of the extracted truncated information,

means configured to determine whether the estimated candidate value is correct by evaluating the integrity of the current encrypted packet as a function of the estimated candidate value, the encrypted data, and the extracted verification code,

means configured to determine a decryption key according to the candidate value considered to be correct and the extracted truncated information,

The receiver device (30) of claim 15, wherein the integrity of the current encrypted packet is further evaluated based on an authentication key of the transmitting device (20).

17 - receiving device (30) according to one of claims 15 and 1 6, further comprising means configured to extract the registration information included in a registration packet issued by the transmitter device (20), the candidate value of the first part of the generation information of the current encrypted packet being estimated further according to the registration information extracted from said registration packet.

Receiver device (30) according to one of claims 15 to 17, wherein several candidate values for the first part of the generation information are estimated, and wherein the integrity of the current encrypted packet is evaluated for each estimated candidate value until a stop criterion is verified.

Receiver device (30) according to one of claims 15 to 18, wherein the generation information is a packet counter of the transmitting device (20) whose value of the first part for the current encrypted packet is estimated further depending on the value of the estimated and checked first portion for a previous packet received from the same transmitting device (20).

Receiver device (30) according to one of claims 15 to 18, wherein the generation information corresponds to a generation date of the packet transmitted by the transmitting device (20) whose value of the first part is estimated and checked in addition to the date of receipt of said current encrypted packet by the receiving device (30).

21 - System (10) communication characterized in that it comprises at least one transmitting device (20) according to one of claims 5 to 8 and at least one receiving device (30) according to one of claims 15 to 20 .