Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
  • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Definitions

• the present invention relates to a method of personalizing a set of several second security modules, comprising a secure loading of an application key from a first security module to said second security modules of said set, said first and second modules each comprising at least one memory.
• the invention finds a particularly advantageous application during a phase of personalization of second security modules in fields such as the loyalty field or the banking field.
• Such a personalization process is carried out before a phase of using said second modules.
• the second modules are located in service station terminals and are used so as to provide services for securing loyalty debit-credit transactions between one of said terminals and user credit cards.
• the second modules are located in banking terminals and provide services for securing money transactions in users' credit cards.
• a state of the art known and disclosed in the American patent published under the number US 5,517,567 in the name of DAQ Electronics teaches that there is a key encryption system whose purpose is to secure communications that can be established between a second security module "master unit” and a third user module “remote unit” when the latter is installed in a remote site, for example in a mobile telephone. Said security is based on the use of a temporary communication key. According to this system, after the user module is installed on its remote site, a communication key is generated by means of the second module. Consequently, the encrypted communication key is sent for the establishment of each communication, from the second module to the user module. The communication key allows an exchange of secure messages between the second module and the user module because it is known only to these two modules.
• said key is based on a pair of two secret numbers unique to each user module and the second module includes all the pairs corresponding to all user modules.
• the system is all the more secure when a pair of two secret numbers is written to the memory of a user module, said memory being volatile.
• said pair is deleted and a fraudster is not likely to discover the two secret numbers.
• said system generates another communication key.
• a technical problem to be solved by the object of the present invention is to propose a method of personalizing a set of several second security modules comprising a secure loading of an application key from a first security module to said second security modules of said set, said first and second modules each comprising at least a memory, which would allow, on the one hand, to prevent a fraudster from discovering said application key, and, on the other hand, to save time during the phase of personalization of said second security modules.
• a solution to the technical problem posed is characterized in that said personalization process comprises the steps according to which: for each second module of said set,
• an operating key is calculated in the first module from information specific to the second module, a transport key and a diversification algorithm, said transport key being in the memory of the first security module, said memory being non-volatile,
• the application key is encrypted in the first module, from information comprising said operating key and an encryption algorithm, said application key being found in said memory,
• the operating key is calculated in the second module from information specific to the second module, the transport key and the diversification algorithm, said same transport key being in the non-volatile memory of each second security module of said set, said exploitation key not being recorded in the memory of said second module,
• the encrypted application key is decrypted in the second module, from information comprising said operating key and from an inverse decryption algorithm of the encryption algorithm.
• the loading method of the invention allows, by calculating said operating key and keeping it only for the time of encryption or decryption of the application key, to improve the security of loading an application key. Consequently, a fraudster will not be able to access said operating key or consequently the application key. Any fraud is therefore avoided and no more operations are carried out which are costly in time for the personalization phase, the time for calculating the operating key being tiny compared to the access time required for the registration of said key.
• FIG. 1 is a diagram showing a first module and several second modules belonging to the same assembly.
• FIG. 2 is a diagram showing the first module and a second module in FIG. 1.
• FIG. 3 is a diagram showing an exchange of data between the first module and the second module of FIG. 2.
• FIG. 4 a diagram showing a second exchange of data between the first module and the second module of FIG. 2.
• FIG. 5 is a diagram showing a third exchange of data between the first module and the second module of FIG. 2.
• FIG. 6 is a diagram showing a fourth exchange of data between the first module and the second module of FIG. 2.
• FIG. 1 shows a first safety module AS and several safety modules El from the same set S (not shown), each of the modules (AS, El) comprising at least one non-volatile memory M.
• the first module AS as well as the second modules El of said set S comprise the same transport key T and a same algorithm ALGO 1 called diversification algorithm which are found in the memory M.
• the module AS is represented as well as a module El of said set S.
• Each second module El of set S comprises the same transport key T.
• a set of second El modules is differentiated from another set by means of said transport key T.
• two sets of second El modules correspond to two different service station suppliers.
• the first module AS includes an application key TA and an ALGO2 encryption algorithm. Note that the two algorithms ALGO 1 and ALGO2 can use the same basic algorithm.
• Each module El of said set S comprises information SN which is specific to it and at least one user application (not shown), for example an application providing security services for loyalty debit-credit transactions.
• each second module El of said set S it is necessary for each second module El of said set S, to first load an application key TA of the first module AS during a phase known as personalization comprising the steps described below .
• Said key is transferred via a standard communication network.
• a fraudster who spies on said network or said modules is prevented from accessing the keys of the modules, as described below.
• a key Tl is calculated from the information SN specific to the second module El, the key T for transport and the algorithm ALGO 1 of diversification, said transport key T being in the memory M of the first security module AS, said memory being non-volatile.
• said memory M is a rewritable memory. Note that the key to transport T remains valid even during the phases of use of a second El module, as long as it is not replaced.
• the information SN specific to the second module El is not found in the first module. Also, as shown in FIG. 3, we send to the first module AS the information SN specific to the second module El, prior to the calculation in the first module AS of the operating key T1.
• Said first module AS preferably comprises several application keys TA.
• Said key T1 will be used to load one of the application keys TA contained in the first module AS, said selected application key will be encrypted and sent to the module El.
• An application key is associated with a user application. Depending on the application found in the second module El, the appropriate key is chosen.
• the first module AS is sent information REF1 relating to an application key TA, prior to encryption in said module AS of the application key TA and on chooses the application key TA to be encrypted from said information REF1.
• the application key TA is encrypted in the first module AS from information comprising said operating key T1 and from the encryption algorithm ALGO2. Said operating key is temporarily in a second volatile memory (not shown) of the first AS module.
• the operating key T1 is temporarily saved in said second volatile memory of the first module AS.
• the encrypted application key TA is decrypted in the second module El, from information comprising said operating key Tl and from an algorithm ALGO2P for reverse decryption of the algorithm ALGO2 for encryption.
• this step in order to find the application key TA chosen, it is necessary to use the same operating key Tl which was used for the encryption of said application key TA in the first security module AS.
• the operating key Tl is calculated in the second module El from the information SN specific to the second module El, the key T of transport and the ALGO 1 diversification algorithm, said same transport key T being in the non-volatile memory M of each second security module El of said set S, said operating key Tl not being recorded in memory M of a second module El.
• the memory M of the second module is rewritable.
• Said operating key T1 is temporarily saved in a second volatile memory (not shown) of the second module El. It will be noted that said calculation can be done at any time before the deciphering of the application key TA.
• the elements necessary for calculating the operating key Tl in the second security module El are the same as those used for calculating the operating key Tl in the first module AS. Consequently, the two keys Tl are identical and we find well in the second module El the TA application key chosen. It was not necessary to send the operating key Tl through the communication network.
• a fifth step after the decryption of the application key TA and preferably just after said decryption, the operating key T1 is erased temporarily saved in said second volatile memory of the second module El.
• this facilitates the personalization and setting in the field of a nth second module El insofar as to personalize the second modules it is no longer necessary to carry out two loads, the first of a Tl operating key and a second of a TA application key, but simply a loading of a TA application key.
• One thus frees oneself from the first loading which is usually carried out by an entity different from the first AS module, which generally complicates things even more.
• a module El preferably comprises several application keys TA.
• a second module El it is possible to manage several applications.
• this improves the security of said modules, given that a fraudster will have more difficulty, on the one hand, discovering an application key among others, and on the other hand, knowing that it is applying it. is dedicated.
• this must be able to provide different services such as securing debit-credit point transactions for, for example, different types of fuel. It is thus important to have different application keys TA in said module El to manage the security of these different types of transactions, the latter representing different applications.
• REF2 information is sent to the second module El relating to an application key TA, prior to the decryption in said module El of the encrypted application key TA, as shown in FIG. 4.
• the information REF2 allows, either choose the application key TA which will receive the value of the application key coming from the first AS module, or indicate a location where said TA key coming from said first AS module will be loaded.
• the second module El rejects the key received and indicates that an error happened. It will be noted that the information REF1 and REF2 sent respectively to the first and second security modules can be equivalent.
• one of the application keys TA located in the second module El may be used by said module to identify vis-à-vis external entities such as for example a user card .
• said identification must be unique. Consequently, said TA key must not have a duplicate.
• the second module El can now be used and be placed on a remote user site such as a service station terminal. It will be noted that no operating key T1 has been transferred from the first module AS to the second module El and has not been recorded in the memory M of the security modules. The operations necessary for these two actions are not carried out, which saves time during the personalization phase. Thus, a secret data item that is immediately usable by an algorithm is not stored, which prevents a fraudster who analyzes said algorithm from discovering said data. Thus, it is useless for the fraudster to spy on either the communication network or the security modules in order to find the operating key Tl used.
• Another advantage of the object of the present invention is that the information SN specific to each second security module El is unique.
• the operating key T1 which is diverse, that is to say calculated from this information, is therefore unique for each security module El. Consequently, the encrypted application key TA, which is a function of said operating key Tl, is only intended for a single second recipient module El which reinforces the security aspect of the invention. If a second module El does not have the same information SN as that used to calculate the operating key Tl in the first module AS and if it thus receives an application key TA which is not intended for him, he rejects said key and indicates that an error has occurred.
• the object of the present invention provides an additional step, shown in FIG. 4, according to which a random number R from the second module El is sent to the first module AS, prior to encryption in the first module AS of the application key TA.
• the use of the random number R to encrypt and decrypt said application key TA avoids having the same encryption value of an application key TA intended for a second module El when, for example, said load is loaded several times key in said module.
• each encryption of an application key TA intended for a second module El is unique.
• a fraudster who spies on the communication network and retrieves the DATA data during the transfer never obtains the same encryption value and therefore cannot discover a secret relating to the transferred application key TA.
• the fraudster may have carried out fraudulent operations which alter the data transferred. Also, it is checked that the DATA data comprising the encrypted application key TA are intact. To this end, as shown in FIG. 5, a CAS certificate is calculated in the first module AS on said DATA data, prior to the sending of said data, said certificate being subsequently sent to the second module El and verified in said second module, prior to decryption in said second module El of the encrypted application key TA. In order to perform the verification, an IEC certificate is calculated in the second module E1 as a function of the data received and the two CAS and IEC certificates are compared.
• the application key TA is authentic.
• a SAS signature of said key TA is calculated, said signature being subsequently sent to the second module El and verified in said module.
• the verification of the signature of said application key TA is done after decryption in the second module El of said encrypted TA key and prior to the recording of said key in said module.
• a SEI signature is calculated with the application key TA deciphered in said module El and the two signatures SAS and SEI are compared.
• the decrypted TA application key is authentic and is recorded.
• the application key TA is not authentic, the registration of said key is not done and the second module El indicates that an error has occurred.
• the system described above thus makes it possible to verify that we recover the TA application key chosen in the first AS module and not another key.
• the CAS certificate is also calculated according to said SAS signature. Said signature is part of the DATA data sent during the third step described above.
• Sending data such as a certificate or signature to a security module calls for operations whose completion time is added to that of the personalization phase. Also, as shown in Figure 6, in order to reduce the number of accesses to the different modules and thus reduce the personalization time, we send all the data that a security module needs in one go by means of '' a single order.
• the random number R, the number REF1 relating to an application key TA and the number SN specific to the second module El are sent to the first module AS by means of a single first command EXPORTKEY.
• the encrypted application key TA, the number REF2 relating to an application key TA, the SAS signature as well as the CAS certificate if they exist are sent to the second module El by means of a single second IMPORTKEY command.
• the invention applies more particularly in the case where the first AS security module is a smart card.
• the smart card comprises a plastic card body in which is incorporated an electronic module comprising an integrated circuit chip.
• Said chip commonly comprises two memories M and a third volatile memory (RAM), the first memory M being rewritable (EEPROM) and the second non-rewritable (ROM).
• the first memory M includes all of the application keys TA and the transport key T.
• the third memory includes the operating key T1.
• the ALGO1 diversification and ALGO2 encryption algorithms can be found in the first or second memory M. However, it will be noted that it is not compulsory to have said algorithms in the smart card. They can be located in an entity external to said smart card, for example in a central unit of a terminal with which said smart card would be connected.
• the smart card ensures better protection of the TA application keys.
• said keys are unknown to any entity (a terminal, an administrator of said card, another smart card, ... ) except from the entity issuing said keys.
• fraud is more difficult to carry out on a smart card than on a central unit of a terminal for example.
• the second security module is a smart card. It will be noted that an application key TA being in a non-volatile memory M, it can be used during several phases of use of a second module El, because even when the latter is no longer supplied, said key is not not deleted.

Applications Claiming Priority (3)

Publications (1)

Family

ID=9540953

Family Applications (1)

Country Status (4)

Cited By (1)

Families Citing this family (8)

Family Cites Families (6)

• 1999
  • 1999-01-18 FR FR9900462A patent/FR2788649A1/fr active Pending
• 2000
  • 2000-01-18 EP EP00900603A patent/EP1142193A1/de not_active Withdrawn
  • 2000-01-18 CN CN 00803434 patent/CN1199387C/zh not_active Expired - Fee Related
  • 2000-01-18 WO PCT/FR2000/000099 patent/WO2000042731A1/fr not_active Application Discontinuation

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events