EP1371035A1

EP1371035A1 - Verification of access compliance of subjects with objects in a data processing system with a security policy

Info

Publication number: EP1371035A1
Application number: EP02713020A
Authority: EP
Inventors: Christophe Bidan; Mireille Pauliac
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Thales DIS France SA
Priority date: 2001-03-13
Filing date: 2002-03-08
Publication date: 2003-12-17
Also published as: US20040172370A1; FR2822256B1; CN1507608A; CN1507608B; FR2822256A1; WO2002073552A1

Abstract

The invention relates to access rules (R) of compliance of subjects (Su) with objects (Ob) with a predetermined security policy (PS) in a data processing system such as a chip card. Each access rule defines the right of a subject to carry out an action on an object. The security policy defines the security rules (RS) for access of the subjects to the objects. For an operation relating to a given object (Ob), at least one access rule relating to the given object is compared with the security rules in order to accept the operation when the access rule is in compliance with all the security rules; if this is not the case, the operation is refused. An operation can be the loading of an object such as an application, a modification of the access rules, or deletion or addition of a subject (s) or a request for access to a given object by a subject or a group of subjects.

Description

CHECKING THE CONFORMITY OF SUBJECT ACCESS OF OBJECTS IN A DATA PROCESSING SYSTEM WITH A SECURITY POLICY

The present invention relates generally to the verification of the conformity of access conditions by first elements to second elements with security rules defining a security policy. The first 0 elements are subjects constituting users or software modules of a data processing means. The second elements are objects such as applications implemented in the data processing means. More particularly, the invention relates to conditions of access to applications implemented in a smart card, also known as a microcontroller or integrated circuit card, which comprises several applications relating to various services, such as 0 applications of electronic commerce, electronic wallet, loyalty service, etc.

The invention is therefore particularly directed towards the compliance of any operation relating to an application in a multi-application smart card 5 with security rules. The operation can be a loading or a modification of the application, or modifications of the conditions of access to the application, or even a request for access to the application to perform an action on it. 0

The coexistence and cooperation of several applications within the same smart card raises many problems from a security point of view. In particular, each application has its own 5 data for which the provider the application defines access rights specific to the application. Access rights are means of connection between external accesses which can be users of the card or else software modules, such as user interfaces, and internal accesses to the card such as applications, possibly via the through other applications or other application software elements in the card. Control of access conditions is based on the authentication of subjects, such as users, which are "active" elements which manipulate information contained in objects, such as applications, which are "passive" elements containing data. The access rights of subjects to objects are governed by access control rules between subjects and objects. Each rule includes a right of access, i.e. a link between a subject and an object in the form of an action which can be performed by the subject on the object.

It is known to represent the access rights of subjects to objects by an access matrix MA whose columns correspond to subjects and whose rows correspond to objects, as shown in FIG. 1. For example, the matrix MA relates to three subjects SI, S2 and S3, such as three users, and to three objects 01, 02 and 03, such as files and programs. Each box of the matrix at the intersection of a row and a column contains access rights, that is to say privileged actions which can be performed by the respective subject on the respective object.

The access rights can be positive to authorize a predetermined action of a subject on a object, or can be negative to prohibit a predetermined action of a subject on an object. For example, subject S2 can read and execute object 02 but cannot write to this object, and subject S3 can record and read object 03 but cannot execute object 03.

As is known, access control rules are generally treated according to two approaches. The first approach consists of access control lists ACL (Access Control List) corresponding to the rows of the access matrix MA and each specifying the access rights of subjects to the object associated with the row. For example, in a multi-application smart card of the WINDOWS type (registered trademark), ACL access control lists define user access to files included in the card.

Conversely, the second approach consists of capacities corresponding to the columns of the MA matrix and each specifying the access rights of the subject associated with the column on the objects. For example, access control relates to applet methods for multi-application smart cards of the JavaCard type in which programs in Java language have been written. The capacities are in the form of pointers making it possible to make calls to objects, in predetermined applets constituting subjects.

In the field of microcontroller cards, the notion of security policy is generally omitted. Indeed, the cards being hitherto generally mono-application, this imposes a single security policy of reasonable size to ensure that the access rights correspond to the wishes of the developer responsible for defining access rights.

As already specified, the access rights are expressed in the form of access control rules. It is then necessary to verify and guarantee that the access rights are complete and consistent with respect to a policy, that is to say that they offer at least two properties, completeness and consistency. The completeness of the access right ensures that for any subject and any object, there is at least one access right specifying whether the subject is authorized or not to access the object. The consistency of the access rights guarantees that for any subject and any object, if several access rights to the object are defined, the access rights all specify the same type of positive or negative right. The completeness of access rights vis-à-vis a security policy ensures that access rights define all the rights specified by the security policy. The consistency of access rights vis-à-vis a policy ensures that access rights are limited to those defined by the security policy and do not define more rights. Currently in multi-application cards, the completeness and consistency properties of access rights with a security policy cannot be checked. The developer in charge of defining access rights is therefore unable to verify that the specified access rights correspond to the rules of the desired security policy.

The introduction of multi-application cards complicates the problem of the coexistence of several applications and therefore the coexistence of several security policies, cooperation between applications further increasing the complexity of policies.

The present invention aims to provide a method for verifying the conformity of the access rights of several subjects to several objects, such as applications in a multi-application card, with a global security policy which is implemented by the card manager who can be a different person from the developer of each application. This process thus guarantees the completeness and consistency of the access rights vis-à-vis a security policy: the access rights define all the rights specified by the security policy according to the completeness property, and are limited to these security policy rights depending on consistency property.

To achieve this objective, a method for verifying a set of access rules from first elements to second elements in a data processing system, each rule defining a right of a first element to perform an action on a second element, is characterized in that it comprises, a definition of security rules for the access of the first elements to the second elements, and for each operation relating to a second given element, a comparison of at least one access rule given to the second element given with the security rules so as to accept the operation when the access rule complies with all the security rules and to report the non-conformity of the operation when the access rule does not comply with one of the security rules.

As will be seen below, the first elements are for example subjects such as users, and the second elements are for example objects, such as applications in a multi-application smart card included in the processing system. data.

According to a first embodiment, the data processing system comprises a portable electronic object in which at least the second elements are installed, and a security means external to the portable electronic object in which the security rules are installed and which performs the comparison.

According to a second embodiment, the data processing system is a portable electronic object in which at least the second elements and the security rules are installed and which performs the comparison.

Other characteristics and advantages of the present invention will appear more clearly on reading the following description of several preferred embodiments of the invention with reference to the corresponding appended drawings in which:

- Figure 1 is a diagram showing a control matrix between three subjects and three objects, already commented on according to the prior art

- Figure 2 is a schematic block diagram of a data processing system for the implementation of the conformity control method according to a first embodiment of the invention; and - Figure 3 is an algorithm of the compliance verification method according to the invention.

An electronic data processing system as illustrated in FIG. 2 comprises a portable electronic object such as a smart card CA and a terminal TE equipped with a keyboard CL and a reader LE for reading the data in the menu. The CA card "chip" is a microcontroller comprising a microprocessor PR and three memories MO, MNV and MA. The MO type ROM memory includes an operating system OS of the card. The MNV memory is a non-volatile memory of the programmable and erasable type, like an EEPROM memory. The memory MNV contains data notably linked to the possessor and the supplier of the card and in particular AP applications constituting objects within the meaning of the invention and data linked to access to AP applications, such as access rules R and Su subjects. The memory MA is of the RAM type and intended in particular to receive data from the terminal TE of the card. All the components PR, MO, MNV and MA are linked together by an internal bus BU. When the card CA is inserted into the reader LE of the terminal TE, the bus BU is connected to the terminal TE through a contact link LI when the card is of the type with electrical contacts.

According to this first embodiment, a security policy defined by security rules RS relating to all the applications AP in the smart card CA is pre-stored in the terminal TE. For example, the TE terminal belongs to the distributor of the smart card, which may be different from each application developer responsible for definition of access rules for at least one respective application.

As a variant, the terminal containing the security rules and verifying the compliance of the access rules with the security rules is a server connected by a telecommunications network to a reception terminal of the smart card.

According to a second embodiment, instead of the security policy PS being implemented in the terminal TE, the security rules RS defining the security policy are installed in the ROM memory MO of the smart card CA which constitutes the processing system for data.

The description below of the conformity verification method according to the invention is valid equally for these two embodiments presented above.

The embodiments described below of the method for verifying the conformity of access of subjects to objects with a security policy refer to the following five sets:

- a set of object EO = {01, ... Ob, ... OB} with 1 <b <B, - a set of subject ES = {SI, ... Su, ... SU} with 1 <u <U relating to subjects each having at least one access to a given object Ob,

- a set of subject group EG = {G1, ... Gp, ... GP} relating to subjects each having at least one access to the object Ob, a subject in a group having all the access rights granted to this group, and a subject that can belong to one or more groups,

- a set of access right rule ER = {RI, ... Re, ... RE} with 1 <e <E governing access subjects from the set ES and groups from the set EG to the given object Ob, and a set of security rules RS applicable to all the subjects from the set giving access to the object Ob and rules from security RS1 to RSP applicable respectively to groups Gl to GP to access the object Ob.

If R (or RS) designates a right, that is to say an action such as reading, writing, execution or recording, which can be performed by any subject Su on any given object Ob, access control is governed by the following rules of positive law:

- (SuROb): the subject Su has the right R on the object Ob, that is to say is authorized to perform the action R on the given object Ob;

- (GpROb): the subjects of the group Gp have the right R on the object Ob; as well as by the following negative law rules: - no (SuROb): the subject Su does not have the right R on the given object Ob, that is to say is prohibited to perform the action R on the Ob object;

- no (GpROb): subjects in the Gp group do not have the R right on the Ob object. In the following, we will call "direct right" of the subject Su on the object Ob, a right obtained directly by the rule (SuROb), that is to say without going through a group; and "indirect right" of the subject Su on the object Ob, a right obtained by the rule (GpROb) through a group Gp in which the subject Su is included.

Referring now to Figure 3, the compliance verification method mainly comprises steps ET1 to ET8. At the start of the method, a first initial step ET1 defines a security policy PS which includes security rules RS which are common to all the objects 01 to OB of the set EO as well as security rules respectively for groups of subject predetermined and predetermined objects, and in particular for the groups G1 to GP associated with the given object Ob. The security policy is implemented in the terminal TE, or in the memory MNV of the smart card CA.

The second initial step ET2 defines the four groups ES, EO, EG and ER to implement them in the memories MO and MNV of the smart card CA.

The next step ET3 concerns the triggering of an operation on the given object Ob. This operation can be the loading of the given object Ob, for example as a new application, into the EEPROM memory MNV of the card CA, including the access rules specific to the application defined in a previous step ET2 and written in the MNV memory, or a modification of the access rule relating to the given object Ob. The modification of an access rule can be a deletion or an addition of an access rule relating to a subject Su or a group Gp and of course to the given object Ob. The operation on the given object Ob can simply be a request for right access to the object given by a subject Su or a group Gp of the type (SuROb) or (GpROb), or a modification of one or several subjects or a group having access to the given object Ob, that is to say a deletion or an addition of one or more subjects or a group.

Verification of conformity proper by comparison of access rules relating to the object given Ob to all security rules starts at step ET4. As a variant, this conformity check is carried out periodically, for example every twenty four hours when the smart card CA is used, or else all the M operations relating to the given object Ob, where M denotes an integer at least equal to 2 .

In general, according to a first embodiment, all the positive and negative access rules Re relating to the given object Ob and to any subject Sq for a direct right or to any group Gp for an indirect right have their conformity checked against all security rules RS and RSp whatever the index p defined by the security policy for the object Ob, as indicated in steps ET81, ET82, ET83 and ET9 which then directly follow the step ET4 through a negative response to intermediate step ET6 or after step ET7. In practice, the verification of the compliance of an access rule results from a comparison of this rule with each of the security rules. For example, a security rule common to all subjects and groups relating to the Ob object may be a write ban on the Ob object, and an RSp security rule for the Gp group may be an authorization to read the object given Ob by all the subjects belonging to the group Gp.

However, according to other embodiments, the method distinguishes operations relating only to a subject Su, such as a request for direct access from the subject Su to the object Ob or an addition of the subject Su, in step ET5, and a operation relating only to a given group Gp, such as a request for indirect access to the given object Ob or an addition or deletion of the subject or modification of the law relating to the Gp group, as indicated in step ET6. If none of the conditions of steps ET5 and ET6 is satisfied, the method goes directly from step ET4 to step ET81 already commented on.

When the operation is related only to a subject Su and the object Ob, the ST5 is followed by a step in ET7 ^• Gp which all groups that contain the subject Su are detected. In this embodiment, step ET81 is replaced by step ET82 which checks the conformity of all the positive and negative access rules relating to the given object Ob and directly to the subject Su or indirectly to the groups Gp containing the subject Su . These access rules are compared with all the common security rules RS and with the security rules RS1 to RSp and in particular relating to the group Gp in step ET9. By means of steps ET7 and ET82, the method thus verifies that the capacity of a subject Su relative to the given object Ob complies with the security policy PS.

When the operation on the given object Ob relates only to a group of subject Gp in step ET6, all the access right rules of positive type (GpROb) and negative non (GpROb) have their conformity verified by comparison with all the common security rules RS and the security rules RS1 to RSp relating to all the groups, and particularly relating to the given group Gp, at a step ET83. Through steps ET6 and ET83, the method thus verifies that the access control list concerning all the access rights of the subjects in a given group Gp is in accordance with the security policy PS. If after the step ET81, or ET82 or ET83, the compared access rules do indeed comply with the security rules, the operation requested in step ET3 is accepted in step ET10, and the method returns to step - ET3 for a conformity check relating to another operation on the Ob object, or to an operation on another object.

On the other hand, if at least one of the access right rules compared and defined in one of the steps ET81, ET82 and ET83 does not comply with one of the security rules in step ET9, l step ET11 refuses the operation requested in step ET3, and the method then returns to step ET3. The refusal of the operation requested in step ET11 may be accompanied by a rejection of the smart card CA, or a deletion of the access right rule or rules which did not comply with the rules of security.

As an example, it is assumed that a first group G1 composed of subjects SI and S2 has only read access rights to the given object Ob, a second group G2 composed of subjects S2 and S3 does not have that the write access right on the Ob object, and that the two groups Gl and G2 are authorized to execute the Ob object such as an application. Furthermore, step ET1 defines two security rules RS1 and RS2. According to the first rule RS1, the group Gl is not authorized to write on the objects of the set EO, and therefore including on the given object Ob. According to the second RS2 security rule, group G2 is not authorized to read objects from the EO assembly.

For this example, steps ET6 and ET83 of the method according to FIG. 3 are carried out. A Gl group read access request appear in step ET9 a conformity for the subject SI belonging only to the group Gl between the read access rule of the group Gl and the security rule in prohibition of writing of the group Gl, and a conformity for the subject S3 between the group G2 write access right rule and the group G2 read prohibition security rule. On the other hand, step ET9 signals a lack of conformity for the subject S2 which belongs to both the groups Gl and G2. For subject S2, the read access right rule relating to the group Gl does not comply with the read prohibition security rule for the group G2, and the write access right rule for the group. G2 does not comply with the Gl group write security prohibition rule. The step ET11 then proceeds to the removal of the read and write access rights of the subject S2 which retains only the access right in execution in common with the other subjects SI and S3.

Although FIG. 3 relates to the conformity of operations on a given object Ob, more generally, any operation relating to any of the objects 01 to OB of the set EO can cause a verification of conformity general of all access control lists and capacities relating to all objects 01 to OB in relation to all the security rules of the security policy. Such a general compliance check is preferably carried out at least during the commissioning and personalization of the CA smart card.

Claims

1 - Method for verifying the conformity of access rules (Re) respectively defining rights authorizing and / or prohibiting first elements (Su), such as users, to perform actions on second elements (Ob), such as applications installed in a portable electronic object (CA), with security rules (RS) limiting the access rules from the first elements to the second elements, characterized in that it comprises, for each operation (ET3) relating to a second given element (Ob), such as in particular a loading of the second given element (Ob) or a modification of access rule relating to the second given object in the portable electronic object (CA), a comparison (ET81, ET82, ET83 , ET9) of at least one access rule (Su / GpROb) to the second element given with the security rules (RS) so as to accept (ET10) the operation when said access rule (R) complies at t all security rules and to report the non-compliance of the operation when said access rule does not comply with one of the security rules.

2 - Method according to claim 1, according to which said operation (ET3) is either a deletion or an addition of an access rule (R) relating to the second given element, or a deletion or an addition of a first element (Su) or several first elements (Gp) having access to the given object

(Ob), or a request for access to the given object (Ob) by a first element (Su) or by a group (Gp) of first element. 3 - Method according to claim 1, according to which, when the operation (ET5) relates only to a first given element (Su) and to the second given element (Ob), the comparison (ET82) consists in comparing all the rules access (SuROb, Gp (Su) ROb) relating to the first given element (Su) and the second given element (Ob) with all the security rules (RS).

4 - Method according to claim 1, according to which some of the first elements each belong to one or more groups of first element (Gp), a first element in a group having all the access rights granted to the group, characterized in that , when the operation (ET6) relates to a given group of first element (Gp), the comparison (ET83) consists in comparing all the access rules (GpROb) relating to the given group and to the second given element (Ob) with all safety rules (RS).

5 - Process according to any one of claims 1 to 4, according to which the comparison (ET81, ET82, ET83, ET9) is carried out periodically.

6 - Method according to any one of claims 1 to 5, according to which the security rules (RS) are implemented in a security means (TE) which is external to the portable electronic object (CA) and which performs the comparison ( ET81, ET82, ET83, ET9).

7 - Method according to any one of claims 1 to 5, according to which the security rules (RS) are implanted in the object portable electronics (CA) which performs the comparison (ET81, ET82, ET83, ET9).