Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
  • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
  • G06F21/629—Protecting access to data via a platform, e.g. using keys or access control rules to features or functions of an application
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
  • G06F21/77—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in smart cards
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
  • G06F21/88—Detecting or preventing theft or loss
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/355—Personalisation of cards for use
  • G06Q20/3552—Downloading or loading of personalisation data

Definitions

• the present invention relates to a portable electronic entity and a method of remotely blocking a functionality of such a portable electronic entity.
• the invention is particularly concerned with portable and removable electronic entities, preferably comprising a non-volatile memory and a microcontroller.
• portable and removable electronic entities consist of an electronic key called "USB” (acronym for "Universal Serial Bus” for universal serial bus), that is to say a key whose physical interface with a host computer is compliant to the USB specification, and able to communicate according to a protocol compliant with the USB specification, a microcircuit card, for example a microcircuit card compliant with the ISO7816 standard, or an MMC card (acronym for "MultiMedia Card”).
• Removable portable electronic entities are known that offer various features or services, for example:
• USB memory keys which can be connected to a host station for storing, for example, data stored by this host station,
• smart cards (compliant with the ISO7816 standard) that can, for example, be connected to a host station via a reader, or a USB key, to secure an internet transaction,
• the issuer or service provider who owns the portable electronic entity is able to revoke certain electronic entities, for example when a holder of an electronic entity has stopped paying his subscription or when an electronic entity has been lost or stolen.
• a typical solution for allowing this revocation is that the host stations on which the electronic entity connects to implement said functionality or provide said service or the servers that collaborate with the electronic entity to implement said functionality or provide said service can access "black" lists of portable electronic entities, which prohibit service or functionality for the revoked electronic entity.
• Such an approach has the disadvantage of requiring that the black lists of host stations and servers are frequently updated, which is expensive and sometimes impossible.
• a revoked electronic entity may continue to contribute to implementing said service in collaboration with a remote station or server whose blacklist has not yet been updated. The use of such a blacklist is not always feasible.
• a conventional solution is to send revocation messages to the electronic entity.
• a person attempting to fraudulently use the electronic entity may intercept and block said revocation messages by implementing, for example, the necessary means within the host station to which the electronic entity is connected.
• the present invention aims to remedy these disadvantages.
• the present invention provides a method for revoking and authorizing a feature of a portable electronic entity, which comprises: a step of determining the status of the electronic entity, by a server, from the identifier of said electronic entity, a step of sending to the electronic entity, by the server, according to said status, either of a message of revocation of said functionality, or of an authorization message of said functionality, said messages of revocation and authorization can not be distinguished, except by means of a secret memorized by the electronic entity,
• the authorization and revocation messages have the same length, in number of data transmitted. Thanks to these provisions, the length of the messages can not be used to distinguish them.
• said revocation step is irreversible.
• the revocation can, for example, revoke the authorization mechanism of at least one feature.
• the revocation step preferably renders inoperative the subsequent reception of an authorization message of the functionality.
• said revocation step renders the electronic entity completely unusable. Thus, there is no more risk that the electronic entity is used fraudulently later.
• said revocation step disables said functionality. Thanks to these provisions, the present invention can be used to suspend rights to services when the subscriber of these rights has not paid the amount of these subscriptions.
• the method as briefly described above comprises a step of connecting said electronic entity to a host station and a step of transmitting the identifier of the electronic entity from said portable electronic entity to the server, by via a communication network.
• said portable electronic entity is an electronic key known as "USB” (acronym for “Universal Serial Bus”), that is to say a key whose physical interface with a host computer is compliant with the USB specification, and able to communicate according to a protocol compliant with the USB specification.
• USB an electronic key known as "USB” (acronym for "Universal Serial Bus”)
• the step of determining the status is preceded by a step of sending an authorization request from the electronic entity to the server. Thanks to these provisions, the electronic entity, and therefore the issuer or the service provider owning the electronic entity can control the times at which the electronic entity can be revoked by the server.
• the step of transmitting a request includes a step of authenticating the electronic entity. Thanks to these provisions, server attacks are avoided by a falsified electronic entity.
• the step of issuing an authorization request takes place each time the electronic entity is powered up. It is thus sure that, as soon as the server is informed of the revocation of a feature on a portable electronic entity, it can no longer use this feature.
• the method as briefly described above includes a step of signing, by the server, each authorization or revocation message.
• These provisions prevent a virus or other malicious software on the host station may revoke one or all of the functionalities of the portable electronic entity.
• the method as briefly described above includes a step of encryption, by the server, of each authorization or revocation message. This provides a simple and easy way to make the authorization and revocation messages indistinguishable.
• the authorization and revocation messages recognized by the portable electronic entity are variable over time. Thus, they can be transmitted in the clear, but they have a different meaning over time, for example depending on the value of shared information, typically unknown to an attacker (for example, a counter of messages exchanged, messages authorization and revocation having, for example, inverted meanings when the counter is odd).
• the authorization and / or revocation messages are for single use only. Thus, they can only be used once, which prohibits the use of a copied message to trigger a subsequent authorization.
• an automatic launching of a communication application with the server is performed. This automatic loading can be carried out, for example, in the form of an application "autorun.exe” which starts automatically when the host station reads the contents of the portable electronic entity. In this way the application is easily launched without complex manipulation for the user.
• the present invention relates to a portable electronic entity, which comprises:
• a means of communicating an identifier means for producing, at least partially, a functionality
• a revocation means adapted to revoke said functionality if the message is a revocation message
• an authorization means adapted to authorize said functionality if the message is an authorization message.
• FIG. 1 represents, schematically, an embodiment particular of the electronic entity object of the present invention connected to a host station and to a remote authorization server and
• FIG. 2 represents, in the form of a logic diagram, the steps implemented in a particular embodiment of the method that is the subject of the present invention.
• FIG. 1 shows a server 100 holding a database 110 of portable electronic entity statuses and connected to a communication network, or computer network 130, for example the Internet.
• a server 120 implements services accessible to carriers of portable electronic entities.
• a host station 140 is also connected to the network 130 and, via a connector 150, to a portable electronic entity 160 object of the present invention.
• the host station 140 is, for example, a general purpose computer, or personal computer.
• the portable electronic entity 160 comprises, in addition to a portion of the connector 150, a hub 165, a microcontroller 170, a non-volatile memory 175.
• the microcontroller 170 includes a memory (not shown) retaining at least one secret necessary to decrypt a message and / or verify its signature, for example in the form of cryptographic keys.
• the memory 175 retains a program 180 implementing, in collaboration with the microcontroller 170, connection and / or transaction securing.
• the program 180 also implements functionalities of the portable electronic entity 160, for example banking transaction functionalities.
• the memory 175 also retains an electronic address 185 of the server 100 and an identifier 190 of the portable electronic entity 160.
• the hub 165 allows the communication of the host station with, on the one hand, the microcontroller 170 and, on the other hand, the nonvolatile memory 175.
• the microcontroller 170 is of secure type, such as, for example a chip card microcontroller and includes an EEPROM memory (not shown). If it is secure, preferably the microcontroller complies with FIPS security requirements (acronym for "Federal
• the non-volatile memory 175 is, for example, a flash memory.
• the memory 175 is associated with a controller simulating a compact disc player, or CD-ROM.
• the program 180 and the server 120 correspond, for example, to at least one functionality of banking applications, mobile telephony, identification, access an online service (voice over IP, for example) or pay television.
• the program 180 is preferably of automatic launching type as soon as the portable electronic entity is powered via the connector 150.
• the program 180 is, for example, of type
• the program 180 is preferentially available in the memory 175 of the portable electronic entity 160, in several versions adapted to operate on different types of host station 200, for example with different operating systems.
• the program implements cryptographic means.
• the e-mail address 185 of the server 100 is, for example, a URL (acronym for "Universal Resource Locator” for universal resource locator).
• the identifier of the portable electronic entity 190 is a unique identifier, that is to say that there are no two portable electronic entities that have the same identifier.
• the portable electronic entity 160 is directly connected to the server 100 via a passive host station, for example of the portable electronic entity reader type.
• the portable electronic entity 160 includes, for example, a contactless communication interface, preferably a short-range contactless contact interface. It can thus be a contactless smart card or dual interface (both non-contact and contact interface) for example in accordance with the IS014443 standard.
• the portable electronic entity may also be a passport comprising in the thickness of its cover a secure microcontroller provided with contactless communication means in accordance with the ISO14443 standard. Communication with such an electronic entity can be achieved using the contactless interface, or the contact interface if the electronic entity also includes one.
• the network 130 is a mobile communication network.
• the portable electronic entity may be, for example, a USB key, a smart card or an MMC card.
• FIG. 2 shows that, upon connection of the portable electronic entity 160 to the host station 140, step 205, the portable electronic entity is powered by the host station during a step 210.
• the program 180 automatically loads into the memory of the host station 140, possibly after a selection, for example depending on the operating system of the host station 140.
• the program 180 automatically starts on the host station 140.
• the loading and automatic launching of the program 180 can be performed, for example, in the form of an "autorun.exe" application which is automatically launched when the host station 140 accesses the contents of the portable electronic entity 160. In this way the program 180 is easily launched without complex manipulation for the user.
• the program 180 launched on the host station 140 connects to the server 100, implementing the e-mail address 185 of the server 100.
• the program s' authenticates by implementing its cryptographic means and those of the portable electronic entity 160. With the authentication of the portable electronic entity 160, it is avoided, at the server 100, attacks by a falsified or simulated electronic entity.
• the program 180 launched on the host station 140 sends, to the server 100, an authorization request for use of at least one feature, this request representing the identifier 190.
• the server performs a search, in the database 110, of the status of each required functionality for the portable electronic entity, by implementing the identifier 190.
• the server determines whether the status of the required functionality of the portable electronic entity is "authorized” or "revoked”. If the status is "revoked", during a step 245, the server 100 sends to the microcontroller 170, via the network 130 and the program 180 launched on the host station 140, a response formed of a message of signed and encrypted revocation.
• the microcontroller 170 verifies the signature of the server 100. For example, the server uses a private key whose portable electronic entity knows or can know the public key. It is observed that, thanks to the signature of the messages, it is avoided that a virus or another malicious software present on the host station 140 can revoke one or all the functionalities of the portable electronic entity 160.
• the microcontroller 170 decrypts the received message. For example, the server uses a public key whose portable electronic entity retains the associated private key. Then, during a step 255, the microcontroller 170 interprets the received message, that is to say determines whether it means a revocation, as in this case, or authorization. In the case where, as here, it is a revocation, the microcontroller 170 writes in its EEPROM, verified at each power up, a binary information representative of a "revoked" status of each required functionality. The microcontroller 170 then sends the program 180 a message blocking each revoked feature. In the case where all the features of the program 180 are revoked, the microcontroller no longer responds to the messages that are transmitted to it. More generally, according to the embodiments, the revocation step:
• the server 100 sends to the microcontroller 170, via the network 130 and the program 180 launched on the host station 140, a response consisting of a signed and encrypted authorization message.
• the microcontroller 170 verifies the signature of the server 100 and, if the signature is valid, performs the decryption of the received message.
• the microcontroller 170 interprets the message received, that is, ie determines whether it means an authorization, as in this case, or a revocation.
• the microcontroller 170 writes, in the memory 175, a binary value allowing the implementation of the functionality and, for example, the provision of digital content. , or access to another service, through the server 120.
• the authorization and revocation messages have the same length, in number of data transmitted.
• step 230 allows the electronic entity and, therefore, the issuer or the service provider owning the electronic entity, to control the times at which the electronic entity can be revoked by the server. .
• the electronic entity instead of sending a request to the server 100 at each launch of the program 180 on the host station 140, the electronic entity keeps, in memory, a counter of the number of implementations of a feature that is incremented or decremented at each of these implementations. This counter is, for example, initialized, after each procedure in this authorization variant exposed with reference to FIG. 2, to such a value that, after one day, the number of authentication will not be exhausted, but probably exhausted after, say, a week.
• a server of a mobile communication network may send authorization messages that cause the counter reset or a revocation message, for example every day.
• the revocation and authorization messages can not be distinguished, except with the aid of a secret stored by the secure electronic entity.
• the authorization and revocation messages may be masked by steganography methods.
• the authorization and / or revocation messages are for single use, that is to say they can only be used once, which prohibits the use of a copied message to trigger subsequent authorization.
• the portable electronic entity generates a pseudo-random code and transmits it to the server, in the request sent to the during step 230, the server using this code to generate the message transmitted in response.
• the interpretation of the messages made during steps 255 and 270 is such that the authorization and revocation messages considered or recognized by this portable electronic entity 160 are variable over time. Thus, they can be transmitted in the clear, but they have a different meaning over time, for example according to the value of shared information, typically unknown to an attacker (for example, a counter of messages exchanged, messages authorization and revocation having, for example, inverted meanings when the counter is odd).
• the portable electronic entity 160 expects, in order to implement a feature, an authorization message from an authorization server 100 and you can not distinguish a revocation message from an authorization message. It is therefore impossible to prevent the receipt of the revocation messages by the electronic entity without prohibiting the use of a feature by this portable electronic entity. It is observed that the use of the revocation messages makes it possible to limit the risks associated with attacks, in particular the attacks consisting in trying to fraudulently authorize the functionality.

Applications Claiming Priority (2)

Publications (1)

Family

ID=38123749

Family Applications (1)

Country Status (3)

Families Citing this family (2)

Citations (2)

Family Cites Families (4)

• 2006
  • 2006-11-02 FR FR0654698A patent/FR2908194B1/fr not_active Expired - Fee Related
• 2007
  • 2007-10-24 WO PCT/FR2007/001754 patent/WO2008053095A1/fr active Application Filing
  • 2007-10-24 EP EP07866428A patent/EP2084679A1/de not_active Ceased

Patent Citations (2)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events