EP3053082A1 - Method for securing a terminal - Google Patents

Method for securing a terminal

Info

Publication number
EP3053082A1
EP3053082A1 EP14787228.7A EP14787228A EP3053082A1 EP 3053082 A1 EP3053082 A1 EP 3053082A1 EP 14787228 A EP14787228 A EP 14787228A EP 3053082 A1 EP3053082 A1 EP 3053082A1
Authority
EP
European Patent Office
Prior art keywords
mem
desc
securing
terminal
meth
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP14787228.7A
Other languages
German (de)
French (fr)
Inventor
Denis OLIER
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Avantix SAS
Original Assignee
Time Reversal Communications
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Time Reversal Communications filed Critical Time Reversal Communications
Publication of EP3053082A1 publication Critical patent/EP3053082A1/en
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

  • the present invention relates to the field of software, and more particularly to the securing of terminals, including mobile terminals of "Smartphone” type, including terminals operating under the Android operating system. More specifically, the invention relates to a method for securing a mobile terminal.
  • a process that is, a program running on a terminal, uses resources that are allocated to it.
  • the resources include areas of RAM and handles (in English "handle") of files or databases.
  • the resources are vulnerable, that is, potentially accessible by an attacker.
  • An attack is particularly difficult to detect when the terminal is locked (a lock is for example made manually by a user or automatically after a certain period of inactivity of the terminal).
  • a lock is for example made manually by a user or automatically after a certain period of inactivity of the terminal.
  • it is known to stop the processes.
  • each process saves in a flash memory of the terminal the resources it uses, and ends.
  • the data in the RAM areas used by the processes are erased.
  • the processes are restarted and the data is restored using the data saved in the flash memory.
  • the object of the invention offers a solution to the problem mentioned above, by proposing a method of securing the resources allocated to the processes executed on a terminal, when said terminal is in a locked state.
  • the invention therefore essentially relates to a method of securing a terminal.
  • the method comprises the following step: following a locking of the terminal, for each process of a list of processes executed by the terminal:
  • the method is implemented by a kernel of an operating system installed on the terminal.
  • the operating system is for example Android.
  • the processes in the list are not stopped, but their execution is interrupted.
  • the kernel scheduler has been modified to manage a new possible state for each process (named "frozen” later). As long as the process is in this new state, the scheduler does not give it a hand and the process does not run.
  • the resources that the processes in the list use are secure. Thus, in case of attack, the attacker will not get any intelligible data.
  • the security method according to the invention may have one or more additional characteristics among the following, considered individually or in any technically possible combination:
  • resources allocated to a process include a RAM area, and the protection includes an encryption of said RAM area.
  • the method comprises, following the encryption step: erase RAM an encryption key used during encryption.
  • resources allocated to a process include a file or database descriptor, and the protection includes closing said descriptor.
  • the databases and / or files used by the processes in the list are rendered inaccessible.
  • the method comprises a preliminary step of updating the process list, comprising: following receipt of a notification of a process, adding said process to the list of processes.
  • Process notifications are received by the kernel of the Android operating system.
  • Process notifications are issued by a protection process named "Protection Manager" in English.
  • the Protection Manager indicates to the kernel the processes on which the securing method according to the invention is to be implemented.
  • issuing a notification of a process depends on an initial setting of said process. Indeed, not all processes are concerned by the security method according to the invention. By concern, one intends to be in the list of processes mentioned above. Only pre-configured processes for securing are concerned. At startup a process is not in the process list; if the Protection Manager detects that said process is configured to be concerned with the security method according to the invention, then the Protection Manager notifies the kernel, which will add it to the protection list. process.
  • the method comprises: following an unlocking of the terminal: making said process eligible for execution and removing the protection on the previously protected resources.
  • the resources allocated to a process comprise a RAM area
  • the deletion of the protection includes a decryption of said RAM area
  • the resources allocated to a process include a file or file descriptor database, and the removal of the protection includes an opening of said descriptor.
  • Figure 1 is presented for guidance and in no way limitative of the invention.
  • Figure 1 shows steps of a method of securing a terminal according to a non-limiting embodiment of the invention.
  • FIG. 1 shows steps of a method METH for securing a terminal according to a non-limiting embodiment of the invention.
  • the terminal is of the Smartphone type, and operates under the Android operating system, which includes a kernel.
  • the kernel includes a scheduler (in English "scheduler"), choosing the order of execution of the processes of the terminal.
  • the scheduler is adapted to manage process states, including:
  • a PR process executed on the terminal is preconfigured to be concerned or not by the method of securing METH according to the invention. If the process PR is concerned with the method of securing METH, then following an LK lock of the terminal, resources MEM, DESC it uses are protected. A PR_PM configuration parameter is therefore associated with each PR process.
  • the PR_PM configuration parameters of the PR processes can be analyzed by a Protection Manager protection process.
  • the protection process analyzes the PR_PM configuration parameter associated with said PR process. If the configuration parameter PR_PM indicates that the process PR is concerned with the method of securing METH according to the invention, then the protection process sends a notification to the kernel. It will be said that the protection process tells the kernel that a protection mechanism must be activated on the PR process in question.
  • the kernel On receipt of NO_REC notification on a PR process, the kernel adds the process to a LI_PR list. The list LI_PR is thus updated at each reception NO_REC notification. When the terminal changes from the unlocked state to the locked state, the list LI_PR contains all the started PR processes on which the protection mechanism must be activated.
  • the scheduler places the processes (PR) in the list (LI_PR) in the "frozen” state. Then, the kernel activates a protection on the resources MEM, DESC of the processes PR of the list LI_PR. More precisely, areas of memory MEM fast allocated to the processes PR of the list LI_PR are encrypted MEM_ENC. In addition, the KM encryption key used is deleted KM_ERZ RAM at the end of encryption MEM_ENC. In addition, DESC descriptors of files or databases used by the PR processes of the list LI_PR are closed, that is to say erased. Thus, no sensitive data is accessible or exploitable. In the event of an attack, no intelligible data will be usable.
  • the scheduler places the processes (PR) of the list (LI_PR) in the "idle" state: these processes are then again eligible for execution. Then, the protection on the PR process resources of the LI_PR list is removed by the kernel.
  • the kernel decrypts MEM_DESENC MEM previously encrypted RAM areas and reopen DESC_OP DESC descriptors.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a method (METH) for securing a terminal, characterised by comprising: after locking (LK) the terminal, for each process (PR) of a list of processes (LI_PR) executed by the terminal: making said process (PR) ineligible for execution; and protecting (MEM_ENC; DESC_CLZ) resources (MEM; DESC) allocated to said process (PR).

Description

PROCEDE DE SECURISATION D'UN TERMINAL DOMAINE TECHNIQUE DE L'INVENTION  METHOD OF SECURING A TERMINAL TECHNICAL FIELD OF THE INVENTION
La présente invention se rapporte au domaine logiciel, et plus particulièrement à la sécurisation des terminaux, notamment des terminaux mobiles de type « Smartphone », notamment des terminaux fonctionnant sous le système d'exploitation Android. Plus précisément, l'invention concerne un procédé de sécurisation d'un terminal mobile.  The present invention relates to the field of software, and more particularly to the securing of terminals, including mobile terminals of "Smartphone" type, including terminals operating under the Android operating system. More specifically, the invention relates to a method for securing a mobile terminal.
ARRIERE PLAN TECHNOLOGIQUE DE L'INVENTION BACKGROUND OF THE INVENTION
Un processus, c'est-à-dire un programme en cours d'exécution sur un terminal, utilise des ressources qui lui sont allouées. Les ressources sont notamment des zones de mémoire vive et des descripteurs (en anglais « handle ») de fichiers ou de bases de données. Lorsque le processus est en cours, les ressources sont vulnérables, c'est-à-dire potentiellement accessibles par un attaquant.  A process, that is, a program running on a terminal, uses resources that are allocated to it. The resources include areas of RAM and handles (in English "handle") of files or databases. When the process is in progress, the resources are vulnerable, that is, potentially accessible by an attacker.
Une attaque est particulièrement difficile à déceler lorsque le terminal est verrouillé (un verrouillage est par exemple réalisé manuellement par un utilisateur ou encore automatiquement au bout d'une certaine durée d'inactivité du terminal). Afin de protéger les ressources des processus lorsque le terminal est verrouillé, il est connu d'arrêter les processus. Dans ce cas, chaque processus sauvegarde dans une mémoire flash du terminal les ressources qu'il utilise, et se termine. Les données dans les zones de mémoire vive utilisées par les processus sont effacées. Quand le terminal est déverrouillé, les processus sont redémarrés et les données sont restaurées en utilisant les données sauvegardées dans la mémoire flash. An attack is particularly difficult to detect when the terminal is locked (a lock is for example made manually by a user or automatically after a certain period of inactivity of the terminal). In order to protect the process resources when the terminal is locked, it is known to stop the processes. In this case, each process saves in a flash memory of the terminal the resources it uses, and ends. The data in the RAM areas used by the processes are erased. When the terminal is unlocked, the processes are restarted and the data is restored using the data saved in the flash memory.
Ce procédé présente plusieurs inconvénients : This process has several disadvantages:
Les durées d'écriture et de lecture de la mémoire flash sont relativement longs ; Il est difficile de rétablir les processus dans les mêmes états qu'à leur fermeture ; Ce procédé nécessite une coopération des processus. DESCRIPTION GENERALE DE L'INVENTION The writing and reading times of the flash memory are relatively long; It is difficult to restore processes in the same states as when they are closed; This process requires a cooperation of the processes. GENERAL DESCRIPTION OF THE INVENTION
L'objet de l'invention offre une solution au problème évoqué précédemment, en proposant un procédé de sécurisation des ressources allouées aux processus exécutés sur un terminal, lorsque ledit terminal est en état verrouillé.  The object of the invention offers a solution to the problem mentioned above, by proposing a method of securing the resources allocated to the processes executed on a terminal, when said terminal is in a locked state.
L'invention concerne donc essentiellement un procédé de sécurisation d'un terminal. Le procédé comporte l'étape suivante : suite à un verrouillage du terminal, pour chaque processus d'une liste de processus exécutés par le terminal : The invention therefore essentially relates to a method of securing a terminal. The method comprises the following step: following a locking of the terminal, for each process of a list of processes executed by the terminal:
rendre inéligible à l'exécution ledit processus ;  render ineligible the said process;
protéger des ressources allouées au processus.  protect resources allocated to the process.
Le procédé est mis en œuvre par un noyau d'un système d'exploitation installé sur le terminal. Le système d'exploitation est par exemple Android. Les processus de la liste ne sont pas arrêtés, mais leur exécution est interrompue. Pour ce faire, l'ordonnanceur du noyau a été modifié afin de gérer un nouvel état possible pour chaque processus (nommé « frozen » par la suite). Tant que le processus est dans ce nouvel état, l'ordonnanceur ne lui donne pas la main et le processus ne s'exécute pas. De plus, les ressources que les processus de la liste utilisent sont sécurisées. Ainsi, en cas d'attaque, l'attaquant n'obtiendra pas de données intelligibles. The method is implemented by a kernel of an operating system installed on the terminal. The operating system is for example Android. The processes in the list are not stopped, but their execution is interrupted. To do this, the kernel scheduler has been modified to manage a new possible state for each process (named "frozen" later). As long as the process is in this new state, the scheduler does not give it a hand and the process does not run. In addition, the resources that the processes in the list use are secure. Thus, in case of attack, the attacker will not get any intelligible data.
Le procédé de sécurisation selon l'invention peut présenter une ou plusieurs caractéristiques complémentaires parmi les suivantes, considérées individuellement ou selon toutes les combinaisons techniquement possibles : The security method according to the invention may have one or more additional characteristics among the following, considered individually or in any technically possible combination:
les ressources allouées à un processus comportent une zone de mémoire vive, et la protection comporte un chiffrement de ladite zone de mémoire vive. Ainsi, les zones de mémoire vive utilisées par les processus de la liste protégées par chiffrement. Un attaquant ayant accès à la mémoire vive du terminal ne pourra pas la lire : la mémoire vive est rendue inutilisable.  resources allocated to a process include a RAM area, and the protection includes an encryption of said RAM area. Thus, the RAM areas used by the processes in the list protected by encryption. An attacker having access to the RAM of the terminal will not be able to read it: the RAM is rendered unusable.
le procédé comporte, suite à l'étape de chiffrement : effacer de la mémoire vive une clef de chiffrement utilisée lors du chiffrement. Ainsi, on s'assure qu'un déchiffrement de la mémoire vive par un attaquant est impossible, the method comprises, following the encryption step: erase RAM an encryption key used during encryption. Thus, it is ensured that a decryption of the RAM by an attacker is impossible,
les ressources allouées à un processus comportent un descripteur de fichier ou de base de données, et la protection comporte une fermeture dudit descripteur. Ainsi, les bases de données et/ou fichiers utilisés par les processus de la liste, sont rendues inaccessibles. resources allocated to a process include a file or database descriptor, and the protection includes closing said descriptor. Thus, the databases and / or files used by the processes in the list are rendered inaccessible.
le procédé comporte une étape préalable de mise à jour de la liste de processus, comportant : suite à la réception d'une notification d'un processus, ajouter ledit processus à la liste de processus. Les notifications de processus sont reçues par le noyau du système d'exploitation Android. Les notifications de processus sont émises par un processus de protection nommé « Protection Manager » en anglais. Ainsi, le processus de protection (Protection Manager) indique au noyau les processus sur lesquels le procédé de sécurisation selon l'invention doit être mis en œuvre. the method comprises a preliminary step of updating the process list, comprising: following receipt of a notification of a process, adding said process to the list of processes. Process notifications are received by the kernel of the Android operating system. Process notifications are issued by a protection process named "Protection Manager" in English. Thus, the Protection Manager indicates to the kernel the processes on which the securing method according to the invention is to be implemented.
l'émission d'une notification d'un processus dépend d'un paramétrage initial dudit processus. En effet, tous les processus ne sont pas concernés par le procédé de sécurisation selon l'invention. Par concerner, on entend être dans la liste de processus évoquée précédemment. Seuls les processus pré-configurés pour sécurisation sont concernés. A son démarrage un processus n'est pas dans la liste de processus ; si le processus de protection (Protection Manager) détecte que ledit processus est configuré pour être concerné par le procédé de sécurisation selon l'invention, alors le processus de protection (Protection Manager) le notifie au noyau, qui l'ajoutera dans la liste de processus. issuing a notification of a process depends on an initial setting of said process. Indeed, not all processes are concerned by the security method according to the invention. By concern, one intends to be in the list of processes mentioned above. Only pre-configured processes for securing are concerned. At startup a process is not in the process list; if the Protection Manager detects that said process is configured to be concerned with the security method according to the invention, then the Protection Manager notifies the kernel, which will add it to the protection list. process.
le procédé comporte : suite à un déverrouillage du terminal : rendre éligible à l'exécution ledit processus et supprimer la protection sur les ressources préalablement protégées. the method comprises: following an unlocking of the terminal: making said process eligible for execution and removing the protection on the previously protected resources.
les ressources allouées à un processus comportent une zone de mémoire vive, et la suppression de la protection comporte un déchiffrement de ladite zone de mémoire vive. the resources allocated to a process comprise a RAM area, and the deletion of the protection includes a decryption of said RAM area.
les ressources allouées à un processus comportent un descripteur de fichier ou de base de données, et la suppression de la protection comporte une ouverture dudit descripteur. the resources allocated to a process include a file or file descriptor database, and the removal of the protection includes an opening of said descriptor.
L'invention et ses différentes applications seront mieux comprises à la lecture de la description qui suit et à l'examen des figures qui l'accompagnent. The invention and its various applications will be better understood by reading the following description and examining the figures that accompany it.
BREVE DESCRIPTION DE LA FIGURE BRIEF DESCRIPTION OF THE FIGURE
La figure 1 n'est présentée qu'à titre indicatif et nullement limitatif de l'invention. La figure 1 montre des étapes d'un procédé de sécurisation d'un terminal selon un mode de réalisation non limitatif de l'invention.  Figure 1 is presented for guidance and in no way limitative of the invention. Figure 1 shows steps of a method of securing a terminal according to a non-limiting embodiment of the invention.
DESCRIPTION DETAILLEE D'AU MOINS UN MODE DE REALISATION DE L'INVENTION DETAILED DESCRIPTION OF AT LEAST ONE EMBODIMENT OF THE INVENTION
Sauf précision contraire, un même élément apparaissant sur des figures différentes présente une référence unique.  Unless otherwise specified, the same element appearing in different figures has a unique reference.
La figure 1 montre des étapes d'un procédé METH de sécurisation d'un terminal selon un mode de réalisation non limitatif de l'invention. Dans le mode de réalisation non limitatif décrit, le terminal est de type Smartphone, et fonctionne sous le système d'exploitation Android, qui comprend un noyau. FIG. 1 shows steps of a method METH for securing a terminal according to a non-limiting embodiment of the invention. In the nonlimiting embodiment described, the terminal is of the Smartphone type, and operates under the Android operating system, which includes a kernel.
Le noyau comporte un ordonnanceur (en anglais « scheduler »), choisissant l'ordre d'exécution des processus du terminal. L'ordonnanceur est adapté pour gérer des états des processus, notamment : The kernel includes a scheduler (in English "scheduler"), choosing the order of execution of the processes of the terminal. The scheduler is adapted to manage process states, including:
un état dit « idle » dans lequel un processus est éligible à l'exécution.  a state called "idle" in which a process is eligible for execution.
- un état dit « frozen » dans lequel un processus est gelé. Tant qu'un processus est dans l'état gelé, l'ordonnanceur ne lui donne pas main, le processus ne s'exécute donc pas.  a so-called "frozen" state in which a process is frozen. As long as a process is in the frozen state, the scheduler does not give it hand, so the process does not run.
Selon l'invention, un processus PR exécuté sur le terminal est préconfiguré pour être concerné ou non par le procédé de sécurisation METH selon l'invention. Si le processus PR est concerné par le procédé de sécurisation METH, alors suite à un verrouillage LK du terminal, des ressources MEM, DESC qu'il utilise sont protégées. Un paramètre de configuration PR_PM est donc associé à chaque processus PR. Les paramètres de configuration PR_PM des processus PR sont analysables par un processus de protection nommé en anglais « Protection Manager ». According to the invention, a PR process executed on the terminal is preconfigured to be concerned or not by the method of securing METH according to the invention. If the process PR is concerned with the method of securing METH, then following an LK lock of the terminal, resources MEM, DESC it uses are protected. A PR_PM configuration parameter is therefore associated with each PR process. The PR_PM configuration parameters of the PR processes can be analyzed by a Protection Manager protection process.
Plus précisément, au démarrage d'un processus PR (lorsque le terminal est déverrouillé), le processus de protection analyse le paramètre de configuration PR_PM associé audit processus PR. Si le paramètre de configuration PR_PM indique que le processus PR est concerné par le procédé de sécurisation METH selon l'invention, alors le processus de protection envoie une notification au noyau. On dira que le processus de protection indique au noyau qu'un mécanisme de protection doit être activé sur le processus PR en question. A réception NO_REC d'une notification sur un processus PR, le noyau ajoute le processus à une liste LI_PR. La liste LI_PR est ainsi mise à jour à chaque réception NO_REC de notification. Lorsque le terminal passe de l'état déverrouillé à l'état verrouillé, la liste LI_PR comporte tous les processus PR démarrés sur lequel le mécanisme de protection doit être activé. More precisely, at the start of a PR process (when the terminal is unlocked), the protection process analyzes the PR_PM configuration parameter associated with said PR process. If the configuration parameter PR_PM indicates that the process PR is concerned with the method of securing METH according to the invention, then the protection process sends a notification to the kernel. It will be said that the protection process tells the kernel that a protection mechanism must be activated on the PR process in question. On receipt of NO_REC notification on a PR process, the kernel adds the process to a LI_PR list. The list LI_PR is thus updated at each reception NO_REC notification. When the terminal changes from the unlocked state to the locked state, the list LI_PR contains all the started PR processes on which the protection mechanism must be activated.
Suite à verrouillage LK du terminal, l'ordonnanceur place les processus (PR) de la liste (LI_PR) dans l'état « frozen ». Puis, le noyau active une protection sur les ressources MEM, DESC des processus PR de la liste LI_PR. Plus précisément, des zones de mémoire MEM vive allouées aux processus PR de la liste LI_PR sont chiffrées MEM_ENC. De plus, la clef de chiffrement KM utilisée est supprimée KM_ERZ de la mémoire vive à la fin du chiffrement MEM_ENC. En outre, des descripteurs DESC de fichiers ou de bases de données utilisés par les processus PR de la liste LI_PR sont fermés, c'est-à-dire effacés. Ainsi, plus aucune donnée sensible n'est accessible ou exploitable. En cas d'attaque, aucune donnée intelligible ne sera utilisable. Suite à un déverrouillage UNLK du terminal, l'ordonnanceur place les processus (PR) de la liste (LI_PR) dans l'état « idle » : ces processus sont alors à nouveau éligibles à l'exécution. Puis, la protection sur les ressources des processus PR de la liste LI_PR est supprimée par le noyau. Le noyau déchiffre MEM_DESENC les zones de mémoire vive MEM préalablement chiffrées et rouvrent DESC_OP les descripteurs DESC. Following the LK lock of the terminal, the scheduler places the processes (PR) in the list (LI_PR) in the "frozen" state. Then, the kernel activates a protection on the resources MEM, DESC of the processes PR of the list LI_PR. More precisely, areas of memory MEM fast allocated to the processes PR of the list LI_PR are encrypted MEM_ENC. In addition, the KM encryption key used is deleted KM_ERZ RAM at the end of encryption MEM_ENC. In addition, DESC descriptors of files or databases used by the PR processes of the list LI_PR are closed, that is to say erased. Thus, no sensitive data is accessible or exploitable. In the event of an attack, no intelligible data will be usable. Following UNLK unlocking of the terminal, the scheduler places the processes (PR) of the list (LI_PR) in the "idle" state: these processes are then again eligible for execution. Then, the protection on the PR process resources of the LI_PR list is removed by the kernel. The kernel decrypts MEM_DESENC MEM previously encrypted RAM areas and reopen DESC_OP DESC descriptors.

Claims

REVENDICATIONS
Procédé (METH) de sécurisation d'un terminal, caractérisé en ce qu'il comporte :  Method (METH) for securing a terminal, characterized in that it comprises:
Suite à un verrouillage (LK) du terminal, pour chaque processus (PR) d'une liste (LI_PR) de processus exécutés par le terminal :  Following a lock (LK) of the terminal, for each process (PR) of a list (LI_PR) of processes executed by the terminal:
• rendre inéligible à l'exécution ledit processus (PR) ;  • render ineligible the said process (PR);
• protéger (MEM_ENC ; DESC_CLZ) ressources (MEM ; DESC) allouées audit processus (PR).  • protect (MEM_ENC; DESC_CLZ) resources (MEM; DESC) allocated to said process (PR).
Procédé (METH) de sécurisation selon la revendication précédente, caractérisé en ce que les ressources (MEM ; DESC) allouées à un processus (PR) comportent une zone de mémoire vive (MEM), et la protection (MEM_ENC ; DESC_CLZ) comporte un chiffrement (MEM_ENC) de ladite zone de mémoire vive (MEM).  Method (METH) for securing according to the preceding claim, characterized in that the resources (MEM; DESC) allocated to a process (PR) comprise a RAM area (MEM), and the protection (MEM_ENC; DESC_CLZ) comprises an encryption (MEM_ENC) of said RAM area (MEM).
Procédé (METH) de sécurisation d'un terminal selon la revendication précédente, caractérisé en ce qu'il comporte, suite à l'étape de chiffrement (MEM_ENC) : effacer (KM_ERZ) de la mémoire vive (MEM) une clef de chiffrement (KM) utilisée lors du chiffrement (MEM_ENC). Method (METH) for securing a terminal according to the preceding claim, characterized in that it comprises, following the encryption step (MEM_ENC): erase (KM_ERZ) of the random access memory (MEM) an encryption key ( KM) used during encryption (MEM_ENC).
Procédé (METH) de sécurisation d'un terminal selon l'une des revendications précédentes, caractérisé en ce que les ressources (MEM ; DESC) allouées à un processus (PR) comportent un descripteur (DESC) de fichier ou de base de données, et la protection (MEM_ENC ; DESC_CLZ) comporte une fermeture (DESC_CLZ) dudit descripteur (DESC).  Method (METH) for securing a terminal according to one of the preceding claims, characterized in that the resources (MEM; DESC) allocated to a process (PR) comprise a file or database descriptor (DESC), and the protection (MEM_ENC; DESC_CLZ) comprises a closure (DESC_CLZ) of said descriptor (DESC).
Procédé (METH) de sécurisation d'un terminal selon l'une des revendications précédentes, caractérisé en ce qu'il comporte une étape préalable de mise à jour de la liste (LI_PR) de processus, comportant : suite à une réception (NO_REC) d'une notification d'un processus (PR), ajouter (PR_AD) ledit processus (PR) à la liste (LI_PR) de processus.  Method (METH) for securing a terminal according to one of the preceding claims, characterized in that it comprises a preliminary step of updating the process list (LI_PR), comprising: following a reception (NO_REC) of a process notification (PR), adding (PR_AD) said process (PR) to the process list (LI_PR).
Procédé (METH) de sécurisation d'un terminal selon la revendication précédente, caractérisé en ce que l'émission d'une notification d'un processus (PR) dépend d'un paramétrage (PR_PM) initial dudit processus (PR).  Method (METH) for securing a terminal according to the preceding claim, characterized in that the transmission of a notification of a process (PR) depends on an initial parameterization (PR_PM) of said process (PR).
Procédé (METH) de sécurisation d'un terminal selon l'une des revendications précédentes, caractérisé en ce qu'il comporte : Method (METH) for securing a terminal according to one of the claims preceding, characterized in that it comprises:
- Suite à un déverrouillage (UNLK) du terminal :  - Following an unlock (UNLK) terminal:
• rendre éligible à l'exécution ledit processus (PR) ;  • make the said process (PR) eligible for execution;
•supprimer la protection (MEM_DESENC ; DESC_OP) sur les ressources (MEM ; DESC) préalablement protégées.  • delete the protection (MEM_DESENC; DESC_OP) on the previously protected resources (MEM; DESC).
8. Procédé (METH) de sécurisation d'un terminal selon la revendication précédente, caractérisé en ce que les ressources (MEM ; DESC) allouées à un processus (PR) comportent une zone de mémoire vive (MEM), et la suppression de la protection (MEM_DESENC ; DESC_OP) comporte un déchiffrement (M EM_DESENC) de ladite zone de mémoire vive (MEM).  8. Method (METH) for securing a terminal according to the preceding claim, characterized in that the resources (MEM; DESC) allocated to a process (PR) comprise a RAM area (MEM), and the deletion of the protection (MEM_DESENC; DESC_OP) comprises a decryption (M EM_DESENC) of said area of RAM (MEM).
9. Procédé (METH) de sécurisation d'un terminal selon l'une des revendications 7 ou 8, caractérisé en ce que les ressources (MEM ; DESC) allouées à un processus (PR) comportent un descripteur (DESC) de fichier ou de base de données, et la suppression de la protection (MEM_DESENC ; DESC_OP) comporte une ouverture dudit descripteur (DESC_OP).  9. Method (METH) for securing a terminal according to one of claims 7 or 8, characterized in that the resources (MEM; DESC) allocated to a process (PR) comprise a descriptor (DESC) file or database, and the deletion of the protection (MEM_DESENC; DESC_OP) includes an opening of said descriptor (DESC_OP).
EP14787228.7A 2013-10-02 2014-09-30 Method for securing a terminal Ceased EP3053082A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
FR1359566A FR3011359B1 (en) 2013-10-02 2013-10-02 METHOD FOR SECURING A TERMINAL
PCT/FR2014/052468 WO2015049458A1 (en) 2013-10-02 2014-09-30 Method for securing a terminal

Publications (1)

Publication Number Publication Date
EP3053082A1 true EP3053082A1 (en) 2016-08-10

Family

ID=50289721

Family Applications (1)

Application Number Title Priority Date Filing Date
EP14787228.7A Ceased EP3053082A1 (en) 2013-10-02 2014-09-30 Method for securing a terminal

Country Status (3)

Country Link
EP (1) EP3053082A1 (en)
FR (1) FR3011359B1 (en)
WO (1) WO2015049458A1 (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100138189A1 (en) * 2008-12-01 2010-06-03 International Business Machines Corporation Fast detection of process outages

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7299364B2 (en) * 2002-04-09 2007-11-20 The Regents Of The University Of Michigan Method and system to maintain application data secure and authentication token for use therein

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100138189A1 (en) * 2008-12-01 2010-06-03 International Business Machines Corporation Fast detection of process outages

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of WO2015049458A1 *

Also Published As

Publication number Publication date
FR3011359B1 (en) 2016-12-30
FR3011359A1 (en) 2015-04-03
WO2015049458A1 (en) 2015-04-09

Similar Documents

Publication Publication Date Title
US10789361B2 (en) Ransomware attack remediation
EP3374922B1 (en) Systems and methods for protecting backed-up data from ransomware attacks
EP3479280B1 (en) Ransomware protection for cloud file storage
US10607027B1 (en) Secretless secure data distribution and recovery process
US9258122B1 (en) Systems and methods for securing data at third-party storage services
US10050982B1 (en) Systems and methods for reverse-engineering malware protocols
EP2178016B1 (en) Method of operating on-board equipment, associated equipment and aircraft containing such equipment
US10339304B2 (en) Systems and methods for generating tripwire files
US20090220088A1 (en) Autonomic defense for protecting data when data tampering is detected
US20190087278A1 (en) Secure data protection and recovery
US10397216B2 (en) Systems and methods for performing secure backup operations
EP3063693B1 (en) Intrusion detection system in a device comprising a first operating system and a second operating system
WO2016045548A1 (en) Data synchronization method and device
US9800610B1 (en) Systems and methods for defeating relay attacks
EP2614458A2 (en) Method of authentification for access to a website
US10318272B1 (en) Systems and methods for managing application updates
EP3586258B1 (en) Segmented key authentication system
US10447671B1 (en) Systems and methods for recovering encrypted information
US10162962B1 (en) Systems and methods for detecting credential theft
US11184169B1 (en) Systems and methods for crowd-storing encrypiion keys
US20190116030A1 (en) Storing data for ransomware recovery
Netto et al. An integrated approach for detecting ransomware using static and dynamic analysis
EP3053082A1 (en) Method for securing a terminal
Aggarwal Ransomware Attack: An Evolving Targeted Threat
CN113868718A (en) FPGA encryption method, device, equipment and medium based on BIOS

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20160422

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20170508

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: AVANTIX

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20200509