Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/03—Protecting confidentiality, e.g. by encryption
  • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
  • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
  • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
  • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
  • H04L9/0872—Generation of secret information including derivation or calculation of cryptographic keys or passwords using geo-location information, e.g. location data, time, relative position or proximity to other entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
  • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless

Definitions

• the present invention belongs to the field of digital telecommunications, and more particularly relates to a method of transmitting a packet comprising encrypted data, as well as a method for extracting data included in such a packet.
• ultra-narrowband wireless communication systems By “ultra narrow band” (“Ultra Narrow Band” or UNB in the English literature), it is meant that the instantaneous frequency spectrum of the radio signals emitted by terminals, to an access network, is of width frequency less than two kilohertz, or even less than one kilohertz.
• Such UNB wireless communication systems are particularly suitable for applications of the type M2M (acronym for machine-to-machine) or the Internet of Things ("Internet of Things” or loT in the literature Anglo-Saxon).
• the data exchanges are mainly on a link rising from terminals to an access network of said system.
• the terminals transmit packets that are collected by base stations of the access network, without first having to associate with one or more base stations of the access network.
• the packets transmitted by a terminal are not intended for a specific base station of the access network, and the terminal sends its packets assuming that they can be received by at least one base station.
• Such provisions are advantageous in that the terminal does not need to perform regular measurements, particularly greedy in terms of power consumption, to determine the most appropriate base station to receive its packets. Complexity rests on the network access, which must be able to receive packets that can be transmitted at arbitrary times, and at arbitrary central frequencies within a frequency band multiplexing the different terminals.
• the access network when receiving a packet, updates the key by applying the same key generation method as the terminal.
• a disadvantage of such an approach is that, in a UNB wireless communication system, the access network does not necessarily receive all the packets transmitted by the terminal, so that the access network does not know a priori how much times the key has been changed between the previous packet received from the same terminal and the current packet.
• the amount of information to be included in a packet can be important.
• the amount of information can be included in a package is very limited.
• the present invention aims to remedy all or part of the limitations of the solutions of the prior art, including those described above, by proposing a solution that ensures good confidentiality of trade while limiting the amount of information to include in packages.
• the invention relates to a method of sending, by a transmitting device, packets destined for a receiving device of a communication system, comprising, for the transmission of a packet, called "encrypted packet", comprising data encrypted according to a symmetric key encryption protocol:
• a calculation of a truncated information by decomposing the generation information into a first part and a second part, the first part varying more slowly over time than the second part, the truncated information being representative of said second part; part of the generation information,
• the encryption key is determined according to the value of a variable generation information over time. Therefore, the encryption key changes each time the value of the generation information changes, and can take as many different values as the generation information.
• the generation information is not included as it is in the encrypted packet to be transmitted, and it is truncated information that is included in the transmitted encrypted packet.
• the generation information being decomposed into a first part and a second part, the first part varying more slowly than the second part, the truncated information is calculated according to the second part, without taking into account the first part.
• the first part of the generation information corresponds to a part that does not vary or little over the duration of transmission of several consecutive packets, while the second part is likely to vary from one packet to another.
• the number of different values that the encryption key may take may be chosen according to the desired level of confidentiality, without affecting the amount of information to be transmitted in the encrypted packet to enable the receiving device to determine the key. encryption. Indeed, the amount of information to be transmitted can be limited to the amount of information needed to encode the truncated information.
• the receiving device must, when receiving an encrypted packet transmitted by the transmitting device, estimate the value of the first part of the generation information of said encrypted packet (not included in said encrypted packet) in order to deducing, from the truncated information, the value of the generation information and thus be able to determine the encryption key used by the transmitting device.
• the verification code which is calculated by the sending device according to the encrypted data and the first part of the generation information, is then used by the receiving device to determine whether the estimated value of the first part of the information generation is correct, that is to say if it corresponds to the first part of the generation information used by the sending device, by evaluating the integrity of the encrypted packet based on the encrypted data and the estimated value of the first part of the generation information. If the encrypted packet is considered as integrity, then it means furthermore that the estimated value of the first part of the generation information corresponds to the first part of the generation information used by the transmitting device.
• the method of transmission may further comprise one or more of the following features, taken singly or in any technically feasible combination.
• the verification code is further calculated based on an authentication key of the transmitting device, so that the verification code also makes it possible to verify the authenticity of the encrypted packet.
• the transmission method also comprises a formation and a transmission of a packet, called "registration packet", including a registration information representative of the first part of the generation information.
• This registration packet can be issued recurrently, for example periodically, or whenever the first part of the generation information varies, or whenever the transmitting device transmits a predetermined number of encrypted packets. .
• an encrypted packet transmitted by the transmitting device estimating a candidate value of the first part of the generation information of said encrypted packet is performed in addition to reset information extracted from a previously received registration packet.
• the generation information is a packet counter corresponding to the number of packets transmitted by the transmitting device or a generation date of the packet to be transmitted.
• the present invention relates to a transmitting device for sending packets to a receiving device of a communication system, comprising, for the transmission of a packet, said "encrypted packet", comprising data encrypted according to a symmetric key encryption protocol:
• means configured to encrypt data to be included in the encrypted packet to be transmitted according to the encryption key, means configured to calculate a truncated information by decomposing the generation information into a first portion and a second portion, the first portion varying more slowly over time than the second portion, the truncated information being representative of said second party,
• the transmitter device may further comprise one or more of the following characteristics, taken separately or in any technically possible combination.
• the verification code is further calculated according to an authentication key of the transmitting device, so that the verification code also makes it possible to verify the authenticity of the encrypted packet.
• the transmitter device further comprises means configured to form and transmit a packet, called "registration packet", including a registration information representative of the first part of the generation information.
• the generation information is a packet counter corresponding to the number of packets transmitted by said transmitting device or a generation date of the packet to be transmitted.
• the present invention relates to a method of extraction, by a receiver device, of data included in an encrypted packet, called "encrypted packet in progress", transmitted by a device that transmits a communication system in accordance with a transmission method according to any one of the embodiments of the invention.
• Said extraction process comprises:
• the extraction method may further comprise one or more of the following characteristics, taken separately or in any technically possible combination.
• the integrity of the current encrypted packet is evaluated in addition to an authentication key of the transmitting device.
• the extraction method further comprises an extraction of registration information included in a packet transmitted by the transmitting device, called "registration packet”.
• registration packet an extraction of registration information included in a packet transmitted by the transmitting device.
• the estimate of the candidate value of the first part of the generation information for the current encrypted packet is then further performed according to this registration information.
• candidate values for the first part of the generation information are estimated, and the integrity of the current encrypted packet is evaluated for each estimated candidate value until a criterion of stop is checked.
• information from generation is a packet counter of the transmitting device whose value of the first part for the current encrypted packet is further estimated based on the value of the estimated first part and verified for a previous packet received from the same transmitting device.
• the generation information corresponds to a generation date of the packet transmitted by the transmitting device whose value of the first part is estimated as a function also of the first part of the date of receipt of said encrypted packet in progress by the receiving device.
• the present invention relates to a receiver device for receiving packets of a transmitting device of a communication system according to any one of the embodiments of the invention.
• said receiver device comprises:
• the receiving device can in addition, include one or more of the following characteristics, taken separately or in any technically feasible combination.
• the integrity of the current encrypted packet is evaluated in addition to an authentication key of the transmitting device.
• the receiver device further comprises means configured to extract the registration information from a registration packet transmitted by the transmitting device.
• the candidate value of the first portion of the generation information for the current encrypted packet is then further estimated based on this registration information.
• the generation information corresponds to a packet counter of said transmitting device whose value of the first part for the current encrypted packet is estimated in addition to the value of the first estimated and verified part. for a previous packet received from the same transmitting device.
• the generation information corresponds to a generation date of the packet transmitted by the sending device whose value of the first part is estimated in addition to the first part of the date of receipt of said encrypted packet. in progress by the receiving device.
• the present invention relates to a communication system comprising at least one transmitting device according to any one of the embodiments of the invention, and at least one receiving device according to any one of the embodiments of the invention. 'invention.
• FIG. 1 a schematic representation of a wireless communication system
• FIG. 2 a diagram illustrating the main steps of a method of sending a packet containing encrypted data
• FIG. 3 is a diagram illustrating the main steps of a preferred embodiment of the transmission method of FIG. 2, with the transmission of a registration packet,
• FIG. 4 a diagram illustrating the main steps of a data extraction method included in an encrypted packet
• FIG. 5 a diagram illustrating the main steps of a preferred mode of implementation of the extraction method of FIG. 4, and highlighting the use of a registration packet
• FIG. 6 a diagram illustrating the main steps of evaluating the integrity of an encrypted packet
• Figure 7 a diagram illustrating the main steps of a preferred embodiment of the extraction method of Figure 5, and highlighting the estimation of several candidate values.
• FIG. 1 schematically represents a wireless communication system 10, for example of the UNB type, comprising several terminals 20 and an access network 30.
• the access network 30 comprises several base stations 31 and a server 32.
• radio signal is meant an electromagnetic wave propagating via non-wired means, the frequencies of which are included in the traditional spectrum of radio waves (a few hertz to several hundred gigahertz).
• the terminals 20 are adapted to transmit packets on an uplink link to the access network 30.
• packets are sent asynchronously.
• asynchronously transmitting is meant that the terminals 20 determine autonomously when they transmit and / or on which central frequency they transmit, without coordination of said terminals 20 to each other and to the base stations 31 of the access network. 30.
• Each base station 31 is adapted to receive the packets of the terminals 20 which are within range.
• Each packet thus received is for example transmitted to the server 32 of the access network 30, possibly accompanied by other information such as an identifier of the base station 31 which received it, the measured power of said received packet, the date of reception. measured from said packet, the measured center frequency of said received packet, etc.
• the server 32 processes, for example, all the packets received from the various base stations 31.
• FIG. 2 diagrammatically represents the main steps of a method 50 for sending, by a terminal 20 and destined for the access network 30, packets comprising data encrypted according to a symmetric key encryption protocol.
• the terminal 20 comprises a processing circuit (not shown in the figures), comprising one or more processors and storage means (magnetic hard disk, electronic memory, optical disk, etc.) in which a program product is stored. computer, in the form of a set of program code instructions to be executed to implement the different steps of the packet sending method.
• the processing circuit includes one or more programmable logic circuits (FPGA, PLD, etc.), and / or one or more specialized integrated circuits (ASICs), and / or a set discrete electronic components, etc., adapted to implement all or part of said steps of the method of transmitting packets.
• the processing circuit comprises a set of means configured in software (specific computer program product) and / or hardware (FPGA, PLD, ASIC, discrete electronic components, etc.) to implement the steps of the packet sending method 50 to the access network 30.
• the terminal 20 also comprises wireless communication means, considered as known to those skilled in the art, enabling the terminal 20 to send packets to the base stations 31 of the access network 30, under the form of radio signals.
• the method for transmitting encrypted packets comprises the following steps, all executed by the terminal 20, which will be described in detail below:
• the encryption key is determined according to the value of a generation information that is variable over time. As a result, the encryption key changes each time the value of the generation information changes.
• the generation information is not included as it is in the encrypted packet to be transmitted, and it is truncated information that is included in the transmitted encrypted packet.
• Generation information can be any variable information at course of time that can be broken down into a first part and a second part, the first part varying more slowly than the second part. Therefore, the first part, which does not vary or little over the transmission duration of several consecutive packets, does not have to be included in the encrypted packet to be transmitted.
• the second part which varies from one packet to another, is included in the encrypted packet to be transmitted in any suitable form, and the truncated information is calculated from said second part only, that is to say to say without taking into account the first part.
• the generation information is the generation date of the encrypted packet to be transmitted.
• the generation date is for example expressed as year-month-day-hour-minute-second, and is therefore decomposable into a first part that varies slowly, such as the part corresponding to year-month-day, while the second part, which varies more rapidly, is the part corresponding to hour-minute-second.
• the truncated information is therefore, in this example, representative of the part corresponding to hour-minute-second, and is for example calculated from the hour-minute-second part by means of an invertible calculation function known to the priori of the terminal 20 and the access network 30.
• the generation information is a packet counter corresponding to the number of packets transmitted by the terminal 20.
• the truncated information is hereinafter referred to as " truncated counter ".
• the terminal 20 updates the value of a packet counter, which corresponds to the number of packets transmitted by said terminal 20.
• the value of said packet counter is incremented with each new packet transmission.
• incrementing said value of the packet counter only for certain packets For example, it is possible, in order to increase the probability of reception, by the access network 30, of the data included in a packet, of duplicating Nr times said data in order to include them in Nr packets sent successively, for example on different central frequencies, with all the same data. In such a case, for example, it is possible to increment the value of said packet counter only all Nr packets, that is to say only when new data must be sent by the terminal 20.
• the value of the packet counter is, for example, incremented modulo Ne, Ne being a predetermined positive integer.
• the packet counter of the terminal 20 can take Ne different values.
• the number Ne is equal to 2 Nb1 , Nb1 being a predetermined positive integer, so that the value of the packet counter can be encoded by means of Nb1 bits.
• Nb1 is equal to 128, so that the packet counter of the terminal 20 can take more than 10 38 different values.
• the encryption key to be used for encrypting the data to be included in the encrypted packet to be transmitted, is determined according to the value of the packet counter.
• the encryption key to be used is changed each time the value of the packet counter is incremented.
• the packet counter may take different values, it follows that the encryption key may also take different values.
• the number Ne is advantageously predetermined so as to ensure in particular a good level of confidentiality of exchanges.
• the encryption key can take more than 10 38 different values, which ensures a good level of confidentiality.
• the encryption key is determined, from the value of the packet counter, according to a predefined key generation method, known a priori from the terminal 20 and the access network 30.
• the invention can implement any type of adapted key generation method known to those skilled in the art, and the choice of a particular key generation method is only an alternative embodiment of the invention.
• the encryption key can It can also be determined from additional information which, if necessary, is for example concatenated with the packet counter to obtain a generation word of greater size than that of the single packet counter. For example, it may be envisaged to concatenate with the packet counter a static sequence generated in a pseudo-random manner, unique for a given terminal 20 and known a priori by the access network 30.
• the data to be included in the encrypted packet to be transmitted is encrypted according to the encryption key, according to the symmetric key encryption protocol considered.
• the invention is applicable to any type of symmetric key encryption protocol known to those skilled in the art, and the choice of a particular symmetric key encryption protocol is only a variant of implementation of the invention.
• the symmetric key encryption protocol used is a stream encryption protocol (also known as stream cipher in the English literature) possibly emulated from a block encryption protocol like AES (Advanced Encryption Standard).
• stream encryption protocol also known as stream cipher in the English literature
• AES Advanced Encryption Standard
• a stream encryption protocol makes it possible to encrypt data regardless of their size relative to the size of the encryption key. Therefore, it is possible to choose long encryption keys, which can take a very large number of different values, without having to increase by the same amount of data to include in a package.
• the data is for example in the form of bits, as is the encryption key which comprises at least Nb1 bits.
• the encrypted data are for example obtained by combining one by one the successive bits of the data and the encryption key, for example by means of a logic function of the type "EXCLUSIVE OR" ("XOR" in the English-language literature) .
• Truncated counter calculation During the calculation step 54, a truncated counter is determined from the value of the packet counter of the terminal 20.
• the packet counter is decomposed into a first part and a second part.
• the second part of the packet counter corresponds to the value of said modulo packet counter Nt, where Nt is a predetermined positive integer less than Ne.
• Nt is a predetermined positive integer less than Ne.
• the second part corresponds to the rest of the Euclidean division of the packet counter value by Nt
• the first part corresponds to the quotient of the Euclidean division of the packet counter value by Nt.
• the number Nt is equal to 2 Nb2 , Nb2 being a predetermined positive integer less than Nb1, so that the second part then corresponds to the Nb2 least significant bits ("Least Significant Bits" or LSB in the English literature). Saxon) among the Nb1 bits of the packet counter.
• Nb2 is equal to 12, so that the second part corresponds to the value of the modulo packet counter 4096.
• the number Nt can for example be chosen such that the probability, for the access network 30, of Missing consecutive packets transmitted by the same terminal 20 is less than a predefined threshold value, for example less than 10 -6 .
• the truncated counter is representative of the second part of the packet counter, and is for example calculated from said second part according to an invariable calculation function known prior to the terminal 20 and the access network 30. In the following description, it is placed in a nonlimiting manner in the case where the truncated counter is chosen equal to the second part, so that said truncated counter corresponds to the value of the packet counter modulo Nt.
• a verification code is determined from the encrypted data and the first part of the packet counter.
• the access network 30 must, when receiving an encrypted packet transmitted by the terminal 20, estimate the value of the first part of the packet counter for said encrypted packet in order to deduce, from the truncated counter, the value of generation information, and so power determining the decryption key to be able to decrypt the encrypted data contained in said encrypted packet.
• the verification code which is calculated by the terminal 20 based on the encrypted data and the first part of the packet counter, is then used by the access network 30 to evaluate the integrity of the encrypted packet. If the encrypted packet is considered integrity, then it means that the encrypted data extracted from the encrypted packet and the estimated value of the first part of the packet counter are correct. If not, it means that the encrypted data extracted from the encrypted packet and / or the estimated value of the first part of the packet counter are not correct.
• CMOS complementary metal-oxide-semiconductor
• CAM Message Authentication Code
• MAC Message Authentication Code
• the encrypted packet to be transmitted is formed from the encrypted data, the verification code, and the truncated counter.
• the value of the packet counter is not included in the encrypted packet to be transmitted, which includes only the truncated counter.
• the quantity of information included in the encrypted packet for encoding the truncated counter is less than that necessary to encode the value of the packet counter, since the truncated counter corresponds, for example, to the Nb2 least significant bits among the Nb1 bits of the packet counter. Therefore, the (Nb1 - Nb2) most significant bits (MSB) of the packet counter, which correspond to the first part of said packet counter, are not included in the packet counter. coded packet to be transmitted, which corresponds to 1 1 6 bits not included in the case where Nb1 is equal to 128 and Nb2 is equal to 12.
• the encrypted packet thus formed is then transmitted by the terminal 20 to the access network 30.
• FIG. 3 represents the main steps of an implementation variant of the transmission method 50 comprising, in addition to the steps described above with reference to FIG. 2, a step 56 of forming a registration packet from a registration information representative of the first part of the packet counter.
• This registration packet may be issued recurrently, for example periodically, or whenever the value of the first part of the packet counter varies, or whenever the terminal 20 transmits a predetermined number of encrypted packets. etc.
• the registration information makes it possible, when receiving an encrypted packet by the access network 30, to improve the estimate of the value of the first part of the counter. packets.
• the packet counter of the terminal 20 can count only the encrypted packets, just as it can also count the set of transmitted packets, including the registration packets. This choice of behavior of the packet counter is only one variant of implementation of the invention.
• the registration packet may comprise only the registration information, just as it may also include other information, such as for example encrypted data, or the second part of the packet counter (for example if the packet counter is incremented when issuing a registration packet).
• the registration information is the first part of the packet counter, that is to say the (Nb1-Nb2) most significant bits of the packet counter in the example considered,
• a reset packet is sent each time the counter has been incremented exactly one time, that is to say each time the second part of the packet counter (the Nb2 least significant bits) returns to zero, that is to say also whenever the first part of the packet counter (the (Nb1 - Nb2) most significant bits) is incremented,
• the packet counter of the terminal 20 is incremented when issuing a registration packet.
• information identifying the type of packet may be included in the packet. This aspect is outside the scope of the invention.
• FIG. 4 schematically represents the main steps of a method 60 for extracting, by the access network 30, data included in a packet received from a terminal 20, said packet having been transmitted in accordance with a method 50 of FIG. emission according to one of the embodiments of the invention.
• the encrypted packet is designated from which it is sought to extract data by "encrypted packet in progress", in order to distinguish it from other packets previously received from the same terminal 20.
• the data extraction method 60 comprises the following steps, which will be described in detail below:
• the encrypted packet in progress from which one seeks to extract the data, is initially received by one or more base stations 31.
• Each base station 31 comprises for this purpose wireless communication means, considered as known to those skilled in the art, allowing said base station to receive packets transmitted by one or more terminals 20 in the form of signals. radio.
• the steps of the data extraction method 60 can be executed by the base station (s) 31 having received the current encrypted packet and / or by the server 32.
• the base stations 31 and the server 32 comprise respective network communication means, considered as known to those skilled in the art, allowing the base stations 31 to transmit each received packet to the server 32.
• the server 32 comprises for example a processing circuit (not shown in the figures), comprising one or more processors and storage means (magnetic hard disk, electronic memory, optical disk, etc.) in which a program product is stored. computer, in the form of a set of program code instructions to be executed to implement the different steps of the data extraction method 60.
• the processing circuit comprises one or more programmable logic circuits (FPGA, PLD, etc.), and / or one or more specialized integrated circuits (ASIC), and / or a set of discrete electronic components, etc. , adapted to implement all or part of said steps of the data extraction method 60.
• the processing circuit comprises a set of means configured in software (specific computer program product) and / or hardware (FPGA, PLD, ASIC, discrete electronic components, etc.) to implement the steps of the method 60 of extracting data from the current encrypted packet received from the terminal 20.
• different types of generation information can be considered.
• one places oneself in the case where the truncated information included by the terminal 20 in the transmitted packet is a truncated counter which corresponds to the value of said modulo packet counter Nt.
• the truncated counter is equal to the second part of the packet counter of the terminal 20.
• the truncated counter is not directly equal to the second part of the packet counter, it is sufficient to obtain said second part of the packet counter, to apply to the truncated counter of the current encrypted packet the inverse function of the calculation function used by the terminal 20.
• the server 32 extracts from the current encrypted packet the truncated counter, the verification code, and the encrypted data.
• the extraction of the truncated counter, the verification code, and the encrypted data depends on the manner in which they have been incorporated into the current encrypted packet, and is beyond the scope of the invention.
• the server 32 estimates a candidate value of the first portion of the packet counter of the terminal 20 that has issued the current encrypted packet.
• the current encrypted packet comprises only the truncated counter of the terminal 20 that sent it, and therefore does not fully include the value of the packet counter of said terminal 20, since the truncated counter only corresponds to to the Nb2 least significant bits among the Nb1 bits of the packet counter.
• the server 32 since the encryption key, used by said terminal 20 to encrypt the data included in the current encrypted packet, has been determined according to the value of the packet counter of said terminal 20, the server 32 must estimate the value. of the first part of said counter of packets of the terminal 20 to deduce the full value of the packet counter, and thus be able to determine in turn the decryption key to use, which is identical to the encryption key.
• the server 32 can estimate the value of the first part of the packet counter of the terminal 20 when transmitting the current encrypted packet, depending on:
• next packet received it is understood the last packet received from the terminal 20 before the current encrypted packet, among the packets for which the packet counter of the terminal 20 is incremented, and for which the value of the first part of the counter of packages could be estimated and verified. It should be noted that it may therefore be another encrypted packet, or another type of packet such as a registration packet.
• the server 32 stores the estimated value of the first part of the packet counter used by the terminal 20 when transmitting the previous packet received from said terminal 20, and updates the estimated value of said first part of the packet counter each time a new packet is received from said terminal 20.
• the server 32 considers, when it receives for the first time a packet transmitted by this terminal 20 (which is not necessarily the first packet sent by the terminal 20 if some packets have been missed by the network of access 30), that the estimated value of the first part of the packet counter for the previous packet received from the same terminal 20 is equal to said predefined initial value.
• the server 32 From the value of the first part of the estimated packet counter for the previous packet received from the terminal 20, and from the truncated counter extracted from the current encrypted packet, it is then possible for the server 32 to estimate the value of said packet counter of said terminal 20 for the encrypted package in progress.
• the value of the first part of the packet counter of the terminal 20 for the current encrypted packet is estimated according to the following expression:
• C (n) is the value of the packet counter of the estimated terminal for the current encrypted packet
• C 2 (n) corresponds to the truncated counter extracted from the current encrypted packet
• Ci (n-1) corresponds to the value of the first part of the packet counter of the terminal 20 estimated and verified for the preceding packet
• k is an integer to be determined.
• the value k corresponds to the number of returns to zero of the second part of the packet counter of the terminal 20 from the previous packet received.
• the value of the first part of the packet counter (corresponding to the (Nb1 - Nb2) most significant bits of the counter) is incremented each time the value of the second part of the packet counter (the truncated part, corresponding the Nb2 low-order bits of the counter) returns to zero.
• the Nb2 least significant bits by the Nb2 bits of the truncated counter extracted from the packet. encrypted in progress, but also add one (1) to the (Nb1 - Nb2) most significant bits of the value of the estimated packet counter for the previous packet.
• FIG. 5 represents the main steps of an implementation variant of the data extraction method 60 comprising, besides the steps described above with reference to FIG. 4, a step 66 of extraction, starting from a registration packet, a registration information representative of the first part of the packet counter.
• the estimate of the value of the first part of the packet counter of an encrypted packet in progress may be erroneous, particularly in the case where a large number, for example greater than Nt, of consecutive packets would be missed by the access network. Such an error is all the more serious as it leads to an estimation error for all subsequent packets.
• the registration information included in the registration packet is representative of the first part of the packet counter. It must therefore make it possible to determine with a good accuracy the value of the first part of the packet counter. At best, and as is the case in the embodiment described, it allows to determine without error the value of the first part of the packet counter.
• the value of the generation information for a current encrypted packet can be estimated by concatenating the first part of the generation information determined using the registration information, with the truncated information extracted from the encrypted packet by Classes.
• the registration information is the first part of the packet counter
• a reset packet is sent each time the packet counter of the terminal 20 has It has been incremented exactly one time, that is to say each time the first part of the counter changes, and the packet counter of the terminal 20 is incremented each time a reset packet is transmitted. It is therefore easy, on receiving a registration packet, to determine the value of the packet counter of the terminal 20 since it corresponds, for its (Nb1 - Nb2) most significant bits, to the value of the information for resetting, and for its Nb2 low-order bits, to a zero value. As a result, a registration packet may play the role of a "previous received packet" for which the value of the packet counter has been determined without error.
• a "desynchronization" may be detected if the value of the first portion of the estimated packet counter for the registration packet from a previous packet is different from the value of the first packet. part of the packet counter determined from the registration information.
• the system 10 is then resynchronized for the terminal 20 by resetting the value of the first part of the packet counter of the terminal 20 stored by the server 32 with the value of the registration information.
• FIG. 6 details a preferred mode of implementation of step 63 of evaluating the integrity of the current encrypted packet.
• step 63 includes a step 631 of calculating a verification code from the encrypted data and the estimated candidate value of the first part of the packet counter. This calculation is carried out according to the same method as that used by the terminal 20 to calculate the verification code on issue of the encrypted packet.
• Step 63 then comprises a step 632 comparing the verification code calculated by the server 32 with the verification code extracted from the current encrypted packet, it is possible to evaluate the integrity of the current encrypted packet.
• the encrypted packet is considered integral only if the verification code extracted from the current encrypted packet and the calculated verification code are identical.
• the server 32 can perform the step 64 of determining the decryption key, and the step 65 of decryption of the encrypted data.
• the current encrypted packet is not considered integrity, then the estimated candidate value of the first part of the packet counter is considered incorrect, and therefore it is not possible to determine the decryption key.
• the current encrypted packet may, for example, simply be ignored, or it may possibly be memorized in order to revert later by a new step of estimating a candidate value of the first part of the packet counter, for example following upon receipt of a registration package.
• the verification code is a Message Authentication Code (CAM) or MAC ("Message Authentication Code" or MAC in English literature) calculated according to in addition to an authentication key which is known by both the terminal 20 and the server 32.
• the server 32 may for example determine the authentication key to use through information included in the current encrypted packet which makes it possible to uniquely identify the terminal 20 that sent the packet. More generally, the determination by the server 32 of the authentication key to be used can implement any method known to those skilled in the art and is beyond the scope of the invention.
• the verification code makes it possible simultaneously to verify the authenticity of the current encrypted packet, the integrity of the encrypted data contained in this encrypted packet, and also the candidate value. estimated from the first part of the packet counter of the current encrypted packet.
• the server 32 determines the decryption key to be used for decrypting the encrypted data extracted from the current encrypted packet.
• the value of the packet counter of the terminal 20 for the current encrypted packet is derived from the estimated and verified candidate value of the first portion, and from the truncated information.
• the decryption key is then determined from the packet counter value of the terminal 20 for the current encrypted packet using the same key generation method used by the terminal 20 to generate the encryption key. In the absence of errors, the decryption key is identical to the encryption key.
• the server 32 decrypts the encrypted data extracted from the current encrypted packet, as a function of the decryption key obtained at the end of the determination step 64.
• the decryption of the encrypted data depends on the symmetric key encryption protocol considered, and is outside the scope of the invention. For example, in the case of a stream encryption protocol in which the encrypted data is obtained by combining one by one the successive bits of the data and the encryption key by means of an "EXCLUSIVE OR" logical function. , then the unencrypted data is also obtained by combining one by one the successive bits of the encrypted data and the decryption key by means of an "EXCLUSIVE OR" type logical function. B.6) Estimation of several candidate values
• FIG. 7 represents the main steps of an implementation variant of the data extraction method 60 comprising, besides the steps described above with reference to FIG. 5, the estimation and verification of several candidate values of the first part of the packet counter until a stop criterion is verified.
• a set of several candidate values of the first part of the packet counter of the current encrypted packet is defined, and each estimated candidate value is iteratively verified using the verification code.
• the stopping criterion is for example checked when, for a given candidate value, the integrity of the current encrypted packet is verified, or as soon as the set of candidate values is exhausted without any candidate value being able to be satisfied. allow to consider the current encrypted packet as integrity.
• This implementation variant overcomes the possibility that a large number, for example greater than Nt, consecutive packets are missed by the access network 30.
• the estimate of the candidate value of the first part of the packet counter for the current encrypted packet as presented in section B.3 is false, and it is then advantageous to estimate several different candidate values of the first part of the packet counter , to allow the extraction of data.
• variable k introduced in section B.3 represents, for an encrypted packet in progress, the number of returns to zero of the second part of the counter. of packets of the terminal 20 since the last previous received packet for which the value of the first part of the packet counter could be estimated and verified.
• the current encrypted packet can, however, be considered as not being integrated due to a transmission error altering the encrypted data (for example due to interference) or if a bad authentication key has been used. In such a case, it would be unfortunate to iterate indefinitely on candidate values for which the encrypted packet can not be considered as integrity. Also, it is necessary to limit all the possible candidate values. For this purpose, it is possible, for example, to define the maximum frequency at which the terminal 20 can send packets to the access network 30.
• t (n-1) is the date of receipt of the previous packet
• t (n) is the date of receipt of the current packet
• k max is the maximum number of zero returns of the second part of the packet counter of the terminal 20 during the period of time between t (n-1) and t (n).
• the set of candidate values of the first part of the packet counter to be considered is then defined by:
• C 1 (n) (C 1 (n - 1) + k) modulo 2 (Nb1 "Nb2) , with k varying between 0 and k max .
• the terminals 20 transmit their packets asynchronously, said terminals 20 can nevertheless issue their packets with a certain regularity.
• a terminal 20 may transmit a predetermined number of packets per day, without, however, transmitting said packets in a strictly periodic manner.
• said packets will nevertheless be transmitted, on average, substantially periodically.
• the average transmission period of said terminal 20 is calculated according to the following expression: expression in which:
• Tem corresponds to the estimated average emission period for the terminal 20
• t (m) corresponds to the date of reception measured for the packet of rank m received from said terminal 20,
• C (m-1) corresponds to the value of the packet counter of the terminal 20 estimated for the rank packet (m-1) received from said terminal 20,
• t (m-1) corresponds to the measured reception date for the rank packet (m-1) received from said terminal 20,
• M is the total number of packets received from the terminal 20.
• the candidate values to be iterated can then be, for example, defined by the set:
• k k prob ⁇ i, i N, k ⁇ 0, k ⁇ k prob + k max
• the case in which the generation information is the packet counter of the terminal 20 has been considered in a nonlimiting manner.
• estimation of the value of the first part of the generation information of the terminal 20 for the current encrypted packet may depend on the type of generation information considered.
• the estimation of the first part of the value of said packet counter of the terminal 20 for the current encrypted packet advantageously takes account of the value of the first part of said estimated packet counter for the previous packet received from the same terminal
• the generation information considered corresponds to the generation date, by the terminal 20, of the packet to be transmitted then it is not necessary to take into account the value of the first part of the estimated generation date. for the previous packet received from the same terminal 20, and the value of the first part of the date of generation of the current encrypted packet by the terminal 20 is for example estimated according to the date of receipt of said current encrypted packet.
• the generation date of the current encrypted packet by the terminal 20 and the date of receipt of said current encrypted packet by the access network 30 have, in principle, respective first portions. substantially identical, and differ mainly in their respective second parts.
• the truncated information extracted from the current encrypted packet is representative of the second part of the date of generation of said current encrypted packet by the terminal 20, it is understood that it is possible to estimate the value of the date of generating said current encrypted packet based on the truncated information extracted from said current encrypted packet and depending on the date of receipt of said current encrypted packet by the access network 30.
• the value of the generation date the current encrypted packet is obtained by combining the first part of the date of receipt of the current encrypted packet with the second part of the generation date determined from the truncated information extracted from said current encrypted packet.
• the invention has been described by considering only packets transmitted on the uplink from the terminals 20 to the access network 30.
• the invention is however applicable, alternatively or in addition, on a downlink from the network.
• the invention is more generally applicable to the transmission, by a transmitting device, of a packet containing encrypted data and to the extraction, by a receiving device, data included in such a package.
• the invention has been described by considering a UNB wireless communication system. However, there is nothing to preclude, in other examples, considering other types of communication systems, including wired communication systems. However, the invention finds a particularly advantageous application in low speed wireless communication systems, that is to say with a flow rate of less than 1 kilobit / s.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Power Engineering (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)
• Data Exchanges In Wide-Area Networks (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=58314366

Family Applications (1)

Country Status (6)

Families Citing this family (4)

Family Cites Families (16)

• 2016
  • 2016-11-09 FR FR1660864A patent/FR3058604B1/fr active Active
• 2017
  • 2017-11-09 JP JP2019546077A patent/JP7100654B2/ja active Active
  • 2017-11-09 EP EP17793981.6A patent/EP3539253A1/fr active Pending
  • 2017-11-09 WO PCT/EP2017/078809 patent/WO2018087255A1/fr unknown
  • 2017-11-09 US US16/347,589 patent/US11070975B2/en active Active
  • 2017-11-09 CN CN201780076256.2A patent/CN110089072B/zh active Active

Also Published As

Similar Documents

Legal Events