FR2882209A1 - METHOD OF AUTHENTICATING AN ELECTRONIC LABEL USING A CRYPTOGRAPHIC ALGORITHM WITH A PUBLIC KEY - Google Patents

Abstract

The invention relates to a method of authentication of an electronic tag (1) by a server (2) and the use of a public key cryptography algorithm whose secret key is known to the server (2). The electronic tag (1) comprises a secret identifier also accessible by the server (2). The method consists, on the label, in: - encrypting (12) the secret identifier by iteration of the encryption algorithm, - encrypting (15) the result of a bijective function having, as input parameters, a random sent by the server (2) and the concatenation of the encrypted secret identifier and the number of iterations, and on the server, to: - decrypt (17) the transmitted result, - use (18) the inverse bijective function and the randomly to extract the encrypted secret identifier and the number of iterations, decrypt the secret identifier by iteration of the decryption algorithm, and search for it on the server.

Description

2882209 1

  The present invention relates to a method of authentication of an electronic tag by an authentication server and using a public key encryption / decryption algorithm, the tag comprising a counter initialized to the null value and a register of current identifier initialized with a secret identifier of the electronic tag and the authentication server having access to storage means of said secret identifier of the electronic tag.

  It also relates to the authentication system, the electronic tag and the associated authentication server.

  The massive and increasing use of electronic tags (Radio Frequency IDentifiers (RFID) - radio-frequency identifier, cards without contacts, ...) pose new security problems.

  In particular, it raises the issue of protecting the privacy of the carriers of these labels. Indeed, the detection of a label by a reader can be done without particular action of the wearer, by mere proximity. Combined with a growing interaction between these readers, the frequent identification of these tags allows the constitution of databases to track the wearer at the expense of anonymity.

  The object of the invention is therefore to propose a method for authenticating an electronic tag accessible only to authorized readers / servers and thus not allowing a third party to trace a tag by the information it generates.

  The object of the invention is a method of authentication of an electronic tag by an authentication server and using a public key encryption / decryption algorithm, the electronic tag having a counter initialized to the value null and a current identifier register initialized with a secret identifier of the electronic tag and the authentication server having access to storage means of said secret identifier of the electronic tag, said method comprising the steps of: a) encryption by the electronic tag of said current identifier by a number of iterations of the encryption algorithm using said public key, incrementation of the counter of said number of iterations and storage of the value of the counter, storage of the result of the encryption in the current identifier register, b) transmission of a randomness from the authentication server to the electronic tag, c) ch efectly, by the electronic tag, the result of a bijective function having two input parameters, the first parameter being the random and the second parameter being the concatenation of the current encrypted current identifier and the counter, said function being as the second parameter is computable from the result of this function, the random and the inverse function, d) emission of the result of the encryption to the authentication server, e) decryption by the authentication server of the result using the secret key associated with the public key and the decryption algorithm, then f) calculating the second parameter from said inverse function, the random and the decrypted result, g) separation in the second parameter of the value derived from the current identifier and the counter, h) decryption of the value derived by successive iterations of said number of iterations, of the decryption algorithm t with the secret key, i) search in said storage means of said decryption result thus calculated, j) authentication of the electronic tag if said search is positive.

  Other characteristics of the authentication method are: prior to step b), the electronic tag issues an authentication request to the authentication server; in step a), said number of iterations is equal to 1 and is applied to the current identifier stored in step a) during the preceding authentication; the encryption step a) is performed after step c) in preparation for a subsequent authentication; and the encryption algorithm is an RSA algorithm using a low value exponent; the authentication server is initialized by loading an image of the secret identifier obtained by using a single-direction function, and the step h) is followed by a step of calculating an image the result of decryption obtained using the same function and step j) is replaced by a step of searching for said image; a first pair of public / secret keys is used in steps a) and h) for the encryption / decryption of the current identifier and a second public / secret key pair is used in steps c) and e) for encryption / decryption of the result of the bijective function.

  Other objects of the invention are - an electronic tag, comprising: - storage means of a current identifier; means for storing a public key and means for implementing an asymmetric encryption algorithm using this public key; a counter able to increment the number of iterations 15 of application of the encryption algorithm of the current identifier; first computing means adapted to iterate the encryption of the current identifier by a predetermined number of iterations using the encryption algorithm and said public key; means of communication with an authentication server able to receive a random value from this server and to send back the result obtained by second means for calculating a bijective function having two input parameters, the first parameter being the hazard and the second parameter being the concatenation of the current encrypted identifier and the counter, said function being such that the second parameter is computable from the result of this function, of the hazard and of the inverse function; an authentication server, comprising: means for accessing means for storing at least one secret identifier of an electronic tag; means for generating a hazard; means of communication with the electronic tag able to transmit to it the random generated and to receive a value in return; Means for implementing an asymmetric decryption algorithm to which means for storing a secret key are connected; first means for decrypting the value received by using the means for implementing the asymmetric decryption algorithm; means for calculating an inverse bijective function having two input parameters, the first parameter being the random value and the second parameter the result of the first decrypting means; separating means capable of extracting from the result of the bijective function a first value and a second value considered as a number of iterations; second decryption means able to repeat the number of iterations contained in the second value of the decryption algorithm with the secret key on the first value; means for finding the value decrypted in the storage means of the secret identifier; and an authentication system comprising at least one electronic tag and at least one authentication server.

  The invention will be better understood on reading the description which will follow, given solely by way of example, and with reference to the appended drawings in which: FIG. 1 is a block diagram of a system of FIG. authentication according to the invention; FIG. 2 is a flow chart of an embodiment of the method according to the invention; FIG. 3 is a detailed flow chart of an encryption operation; Figure 4 is a detailed flowchart of a decryption operation; FIG. 5 is a block diagram of an electronic tag; and Figure 6 is a block diagram of an authentication server.

  The authentication system, FIG. 1, comprises an electronic tag 1 connected to an authentication server 2 by a wireless link 3.

  The electronic tag 1 is, for example, a contactless card or a radio frequency identifier.

  The authentication server 2 is, for example, a base station, a banking terminal or a radio frequency reader. Generally, the authentication server 2 is connected by a conventional data link 4, for example of the TCP / IP (Transfer Control Protocol / Internet Protocol) type, to other processing and storage machines. information.

  The link 3 is generally a very short-range radio-frequency link, for example that defined by the ISO 14443 standard. An infrared link is also possible although having the disadvantage of operating only at sight between the tag 1 and the authentication server 2.

  The authentication method, described below, is based on asymmetric cryptographic algorithms. These algorithms are well known to those skilled in the art, the most famous of them being the RSA algorithm. For the understanding of what will follow, it will be recalled only that to encrypt a transmission of information between an Alice transmitter and a receiver Bob with such an algorithm, it is necessary for Bob to generate a pair of keys: a public key and a key secret. Bob then sends Alice her public key. Alice encrypts her message using Bob's public key and the appropriate encryption algorithm and passes the encrypted message to Bob. Bob decrypts the message with his secret key and the corresponding decryption algorithm.

  The mathematical properties of these algorithms are such that knowledge of the public key alone does not allow decryption.

  In the following description, note PA public key A and SA his secret key. The encryption algorithm will be noted Asym and the corresponding decryption algorithm Asym-1.

  The electronic tag 1 comprises means for implementing the Asym encryption algorithm and means for storing the public key P2 of the authentication server 2, common to a set of authentication servers. The authentication server 2 comprises means for implementing the decryption algorithm Asym "" and means for storing the secret key S2.

  Prior to any authentication method, FIG. 2 implements a first card initialization step during which a current identifier register KI is initialized with a secret identifier IS specific to this tag. This secret identifier is, for example, a serial number or the result of a diversification such as MAC (Message Authentication Code Message Authentication Code). A counter CI is also initialized to 0.

  In parallel, step 11, the secret identifier IS of the electronic tag 1 is also loaded on the authentication server 2, or is accessible by the authentication server 2 to another machine 5.

  Then, prior to authentication, the tag digitizes the secret identifier IS by successive iteration of the Asym encryption algorithm with the public key P2 and stores the number of iterations in the counter CI as well as the result of the encryption in a Ki register.

  With reference to FIG. 3, this step 12 is divided into an encryption step 12A y = Asym (P - ,, K), a step of storing the result in 12B in the register KI K1 y and an incrementing step at 12C of the CI F-CI +1 counter.

  Steps 12A to 12C are repeated N times, N being a predetermined value selected, for example, randomly.

  The secret identifier IS having thus been encrypted, the electronic tag 1 in this embodiment transmits at 13, FIG. 2, an authentication request to the authentication server 2.

  It responds to 14 by sending a random R, that is to say some random value.

  At 15, the electronic tag 1 concatenates the previously encrypted current identifier KI and the number of iterations CI and encrypts with the public key P2 the result of the exclusive-OR operation between the hazard R and this concatenation, namely X = Asym (P2, (K1 C1) R) classically denoting the result X, the concatenation and the exclusive OR e. Remember that the OR-exclusive operation of two numbers in binary notation consists of adding the 2 bit-to-bit numbers modulo 2.

  This result X is sent at 16 by the electronic tag 1 to the authentication server 2.

  By using its secret key S2, the authentication server 2 decrypts the result X in 17 with the decryption algorithm Asym "', ie X' = Asym-1 (S2, X) and then calculates at 18 the exclusive-OR of X 'with the randomness R, let Z' = X'O + R For the understanding of the operation, it is recalled that performing twice an exclusive-OR using the same operand amounts to doing an identity operation: X = XO + RO + R.

  Thus, it is possible to use another bijective function than the OUexclusive, this function having the property that, knowing the inverse function and the hazard, it is possible to find the initial value. For example, multiplication or addition with randomness are functions with this property.

  The result Z 'of the exclusive-OR can be separated into 19 into a first value K'1 and a second value C'1 such that Z' = K'1 C'1. The second value C'1 is interpreted as indicating the number of iterations performed to encrypt the secret identifier.

  The first value K'1 is thus decrypted by repeating the number of iterations C'1 using the decryption algorithm Asym "'with the secret key S2 of the server, ie IS' _Asym - ') (' (S2, K ', This operation, symmetrical to the encryption operation of step 12 decomposes, FIG. 4, according to the following algorithm: - decryption at 20A of the first value K'l using the algorithm decryption Asym- 'and secret key S2 of authentication server 2, assignment of the result of decryption to K'i, in 20B, - decrementation of counter C'1, in 20C, - if C'1 is positive, in 20D, return to step 20A.

  2882209 8 This gives a value IS '. It is then searched in 21 if this IS 'value is equal to the secret identifier IS which had been stored in the server, or made accessible to the latter, during step 11.

  In general, the server has a list of secret identifiers corresponding to all valid tags for the application. By methods well known to those skilled in the art (read in sequence, hash table, ...) the server looks in this list of secret identifiers if one of them corresponds to the value IS '.

  If such a secret identifier is found, then the electronic tag 1 is authenticated at 22.

  A method has thus been described which advantageously allows an authentication of the electronic tag 1 without a third party being able to intercept the identifier of the tag or pretend to be the authentication server.

  Indeed, the prior encryption of the secret identifier according to a number of iterations which is preferably different to each authentication request makes the label can be seen by a third party only as a different label for each test. authentication.

  A preferred way to obtain this variation is to execute one and only one encryption operation on the value KI stored during the previous authentication, before an authentication and thus to increment the counter CI by one unit before each authentication.

  It should be noted that in this variant, the encryption of K, and the incrementation of the counter can take place indifferently before or after the calculation, step 15, of the value X transmitted to the authentication server 2.

  In another variant of the method, the Asym encryption algorithm is an asymmetric RSA algorithm with a low value exponent, for example a value of 3. The calculation of step 12A then amounts to carrying out 2 multiplications modulo n, where n is the product of several prime numbers. For any reference to the RSA algorithm, reference may be made to Ronald L. Rivest, Adi Shamir, Leonard M. Adleman "A Method for Obtaining Digital Signatures and Public Key Cryptosystems", Commun. ACM 21 (2): 120126 (1978).

  Thus a microprocessor card without a crypto-processor or a radio frequency identifier can easily perform the operation. This advantageously makes it possible to use low cost components.

  Moreover, in this variant, the verification by the authentication server 2 is done quickly: the iterated application C'1 times of Asym - '(S2, K'I) is done in a single calculation of Asym - '(S'2, K'1) where S'2 is the inverse of P2 raised to the power C'l modulo ço (n) with (0 (n), Euler function.

  In another variant, two pairs of public / secret keys are used. A first pair is used to encrypt and decrypt the secret identifier IS, steps 12 and 20, and the second pair is used to encrypt and decrypt the result of the exclusive OR operation, steps 15 and 17.

  This advantageously makes it possible to modulate the size of the key pairs according to the security constraints. For example, a risk analysis may lead to increasing the size of the key pair used for the transfer, while keeping a key size allowing a quick calculation for the iterative calculation on the secret identifier.

  In another variant, the secret identifiers IS are not stored in the authentication server 2. Instead, an image of the secret identifier is stored by a one-way function such as a SHA type of condensation function (by for example, NITS, FIPS 180-1 and 180-2) or encryption by a symmetric algorithm with a secret key.

  The only change is then to use the same function on the result of the decryption operation 20 and to search for the result with the list of images of the identifiers.

  This variant advantageously protects the secret identifier by avoiding its dissemination on a multitude of authentication servers.

  For the implementation of this method, the electronic tag 1 therefore comprises, FIG. 5, storage means 50 of the current identifier KI, storage means 51 of the public key P2 and means 52 for implementing of the encryption algorithm Asym.

  It also comprises a counter 53 containing the value of CI corresponding to the total number of iterations since the initialization of the card.

  All the preceding means are connected to first computing means 54 for iteration of the encryption of the secret identifier IS to obtain the value KI stored in storage means 55.

  The electronic tag 1 also comprises second calculation means 56 capable of encrypting the result of the exclusive-OR operation, or of an equivalent bijective function, between the randomness R and the concatenation of the secret encrypted identifier. K1 and the value C1 contained in the counter 53.

  The hazard R is received from the authentication server 2 by the communication means 57 of the electronic tag 1.

  These same communication means 57 are adapted to send to the authentication server 2 the result of the calculation carried out by the means 56.

  The authentication server 2 comprises, FIG. 6, communication means 60 connected to randomization generating means 61 in order to be able to send this hazard to the electronic tag 1. These communication means 60 are also connected to first ones. decryption means 62 capable of decrypting the value transmitted by the electronic tag 1.

  These first decryption means 62 use the means 63 for implementing the decryption algorithm Asym-1 to which the storage means 64 of the secret key S2 are connected.

  The authentication server also comprises means 65 for calculating exclusive-OR, or an equivalent bijective function, between the random value R and the value decrypted by the decryption means 62, the result of which is transferred to means 66. separating the first value K'1 and the second value C'1.

  Second decryption means 67 are adapted to repeat the number of iterations C '1 using the means 63 for implementing the Asym-1 decryption algorithm.

  The result is transferred to search means 68 for the secret identifier IS stored in storage means accessible by access means 69.

  In one variant, the authentication system comprises a plurality of authentication servers sharing the pair of keys (public, secret).

  In general, the authentication system comprises electronic tags and at least one authentication server as described above.

  The method thus described and the system associated with it advantageously allow authentication of electronic tags accessible only to authorized servers, that is to say to those who know the secret identifier. A third party can not therefore draw such a label by the information it generates, which varies with each request for authentication in a mode that seems random to this third party.

  They also allow and advantageously ensure a retroactive non-traceability, that is to say that an unauthorized third party who seized the electronic tag and thus accesses its content is not able to correlate these information with past communications of the tag with servers since it can not unroll the process in reverse chronological order.

  Finally, since this method only requires simple calculations on the electronic tag side, it can be implemented in hardwired logic, which advantageously makes it possible to use low cost tags.

2882209 12

Claims (10)

  1. A method of authentication of an electronic tag (1) by an authentication server (2) and using a public key encryption / decryption algorithm, the electronic tag (1) comprising a counter (CI ) initialized to the null value and a current identifier register (KI) initialized with a secret identifier (IS) of the electronic tag and the authentication server (2) having access to storage means of said secret identifier (IS ) of the electronic tag, said method comprising the steps of: a) encrypting (12) by the electronic tag (1) of said current identifier (KI) by a number of iterations of the encryption algorithm using said public key , incrementing the counter (CI) of said number of iterations and storing the value of the counter, storing the result of the encryption in the current identifier register (KI), b) transmitting (14) a randomness (R) the authentication server (2) to the electronic tag (1), c) encryption (15), by the electronic tag (1), the result of a bijective function having two input parameters, the first parameter being the hazard (R) and the second parameter being the concatenation of the current encrypted identifier (KI) and the counter (C1), said function being such that the second parameter is computable from the result of this function, the random and the inverse function , d) transmitting (16) the result of the encryption to the authentication server (2), e) decrypting (17) by the authentication server (2) of the result using the secret key associated with the public key and the deciphering algorithm, then f) calculating (18) the second parameter from said inverse function, the random and the decrypted result, g) separating (19) in the second parameter from the value derived from the current identifier (K'1) and counter (C'1), 2882209 13 h) de enciphering (20) the derived value by successive iterations of said number of iterations (C'1), the decryption algorithm with the secret key, i) searching (21) in said storage means of said decryption result as well as calculated, j) authentication (22) of the electronic tag if said search is positive.   2. Authentication method according to claim 1, characterized in that prior to step b), the electronic tag (1) issues an authentication request to the authentication server (2).   3. Authentication method according to any one of the preceding claims, characterized in that in step a), said number of iterations is equal to 1 and is applied to the current identifier stored in step a) during the previous authentication.   4. Authentication method according to claim 3, characterized in that the encryption step a) is performed after step c) in preparation for a subsequent authentication.   5. Method according to any one of the preceding claims, characterized in that the encryption algorithm is an RSA algorithm using a low value exponent.   6. Method according to any one of the preceding claims, characterized in that the initialization of the authentication server is done by loading an image of the secret identifier obtained using a one-way function, and the step h) is followed by a step of calculating an image of the result of decryption obtained using the same function and step j) is replaced by a step of searching for said image.   7. Method according to any one of the preceding claims, characterized in that a first pair of public / secret keys is used in steps a) and h) for the encryption / decryption of the current identifier (KI) and a second pair public / secret key is used in steps c) and e) for the encryption / decryption of the result of the bijective function.   8. Electronic label, characterized in that it comprises: means (50) for storing a current identifier, 2882209 14 - means (51) for storing a public key and means (52) for setting implementation of an asymmetric encryption algorithm using this public key, - a counter (53) able to increment the number of iterations 5 of application of the encryption algorithm of the current identifier, - first ( 54) computing means adapted to iterate the encryption of the current identifier of a predetermined number of iterations by using the encryption algorithm and said public key, - means (57) of communication with an authentication server 10 adapted to receive a randomness of this server and to send back the result obtained by - second (56) means for calculating a bijective function having two input parameters, the first parameter being the hazard and the second parameter being the concatenation of the identifier encrypted current and counter (53), said function being such that the second parameter is computable from the result of this function, the hazard and the inverse function.   9. Authentication server, characterized in that it comprises: means (69) for accessing means for storing at least one secret identifier of an electronic tag (1), - means (61) ) of generation of a hazard, - means (60) of communication with the electronic tag (1) able to transmit to it the random generated and to receive a value in return, - means (63) for implementation an asymmetric decryption algorithm to which are connected means (64) for storing a secret key; first (62) means for decrypting the value received by using the means for implementing the decryption algorithm; asymmetric means - means (65) for calculating an inverse bijective function having two input parameters, the first parameter being the random and the second parameter the result of the first decrypting means (62), - means ( 66) capable of extracting from the result of the bijec function a first value and a second value considered as a number of iterations, second (67) decryption means able to repeat the number of iterations contained in the second value the decryption algorithm with the secret key on the first value, means (68) for finding the value decrypted in the storage means of the secret identifier.   10. Authentication system characterized in that it comprises at least one electronic tag according to claim 8 and at least one authentication server according to claim 9.