FR2888348A1 - Electronic device e.g. portable telephone, for e.g. mail distribution field, has processor switching device`s execution in secured execution mode in which processor requests necessary for applicative program execution are considered - Google Patents

Abstract

The device has a processor (30) adapted for switching execution of the device in a secured execution mode. Requests of the processor necessary for the execution of a secured applicative program (APs) are taken into account, in the secured execution mode. A joystick permits to displace a pointer. A memory manager (32) is provided for storing digital images in a memory zone (33) which is accessible only in the secured execution mode. The screen displays a digital image representing a formula with three cases constituting entering zones. Independent claims are also included for the following: (1) a method for capturing a digital image and being implemented by a processor having a secured execution mode (2) a computer program comprising instructions for implementing a method for capturing a digital image (3) a data medium on which a computer program comprising instructions for the execution of a method for capturing a digital image is stored.

Description

2888348 1

  Title of the Invention Method and dematerialization device for guaranteeing the integrity of a digital image, in particular signed.

  BACKGROUND OF THE INVENTION The present invention relates to the general field of securing electronic devices.

  Preferably, but without limitation, the invention applies to open architecture terminals, that is to say terminals in which a user can install new applications. It can especially be used in a mobile phone or in a personal organizer (PDA).

  More precisely, the invention is in the context of the dematerialization of electronic documents, that is to say in the context of the replacement of a paper document by its electronic equivalent.

  Already known, particularly in the field of mail delivery, devices touch screens on which a user can, with the aid of a stylus, affix a handwritten signature on the digital image representing a delivery note.

  Such devices have two major disadvantages.

  First of all, there is no guarantee that the digital image displayed on the screen corresponds to the associated digital file in memory. This file could be modified by a malicious computer program, or by a virus.

  Secondly, there is no guarantee that the digital file representing the digital image and the signature affixed by the user will be altered later.

  Other dematerialization techniques are based on the use of personal cryptographic keys. Such methods most often use a pair of keys, the user using a cryptographic key to sign the electronic document, an associated verification key being used to verify the signature.

  But here again, there is no guarantee that the image displayed on the screen corresponds to the digital file that is supposed to represent it. When one is interested in the electronic signature, this problem is known as the 2888348 2 name of "WYSIWYS" (What You See Is What You Sign); it can be posed in the following way: to guarantee that the digital file on which the cryptographic calculation of signature takes place corresponds effectively to the image which is on the screen.

  In addition, key management processes are complex and difficult to implement.

  The object of the invention is therefore to provide a method and a device that do not require any personal cryptographic key and such that the file comprising the representation of the image displayed on the screen is faithful to this image, not repudiatable by its author , and unalterable later.

  For this purpose, the invention relates to an electronic device comprising means for displaying a digital image, means for entering information, and means for implementing an application program inviting a user to enter at least one a sensitive data item to be associated with a digital image presented to it.

  This device comprises a processor adapted to switch the execution of the device in a secure execution mode, namely a mode in which only the requests of the processor necessary for the execution of the application program are taken into account by the means of display and input.

  Thus, the invention makes it possible to guarantee that, in secure execution mode, all the operations and resources used for display and input are under the sole control of the application program.

  Those skilled in the art will understand that the digital image presented to the user is necessarily faithful to its digital representation, and that any data affixed to this image, for example a handwritten signature, will be protected from malicious attack.

  Preferably, the device according to the invention comprises means for storing a digital image in a memory zone accessible only in the secure execution mode.

  This characteristic advantageously makes it possible to store, in this protected area, the second digital image resulting from the combination of the initial digital image (for example the delivery note) and of the sensitive data input by the user (for example his handwritten signature ).

  In a preferred embodiment, the device further comprises means for implementing, in the secure execution mode, a signature program of a digital image.

  Thus, the digital image resulting from the above combination 5 can be signed, for example with a cryptographic key, to be subsequently transmitted to another application that holds the associated verification key.

  In a preferred embodiment, the display means comprise a screen and the input means a touch screen plate superimposed on this screen.

  Preferably, the processor is adapted to switch the execution of the device in an unsecured execution mode.

  This characteristic advantageously makes it possible to prioritize the different applications implemented by the electronic device.

  Specifically, critical, critical applications run in the secure environment and are isolated from other applications that are not trusted and may contain viruses.

  Correlatively, the invention relates to a digital image capture method capable of being implemented by a processor comprising at least one secure execution mode, this method comprising the following steps: switching the processor into execution mode secure if said processor is not in this mode; - display of a first digital image; - Obtaining at least one sensitive data from a user of the device, this data to be associated with the digital image; displaying a second digital image consisting of the first digital image and a representation of the sensitive data; - Capture and storage of this second digital image in a secure memory.

  Preferably, the processor furthermore comprises a non-secure execution mode and the capture method according to the invention comprises a step of failover in unsecured execution mode, this step being implemented after the capture and defrosting step. storing the second digital image in the secure memory.

  In this preferred embodiment, the processor can execute insecure applications, for example downloaded from the Internet, such applications being unfortunately likely to install viruses.

  But thanks to the invention, the critical applications of display and image capture in particular are protected from these viruses because they run in secure mode.

  Preferably, the failover step is also performed in the unsecured execution mode when the obtaining of the sensitive data has not been performed after the expiration of a delay.

  This feature provides an additional level of security, especially in the case where the user temporarily abandons his device when entering the sensitive data.

  The sensitive data may be representative of a handwritten signature, but also a choice in an electronic form, a number, a secret code, ...

  According to a preferred implementation, the different steps of the capture method are executed by computer program instructions.

  Consequently, the invention also relates to a computer program, this program being capable of being implemented in an electronic device, this program comprising instructions adapted to the implementation of the steps of the capture method.

  This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape.

  The invention also relates to an information carrier readable by an electronic device and comprising instructions of a computer program as mentioned above.

  The information carrier may be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a diskette (floppy disc) or a disk hard.

  On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet type network.

  Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

Brief description of the drawings

  Other features and advantages of the present invention will emerge from the description given below, with reference to the accompanying drawings which illustrate an embodiment having no limiting character. In the figures: FIGS. 1A and 1B schematically represent an electronic device according to the invention in a first embodiment; - Figures 2A and 2B show an electronic device according to the invention in a second embodiment; FIGS. 3A and 3B show an electronic device according to the invention in a third embodiment; FIG. 4 represents the architecture of the electronic device of FIGS. 2A and 2B; and FIG. 5 represents, in flowchart form, the main steps of a capture method according to the invention in a preferred embodiment.

  Detailed description of an embodiment

  FIG. 1A represents an electronic device 101 according to the invention.

  This device 101 comprises display means constituted by a screen 10.

  On this screen is displayed a digital image IiA representing a form with three boxes constituting possible input areas.

  The electronic device 101 comprises input means constituted here by a button (joystick) 21 for moving a pointer.

  The electronic device 101 also includes a light indicator 70 whose use will be described later.

  FIG. 1B represents the device 101 of FIG. 1A, after the user has entered a sensitive data item D1 corresponding to the selection of the second box of the form. The digital image constituted by the combination of the image IlA representing the blank form and the sensitive data item D1 has been referenced I1B.

  FIG. 2A represents an electronic device 102 according to the invention in another embodiment.

  In this variant, the input means consist of a touch screen 22 superimposed on the screen 10, and a stylet 23 or a hand 24 to which the touch screen 22 can react.

  The digital image I2A here is representative of a text.

  FIG. 2B represents the digital image I2B constituted by the text of the digital image I2A and a signature D2 (sensitive data) affixed to the digital image I2A by means of the stylus 23.

  FIG. 3A represents another electronic device 103 according to the invention.

  This electronic device comprises input means 25 constituted by a keyboard.

  The image I3A represents in particular an input area that the user can enter through the keyboard 25.

  In Figure 3B, it has been assumed that the user has entered the sensitive data D3 filling this field. The digital image constituted by the combination of the initial digital image I3A and the sensitive data item D3 has been referenced I3B.

  Figure 4 schematically shows the architecture of the electronic device of Figures 2A and 2B.

  This architecture comprises a processor 30, a flash memory 35, a memory 34, and a memory manager 32.

  It also comprises a screen 10 associated with its controller 50, a touch screen 22 associated with its controller 60, a clock 80 and the indicator light 70.

  All these elements are interconnected by a bus system 100.

  According to the invention, the processor 30 is a processor adapted to switch the execution of the device 102 in a secure execution mode.

  In the preferred embodiment described here, the environment is consistent with that of the ARM TrustZone architecture as described in the document "TrustZone: integrated hardware and software security" by Tiago Alves and Don Felton, July 2004, published in particular at the following Internet address http://www.arm.com/products/CPUs/archtrustzone.html.

  In this embodiment, the processor 30 proposes a new instruction, noted here "IS", to switch to secure mode, and a new level of "secure" permission, noted here "MS", which adds to the known mode "user" and "kernel" processor.

  The data bus 100, which connects all the components, has an additional bit of security (called "bit secure") which can only be set by the processor 30.

  This security bit may be interpreted by the screen controller 50 and the controller of the touch screen panel 60.

  In the preferred variant described here, this security bit may also be interpreted by the memory manager 32.

  In this variant, the memory manager 32 controls two memory zones, namely a zone 36 that can be used when the processor is in the "user" or "kernel" mode, and another memory zone 33 accessible only in the mode of operation. secure execution, i.e., when the processor 30 has set the security bit.

  In the preferred embodiment described here, the flash memory 35 comprises a secure application program AP_S and an unsecured application AP.

  In the embodiment described herein, the memory 34 includes a digital image signature program P_SIG, which program can only be executed when the processor 30 is in secure mode.

  We will now describe with reference to Figure 5 the main steps of a digital image capture method according to the invention.

  It will be assumed in this description that the unsecured AP application is running.

  It will also be assumed that this non-secure application program AP requires the display of an I2A digital image, the capture of a handwritten signature D2 to be associated with this digital image I2A, the capture and archiving of the digital image I2B constituted by the original image I2A and the signature D2.

  For this purpose, the application program AP initiates the execution of the secure application program AP_S.

  During a first step E10, the secure application program AP_S switches the device 102 in a secure execution mode.

  To do this, the processor 30 executes the instruction IS, which has the effect of switching the system into the secure mode MS.

  The processor 30 then positions the secure bit on the bus 100 and the screen controllers 50, touch screen 60, and memory management 32, detecting this secure bit on the bus 100, put themselves in a mode where only the processor requests 30 necessary for the execution of the secure application program AP_S are taken into account.

  The switching step E10 is followed by a step E20 during which the image I2A representing a text is displayed.

  When this image is displayed, the indicator 70 is turned on.

  Those skilled in the art will understand that this image is necessarily faithful to its representation in memory, since no application other than the secure application AP_S could intervene on the memory manager or on the screen controller 50.

  This display step E20 is followed by a step E30 during which a timer is started that is supported by the clock 80.

  The triggering step E30 is followed by an E40 test in which it is checked whether a predetermined time has elapsed since the start of the counter in step E30.

  If this is the case, the capture process ends.

  Otherwise, the E40 test is followed by an E50 test in which it is checked whether the user has finished entering it. In a preferred embodiment, when the user has entered his signature D2 by means of the stylus 23 on the touch screen 22, he notifies this end of input to the system by pressing a virtual button displayed on the screen.

  If this is not the case, the result of the E50 test is negative. This test is then followed by the control test E40 of the end of delay already described.

  When the signature has been affixed (sensitive data D2 obtained), the test E50 is followed by a step E60 during which an image I2B is displayed on the screen 10 constituted by the combination of the original image I2A and of the handwritten signature D2.

  It will be assumed here that a confirmation step E70 allows the user to validate this signature by expressly requesting the capture of the I2B image.

  This confirmation step E70 is followed by a step E80 in which the second digital image I2B is captured and stored in the secure zone 33 controlled by the memory manager 32.

  The capture and storage step E80 is followed by a step E85 in which the digital image I2B is digitally signed using the P_SIG signature program.

  This signature step is known to those skilled in the art and will not be described here. For example, it can use a private / public key system.

  The signature step E85 is followed by a step E90 in which it is rebased in the unsecured execution mode.

  To do this, the processor 30 deletes the positioning of the security bit. During this switching step E90, the indicator 70 is turned off.

  Thus the indicator light 70 remains lit only during the execution of the display operations of the digital image, capture and screenshot.

  The secure AP_S application program terminates and execution of the unsecured AP calling program continues.

  At the end of the screen capture process, the file corresponding to the image I2B forms a digital image which has been mastered by the creation process and which can then be copied to the unsecure memory 36 and / or transferred to a third. The secure application program AP_S ensures that the digital image captured is the one that the user has signed on the screen 10 of the device 102.

  And as this application runs in the secure environment, it is impossible that this image was copied and / or modified by a malicious application.

  The signature of the image guarantees its integrity and its origin during a transfer. If this image is modified by a third-party application, the signature will no longer be valid.

  The digital image I2B is the electronic equivalent of a paper manually signed by the user.

Claims (12)

  An electronic device (101) having display means (10) for a digital image (I1A, I1B, I2A, I2B, I3A, I3B), information capturing means (21), and means ( 30, 31, 32, 33) for implementing an application program (AP_S) inviting a user to enter at least one datum (D1) to be associated with a digital image (I1A, I2A, I3A) presented to him , said device (101) being characterized in that it comprises a processor (30) adapted to switch the execution of said device (101) in a secure execution mode (MS), in which only the requests of said processor necessary at the execution of said application program (AP_S) are taken into account by said means (10) for display and input (21).   2. Electronic device according to claim 1, characterized in that it further comprises means (32, 33) for storing a digital image (I1A, I1B, I2A, I2B, I3A, I3B) in a memory area ( 33) accessible only in the Safe Execution (MS) mode.   3. Electronic device according to claim 1 or 2, characterized in that it further comprises means (30, 32, 33, 34) adapted to implement, in said secure execution mode, a program (P_SIG ) for signing a digital image (I1B, I2B, I3B).   4. Electronic device according to any one of claims 1 to 3, characterized in that said display means (10) comprise a screen, and said input means a touch screen (22) superimposed on said screen (10).   5. Electronic device according to any one of claims 1 to 4, characterized in that said processor (30) is adapted to switch the execution of said device in an unsecured execution mode.   2888348 12 6. Digital image capture method that can be implemented by a processor (30) having a secure execution mode, characterized in that it comprises the following steps: -basch (E10) processor (30) in secure execution mode 5 (MS) if the same processor is not in this mode; - displaying (E20) a first digital image (I1A, I2A, I3A); obtaining (E50) at least one datum (D1) originating from a user of said device, this datum (D1) to be associated with said digital image (I1A, I2A, I3A); displaying (E60) a second digital image (I1B, I2B, I3B) consisting of said first digital image (I1A, I2A, I3A) and a representation (D1) of said data item (D1); and capturing (E80) and storing said second digital image (I1B, I2B, I3B) in a secure memory (33).   7. An image capture method according to claim 6, wherein said processor further comprises an unsecured execution mode, characterized in that it comprises a step (E90) for switching the processor in an execution mode. unsecured, this step being implemented after said step (E80) for capturing and storing the last digital image (I1B, I2B, I3B) in the secure memory (33).   8. capture method according to claim 6 or 7, characterized in that one switches to unsecured execution mode when said step (E50) of obtaining has not been performed after the expiration of a predetermined time.   9. Capture method according to any one of claims 6 to 8, characterized in that it comprises a step (E85) of signature of said second digital image (I1B, I2B, I3B), this signature being carried out in secure execution (MS).   10. An image capture method according to any one of claims 6 and 9, characterized in that said datum (D1) is a signal representative of a handwritten signature.   2888348 13 11. Computer program on an information carrier, said program being characterized in that it comprises instructions adapted to implement an image capture method according to any one of claims 6 to 10 when said program is run by a computer.   12. A computer readable information medium on which a computer program is stored which includes instructions for executing the image capture method according to any one of claims 6 to 10.