FR2998687A1 - Electronic system i.e. chipset, for use in e.g. smart card of portable smartphone, has memory for storing information associated with user, where confidence operating system, controller and screen adjusts confidence environment for user - Google Patents

Abstract

The system i.e. chipset (1000), has a secure non-volatile memory (1160) for storing information associated with a user. The information is obtained by a confidence operating system (1150), a secure operating system (1170) and a human computer interface i.e. keyboard (2100). The confidence operating system, a display controller (1500) and a screen (2000) adjusts a confidence execution environment (1100) for the user at a time of access of the user to the confidence execution environment via a general-purpose execution environment (1200). The information comprises a phrase, a personal identification number, a photograph, an image, a screen background, a sound, a vibration, font characters, choice of language, choice of currency, bank account number, a choice of mode of interaction with an application, a light, or activation of LED keyboard keys. Independent claims are also included for the following: (1) a method for adjusting an electronic system (2) a confidence operating system comprising a set of instructions for executing a method for adjusting an electronic system.

Description

TECHNICAL FIELD AND PRIOR ART The invention is in the field of electronic devices comprising several execution environments, at least one of which is a trusted execution environment and another a versatile execution environment. In such an electronic device, the trusted environment forms a secure area of the electronic device specific to it, and the versatile environment forms an open and multifunctional environment. In this category of devices are found intelligent mobile phones, touch pads, microcomputers, autonomous intelligent systems, based on the concept of "machine to machine" (M2M), for example on-board computers, and generally devices using secure microcircuits. It is recalled that there are secure microcircuits including smart cards, memory cards, USB authenticators and secure elements ("secure elements"). The trusted execution environment is implemented using a secure processor, which may be a processor dedicated to this task, or have other functions, and a secure rewritable non-volatile memory, and is based on a trusted operating system. This trusted operating system has a secure boot mechanism that verifies that the electronic device starts in a trusted state, for example by checking the integrity of the code executed on the electronic device, including the system code. Trusted operation. The trusted operating system starts when no other operating system has booted before. The integrity of the secure non-volatile rewritable memory is, for example, verified by means of encryption techniques and fingerprint verification (hash function). Thanks to the trusted execution environment, it is possible to store sensitive data in the electronic device. To maintain the secure nature of the trusted execution environment, only trusted applications from trusted (or trusted) sources that the user does not have control are installed in the memory of that environment and are executed under the control of its operating system. For example, a PIN entry application (which can be a PIN code, or a one-time password) can be installed in the trusted execution environment. In a trusted environment, electronic devices provide versatile runtime environments for flexibly and powerfully executing applications from a wide variety of sources, including applications downloaded from the Internet, on a device with a trusted environment and a versatile environment. the trusted and versatile environments may be operating at the same time, provided that the trusted environment was started before the multipurpose environment, but then when one is active, the other is in idle mode. Moreover, each device of the electronic device which constitutes a common resource for the two environments, as it is the case generally of the keyboard or the screen, is controlled or used at a given time exclusively by or to one of the two environments. Nevertheless, it is difficult to know for the user whether the peripherals of his electronic device, in particular the screen, are controlled at a given time by an application executed in the trusted execution environment or the Versatile execution environment. This is a problem and for example an attack against an electronic device 25 may consist in installing in the versatile execution environment an application that reproduces the design of the confidential application trusted code entry installed in the environment of confidence. Thus, the user is abused and discloses his PIN in an unsecured environment, which allows a fraudster to obtain it, for example via a network to which the electronic device is connected. Document EP1688859 discloses a method for a microcircuit card to authenticate an application downloaded to a portable telephone. It uses an authentication module in the phone, which stores information in a tamper-proof region. But the user is not able, with this system, to verify the authenticity of the application by itself. Document US20090089215 discloses a method by which an Internet site authenticates itself to an Internet user by the use of personalization information of the Internet site. This system does not allow the authentication of an application on an electronic device. An object of the invention is to provide a system and a method for customizing a trusted execution environment for the user and in particular the authentication of the trusted execution environment with the user, in the circumstances where it uses trusted functions since the versatile operating system. Definition of the invention and associated advantages To achieve this goal, there is provided an electronic device comprising a trusted execution environment and a versatile execution environment, characterized in that it comprises means for obtaining a information associated with or shared with a user, a secure memory for storing said information once it has been obtained, and means for adapting the trusted environment for said user on the basis of said information when subsequent access of the user to said trusted execution environment via the versatile execution environment. Due to the peculiarities of this device, the trusted environment is suitable for a given user, when that user accesses the trusted execution environment via the multipurpose environment. In some embodiments, the information is authentication information of the trusted execution environment to the user. It can also be a customization information of a display of said trusted execution environment. In some embodiments, the obtaining means are implemented when the electronic device is started for the first time or are implemented during a startup of the electronic device in which a launch program detects a request of the 'user. The means of obtaining can be understood or implemented in the trusted execution environment.

The information can be obtained by a user input via a human machine interface, for example on a keyboard. In general, the information may include a phrase, a personal identification number, a photograph, a color, an image, a wallpaper, a font, a choice of language, a choice of currency, a bank account number, or a choice of how to interact with an application. Also, and this is advantageous in the absence of a screen, a sound, a vibration, a light, the activation of a keypad LED keys can be used. The secure memory is secured by encryption techniques and fingerprint verification or by being embedded in a System on Chip or by the fact that it is a dedicated memory. The means for adapting the trusted environment includes a secure controller for connecting a device operation to a trusted environment or a multipurpose environment.

Preferably, the adaptation means of the trusted environment comprise a secure processor, and / or are understood or implemented in the trusted execution environment. Advantageously, the means of exploiting said information during a subsequent access of the user to said trusted execution environment via the polyvalent execution environment comprise an interface for accessing an application of the environment of the environment. trusted execution through an application of the versatile runtime environment. It is also advantageous that, during a startup of the terminal, a launcher is configured so that an operating system of the versatile runtime environment is launched only when an operating system of the environment trusted execution has been successfully launched.

It is specified that in an architecture versatile and trusted execution environments are included on the same chipset. The invention also relates to a mobile telephone terminal comprising an electronic device as presented above.

The invention also relates to a method of adapting an electronic device comprising a trusted execution environment and a versatile execution environment, characterized in that it comprises a step of obtaining information associated with a user or shared with it, and a step of storing said information once it is obtained in a secure memory for adapting a function of the trusted environment for said user on the basis of said information during subsequent access of the user to said trusted execution environment via the versatile execution environment. The invention also relates to a trusted operating system comprising instructions which, when executed by a processor, implement a method as presented above. BRIEF DESCRIPTION OF THE FIGURES FIG. 1 shows an embodiment of a device according to the invention.

Figure 2 shows a general embodiment of a method according to the invention. FIG. 3 shows a first particular embodiment of a method according to the invention. Figure 4 shows a particular aspect of the first embodiment mentioned above.

FIG. 5 presents a second particular embodiment of a method according to the invention. FIG. 6 shows a third particular embodiment of a method according to the invention. FIG. 7 presents a fourth particular embodiment of a method according to the invention. Figure 8 shows a particular aspect of the fourth embodiment of the invention.

DETAILED DESCRIPTION OF THE FIGURES FIG. 1 shows a mobile telephone terminal 100, comprising a chipset (or system-on-a-chip) 1000 on which two execution environments are present, one being a trusted environment and being referenced 1100. , the other a versatile environment referenced 1200. Other architectures are possible, including for example a chipset environment. It is recalled that the execution environments, trust or versatile, include or are included in electronic chipset or System on Chip. Several environments can be hosted in the same chipset or the same System on Chip, but in this case, if one of the environments is a trusted environment, a rewritable non-volatile memory or a rewritable non-volatile memory area whose controlled access is dedicated to the trusted environment. Only applications that are verified for authenticity and integrity are installed in the trusted nonvolatile memory of the trusted environment. A trusted execution environment also includes a secure processor, which executes only applications provided by the secure non-volatile memory. The trusted environment 1100 includes a trusted operating system 1150 and a secure non-volatile memory 1160, as well as a secure processor 1170. The latter can be a single processor shared with the versatile runtime environment. 1200. It can also not be physically on the chipset 1000. It has access to the devices that are the screen 2000 and the keyboard 2100.

A boot program 1300 ("bootloader") stored in a non-rewritable memory ("bootROM") of the chipset is responsible for proceeding, in case of startup of the terminal 100, the start of the execution of the operating system. trusted 1150, and if it is successfully executed, then run the operating system running the multi-purpose runtime environment. Thus a chain of steps ("Secure Boot") is executed, the proper execution of each step constituting a condition for the execution of the next. The set of steps allows the complete start of the terminal.

The terminal 100 has a screen 2000 and an input interface, typically a keyboard 2100 to allow the user to exchange information, for example text, with the terminal. In Figure 2, a general scheme of operation of the invention is presented.

This comprises a step E10 obtaining information for the adaptation of the trusted operating system for a user, a storage step E20 of said information once it has been obtained, in the secure memory 1160, and then an operation step E30 of said information during a subsequent use of the trusted operating system 1150.

A first embodiment is presented in FIG. 3. During a step E110, the configuration of the terminal is carried out during a first start thereof after it has been made available to a first user. More precisely, the launching program 1300 then authenticates and launches the trusted operating system 1150, which, by initializing, reads information ("flag") in the secure non-volatile memory 1160 informing it of the fact that that the start corresponds to a first use. The trusted operating system 1150 then prompts the user to answer certain questions about the configuration options that he wishes to use on the terminal 100, such as the language of the displayed texts.

He can also ask him to fill in a field called "shared secret", which the user is informed that it is confidential information that he will share with the trusted execution system 1150, and only with it, which will allow him to recognize that an application executed on the terminal 100 is in the framework of the secure operating system.

The user enters the "shared secret" field. The information is entered by the keyboard 2100, and can be displayed on the screen 2000, the time of the entry. An exemplary implementation is present on the screen capture 201 in FIG. 4. The shared secret is registered by the trusted operating system 1150 in the non-volatile secure memory 1160.

The configuration of the terminal 100 continues, and the versatile operating system can be started in turn. It is specified that the configuration and customization thus made are secure because no operating system other than the trusted operating system is executed at this stage. During a subsequent step E130, which may take place much later, possibly after one or more terminal shutdowns, without reconfiguration of the latter, the user wishes to use a trusted application operating in the context of the system. This can be done in the following way: the user uses applications running in the framework of the versatile execution environment 1200, and one of them, for example a browser Internet, requires access (necessarily indirect, since this browser is run as part of the multipurpose environment) to a trusted application operating as part of the trusted execution environment 1100, such as a payment application remote. The Internet browser communicates with a trusted application of the trusted operating system via an API ("Application Programming Interface") 1600. The secret information is extracted from the secure non-volatile memory 1160 by the trusted application implemented as part of the secure operating system 1170 and is transmitted to the Internet browser which displays it on the screen 2000, as Appears on the screen capture 202. The remote payment application is activated and display elements generated by the secure payment application are displayed on the screen 2000, and a secure controller 1400 switches the communication link. from the 2100 keyboard to the trusted environment. Other means can be used.

For the 2000 screen, two graphic buffers are used, each being filled by one of two environments. A display controller 1500 reads each of the two memories and displays the contents of the two which is under the control of the trusted system over the contents of the other memory. Other means can be used.

The user, having had his secret information returned, can use with confidence the screen and the keyboard, which he knows to be controlled by an application implemented as part of the trusted environment. The user can dial his PIN with confidence, for the payment application. In an alternative embodiment shown in FIG. 5, during a step E210, the user presses a key combination or a dedicated key of the terminal 100 to obtain the start of the latter in a system configuration mode. Trusted operation. The precise mode of triggering of the configuration mode is specified during the manufacture of the terminal and written in the launching program of the device. The launcher starts the trusted operating system configuration mode 10, launches the trusted operating system and authenticates it. As in the previous embodiment, the trusted operating system 1150 requests its shared secret from the user via the keyboard 2100 and the screen 2000. The shared secret is provided by the user and stored in the non-memory. secure volatile 1160 during step E220. A step E230 similar to step E130 described above is implemented later. In another embodiment, represented in FIG. 6, the method is started by a step E310 for defining the secret shared by a trusted third party, for example a mobile telephone operator to which the user of the terminal 100 has subscribed a subscription. . During the step E310, the operator transmits to the user, via a communication channel considered secure, such as for example a signed and encrypted email, or a mail, confidential information. This confidential information is also transmitted by a secure SMS or other secure protocol using the mobile telephone network, to the terminal 100. This step is optional in the case where the secret code is defined during the manufacture of the electronic device. Only the secure operating system 1150 is able to read the confidential information received by the terminal 100. During a step E320, the secure operating system 1150 stores the confidential information in the non-volatile secure memory 1160.

The confidential information is then used as a shared secret between the user and the secure operating system 1150. An authentication step E330 is implemented during subsequent use in a manner similar to that described in connection with other embodiments. In another embodiment, shown in FIG. 7, the information stored in the non-volatile secure memory 1160 serves to adapt the display generated on the screen 2000 as part of the secure operating system. A configuration step E410 is performed in a manner similar to steps E110 or E210 in the embodiments of FIGS. 3 and 5. The information requested from the user is not necessarily confidential information, and it concerns the dressing of the display performed as part of the secure operating system or more generally the parameters that define the interactions (including vibrations, etc ...). It can be for example a color, an image, a wallpaper or a font. A storage step E420, which is similar to steps E120, E220 or E320 in the corresponding embodiments, is then performed. It is specified that the configuration and customization thus made are secure because no operating system other than the trusted operating system is executed at this stage. In a subsequent use step E430 of a trusted operating system function via the versatile operating system, the display of the display elements generated by the trusted operating system is adapted according to the memorized information.

This adaptation can be a comfort adaptation, such as the use of a user's favorite color. In FIG. 8, a screen view 301 is shown during the configuration step E410, in a variant where the configuration concerns the display for a particular trust application. Also shown is a screen view 302 in step E430, corresponding to the use of the particular trust application, for which the display is customized.

Other aspects implemented in the context of the trusted operating system can be modified such as the choice of a default currency for payment applications. The invention is not limited to the embodiments described, but extends to all variants within the scope of the claims.

Claims (17)

REVENDICATIONS1. Electronic device (100; 1000) comprising a trusted execution environment (1100) and a versatile execution environment (1200), characterized in that it comprises means (1150, 1170, 2100) for obtaining information associated with a user, a secure memory (1160) for storing said information once it is obtained, and means for adapting (1150, 1500, 2000) the trusted environment for said user on the basis of said information upon subsequent access of the user to said trusted execution environment (1100) via the multipurpose execution environment (1200). An electronic device according to claim 1, the information being authentication information of the trusted execution environment (1100) to the user. An electronic device according to claim 1 or claim 2, the information being personalization information of a display of said trusted execution environment (1100). 4. An electronic device according to one of claims 1 to 3, wherein the obtaining means are implemented when the electronic device (100) is started for the first time (Fig. 3, 4). 5. Electronic device according to one of claims 1 to 4, wherein the obtaining means are implemented during a startup of the electronic device (100) in which a launcher (1300) detects a request of the user (Fig. 5, 7, 8). 6. Electronic device according to one of claims 1 to 5, wherein the obtaining means (1150, 1170, 2100) are included or implemented in the trusted execution environment (1100). 7. Electronic device according to one of claims 1 to 6, wherein the information is obtained by an input of the user via a human-machine interface (2100). 8. Electronic device according to one of claims 1 to 7, the information comprising a sentence, a personal identification number, a photograph, an image, a wallpaper, a sound, a vibration. 9. Electronic device according to one of claims 1 to 7, the information comprising a color, a font, a choice of language, a choice of currency, a bank account number, a choice of mode of interaction with an application, a light, or an activation of LEDs of keyboard keys. An electronic device according to one of claims 1 to 9, wherein the adaptation means (1150, 1500, 2000) of the trusted environment comprises a secure controller (1500) for connecting a peripheral operation. to a trusted environment or a versatile environment. An electronic device according to one of claims 1 to 10, wherein the adaptation means (1150, 1500, 2000) of the trusted environment are understood or implemented in the trusted execution environment. (1100). An electronic device according to one of claims 1 to 11, wherein the means for operating (1150, 1500, 2000) said information upon subsequent access of the user to said trusted execution environment (1150 ) through the versatile execution environment (1200) includes an interface (1600) for accessing an application of the trusted execution environment (1100) by an application of the multipurpose execution environment ( 1200). An electronic device according to one of claims 1 to 12, wherein upon start-up of the terminal, a launch program (1300) is configured so that an operating system of the multi-purpose runtime environment is launched only when a trusted operating environment operating system was launched successfully. An electronic device according to one of claims 1 to 13, wherein the versatile (1200) and trusted (1100) execution environments are included on the same chipset (1000). Mobile telephone terminal (100) comprising an electronic device according to one of claims 1 to 14. 16. A method of adapting an electronic device (100; 1000) comprising a trusted execution environment (1100) and a multipurpose execution environment (1200), characterized in that it comprises a step of obtaining (E10-E410) information shared with a user, and a step of storing (E20-E420) said information once it is obtained in a secure memory for adaptation (E30-E430) of a according to the trusted environment for said user based on said information upon subsequent access of the user to said trusted execution environment (1150) via the multipurpose execution environment (1200). 17. A trusted operating system comprising instructions which, when executed by a processor, implement a method according to claim 16.