FR3003712A1 - MATERIAL SAFETY MODULE - Google Patents

Abstract

The subject of the invention is a hardware security module (4) offering VPN functionalities. According to the invention, the module (4) comprises, an integrated circuit ASIC with a processor (40), a memory (41) of data, a memory (42) of programs, a cryptographic module (43) comprising a generator ( 430) of cryptographic keys and a module (431) for encryption and / or decryption, a first interface (44) able to receive unencrypted or encrypted data from a first access point (1), a second interface (45) capable of transmitting encrypted data, respectively transcribed, to a second access point (2), and an interface controller (46) able to control the first and second interfaces (44, 45) to enable a secure communication between the two access points (1, 2). This module (4) can be advantageously used as an elementary module to form equipment furthermore offering a segregation between the unencrypted data, respectively encrypted and the encrypted data, respectively transcribed, and a firewall functionality.

Description

BACKGROUND OF THE INVENTION The present invention generally relates to security in communications networks, and more specifically to a hardware security module. A hardware security module or HSM (English initials for Hardware Security Module) is a module whose main functions are: - to generate on demand or in advance cryptographic keys, 10 for example RSA keys for authentication ; - protect the generated keys; - Transfer cryptographic keys with adequate security, for example in encrypted form according to whether the encryption is symmetrical or not; To perform encryption and / or decryption operations. The hardware is placed in a secure box, which protects the generated keys. HSMs are typically used to encrypt data such as bank PINs or to generate private / public key pairs for authentication of users or applications. HSMs can be classified into categories corresponding to form factors and associated performance: - small form factor, such as a smart card or USB key: Sizing limits the generation and storage capacity of keys, the ability to embedded computing, and therefore the speed of cryptographic operations that can be performed. However, the module is of low relative cost, and can be easily transported and handled. - classical equipment: Sizing gives a large capacity for key storage generation, and provides cryptographic accelerators to perform high speed operations. Nevertheless, the module is expensive and not nomadic. The level of security, evaluated according to this or that recognized process, for example Common Criteria or Common Criteria (CC) or FIPS (United States Federal Information Processing Standard), is a very important feature. Finally, an HSM must be able to interface and communicate with other equipment or products; it is therefore usually equipped with interfaces such as Ethernet, USB or other standards.

Also known virtual private networks, or VPN (English initials set for Virtual Private Network), which provide a secure connection between terminal equipment, while using non-private networks. To do this, a VPN network must: - authenticate the interlocutors who exchange data, - make the transmitted data confidential by encryption. A VPN is therefore mainly, but not only, a data encryptor. A special case is the direct exchange between two users, but most often, in a secure communication infrastructure, are established tunnels, through which an authenticated client encrypts data and sends them to a server that decrypts them on arrival. , and can himself be a customer in another tunnel. The data is encapsulated in a defined protocol, for example IPSec or SSL / TLS. In each tunnel, encrypted data, many, and even a large number of individual users pass. The VPN function is usually implemented either in a stand-alone box or integrated into a larger feature set (for example a router). It thus makes it possible: to perform, with the aid of cryptographic modules, authentication operations, including but not limited to the recognition of certificates; - To encrypt on the fly the data to be sent, and decrypt the received data on the fly, using cryptographic modules. The encryption keys and initial authentication certificates are received from an HSM. Within a VPN, however, the software can generate temporary keys and certificates used for a particular session. But when it does, the attainable level of security is lower; in particular, it is not possible to resist known and documented attacks. FIG. 1 illustrates in schematic form a known communication system between a local communication network 1 (for example within a company) and an external communication network 2, thanks to a connected VPN module 3 and a connected HSM module 4. between them via a link 5 of the Ethernet type. In this type of architecture, the data transiting between the local network 1 and the VPN module 3 are usually unencrypted, the data transiting between the VPN module 3 and the external network 2 are encrypted by the VPN 3 using the keys generated by the HSM module 4. This architecture 10 has a number of disadvantages. In particular, the fact of using separate VPN 3 and HSM 4 modules is a weakness in the security, because an attack is possible via the Ethernet network linking the HSM (s) to the VPN, since the keys or certificates generated HSM (s) must be sent to the VPN (s). More generally, any situation in which encryption keys, or encryption keys, generated are accessible is a security weakness, which is the case when said keys leave the component in which they were generated. Moreover, the different HSMs and VPNs, as well as the users themselves, are connected to a network whose interface standard is of the Ethernet type, or else, which allows for documented attacks, since there is network continuity, without interruption between the subscribers to said network. In particular, it is possible for an attacker to have his data routed to an internal recipient, and thus to break the quality of the service offered to him, to introduce malware or viruses, and above all, as regards security, to have access to data without the right to do so. It is to face, as much as possible, this situation, that are designed and known in the state of the art firewalls. For those who are the safest, it is a matter of inserting, in break between two networks, or two sets of users, a device that will block all the packets 30 (all the data), from any source (of any transmitter), for any service (regardless of the protocol), except when the security policy allows to pass. A firewall therefore has at least two network interfaces, a processor and a memory. However, it is still possible to circumvent the security policy and get into the system. There are also intrusion detection systems that are intended, in view of normal behavior of users, to detect those that are abnormal, and then send an alert to an administrator of the internal network. An intrusion detector therefore has at least one network interface, a processor and a memory. Nevertheless, an intruder detection system can not block the flows. Moreover, in the architecture of FIG. 1, the unencrypted and encrypted data are not strictly segregated, because such segregation is complex and expensive to perform. By the mere fact that this segregation is not performed, particular attacks are possible, when the encrypted and unencrypted data are co-localized, for example on a data bus. In addition, the VPN functions are implemented in software, intrinsically of lower security level (typically CC EAL2 +, at best EAL3 +) than the security level obtained with the security component (at least EAL 4+). Finally, the different architectures and devices of the state of the art are expensive because complex. The present invention proposes a new HSM module which allows, according to the variants, to overcome one or more of the above disadvantages. In particular, the subject of the invention is a hardware security module comprising an ASIC integrated circuit with a processor, a data memory for storing data, a program memory for storing program codes, a cryptographic module comprising a generator cryptographic key and a data encryption and / or decryption module, a first interface capable of receiving unencrypted or encrypted data of a first access point, a second interface capable of transmitting encrypted data, respectively transcrypted to a second access point, and an interface controller adapted to control the first and second interfaces to allow secure communication between the two access points. According to certain optional and / or preferred features: the hardware security module according to claim 1 may comprise a secure external casing; the data memory is of the NVM type, and the program memory is of ROM or NVM or flash type; the data transmitted by the second interface are encrypted, respectively transcribed, by the encryption module and / or decryption of data using at least one cryptographic key generated by the cryptographic key generator. The invention also relates to hardware security equipment, characterized in that it comprises an assembly comprising two hardware security modules as defined above, namely: a first hardware security module capable of being used for receiving on its first interface unencrypted data, respectively encrypted, an access point of a first communication network; and a second hardware security module which can be used in transmission only to transmit encrypted data, respectively transcribed, from its second interface to an access point of a second communication network; said set further comprising a module forming an interface 20 of segregation of unencrypted data, respectively encrypted, and encrypted data respectively transcribed. In a preferred embodiment, the data transmitted by the second interface of the second module are encrypted, respectively transcribed, by the data encryption and / or decryption module 25 of the second hardware security module using at least one cryptographic key generated by the cryptographic key generator of the first hardware security module. According to another possible embodiment, the hardware security equipment comprises a plurality of sets, the first hardware security module of each set being adapted to be used to receive on its first interface unencrypted data, respectively encrypted, an access point of the first communication network, and the second hardware security module of each set being adapted to be used in transmission, only to transmit from its second interface encrypted data, respectively transcribed, to a access point of the second communication network. In this case, the data transmitted by the second interface are preferably encrypted, respectively transcribed, by the encryption module and / or data decryption of the second hardware security module of each set using at least one cryptographic key generated by the generator cryptographic keys of the first hardware security module of each set.

According to an alternative embodiment, the hardware security equipment comprises a first set and a second set each comprising a plurality of hardware security modules as defined above, each module of the first set being able to be used to receive on its first interface of the unencrypted data, respectively encrypted, an access point of a first communication network, and each module of the second set being adapted to be used in transmission, only to transmit from its second interface data enciphered, respectively trasncrypted, to an access point of a second communication network, and a single module forming an encrypted and unencrypted data segregation interface for all hardware security modules. In this case, the data transmitted by the second interface are preferably encrypted, respectively transcribed, by the encryption module and / or decryption of data of each hardware security module of the second set using at least one cryptographic key generated by the generator cryptographic keys of each associated module of the first set. In any case, the segregation interface module may furthermore be able to filter the data exchanged between the first network and the second communication network. The invention and the advantages it provides will be better understood from the following description, made with reference to the appended figures, in which: FIG. 1, already described above, schematically illustrates a known communication system between a local communication network and an external communication network; FIG. 2 schematically represents an HSM-VPN module according to one possible embodiment of the invention; FIG. 3 illustrates, by way of example, exchanges of data between two access points via the HSM-VPN module of FIG. 2; - Figure 4 schematically shows a safety equipment built from two HSM-VPN modules such as that of Figure 3; Figure 5 illustrates an alternative embodiment of the equipment of Figure 4; - Figure 6 illustrates another variant of the equipment of Figure 4. Figure 2 schematically shows a hardware security module 4 incorporating, in accordance with the invention, a VPN functionality. This module 4 comprises an integrated circuit ASIC including an onboard processor 40, a memory 41 of NVM type data (non-volatile initials set to Non Volatile Memory) for storing the data, a memory 42 of non-volatile programs of the ROM type, NVM or flash for storing the program codes, a cryptographic module 43 comprising a cryptographic key generator 430 and a data encryption and / or decryption module 431, and two communication interfaces 44, 45 controlled by a controller 46 of FIG. interfaces. The above set is preferably placed in a secure case 47. The functions of HSM and VPN are realized in the same architecture and product. The program memory 42 accordingly contains the codes for performing both functions. The keys, on the one hand for the HSM function, and on the other hand for the VPN function, are generated via the cryptographic key generator 430, and are stored in the data memory 41. Both interfaces 44, 45 allow communication with two external access points (not shown) separately. The controller 46 manages the separation of these accesses. In addition to this isolation between the two interfaces, a trans-encryption can take place between the data that enters and the data that comes out.

The entire hardware component is secured with state-of-the-art security mechanisms (shield, electronic failure detector ...). The cryptographic functions are also implemented to be at the state of the art of securing (attacks by auxiliary channels or 5 by faults). Strong authentication between the two access points takes place. For this, keys, for example asymmetric, are generated by the generator 430 and used by the VPN (encryption and / or decryption module 431) function integrated in the module 4 to authenticate between the two access points. Finally, an identical session key K is formed on both sides. An example of the steps implemented during a communication between a first access point, for example located in the local communication network 1, and a second access point, for example located in the external communication network 2, Through the HSM-VPN module 4 of the invention will now be described with reference to FIG. 3. It is assumed in this nonlimiting example that the communication is requested by the first access point: In the first step 100, the first access point sends a connection request to the module 4, this request being relayed by the module 4 to the second access point 2 (step 110). The module 4 then generates the keys that will be used for the ciphers (step 120), then sends the generated keys to the access points 1 and 2 (step 130). When the two access points have formed the session key from the received keys (step 140), bidirectional exchanges of secure data can take place between the two (steps 150 and 160). More specifically, the data coming from the access point 1 is received, encrypted or not encrypted on the interface 45 of the module, then retransmitted, respectively transcribed or encrypted by the interface 46 to the second access point. More specifically, the data transmitted by the second interface 45 are encrypted, respectively transcribed, by the module 431 of encryption and / or decryption of data using at least one cryptographic key generated by the generator 40 of cryptographic keys. Thus, the module 4 allows itself to perform various functions, either they have been implemented in hardware form, or they have been programmed and implemented as embedded application in the processor. The HSM features on the one hand, and VPN on the other hand, are packaged together in a standard form factor, for example a microSD card, or any other form factor, and this component is able to communicate with the outside . With regard to the definition of HSMs, security module 4 provides the functionalities required of conventional equipment, both in the generation and protection of keys and in cryptographic operations, in a small form factor (microSD card type), and it is compatible with SD, USB and Ethernet interfaces. In contrast to the definition of VPNs, Security Module 4 provides the resources to generate and protect keys, encrypt and decrypt data on the fly, and more broadly perform cryptographic operations, in a small form factor, and It is compatible with SD, USB and Ethernet interfaces. The security module 4 according to the invention can also make it possible: to encrypt or decrypt data and to store them encrypted or not, within the same component; - To transcode, that is to say, to decrypt encrypted data input, and then re-encrypt with other keys or other algorithms, before re-issue them in output. Unlike solutions of the prior art, the keys never leave the module. In addition, the encryption functions are performed in hardware, which offers a better level of security. Encrypted and unencrypted data is not co-localized. Finally, by the use of ASIC technology, and the compactness of the component, its security can be obtained at a lower cost and it is economically very competitive. Module 4 as just described can serve as a basis for constructing improved security equipment, as will be described later. FIG. 4 illustrates an HSM-VPN security equipment 5 with cut-off according to the invention. This equipment 5 here comprises a housing 7, preferably secure, containing two HSM-VPN modules 4 such as those described with reference to Figure 2, and a module 6 forming a data segregation interface. In an exemplary architecture, it is assumed that the local communication network 1 transmits only unencrypted data. In this case, a first module 4 (the one on the left in FIG. 4) is used for example only for its HSM functionality, in particular for the generation of cryptographic keys that will be used for encryption, and receives on its interface 44 the unencrypted data of the local area network 1 of communication; the second module 4 (the one on the right in FIG. 4) is used for its VPN functionality only, and transmits encrypted data to the external network 2 via its interface 45. The module 6 with its segregation interface makes it possible to ensure consistency and filtering of the data exchanged between the local network 1 and the external network 2. It thus inspects the data packets it receives to ensure that only those that are to be transmitted are transmitted. In particular, it filters Ethernet commands to resist documented attacks via Ethernet. In another example of use, the data transmitted by the local communication network 1 can be encrypted. In this case, the module 4 on the left in FIG. 4 is also used for its VPN functionality in order to decrypt the received data, then for its HSM functionality to generate the cryptographic keys that will be used for the transcryption. The right module 4 in FIG. 4 remains used only in the transmission direction for its VPN function to transmit transcribed data, using the cryptographic keys generated by the left module 4. In both cases, the data transmitted by the second interface 45 of the second module are encrypted, respectively transcribed, by the data encryption and / or decryption module of the second hardware security module using at least one cryptographic key generated by the cryptographic key generator of the first hardware security module.

Here again, the cryptographic keys used for encryption or transcryption never leave the equipment 5. In addition, the module 6 provides a secure interface between the two modules 4, allowing not only to segregate between the unencrypted data respectively encrypted, and the encrypted data, respectively transcribed, but also a firewall function, allowing only the data that must actually pass, and prohibiting attacks via commands related to interface protocols, as c is especially possible for Ethernet (penetration).

In the above equipment, the intrinsic performance of the security component as an encryptor / decryptor can be limited in speed, either by the technology of the integrated circuit itself, or by the chosen interface standard. Moreover, the number of cryptographic keys that can be generated in a given time is in essence limited.

To increase the usable rate for the benefit of the users and / or the number of keys that can be generated in a given time, a first solution, shown schematically in FIG. 5, consists in placing, in a same box 7, preferably secure , not one but n identical equipment 51 to 5n. Each device or set 5, the integer i varying from 1 to n, comprises, as in the case of FIG. 4: a first module 4; 1 used only for its HSM functionality or for its two HSM and VPN functionalities, depending on whether its interface 44i1 receives unencrypted or already encrypted data from the local network 1, - a second module 4; 2 used only (in the direction of transmission) for its VPN functionality, with its interface 45; 2 transmitting encrypted data, respectively transcribed, to the external network 2; a module 6; forming segregation interface.

Here again, the data transmitted by the second interface 45; 2 are encrypted, respectively transcribed, by the data encryption and / or decryption module of the second hardware security module 4; 2 of each set 5; using at least one cryptographic key generated by the cryptographic key generator of the first hardware security module 4; 1 of each set 5; An alternative embodiment which also makes it possible to increase the useful bit rate for the benefit of the users and / or the number of keys that can be generated in a given time is shown in FIG. 6. Here, instead of using n modules 6 ; for segregation / firewall, only one module 6 is pooled. In this variant, the device comprises, in addition to the single module 6 forming a segregation interface between unencrypted data 10 (respectively encrypted) and encrypted data (respectively transcrypted), a first set and a second set each comprising a plurality of modules 4n1, ... 412 ... 4n2 hardware security such as that described in Figure 2, each module 4; 1 (the integer i varying from 1 to n) of the first set being adapted to be used to receive on its first interface 44; 1 unencrypted data, respectively encrypted, an access point 1 of the local area network 1 communication, and each module 4; 2 of the second set being adapted to be used, in transmission, only to transmit from its second interface 45; 2 encrypted data, respectively trasnchiffrées, to an access point 2 of the external communication network. As in the previous examples, the data transmitted by the second interface 45; 2 are encrypted, respectively transcribed, by the encryption module and / or decryption of data of each hardware security module 4i2 of the second set using at least one key 25 cryptographic generated by the cryptographic key generator of each associated module 4; 1 of the first set. In all the cases shown in FIGS. 4 to 6, the equipment makes it possible to fill: the cutoff firewall function, the intruder detector function, and of course the VPN and HSM functions, moreover, when data arrives from the outside network 2, the equipment can verify by cryptographic authentication of the transmitter that it is the one expected, and by cryptographic integrity that the data are indeed those expected. Any data not correctly decrypted or unhealthy, or any data received from an unauthenticated transmitter will advantageously be blocked. The performance of the firewall and intrusion detection is thus increased. The equipment can also provide a particular function of coupling networks of different security level. Indeed, in the context of certain so-called "multi-level" security policies, it is possible, for example, to define a standard level of security and a reinforced level of security (or confidential and secret). A user authorized to connect to a network of reinforced level can also be coupled to a network of standard level, but not the opposite (only the authorized users at the reinforced level can couple at the reinforced level).

Standard level information may "mount" in a tiered network, but will only be accessible to authorized users at the enhanced level. Enhanced level information, on the other hand, should not be transmitted to a standard level network. It would indeed be accessible in principle to unauthorized users.

The equipment according to FIGS. 4 to 6 directly makes it possible to have a multi-level safety filter, combining two operations: a "diode" mode operation or a passing operation: if the network 1 is of standard level, and the network 2 This mode consists of letting the information pass from network 1 to network 2 only. 25 - operation in virtualized multilevel exchange mode: If a user of network 1 has the rights of access to information at a higher level of the network 2, then the device authenticates the user and his rights, and allows him to access the information on the network 2, knowing that said information will be transmitted encrypted, and accessible only to authenticated users. Finally, it should be noted that, although the description mentioned data exchanges between a local network 1 type of communication network internal company, and an external network 2, the module 4 and the equipment integrating this module 4 according to to the invention can be used for the exchange of data between any type of communication networks, internal or external.

Claims (11)

REVENDICATIONS1. Hardware security module (4) comprising an ASIC integrated circuit with a processor (40), a data memory (41) for storing data, a program memory (42) for storing program codes, a cryptographic module (43) ) comprising a cryptographic key generator (430) and a data encryption and / or decryption module (431), a first interface (44) able to receive unencrypted or encrypted data from a first access point; (1), a second interface (45) capable of transmitting encrypted data, respectively transcribed, to a second access point (2), and an interface controller (46) able to control the first and second interfaces ( 44, 45) to enable secure communication between the two access points (1, 2). 2. Module (4) for material security according to claim 1, characterized in that it comprises a casing (47) external secure. Security module (4) according to one of the preceding claims, characterized in that the data memory (41) is of the NVM type, and the program memory (42) is of the ROM or NVM or flash type. 4. Module (4) security according to any one of the preceding claims, characterized in that the data transmitted by the second interface (45) are encrypted, respectively transcribed, by the module (431) of encryption and / or decryption of data using at least one cryptographic key generated by the cryptographic key generator (430). 5. Hardware security equipment (5), characterized in that it comprises an assembly comprising two hardware security modules (4) according to claim 1, namely: a first hardware security module (4) capable of being used; to receive on its first interface (44) unencrypted data, respectively encrypted, an access point (1) of a first communication network; and a second hardware security module (4) which can only be used in transmission to transmit, from its second interface (45), encrypted data, respectively transcribed, to an access point (2). a second communication network; said set further comprising a module (6) forming an interface for segregating unencrypted data, respectively encrypted, and encrypted data respectively transcribed. 6. Equipment (5) for material security according to claim 5, characterized in that the data transmitted by the second interface (45) of the second module are encrypted, respectively transcribed, by the encryption module and / or decryption of data of the second hardware security module using at least one cryptographic key generated by the cryptographic key generator of the first hardware security module. 7. Equipment (5) for material security according to claim 5, characterized in that it comprises a plurality of sets (51 to 5n), the first module (4ii to 4ni) material security of each set (51 to 5n). ) being adapted to be used to receive on its first interface (44ii to 44ni) unencrypted data, respectively encrypted, of an access point (1) of the first communication network, and the second module (412 to 4n2) of hardware security of each set (51 to Sn) being adapted to be used, in transmission, only to transmit from its second interface (4512 to 45n2) encrypted data, respectively transcribed, to an access point (2) the second communication network. 8. Hardware security equipment (5) according to claim 7, characterized in that the data transmitted by the second interface (4512 to 45n2) are encrypted, respectively transcribed, by the data encryption and / or decryption module of the second module ( 412 to 4n2) of each set (51 to 5n) using at least one cryptographic key generated by the cryptographic key generator of the first hardware security module (4ii to 4ni) of each set (51 to 5n). 9. Equipment (5) for material security, characterized in that it comprises a first set and a second set each comprising a plurality of hardware security modules (411 ... 4n1, ... 412 ... 4n2) according to claim 1, each module (4ii ... 4n1) of the first set being adapted to be used to receive on its first interface (44ii to 44n1) unencrypted data, respectively encrypted, an access point (1) a first communication network, and each module (412 ... 4n2) of the second set being adapted to be used, in transmission, only to transmit from its second interface (4512 to 45n2) encrypted data respectively trasnchiffrées , at an access point (2) of a second communication network, and a single module (6) forming an encrypted and unencrypted data segregation interface for all the modules (411 --- 4n1, --- 412 --- 4n2) material security. 10. Equipment (5) for material security according to claim 9, characterized in that the data transmitted by the second interface (4512 to 45n2) are encrypted, respectively transcribed, by the module of encryption and / or decryption of data of each module (412-4n2) hardware security of the second set using at least one cryptographic key generated by the cryptographic key generator of each associated module (4ii-4ni) of the first set (51-5n). 11. Equipment (5) for material security according to any one of claims 5 to 10, characterized in that said module (6) forming segregation interface is further able to filter the data exchanged between the first network and the second communication network.