FR3139924A1 - Portable electronic device comprising interactive stacking means - Google Patents

Abstract

Portable electronic device (HW3) comprising a chassis in which at least one processor is arranged, a touch screen (TS) covering all or part of a front face (FS) of the chassis, and wireless communication means. The device is configured to, when stacked with at least one other similar device (HW3-1) and at the top of the stack, establish communication with the similar device (HW3-1) present in the stack, receive information provided by the device present in the battery and display it on the touch screen (TS). Figure for abstract: Figure 24

Description

Portable electronic device comprising interactive stacking means

The present invention relates to hardware wallets for cold storage of private keys from the blockchain. The present invention also relates to the ergonomics of portable electronic devices, and in particular the ergonomics of hardware wallets for cold storage of private keys.

Background

In recent years, the development of cryptocurrencies or other types of cryptoassets managed by the blockchain, such as non-fungible tokens (“NFTs”) and smart contracts (“Smart Contracts”), has given rise to various means of storage and conservation of private keys attached to these different types of cryptoassets. This is how the notions of “wallet”, “cold storage” and “hot” storage of private keys appeared. A “wallet”, also called a “purse”, is a device or program whose function is to manage cryptoassets, and therefore to store the private keys attached to them. So-called “hot wallets” are connected to the Internet and susceptible to hacker attacks or exposure to viruses and malware. These may be wallets managed by centralized exchange platforms, which do not offer the highest level of security. As a result, many centralized platforms have been looted of hundreds of millions of dollars by hackers over the years. “Hot” wallets can also take the form of programs installed on mobile phones, tablets or personal computers (“software wallets”). Such wallets are permanently connected to the Internet and therefore themselves susceptible to attacks.

Cold wallets constitute the safest solution for cold storage of private keys, that is to say outside of any direct access to the Internet, which reduces the surface area of attack and therefore the risk of theft by computer hacking. Transactions involving private keys are signed in an offline environment. Any transaction initiated online is temporarily transferred to the offline hardware wallet, where it is then digitally signed before being transmitted to the online network. Since the private key is not communicated to the online server during the signing process, a hacker cannot access it.

The simplest form of cold storage is the paper wallet. A paper wallet is a document on which the user's public and private keys are written. The document usually has an embedded QR code which can then be scanned to sign a transaction. The disadvantage of this medium is that if the paper wallet is lost, illegible or destroyed, the user can no longer access their funds.

Hardware wallets are a convenient alternative to paper wallets for storing private keys. In addition, they are generally configured to generate recovery sentences to restore private keys if they are lost. Remember that cryptoassets are never stored in a hardware wallet, but are recorded on the blockchain. The hardware wallet only stores private keys used to manage transactions on the blockchain. Public keys corresponding to private keys point to an address on the blockchain where the assets are actually located.

As shown on the , an HW hardware wallet is never directly connected to the Internet. To be usable, the HW hardware wallet must be connected to an HDV host device using an LNK data link, for example USB or Bluetooth. The HDV host device can be a computer, a mobile phone or a tablet, and runs so-called “companion” software making it possible to conduct transactions on the BCN blockchain, such as the “Ledger live” software developed by the applicant. Alternatively, the HW hardware wallet can be used, through the HDV host device, with decentralized exchange platforms or “DEXs”, on which the user can transact while retaining their keys.

The HW hardware wallets marketed by the applicant have enjoyed significant commercial success due to the high degree of security they offer, thanks to the use of a secure element to store private keys and sign transactions. . A secure element is a hardware platform capable of storing and manipulating data in compliance with security rules and requirements set by a trusted authority. It comes in the form of a semiconductor chip implementing various countermeasures aimed at countering attacks by fraudsters.

There shows the architecture of an HW1 hardware wallet of the type marketed by the applicant under the name “Nano S”. The HW1 hardware wallet includes a secure element SE1 associated with a microcontroller MCU1. The processor MCU1 includes a USB interface U1 and acts as a proxy device with respect to the secure element SE1, for communication with an external HDV host device running a companion application (Cf. ). The secure element SE1 has its own secure OS operating system (firmware) allowing it to execute APP application programs, and integrates a CRY cryptographic coprocessor. The HW1 hardware wallet also has a DISP1 display and two buttons B1, B2.

The DISP1 display and the B1, B2 buttons are managed by the MCU1 microcontroller. These two buttons play an important role in securing certain operations: the user must press both buttons at the same time in order to demonstrate their agreement or consent for carrying out or finalizing these operations.

There illustrates a second HW2 hardware wallet architecture of the type marketed by the applicant under the name “Nano National Information Systems Security Agency (ANSSI).

(https://www.ssi.gouv.fr/uploads/2019/10/anssi-cible-cspn-2019_12en.pdf)

The HW2 hardware wallet includes, like the HW1 wallet, a secure element SE2, an MCU2 microcontroller equipped with a USB interface U1, a DISP2 screen and two buttons B1, B2. It also includes a BAT battery rechargeable via the USB interface and a Bluetooth BT1 communication interface managed by the microcontroller.

As before, the user must press both buttons at the same time in order to demonstrate their agreement or consent when carrying out certain sensitive operations, as indicated in the aforementioned document “Ledger Nano X Security Target”, paragraph 1.2 “Terminology”, “Consent” line: “The security concept of the Ledger Nano X is reinforced by the end user. Whenever a sensitive operation is required, the end user must confirm the operation using the two “buttons”.

Unlike the HW1 hardware wallet, the DISP2 screen and the B1, B2 buttons of the HW2 hardware wallet are managed directly by the secure element SE2, which provides an additional degree of security in the event of corruption of the MCU2 microcontroller. Thus, the signals received by the secure element SE2, indicating that the user simultaneously presses the two buttons B1, B2, cannot be falsified by the microcontroller. Likewise, the information presented to the user by the DISP2 screen, for example the amount of a transaction to be validated by the user, cannot be falsified.

In summary, in a hardware wallet for the cold storage of private keys within the meaning of this application, the microcontroller associated with the secure element does not execute any application program and has the sole function of managing communication devices, USB, Bluetooth, etc. as well as other peripherals (battery, battery charger, etc.). All application programs are executed by the secure element.

There are also DV1 devices whose classic architecture is shown on the , which include an SMCU microcontroller including a TZ (“Trust Zone”). The TZ trust zone can in certain cases be associated with a secure element SE to which it entrusts the most sensitive operations or cryptographic calculation. The implementation of such a TZ trust zone is generally based on the use of two virtual processors associated with hardware access control. This allows the core of an application program to switch between two states, called "worlds", in order to prevent information from leaking from the more reliable world to the less reliable world. Each world can operate independently of the other while using the same core. Memory and peripherals are then informed of the kernel's operating world and can use it to provide access control to device secrets and code. Typically, the SMCU microcontroller runs a so-called "rich" ROS operating system in the less reliable world, and smaller, security-focused code in the more reliable world, to reduce the attack surface. The rich operating system is usually Android.

This type of device does not need to be connected to a host device to execute operations on the blockchain, and generally contains a WF1 wifi communication interface in addition to USB U1 and Bluetooth BT1 communication interfaces. Thanks to its rich operating system, it has extensive functionalities and very advanced ergonomics, and notably includes a large touch screen like those fitted to smart mobile phones. The DV1 device can also, in certain cases, be equipped with mobile telephone circuits and form a full-fledged mobile telephone equipped with private key storage functionality.

In practice, and despite the undeniable ergonomic advantages it offers, such a DV1 device is not immune to attack and does not meet the same rigorous security requirements as hardware wallets for cold storage of private keys, which have no internet connection and whose microcontroller never executes application programs.

On the other hand, hardware wallets for cold storage of private keys offer only mediocre ergonomics, making certain transactions difficult to carry out, due to a small display and the obligation to provide two buttons to validate certain sensitive operations.

It could therefore be desired to improve the ergonomics of hardware wallets, without altering the high degree of security they offer.

Furthermore, some cryptoasset holders use several hardware wallets to store cryptoassets of different types or values. A user can for example use a first hardware wallet dedicated to the management of cryptocurrency accounts of low monetary value, to carry out daily transactions or pay for purchases, a second hardware wallet dedicated to the management of cryptocurrency accounts of high monetary value, a third hardware wallet dedicated to the management of cryptoassets such as non-fungible tokens, etc. It could therefore also be desired to improve the ergonomics of hardware wallets for users who use several of them.

It could more generally be desired to provide for improvements applicable to portable electronic devices and in particular to hardware wallets for the storage of private keys, which improve their ergonomics, or which provide new functionalities, or which improve their performance in terms of Bluetooth communication when provided with such means of communication.

Summary

Embodiments relate to a portable electronic device comprising a chassis in which at least one processor is arranged, a touch screen covering all or part of a front face of the chassis, and wireless communication means, the device being configured to, when stacked with at least one other similar device and located at the top of the stack, establish communication with the similar device present in the stack, receive information provided by the device present in the stack and display it on the touch screen.

According to one embodiment, the device is also configured to receive commands provided by a user via the touch screen and transmit them to the similar device.

According to one embodiment, the device is configured to switch, automatically or in response to user action, into a stacked mode of operation in which it communicates with at least one similar device.

According to one embodiment, the device is configured to, in the stacked mode of operation, execute a first mode of operation in which the device is not at the top of the stack, and a second mode of operation in which the device is located at the top of the stack, and in which, in the first mode of operation, the device can be controlled via the touch screen of a similar device present at the top of the stack, and in the second mode of operation, the touch screen of the device allows you to control a similar device present in the battery.

According to one embodiment, the device comprises at least one sensor to detect the presence of a device present above or below the chassis.

According to one embodiment, the device includes magnets to magnetically stack the device with a similar device.

According to one embodiment, the sensor is a hall effect sensor configured to detect the presence of at least one magnet above or below the chassis.

According to one embodiment, the device comprises a secure element configured to manage the stacked operating mode.

According to one embodiment, the device is configured to transmit or receive data in a determined frequency band, and for this purpose comprises a radio frequency antenna comprising a combination of a closed slot antenna and a parasitic antenna with an open slot , the two antennas being adjusted so that when the device is in the open air, the open slot parasitic antenna has a tuning frequency located in the determined frequency band while the closed slot antenna has a tuning frequency located outside the determined frequency band, and when the device is stacked with a similar device, the closed slot antenna has a tuning frequency located in the determined frequency band while the antenna open-slot parasite has a tuning frequency located outside the determined frequency band.

According to one embodiment, the closed slot antenna comprises a through longitudinal orifice made in a side wall of the chassis, the longitudinal orifice comprising two longitudinal surfaces facing each other, and means for applying to the first surface of the orifice longitudinal a ground potential and apply to the second surface of the longitudinal orifice a radio frequency signal, and the parasitic antenna with an open slot comprises an electrically conductive arm arranged parallel to the side wall of the chassis and close to the longitudinal orifice, the electrically conductive arm having a free end and an end electrically connected to the side wall.

According to one embodiment, the determined frequency band is the Bluetooth band or a Wifi band.

Summary description of the drawings

Examples of making improvements to portable devices will be described in the following on a non-limiting basis, in relation to the attached figures, among which:

There shows classic examples of using a hardware wallet through a host device,

There shows a classic hardware wallet architecture,

There shows another classic hardware wallet architecture,

There shows a classic architecture of an electronic device offering an average degree of security,

There shows an advanced hardware wallet architecture,

There shows the organization of part of the non-volatile memory of the hardware wallet of the ,

There shows examples of using the hardware wallet of the ,

There is a flowchart describing a process for securing certain operations when using the hardware wallet of the ,

There shows an embodiment of the hardware wallet of the ,

There describes steps for checking a component shown on the ,

There is a top and perspective view of an embodiment of the hardware wallet of the ,

There is a bottom and perspective view of the hardware wallet of the ,

There is a cross-section of the hardware wallet of the , showing certain constituent elements,

There is another cutaway view of the hardware wallet of the , showing other constituent elements,

There is a top view of a hardware wallet display of the ,

There is a top view of a touch module of the hardware wallet of the ,

There is a top view of a protective lens of the hardware wallet of the ,

There shows a hardware wallet cover of the ,

There is a sectional view of a magnetically stackable hardware wallet comprising magnets,

There is a bottom view of the hardware wallet of the ,

There is an exploded bottom view of the hardware wallet of the ,

There is an abstract representation of an arrangement of magnets in the chassis of a portable electronic device,

There shows the dimensions of a magnet,

There is a cutaway view of a magnetic stack of hardware wallets,

There is a cutaway view of a variation of a magnetically stackable hardware wallet,

There is a cutaway view of another variation of a magnetically stackable hardware wallet,

There shows a magnetic stack of hardware wallets,

There shows an example menu displayed by a hardware wallet stacked with other hardware wallets,

There describes operations performed by a hardware wallet stacked with other hardware wallets,

There is a cutaway view of a stack of sensor-equipped hardware wallets,

There describes a method for automatically managing a stack of hardware wallets,

There shows another example menu on the screen of a hardware wallet stacked with other hardware wallets,

There describes a method for manually managing a stack of hardware wallets,

There is an exploded view of a hardware wallet including an antenna,

There is a front view of the hardware wallet of the and shows an antenna element,

There is a top view of another antenna element,

There is a bottom view of another antenna element,

There is a cross-section of the hardware wallet of the ,

There is a cross-sectional and perspective view of the hardware wallet of the ,

There is the electrical diagram of the antenna element of Figures 36, 37,

There is the equivalent diagram of part of the antenna of the hardware portfolio of the ,

There and the are bottom and perspective views of the hardware wallet of the ,

There shows an antenna element present in Figures 42, 43,

There is the equivalent diagram of an antenna present in the hardware portfolio of the ,

Figures 46, 47 show a property of the antenna of the in two different uses,

There shows a stack of two hardware wallets,

There , there , there and the show other properties of the antenna of the in two different uses.

detailed description

In the following we will describe improvements applied to hardware wallets for cold storage of private keys. Certain improvements are likely to be implemented in all types of portable electronic devices, and therefore have a field of application going well beyond the sole creation of hardware wallets.

Example of making a p hardware wallet including a touch screen controlled by a secure element

As indicated in the above, a secure element is a hardware platform implementing various countermeasures aimed at countering attacks by fraudsters. Schematically, it can be:

- attacks by inspection and/or reverse engineering (polishing, layer removal, thermal imaging, X-rays, electron scanning microscopy),

- attacks by auxiliary channels (analysis of electrical consumption, electromagnetic radiation, calculation time, or any other measurable physical quantity correlated to the value of a secret that the attacker seeks to discover), or even

- attacks by laser fault injection or by means of test tips (in particular injection of parasitic signals or “glitches” on power lines, clock lines or data buses).

The countermeasures provided in a secure element are very numerous. Some are software and others hardware (code protected against attacks, means of protecting volatile and non-volatile memories, means of masking electrical consumption, masking data, means of masking the topography of the integrated circuit, sensors of voltage, frequency, light, temperature, allowing attacks to be detected, etc.). In the event of an attack, the operating system of a secure element is designed to initiate defensive actions such as interrupting a calculation in progress, permanently blocking the circuit or self-destructing by completely erasing its memory.

Due to the numerous countermeasures they implement, secure elements are complex and expensive to produce. The functionalities they offer are therefore limited, particularly with regard to the number of inputs/outputs they offer. As a result, secure elements are generally not used to control screens, and when they are, as in the “NanoX” product marketed by the applicant, it is to control small screens without any touch function. .

Thus, if we consider the secure elements available on the market and in particular those which offer a security level at least equal to 5 on the EAL Evaluation Assurance Level, corresponding to level E4 of the European ITSEC system (Information Technology Security Evaluation Criteria) and at level B2 of the American TCSEC system (Trusted Computer System Evaluation Criteria), there is to date to the knowledge of the applicant no secure element which includes more than 10 entries/ exits. In fact, the higher the number of inputs/outputs, the greater the attack surface of a secure element.

It will be noted here that the term “inputs/outputs” means 1-bit digital ports usable for transmitting or receiving logic signals, this number of inputs/outputs being less than the number of electrical pins (or “pins”) of a secure element, which includes in addition input/output pins, power supply pins, ground pins, possibly reset pins, etc.

As part of this improvement, however, it was noted that it could be possible to manage a touch screen with a secure element. In fact, a secure element equipped with 10 inputs/outputs can manage the following serial links:

1) an ISO/IEC 7816 link, which has only three logic signals CLK (clock), I/O (data) and RST (“Reset”);

2) an SPI (“Serial Peripheral Interface”) bus which only uses 4 signals:

- SCLK “Serial Clock” or Serial Clock (generated by the master),

- MOSI “Master Output, Slave Input”, or “Master Output, Slave Input” (generated by the master),

- MISO “Master Input, Slave Output” or “Master Input, Slave Output” generated by the slave), and

- SS “Slave Select”, or “Slave Selection”;

3) an I2C bus (“Inter Integrated Circuit Bus”) which has only two signals:

- SDA (Serial Data Line): bidirectional data line,

- SCL (Serial Clock Line): bidirectional synchronization clock line,

a total of 9 inputs/outputs required.

It has also been noted that certain types of displays and certain types of touch modules can be controlled with an SPI bus or an I2C bus. It is also possible to connect a secure element and a microcontroller via an ISO/IEC 7816 connection for smart card, or even an SPI, I2C, USB connection, as well as others.

Finally, managing a touch screen requires processing an interrupt signal that the touch screen emits each time a touch event is detected. Such an interrupt signal makes it possible to activate a touch event management subroutine. Receiving such a signal therefore requires mobilizing another input/output of a secure element, i.e. 10 inputs/outputs in total. As part of this improvement, it has therefore been noted that the use of a secure element to control a touch screen is not impossible.

Thus, according to a first improvement, a hardware wallet is provided comprising a touch screen controlled exclusively by a secure element, via one or more serial links. Subject to certain precautions which will be described later, such a touch screen is able to considerably improve the comfort of the user interface, while meeting the security requirements applicable to hardware wallets. According to the present improvement, the touch screen has a diagonal greater than or equal to 3 inches (i.e. 7.62 cm, one inch being equal to 2.54 cm), but preferably greater than or equal to 3.5 inches (i.e. 8 .89 cm), and includes at least 600 x 400 pixels. In one embodiment, the screen has a diagonal of 3.9 inches (9.906 cm) and offers 670 x 496 pixels.

Example of hardware implementation hardware wallet

There shows the general architecture of an HW3 hardware wallet according to this improvement. The HW3 device includes a secure element SE3, an MCU3 microcontroller and a touch screen TS (“Touch Screen”). The TS touch screen includes an EID electronic ink display (“E-Ink Display”) and a TM touch module (“Touch Module”). The TS touch screen is under the exclusive control of the SE3 secure element. For this purpose, the resources in terms of inputs/outputs of the secure element SE3 are divided into three groups of inputs/outputs IOGA, IOGB IOGC. The IOGA input/output group is assigned to the implementation of a BS1 bus connecting the secure element SE3 to the microcontroller MCU3. The IOGB input/output group is assigned to the implementation of a BS2 bus connecting the secure element SE3 to the EID display, and the IOGC input/output group is assigned to the implementation of a BS3 bus connecting the secure element SE3 to the touch module TM. The BS1 bus is for example an IEC/ISO 7816 bus, the BS2 bus is for example an SPI bus and the BS3 bus is an I2C bus. An inverse arrangement could be provided, with a BS2 bus of I2C type and a BS3 bus of SPI type, or another serial link protocol compatible with the resources of the secure element. The SPI bus is managed on the EID display side by a chip integrated into it, for example the UltraChip® UC8177 chip. The I2C bus is managed on the TM touch module side by a chip integrated into it, for example the Goodix® GT1151QM chip. The secure element is for example an STMicroelectronics® chip from the ST33K1M series and the microcontroller is an STMicroelectronics® chip from the STM32 series.

The HW3 device also includes various peripherals controlled by the MCU3 microcontroller, for example:

- a BAT battery;

- a PMIC power management integrated circuit, for example the NXP PCA9420 chip. The PMIC circuit receives a voltage Vat from the battery when it is charged, supplies the voltage Vat to the battery when it must be charged, and supplies a regulated supply voltage Vcc to the MCU3 microcontroller, to the secure element SE3 and TS touch screen;

- a QiA antenna for inductive battery charging in accordance with Qi technology (https://www.wirelesspowerconsortium.com/qi/). The QiA antenna is connected to a wireless charging integrated circuit WCIC (“Wireless Charging Integrated Circuit”), for example the EPIC® 103AHQI01 chip. The WCIC circuit supplies a voltage Vqi to the PMIC circuit for battery charging;

- a U1 USB port. The USB port provides the PMIC circuit with Vusb voltage for battery charging, provides the MCU3 microcontroller with DTu data received from an external device connected to the USB port, and transmits DTu data to the external device;

- a BTA Bluetooth antenna, receiving an RFS radio frequency signal provided by a BTM circuit for managing Bluetooth communications. Although represented as a separate block from the MCU3 microcontroller, the BTM circuit can be included in the MCU3 microcontroller. The BTM circuit provides DTb data exchanged with an external device via a Bluetooth link or transmits DTb data to the external device via the Bluetooth link.

The HW3 device therefore has the advantage of having a touch screen exclusively controlled by the secure element SE3 and therefore not susceptible to corruption, including in the event of an attack on the MCU3 microcontroller. The latter does not run any application programs and does not store any of the cryptographic secrets used by the secure element. It only manages the peripherals and operates as a proxy processor with regard to the secure element, transmitting to it the DTb, DTu data received by the communication interface chosen by the user, or by transmitting data to the external device DTb, DTu provided by the secure element. The HW3 device therefore does not offer any possibility of direct connection to the Internet and remains, despite its touch screen, a hardware wallet for the cold storage of private keys offering a high level of security.

The secure element SE3 also includes a MEM memory space comprising a read-only memory area (ROM memory), a programmable and electrically erasable non-volatile memory area (Flash memory) and a volatile memory area (RAM memory). The programmable and electrically erasable non-volatile memory area receives an OS3 operating system from the secure element. This is configured to allow application programs to use the TS touch screen.

Example of software implementation hardware wallet

In relation to the example of hardware architecture which has just been described, the schematically shows an example of organization of the programmable and electrically erasable non-volatile memory area of the MEM memory space. The MEM memory space includes an APP zone for storing application programs APP1, APP2… APPn and an zone receiving the OS3 operating system. The OS3 operating system includes a PAP (“Privileged Applications”) memory area comprising a DB dashboard (“Dashboard”) of privileged application programs, and an OSMD (“Operating System Modules”) memory area comprising modules operating system. The OSMD memory area includes:

- a USINT module for managing the user interface,

- a PERS module for personalizing the device,

- a CRY cryptography module associated with a cryptography coprocessor integrated into the secure element, or with hardware accelerators for advanced cryptographic functions,

- an EAA module for approval and attestation of application programs (“Endorsement and Application Attestation”)

- an IOM module for managing communication interfaces (“IO Management”)

The OSMD memory area also includes, according to this improvement, a graphics engine GENG (“Graphic Engine”) configured to manage the electronic ink display EID. The GENG graphics engine includes:

- preconfigured PG pages,

- preconfigured LY (“Layout”) shapes,

- preconfigured OB objects, and

- basic shapes BF.

Access by application programs to the EID display is therefore under the control of the OS3 operating system of the secure element, which first verifies the authenticity and legitimacy of the programs before making the graphics engine available to them.

The OSMD memory area also includes, according to this improvement, a touch module management engine TME (“Touch Management Engine”) which provides authorized application programs with the possibility of having access to and interpreting the data emitted by the TM touch module.

The GENG graphics engine also includes an EVENG event management engine which receives the tactile information provided by the TME tactile engine and searches for correlations with display areas, to distinguish non-significant user presses on the screen and significant support.

In an embodiment making it possible to preserve the limited resources of the secure element in terms of RAM, the GENG graphics engine operates without RAM allocation. The image pixels are transferred to a RAM of the display without rereading them. In another embodiment which can be combined with the previous one, the graphics engine GENG does not manage the preconfigured pages PG, the preconfigured shapes LY (“Layout”) and the preconfigured objects OB. Thus, the “work” that the operating system must do is minimized and is limited to basic BF forms, as it does not need to dynamically create objects. The management of complex shapes is left to the application programs, whose code is designed with preconfigured graphic elements minimizing the operations that the graphics engine must execute.

There illustrates examples of how to use the HW3 hardware wallet. As this cannot connect directly to the Internet, a connection must be established with an HDV host device connected to the Internet ("WB") and running a CA companion application, for example the "Ledger Live" application (https://www.ledger.com/fr/ledger-live). The HW3 device can then interact with the companion software to carry out transactions on the BCN blockchain or on decentralized exchange sites DEX.

The management of the HW3 hardware wallet is also ensured by a transactional black box HSM (“Hardware Security Module”) located in a datacenter, to which the HW3 hardware wallet connects via a secure HTTPS connection. The transactional black box does not store any private keys and only ensures the verification of the authenticity of the device, its commissioning, updating of its operating system, downloading of certified application programs, etc.

Embodiment comprising a v alidation of sensitive operations using two virtual buttons

Although the secure use of a touch screen exclusively controlled by the secure element offers certain ergonomic advantages, the abandonment of the two classic buttons whose simultaneous pressing makes it possible to secure certain sensitive operations could prove harmful to security of the device.

Thus, in one embodiment, the operating system is configured to emulate, by means of the touch screen, the two hardware buttons of the prior art. There illustrates as an example the execution of a sensitive operation in which user approval must be secure:

- at a step S1, the device HW3 connects to the companion application CA or to the HSM module depending on the type of operation to be performed, for example carrying out a transaction or displaying a recovery phrase, via the application CA companion, activate and configure the device, or download an application program via HSM, etc.

- at a step S2, the device HW3 initiates the performance of the sensitive operation,

- at a step S3, the device HW3 displays on the EID display a request for confirmation, by the user, that the sensitive operation must be carried out, and waits for confirmation.

Waiting for confirmation includes a step S31 where the device HW3 displays at least two virtual buttons on the EID display, preferably far from each other. The buttons can have any or fancy graphic of the designer's choice. This step is followed by a waiting step S32 where the device HW3 reads in a loop, for a time T, the information provided by the touch module TM. If before the expiration of time T the device HW3 detects, at a step S33, two simultaneous presses by the user on the two buttons, the device then carries out (or finalizes) the operation at a step S4. If at the end of time T the device HW3 notes, at a step S34, that the user has not validated the operation, the device cancels the operation at a step S5.

Example of creating the hardware wallet with certain types of peripheral organs imposing specific constraints

As indicated above, certified secure elements available on the market only offer a small number of inputs/outputs, generally a maximum of 10 inputs/outputs. In fact, secure elements are generally intended to be arranged in smart cards or in objects connected to the Internet to secure the Internet of Things, particularly in the field of professional applications. A secure element having only 10 inputs/outputs is therefore not designed to control a large touch screen (the other electrical pins of a secure element, such as power or ground pins, are not considered as inputs/outputs as indicated above).

Thus, in the above, the following use of secure element resources was proposed as an example:

- two inputs/outputs to manage the I2C bus connected to the TM touch module (SDA, SCL signals),

- four inputs/outputs to manage the SPI bus of the EID display (SCLK, MOSI, MISO, SS),

- three inputs/outputs to manage the ISO/IEC 7816 bus between the secure element and the microcontroller (I/O, CLK and RST).

In addition to these 9 inputs/outputs, an input/output of the secure element must be reserved for receiving an interrupt signal emitted by the touch module TM when a tactile event is detected, to send the element secured in a touch event processing routine. Under these conditions, the 10 inputs/outputs of the secure element are used

However, in certain embodiments, the EID display may include a configuration element which must be configured and which is only accessible via a serial link dedicated to this component. As shown on the , the EID display can for example comprise a display module EID0 and a configuration unit WM of the display module EID0. The configuration member WM is for example a programmable and electrically erasable non-volatile memory receiving a library of waveforms, which is connected to the display module EID0 by circuitry internal to the latter. The WM configuration unit has its own inputs/outputs which are compatible with an SPI bus.

As the secure element SE3 must have access to the configuration unit WM to program or erase data there, the BS2 bus is used to control both the display module EID0 and the configuration unit WM. More particularly, the wires of the BS2 bus which carry the SCLK, MOSI, and MISO signals are connected both to the inputs/outputs of the EID0 display module and to the inputs/outputs of the WM configuration unit. The SS signal from the BS2 bus is applied only to a selection input CSEL1 (“Chip Select”) of the display module EID0, to which it applies a selection signal SEL1.

In summary, the assignment of the inputs/outputs of the secure element SE3 shown on the is the following :

1) BS1 bus (ISO/IEC 7816), IOGA input/output groups:

- an IO1 input/output of the secure element SE3 is used to manage the RST signal and is connected to an IOM1 input/output of the MCU3 microcontroller,

- an IO2 input/output of the secure element SE3 is used to manage the CLK signal and is connected to an IOM2 input/output of the MCU3 microcontroller,

- an IO3 input/output of the secure element SE3 is used to manage the RST signal and is connected to an IOM3 input/output of the MCU3 microcontroller,

2) BS2 bus (SPI), IOGB input/output groups:

- an IO4 input/output of the secure element SE3 is used to manage the MISO signal and is connected both to an input/output of the display module EID0 and to an input/output of the WM configuration unit of the EID0 display module,

- an IO5 input/output of the secure element SE3 is used to manage the MOSI signal and is connected both to an input/output of the display module EID0 and to an input/output of the WM configuration unit of the EID0 display module,

- an IO6 input/output of the secure element SE3 is used to manage the SCLK signal and is connected both to an input/output of the display module EID0 and to an input/output of the configuration unit WM of the display module EID0, and

- an IO7 input/output of the secure element SE3 is used to manage the signal SEL1 and is connected only to the CSEL1 input of the display module EID0, to which it supplies the selection signal SEL1,

3) BS3 bus (I2C), IOGC input/output groups:

- an IO8 input/output of the secure element SE3 is used to manage the SCL signal and is connected to an input/output of the touch module TM, and

- an IO9 input/output of the secure element SE3 is used to manage the SDA signal and is connected to an input/output of the touch module TM,

4) Finally, the last input/output IO10 of the secure element SE3 is used to receive the interrupt signal emitted by the touch module TM, designated here by the reference ITR.

The configuration unit WM and the display module EID0 being both connected to the same BS2 bus, one must be activated while the other is deactivated, and vice versa, otherwise the secure element cannot communicate with one or the other. For this purpose, the configuration unit WM also includes a selection input CSEL2 (“Chip Select”) which must receive a selection signal SEL2.

It therefore appears in this case that the secure element SE3 does not have enough inputs/outputs to generate the selection signal SEL2 to be applied to the CSEL2 input of the configuration unit WM.

In one embodiment, a method is implemented to nevertheless be able to control the touch screen by means of the secure element SE3. According to this method, the selection input CSEL2 is controlled by an IOM4 input/output of the microcontroller MCU3, which provides the selection signal SEL2. Indeed, a microcontroller generally does not lack available inputs/outputs, unlike the secure element. The binary value of the signal SEL2 supplied by the IOM4 input/output of the microcontroller is controlled by the secure element SE3, which sends commands to the microcontroller for this purpose via the BS1 bus. The microcontroller is configured to “slavishly” execute these commands. Preferably, it does not include any application programs that could take control of the IOM4 input/output, other than that necessary to execute the commands sent by the secure element.

An example of a method of controlling the CSEL2 input of the configuration unit WM by the secure element SE3, via the microcontroller MCU3, is described in the .

At a step S01, the secure element SE3 sends to the microcontroller MCU3 a command for selection of the configuration unit WM. At a step S02, the microcontroller executes this command and applies the selection signal SEL2 of the configuration unit to the CSEL2 input via its IOM4 input/output. The value of this signal can be 0 (ground potential) or 1 depending on the specifications provided by the manufacturer of the WM configurator. At a step S03, the microcontroller confirms to the secure element that the configuration element has been selected. At a step S04, the secure element SE3 establishes communication with the configuration unit WM by means of the bus BS2, after having previously deactivated the CSEL1 input of the display module EID0 by means of the signal SEL1. The secure element then carries out the intended operation on the configuration unit, for example erasing and/or writing data if it is a non-volatile memory. Once the operation is completed, the secure element sends to the microcontroller, in a step S05, a command to deselect the configuration element WM. At a step S06, the microcontroller deselects the configuration element WM, then confirms this deselection to the secure element at a step S07. The latter can then re-establish communication with the EID0 display module by means of the BS2 bus, after having reselected it via its CSEL1 input by means of the SEL1 signal.

It will be clear to those skilled in the art that the method which has just been described is susceptible to various variants, in particular with regard to the confirmations of execution of orders, which could be optional, and the transfer protocol of commands between the secure element and the microcontroller.

Also, it will be clear to those skilled in the art that this process can be applied to various other peripheral organs. In one embodiment, the BS2 bus is connected to a third peripheral device in addition to the display module EID0 and the configuration device WM. The secure element selects/deselects this third peripheral via another input/output of the microcontroller, and can communicate with this peripheral by means of the BS2 data bus, after having deselected the display module EID0 and the configuration body.

Finally, it will be clear to those skilled in the art that this process is capable of various applications and is not limited to the control of a touch screen. It may concern any circuit structure combining a microcontroller and a secure element, in which the secure element controls a number of peripheral organs greater than the number of peripheral organs that it could control if it had to manage all the inputs or inputs / outputs of such peripheral organs, and in particular their selection inputs.

Example of creating a hardware wallet including a large touch screen with display on the edge of the chassis

Figures 11 and 12 show the chassis 10 of an HW3 hardware wallet produced in accordance with a second improvement. The chassis of the HW3 device is seen from its front face FS on the and from its rear face RS on the . The chassis 10 is here a single piece of rectangular shape made of machined or die-cast aluminum. It comprises a first longitudinal side wall 101, a second longitudinal side wall 102, a first transverse side wall 103, a second transverse side wall 104, and a plate 105 which covers the entirety of its front face FS. Inside the chassis, we can see the BAT battery and a printed circuit 11 receiving various components of the HW3 device whose architecture has been described in relation to the .

Figures 13 and 14 are sectional views of the HW3 device, RS rear face of the chassis facing upwards. The HW3 device comprises a touch screen 20, previously designated TS, arranged on the front plate 105 of the chassis. The touch screen 20 is obtained by assembling an electronic ink display 21 ( ) previously designated EID, covered by a touch module 22 ( ) previously designated TM, itself covered with a protective lens 23 ( ).

The display 21 is shown in more detail on the . It includes an active zone 211 or display zone, a painted frame 212, and is manufactured on a flexible substrate 213 using COP (“chip on plastic”) technology. The display is for example an organic active matrix electrophoretic screen combining source drivers, gate drivers and an integrated circuit controller glued directly to the screen substrate, for example the UltraChip® UC8177 controller. The screen offers 670 x 496 pixels with a pixel pitch of 119 micrometers with 16 gray levels. Its dimensions are for example 3.9 inches (9.906 cm) for a total length of 77.4 mm and a total width of 81.7 mm. The dimensions of the active zone are for example 79.73 x 59.03 mm. The flexible substrate 213 extends beyond the active zone 211, and receives a line and column multiplexer 214. It is extended by an SPI bus connector 215 made of a flexible printed circuit, making it possible to connect the display 21 to the printed circuit 11 present in the chassis. The connector comprises auxiliary components 216 and a non-volatile memory 217 receiving a library of waveforms, corresponding for example to the configuration member WM cited in the embodiment of the HW3 device of the .

The touch module 22 is shown in detail on the . It comprises a covering surface 220 and a painted frame 221, the whole being produced on a flexible support 222 of the FPC (“Flexible Printed Circuit”) type. The coverage surface 220 includes a touch zone 220a and a non-touch zone 220b. The flexible support 222 includes an extension 224 receiving a module control chip 225, for example the Goodix® GT1151QM chip. The end of the extension 224 receives an I2C bus connector 226 to connect the touch module 22 to the printed circuit 11 present in the chassis. The touch module has, for example, a total length of 65.7 mm and a total width of 81.3 mm. The tactile zone 220a has for example a surface area of 79.73 x 48.10 mm and the non-tactile zone 220b extends 34.0 beyond this.

The protective lens 23 is shown on the . It includes a transparent zone 230 and a painted frame 231. The lens has, for example, a total length of 67.9 mm and a total width of 83.7 mm. It includes a moisture protection layer, a hard anti-reflective layer and an optically clear adhesive on its rear side to assemble it on the touch module 22. In one embodiment, the lens is designed not to scratch in the case of stacking the HW3 device with other similar devices HW3-1, HW3-2, which will be described later ( ).

In Figures 13 and 14, it appears that the longitudinal side wall 101 of the chassis has a rounded external edge 101r having a substantially semi-circular section, identified by a dotted line arrow. The wall 101, due to its thickness, also has a flat part in the extension of the plate 105, which forms part of the front face FS of the chassis. It also presents, after the rounded edge 101r, a flat part which forms part of the rear face RS of the chassis. The rest of the rear face of the chassis is closed by a cover 110. It will be further noted that in one embodiment of the cover shown on the , the cover 110 includes an antenna coil which is connected to the printed circuit 11.

According to the improvement described here, and as seen on the , the active zone 211 of the display 21 covers:

- most of the front plate 105,

- most of the flat part of the wall 101 which extends the plate 105 and forms part of the front face of the chassis,

- most of the rounded edge 101r of the wall 101, and, optionally,

- the flat part of the wall 101 which forms part of the rear face of the chassis.

The flexible substrate 213 which extends beyond the active zone 211 penetrates inside the chassis to allow the connector 215 of the SPI bus to be fixed on the printed circuit 11, this part of the circuit being hidden by the cover 110.

Likewise, on the , the touch module 22, which covers the display 21 and is itself covered by the lens 23, extends over:

- most of the front plate 105,

- most of the flat part of the wall 101 which extends the plate 105 and forms part of the front face of the chassis,

- most of the rounded edge 101r of the wall 101, and, optionally,

- the flat part of the wall 101 which forms part of the rear face of the chassis.

The term “major part” designates for example at least 90% of the surface area concerned.

The extension 224 of the touch module then passes under the cover 110 and penetrates inside the chassis to allow the I2C bus connector 226 to be fixed on the printed circuit 11.

Preferably, the tactile zone 220a of the module 22 covers only the front plate 105 and the flat part of the wall 101 which extends the plate 105 and forms part of the front face of the chassis, while its non-touch zone 220b covers the edge rounded 101r and the flat part of the wall 101 which forms part of the rear face of the chassis.

Thus, the TS touch screen allows the secure element:

- display information on the front of the chassis, and collect tactile information,

- to display information on the rounded edge 101r without the risk of collecting unintentional tactile information, linked to the handling of the chassis by the user.

The HW3 device, while meeting the rigorous security requirements required by its hardware wallet function, therefore offers remarkable ergonomic advantages usually reserved for moderately secure devices whose screen is not controlled by a secure element, operating under Android or equivalent, with the added possibility of displaying specific information on the edge of the chassis.

Example of making a p hardware wallet comprising magnetic stacking means

As noted above, some cryptoasset holders may use multiple hardware wallets to manage cryptoasset accounts of different natures or values, for example accounts of low monetary value, accounts of high monetary value, accounts of non-fungible tokens or smart contracts, etc.

According to a third improvement which may or may not be combined with the previous improvements, a hardware wallet is provided which can be stacked magnetically with similar hardware wallets.

More particularly provided is a hardware wallet comprising at least four magnets arranged so as to cooperate magnetically with four magnets of at least one similar hardware wallet, in order to ensure the magnetic stacking of the hardware wallet with the similar hardware wallet, and this which whichever hardware wallet sits on top of the other.

In one embodiment, the magnets are arranged asymmetrically so as to form a magnetic key allowing stacking in which the edges of the frame of the hardware wallet are aligned with the same edges of the similar hardware wallet, and in which each magnet faces to the corresponding magnet of the similar device.

Figures 19, 20, 21 show an HW3 device according to this embodiment. There is a cross-sectional view, the is a top view and the is an exploded perspective view of the HW3 device. On the , the FS front face of chassis 10 is at the top. In Figures 20 and 21, the chassis is seen from its rear face RS.

The chassis 10 is here equipped with four magnets M1, M2, M3 and M4 preferably having the same magnetic orientation, for example North oriented towards the front face of the chassis. The magnets M1, M2 are arranged in housings 103-1, 103-2 made in the transverse side wall 103 of the chassis, which extend over substantially the entire thickness of the chassis. The magnets M1, M2 therefore generate a magnetic field on both sides of the chassis.

The magnets M3, M4 each include two superimposed magnets M3a-M3b, and M4a-M4b, as seen in the . The magnets M3a, M4a are arranged in housings 105-3, 105-4 provided in the front plate 105 of the chassis (Figs. 20, 21), while the magnets M3b, M4b are fixed on the cover 110, facing the housings 105-3, 105-4, in recesses provided for this purpose in the cover. The magnets M3a and M3b, M4a and M4b are here of a thickness much less than half the thickness of the chassis, and the space which separates them advantageously allows the passage of the printed circuit 11, as can be seen in the .

In what follows, the magnets M3, M4 will be considered as being in one piece, like the magnets M1, M2, their structure in two superimposed magnets not modifying the reasoning presented below.

The arrangement of the magnets M1, M2, M3, M4 is chosen here so as to form a magnetic key during the magnetic stacking of the device HW3 with a similar device HW3-1, as shown schematically on the . The intended stacking arrangement is one in which the edges of the chassis of the HW3 device are aligned with the same edges of the HW3-1 device, and in which each magnet of the HW3 device faces the corresponding magnet of the similar HW3 device -1. This arrangement should preferably be unique, so that there is only one magnetic stacking position in which the devices HW3, HW3-1 have their respective edges aligned. In other words, when the stacking arrangements are not identical (for example if the devices are arranged head to tail) the devices should not adhere magnetically. The arrangement of the magnets must therefore prevent the devices from being incorrectly positioned, so that the devices do not attract each other magnetically if this is the case.

For this purpose, and with reference to Figures 20, 22, we define a longitudinal central axis L-L' of the chassis, located midway from the longitudinal side edges 101, 102 of the chassis, and a transverse central axis T-T' of the chassis, located midway from the transverse side edges 103, 104 of the chassis. The axes L-L' and T-T' define four quadrants Q1, Q2, Q3, Q4 and each magnet is arranged in one of these quadrants. The magnets M1, M2, M3, M4 are arranged asymmetrically relative to the longitudinal central axis L-L' or relative to the transverse central axis T-T'. A combination of these two asymmetries can also be provided, for all or part of the magnets. To formalize this asymmetry more precisely, each magnet M1, M2, M3, M4 is defined as having a central point cm1, cm2, cm3, cm4 (cmi), a longitudinal dimension lm1, lm2, lm3, lm4 (lmi) and a dimension transverse tm1, tm2, tm3, tm4 (tmi), as shown in the .

Furthermore, the following axes and distances are defined, as shown in Figures 20 and 22:

- L1-L1’ is a longitudinal axis passing a central point of the magnet M1 and parallel to the longitudinal central axis L-L’,

- t1 is the transverse distance between the axes L1-L1’ and L-L’,

- L2-L2’ is a longitudinal axis passing a central point of the magnet M2 and parallel to the longitudinal central axis L-L’,

- t2 is the transverse distance between the axes L2-L2’ and L-L’,

- L3-L3’ is a longitudinal axis passing a central point of the magnet M3 and parallel to the longitudinal central axis L-L’,

- t3 is the transverse distance between the axes L3-L3’ and L-L’,

- L4-L4’ is a longitudinal axis passing a central point of the magnet M4 and parallel to the longitudinal central axis L-L’,

- t4 is the transverse distance between the axes L4-L4’ and L-L’,

- T1-T1’ is a transverse axis passing a central point of the magnet M1 and parallel to the transverse central axis T-T’,

- l1 is the longitudinal distance between the axes T1-T1’ and T-T’,

- T2-T2’ is a transverse axis passing a central point of the magnet M2 and parallel to the transverse central axis T-T’,

- l2 is the longitudinal distance between the axes T2-T2’ and T-T’,

- T3-T3’ is a transverse axis passing a central point of the magnet M3 and parallel to the transverse central axis T-T’,

- l3 is the longitudinal distance between the axes T3-T3’ and T-T’,

- T4-T4’ is a transverse axis passing a central point of the magnet M4 and parallel to the transverse central axis T-T’, and

- l4 is the longitudinal distance between the axes T4-T4’ and T-T’,

it can be provided, in one embodiment, that at least two magnets have different transverse distances t1-t4 or longitudinal l1-l4.

In one embodiment, one of the following design rules or a combination of at least two of these rules is implemented:

- the transverse distances t1-t4 are all different from each other,

- the longitudinal distances l1-l4 are all different from each other,

- certain transverse distances t1-t4 are different and certain longitudinal distances l1-l4 are different.

In another even more rigorously asymmetrical embodiment, one of the following rules is added to one of the rules above or to a combination of these rules:

- the difference between each transverse distance t1, t2, t3, t4 and each of the other transverse distances is at least equal to the sum of the halves of the transverse dimensions tm1, tm2, tm3, tm4 of the corresponding magnets, or

- the difference between each longitudinal distance l1, l2, l3, l4 and each of the other longitudinal distances is at least equal to the sum of the halves of the longitudinal dimensions lm1, lm2, lm3, lm4 of the corresponding magnets,

Or, by combining the two rules:

- the difference between certain transverse distances t1, t2, t3, t4 is at least equal to the sum of the halves of the transverse dimensions tm1, tm2, tm3, tm4 of the corresponding magnets, and the difference between certain longitudinal distances l1, l2, l3, l4 is at least equal to the sum of the halves of the longitudinal dimensions lm1, lm2, lm3, lm4 of the corresponding magnets.

In the embodiment shown on the , the center cm2 of the magnet M2 is arranged on the transverse axis T1-T1' of the magnet M1, and the center cm4 of the magnet M4 (M4a, M4b) is arranged on the transverse axis T3-T3' of magnet M3 (M3a, M3b). The longitudinal distances l1, l2 are equal, as are the longitudinal distances l3, l4, but the longitudinal distances l1, l2 are different from the longitudinal distances l3, l4. Furthermore, the transverse distances t1, t2, t3, t4 are all different, and the smallest differences between the transverse distances, here the differences between the distances t1 and t3 and between the distances t2 and t4, are substantially equal to the sum halves of the transverse dimensions of the corresponding magnets, i.e. M1, M3 on the one hand and M2, M4 on the other hand. The term “substantially” is understood here to within a few tenths of a millimeter.

It will be clear to those skilled in the art that the improvement which has just been described is capable of various other variants and embodiments. In particular, the magnets M1 and M2 can themselves comprise two superimposed magnets, as illustrated in the which shows an HW4 variant of the device equipped with a magnet M1 consisting of a pair of magnets M1a, M1b. Conversely, the M3 and M4 magnets can be in one piece and extend over the entire thickness of the chassis, as shown in the which shows an HW5 variant of the device equipped with a one-piece M3 magnet identical to the M1 magnet. Likewise, fixing the magnets in the chassis can use various means other than those which have been described. In particular, the magnets or some of them could be directly fixed on the printed circuit, if it is robust enough to resist the tearing force which is exerted on each magnet during the separation of two magnetically stacked chassis . Finally, although this improvement does not require it, the polarities of the magnets could, in certain embodiments, not all be identical. It will also be clear to those skilled in the art that the improvement which has just been described is capable of being applied to any type of portable electronic device which one wishes to stack with a similar device.

Example of production portable electronic devices having interactive stacking functionality

We have described in the above examples of embodiments of devices which can be stacked magnetically in accordance with the third improvement. According to a fourth improvement, stacked devices implement an interactive stacking management method allowing them to be used when they are present in a stack despite the fact that their front screen is no longer accessible.

For example, a user can own three hardware wallets HW3, HW3-1, HW3-2 and stack them magnetically as shown in the . The user might want, without removing the battery, to access their content or check their status (battery charge, cryptoasset wallets, value of a private key, etc.). The user might also want to use one of the devices by connecting it to an HDV host device to carry out a transaction on the BCN blockchain or on a decentralized exchange site DEX, or even an update or download operation. an application program via an HSM module.

According to the present improvement, the device at the top of the stack makes its screen available to other devices if the user requests it. This “provisioning” means that the user can use the screen of the device at the top of the stack to view or use a device present in the stack.

For this purpose, the devices communicate with each other by means of a wireless data link. In the case of an HW3 device as described above, this link is for example a multipoint Bluetooth link, after prior pairing of the devices, as well as, preferably, their pairing with an HDV host device.

The organization of data exchanges between stacked devices can be done according to a meshed, chained, or hierarchical communication strategy. In a mesh communication strategy, each device can communicate with any of the other devices. In the example shown on the , such a strategy involves wireless data links SLNK1, SLNK2, SLNK3 between the devices. In a chained communication strategy, each device can communicate with the device immediately below or above it in the stack. In the example shown on the , such a strategy involves the SLNK1 and SLNK2 wireless data links. In a tiered communication strategy, the device at the top of the stack talks to the devices below it, and any two devices inside the stack do not communicate with each other. In this case, only the SLNK1 and SLNK3 connections are used in the example of the .

This improvement being applicable to any type of portable electronic device comprising means of wireless communication, in particular wifi, the choice of a communication strategy may vary depending on the type of wireless data link used. A hierarchical communication strategy may for example be preferred in the case of Bluetooth links. A mesh communication strategy may be preferred in the case of wifi links.

In one embodiment, the interactive stacking method according to the present improvement assigns to each device in the stack one of the following operating modes:

- an SM0 mode, or “Stacked Mode disabled”.

- an SM1 mode, or “Covered” mode

- an SM2 mode, or “Summit” mode.

- an SM3 mode, or “Between two” mode.

In modes SM1, SM2 SM3, stacked mode is activated and each mode reflects the position of the device in the stack and corresponds to specific “F” and “E” displays: Fashion Stacked Mode Location Display SM0 Disabled Isolated F0, E0 SM1 Enabled Bottom of the pile F1, E1 SM2 Enabled Top of the pile F2, E2 SM3 Enabled Between two devices F3, E3

In order to make the most of the display possibilities offered by the TS touch screen which has been described above, each mode is assigned an “F” display on the front (“front” display) and a “E” on the edge of the device (“Edge” display). The display “E” corresponds, in the embodiment described above, to an information display on the non-touch zone of the touch screen TS covering the rounded edge 101r of the chassis. An “F” display can correspond to one or more different menus, allowing you to manage the battery or to individually manage one of the devices that make up the battery.

The SM0 operating mode corresponds to the normal operating mode of the HW3 device. The HW3 device in SM1 or SM3 mode is covered by another device and therefore could not be used without the method described here. The device in SM2 mode is at the top of the stack and can be used normally since its screen is accessible to the user, but it can also make its screen available to other devices if the user requests it. Predicting the SM3 operating mode may not be necessary, depending on interactive stack management needs. In particular it may not be necessary to know which devices are at the bottom or in the middle of the stack when the device in the “top” mode addresses each of them.

The F0 display is the usual display presented to the user when using the device with stacked mode disabled. The display F1 (“covered”) or F3 (“Between two”) can be any since the user does not see the device screen. This may be a lack of display, the display of an image or information, for example “this device is in stacked mode”. But it can also be the display of a command, for example "disable stacked mode", which can be useful if it happens that the user breaks the stack without having previously informed the device at the top of the battery that it wishes to deactivate stacking mode, information that the device will then transmit to other devices.

The display F2 can include the prior display of a menu by which the user chooses the device he wants to control by means of the screen. An example of such a menu is shown on the . The user is asked to choose between “this device” or one of the other two devices HW3-1, HW3-2. If the user chooses "this device" the F2 display switches to an F0' display which is similar to the F0 display with the addition of a back key to allow the user to make a new choice. If the user chooses “HW3-1” or “HW3-2” the F2 display switches to an F0'' display which is similar to the F0 display but with the added indication that the device in use is not “this device” but the one that was selected. A return key is also provided to allow the user to make a new choice.

Thus, the use of a device located in the stack by means of the display of the device at the top of the stack, can be similar to its use when the stacked mode is disabled, the displays F0' or F0'' may include the same menus as the F0 display. The user may for example choose to connect the device to an HDV host device using an LNK1, LNK2 or LNK3 data link, to conduct a transaction, as shown in Figure .

The displays on the edge E0 to E4 are optional but can provide additional comfort to the user since they are visible despite the fact that the devices are stacked. These displays may be the same or different. They can, for example, consist of displaying the name of the device or its serial number. When a device in SM1 or SM3 mode is selected by the device in SM2 mode, the display of the device name or serial number may become flashing or scrolling instead of remaining solid.

There describes operations carried out by the device HW3 after having been placed in the “summit” mode SM2 ( ). At a step S10, the device HW3 interrogates all the devices present in the stack to identify them. It will be noted that for security reasons, the implementation of these various data links preferably requires prior device configuration steps during which each device is informed of the devices with which it could be stacked. A device that has not been previously declared by the user will therefore not be admitted to a stack. Likewise, it can be expected that the devices HW3, HW3-1, HW3-2 authenticate each other in a secure manner using their cryptographic means, before agreeing to communicate with each other.

At a step S11, the device HW3 presents the list of devices to the user and asks him to make a choice, for example in the aforementioned manner shown on the . At a step S12, the device HW3 establishes communication or reestablishes communication with the device designated by the user. At a step S13 the device HW3 receives information to be displayed from the selected device and displays it on its touch screen. At a step S14 the device HW3 detects a user action on its touch screen and transmits it, at a step S15, to the selected device. This process can continue indefinitely as long as the user uses the selected device, until a step S16 where the user returns to the choice menu ( ) to select another device or to request that all devices be put into a sleep mode.

The implementation of this interactive stacking management method assumes that each device is able to activate stacking mode and knows where it is in the stack, to place itself in the corresponding SM1 or SM2 mode, or optionally in SM3 mode. For this purpose, the stacking management method can be implemented automatically or manually.

As part of an automatic implementation of the method, each device HW3, HW3-1, HW3-2 is equipped with sensors 108a, 108b, as illustrated in the . These sensors allow devices to detect the presence of another device below or above them. If the devices are equipped with magnets, the sensors 108a, 108b can be Hall effect sensors, capable of detecting the presence of a magnet below or above each device. The sensors 108a, 108b can be directly connected to the secure element SE3 as shown on the , or be connected to the MCU3 microcontroller. Various other types of sensors can also be used, such as optical, acoustic, piezoelectric, electromagnetic, thermal, capacitive, etc., especially if the stacked devices do not include magnets.

In one embodiment, it is not essential that the sensors make it possible to identify with certainty that an object detected on or under a device HW3, HW3-1, HW3-2 is a similar device capable of being placed in the stacking mode. This indetermination can be lifted by the device in the “summit” mode depending on the responses received to its identification requests. Likewise, a device detecting an object placed above it and not receiving any identification request will understand that the object is not a compatible device.

There is a state diagram showing an example of automatic implementation of the interactive stacking management method. In this example, the four operating modes SM0, SM1, SM2, SM3 are managed. The HW3 device defaults to SM0 mode. At a step S22, the device detects the presence of a device above it and switches to mode SM1, where it waits to be interrogated by the device in the “summit” mode. As another possibility, the device detects the presence of a device below it at a step S23 and switches to the “top” mode to interrogate and identify the other devices present in the stack. If the device is in SM2 mode and detects at a step S24 that a device has been placed above it, it switches to SM3 mode. Once in SM3 mode, the device returns to SM2 mode if, at a step S25, the device above is no longer detected. Finally, whatever the mode SM1, SM2, SM3 in which it is located, if the device detects at a step S20 that there is no longer any device above or below it, it automatically returns to SM0 mode.

In a manual implementation of the method, the user accesses a menu for manual activation of the stacking mode, an example of which is given on the . The user first activates stacked mode, then chooses between “covered” mode SM1 and “top” mode SM2. In this example, SM3 mode is not supported.

There is a state diagram showing an example of manual implementation of the interactive stacking management method. The HW3 device defaults to SM0 mode. At a step S30, the user activates stacked mode. At a step S31, the user chooses SM1 or chooses mode SM2 at a step S32. At any time, the user can return to step S31 or S32 to change the operating mode of the device while modifying its position in the stack. Likewise, at any time the user can, during a step S33, deactivate stacked mode.

In an application of the method to hardware wallets of the type described above, the management of modes SM0, SM1, SM2, and optionally mode SM3, is preferably ensured by the operating system OS3 of the secure element SE3. For this purpose, an ASM module for automatic stacking management (“Automatic Stacking Management”) is provided in the operating system as shown in the . Alternatively, an MSM module for manual stacking management is provided in the OS3 operating system. In certain embodiments, the two modules can coexist, the choice between automatic or manual management being offered to the user. Each of these modules allows the device to be placed in the different operating modes and to operate as these modes require. When SM3 operating mode is not supported, it is included in SM1 mode, which covers the case where the device is at the bottom of the stack and the case where it is in the middle of the stack.

It will be clear to those skilled in the art that the method according to the present improvement is applicable to any type of portable electronic device comprising means of wireless communication, in particular wifi, and that its field of application is not limited. to hardware wallets for cold storage of private keys. Likewise, the method is not exclusively linked to the use of magnets to stack devices, a stacking can be provided without the devices being held magnetically against each other. Also, the method is applicable to devices having no display on the edge of the chassis (display E) and only having a display on the front panel (display F).

In embodiments, the interactive stack management method may also involve the HDV host device. In this case, the companion software menu includes a “stack management” option allowing the user to select the hardware wallet they want to use to make a transaction ( ). The hardware wallet at the top of the stack is then informed by the companion software that it should make its screen available to the selected hardware wallet via the host device.

Example of making an a Self-adaptive Bluetooth antenna having two radiation axes, particularly for stackable devices

We have described in the above a hardware wallet equipped with a Bluetooth BTA antenna ( ) and a TS touch screen. We have also described a hardware wallet made of an aluminum chassis and comprising a front face covered with an electrically conductive wall 105 receiving the TS touch screen ( ). Finally, a hardware wallet that can magnetically stack with a similar hardware wallet ( ) and a method for interactively managing a stack of hardware wallets using wireless communication between the stacked hardware wallets, in particular via Bluetooth links.

Tests carried out by the applicant with Bluetooth antennas available on the market in the form of integrated components have shown that this type of component is unsuitable for obtaining good quality Bluetooth communication due to the metallic mass contained in the chassis 10, in particular the electrically conductive wall 105 which covers the front face of the chassis ( ). In normal use (HW3 device in the open air), this metallic mass causes a strong attenuation of the gain of these conventional antennas, by acting as a screen (in the sense of shield or shielding) with regard to the electromagnetic field that they emit. We obtain a low gain, not allowing a stable Bluetooth connection to be established.

The applicant also conducted tests with an IFA type inverted-F antenna (“Inverted-F Antenna”), a type of antenna generally used in mobile telephones, the antenna being arranged near the edges of the chassis. We obtained a relatively low gain in normal use (HW3 device not stacked and in the open air), but not preventing Bluetooth communication. On the other hand, when two devices HW3, HW3-1 are stacked (for example ), the device located at the top of the stack sees the gain of its antenna weaken which can lead to unstable Bluetooth communication.

It could therefore be desired to provide an improved radio frequency antenna structure which can be used in particular but not exclusively in a portable electronic device comprising an electrically conductive chassis, and which offers relatively stable performance in two conditions of use, comprising a on the other hand use in the open air, and on the other hand use in the presence of an electrically conductive surface, for example when the device is stacked with a similar device.

According to a fifth improvement, a radio frequency antenna is provided comprising the combination of a closed slot antenna produced in a side wall of the chassis, having a radiation axis substantially perpendicular to this wall, and a parasitic antenna with an open slot having a radiation axis perpendicular to the radiation axis of the closed slot antenna. The two antennas are adjusted using computer radiofrequency field simulation tools taking into account the two aforementioned operating conditions. A resulting antenna is obtained whose performance is substantially homogeneous under these two operating conditions. A detailed example of producing such an antenna will be described in the following on a non-limiting basis.

Example of making a closed slot antenna

The main components of one embodiment of a closed slot antenna are shown in the exploded view of the . The structure of the antenna after assembly is shown in Figures 38, 39, 42, 43. In Figures 34, 39, 42, 43 the chassis 10 is seen in perspective from its rear face RS, the plate 105 being at the bottom . In the sectional view of the , plate 105 is at the top. As a result, the locations or orientations of the components are reversed on the compared to the other figures.

In reference to the , the closed slot antenna comprises a longitudinal orifice 40 made in a wall of the chassis, here the longitudinal side wall 102. The antenna also comprises a radio frequency signal injector 50, to apply to the orifice 40 a ground potential and a radio frequency signal RFS, this signal being supplied by the BTM circuit ( ) arranged on the printed circuit ( ).

The longitudinal orifice 40, seen from the front on the , comprises two longitudinal surfaces 41, 42 facing each other, connected by two lateral surfaces 44, 45, here of substantially rounded shape. It has a length Ls, or length of the longitudinal surfaces 41, 42, and a height Hs. The wall 102 also has a recess 45 which does not pass through it and is not considered to be included in the orifice 40.

The injector 50 is made from a flexible printed circuit and comprises two electrodes 51, 52. The electrode 51 rests on the surface 41 of the orifice 40 and the electrode 52 rests on the surface 42 of the orifice. The injector 50 also comprises a connecting part 53 extending between the electrodes 51, 52, and an extension 54 in the extension of the electrode 51.

Figures 36, 37 show the injector 50 respectively in a top view and a bottom view. The top view shows the exterior face of the injector which is in contact with the surfaces 41, 42. Before its folding, which occurs during its insertion into the orifice 40, the injector is a flat part as seen on these figures. The injector includes various conductors 500, some being on the surface and others buried. It also includes contact pads Pc1, Pc2, Pc3, Pc4, Pc5, Pc6 allowing components to be soldered, here capacitors C1, C2, C3, which participate in the adjustment of the closed slot antenna. Finally, the injector 50 includes a connector 540 arranged on the extension 54, allowing it to be connected to the printed circuit in order to receive the ground potential and the RFS radio signal.

When the injector 50 is arranged in the orifice 40, a compression piece 55 - or spacer - is inserted between the electrodes 51, 52, as seen for example on the . The compression piece 55 is made of a flexible material such as silicone rubber, and presses the electrodes 51, 52 against the surfaces 41, 42. It will be noted that the electrodes 51, 52 only cover the edges of the surfaces 41, 42 here. , the exterior part of the orifice 40 being obstructed by a non-electrically conductive plug 47 ( ). The electrodes 51, 52 can be covered with a layer of gold 520 to ensure good electrical contact with the surfaces 41, 42. The latter can also be produced by milling to provide good electrical conductivity, particularly if the chassis in aluminum has been previously anodized.

Advantageously, the electrodes 51,52 here have a large contact surface with the surfaces 41, 42, the length of the contact surface being at least equal to a quarter of the length Ls of the surfaces 41, 42. They are preferably inserted at middle of the orifice 40, so that their edges are at the same distance from the walls 44, 45 of the orifice.

There is the electrical diagram of the injector. The connector 540 comprises a plurality of ground contacts 541 connected to the electrode 51 which forms a ground plane (GND). It also includes a contact 542 receiving the RFS radio frequency signal. Contact 542 is connected to pad Pc3' by a conductor 500. Capacitor C3 has a first terminal connected to pad Pc3' and a second terminal connected to pad Pc3 which is connected to electrode 51. Capacitor C1 has a first terminal connected to the range Pc1' and a second terminal connected to the range Pc1. The capacitor C2 has a first terminal connected to the area Pc2' and a second terminal connected to the area Pc2, which is connected to the electrode 51. The conductors 500 connect the area Pc1 to the area Pc3', the area Pc1' to the Pc2' range as well as the electrode 520. As shown on the , surface 42 therefore receives the radio frequency signal RFS via capacitor C3, the second terminal of which is connected to surface 41 via capacitor C3. Surface 41 is at ground potential and is connected to surface 42 via capacitor C2.

The configuration which has just been described is only of an exemplary nature and various other arrangements of components and choices of components involved in the adjustment of the antenna could be envisaged by those skilled in the art.

Example of making a parasitic antenna with an open slot

The main components of an exemplary embodiment of an open slot parasitic antenna are shown in the exploded view of the . The structure of the antenna after assembly is shown in Figures 42, 43. The open slot parasitic antenna comprises an arm 70 made of an electrically conductive metal, for example stainless steel or mild steel with nickel plating. The arm 70 has a thin rectangular section to be flexible, and a length Lb. It extends along the wall 102 of the frame, at a distance Db from the opening 40 (Figs. 38), or at a distance Db from the interior edges of the surfaces 41, 42 of the opening 40, in a plane parallel to the plane of surface 42 ( ) and close to it.

The arm 70 has a free end 701 and a captive end 702. The end 702 is wider than the rest of the arm and extends to the wall 102 where it has a projecting contact 71, obtained for example by stamping, which comes to rest on a contact surface 107 made in the wall 102 ( ).

The arm 70 also includes, in the extension of the end 702, a base 703 provided with a hole 704. A screw 705 which passes through the hole 704 is screwed into a threaded hole 106 ( ) made on a reception surface 108 provided in the wall 102 (Figs. 34, 43).

The arm 70 is fixed to the wall 102 by exerting on it an elastic bending stress between its base 703, which is screwed onto the receiving surface 108, and the projecting contact 71, which is supported on the surface contact 107. This constraint exerts sufficient pressure on the contact 71 so that the electrical contact between the arm 70 and the surface 107 does not alter over time.

The electrical contact point of the arm 70 with the wall 102, here the contact surface 107, is preferably close to the surface 42 which receives the RF signal, so that the parasitic antenna is indirectly powered by the radio frequency signal applied to the Closed slot antenna. More particularly, this point is preferably close to the end of surface 42. We thus see on the that the projecting contact 71 is here close to the lateral surface 44 of the orifice.

In reference to the or to the , the parasitic antenna with an open slot also includes a part 80 comprising guide walls of the arm 70 in order to ensure its parallelism relative to the wall 102. The guide part 80 is also shown on the . The free end 701 of the arm 70 is shown in two positions: a relaxed position P1(701) before mounting in the chassis, and a position P2(701) subjected to the elastic bending stress mentioned above, where the contact in projection 71 resting on surface 107 forces the arm to occupy a horizontal position.

There is a schematic diagram that shows the antenna resulting from the combination of the closed slot antenna and the open slot parasitic antenna. The closed slot antenna comprises the surfaces 41 and 42 of the orifice 40, connected by the walls 43, 44. The open slot parasitic antenna comprises the arm 70 connected to the wall 102 by the projecting contact 71 provided on the captive end 702. The closed slot antenna has a radiation axis Y substantially perpendicular to the side wall 102 of the chassis, while the parasitic antenna with an open slot has a radiation axis radiation Y, therefore parallel to the side wall 102 and perpendicular to the plane of the chassis 10.

Example of tuning and optimization of the resulting antenna

The closed slot antenna and the open slot parasitic antenna together form a resulting antenna whose sizing and tuning parameters must be determined by computer simulations. To do this, it is first necessary to determine the frequency band in which the antenna will be used. This will be, for example, the Bluetooth band or the 2.45 GHz WiFi band, with channel widths which may vary depending on the technology used.

In an embodiment offering results which will be described later, these simulations aim to optimize the antenna in the context of Bluetooth communication, i.e. in a targeted frequency band TFB between a frequency Fmin of 2.4 GHz and a frequency Fmax of 2.483 GHz, to obtain at least one of the following results:

1) the gain of the resulting antenna in the targeted frequency band must be greater than -5 dB when the chassis 10 of the HW3 device is in the open air, and must remain greater than -5 dB when the rear face of the chassis is facing an electrically conductive surface, in particular the plate 105 of the chassis of a similar device HW3-1, HW3-2.

2) when the chassis 10 is in the open air, the open slot parasitic antenna must have a tuning frequency located in the targeted frequency band,

And

3) when the rear face of the chassis 10 faces a metal surface and in particular the front plate 105 of the chassis of a similar device, the closed slot antenna must have a tuning frequency located in the band of target frequencies.

In other words, depending on the operating conditions, the radiation from the closed slot antenna will be predominant over that of the open slot parasitic antenna or vice versa.

Among the large number of parameters allowing the antenna to be tuned to obtain the desired results, the most important parameters include:

- the length Ls of the longitudinal orifice 40, i.e. the length of the closed slot antenna,

- the height Hs of the longitudinal orifice 40, i.e. the opening of the closed slot antenna,

- the length Lb of arm 70, i.e. the length of the parasitic antenna with an open slot,

- the distance Db previously described between the arm 70 and the opening 40, i.e. the opening of the parasitic antenna with an open slot.

As a starting point for the simulations, the theoretical length of the longitudinal orifice 40 is chosen equal to a quarter of the wavelength of a frequency of 2.45 GHz, or 30.6 mm. The tests and simulations lead to a significantly different value within a few millimeters, due to the presence of the parasitic antenna with an open slot, to obtain the objectives mentioned above. Thus, after simulations and tests, the following values were for example retained:

- length Ls of the longitudinal orifice 40: 30 mm;

- height Hs of the longitudinal orifice 40: 2.1 mm;

- length Lb of arm 70: 22 mm;

- distance Db: 1.6 mm.

It will be clear to those skilled in the art that these values are likely to vary depending on other parameters of the antenna, for example the electronic components on board the injector 50 (here the capacitors C1 to C3), the shape of the frame and the location of the opening on one of its walls, the quantity of metal constituting the frame, etc.

Figures 46 and 47 show curves of the reflection losses or return losses of the resulting antenna, obtained with the dimensioning which has just been indicated. There shows the reflection loss curve RL1 when the device HW3 is in the open air. There shows the reflection loss curve RL2 when device HW3 is stacked on a similar device HW3-1, as shown in Figure . Each curve presents two low values of the reflection losses, at frequencies which correspond respectively to the tuning frequency FT1 of the closed slot antenna and to the tuning frequency FT2 of the open slot parasitic antenna. More specifically:

- FT1a ( ) is the tuning frequency of the closed slot antenna when the device is in the open air or when the device is under another similar device (e.g. the HW3-1 device on the ). These two cases are considered similar because the conductive plate 105 forms a screen which makes the antenna insensitive to what is above it;

- FT1b ( ) is the tuning frequency of the closed slot antenna when the device is placed on a metallic surface or placed on another similar device (for example the HW3 device on the ) ;

- FT2a ( ) is the tuning frequency of the open slot parasitic antenna when the device is in the open air or when the device is under another similar device (e.g. the HW3-1 device on the ). Indeed in both cases the conductive plate 105 forms a screen which blocks the radiation that the parasitic antenna emits upwards along the axis X, and the presence of metallic masses above the device does not modify its properties ;

- FT2b ( ) is the tuning frequency of the open slot parasitic antenna when the device is placed on a metallic surface or placed on another similar device (for example the HW3 device on the ). In this case the conductive plate 105 blocks the radiation emitted downwards by the parasitic antenna, along the X axis.

The following results are obtained, the tuning frequencies of the closed slot antenna and the open slot parasitic antenna being those for which the lowest reflection losses are obtained:

(outdoors) :

- FT1a = 2.32 GHz i.e. FT1a<Fmin

- FT2a = 2.42 GHz i.e. Fmin<FT2a<Fmax

(placed on a metal surface or other device):

- FT1b = 2.475 GHz, i.e. Fmin<FT1b<Fmax

- FT2b = 3.15 GHz i.e. Fmax<<FT2b

With (for the record):

- Fmin = 2.4 GHz

- Fmax = 2.483 GHz

In the case of the , the tuning frequency FT1a of the closed slot antenna is “out of band” while the tuning frequency FT2a of the open slot parasitic antenna is in the target frequency band. The radiation from the open slot parasitic antenna is predominant over that of the closed slot antenna.

In the case of the , the tuning frequency FT1b of the closed slot antenna is in the target frequency band while the tuning frequency FT2b of the open slot parasitic antenna is out of band. We see in fact on the that the open-slot parasitic antenna sees two electromagnetic screens above and below it, along its X-axis of radiation. The screen above is formed by the wall 105 of the chassis in which it is located, and the screen below is formed by the wall 105 of the chassis of the HW3-1 device. The radiation from the closed slot antenna is therefore in this case predominant over that of the open slot parasitic antenna.

Finally, Figures 49A and 49B show the gain CG1, CG2 of the resulting antenna when the device HW3 is in the open air, and Figures 50A, 50B show the gain CG3, CG4 of the resulting antenna when the device HW3 is placed on a metal surface or similar HW3-1 device. More particularly, Figures 49A, 50A show the gain CG1, CG3 of the resulting antenna in the Y-Z plane, i.e. the plane of the chassis or horizontal plane when the chassis is laid flat. Figures 49B, 50B show the gain CG2, CG4 of the resulting antenna in the vertical plane X-YZ, i.e. a plane perpendicular to the chassis or vertical plane when the chassis is laid flat. We obtain, in the first case, a gain peak of -1.5 dB at a horizontal angle of 225 degrees and a vertical angle of 105 degrees. In the second case, we obtain a peak gain of -3.4 dB at a horizontal angle of 90 degrees and a vertical angle of 120 degrees.

So :

1) the gain of the resulting antenna in the targeted frequency band is greater than -5 dB when the chassis of the device is in the open air and remains greater than -5 dB when the rear face of the chassis of the HW3 device is in view of an electrically conductive surface, in particular the plate 105 of the chassis of a similar device HW3-1, HW3-2,

2) when the chassis 10 is in the open air, the open slot parasitic antenna has a tuning frequency located in the targeted frequency band while the closed slot antenna has a tuning frequency located outside of the targeted frequency band, and

3) when the rear face of the chassis faces a metal surface and in particular the front plate 105 of the chassis of a similar device, the closed slot antenna has a tuning frequency located in the targeted frequency band while that the open slot parasitic antenna has a tuning frequency located outside the targeted frequency band.

In other words, when the resulting antenna is between two conductive plates, it radiates mainly from the side of the chassis, while when the chassis is in the open air, the resulting antenna radiates mainly from the underside of the chassis , which is covered with a plastic cover.

It will be clear to those skilled in the art that the improvement which has just been described is capable of numerous variations and is not limited to the application context in which it was designed. Generally speaking, the combination of a closed slot antenna and an open slot parasitic antenna which has just been described is not linked to the structure of the chassis 10 which has been described in the above and its application is not just reserved for a hardware wallet. Such a combination can be used in various applications and various portable electronic devices, in particular but not exclusively when the conditions of use are such that the metallic environment of the antenna can vary in large proportions.

It will also be clear to those skilled in the art that the second, third, fourth and fifth improvements, although having been described in the above in relation to the production of a hardware wallet for the storage of private keys, are independent of each other and may be subject to separate implementations and various applications other than application to a hardware wallet.

Claims (11)

Portable electronic device (HW3) comprising a chassis (10) in which is arranged at least one processor (MCU3, SE3), a touch screen (TS, 20) covering all or part of a front face (FS) of the chassis (10 ), and wireless communication means (BTA, BTM), characterized in that it is configured for, when stacked with at least one other similar device (HW3-1, HW3-2) and is in top of the stack, establish communication with the similar device (HW3-1, HW3-2) present in the stack, receive information provided by the device present in the stack and display it on the touch screen (TS, 20) . Device according to claim 1, also configured to receive commands provided by a user via the touch screen (TS, 20) and transmit them to the similar device. Device according to one of claims 1 and 2 configured (ASM, MSM) to switch, automatically (S22, S23) or in response to an action (S30, S31, S31) of the user, in a stacked operating mode ( SM1, SM2, SM3) in which it communicates with at least one similar device (HW3-1, HW3-2). Device according to claim 3, wherein the device is configured to, in the stacked mode of operation, execute a first mode of operation (SM1, SM3) in which the device is not at the top of the stack, and a second mode mode (SM2) in which the device is at the top of the stack, and in which, in the first mode of operation, the device can be controlled via the touch screen (TS) of a similar device (HW3-1 , HW3-2) present at the top of the stack, and in the second operating mode, the touch screen (TS) of the device makes it possible to control a similar device (HW3-1, HW3-2) present in the stack. Device according to one of claims 1 to 4, comprising at least one sensor (108a, 108b) for detecting the presence of a device (HW3-1, HW3-2) present above or below the chassis (10 ). Device according to one of claims 1 to 5, comprising magnets (M1-M4) for magnetically stacking the device with a similar device (HW3-1, HW3-2). Device according to claims 5 and 6, in which the sensor (108a, 108b) is a hall effect sensor configured to detect the presence of at least one magnet (M1-M4) above or below the chassis ( 10). Device according to one of claims 3 and 4, comprising a secure element (SE3) configured (ASM, MSM) to manage the stacked operating mode (SM1, SM2, SM3). Device according to one of claims 1 to 8, configured to transmit or receive data in a determined frequency band, and comprising for this purpose a radio frequency antenna comprising a combination of a closed slot antenna (40, 50) and a parasitic antenna with an open slot (70, 102), the two antennas being adjusted so that:
- when the device is in the open air, the parasitic antenna with an open slot has a tuning frequency located in the determined frequency band while the closed slot antenna has a tuning frequency located outside the determined frequency band, and
- when the device is stacked with a similar device (HW3-1, HW3-2), the closed slot antenna has a tuning frequency located in the determined frequency band while the open slot parasitic antenna has a tuning frequency located outside the determined frequency band. Device according to claim 9, in which:
- the closed slot antenna comprises a through longitudinal orifice (40) made in a side wall (102) of the chassis (10), the longitudinal orifice (40) comprising two longitudinal surfaces (41, 42) facing each other, and means (50) for applying a ground potential to the first surface (41) of the longitudinal orifice (40) and applying a radio frequency signal (RFS) to the second surface (42) of the longitudinal orifice, and
- the open slot parasitic antenna comprises an electrically conductive arm (70) arranged parallel to the side wall (102) of the chassis (10) and close to the longitudinal orifice (40), the electrically conductive arm (70) having a free end (701) and an end (702) electrically connected to the side wall (102). Device according to one of claims 9 and 10, in which the determined frequency band is the Bluetooth band or a Wifi band.