WO1996024912A1

WO1996024912A1 - Health card

Info

Publication number: WO1996024912A1
Application number: PCT/FR1996/000193
Authority: WO
Inventors: Claude Gaudeau; Jean-Marc Robin; Gabriel Vuillemin
Original assignee: Claude Gaudeau; Robin Jean Marc; Gabriel Vuillemin
Priority date: 1995-02-07
Filing date: 1996-02-06
Publication date: 1996-08-15
Also published as: AU4722496A; FR2730331A1

Abstract

A method and a device for protecting confidential data banks stored in smart cards (2) such as WORM cards. The data is first accessed by mutual recognition of a single encrypted code stored in the security chip (1) linked to the smart card as well as in the security chip of a card reader module (4). Whenever necessary, reinforced protection of the text on the card is achieved by means of an encryption circuit combining the methods of transposition and substitution with a secret key associated with the smart card. The method and device are useful in the field of health care.

Description

HEALTH CARD

The present invention relates to a health card resulting from the combination of a "chip" and a cane provided with a large capacity memory, an optical card for example.

It is desirable that anyone can carry a health card with precise and complete information concerning their medical history, the treatments they must undergo, as well as their previous treatments.

It is of the greatest interest that an attending physician can find the radiographs or photocopies of the images obtained during the life of the card holder. In addition, it is absolutely essential that this cane remains confidential and that it enters a personal entry code.

To allow the insertion of information such as x-rays and scanner images, the reading cane must be able to have a very large memory, more than 2 MB of data, the equivalent of a thousand pages of text.

In a known embodiment, we therefore chose a WORM type (Write Only Read Memory) with digital optical memory such as, for example, a standard size optical cane.

To ensure the secrecy of the content of the health cane of this realization, we physically associate with this cane a "chip" offering a memory of 2 kb to 4 ko on which we write a secret reading code To allow to read the content of the cane, this one and its "chip" must be received by a special reading module belonging to the doctor. You must first verify that this reading module is authorized to read the contents of the card. There are many, more or less sophisticated, ways of carrying out this recognition.

The simplest of them is to provide the reading module with a keyboard, a comparator and a security chip.

To access the content of the cane, the holder of the reading module must enter, on his keyboard, the secret code which is written on the right side of the comparator, while the contact of the "chip" with the reading module brings up the secret code on the left of the comparator. If the inscription on both sides of the comparator is exactly the same, the comparator emits no current and thus authorizes the reading of the data appearing on the optical cane.

It should be noted that the repeated plain writing of the secret code by means of the keyboard makes this code accessible to the public and therefore it can be "hacked" at any time. In addition, the duck can be lost or stolen; if it then falls into the hands of an expert in the matter, the latter may manage to reconstitute the identification code.

We see that the method described above is absolutely insufficient to ensure the secrecy of the contents of the optical card. In conclusion, in the process described above, the main defect lies in the obligation to have the secret code appear in plain text each time the cane is used.

A first improvement with a view to keeping the secret will consist in not making the secret code appear openly at the time of recognition.

To this end, an encryption system and an identification protocol are used in the exchange of information between the optical cane "chip" and the doctor's reading module, during which the secret recognition code does not appears only as the component of an auxiliary random variable.

The "chip" is then equipped with a random generator, an arithmetic calculation cell, a shift register provided with specific internal wiring. As it is a health card, the card and the chip are held by the patient, while the reading module is in the hands of the doctor. The reading module is coupled with a "chip" provided with the same elements as the "chip" associated with the optical rod. It goes without saying that the various systems intended to read secure canes must first be initialized with the different secret codes. The wiring of the calculation cell of the optical cane securing "chip" performs an encryption function of the type: E (P) = C.

The receiver, the optical channel reading module in this case, has an encryption function. D (C) = P

The encryption functions generally used are of the form: g E (c) = c mod N g where E (c) is the smallest remainder of the division of c by the number N. To ensure a more certain secret, the values of c and N are at least 512 bits in size.

In the present case, it was considered sufficient to take e = 2 so that:

E (c) = c ² mod N '

Among the possible identification protocols implementing such a variable, we choose the Weyner algorithm whenever necessary. When the security "chip" associated with the optical rod is inserted into the reading module, an electrical contact between the "chip" and the "module" ensures the supply of the chip. The process of identifying the doctor without transmitting the secret code according to the Wayner algorithm (variant of the simplified Fact-Shamir algorithm) can then begin.

This process comprises at least 9 successive operations, some performed by the "chip" for securing the optical tube, the others by the reading module of the doctor and by his own "chip". As soon as the electric current is established, the random generator of the "cane" of the health cane generates two random variables c and g. These two variables are linked by an encryption function wired into the chip:

g = od c

where w is the doctor's secret code. A priori, between two variables c and g, the probability that w is known is zero if the 2 numbers c and g have very high values and are prime between them.

The doctor's reading module then generates a random variable "u" such that the value of "u" is chosen from prime numbers with the value of c. There is then a certain probability that this value is the value w or at least that it approaches it.

But this probability is low. We will therefore repeat the operation until the probability reaches an acceptable predetermined value.

If security has now reached the required threshold, the operation is completed and consideration may be given to proceeding with the operations. If, on the contrary, the safety threshold and the required probability are not reached, the process will start again until the probability has reached the desired value.

In conclusion, we have just seen that this recognition protocol does not reveal the secret code w at all. It allows the holder of the optical card (the patient) to discreetly ensure that the doctor, who has the reading mode, is authorized to treat him. But this operation did not allow the doctor to ensure that the card presented by the patient is his own card. However, this verification is not always necessary: when the patient sees his doctor for the first time, he does not yet have a reading card and the doctor will participate in the creation of it.

Similarly, when ^'the patient will return consult their doctor, it will be recognized by the medical doctor and usually it does not need to ensure that the presented card reading is that of the patient. However, when this patient is received in the usual office by a different doctor, it will be necessary for the doctor to make sure that the consultant is indeed the usual client. This problem will be solved very simply by associating its administrative file in memory with the security "chip". This file will include an identity photograph of the patient. Each time the patient is asked to identify the patient, the patient's administrative file will be sent to the doctor, who will be able to recognize his client by displaying this identity photograph on his screen.

Nevertheless, it is essential that the text of the health cane, revealing all the care previously received by the patient, remain absolutely confidential. So the real problem is to allow the contents of the health card to be read exclusively by the doctor. It will be the same when the card, ceasing to be a health card relates to a set of secret information of a military or financial nature.

Secure transmission of the encryption key

The confidential information contained in the cane is then encrypted by means of a block encryption algorithm used in chained mode to avoid the repetition phenomenon of the cryptogram. The text of the optical channel is encrypted in the following way: the cryptographic encryption algorithm implemented, combines the conventional cryptographic transposition and substitution methods: the text of the optical channel is then cut into 64-bit slices (8 bytes) plain text and subject to

16 iterations of a main coding function to produce 64 bits of coded text. The encryption algorithm chosen is the R.S.A. algorithm (named after its inventors, Rivest, Shamir and Adelman). Either be accredited to the Authorities

Superior. It includes 3 elements (n, e, d) where "n" is the module of the system, "e" is the public exponent, and "d" is the private exponent.

The public key is "n e" and "d" is the secret key, "n" is the product of 2 prime numbers p and q. n = p. q "e" and (p - 1) (q - 1) are prime to each other.

According to Euclid's algorithm: e. d = 1 mod [(p - 1) (q - 1)]

So the secret key:

d = e ^'1 mod [(p - 1) (q - 1)]

It is understood that the doctor has verified the accreditation of the patient's RSA system (n, e, d) and that the patient has checked the accreditation of the doctor's RSA system (n ', e', d '). The doctor transmits his RSA public key (n ', e') to the patient. The patient generates an AL masking hazard (512 bits for example). We then obtain a bit string:

X = (AL) // (KL)

where AL denotes the concatenation of the bit strings and where KL denotes the encryption key.

D calculates

Y = X ^e (modulo n ')

D transmits the value Y to the doctor.

The doctor decrypts Y and calculates:

X = Y ^d (modulo n ')

Now in possession of X, he deduces KL from it. π can now decrypt the card.

In fact, the security of coding relies exclusively on a 56-bit personal encryption key held by the patient's card chip. So that this key is unique and it must ensure both the secret of coding and decoding. So that anyone not holding this key would be unable to read even partially the contents of the card. This key is transmitted as explained in the preceding paragraph. It therefore appears that the patient's card sends the doctor his secret key KL in a masked form. However, it is desirable in certain cases to be able to modify the key quite frequently. The doctor's module is then able to read the content of the patient's optical card clearly.

In conclusion, we can consider that the exchange of information between the patient's card and the reading module, which was carried out under completely satisfactory conditions of secrecy. The invention will be better understood by referring to the attached figures in which:

FIG. 1 is a diagram of all of the elements which cooperate,

- Figures 2A and 2B are diagrams describing the progress of the Wayner algorithm.

In FIG. 1, on the left, there is shown in (1) the "chip" for identifying the optical card. In (2), the optical rod with a memory of 2 to 4 M.bytes.

On the right of the figure in (3), there is shown the "chip" carried by the doctor's module.

In (4), the module of the doctor proper was shown, while the active part of the reading module is shown in the middle of the figure. When the optical rod with its "chip" is pressed into the slot of the reading module, the latter supplies electric current to the rod (2) and its "chip" (1) by an electromagnetic coupling (5). The "chip" (1) supplied with current, transmits its information via a light-emitting diode (6). This information picked up by a photoelectric cell (7) transmits the information to the "chip" (3) of the doctor's reading module by the diode (8).

It is thus by this way that the recognition procedure is carried out, that is to say the identification of the doctor based on the secret coded key w.

These operations result in the transmission to the doctor of the personal secret key of the encryption of the optical rod.

It is therefore the logic block (9) and the timer (10) which will allow the module (4) to read the content of the optical rod (2) through the optical couplings (11) and (12 ).

FIG. 2 represents a diagram of the Wayner algorithm which will allow us to carry out mutual recognition of the same stored code, of a section in the

security "chip" on the reading card and on the other hand in the "chip" of the doctor's module or in any other system for accessing the data on the reading card. It is obvious that if the code stored in the "chip" of the reading card is different from the code stored in the module, recognition will not take place. Let w be the secret code of the doctor, the "chip" of the reading cane generates two pseudo-random variables c and g;

2 such that these two variables are united by the relation g = w mod c.

Consequently, the operations of the algorithm will follow one another:

2.1 - The "chip" transmits these two numbers c and g to the reading module. 2.2 - The reading module

The module randomly chooses a value "u" taken from the set of prime numbers with "c" and calculates a random function:

z = = u mod e

and passes this value "z" to the "chip". 2.3 - The "chip" of the card

A random generator is associated with the "chip" of the optical rod.

If the random generator delivers a zero, this zero will be transmitted to the reading module.

2.4 - The reading module In response to zero, the reading module transmits the value of "u" which it used in the previous calculation to the patient's cane.

2.5 - The "chip" of the card It calculates:

z = u ^" mod c

It thus verifies that the reading module has indeed carried out the coding operation:

z = u mod c

and it confirms that "u" is the caned root of "z".

He deduces from this that there is already a certain probability that the reader module is the only one authorized to read the card, which reduces the probability of disagreement accordingly. And it returns to the generator so that it delivers a zero or a 1. 2.6 - If the generator delivers a 1

The chip transmits the 1 to the reading module.

2.7 - The card reader module will then use the secret code "w" in a product. v = uw mod c

The only element that appears is therefore "v", that is to say the smallest remainder of the division of the product "uw" by c.

From the single value "v"; it is not possible to deduce the expression from "w" (256 bytes or more).

2.8 - The "chip" of the card must verify by certain operations, that the reading module has used the expression of the secret code "w".

It calculates the value of: zc mod c

2 Given that g = w mod c

2 and that z = u mod c and that z. g = (uw) mod c we deduce v = uw mod c and v ^" = z _x g Taking into account the previous result, we deduce that there is a certain probability that the secret key used is really the right one; if we consider that the probability is still insufficient, we will start a new sequence of operations.

The use of the card in accordance with the present application is as simple as the use of the simplified cards described at the beginning of this text. When the card is inserted into the reading module, the known secret code is recognized automatically; the same is true for determining a pointer number for the cane. At this stage, the cane will transmit the 56-bit confidential secret code to the module and therefore the module can read the contents of the card.

Claims

Claims:

1.- Method for directly exchanging information between a reading module and a card provided with a very large capacity memory, this information being encrypted by means of a coding algorithm, characterized in that after identification mutual operated without changing the secret code between the card and the reading module and after checking the identity of their respective encrypted codes, the card secretly transmits to the reading module its personal coding and decoding key so that the module can now read in clear the data stored in the card and possibly write in coded form new information with the same coding key.

2.- Method according to claim 1 ensuring recognition of the reading module by the cane having a large capacity memory thanks to a secret key stored in a "chip" linked to the card and in a "chip" linked to the reading module , characterized in that the recognition is carried out without transmission of said secret key.

3.- Device for implementing the method according to one of claims 1 and 2, wherein the card offering a large capacity memory and the reading module are provided with a "chip", characterized in that the chip the card includes a random generator, an arithmetic calculation element, a comparison element and an element causing the start of a sequence of recognition operations carried out without making this common key public.

4.- Device according to claim 3, characterized in that the card with a very large capacity memory is provided with a "chip" provided with a memory of the order of 4 k.bytes, containing the key 56-bit personal code locking said main code and in that a second "chip" coupled to the reading module contains the main decoding algorithm combining substitution and transposition methods.

5. Health card for implementing the method according to one of claims 1 or 2, characterized in that in a simplified protocol, the reading module is authorized to read the content of the health card at the end of the stage. identification of the doctor and the patient.

6.- Device according to claim 3, wherein the card and its reading module are both provided with a "chip" provided with elements allowing their mutual identification without transmission of secret codes and also both have the same encrypted code confidential, the 56-bit personal secret encryption key being on the chip of the information card and that said personal secret key is changeable.

7.- Method according to claim 1, characterized in that the information contained in the card is encrypted by means of a block encryption algorithm used in chained mode.

8.- Device for the implementation of claim 7, characterized in that the large capacity card is equipped with an R.S.A. system accredited to the Higher Authority.