WO2002041235A2

WO2002041235A2 - Method for verifying before activating a programme loaded in a smart card

Info

Publication number: WO2002041235A2
Application number: PCT/FR2001/003564
Authority: WO
Inventors: Pierre Girard; Jean-Luc Giraud
Original assignee: Gemplus
Priority date: 2000-11-14
Filing date: 2001-11-14
Publication date: 2002-05-23
Also published as: FR2816729B1; AU2002223068A1; WO2002041235A3; FR2816729A1

Abstract

The invention concerns a method for loading a programme in an electronic component storage, said method comprising: a first phase which consists in loading in a first storage of the component by a first entity at least a predefined characteristic value of a programme authorised for use by the component, a second loading phase (22) which consists in loading by a second entity a programme in a second storage of the component, said second entity not being capable of loading in the first storage; a phase which consists in verifying (23) the loaded programme, consisting in determining a value characteristic of the loaded programme, and comparing said characteristic value to the predefined characteristic values loaded in the first storage; and a phase which consists in activating (25) the loaded programme, if the determined characteristic value of the programme corresponds to one of the characteristic values loaded in the first storage.

Description

VERIFICATION PROCESS BEFORE ACT ATION OF A PROGRAM LOADED IN A CHIP CARD.

The present invention relates to a method for verifying a program loaded in a smart card, before its activation.

It applies in particular, but not exclusively to portable electronic devices such as electronic microcircuit cards, called smart cards. It more generally applies to any independent on-board device, equipped with a processing unit or microprocessor, associated with program and data memories, and a communication module with or without contact to be connected with an electronic device. reading and / or writing. The program and data memories generally comprise a read-only or non-rewritable memory, but programmable only once at the time of its manufacture, for example of the ROM (Read Only Memory) type, and a volatile memory which is accessible for writing and reading, for example of the RAM (Random Access Memory) type, used for storing temporary data during the execution of a program. The most advanced chips also include a non-volatile memory, accessible in both reading and writing, for example of EEPROM (Electrically Erasable Programmable Read Only Memory) or FLASH type.

Until now, most of the information to be stored in a smart card has been the program of the card itself. To save memory space, the program was stored in a ROM memory which has the advantage of occupying less surface than a programmable non-volatile memory, normally used to store variable data like the balance of a wallet electronic. However, the ROM memory has the disadvantage of having to be loaded at the time of its manufacture, its content being defined by a mask. It is therefore necessary to provide a mask by program, the production of such a mask being carried out by the manufacturer of the chip and being long and costly. In addition, if a programming error is discovered, a new mask must be made.

Recently, a new technology, known as Flash, has appeared, combining the advantages of ROM memory in terms of surface area, and EEPROM with regard to programming possibilities. This technology allows new architecture in which the chip includes a low capacity ROM memory in which is loaded a small loading program called "bootloader" of the programmable non-volatile memory, following such loading the loading program activates the loaded program which is generally written in machine language, that is to say the command language of the chip's microprocessor. In this way, the contents of the ROM memory are made generic by allowing the loading of a large number of application programs. This possibility is very interesting for the programmer, because it allows him to test his programs directly on the card without the need to start manufacturing a new ROM memory mask. It also makes it possible to reduce the time taken to design and develop a new application.

This solution also offers the possibility of operating the chip using several operating systems, and adapting it according to customer needs. It is also conceivable to deliver cards whose programmable memory is empty, the client himself loading an operating system and testing the card. However, if the ROM loader can load any program, this poses security concerns. Indeed, if a malicious person obtains such a card, he can freely load a program giving him access to all the resources of the card, which allows him to very finely study the behavior of the chip, and therefore easily develop attack strategies on other cards of the same type.

There is also the principle of the virtual machine according to which the operating system of the card accepts only commands or programs which are written in a language different from the command language of the microprocessor. If the operating system command language does not give access to all of the card's resources, the card is less vulnerable. However, the operating system and the virtual machine must be loaded beforehand. If they are loaded into the non-erasable memory, there are the problems of development and of manufacturing times and costs mentioned above. If they are loaded into non-volatile memory, as they are written in machine language, they can therefore be replaced by other programs allowing to analyze the functioning of the chip. Consequently, the latter solution makes the chip vulnerable. In this context, the invention relates to a method allowing the loading program stored in the ROM memory to ensure that it loads an authorized program.

To this end, it proposes a method for loading a program into a memory of an electronic component comprising a processing unit.

According to the invention, this process is characterized in that it comprises:

a first loading phase comprising the loading into a first memory of the component by a first entity of at least one predefined characteristic value of a program authorized to be used by the component,

a second loading phase comprising the loading by a second entity of a program into a second memory of the component, said second entity not being able to perform loading into the first memory,

a verification phase by the processing unit of the loaded program, comprising the determination of a characteristic value of the loaded program, and the comparison of this characteristic value with the predefined characteristic values loaded in the first memory, and

an activation phase by the processing unit of the loaded program, comprising activating the loaded program only if the characteristic value of the determined program corresponds to one of the predefined characteristic values loaded in the first memory.

Thanks to these provisions, only the programs previously checked and referenced in the first memory of the chip, which can be a non-erasable memory, can be loaded in the second memory and activated. It is therefore not possible to load a program allowing to study precisely the functioning of the chip.

Advantageously, the verification phase is carried out following the reception by the processing unit of an end of loading command associated with an authentication signature, and of the verification that this signature is acceptable.

The characteristic value can be a program identifier or a condensed value of the program, obtained by applying to the program a function of "hash" or a MAC (Message Authentication Code) function.

According to a feature of the invention, the first loading phase comprises the. loading into the first memory of the component of a correspondence table associating for each program capable of being loaded into the second memory, a characteristic value of the program and a definition of addresses of memory areas where the program can be loaded, a command loading a program into the second memory of the component being executed only if it contains loading addresses corresponding to those appearing in the correspondence table in association with the characteristic value transmitted.

If the characteristic value of the loaded program is a condensed value of the program, the determination of the characteristic value of the loaded program can be carried out only on the memory areas defined in the correspondence table in association with the condensed value transmitted.

According to another feature of the invention, the correspondence table further comprises a respective reference of all the programs capable of being loaded into the second memory of the component, the method comprising the transmission to the component of the reference of the program to be loaded, reading the table to obtain the condensed value associated with the received program reference, and comparing the calculated condensed value with the condensed value read from the table to determine whether the program loaded in the second memory can be activated.

If the verification phase has failed, provision can be made to erase the program loaded in the second memory.

Alternatively, each program loaded into memory can be associated with an activation authorization indicator, making it possible to prohibit or authorize the subsequent activation of the corresponding program depending on whether the verification phase has failed or not.

The programs that can be loaded into the second memory include free areas whose addresses are predefined for receiving specific information. They can be modular programs, each module having a value characteristic stored in the first memory.

The first phase is advantageously carried out once and irreversibly.

It is also possible to provide a secure extension mode making it possible to add to a memory of the component a characteristic value of the program capable of being loaded into the second memory.

The invention also relates to an electronic component making it possible to implement the method described above.

An embodiment of the method according to the invention will be described below, by way of nonlimiting example, with reference to the appended drawings in which:

FIG. 1 schematically represents the electronic component of a smart card;

FIG. 2 shows the organization of the non-volatile memory of the component at the end of the loading phase of the non-confidential information;

Figure 3 shows in the form of a flowchart the sequence of the different stages of the method according to the invention.

FIG. 1 shows an electronic component 1 designed to be integrated into a so-called smart card. This component generally comprises a processing unit 2 or microprocessor, connected by a communication bus 3 to memories 4, 5, 6, and to a link 7 to a reading and possibly writing terminal. This link is made up either of contact pads in the case of a smart card with contacts, or by an antenna in the case of a smart card without contact. These memories include a non-rewritable and non-erasable memory 4, for example of the ROM type, a non-volatile memory 5 accessible for writing and reading, for example of the EEPROM or FLASH type, and a volatile memory 6 or RAM.

In accordance with the method according to the invention 20 illustrated in FIG. 3, an initialization treatment 21 is first applied to the electronic component made at the time of its manufacture. This processing consists in writing in the memory 4 a program allowing the loading of the non-volatile memory 5, as well as a table comprising for each program capable of being loaded in the memory 5, a value characteristic of the program or of the 5 addresses of loading it into the memory 5. This characteristic value can be an identifier of the program or a condensed value of the latter or of the loading addresses. This condensed value can be obtained by a CRC calculation (Cyclic Redundancy Check), or even by a "hash" algorithm, for example the SHA-1 function (Secure Hash Algorithm - 10 1), allowing to obtain a sequence binary, for example 160 bits, representing in condensed form the program code. Such a function is designed so that a slight modification of content results in a significant modification of the binary sequence thus calculated.

The table preferably also includes the definition of the addresses of the memory area where the program is to be loaded into memory 5.

This table can also include a reference of each program capable of being loaded into memory 5, in association with the characteristic value of the program.

During this phase, provision can also be made to load into the memory 4 confidential information, such as a serial number and a secret key which can be determined as a function of the serial number. 25

The loading program stored in the memory 4 is designed so as to be activated as soon as the component 1 is powered up and to wait for the loading of an application program or an operating system.

During the next phase of the method according to the invention, the component 1 is connected to a programming terminal via the link 7, the terminal transmitting to the component one or more commands for writing an application program (step 22). Each command contains a write address and the program or part of the program to be loaded at the address

35. indicated, and possibly the size of the information to be loaded contained in the loading command.

The program thus transmitted is loaded into memory 5. At the end of this loading which can be indicated by the terminal by sending an end of loading command, the microprocessor 2 goes to a verification phase 23. The end of loading command can be associated with a signature, for example a code MAC, used to authenticate the entity that has just loaded. If the signature is not valid, the loaded program cannot be validated and activated.

During the verification phase of the loaded program, the microprocessor 2 determines the characteristic value of the program thus loaded in the memory 5. Then, the microprocessor 2 compares 24 the characteristic value thus obtained with the reference values which were previously loaded in the memory not erasable 4. If the calculated value does not correspond to one of the values memorized in memory 4, the loading of the program is considered to have failed and the loading program starts _. waiting for a new load command, after possibly sending an error message to the programming terminal. Otherwise, the loading phase of the application program is validated and it can be activated 25.

At the end of the loading of the application program, the content of the memory can for example be as shown in FIG. 2. In this figure, the loaded program is an operating system occupying two zones 13, 14, in the memory 5 , the other zones 12 of the memory (between zones 13 and 14 and after zone 14) remaining free and allowing the user to include his own data or programs.

The loaded application program can also include free areas 11 provided for receiving confidential information during a confidential personalization step. In this case, the application program when activated in step 25 waits for commands to load this confidential information.

On receipt of such a command, the memory loading program 4 checks in the correspondence table that the transmitted writing address is part of the memory area where the program having the transmitted reference must be loaded.

Each characteristic program value that can be loaded into the memory 5 can advantageously be stored in memory 4 in a correspondence table where it is associated with address values of memory zones where the program must be loaded. . .

It is thus possible to provide for a program loading to be carried out by the processing unit 2 only if the addresses transmitted in the program loading command correspond to those which are stored in the memory 4 in association with the characteristic value. from the program.

It can also be provided that the characteristic value calculation carried out by the loading program relates only to the memory areas defined in the correspondence table in association with the characteristic value of the loaded program.

The memory 4 can also store a program reference in association with each characteristic program value which can be loaded into the memory 5. In this case, the loading commands include this reference, and the loading program searches in the memory 4 , the reference transmitted in the load command received, and compares the characteristic value calculated with that which is stored in memory 4 in association with the reference transmitted.

The process which has just been described can be carried out so that it can be applied to the loading of several application programs or operating systems. In this case, the areas of the memory 5 where the programs to be stored must be loaded simultaneously are of course separate. Thus, provision can be made to verify the loading (step 23) when all the loading commands have been executed, by performing a characteristic value calculation on each memory area associated in the correspondence table with a received program reference.

In addition, when the component is powered up, provision must be made for selecting the application program to be activated.

Likewise, the method which has just been described can also be applied to an application program or modular operating system. In this case, each module of the application program is associated with a program reference which appears in the correspondence table in association with a loading address and a characteristic value of the module. Of course, such modular program must be designed to execute a command only if it belongs to a module previously loaded. Provision can therefore be made to execute an initialization procedure during which the microprocessor 2 detects the modules loaded to validate the corresponding commands.

It should be noted that the method according to the invention is perfectly suited for loading operating systems carrying out what is called a virtual machine, that is to say capable of executing programs written in a specific language. different from the microprocessor control language 2.

A means can be provided to prohibit the execution of an invalidated program. This means can consist in erasing the memory zone which was loaded with the received invalid program. It can also consist of an indicator table, at the rate of one indicator per loaded program, the activation of a program being carried out only if the corresponding indicator authorizes this activation.

In the case where the loading addresses of each authorized program are not imposed, a new program loading can be authorized in a memory zone in which a program has already been validated. In this case, a procedure must be provided which can be activated systematically at each load, making it possible to prohibit the subsequent use of the previously loaded program which is overwritten by the new load. To this end, it is possible to provide a validation table in which is included the definition of the addresses of the memory area where each program is loaded, in association with a validation indicator representing the validated state or not of the corresponding program. If the processing unit receives a loading command in a memory area which is referenced in the validation table as having been previously validated, it executes the loading command having previously changed the state of the corresponding validation indicator .

It is also possible to provide a secure extension mode making it possible to add a condensed program value capable of being loaded into the memory 5. Such an extension can for example be carried out using a command provided for this purpose, this command being associated with a MAC code applied to the command allowing the microprocessor 2 to authenticate the entity which issued such a command. In this way, the set of characteristic values programs capable of being loaded into the memory of the component can all be stored in a non-volatile and erasable memory of the component.

Claims

1. Method for loading a program into a memory of an electronic component (1) comprising a processing unit (2), characterized in that it comprises:

- a first loading phase comprising loading into a first memory (4) of the component (1) by a first entity of at least one predefined characteristic value of a program authorized to be used by the component, - a second phase of loading (22) comprising the loading by a second entity of a program into a second memory (5) of the component (1), said second entity not being capable of performing loading into the first memory (4),

a verification phase (23) by the processing unit of the loaded program, comprising the determination of a characteristic value of the loaded program, and the comparison of this characteristic value with the predefined characteristic values loaded in the first memory, and

an activation phase (25) by the processing unit of the loaded program, comprising activating the loaded program only if the characteristic value of the determined program corresponds to one of the values. predefined characteristics, loaded into the first memory.

2. Method according to claim 1, characterized in that the verification phase is carried out following the reception by the processing unit (2) of an end of loading command.

3. Method according to claim 2, characterized in that the end of loading command is associated with an authentication signature which is verified, the verification phase being carried out only if this signature is acceptable.

4. Method according to claim 1 or 3, characterized in that the characteristic value is a program identifier.

5. Method according to claim 1 or 3, characterized in that the characteristic value is a condensed value of the program.

._

6. Method according to claim 1 or 3, characterized in that the characteristic value is a condensed value of the program obtained by applying to the program a "hash" function.

7. Method according to claim 1 or 3, characterized in that the characteristic value is a condensed value of the program obtained by applying to the program a MAC function.

8. Method according to one of claims 1 to 7, characterized in that the first loading phase comprises loading into the first memory (4) the component of a correspondence table associating for each program capable of being loaded in the second memory (5), a characteristic value of the program and information defining memory areas where the program can be loaded, a command for loading a program into the second memory (5) of the component being executed only if it contains loading addresses corresponding to those appearing in the correspondence table in association with the transmitted characteristic value.

9. Method according to claim 8, characterized in that the characteristic value is a condensed value of the program, and in that the determination of the characteristic value of the loaded program is carried out only on the memory areas defined in the correspondence table in association with the condensed value transmitted.

10. Method according to claim 8 or 9, characterized in that it further comprises the transmission to the component of a reference of the program to be loaded, the reading of the correspondence table in which each condensed program value is associated with a respective program reference, to obtain the condensed value associated with the received program reference, and comparing the calculated condensed value with the condensed value read from the table to determine whether the program loaded in the second memory can be activated.

11. Method according to one of claims 1 to 10, characterized in that if the verification phase has failed, the program loaded in the second memory is erased.

12. Method according to one of claims 1 to 10, characterized in that each program loaded in memory is associated with an activation authorization indicator, making it possible to prohibit or authorize the use of the corresponding program according to whether the verification phase has failed or not.

13. Method according to one of claims 1 to 12, characterized in that before each loading of a memory area the invalidation of said memory area to make its content unusable, so as to prohibit the subsequent use d 'A program previously loaded in said memory area which is modified by a new loading.

14. Method according to one of claims 1 to 13, characterized in that the programs capable of being loaded into the second memory, ^' include free areas whose addresses are predefined to receive punctual information.

15. Method according to one of claims 1 to 14, characterized in that the programs capable of being loaded into the second memory, are modular programs, each module having a characteristic value stored in the first memory.

16. Method according to one of claims 1 to 15, characterized in that the first phase is carried out only once and irreversibly.

17. Method according to one of claims 1 to 15, characterized in that it comprises a secure extension mode making it possible to add in the first memory a characteristic value of the program capable of being loaded in the second memory.

18. Electronic component (1) comprising a processing unit

(2), characterized in that it comprises at least a first memory (4) accessible only by a first entity and in which is stored at least one characteristic value of a program capable of being loaded in a second memory (5 ), the processing unit (2) comprising means for receiving a command to load a program and loading this program into the second memory, means for determining a characteristic value of the program loaded in the second memory, means for comparing the determined characteristic value with the characteristic values stored in the first memory , and means for activating the program loaded in the second memory if the determined characteristic value corresponds to a characteristic value stored in the first memory.

19. Electronic component according to claim 18, characterized in that the first memory (4) is a non-erasable memory, and the second memory (5) is a non-volatile and erasable memory.

20. Electronic component according to claim 18, characterized in that the first memory (4) is an erasable memory, protected so as to be accessible in writing only by an authorized entity.

21. Microcircuit card, characterized in that it comprises an electronic component according to one of claims 18 to 20.