WO2004063999A1

WO2004063999A1 - Method for the secure personalisation of an object

Info

Publication number: WO2004063999A1
Application number: PCT/FR2003/003563
Authority: WO
Inventors: Gilles Dumortier
Original assignee: Oberthur Card Systems Sa
Priority date: 2002-12-09
Filing date: 2003-12-02
Publication date: 2004-07-29
Also published as: AU2003298394A1; FR2848364A1; FR2848364B1

Abstract

The invention relates to a method for the secure personalisation of an object consisting of a first secure assembly (E1) comprising a first memory unit and a first microcircuit. The inventive method involves the use of n-1 secure assemblies (E2, E3) in addition to the first secure assembly (E1), n being an integer strictly greater than 2, each of the n-1 secure assemblies (E2, E3) comprising a memory unit and a microcircuit, and forming with the object an authorised n-tuple which is known by at least one of the secure assemblies. The method comprises a plurality of authentication steps between the secure assemblies, which are taken in pairs, prior to a personalisation step consisting in writing personal object-specific data in or on said object. The invention can be used for government securities, official documents, tickets or travel documents.

Description

METHOD FOR SECURE PERSONALIZATION OF AN OBJECT

The present invention relates to a method of secure personalization of an object. More generally, the present invention relates to a method of secure communication between a plurality of secure assemblies.

In its application example more particularly described here, the invention proposes a method for securely personalizing an object comprising a secure assembly consisting of a storage unit and a microcircuit adapted to communicate with the outside by using a contactless technology. Personalization means the writing, in or on the object, by mechanical, electronic, optical, chemical or any other technique, of personal data specific to this object.

Currently, when personalizing an object, authentications can be carried out sequentially between a first entity and a second entity participating in the personalization process, which conditions the blocking of the personalization process if the result of this first authentication is negative, or the triggering of a second authentication between the second entity and a third entity also participating in the personalization process, and so on. Typically, the second entity is a hardware security module or

HSM (in English "Hardware Security Module"), such as an IBM 4758 PCI card, and the third entity is a microcircuit card associated with an operator.

However, during these sequential authentications, we do not verify that we are indeed in the presence of an authorized triplet formed by the three entities. For example, it is not checked whether the operator associated with the third entity is authorized to carry out the personalization of the first entity. We only check that the operator is authorized to carry out a personalization operation on any object or a particular type of object, but not on a specific object or batch of objects. In addition, these authentications do not generally take into account more than two entities in an authentication procedure in addition to the object to be personalized.

Furthermore, a center for personalizing objects as envisaged here is a place with reduced security compared to a center for personalization of a usual card manufacturer (for example, bank cards). There are more operators, more geographically dispersed and less controlled. Indeed, the objects to be personalized are for example (but not only) official documents or travel documents. Very often, the personalization of these documents, when they are in electronic form, is done in a decentralized way and therefore, not necessarily in a center of a usual card manufacturer, very secure, but rather, for example, in town halls or prefectures, which do not have the same security infrastructures (for example, access control). The increased risk of fraud linked in particular to this reduction in security has drawbacks.

The present invention aims to remedy these drawbacks. To this end, the invention provides a method of secure personalization of an object comprising a first secure set consisting of a first storage unit and a first microcircuit, remarkable in that it implements n-1 sets secure in addition to the first secure set, n being an integer strictly greater than 2, each of said secure sets being made up of a storage unit and a microcircuit, and forming with the object an authorized n-tupl, known from at least one of the secure sets, and in that the method comprises a plurality of authentication steps between the secure sets taken two by two, prior to a personalization step consisting of writing, in or on the object, data specific to this object.

These authentication steps between the various secure assemblies give a secure character to the process of personalizing the object, which makes it possible to decentralize the various operations to be carried out on the object in order to personalize it. This improves the security of the personalization process, which allows personalization to be carried out in a less secure environment. The invention thus offers the advantages of a low-cost process due to a lower investment in the security of the environment in which the personalization is carried out. This process can be adapted to any scheme classic key management type Kerberos or PKI (public key infrastructure, in English "Public Key Infrastructures").

Advantageously, in order to reduce the risk of fraud, provision is made for the object to verify that the other secure assemblies are indeed authorized to participate in its personalization. To this end, the object to be personalized authenticates the n-1 secure sets.

Advantageously, at the end of the object personalization step, the first storage unit keeps a trace making it possible to identify at least one of the secure sets having participated in the personalization process among the n-1 secure sets.

Thus, the invention guarantees the traceability, in the personalized object, of the people or materials involved throughout the process of personalizing the object. These traces can even appear visibly on the object itself. In addition, this traceability can be secured by adding an authentication code to the trace, typically a certificate known to those skilled in the art.

In a particular embodiment, the n-1 secure sets are taken from:

a secure assembly representing a batch of objects to be personalized, a secure assembly comprising a secure electronic entity associated with a machine adapted to personalize the objects of this batch, and

- a secure assembly attached to an operator authorized to use this machine.

This makes it possible to securely personalize any object forming part of a batch, such as an identity card taken from an initial batch of cards to be personalized, the personalization being carried out by means of an authorized machine identified by a secure module. associated machine, and where the machine is handled by an authorized operator identified for example by an operator microcircuit card in his possession, which uniquely identifies it. This increases safety, since operators who are authorized to work on a machine are established in advance, as well as the machines on which the batch will be processed, etc., i.e. determines in advance the participants in the personalization process. In addition, this provides great adaptability to the system, which can be distributed and can be extended very easily by increasing the number of batch secure sets and operator secure sets.

Advantageously, the first secure assembly is adapted to communicate with the outside using contactless technology. This technology is particularly suitable for travel documents and official documents, which are more and more numerous, in their electronic version, to implement this technology for practical reasons. One can for example keep the original format of a passport and insert into the passport paper a microcircuit using contactless communication technology.

Advantageously, the personalization method according to the invention includes a preliminary authentication step involving the n-1 secure sets mentioned above. This preliminary step can for example involve the batch, machine and operator secure assemblies.

This improves the yield of the process in terms of computation time and therefore speed of execution, by making it possible to avoid carrying out these authentications for each new object to be personalized.

Advantageously, the preliminary authentication step is carried out as follows:

- the operator secure set authenticates the batch secure set and the machine secure set,

- the machine secure assembly authenticates the operator secure assembly, and - the batch secure assembly authenticates the operator secure assembly.

Because the operator is on the same site as the machine, it is more convenient to have the secure batch assembly and the machine secure assembly authenticated by the operator secure set, rather than having the authentication of the secure machine set and the secure operator set by the secure batch set, for example, knowing that the secure batch set is generally personalized on a site separate from the site where the machines and their operators are located . In addition, the operator secure assembly is mobile by comparison with the machine secure assembly, which is advantageously inseparable from the latter (for example sealed to the body of the machine, and necessary for the operation thereof), which facilitates, from a logistical point of view, the initialization procedures of the secure operator assembly, when a new batch arrives, for example. Advantageously, at least one microcircuit among the microcircuits of the n-

1 secure set is suitable for communicating with the outside using contactless technology.

According to a particular characteristic, a logic processing unit ensures communication between at least two secure assemblies, when these are all simultaneously in its radiofrequency field.

Contactless technology allows simple, relatively inexpensive production and very practical operation. In practice, it is more convenient to place a microcircuit card on a reader than to insert it there. Advantageously, at least one of the secure sets, for example the secure batch set, is suitable for securely accessing a database or "back-office" containing the personal data mentioned above.

The secure batch set indeed contains batch-specific data, common to all the objects to be personalized. It may be convenient to store the decryption key of the personal data contained in the database in the secure batch set.

The batch security assembly and / or the machine security assembly may be a microcircuit card. The object can be a title issued by the State, such as an identity card, passport, visa or gray card (in English "vehicle registration papers"), or another document of an official nature, such than a notarial deed, or a transport ticket, such as a subscription card to use public transport, or a travel document, such as a driving license, or a toll ticket or other documentary evidence a right to transit, such as permits issued by Mexico City to motorists, for example, to enter the city. Thanks to the present invention, the personalization of these objects can be decentralized, for example carried out in town halls or prefectures, without the need to increase the security of these places.

For the same purpose as that indicated above, the present invention proposes, more generally, a secure communication method, remarkable in that it implements n secure sets, n being an integer at least equal to 2, each of the sets being made up of a storage unit and a microcircuit, and forming an authorized n-tuplet known from at least one of the secure sets, and in that the method comprises a plurality of authentication steps between the sets secure taken two by two.

According to a particular characteristic, at least one of the storage units keeps a trace making it possible to identify at least one of the n secure sets.

This trace can include an authentication code. Advantageously, at least one of the secure assemblies is suitable for communicating with the outside using contactless technology.

According to a particular characteristic, a logic processing unit ensures communication between at least two secure assemblies, when these are all simultaneously in its radiofrequency field. At least one of the secure assemblies can be a microcircuit card.

The communication method and its particular characteristics mentioned above have advantages similar to those of the personalization method. These advantages are therefore not repeated here.

Other aspects and advantages of the invention will appear on reading the following detailed description of a particular embodiment, given by way of nonlimiting examples. The description is made with reference to the accompanying drawings, in which: FIG. 1 is a block diagram of the various exchanges between the secure assemblies participating in the personalization process according to the present invention, in a particular embodiment; FIG. 2 schematically represents different entities involved in the personalization process according to the present invention, in a particular embodiment; and . - Figure 3 is a flowchart illustrating steps of the personalization process according to the present invention, in a particular embodiment.

In accordance with the present invention, in the particular example of application which we have chosen to describe in detail here, we seek to personalize securely an object such as a title issued by the State (identity card, passport, etc.), another document of an official nature (notarial deed for example), a transport ticket (subscription card to use public transport, for example) a travel document (of the type of "transit ticket" "for driving in Mexico City, mentioned in the introduction).

The foregoing examples are preferred applications of the invention, given without limitation. Thus, the invention can also be applied to a bank card, a SIM card or a memory card.

For this, the object comprises a first secure assembly E1 consisting of a first storage unit, such as a non-volatile memory, for example of the ROM or EEPROM type, and of a first microcircuit adapted to communicate with the outside. using contactless technology.

As shown in Figure 1, the method according to the present invention also involves a second secure assembly E2 consisting of a second storage unit and a second microcircuit, which is, in this example, in no way limiting, a card to batch microcircuit, representative of a batch of objects to be personalized. The personalization process also involves a third secure assembly E3 consisting of a third storage unit and a third microcircuit, which is, in this example, a machine secure module, inseparable from a machine adapted to personalize the objects of the batch defined by common data stored in the batch card of the secure assembly E2. The secure module can for example be sealed to the body of the personalization machine and include elements essential to its operation so that one cannot remove this module or put it out of service without hampering the use of the personalization machine. The secure machine module can for example contain self-test means, or even a user license. The machine secure module thus allows the machine to perform self-test operations, which are not the subject of the invention and will therefore not be described here.

In the particular embodiment of FIG. 1, the personalization method also involves a fourth secure assembly E4, consisting of a fourth storage unit and a fourth microcircuit, which is, in this example, a card operator microcircuit, attached to an operator authorized to use the machine specified by the machine secure module of the E3 secure assembly. In the example described here, the secure assemblies E1, E2, and E4 communicate with the outside (and in particular with one or more of the other secure assemblies) using contactless technology, for example of the type using inductive coupling.

A logic processing unit UTL 10 ensures communication between the secure assemblies E1, E2, and E4, when these are all simultaneously in its radiofrequency field, which is shown on the drawing by a dashed circle. The UTL is in fact provided with a contactless reader of structure known per se, used in an unconventional manner, in an environment with several microcircuits. The UTL 10 is used in an unconventional way in the sense that it is to make the various secure assemblies communicate with each other that they are placed simultaneously in the field of the UTL, unlike a conventional use, where, when several microcircuits are in the UTL field, we select only one to communicate with the UTL. The UTL 10 can be a simple conventional personal computer (PC). The machine secure module also communicates with the other secure assemblies via the UTL 10. For this, the secure module is connected to the UTL 10 by a conventional wired link. Typically, the UTL 10 is part of the personalization machine.

The UTL 10 and the four secure sets, represented in the form of three smart cards € 1, E2, E4 and a secure module E3, are also illustrated in FIG. 2, which shows that a database or " back-office "is connected to the UTL 10 of a personalization machine 20. The database contains the personal data to be written in or on the object to be personalize. These data are preferably stored in encrypted form for security reasons. One of the four secure assemblies, for example the batch microcircuit card, is suitable for securely accessing this database, for example by means of an authentication procedure of the card with the database and the creation of a session key.

Alternatively, instead of a contactless interface for the UTL, or in combination with the contactless interface, it is possible to use another type of interface, such as a USB bus. The secure machine module can also be removable relative to the body of the personalization machine. As a non-limiting example, the object to be personalized and the machine secure module can use contactless technology, and the batch card as well as the operator card can use USB keys inserted in the UTL. More generally, any communication interface allowing the selection of several cards, such as an interface conforming to the BlueTooth standard or even WiFi, can be used.

As shown in the flow diagram of FIG. 3, before the personalization process proper takes place, operations for personalizing the various cards called upon to intervene in the personalization of the object are carried out. These personalization operations are carried out in a secure location.

Thus, during a personalization step 30 of the machine secure module, the machine secure module is, prior to the implementation of the process for personalizing the object, which is itself personalized during the manufacture of the machine. The personalization of the secure machine module notably consists in storing therein a secret datum which is for example a master secret key MSK _m (in English "Master Secret Key") identical for a given set of machines. It can be, for example, all the machines of the same site, the same region or a particular type. The personalization of the machine secure module also consists in storing therein information specific to the machine with which it will be associated, such as its serial number, its type, or even its date of commissioning. Finally, during the personalization step 30 of the secure machine module, there is stored there a secret master key MSK _op common to at least a certain number. operators. This master key can for example be common to all operators of the same site, the same region or a particular type.

During data exchanges which will take place with the outside, in particular during the various authentications, whether it is the object to be personalized or other cards (operator or batch), the key which will be used will not be MSKm master key but a diversified version by means of diversification information constituted for example by the serial number of the machine used for the personalization of the object.

A personalization step 32 of the operator card consists in storing therein a secret master key MSK _op , identical for all the operators of the same customer, as well as, optionally, an operator number, his name and surname, a photograph of identity and other personal information about him, such as his fingerprints. The key which will be used during exchanges between the various cards and the object will be a version of the MSK _op key diversified by means of diversification information constituted for example by the unique number identifying each operator. During the personalization step 32 of the operator card, the key MSK _m common to at least a certain number of machines is also stored in the operator card, for example, to all the machines of a given administration of a region, site or particular type.

A step 34 of pre-personalizing the objects to be personalized consists in writing in or on the object all the data common to all the objects in a batch, for example linked to the operating system and to the keys allowing secure access to the objects or object type. During this step, in a manner known to a person skilled in the art, the master key MSK | _0t the same for all objects to customize a lot. According to the invention, the secret master keys MSK _op and MSK _{m are} respectively stored in each object of the operators and of the machines called upon to intervene during the personalization of the batch of objects. Typically, this is the master key associated with the operators of the sites or regions in which it is planned to personalize the objects. During this step, the batch card is also personalized, in a known manner. This personalization consists in particular in storing in the batch card the secret master key MSK | ₀ t. The version of the MSK key | _0t which will be used during exchanges between the various cards and the object will be a diversified version by means of diversification information constituted for example by a unique object number.

Steps 30, 32 and 34 can be performed in any order. A step 36 of initializing the method is then carried out. During this initialization, an authorized authority, for example a person hierarchically superior to the operators, stores in each operator card the list L _m of the serial numbers of the machines on which the operator is authorized to work and stores in the machine secure module, the L _op list of the numbers of operators authorized to work on this machine. This step must be particularly secure in relation to the steps for personalizing the object. It can be carried out by adaptations or an adapted organization, for example in a small shielded room, communicating with the secure modules of the personalization machines, and whose access is very controlled, for example by biometric identifications, a code of access and an airlock allowing only one person to pass. This step can take place when the machine is started up at the customer's site, then periodically, for example at the start of each day by the team leader, depending on the exact distribution of operators by machine, operators present, and machines in service.

Then, during a step 38 of launching a new batch, the operator card (s) and batch are programmed for the personalization of the batch, also by an authority authorized under security conditions similar to those from step 36. The authorized authority determines the operators who will work on this lot according to production planning. The MSK key | ₀ t is installed in the memory of the cards of the operators who will work on this batch. This installation procedure is indicated by dashed arrows in Figure 1.

The order in which steps 36 and 38 are carried out in FIG. 3 is in no way limiting. Steps 36 and 38 can be carried out in any order.

Then, at the start of a new batch of objects, during a step 40 of prior authentication, the machine secure modules and the operator and batch cards are authenticated reciprocally or not using the diversified versions of the corresponding MSKj secret keys and L, lists. For this, at least one of the cards, for example the operator card, knows the triplet (secure machine module, operator card, batch card) authorized to participate in the personalization of an object. This knowledge is reflected in the presence, in the memory of the operator card, of lists of authorized elements (machine (s), batch (s)). In the particular example described here, this is the list L _m of authorized machines. The list of authorized lots is implicitly determined by the list of keys MSK | _0t stored in the operator card. Indeed, the batch card for a given batch can only authenticate the operator card if it contains the key MSK | _0t corresponding to this lot. As a variant, this knowledge results in the presence, in the memory of the operator card, of an explicit enumeration of all the possible triplets of authorized elements. If the operator card does not have such an explicit enumeration, but only a list of authorized elements, it includes means adapted to form from this list all the possible combinations of authorized elements.

As regards authentication proper, the invention can use any type of authentication scheme and cryptography algorithm known to those skilled in the art. As long as we are working on the same batch and it is always the same triplet which participates in the personalization, it is not necessary to repeat the series of authentications aimed at verifying that we are indeed in the presence of the authorized triplet .

In the particular example described here, the prior authentications between the various cards are as follows:

- the operator card authenticates the secure machine module,

- the secure machine module authenticates the operator card,

- the batch card authenticates the operator card, and

- the operator card authenticates the batch card. As for the object to be personalized, it is authorized to work with a single batch card, but can be authorized to work with several operators and / or several machines. The object contains for this purpose in memory a list, stored during the pre-personalization of the object, with the batch card, the operator cards and authorized machines, elements from which the object is adapted to deduce therefrom all possible combinations of authorized elements. In the particular example described here, these lists are implicitly determined by the presence of the keys MSK _m and MSK _op in the memory of the object to be personalized. Indeed, these master keys being limited to a site or to a region or a particular type of operator or machine, they can correspond to a number of machines and operators sufficiently limited to guarantee, in combination with step d '40 preliminary authentication, security of the personalization process. As a variant, the object contains an explicit enumeration of all the possible combinations of triplets (batch card, secure machine module, operator card).

It should be noted that the UTL 10 is transparent vis-à-vis these exchanges between cards.

These authentications can also be followed by the generation of a session key, in a manner known per se, for encrypting the messages exchanged subsequently between the different secure sets.

In the event of a change of operator or batch, the authentication step 40 between the participants in the personalization process is repeated. It should be checked that the new secure set is properly authorized and that the secure sets involved in the personalization process always form an authorized triplet.

The next step 42 is an authentication step, reciprocal or not, between the object and, respectively, the batch card, the secure machine module and the operator card. Thus, for each object to be personalized:

- the batch card authenticates the object, and

- the object authenticates the secure machine module and the operator and batch cards, which allows the object to recover information identifying the machine, the operator and the batch, for traceability of personalization. One or more of the cards, for example the batch card, are suitable for securely accessing the database, illustrated in FIG. 2, containing the personal data relating to the object. This access is done by example by means of a session key, or by another cryptographic mechanism implementing for example the key MSK | _0t .

The table below considers all the possible situations of attempted fraud by using one or more false cards, or even a false object (these false being supposed not to have the secret keys MSKj) and indicates the set (s) secure ( s) which, following authentication, will detect the presence of an unauthorized item and block the personalization process. An authentic card or object is designated by the letter V (true) and a fake, by the letter F (false).

VV The batch card and the object block the procedure

V The batch card blocks the procedure

V The object blocks the procedure

The memorized track will be invalid

In the latter case, where the secure machine module, the operator and batch cards and the object are false, the trace stored in the personalized object will not correspond to any listed machine, nor any registered operator, nor any existing batch; thus, even if the personalization of the object could have been carried out by the fraudster, we will be able to recognize that this personalized object is a fake. This trace can be secured by the use of an authentication code, obtained for example by the use of a hash function, such as SHA-1 or MD5, well known to those skilled in the art, and the use of a cryptography algorithm (for example of the DES type) involving one of the diversified MSK- keys. Conversely, the verification of the authentication code guarantees that the secure sets that participated in the personalization process are true.

Returning to FIG. 3, after the authentication steps of the secure machine module and of the operator and batch cards with the object have taken place, the personalization step 44 itself can be carried out. During this stage, personal information specific to the future user of the object is entered in or on the object, mechanically (by printing, engraving, embossing, etc.), electronic, optical, chemical or by any other technique. This data comes from the database (illustrated in Figure 2 previously described) and is stored there.

In an alternative embodiment, the total number of secure assemblies can be limited to three, the object including, by grouping the batch card and the operator card in a single card, or by grouping the machine secure module and the operator card. .

The context of the personalization of objects is only one example among other possible applications of the present invention, which, more generally, relates to a method of communication between a number n of secure sets, n being at less than 2, which are each made up a storage unit and a microcircuit and which form an authorized n-tuple known to at least one of the secure assemblies.

This method comprises a certain number of authentication steps between the secure sets taken two by two. For example, in the field of banking transactions, given a store delivering loyalty points to its customers on their loyalty card during each purchase, supposedly made by bank card, the invention makes it possible to avoid fraudulent obtaining loyalty points, or their allocation to a customer other than the one who made the purchase giving the right to these loyalty points, or even preventing a customer from recovering loyalty points corresponding to another store.

For this, we consider three secure sets respectively consisting of three microcircuit cards: the loyalty card, the bank payment card and a card associated with a seller of the store assigning loyalty points.

During the purchase, the loyalty card, which knows the triplet (loyalty card, payment card, seller's card) authorized, authenticates the payment card and the seller's card. The operation of allocating loyalty points may possibly also involve a fourth secure assembly, associated with the store: it may for example be a fourth microcircuit card inseparable from the cash register with which the customer pays his purchase. In this case, during the purchase transaction, the loyalty card also authenticates the store card.

If all the authentications, carried out in a similar manner to that which has been described above in connection with the personalization process, are successful, the loyalty points are memorized on the loyalty card.

The communication method according to the present invention applies of course to a large number of other fields not listed here.

Claims

1. Method for secure personalization of an object comprising a first secure assembly (E1) consisting of first storage means and a first microcircuit, characterized in that it implements n-1 secure assemblies (E2, E3) in addition to said first secure set, n being an integer strictly greater than 2, each of said secure sets being made up of storage means and a microcircuit, and forming with said object an authorized tuple, known to at least one of said secure assemblies, and in that said method comprises a plurality of authentication steps between the secure assemblies taken two by two, prior to a personalization step consisting of writing, in or on the object, personal data specific to said object .

2. Method according to claim 1, characterized in that the object to be personalized authenticates said n-1 secure sets.

3. Method according to claim 1 or 2, characterized in that, at the end of the step of personalizing said object, the first storage means keep a trace making it possible to identify at least one of the secure assemblies having participated in the process customization among said n-1 secure sets.

4. Method according to the preceding claim, characterized in that said trace comprises an authentication code.

5. Method according to any one of the preceding claims, characterized in that the n-1 secure sets are taken from: - a secure set representing a batch of objects to be personalized,

a secure assembly comprising a secure electronic entity associated with a machine adapted to personalize the objects of said batch, and

- a secure assembly attached to an operator authorized to use said machine.

6. Method according to any one of the preceding claims, characterized in that the first secure assembly (E1) is adapted to communicate with the outside using a contactless technology.

7. Method according to any one of the preceding claims, characterized in that it comprises a preliminary authentication step involving said n-1 secure sets.

8. Method according to claims 5 and 7, characterized in that the preliminary authentication step is carried out as follows:

9. Method according to any one of the preceding claims, characterized in that at least one microcircuit among the microcircuits of the n-1 secure assemblies is adapted to communicate with the outside using a contactless technology.

10. Method according to any one of the preceding claims, characterized in that at least one of said secure sets is adapted to securely access a database containing said personal data.

11. Method according to claims 5 and 10, characterized in that at least one of said secure assemblies adapted to securely access said database is the batch secure assembly.

12. Method according to claims 6 and 9, characterized in that a logic processing unit (10) ensures communication between at least two secure assemblies, when these are all simultaneously in its radio frequency field.

13. Method according to any one of claims 5 to 12, characterized in that the secure machine assembly is sealed to the body of the machine.

14. Method according to the preceding claim, characterized in that the secure machine assembly is necessary for the operation of the machine.

15. Method according to claim 5 or 8, characterized in that the secure batch assembly is a microcircuit card.

16. Method according to claim 5 or 8, characterized in that the secure machine assembly is a microcircuit card.

17. Method according to any one of the preceding claims, characterized in that the object is a title issued by the State or another document of an official nature or a transport document or a travel document.

18. Method of secure communication, characterized in that it implements n secure sets, n being an integer at least equal to 2, each of said secure sets consisting of storage means and a microcircuit, and forming a n authorized known tuple of at least one of said secure sets, and in that said method comprises a plurality of authentication steps between the secure sets taken two by two.

19. Communication method according to the preceding claim, characterized in that at least one of said storage means retains a trace making it possible to identify at least one of said n secure assemblies.

20. A communication method according to claim 18 or 19, characterized in that said trace comprises an authentication code.

21. Communication method according to claim 18, 19 or 20, characterized in that at least one of said secure assemblies is adapted to communicate with the outside using a contactless technology.

22. Communication method according to the preceding claim, characterized in that a logic processing unit ensures communication between at least two secure assemblies, when these are all simultaneously in its radiofrequency field.

23. Communication method according to any one of claims 18 to 22, characterized in that at least one of said secure assemblies is a microcircuit card.