WO2006084979A1

WO2006084979A1 - Method for authenticating an electronic label by using a public-key cryptographic algorithm

Info

Publication number: WO2006084979A1
Application number: PCT/FR2006/000260
Authority: WO
Inventors: Côme BERBAIN; David Arditti; Olivier Billet
Original assignee: France Telecom
Priority date: 2005-02-11
Filing date: 2006-02-03
Publication date: 2006-08-17
Also published as: FR2882209A1

Abstract

The invention relates to a method for authenticating an electronic label (1) by a server (2) and by using a public-key cryptographic algorithm of which the secret key is known by the server (2). The electronic label (1) comprises a secret identifier also accessible to the server (2). The method consists of, on the label; encrypting (12) the secret identifier by iteration of the cryptographic algorithm; encrypting (15) the result of a bijection having, as input parameters, a random variable emitted by the server (2) and the concatenation of the encrypted secret identifier and of the number of iterations and, on the server; decrypting (17) the transmitted result; utilizing (18) the inverse bijection and the random variable for extracting the encrypted secret identifier and the number of iterations; decrypting (20) the secret identifier by iteration of the decryption algorithm, and; searching (21) on the server.

Description

A method of authenticating an electronic tag by using a public key cryptographic algorithm.

The present invention relates to a method of authentication of an electronic tag by an authentication server and using a public key encryption / decryption algorithm, the tag comprising a counter initialized to the null value and a register of current identifier initialized with a secret identifier of the electronic tag and the authentication server having access to storage means of said secret identifier of the electronic tag. It also relates to the authentication system, the electronic tag and the associated authentication server.

The massive and increasing use of electronic tags (Radio Frequency IDentifiers (RFID) - radio-frequency identifier, cards without contacts, ...) pose new security problems. In particular, it raises the issue of protecting the privacy of the carriers of these labels. Indeed, the detection of a label by a reader can be done without particular action of the wearer, by mere proximity. Combined with a growing interaction between these readers, the frequent identification of these tags allows the constitution of databases to track the wearer at the expense of anonymity.

The object of the invention is therefore to propose a method for authenticating an electronic tag accessible only to authorized readers / servers and thus not allowing a third party to trace a tag by the information it generates. The object of the invention is a method of authentication of an electronic tag by an authentication server and using a public key encryption / decryption algorithm, the electronic tag having a counter initialized to the value null and a current identifier register initialized with a secret identifier of the electronic tag, and the authentication server having access to storage means of said secret identifier of the electronic tag, said method comprising the steps of: a) encrypting by the electronic tag of said current identifier by a predetermined number of iterations of the encryption algorithm using said public key, incrementing the counter of said predetermined number of iterations and storing the value of the counter, storing the result of the encryption in the current identifier register, b) transmitting a randomness from the authentication server to the electronic tag, c) encrypting, by the electronic tag, the result of a bijective function having two input parameters, the first parameter being the hazard and the second parameter being the concatenation of the current encrypted current identifier and the counter, said function being as the second parameter is computable from the result of this function, the random and the inverse function, d) emission of the result of the encryption to the authentication server, e) decryption by the authentication server of the result using the secret key associated with the public key and the decryption algorithm, then f) calculating the second parameter from said inver function se, of the hazard and the decrypted result, g) separation in the second parameter of the value derived from the current identifier and the counter, h) decryption of the value derived from the current identifier (K'-i) by successive iterations of said counter, of the decryption algorithm with the secret key, i) search in said storage means for said decryption result thus calculated, j) authentication of the electronic tag if said search is positive.

Other characteristics of the authentication method are:

prior to step b), the electronic tag issues an authentication request to the authentication server; in step a), said predetermined number of iterations is equal to 1 and is applied to the current identifier stored in step a) during the preceding authentication;

the encryption step a) is executed after step c) in preparation for a subsequent authentication; and the encryption algorithm is an RSA algorithm using a low value exponent;

the initialization of the authentication server is done by loading an image of the secret identifier obtained by using a one-way function, and the step h) is followed by a step of calculating an image of the result decryption obtained using the same function and step i) is replaced by a step of searching for said image;

a first pair of public / secret keys is used in steps a) and h) for the encryption / decryption of the current identifier and a second public / secret key pair is used in steps c) and e) for encryption / decryption of the result of the bijective function. Other objects of the invention are

an electronic tag, comprising:

means for storing a current identifier; means for storing a public key and means for implementing an asymmetric encryption algorithm using this public key;

a counter able to increment the number of iterations of application of the encryption algorithm of the current identifier; first computing means adapted to iterate the encryption of the current identifier by a predetermined number of iterations using the encryption algorithm and said public key; means of communication with an authentication server able to receive a randomness of this server and to send back the result obtained by

second means for calculating a bijective function having two input parameters, the first parameter being the hazard and the second parameter being the concatenation of the current encrypted identifier and the counter, said function being such that the second parameter can be calculated from the result of this function, the hazard and the inverse function;

an authentication server, comprising:

means for accessing storage means for at least one secret identifier of an electronic tag;

means for generating a hazard; means of communication with the electronic tag able to transmit to it the random generated and to receive a value in return;

means for implementing an asymmetric decryption algorithm to which means for storing a secret key are connected;

first means for decrypting the value received by using the means for implementing the asymmetric decryption algorithm;

means for calculating an inverse bijective function having two input parameters, the first parameter being the random value and the second parameter the result of the first decrypting means;

separating means capable of extracting from the result of the bijective function a first value and a second value considered as a number of iterations; second decryption means able to repeat the number of iterations contained in the second value; the decryption algorithm with the secret key on the first value;

means for finding the value decrypted in the storage means of the secret identifier; and an authentication system comprising at least one electronic tag and at least one authentication server.

The invention will be better understood on reading the description which will follow, given solely by way of example, and with reference to the appended drawings in which: FIG. 1 is a block diagram of a system of FIG. authentication according to the invention;

FIG. 2 is a flow chart of an embodiment of the method according to the invention;

FIG. 3 is a detailed flow chart of an encryption operation;

FIG. 4 is a detailed flow chart of a decryption operation;

FIG. 5 is a block diagram of an electronic tag; and

FIG. 6 is a block diagram of an authentication server. The authentication system, FIG. 1, comprises an electronic tag 1 connected to an authentication server 2 by a wireless link 3.

The electronic tag 1 is, for example, a contactless card or a radio frequency identifier.

The authentication server 2 is, for example, a base station, a banking terminal or a radio frequency reader. Generally, the authentication server 2 is connected by a conventional data link 4, for example of the TCP / IP (Transfer Control Protocol / Internet Protocol) type, to other processing and storage machines. information.

The link 3 is generally a very short-range radio-frequency link, for example that defined by the ISO 14443 standard. An infrared link is also possible although having the disadvantage of operating only at sight between the label 1 and the authentication server 2. The authentication method described below is based on asymmetric cryptographic algorithms. These algorithms are well known to those skilled in the art, the most famous of them being the RSA algorithm. For the understanding of what will follow, it will be recalled only that to encrypt a transmission of information between an Alice transmitter and a receiver Bob with such an algorithm, it is necessary for Bob to generate a pair of keys: a public key and a key secret. Bob then sends Alice her public key. Alice encrypts her message using Bob's public key and the appropriate encryption algorithm and passes the encrypted message to Bob. Bob decrypts the message with his secret key and the corresponding decryption algorithm. The mathematical properties of these algorithms are such that knowledge of the public key alone does not allow decryption.

In the following description, note PA public key A and SA his secret key. The encryption algorithm will be noted Asym and the corresponding decryption algorithm Asym ^"1. The electronic tag 1 comprises means for implementing the encryption algorithm Asym and storage means of the public key P ₂ of authentication server 2, common to a set of authentication servers, the authentication server 2 comprises means for setting implementation of the decryption algorithm Asy m ^'1 and storage means of the secret key S ₂ .

Prior to any authentication method, FIG. 2 implements a first initialization step of the card during which a current identifier register Ki is initialized with a secret identifier IS specific to this tag. This secret identifier is, for example, a serial number or the result of a diversification such as a MAC code ("Message Authentication Code"). A counter Ci is also initialized to 0. In parallel, step 11, the secret identifier IS of the electronic tag

1 is also loaded on the authentication server 2, or is accessible by the authentication server 2 to another machine 5.

Then, prior to authentication, the tag encrypts the secret identifier IS at 12 by successive iteration of the Asym encryption algorithm with the public key P ₂ and stores the number of iterations in the counter Ci as well as the result of the encryption in a Ki register.

With reference to FIG. 3, this step 12 is divided into an encryption step 12A y = Asym (P ₂ , K ₁ ), a step of storing the result in 12B in the Ki register

and a step of incrementation at 12C of the counter C ₁ <- C ₁ + 1.

Steps 12A to 12C are repeated N times, N being a predetermined value selected, for example, randomly. The secret identifier IS having thus been encrypted, the electronic tag 1 in this embodiment transmits at 13, FIG. 2, an authentication request to the authentication server 2.

It responds to 14 by sending a random R, that is to say some random value. At 15, the electronic tag 1 concatenates the previously encrypted current identifier Ki and the number of iterations Ci and digit with the public key P ₂ the result of the exclusive-OR operation between the hazard R and this concatenation, either

X = Asym (P ₂ , (Kpi) ® R) classically noting the result X, the concatenation and the exclusive OR Θ. Remember that the OR-exclusive operation of two numbers in binary notation consists of adding the 2 bit-to-bit numbers modulo 2.

This result X is sent at 16 by the electronic tag 1 to the authentication server 2.

By using its secret key S ₂ , the authentication server 2 decrypts in 17 the result X with the decryption algorithm Asym ^'1 , that is

then calculates in 18 the exclusive-OR of X 'with the hazard R, ie Z' = X'θR

For the understanding of the operation, it is recalled that performing an exclusive-OR twice using the same operand amounts to doing an identity operation: X = X @ R @ R.

Thus, it is possible to use another bijective function than the exclusive OR, this function having the property that, knowing the inverse function and the hazard, it is possible to find the initial value. For example, multiplication or addition with randomness are functions with this property.

The result Z 'of the exclusive OR can be separated into 19 into a first value K'i and a second value Ci such that Z' = K \ C ₁ . The second value C'i is interpreted as indicating the number of iterations performed to encrypt the secret identifier.

The first value K'i is thus decrypted by repeating the number of iterations It is the use of the decryption algorithm Asym ^"1 with the secret key S ₂ of the server, ie IS '= (Asym ^{~ ι} f ^ι (S ₂ , K \)

This operation, symmetrical with the encryption operation of step 12, is decomposed, FIG. 4, according to the following algorithm:

decryption in 2OA of the first value K'i by using the decryption algorithm Asym ^"1 and the secret key S ₂ of the authentication server 2,

assigning the decryption result to K'i, in 2OB,

- decrementation of the counter d, in 2OC,

- if it is positive, in 2OD, return to step 2OA. This gives a value IS '. It is then searched in 21 if this IS 'value is equal to the secret identifier IS which had been stored in the server, or made accessible to the latter, during step 11.

In general, the server has a list of secret identifiers corresponding to all valid tags for the application. By methods well known to those skilled in the art (read in sequence, hash table, ...) the server looks in this list of secret identifiers if one of them corresponds to the value IS '.

If such a secret identifier is found, then the electronic tag 1 is authenticated at 22.

A method has thus been described which advantageously allows an authentication of the electronic tag 1 without a third party being able to intercept the identifier of the tag or pretend to be the authentication server.

Indeed, the prior encryption of the secret identifier according to a number of iterations which is preferably different to each authentication request makes the label can be seen by a third party only as a different label for each test. authentication.

A preferred way of obtaining this variation is to execute one and only one encryption operation on the value Ki stored during the preceding authentication, before an authentication and thus to increment the counter Ci by one unit before each authentication.

It should be noted that in this variant, the encryption of Ki and the incrementation of the counter can take place indifferently before or after the calculation, step 15, of the value X transmitted to the authentication server 2. In another variant of the method the Asym encryption algorithm is an asymmetric RSA algorithm with a low value exponent, for example a value of 3. The calculation of step 12A then amounts to producing 2 modulo n multiplications, where n is the product of several prime numbers. For any reference to the RSA algorithm, please refer to Ronald L. Rivest, Adi Shamir and Leonard M. Adleman.

Public Key Cryptosystems, "Common ACM 21 (2): 120-126 (1978).

Thus a microprocessor card without a crypto-processor or a radio frequency identifier can easily perform the operation. This advantageously makes it possible to use low cost components. Moreover, in this variant, the verification by the authentication server 2 is done quickly: the iterated application C ₁ time of Asym ^"1 (S ₂ , K'i) is done in a single calculation of Asym ^{" 1} (S'2, K'i) where S'2 is the inverse of P 2 raised to the power C ' ₁ modulo φ (n) with φ (n), function of Euler. In another variant, two pairs of public / secret keys are used. A first pair is used to encrypt and decrypt the secret identifier IS, steps 12 and 20, and the second pair is used to encrypt and decrypt the result of the exclusive-OR operation, steps 15 and 17.

This advantageously makes it possible to modulate the size of the key pairs according to the security constraints. For example, a risk analysis may lead to increasing the size of the key pair used for the transfer, while keeping a key size allowing a quick calculation for the iterative calculation on the secret identifier.

In another variant, the secret identifiers IS are not stored in the authentication server 2. Instead, an image of the secret identifier is stored by a one-way function such as a SHA type of condensation function (by for example, NITS, FIPS 180-1 and 180-2) or encryption by a symmetric algorithm with a secret key.

The only change is then to use the same function on the result of the decryption operation 20 and to search for the result with the list of images of the identifiers.

This variant advantageously protects the secret identifier by avoiding its dissemination on a multitude of authentication servers.

For the implementation of this method, the electronic tag 1 therefore comprises, FIG. 5, storage means 50 of the current identifier K 1, storage means 51 of the public key P2 and means 52 for implementing of the encryption algorithm Asym.

It also comprises a counter 53 containing the value of C ₁ corresponding to the total number of iterations since the initialization of the card. All the preceding means are connected to first computing means 54 for iteration of the encryption of the secret identifier IS to obtain the value Ki stored in storage means 55.

The electronic tag 1 also comprises second calculation means 56 capable of encrypting the result of the exclusive-OR operation, or of a equivalent bijective function, between the hazard R and the concatenation of the encrypted secret identifier Ki and the value Ci contained in the counter 53.

The hazard R is received from the authentication server 2 by the communication means 57 of the electronic tag 1. These same communication means 57 are adapted to send to the authentication server 2 the result of the calculation performed by the means 56. .

The authentication server 2 comprises, FIG. 6, communication means 60 connected to randomization generating means 61 in order to be able to send this hazard to the electronic tag 1. These communication means 60 are also connected to first ones. decryption means 62 capable of decrypting the value transmitted by the electronic tag 1.

These first decryption means 62 use the means 63 for implementing the decryption algorithm Asym ^{"1 to} which the storage means 64 of the secret key S ₂ are connected, The authentication server also comprises calculation means 65 exclusive-OR, or an equivalent bijective function, between the hazard R and the value decrypted by the decryption means 62, the result of which is transferred to means 66 for separating the first value K'i and the second value C'L Second means 67 for decryption are adapted to repeat the number of iterations Ci using the means 63 for implementing the decryption algorithm Asym ^'1 .

The result is transferred to search means 68 for the secret identifier IS stored in storage means accessible by access means 69.

In one variant, the authentication system comprises a plurality of authentication servers sharing the pair of keys (public, secret).

In general, the authentication system comprises electronic tags and at least one authentication server as described above.

The method thus described and the system associated with it advantageously allow authentication of electronic tags accessible only to authorized servers, that is to say to those who know the secret identifier. A third party can not therefore draw such a label by the information it generates, these varying with each authentication request in a mode that seems random to this third party.

They also allow and advantageously ensure a retroactive non-traceability, that is to say that an unauthorized third party who seized the electronic tag and thus accesses its content is not able to correlate these information with past communications of the tag with servers since it can not unroll the process in reverse chronological order.

Finally, since this method only requires simple calculations on the electronic tag side, it can be implemented in hardwired logic, which advantageously makes it possible to use low cost tags.

Claims

1. A method for authenticating an electronic tag (1) by an authentication server (2) and using a public key encryption / decryption algorithm, the electronic tag (1) comprising a counter (Ci ) initialized to the null value and a current identifier register (KO initialized with a secret identifier (IS) of the electronic tag, and the authentication server (2) having access to storage means of said secret identifier (IS ) of the electronic tag, said method comprising the steps of: a) encrypting (12) by the electronic tag (1) of said current identifier (Ki) by a predetermined number of iterations of the encryption algorithm using said key public, incrementation of the counter (Ci) of said predetermined number of iterations and storage of the value of the counter, storage of the result of the encryption in the current identifier register (K ₁ ), b) transmission (14) of a random ( R) d u authentication server (2) to the electronic tag (1), c) encryption (15), by the electronic tag (1), the result of a bijective function having two input parameters, the first parameter being the hazard (R) and the second parameter being the concatenation of the current encrypted identifier (KO previously and the counter (Ci), said function being such that the second parameter is computable from the result of this function, from the random and inverse function, d) transmission (16) of the result of the encryption to the authentication server (2), e) decryption (17) by the authentication server (2) of the result using the secret key associated with the public key and the decryption algorithm, then f) calculating (18) the second parameter from said inverse function, the random and the decrypted result, g) separation (19) in the second parameter of the value derived from the current identifier (K'-i) and the counter r (C'i), h) decrypting (20) the value derived from the current identifier (K'-i) by successive iterations of said counter (C'i), the decryption algorithm with the secret key, i) search (21) in said storage means of said decryption result thus calculated, j) authentication (22) of the electronic tag if said search is positive.

2. A method for authenticating an electronic tag (1) by an authentication server (2) and using a public key encryption / decryption algorithm, the electronic tag (1) comprising a counter (Ci initialized to the null value and a current identifier register (KO initialized with a secret identifier (IS) of the electronic tag, and the authentication server (2) having access to storage means an image of said secret identifier (IS) of the electronic tag obtained using a one-way function, said method comprising the steps of: a) encrypting (12) by the electronic tag (1) of said current identifier (KO by a predetermined number of iterations of the encryption algorithm using said public key, incrementing the counter (d) of said predetermined number of iterations and storing the value of the counter, storing the result of the encryption in the registrar current identifier

b) transmission (14) of a randomness (R) of the authentication server (2) to the electronic tag (1), c) encryption (15), by the electronic tag (1), of the result of a bijective function having two input parameters, the first parameter being the hazard (R) and the second parameter being the concatenation of the current encrypted identifier (Ki) and the counter (Ci), said function being such that the second parameter is computable from the result of this function, from the hazard and from the inverse function, d) sending (16) the result of the encryption to the authentication server (2), e) decryption (17) by the authentication server (2) of the result using the secret key associated with the public key and the decryption algorithm, then f) calculating (18) the second parameter from said inverse function , random and deciphered result, g) separation (19) in the second parameter of the value derived from the current identifier (K '-i) and the counter (C'-i), h) decryption (20) ) of the value derived from the current identifier (K'-i) by successive iterations of said counter (C'i), of the decryption algorithm with the secret key, h ') calculation, by means of said one-way function unique, the image of the result of decryption thus calculated, i ¹ ) search (21) in said image storage means thus calculated, j) authentication (22) of the electronic tag if said search is positive.

3. Authentication method according to claim 1 or claim 2, characterized in that prior to step b), the electronic tag (1) issues an authentication request to the authentication server (2).

4. Authentication method according to any one of the preceding claims, characterized in that, in step a), said predetermined number of iterations is equal to 1 and is applied to the current identifier stored in step a) during the previous authentication.

5. Authentication method according to claim 4, characterized in that the encryption step a) is performed after step c) in preparation for a subsequent authentication.

6. Method according to any one of the preceding claims, characterized in that the encryption algorithm is an RSA algorithm using a low value exponent.

7. Method according to any one of the preceding claims, characterized in that a first pair of public / secret keys is used in steps a) and h) for the encryption / decryption of the current identifier. (K- _I , K'i) and a second public / secret key pair is used in steps c) and e) for the encryption / decryption of the result of the bijective function.

8. Electronic label, characterized in that it comprises:

means (50) for storing a current identifier; means (51) for storing a public key and means (52) for implementing an asymmetric encryption algorithm using this public key;

a counter (53) capable of incrementing the number of application iterations of the encryption algorithm of the current identifier; first (54) calculation means adapted to iterate the encryption of the current identifier; a predetermined number of iterations using the algorithm of Ghiffrement and said public die,

means (57) for communicating with an authentication server able to receive a random event from this server and to send back the result obtained by

second means (56) for calculating a bijective function having two input parameters, the first parameter being the hazard and the second parameter being the concatenation of the current encrypted identifier and the counter (53), said function being such that the second parameter is computable from the result of this function, the random and the inverse function.

Authentication server, characterized in that it comprises:

means (69) for accessing storage means for at least one secret identifier of an electronic tag (1),

means (61) for generating a hazard; means (60) for communicating with the electronic tag (1) able to transmit to it the random generated and to receive a return value,

means (63) for implementing an asymmetric decryption algorithm to which means (64) for storing a secret key are connected; first means (62) for decrypting the value received by using the means; implementation of the asymmetric decryption algorithm, means (65) for calculating an inverse bijective function having two input parameters, the first parameter being the random value and the second parameter the result of the first decryption means (62),

separating means (66) able to extract from the result of the bijective function a first value and a second value considered as a number of iterations,

second (67) decryption means capable of repeating the number of iterations contained in the second value; the decryption algorithm with the secret key on the first value; means (68) for finding the value decrypted in the first value; storage means of the secret identifier.

10. Authentication system characterized in that it comprises at least one electronic tag according to claim 8 and at least one authentication server according to claim 9.