WO2007003656A1

WO2007003656A1 - Secured identification system and medium, and method for securing same

Info

Publication number: WO2007003656A1
Application number: PCT/EP2006/063924
Authority: WO
Inventors: Pierre Girard; Christophe Mourtel
Original assignee: Gemplus
Priority date: 2005-07-05
Filing date: 2006-07-05
Publication date: 2007-01-11
Also published as: FR2888364A1

Abstract

The invention concerns an identification system comprising two elements having non-contact mutual communication, for example a smart card (1) and a reader (2). The inventive system further comprises co-operating means (41, 42) for establishing, between the card (1) and the reader (2), a co-operation whereof the successful outcome is subject to the condition that those two element (1, 2) are physically relatively close to each other, supervising means (8) being provided to abort the communication in case of failure of the co-operation.

Description

SECURE SYSTEM AND IDENTIFICATION MEDIUM, AND METHOD

FOR THEIR SECURITY.

The invention relates generally to security techniques such as those applied to electronic transactions.

More specifically, the invention relates, according to a first aspect, to an identification system, comprising an identification medium, such as a contactless smart card, a device for operating the medium, such as a reader for contactless smart card, and verification means, the identification medium and the operating device being provided with respective communication means cooperating in operation for exchanging data on presentation of the identification medium by means of electromagnetic waves, and verification means delivering an acceptance or refusal signal according to whether at least one of the two elements constituted by the identification medium and the operating device recognizes the other as authentic or not.

Non-contact identification media, such as smart cards, work by remote power. These media draw the energy necessary for their operation from an electromagnetic field produced and sent by the card reader with which they must interact. In addition, this electromagnetic field carries the data sent by the reader to the card and also serves as support for map responses to the reader.

This electromagnetic field is therefore necessary and sufficient for both the power supply of the smart card and for the establishment of a communication between the reader and the card.

By their very design, such identification media therefore operate without physical contact or contact with the reader, the card and the reader may therefore not be visible to one another.

The consequence of this situation is that it is possible to interrogate a contactless card without its bearer (owner) noticing it and / or being consenting, which opens the way to a new type of attack. on smart cards.

In particular, it is conceivable to use a smart card without the knowledge of its owner by increasing up to 50 meters the distance between a reader and this card by means of relay forming a communication bridge between the card and a reader remote.

This problem can possibly be solved by the implementation of existing solutions.

For example, it has already been proposed to block the use of a contactless identification medium as long as its user does not press a push button on this card. It has also been proposed to prevent any inadvertent use of the card by sliding the latter into a metal case, the metal having the property of blocking the electromagnetic waves.

It has also been proposed to require the user of a contactless card to present an additional identification element, such as a secret code, to validate the transaction between the card and a reader.

In this context, the purpose of the present invention is to propose an alternative solution route, which has its own advantages.

To this end, the system of the invention, moreover in conformity with the generic definition given in the preamble above, is essentially characterized in that the identification medium and the operating device are furthermore equipped with means of concertation to establish a concertation whose success is subject to the condition that this identification medium and this operating device are physically separated from each other by a distance at most equal to a predetermined threshold, this system further comprising supervisory means for inhibiting the acceptance signal in the event of failure of the consultation.

For example, the consultation means comprise measuring means capable of detecting a context or immediate physical environment specific and common to the identification medium and the operating device, and / or influence means capable of at least partially creating such a specific and common immediate physical context or environment.

The measuring means may thus comprise at least a first sensor of a first type that is sensitive to a first physical parameter representative of the specific and common immediate physical context or environment, and that supplies a first measurement signal whose value is verified by the means of measurement. supervision.

It is particularly possible to provide that the first sensor is carried by a first of the elements that constitute the identification medium and the operating device, that the measuring means further comprise at least a second sensor of the first type carried by a second of the elements that constitute the identification medium and the operating device, the second sensor is also responsive to said first physical parameter, and the second sensor provides a second measurement signal whose value is compared with that of the first signal of measured by the means of supervision.

The first physical parameter is advantageously chosen from the set of physical parameters comprising: brightness, temperature, humidity, sound, atmospheric pressure, the chemical composition of the ambient air, the shape of a two-dimensional design or a three-dimensional object, and the relative movement of the identification medium and the operating device. The measuring means may also include sensors of several types fitted to the identification medium and / or the operating device.

In any case, it is preferable that the measurement signal from each sensor fitted to the identification medium is transmitted to the operating device in a secure manner.

It is possible to provide that the first sensor is carried by a first of the elements that constitute the identification medium and the operating device, that the influence means comprise a shape drawn on a second of the elements that constitute the support of identification and the operating device, and that the first measurement signal provided by the first sensor is a function of this form and the distance between the identification medium and the operating device.

The first sensor may be a receiver of a physical field or a physical wave independent of the electromagnetic waves used for the communication, in which case the means of influence then comprise an emitter emitting said field or said physical wave and disposed on a second elements that constitute the identification medium and the operating device, the first measurement signal supplied by the first sensor being a reception signal depending on this field or this physical wave and the distance between the identification medium and the operating device. In this case, said field or said physical wave advantageously has, between the transmitter and the receiver, a range limited to said predetermined threshold.

It is still possible to provide that the physical wave produced by the transmitter is modulated in time, that the first measurement signal delivered by the receiver is returned to the transmitter, and that the success of the consultation is defined by the provided that the transmitted wave and the signal returned to the transmitter have a phase shift at most equal to a phase shift representative of the travel time of the modulated wave from the transmitter to the receiver over a distance at most equal to said predetermined threshold, and the travel time of the signal returned from the receiver to the transmitter at a distance at most equal to said predetermined threshold.

The physical wave used is for example a sound wave humanly inaudible.

The invention also relates to a contactless identification medium, such as a smart card, comprising communication means, this medium being characterized in that it further comprises at least one sensor sensitive to a physical parameter taking a value specific to the immediate environment to which this medium belongs.

The invention also relates to a method for securing a contactless identification operation of an identification medium with a device for exploiting this medium, this method being characterized in that it comprises an operation of verifying that the identification medium and the operating device are separated from one another by a distance at most equal to a predetermined threshold, and to inhibit or cancel the effects of the identification operation in the opposite case.

Other features and advantages of the invention will emerge clearly from the description which is given below, by way of indication and in no way limiting, with reference to the accompanying drawings, in which the single figure is a diagram of a system according to the invention.

As previously announced, the invention relates to an identification system essentially comprising an identification medium 1, such as a contactless smart card, and a device 2 for using the medium, such as a card reader. contactless chip.

The identification medium or card 1, as well as the operating device or reader 2, are provided with respective communication means 31 and 32 which cooperate in operation to ensure, by emitting electromagnetic waves, an exchange of data between the reader 2 and card 1 on presentation of the latter to the reader.

This system also includes verification means

7 whose dotted symbolic representation, halfway between the card 1 and the reader 2, is intended to make it clear that these means can indifferently physically located on the map 1, on the reader 2, or both on the map and on the reader.

These verification means 7 have the function of delivering an acceptance signal Sa in the case where the card 1 recognizes the reader 2 as authentic, and / or in the case where the reader 2 recognizes the card 1 as authentic.

In the other cases, the verification means 7 deliver a refusal signal Sr.

According to the invention, the card 1 and the reader 2 are provided with respective consultation means 41 and 42, the system further comprising supervisory means 8.

The means of consultation 41 and 42 have the function of establishing, between the card 1 and the reader 2, a concertation whose success is subject to the condition that this card 1 and this reader 2 are physically separated from one of the other by a distance D at most equal to a predetermined threshold Do.

For their part, the supervisory means 8 have the function of inhibiting, in case of failure of the consultation, the acceptance signal Sa possibly produced by the verification means.

The symbolic representation of the dashed supervision means 8, halfway between the card 1 and the reader

2, is intended to make it clear that these means, such as the means of verification 7, may indifferently to be physically on the map 1, on the reader 2, or both on the map and on the reader.

The means of concertation 41 and 42 can take many different forms.

In particular, the consultation means 41 and 42 may comprise measuring means 5 capable of detecting a context or specific immediate physical environment common to the card 1 and the reader 2.

Alternatively or cumulatively, these consultation means 41 and 42 may comprise means of influence 6 capable of creating at least partially such a context or immediate physical environment specific and common to the card 1 and the reader 2.

These measuring means 5 may thus comprise a sensor 51, installed on the card 1 or on the reader 2, sensitive to a first physical parameter representative of the context or immediate specific and common physical environment, and providing a first measurement signal Sl whose value is verified by the supervisory means 8.

These measuring means 5 may also comprise a sensor 52, installed on the card 1 or on the reader 2, also sensitive to the first physical parameter, and providing a second measurement signal S2 whose value is compared with that of the first measurement signal Sl by the supervision means 8. This first physical parameter is for example constituted by brightness, temperature, humidity, sound, atmospheric pressure, the chemical composition of the ambient air, the shape of a two-dimensional design or a three-dimensional object, or still the relative movement of the identification medium and the operating device.

In practice, it may be useful to provide that the measuring means 5 comprise sensors of several types fitted to the card 1 and / or the reader 2, that is to say sensors sensitive to different parameters, preferably chosen. in the previous list.

Preferably, the measurement signal from each sensor fitted to the card 1 or the reader 2 is transmitted respectively to the reader or to the card 2 in a secure manner so as to avoid its alteration.

The influence means 6 may comprise a shape 60 drawn on the card 1 or on the reader 2, the sensor 51 then being respectively carried by the reader 2 or the card 1 and delivering, as measurement signal Sl, a signal depending on this form 60 and the distance D between the card 1 and the reader 2.

The influence means 6 may also include a transmitter 61 carried by the card 1 or by the reader 2 and emitting a physical field or a physical wave independent of the electromagnetic waves used for communication between the card and the reader. In this case, the sensor 51, which is respectively carried by the reader 2 or by the card 1, is a receiver of this field or this physical wave and delivers, as measurement signal Sl, a reception signal dependent on this field or this physical wave and the distance D separating the card 1 from the reader 2.

A simple way to ensure that the dialogue fails in case of ^f distance too great between the card 1 and the reader 2 may be to ensure that the field or wave has physical connection between the transmitter 61 and receiver 51, a range limited to the value Do of the maximum distance allowed.

The physical wave may for example be constituted by a sound wave, preferably emitted at a frequency inaudible to the human ear and for example ultrasonic.

It is possible to provide that the physical wave produced by the transmitter 61 is modulated in time and that the measurement signal Sl delivered by the receiver 51 is returned to the transmitter 61, the transmitter and the receiver thus ensuring a function similar to that of a radar.

The success of the concertation can then be defined by the condition that the transmitted wave and the signal returned to the transmitter 61 have a phase shift at most equal to that which must appear when, in the actual operating conditions, the card 1 and the reader 2 are separated from each other by a distance D less than the maximum distance allowed Do.

Indeed, this phase shift is determined by the frequency of the transmitted wave, by the travel time of this wave between the transmitter 61 and the receiver 51 over the distance D, and by the travel time of the signal returned from the receiver 51 to the transmitter 61 over this distance D.

As will be readily understood by those skilled in the art, the travel time of the returned signal is equal to the travel time of the transmitted wave only if the returned signal takes the same physical form as the transmitted wave and therefore be constituted by a wave transmitted in return symmetrically, and that the card and the reader are not moving relative to each other.

On the other hand, if the transmitted wave is a sound wave, and if the signal returned to the transmitter is transmitted by radio, the travel time of the returned signal may be neglected in front of the travel time of the wave initially transmitted.

The invention is based on the observation that a card lawfully used is normally located near the reader with which it must dialogue.

This condition of use implies that the reader and the card are in the same environment, and in particular in the same natural environment. However, this environment can be described by physical parameters such as light, temperature, humidity, etc. It can also be defined by a parameter such as the movement of objects that are in contact with each other.

One or more environmental sensors of the same type can thus be provided on the card 1 and the reader 2 to simultaneously measure these parameters. Before any exchange of sensitive data between the card and the reader, the supervision means 8 verify that the values of the measured parameters are identical on the side of the card and on the reader side.

In order not to be falsified, these values will be exchanged and compared after the establishment of a secure communication scheme.

The invention also proposes to adapt the sensors used to the application. For example an application where the physical maintenance of the card by the wearer is required for greater security may use a light sensor, a temperature sensor, or both in combination.

On the other hand, if the application allows the card to remain in a wallet, then a motion sensor will be more suitable, the reader measuring the movement of the object presented to him and the card measuring his own movement. If the two are opposite each other, then the measurements should give the same value. of the More complex combinations between sensor values are quite possible.

A concrete example of embodiment of the invention is given below.

Considering a system comprising on the one hand the two elements constituted by the card 1 and the reader 2, and on the other hand a set of sensors, namely temperature sensors 51 and light 53 carried by the card 1, and temperature sensors 52 and light 54 carried by the reader 2.

In an elementary embodiment, the card 1 and the reader 2 can simply submit to the supervision circuit 8 the signals S1 to S4 coming from their respective sensors 51 to 54, the supervision circuit having the function of verifying that the signals S1 and S2 on the one hand, and S3 and S4 on the other hand, are very close to each other.

This embodiment has the advantage of a low cost.

In a more elaborate embodiment, providing greater security, it can be expected that the reader 2 can influence its immediate environment and, in this case, the temperature and light in this environment.

For example, the transmitter 61 of the reader 2 may be constituted by a thermal element, such as a resistor or a hot or cold air current generator, making it possible to locally vary the temperature in its immediate environment by controlling the speed of variation thereof.

The reader 2 may also include a transmitter 62 constituted by a light source producing a light beam whose intensity varies in power at the rate of a pattern imposed on it.

In the case of a transaction set up between the card 1 and the reader 2, the transaction starts (after implementation of the known waking protocol and selection of the card) by the establishment of a secure communication between the reader 2 and card 1.

At the request of the reader 2, the sensors 51 to 54 measure the physical parameter to which they are sensitive and produce the measurement signals S1 to S4.

Of course, these measurements must be performed synchronously, particularly in the case in which the reader 2 modifies his immediate environment dynamically.

The card 1 and the reader 2 must therefore implement an existing procedure and well known in itself to those skilled in the art to have a common time reference.

Of course, the dynamics of variation of the temperature and the light will have to be adapted to the dynamics of response of the various concerned sensors. If the supervision means 8 are duplicated on the card 1 and on the reader 2, the comparison of the signals S1 to S4 can be carried out crosswise, the signals S1 and S3 produced on the card 1 being sent to the reader 2, and the signals S2 and S4 produced on the reader 2 being sent to the card 1.

Alternatively or cumulatively, the evolution of the signal Sl at least will be compared to the temperature modulation imposed by the thermal element 61, and the evolution of the signal S3 at least will be compared to the light intensity modulation imposed on the light source 62.

This comparison procedure enables the supervisory means 8 to deliver a signal K whose state indicates whether the card 1 and the reader 2 may or may not be considered as belonging to the same medium.

In the case where, as in the example invoked, sensors of different natures are used, and where consequently the comparison procedure comprises several elementary comparison operations likely to lead to divergent results, a hierarchy and a weighting of these The results may be used to remove any ambiguity in the determination of the state to be given to the K-signal.

For example, preference may be given to the signals produced by the most accurate sensors, these signals are therefore assigned a greater weight for their participation in the final decision-making. In summary, a transaction between a card and a reader in a system according to the invention can take place according to the following scheme:

- Emitting an electromagnetic field by the circuit 32 of the reader 2;

- Query to detect the presence of a card;

- Detection of the presence of a card and selection of the card;

- Measurement of one or more physical parameters by the sensors of the card and the reader;

- Establishment of a secure communication channel between the reader and the card; - Exchange of the measurement signals from the sensors through the secure channel;

- Comparison of the values of these signals;

- Continuing communication between the reader and the card if the comparison leads to conclude that the reader and the card are in the same environment; and

- Interruption of the communication in the opposite case.

The invention has many advantages over existing solutions.

First, the variety of sensors that can be developed on silicon is such that the choice of these sensors can be established taking into account the intended application and not the other way around. In other words, the safety gain provided by the invention will be devoid of any negative effect on the ergonomics, and this Additional security can easily be provided to any existing application.

On the other hand, the range of usable sensors is large enough that it is possible, in each case, to find sensors to prevent the user to manipulate his card to make it operational or to prohibit its use.

On the other hand, the establishment of a secure communication scheme before the exchange of data from the sensors prevents any modification of these data that would aim to bypass the security system.

Finally, the invention, in combination with an authentication of the carrier, ensures a largely sufficient security, even in the case of a use of a contactless card.

Claims

1. Identification system, the identification system comprising an identification medium

(1), a device (2) for operating the support, and verification means (7), the identification medium

(1) and the operating device (2) of the support being provided with respective communication means (31, 32) cooperating in operation to exchange by electromagnetic waves data on presentation of the identification medium (1), the means of verification (7) delivering an acceptance signal (Sa) or rejection signal (Sr) according to whether one of the identification medium (1) and the operating device (2) of the medium recognizes the other of the medium of identification (1) and the operating device (2) of the support as authentic or not, characterized in that the identification medium (1) and the operating device (2) of the support are provided with means for consultation (41, 42) to establish a concertation whose success is subject to the condition that the identification medium (1) and the operating device (2) of the support are physically separated from each other by a distance (D) at most equal to a predetermined threshold (Do), and in that the consultation means comprise influencing means (6) capable of generating a variation of the value of at least one parameter of the immediate physical environment common to the identification medium and the operating device of the device. support, the identification medium and the operating device of the medium comprising measuring means (5) able to detect the variation of the value of said at least one parameter of the physical environment in which the identification medium and the device for operating the medium are located, the system of identification comprising supervisory means (8) for inhibiting and / or canceling the acceptance signal (Sa) in case of failure of the consultation.

2. Identification system according to the claim

1, characterized in that the measuring means (5) comprise at least a first sensor (51) of a first type sensitive to a first parameter of the immediate physical environment and common to the identification medium and the device of operating the support, providing a first measurement signal (Sl) whose value is verified by the supervision means (8), and carried by one of the identification medium (1) and the operating device (2) of the support, in that the measuring means (5) comprise at least a second sensor (52) of the first type carried by the other of the identification medium (1) and the device (2) for the support, the second sensor (52) is also responsive to said first parameter, and in that the second sensor (52) provides a second measurement signal (S2) whose value is compared with that of the first measurement signal (Sl) by the means supervision (8).

3. Identification system according to claim 1 or 2, characterized in that said at least one parameter is selected from the set of physical parameters including: brightness, temperature, humidity, sound, atmospheric pressure, chemical composition of ambient air, and relative motion the identification medium and the device for exploiting the medium.

4. Identification system according to any one of claims 2 and 3, characterized in that the measurement signal from each sensor equipping one of the identification medium (1) and the operating device (2) of the support is transmitted to the other of the identification medium (1) and the operating device (2) of the support in a secure manner.

5. Identification system according to any one of the preceding claims combined with claim 2, characterized in that the first sensor (51) is a receiver of a physical field or a physical wave independent of electromagnetic waves used for the communication, in that the influencing means (6) comprise a transmitter (61) transmitting the field or the physical wave and arranged on one of the identification medium (1) and the operating device (2). ) of the support, and in that the first measurement signal (Sl) provided by the first sensor (51) is a reception signal depending on the field or the physical wave and on the distance (D) between the identification medium (1) and the operating device (2) of the support.

6. Identification system according to claim 5, characterized in that the field or the physical wave present, between the transmitter (61) and the receiver (51), a range limited to said predetermined threshold (Do).

Identification system according to claim 5, characterized in that the physical wave produced by the transmitter is time-modulated, in that the first measurement signal (Sl) delivered by the receiver (51) is returned to the transmitter (61), and in that the success of the concertation is defined by the condition that the transmitted wave and the signal returned to the transmitter (61) have a phase shift at most equal to a representative phase shift of time the path of the modulated wave from the transmitter (61) to the receiver (51) over a distance (D) at most equal to said predetermined threshold (Do), and the travel time of the signal returned from the receiver (51) to the emitter (61) over a distance (D) at most equal to said predetermined threshold (Do).

8. Device (2) for operating an identification medium, the device (2) for operating the identification medium comprising contactless communication means, characterized in that the device (2) for operating of the identification medium comprises influence means capable of generating a variation of the value of at least one parameter of the immediate physical environment in which the device (2) for exploiting the identification medium is located.

9. Identification medium, the identification medium comprising non-contact communication means, characterized in that the contactless identification medium comprises measuring means able to detect a variation of the value of at least one parameter. the immediate physical environment within which the identification medium is located.

10. A method for securing a contactless identification operation of an identification medium (1) with a device (2) for using the medium, characterized in that the security method comprises the operations consisting of to generate a variation of the value of at least one parameter of an immediate physical environment common to the identification medium and to the device for operating the medium,

to measure the variation of the value of said at least one parameter, on the one hand, of the physical environment close to the identification medium, and, on the other hand, of the physical environment close to the device of exploitation of the medium ,

- to verify that the identification medium (1) and the operating device (2) of the support are located within the same immediate physical environment, and to inhibit and / or cancel at least one effect of the identification operation in the case where the measured variation of the value of said at least one parameter of the physical environment near the identification medium is different from that of the physical environment close to the support operating device.