WO2009135831A1

WO2009135831A1 - Information system comprising sensitive data and method of protecting these sensitive data in the memory of its apparatus

Info

Publication number: WO2009135831A1
Application number: PCT/EP2009/055401
Authority: WO
Inventors: Denis Ratier; Thierry D'athis; Philippe Dailly
Original assignee: Thales
Priority date: 2008-05-05
Filing date: 2009-05-05
Publication date: 2009-11-12
Also published as: FR2930831A1

Abstract

The present invention relates to apparatus mounted on a fixed support or to apparatus connected permanently to a remote host and protects the apparatus from any use of its sensitive data outside of its context of use. The system manages sensitive data (7). It comprises means for encrypting and decrypting (2, 6, 8) these sensitive data, and it comprises: - at least one client apparatus (1) charged with using these sensitive data (7), said client apparatus (1) comprising a volatile memory (8) storing at least one secret (5, K) for encrypting and decrypting the sensitive data; - at least one server apparatus (2) remote from the client apparatus (1) storing a secret (5) so as to generate the secret (5, K) contained in the server apparatus (1) in the latter’s initialization phase; - a communication pathway (20) between the client apparatus (1) and the server apparatus (2), the server apparatus transmitting through this pathway to the client apparatus the data for generating the secret (5, K) during the initialization phase. The invention applies in particular for securing electronic transactions between cards comprising numerical values, for example transport passes, and a payment or validation terminal.

Description

Information system comprising sensitive data and method for protecting such sensitive data in the memory of its equipment

The present invention relates to any information system comprising sensitive data. It also relates to a method of protecting these sensitive data in the memory of its equipment. The invention applies in particular to equipment mounted on a fixed support or to equipment permanently connected to a remote host. The invention protects the equipment from any use of its sensitive data outside of its context of use, which can be valuable during maintenance operations, or when the equipment is stolen for malicious purposes.

The development of transactions of all kinds, including electronic transactions, makes it increasingly necessary to protect sensitive data used for the purpose of these transactions. For example, in the field of ticketing, for tickets in particular, secrets are used to protect transactions.

For this purpose, a ticketing terminal includes a secret which is a set of cryptographic encryption keys for encrypting data and in particular transactions with a ticket, for example a smart card.

With such an encryption system, transactions between a user and a ticketing terminal can be done safely. Since it contains secrets, a terminal is thus a weak point in a chain of creation of numerical values since, for example, it can be stolen and its secrets exploited maliciously.

There is therefore a need for protection of ticketing equipment against fraudulent use of its sensitive data outside their normal context of use. Access to these sensitive data can take place during maintenance operations or when equipment is stolen for malicious purposes for example. Solutions are known to protect sensitive data in a fraudulent context. However, these solutions remain unsatisfactory in some cases.

In a first solution, a hardware security module known by the acronym SAM (Security Access Module) is used to store the secrets. As this module is the sensitive part, it should be protected by limiting the use by a server ceilings. The host equipment must periodically connect to reload its security module in order to perform value-creating operations within its new allowed limit. A disadvantage is that this solution uses a remote server requiring expensive and complex communications means to implement and test. There may also be an availability problem in the event of a server failure. Finally, if equipment controlled by this type of solution is stolen, it can still be used until the ceiling is reached.

In another solution, a software protection is used where the protection software limits the value creation function when the equipment is no longer in its context of normal use. This solution may be faulty, especially when fraudsters are able to simulate a normal use context. In addition, sensitive data and especially secrets are no longer physically protected and are accessible and usable for fraudulent purposes.

An object of the invention is in particular to allow reliable protection of sensitive data stored in equipment. For this purpose, the subject of the invention is an information system comprising means for encrypting and decrypting sensitive data, the system comprising:

at least one client device using the sensitive data, said client equipment comprising a volatile memory (8) storing at least one secret for encrypting and decrypting the sensitive data;

at least one remote server equipment of the client equipment memorizing a secret for generating the secret contained in the server equipment in the initialization phase of the latter;

a communication channel between the client equipment and the server equipment, the server equipment transmitting by this means to the client equipment the data to generate the secret during the initialization phase.

The secret stored in the volatile memory is for example the secret stored in the server equipment, said secret being transmitted by the server equipment to the client equipment during the initialization phase. For example, a client device comprises an authentication key for authentication with the server equipment, the client equipment transmitting sensitive data it receives to the server after the server has authenticated the client equipment, the sensitive data being encrypted or decrypted in the server equipment, the server equipment having an authentication key for mutual authentication with a client equipment, during the mutual authentication, a common session key being created to encrypt data exchanges between the server equipment and the client equipment, the latter decrypting the data by the server equipment, the session key of the client equipment being a secret stored in its volatile memory.

A client device may generate a secret in the form of a disposable key for encrypting or decrypting the sensitive data, said disposable key being stored in the volatile memory, the client equipment transmitting the disposable key to the server equipment that stores it, the equipment server transmitting the last disposable key stored in the client equipment during an initialization phase, the client equipment encrypting and decrypting the sensitive data by means of its disposable key. The steps for creating a disposable key may be the following: generation by a client device of a disposable key K _3-1 which is stored in the volatile memory;

transmission of said K _3-1 key to the server equipment;

encrypting and storing sensitive data using said K _3-1 key;

in an initialization phase, transmission by the server of said K _3-1 key to the client equipment which stores it in its volatile memory;

decryption of the sensitive data using said key K _3-1 ;

generation by the client equipment of a new key K ₃ , then transmission of said key K ₃ to the server; removal of the key K _3-1 after the acknowledgment of reception of the new key K ₃ by the server;

- Encryption and decryption of sensitive data with said key K ₃ .

The initialization phase follows for example a destruction of the data in the volatile memory.

Thus the initialization phase can follow a power failure of the customer equipment.

For example, the client equipment stores the sensitive data in a non-volatile memory. The sensitive data are for example the access keys of a ticket.

The customer equipment is for example a ticket validator.

The system comprises for example a client equipment and a server equipment, the latter being disposed in a base connected to the client equipment by a communication column, said column comprising the communication channel.

The power supply line connecting the customer equipment to a power source passes for example through the base and the column.

The subject of the invention is also a method of protecting sensitive data in the memory of a device comprising means for encrypting and decrypting these sensitive data, said method using a remote secret and:

said client device comprising a volatile memory storing at least one secret for encrypting and decrypting the sensitive data;

at least one remote server equipment of said equipment storing a secret for generating the secret contained in the equipment in the initialization phase of the latter, the server equipment transmitting the data to generate the secret during the initialization phase.

Other characteristics and advantages of the invention will become apparent with the aid of the following description made with reference to appended drawings which represent:

FIG. 1, an exemplary possible embodiment of a system according to the invention; - Figure 2, the function principle in another possible embodiment of a system according to the invention.

FIG. 1 illustrates an exemplary possible embodiment of a system according to the invention. This example, as well as the rest of the description, is based on a ticket validation terminal. The invention can of course apply to other types of equipment.

The device comprises a terminal 1 and a remote server 2. In the example of Figure 1, the terminal is a validation terminal of a ticket that will be called later validator. The server 2 is for example located in a base 3 located for example under a floor, a bus or a building in particular. A communication column 4 connects the validator 1 to the server 2, this column can have the form of a foot supporting the validator, or simply connected to the latter without particular support function. In the latter case, the validator can be attached to another structure, including a wall.

The server 2 contains one or more secrets 5. As indicated above, such a secret allows the validator 1 to decrypt the sensitive data 7 stored in encrypted form in its reprogrammable memory 10. The reprogrammable memory 10 is a permanent, non-volatile memory. These data are nothing other than the keys for unfolding secure access algorithms with a ticket. The sensitive data 7 are thus persistent data, that is to say, necessary for the operation of the validator 1. The sensitive data 7 must therefore be kept during the operation of the validator 1.

According to the invention, the sensitive data are then made available in a volatile memory 8 also implanted in the validator 1. This volatile memory is active only when it is supplied with electrical energy, that is to say that his data disappear as soon as his power supply is cut off. In particular, the memorized secret (s) disappear and are therefore no longer accessible in the event of a cut, which renders inoperative the theft of such equipment. The volatile memory can therefore lose its content in the event of a threat to the security of the client equipment, for example the validator 1. Thus any fraudulent use of the secrets by theft or unauthorized access is impossible since they have disappeared.

At each startup, or restarting, a power-up is performed where the device according to the invention executes an initialization phase reconstituting the secrets in the volatile memory 8 so that the processor 6 of the equipment reconstitutes the secrets (data sensitive 7) allowing it to execute transactions. For this purpose, on powering up the processor 6 of the validator 1 accesses the secret reading 5 contained in the server 2 via the communication column 4. For this this column comprises for example a communication bus 20 connecting the processor 6 to the server 2, and more particularly to the memory containing the secret 5. This secret 5 is contained in a memory of the non-volatile server, that is to say a permanent memory where the data remain inscribed even in the absence of power supply . The server 2 also includes conventional components enabling it to interface and communicate with the communication bus.

After switching on, the secret 5 stored permanently in the server 2 is transmitted by the communication bus 4 to the validator 1, then it is copied 9 to the volatile memory of the validator 1, the time of the period of use following.

Conversely, in the presence of sensitive data to be protected, entered or received by the terminal 1, the processor 6 uses the secret hosted in its volatile memory 8. The cryptogram obtained can then be written in reprogrammable memory 10, thus non-volatile, for backup and later reuse.

In case of power failure, after recovery, the processor 6 of the terminal can decrypt 1 1 cryptogram contained in its reprogrammable memory 10 and find its sensitive data that if he knows the secret 5. The initialization phase must then to be executed again to copy the secret 5 in the volatile memory 8 of the terminal 1. This reset phase where the secret 5 is copied to the volatile memory 8 is only possible if the terminal 1 can access the server 2.

Alternative embodiments of a device according to the invention are possible. The secret 5 can for example be assigned according to the needs, by equipment or terminal 1, by category of terminal, for all equipment in operation excluding maintenance workshops, which have their own dedicated secrets, or any relevant partition. In the latter case, it is possible to cut the secret into a number n of parts and store it in several devices of the type of that of Figure 1. The secret is then distributed between several devices. In the example of an articulated bus the secret can be distributed between several devices according to a predefined distribution law. The secret is distributed in servers 2, each inside a base for example, distributed in the bus.

Figure 2 shows the principle of operation of a possible embodiment.

The secret 5 is no longer hosted in the memory of a server located in the base 3, but resides in a security module 24 of a host equipment. The host device may be a remote server 2 of the terminal 1. As in the previous embodiment, the server 2 may be shared between several terminals 1, or client equipment. Encryption and decryption of the data are no longer performed in the terminal 1 but in the server 2. The transmission of the sensitive data 7 must then be secured between the terminal 1 and the server 2. Authentication keys may be necessary to enable mutual authentication between the two devices 1, 2. A session key is also necessary for the terminal 1 to decrypt the sensitive data 7 transmitted by the server. This session key is stored in the volatile memory 8 of the terminal 1.

Thus, at power up during an initialization phase, the client equipment 1 mutually authenticates with the server equipment 2 using an authentication key, symmetrical or asymmetrical. A common session key is created during this initialization phase allowing the encryption of future exchanges or transactions, in order to protect the link between client equipment and the server 2.

When the client equipment is powered up, the session key is created from a shared secret which is the authentication key. Thus, in the presence of sensitive data 7 to be protected, entered or received, the client equipment 1 encrypts this data 7 with the session key 25 and the addresses 22 with the server equipment 2. The server equipment decrypts the data 7 using the session key and the digit with the secret 5. This secret can be optionally a key diversified by equipment to limit the number of keys in the security module. In the case of a diversified key, a new key is generated from an existing key.

The cryptogram thus created is sent 23 to the client equipment 1. This cryptogram can then be written in the reprogrammable memory 10 of the client equipment 1 for backup and subsequent use. The cryptogram is encrypted with the secret 5 and can only be used if decrypted by the server 2 which is the only one to know the secret 5.

In the event of a power failure, after recovery, the client device 1 can not recover its sensitive data until it has correctly authenticated with the server equipment 2. The client equipment 1 sends the cryptogram that it has stored previously to the server equipment 2 which decrypts it with the secret 5 corresponding to the client equipment, and re-encrypts it with the session key, to send them to the client equipment 1. The latter can finally retrieve its sensitive data by deciphering them with the session key. In this variant, the secret can be stored on one or more servers with the authentication key. When a client device is powered up, the session key is created and then the encrypted secret is sent with the session key, this session key being created from a shared secret which is the key of the session key. authentication.

Another variant embodiment is possible when the sensitive data are of a volume that is too large to support encryption, transmission and decryption in numbers, taking into account the hardware performance and the establishment or backup delays. While in the previous variant embodiment, the sensitive data are transmitted to the server equipment 2 which encrypts or decrypts the sensitive data by means of the secret 5 that it stores, in this variant embodiment the sensitive data 7 is not transmitted. to the server equipment and encryption and decryption is performed in the client equipment 1, by means of a disposable key. In this embodiment, the client equipment 1 therefore proceeds to a random draw of a disposable key K, encrypts its sensitive data with this key K and saves the large cryptogram obtained in its reprogrammable memory 10. In the event of a break in power supply, after recovery of this power supply, the client equipment 1 can find its sensitive data after receiving its initial K disposable key of the server equipment. As soon as the client equipment is turned back on, it sends a request to the server equipment which transmits the key K. The transmissions of the key K, or secret K, between the server equipment 2 and the client equipment 1 can be done encrypted using a session key as described above.

The process stages are divided into a preparation phase and an exploitation phase. The preparation phase comprises the following steps:

generation by a client device 1 of a disposable key K _3-1 which is stored in the volatile memory 8;

transmission of the key K _3-1 , stored in the volatile memory 8, to the server equipment 2; - encryption of sensitive data using the K _3-1 key and storage in non-volatile memory;

in case of disconnection of the client equipment 1, the key K _3-1 is destroyed in the volatile memory;

As a result of this disconnection, when the client equipment is connected and authenticated again, the operation phase is executed according to the following steps:

- transmission by the server 2 of the K _3-1 key to the client equipment;

- decryption of the sensitive data using the key K _3-1 ; then possibly: - generation of a key K ₃ , then transmission of the key K ₃ to the server;

removal of the key K _3-1 after the acknowledgment of reception of the new key K ₃ by the server;

- encryption of sensitive data with K ₃ key and storage in non-volatile memory. This process is performed again for the generation of another K _{3 + 1} disposable key.

Claims

1. Information system comprising sensitive data (7) and persistent to protect, characterized in that it comprises:

at least one client equipment (1) using the sensitive data (7) stored in its permanent memory (10), said client equipment (1) comprising encryption and decryption means (6) protecting the sensitive data (7), a volatile memory (8) storing at least one secret (5, K) for encrypting and decrypting the sensitive data (7);

at least one server equipment (2) remote from the client equipment (1) storing a secret (5, K) for encrypting and decrypting the sensitive data (7) contained in the client equipment (1);

- A communication channel (20) between the client equipment (1) and the server equipment (2), the server equipment (2) transmitting this way to the client equipment the secret (5, K) when the initialization phase.

2. System according to claim 1, characterized in that the secret (5, K) stored in the volatile memory (8) of the client equipment (1) is the secret (5, K) stored in the server equipment ( 2), said secret (5, K) being transmitted by the server equipment (2) to the client equipment (1) during the initialization phase.

3. System according to any one of the preceding claims, characterized in that a client equipment (1) comprises an authentication key (25) to authenticate with the server equipment (2), the client equipment transmitting sensitive data (7) that it receives to the server (2) after the latter has authenticated the client equipment (1), the sensitive data (7) being encrypted or decrypted in the server equipment (2), server equipment (2) having an authentication key (24) for mutual authentication with a client equipment (1), during the mutual authentication, a common session key being created to encrypt the data exchanges between the server equipment (2) and the client equipment (1), the session key of the client equipment (1) being a secret (5, K) stored in its volatile memory (8).

4. System according to any one of the preceding claims, characterized in that the client equipment (1) decrypts the sensitive data (7) by the server equipment (2).

5. System according to any one of claims 1 to 3, characterized in that a client equipment (1) generates a secret in the form of a disposable key (K) for encrypting or decrypting the sensitive data, said disposable key (K) being stored in the volatile memory (8), the client equipment transmitting the disposable key to the server equipment (2) which stores it, the server equipment (2) transmitting the last disposable key (K) stored in the equipment client (1) during an initialization phase, the client equipment encrypting and decrypting the sensitive data by means of its disposable key (K).

6. System according to the preceding claim, characterized in that the steps of creating a disposable key (K) are as follows:

- Generation by a client equipment (1) of a disposable key K _3-1 which is stored in the volatile memory (8);

transmission of said K _3-1 key to the server equipment (2); - encrypting and storing sensitive data (7) using said key K ₃ -i;

in an initialization phase, transmission by the server (2) of said key K _3-1 to the client equipment (1) which stores it in its volatile memory (8); decryption of the sensitive data using said key K _3-1 ;

generation by the client equipment (1) of a new key K ₃ , then transmission of said key K ₃ to the server;

removal of the key K _3-1 after the acknowledgment of reception of the new key K ₃ by the server; - Encryption and decryption of sensitive data with said key K ₃ .

7. System according to any one of the preceding claims, characterized in that the initialization phase follows a destruction of the data in the volatile memory (8).

8. System according to claim 6, characterized in that the initialization phase follows a power failure of the client equipment (1).

9. System according to any one of the preceding claims, characterized in that the client equipment (1) stores the sensitive data in a non-volatile memory (10).

10. System according to any one of the preceding claims, characterized in that the sensitive data (7) are the access keys of a ticket.

11. System according to claim 10, characterized in that the client equipment (1) is a ticket validator.

12. System according to any one of claims 10 or 1 1, characterized in that it comprises a client equipment (1) and a server equipment (2), the latter being disposed in a base (3) connected to the customer equipment by a communication column (4), said column comprising the communication channel (20).

13. System according to claim 12, characterized in that the power supply line (12) connecting the customer equipment (1) to a power supply (19) passes through the base (4) and the column ( 4).

14. A method for protecting sensitive data (7) in the memory of a device (1) comprising means for encrypting and decrypting (2, 6, 8) these sensitive data characterized in that said method uses a remote secret (5, K): said client equipment comprising a volatile memory (8) storing at least one secret (5, K) for encrypting and decrypting the sensitive data (7);

at least one server equipment (2) remote from said equipment (1) storing a secret (5) for generating the secret (5, K) contained in the equipment (1) in the initialization phase of the latter, the server equipment transmitting the data to generate the secret (5, K) during the initialization phase.

15. Method according to claim 14, characterized in that the secret (5, K) stored in the volatile memory (8) is the secret (5, K) stored in the server equipment (2), said secret being transmitted by the server equipment to the equipment (1) during the initialization phase.

16. Method according to any one of claims 14 or 15, characterized in that the equipment (1) comprises an authentication key (25) to authenticate with the server equipment (2), the equipment (1) transmitting sensitive data that it receives to the server after the latter has authenticated the equipment (1), the sensitive data being encrypted or decrypted in the server equipment (2), the server equipment (2) comprises an authentication key (24) for performing mutual authentication with the equipment (1), during the mutual authentication, a common session key being created to encrypt the data exchanges between the server equipment (2) and the equipment (1), the latter decrypting the data by the server equipment (2), the session key of the equipment being a secret stored in its volatile memory (8).

17. Method according to any one of claims 14 to 16, characterized in that the equipment (1) generates a secret in the form of a disposable key (K) for encrypting or decrypting the sensitive data, said disposable key being stored in the memory. volatile memory (8), the equipment (1) transmitting the disposable key to the server equipment (2) which stores it, the server equipment (2) transmitting the last disposable key (K) stored in the equipment (1) ) during an initialization phase, the device (1) encrypting and decrypting the sensitive data by means of its disposable key (K).

18. The method of claim 14 to 17, characterized in that the steps of creating a disposable key are as follows:

- Generation by the equipment (1) of a disposable key K _3-1 which is stored in the volatile memory (8); transmission of said K _3-1 key to the server equipment (2); encrypting and storing the sensitive data (7) using said key K _s -i;

in an initialization phase, transmission by the server (2) of said key K _3-1 to the equipment (1) which stores it in its volatile memory (8);

decryption of the sensitive data using said key K _3-1 ;

- Generation by the equipment (1) of a new key K ₃ , then transmission of said key K ₃ to the server;

- Encryption and decryption of sensitive data with said key K ₃ .

19. Method according to any one of claims 14 to 18, characterized in that the initialization phase follows a destruction of the data in the volatile memory (8).

20. The method of claim 19, characterized in that the initialization phase follows a power failure of the equipment (1).