WO2009138641A1

WO2009138641A1 - Method of use of a host terminal by an external device connected to the terminal

Info

Publication number: WO2009138641A1
Application number: PCT/FR2009/050717
Authority: WO
Inventors: Vincent Bel; Matthieu Maupetit; Olivier Charles
Original assignee: France Telecom
Priority date: 2008-04-21
Filing date: 2009-04-17
Publication date: 2009-11-19

Abstract

The invention relates to a method of using a host terminal with the aid of an external device connected to the terminal and hosting at least one program, comprising: - during a phase of starting the terminal, a step (t33) of starting the execution of the program hosted by the external device, on the host terminal, characterized in that, the external device storing a list, so-called "white list", of identifiers of authorized terminals, there is provided: - a step (t34) of determining, by the program of the external device, an identifier of the terminal on the basis of data relating to intrinsic hardware means of the terminal, - a step (t35) of verifying the determined identifier, in the course of which the program of the external device verifies that the determined identifier belongs to the white list, the execution of the program being continued if the verification of the identifier is positive.

Description

Method of using a host terminal by an external device connected to the terminal

The present invention relates to a method of using a host terminal by an external device connected to the terminal.

The external device may be a removable storage device adapted to be connected to the host terminal. It allows the transport of a terminal execution computer environment. Such a device contains the programs and data necessary for the operation of this host terminal: operating system, network access data, user data, etc. It is at the time of startup of the host terminal that the latter loads the programs accessible via this external storage device and executes them.

WO 2007/096554 describes a solution for accessing from a host terminal to a predefined telecommunications network, from data relating to a computing environment stored in a removable external memory. To access the network from the host terminal, the user connects the removable external memory to the host terminal and then starts the host terminal. At the time of startup, the terminal loads the programs it needs (operating system, etc.) and is accessible via external memory. Thus, the connection is established from programs stored in the removable external memory. A case of use of the solution described in WO 2007/096554 may be remote access by a mobile user, working for a company, to the internal network of this company from a terminal external to the network of the company. In this case, the user connects to the external terminal to the company network a removable memory containing programs and / or computer environment data provided by the company and therefore a priori reliable. At no time are the software and data stored in the host terminal itself executed. With this, the user can access the internal network of his company from any terminal, under optimal security conditions since it is the programs and / or data of the computing environment stored in the removable external memory which are used for establish such a connection, not data stored in the terminal itself. Thus, the user does not fear any malicious programs that may be in the host terminal, since such programs are not used. One of the benefits of this solution is security.

However, such a solution makes it possible to use the computer environment stored in the external device, and therefore the programs stored therein, regardless of the program licenses that are generally issued for a specific terminal, or for a specific terminal park. .

There is therefore a need to circumscribe the ability to use a computer environment hosted in an external device, to a predefined set of terminals.

The invention responds to this need by proposing a method of using a host terminal with the aid of an external device connected to the terminal and hosting at least one program, comprising:

during a startup phase of the terminal, a step of starting the execution of the program hosted by the external device, on the host terminal, characterized in that, the external device storing a list, called "white list" , authorized terminal identifiers, it is planned:

a step of determining, by the program of the external device, an identifier of the terminal from data relating to intrinsic hardware means of the terminal; a step of checking the determined identifier, during which the program of the external device verifies the membership of the determined identifier to the whitelist, the execution of the program being continued if the verification of the identifier is positive. The method of the invention thus makes it possible to limit the use of the user's environment, stored on a portable device, to a pool of identified potential host terminals. Thus, a company that delivers to its Employees of such portable environments in a professional context is assured that these environments are used only with the aid of authorized terminals, excluding private terminals dedicated to a private use. This ensures control of the use of environments, and related programs. In particular, when such environments are subject to software licenses, this ensures compliance with licensing agreements with a software provider and therefore provides a legal framework for use.

On the other hand, it enhances the security of using such environments. Indeed, there is a risk, when launching such an environment from any terminal, that any terminal has a hardware device for recording keys entered on the keyboard (the term commonly used to designate such a device is the English term "keylogger") to retrieve usernames and passwords from the user. An attacker who obtains credentials can then impersonate the user to access the corporate network.

In one embodiment of the invention, the external device storing a boot program and an operating system, it is expected, during the terminal startup phase,

a step of executing said boot program accessible via the external device.

the execution of said boot program that triggers the operating system startup step.

In one embodiment of the invention, the method of the invention further comprises a step of verifying the integrity of the operating system hosted by the external device, performed by the boot program, the boot step of Execution of the operating system is executed only if the verification is positive.

With the invention, the launch of the user's environment is highly secure. In fact, the boot program, which can not be modified by a user, verifies during its execution the integrity of the zone comprising the operating system, the operating system, when it is executed, thus checking the whitelist of the terminals. authorized hosts. Thus, it is not possible for an attacker, to modify the system zone to possibly insert erroneous routines for the treatment of the whitelist of the authorized host terminals. In addition, the use of a public key cryptographic scheme to verify the integrity of the terminal identifier blank list does not imply any security constraints on the storage format of the public key. This key, stored either in the same memory block as the one where the boot program is stored, or in the same block where the operating system is stored, is accessible by the operating system for performing the control of the operating system. 'integrity. In one embodiment of the invention, the method comprises:

if the verification of the identifier is negative, a step of sending said identifier to an administrator,

a step of checking the identifier by the administrator to determine whether it is authorized, if the control is positive, a step of sending by the administrator of said identifier to the operating system, and

a step of recording said identifier in the authorized identifiers whitelist.

A method of updating a white list of authorized terminals in connected mode has the advantage of facilitating an eventual updating of external devices since it is not necessary for a device carrier to bring his device back to a device. administrator when the whitelist of authorized terminals needs to be updated.

In one embodiment of the invention, the white list of authorized identifiers further comprises, for at least one identifier, temporal information of validity.

The accuracy of a device expiration date on a terminal allows an administrator to control the period during which a device can be used, which can be useful when a software license is granted for a predefined period. This is the case, for example, of licenses granted on loan, for the purpose of testing. The invention also relates to a device capable of connected to a host terminal, comprising storage means containing:

- at least one program,

a list called "white list" of identifiers of authorized host terminals, said program being able, at the start of its execution, to

determining an identifier of a host terminal to which said device is connected, based on data relating to intrinsic hardware means of the terminal

- check the membership of the determined identifier to the whitelist, continue its execution only if the verification is positive.

In one embodiment of the device according to the invention, the storage means comprise a boot program and an operating system, said boot program verifying at the start of its execution the integrity of the operating system hosted by the device. external, starting the running of the operating system only running if the check is positive.

Advantageously, said program is capable, if the verification of the identifier is negative, to:

sending said identifier to an administrator able to determine if said identifier is authorized, and if necessary, to return said identifier,

- receive said identifier,

if the control is positive, a step of sending by the administrator of said identifier to the operating system, and

- register said identifier in the white list of authorized host terminal identifiers.

The invention also relates to a program intended to be installed in a memory of a storage device adapted to be connected to a host terminal, said device storing a list, called "white list", of authorized terminal identifiers, and comprising portions of code for: determining an identifier of the host terminal from data relating to intrinsic hardware means of the terminal,

- check the membership of the determined identifier to the whitelist,

- continue execution if the verification of the identifier is positive.

Other features and advantages of the present invention will be better understood on reading the description of different exemplary embodiments of the external storage device of the invention and a particular embodiment of the method of using a host terminal to using such a device, with reference to the accompanying drawings given in a non-limiting manner and in which:

- Figure 1a shows a first embodiment of the external storage device according to the invention and a host terminal;

- Figure 1b shows a second embodiment of the external storage device according to the invention and a host terminal;

- Figure 2 schematically shows a memory of the external storage device shown in Figure 1a;

FIG. 3 represents the steps of the method of using the host terminal with the external storage device of FIG. 1a, according to one particular embodiment of the invention;

FIG. 4 presents steps for updating a white list of identifiers of the external storage device of FIG. 1a, according to one embodiment of the invention.

FIG. 1a illustrates a first exemplary embodiment of the external storage device 11a of the invention and a host terminal 10a that can be used via the device 11a.

In this exemplary embodiment, the device 11a is a key, here a "USB" type key (of the "Universal Serial Bus"), comprising means for storing data.

The terminal 10a is here, in a conventional manner, a personal computer "PC" (Personal Computer) having at least one central unit of data processing, a keyboard, a screen and a communication bus for interconnecting peripheral devices to the central unit, for example a serial bus meeting the USB standard. The terminal 10a furthermore comprises at least one USB connection port, to which the USB key 1 1 can be connected. It should be noted that the terminal 10a may not include a hard disk because it is not used for setting implementation of the invention.

The terminal 10a also comprises, in a conventional manner, a memory in which is stored a BIOS (Basic Input / Output System) program, or basic input / output system. In a manner well known to those skilled in the art, this BIOS program is capable of performing a detection, when the terminal 10a is started, of internal and external peripherals of the terminal 10a, as well as the start of an operating system.

FIG. 1b illustrates a second exemplary embodiment of the external storage device according to the invention. It is in this case a communication terminal 11b, in this case a mobile phone, comprising a smart card and data storage means. The communication terminal

11 b could alternatively be a personal assistant ("PDA", for "Personal"

Data Assistant ") or other In Figure 1b, the host terminal is referenced 10b and identical to the terminal 10a of Figure 1a.

By connecting the mobile phone 1 1b to the terminal 10b via a USB cable, three devices of the mobile phone 11b are then accessible by the terminal 10b via the same USB port:

a memory of the mobile phone 1 1 b; - A network access module of the mobile phone 1 1b, in this case a mobile network access modem of the phone 1 1 b; and

- A smart card, here a SIM card ("Subscriber Identity Module"), used by the network access module for telephony applications.

In this second exemplary embodiment, the telephone 11b may act as a network card or a modem capable of providing access to the mobile network of the telephone 11b, vis-à-vis the host terminal 10b. With regard to the use of the SIM card of the network access module as a smart card, preferably uses for the terminal 10b a virtual driver as described in the patent application published under the number WO2005 / 036822. Such a driver is likely to be used with both a wired link and a non-wired link, for example bluetooth, between the terminal 10b and the communication terminal 11b. In this way, the terminal 10b can access the SIM card of the communication terminal 11b as if it were a smart card inserted into a local reader of the terminal 10b, and thus by ignoring the USB link and access constraints related to the integration of the SIM card in the environment of the communication terminal 11 b. According to the same principle, a virtual driver can also be used for controlling the access module to the network, so that access programs to the network operate in the same way as if the access module to the network was a module installed locally on the terminal 10b.

The following description refers both to the first embodiment (USB key 11a) that the second embodiment (communication terminal 11 b) of the external storage device.

The external storage device 11a (11b) comprises data storage means, comprising a memory, conventionally shared in two zones:

a system area that contains:

a file containing an operating system,

a boot program, commonly called "boot" or "bootstrap", located in first bytes of the system area, adapted to be triggered by the BIOS of a host terminal and to boot the operating system,

- a user area for hosting user data and programs: working documents, software, configuration files, etc. The invention uses a specific division of the memory of the external storage device 11a (11b), used to implement the method according to the invention.

A particular embodiment of the memory of the external storage device 11a (11b) according to the invention will now be described in relation to FIG. 2.

The memory represented in this FIG. 2 is structured, divided into four blocks 20, 21, 22 and 23. All of these blocks constitute a partition of the memory. The first memory block 20 corresponds to a secure boot area. This first block 20 comprises a boot program B20, or boot program, whose role is to trigger the loading of a kernel of an operating system in a host terminal, the kernel itself being stored in the second memory block 21. The first memory block 20 has secure write access. According to a first exemplary embodiment, this memory block is of the read-only memory (ROM) type, making it impossible to modify the data stored therein. According to a second exemplary embodiment, write access to this memory block is possible, provided that an access code is available. An update is then possible for an authorized administrator with this access code. In this second exemplary embodiment, use is made for example of a memory coupled to a smart card, for example the memory of a USB key comprising a smart card. The update is then possible:

- via the serial interface of the smart card, unlocked by the access code of the authorized administrator,

- In the case where the smart card provides means of access to a mobile network, for example by sending a "SMS" (short message service) signed. The update of the memory is then performed according to an automatic configuration mechanism called "OTA" (of the English "Over The Air"). The advantage of such an update is that it uses an interface completely controlled by a mobile operator. The authorized administrator then updates it via the operator.

The second memory block 21 is called the system area. This second block 21 comprises a single compressed file S21, digitally signed by means of a private key specific to an authorized administrator. Conventionally, a public key for verifying said digital signature is associated with the private key signature. The file S21 notably comprises data necessary for starting the operating system on the host terminal as well as for reading and operating data stored in the memory blocks 22 and 23. In particular, the file S21 comprises:

- the kernel of the operating system intended to be launched on the host terminal,

a data management driver adapted to construct a file system for accessing data stored in blocks 22 and 23 of the memory,

a device driver suitable for entering a password on the keyboard of the host terminal, or user authentication data,

A digital signature of the file S21 is stored in the memory so as to allow verification of the integrity of the file S21. This signature is stored in the system area, for example at the beginning of the memory block 21, so as to be easily accessible. The public key of the authorized administrator who signed the file S21 is stored in the memory block 20 corresponding to the boot area. Thus, the public key of the administrator is available, during the execution of the boot program, to verify the signature of the file S21.

The third memory block 22 corresponds to a configuration zone according to the invention. It comprises a configuration file C22 containing a list of signed identifiers of authorized potential host terminals that can be used via the external storage device 11a (11b). This list is called a white list. In an exemplary embodiment of the invention, the white list comprises a set of records relating to respective potential host terminals and structured, for example, as follows: [Terminal ID | administrator ID | signature of the administrator]; the character 'l' represents a concatenation.

The first "terminal identifier" field is a reference that uniquely identifies the terminal. It is determined from data relating to intrinsic hardware means to the terminal, that is to say from characteristics or parameters relating to hardware means belonging to the terminal. For example, it can be determined from one or more parameters among which: a serial number of a hard disk, a serial number of a processor, a serial number of a motherboard, a base register, a memory size, a response time of the reference system (processor, network connection, etc.), etc. A method for homogenizing the parameters may optionally be used, for the sake of simplification, so that the parameters chosen to identify the terminal belong to the same representation space. This makes it possible to have a uniform coding format for each of the parameters; such homogenization can be achieved by applying hash functions to some of the parameters. Another example of determining a unique terminal identifier is disclosed in the published application under the number EP1667486. A second identifier field of the authorized administrator is for example an administration server name allocated by the company and uniquely identifying the administration server, or an administrator name, natural person, or an identifier thereof. administrator. In the latter case, the administrator has IT resources that allow him to perform administrative operations, such as signatures, updates, etc.

The concatenation of the fields associated with the identifier of the terminal and the identifier of the administrator is digitally signed by the administrator by means of a private key specific to the administrator. The signature obtained is concatenated with the preceding fields to obtain the record relating to the terminal in the whitelist. In a first embodiment of the invention, the public key associated with the private key of the signatory administrator is stored in the first memory block 20 corresponding to the boot area.

In a second embodiment of the invention, the public key of the signing administrator is stored in the second block 21 of the memory corresponding to the system area. In both cases, the public key of the signing administrator is accessible when launching the operating system, a module of which is adapted to verify the integrity of the data relating to a terminal of the white list of identifiers. The whitelist can only be modified by an authorized administrator for whom a public key associated with a private signature key is already stored in the first block 20, or the second block 21.

It will be noted that with this list structure, where each of the signatory administrators is designated and where each record relating to a terminal identifier is signed by the designated administrator, it is possible to have different directors who are signatories of one or more whitelist records. This can be interesting in an enterprise organization where different administrators are in charge of different applications subject to software licenses, applications for which it is therefore necessary to verify that their launch on a terminal is authorized, according to the terms of the license.

In an alternative embodiment of the invention, a record of the white list relating to a particular host terminal, comprises, in addition to the terminal identifier and the identifier of the administrator, a temporal information of validity, for example a date limit, which allows the signing administrator to specify that a device can be used on the particular terminal for a limited time and until the deadline. The concatenation of these three fields is signed by the signatory administrator. This variant is useful, on the one hand to take into account deadlines for use in software licenses and on the other hand, to overcome an update of the list on the device 11a, 11b when the deadline for using a software license has arrived. The fourth block 23 corresponds to the user zone. Typically, this area of the memory includes personal files of the user. All the data and / or files of the user area is stored as a single F23 file, encrypted and preferably compressed. The user area is unlocked by a password known only to the user.

The third and fourth memory blocks 22, 23 are preferably rewritable, made for example by flash memories.

The steps of a method of using the host terminal 10a by the external storage device 11a connected to said terminal 10a, according to a particular embodiment of the invention, will now be described in relation to FIG.

The method of using the host terminal 10b via the external storage device 11b is similar to the following description.

In an initial step u30, a user 30 carrying the external storage device 11a inserts this device 11a into the USB port of the terminal 10a.

In a start step u31, the user 30 starts the terminal 10a, here by powering on.

In a step t30 I / O basic system startup, the BIOS program of the terminal 10a runs and looks for a boot program. In known manner, the BIOS program executes a device detection procedure of the host terminal 10a, which can be devices internal to the terminal and permanent, or external and removable devices connected to this terminal. Then, it searches among the detected devices, in a sequence predefined by a start list, the first device containing a boot sector including an operating system boot program. As a standard, the start list requires interrogating the devices connected to the USB bus before the internal device constituted by the hard disk of the host terminal 10a. Therefore, in the invention, it is the starting zone the external storage device 11a which is detected first and used in priority with respect to one or more hard disks possibly present in the host terminal 10a.

The BIOS program is written in a read-only memory of the host terminal 10a; it is not modifiable.

In a step d30, the external device 11a responds to the detection procedure initiated by the host terminal 10a. The BIOS program of the terminal 10a detects the presence of a storage memory on the external storage device 11a. The BIOS program reads the storage memory and then triggers the execution of the boot program stored in the boot area of the memory of the device 11a.

In a step t31 execution, the terminal 10a executes the boot program.

In a step d31, the boot program reads the system area of the memory of the device 11a.

In a test step t32, the boot program verifies the signature of the file S21 which is stored in the memory block 21 of the device 11a, by means of a public key stored in the memory block 20 corresponding to the boot zone. . In the case where the signature is not valid, then the process ends. If the signature is valid, then, in a step t33, the system kernel is loaded into a RAM of the terminal 10a and executed. In particular, the file system for accessing data stored in the memory blocks 22 and 23 is constructed. The execution of the system core comprises the execution of a routine according to the invention which causes access to the configuration area stored in the memory block 22 of the device 11a, 11b.

In a step d32, the routine reads access to the configuration file C22 stored in the memory block 22 of the device 11a.

In a step t34, the system core determines a unique identifier of the terminal 10a, based on characteristics and / or parameters relating to intrinsic hardware means of the terminal. These characteristics can for example be obtained using requests to the terminal. A system kernel interface can be used, or a specific kernel routine for obtaining these parameters.

In a search step t35, the system kernel searches for the unique identifier that it has just determined in the white list of terminal identifiers retrieved in the configuration area in step d32. If the identifier is not found in the whitelist, then an updating procedure described in connection with FIG. 4 is executed.

If the identifier is in a record of the whitelist, then in a verification step t36, the system kernel verifies the signature of this record which includes the unique identifier of the terminal. If the verification of the signature is positive, then the system kernel triggers, in a step t37, the execution of an authentication module designed to ask the user 30 to enter a password on the keyboard of the terminal 10a. .

In a step u32, the user 30 enters his password on the keyboard of the terminal 10a, which password is then analyzed by the authentication module to authenticate the user of the terminal 10a. Steps t37 and u32 may optionally involve a smart card and a device driver necessary for the operation of this smart card. If authentication fails, the process stops unless the user is allowed to perform several authentication attempts. Preferably, in case of failure, the complete start of the operating system on the terminal 10a is interrupted so that an unauthenticated user is not able to use the terminal.

In a step t38, in the event of successful authentication, the data management driver obtains a decryption key of the data of the user zone corresponding to the memory block 23. This decryption key is obtained either by interrogation of the smart card, conditional on the presentation of a valid password, or by decryption, using the password provided, a stored decryption key encrypted in the user area. The password provided by the user can also be used as a key for the encryption / decryption of data in the user area. The Data Management Driver Uses the Decryption Key to Decrypt the F23 File stored encrypted in the user area. The driver then builds in a random access memory of the terminal 10a, a logical file structure, in the form of a tree of directories and files, from all or part of the data contained in the decrypted file F23. The files of this tree are thus accessible by the user according to rights of reading, writing, execution specific files. For example, the user can launch software that is licensed on the terminal 10a since it has been verified during the steps previously described that the terminal 10a was an authorized terminal for the device 11a, in particular for launching applications of the user. In a step d34, at the request of the operating system that runs on the terminal 10a, and following commands from the user 30, the device 1 1 reads and writes in the user area.

A procedure for updating the white list of authorized terminal identifiers will now be described in connection with FIG. 4.

This procedure corresponds to an update of the white list of identifiers, called in connected mode (the term commonly used is the term "online"), because subject to conditions of access to the network as described later. This procedure is executed each time a terminal identifier is not found in the whitelist in step t35 according to FIG. 3. It consists in interrogating an administrator to know whether he authorizes the use of the terminal. terminal 10a, by the device 11 a. If necessary, the identifier of the terminal 10a is added to the authorized terminals whitelist that appears in the file C22 of the third memory block 22. An update in disconnected mode, that is to say without any precondition of access to the network, exists and has already been presented previously. It consists in updating the whitelist directly in the memory of the device.

If, during the search step t35 according to FIG. 3 which appears in dashed lines in FIG. 4, the identifier of the terminal is not found in the whitelist of authorized terminals, then, in a sending step t40, the identifier of the terminal determined in step t34 is sent to an administrator 40. recalls that an administrator is treated as an administration server. For this purpose, an update module of the operating system whitelist establishes a network connection with the administrator 40. For example, the whitelist update module uses an Ethernet connection from the terminal 10a to the network of the company. In another embodiment where the device is coupled to a SIM card, the whitelist update module uses a radio-cellular connection.

In an authorization checking step a40, the administrator 40 determines whether it allows the use of the terminal 10a as a host terminal to start the operating system contained in the device 11a. For example, the administrator 40 authorizes the use of the terminal 10a if it belongs to the terminal park of the company. In another embodiment, the launching of an operating system from the external device 11a is allowed on a predefined maximum number of terminals. If the predefined maximum number of host terminals is not reached, then the launching of the operating system of the device 11a on the terminal 10a is allowed. If the use of the terminal 10a is not allowed, then the administrator 40 returns to the update module of the whitelist running on the terminal 10a a refusal message not shown, which interrupts the launch of the operating system.

In a step a41 of sending an update, following a positive authorization check, the administrator 40 returns to the update module of the whitelist running on the terminal 10a a new record related to the terminal 10a signed by means of his private key signature.

In an update step t41, the whitelist update module updates the white list loaded in the terminal's RAM 10a, 10b by adding to the whitelist the new record received from the administrator 40 .

Claims

A method of using a host terminal with the aid of an external device connected to the terminal and hosting at least one program, comprising: during a startup phase of the terminal, a step (t33) of starting up of the execution of the program hosted by the external device, on the host terminal, characterized in that, the external device storing a list, called "white list", of authorized terminal identifiers, there is provided: - a step (t34) determining, by the program of the external device, an identifier of the terminal from data relating to intrinsic hardware means of the terminal,

a step (t35) for verifying the determined identifier, during which the program of the external device verifies the membership of the determined identifier in the whitelist, the execution of the program being continued if the verification of the identifier is positive.

2. Method according to claim 1, wherein, the external device storing a boot program and an operating system, it is expected during the terminal startup phase,

a step (t31) for executing said boot program accessible via the external device.

- The execution of said boot program triggering the step (t33) of the boot of the operating system.

The method of claim 2 further comprising a step (t32) of verifying the integrity of the operating system hosted by the external device, performed by the boot program, the boot step (t33) of Execution of the operating system is executed only if the verification is positive.

The method of claim 1 comprising:

if the verification of the identifier is negative, a step (t40) of sending said identifier to an administrator,

a step (a40) of checking the identifier by the administrator to determine whether it is authorized,

if the control is positive, a step (a41) of sending by the administrator of said identifier to the operating system, and

a step (t41) of recording said identifier in the whitelist of authorized identifiers.

5. The method of claim 1, wherein the white list of authorized identifiers further comprises, for at least one identifier, temporal information validity.

6. Device (11a, 11b) capable of connected to a host terminal, comprising storage means containing:

- at least one program,

a list called "white list" of identifiers of authorized host terminals, said program being able, at start of its execution, to determine an identifier of a host terminal to which said device is connected, from data relating to intrinsic hardware means of the terminal - check the identity of the determined identifier to the whitelist, - continue its execution only if the verification is positive.

7. Device according to claim 6, wherein the storage means comprise a boot program and an operating system, said boot program verifying at startup the integrity of the operating system hosted by the device. external, starting running the operating system only executes if the check is positive.

8. Device according to claim 6, wherein said program is adapted, if the verification of the identifier is negative, to:

- receive said identifier,

9. Program intended to be installed in a memory of a storage device adapted to be connected to a host terminal, said device storing a list, called "white list", of authorized terminal identifiers, and comprising portions of code for :

determining an identifier of the host terminal from data relating to intrinsic hardware means of the terminal, checking the membership of the determined identifier to the whitelist,

- continue execution if the verification of the identifier is positive.