WO2010057828A1

WO2010057828A1 - Method and device for diagnosing the first reception of an identifier, detection method, storage medium and computer software for said method

Info

Publication number: WO2010057828A1
Application number: PCT/EP2009/065050
Authority: WO
Inventors: Haythem Gadacha
Original assignee: Viaccess
Priority date: 2008-11-20
Filing date: 2009-11-12
Publication date: 2010-05-27
Also published as: EP2356608B1; DK2356608T3; EP2356608A1; CN102224507B; FR2938678B1; RU2494454C2; ES2392678T3; TWI417759B; FR2938678A1; TW201020854A; RU2011124923A; PL2356608T3; CN102224507A

Abstract

The method of the invention comprises: a) determining (64, 68) at least one limit based on N already received identifiers, where N is strictly higher than the number of identifiers that can be contained in an anti-replay memory, the limit being determined so as to define, on the one hand, a range of identifiers that have not yet been received and, on the other hand, a range of identifiers containing the N already received identifiers; b) comparing (58) the newly received identifier to said limit; c) if the newly received identifier belongs to the range identifiers that have not yet been received, diagnosing (60) a first reception of the newly received identifier; and d) if the newly received identifier belongs to the range of identifiers containing the N already received identifiers, searching (73) the newly received identifier among those contained in the anti-replay memory.

Description

METHOD AND DEVICE FOR DIAGNOSING THE FIRST RECEPTION OF AN IDENTIFIER, DETECTION METHOD, RECORDING MEDIUM, AND COMPUTER PROGRAM FOR THIS

PROCESS

The invention relates to a method and a device for automatically diagnosing the first reception of an identifier. The invention also relates to a method for detecting a replayed message as well as a recording medium and a computer program for carrying out these methods.

To illustrate the interest of a method of diagnosis of the first reception of an identifier, we place ourselves in a context where a terminal receives encrypted multimedia contents. In such a context, a module generally called DRM (Digital Rights Management) or CAS (Conditional Access System) agent is executed in the terminal or in a smart card connected to this terminal. This DRM or CAS agent is responsible for checking the conditions of access to the encrypted multimedia content. If the access conditions are fulfilled, it allows the decryption of the multimedia content. Otherwise, decryption is prohibited. For example, access conditions are the possession of a valid license or valid access right. For simplicity, we assume here that the access conditions are a license that includes:

a key CEK for decrypting the multimedia content,

a set of rights defining authorized actions on the decrypted multimedia content, such as its visualization, printing, backup or other, and

constraints limiting the consumption of these rights, such as a cumulative maximum duration T ₀ of use of the multimedia content or a maximum number N ₀ of uses of the multimedia content. Under these conditions, a malicious user can save the message containing the license and then present it again to the DRM or CAS agent from time to time as if it were a new message. This repeated message presentation action is called message replay. The attempt to replay messages is called a replay attack. When the terminal can communicate bidirectionally with the license server that issues the message containing the license, there is an effective solution to combat replay attacks. This solution consists of inserting a random number drawn by the terminal into each request or license request sent by the terminal to the server. The message containing the requested license that is issued by the server to the terminal contains the same random number retrieved in the request. Therefore, the DRM agent or CAS can simply diagnose a replay attack by comparing the random number issued to that received in response. However, this solution requires two-way communication between the terminal and the server. However, such two-way communication is not always possible. For example, there are situations where messages can be transmitted only from the server to the terminal but not in the other direction.

In the case where bidirectional communication is not possible, it is known to include a UID in each message that we do not wish to see replayed. The UID identifier uniquely identifies this message from a set of messages that can be generated. When this message is received for the first time, the terminal stores the UID identifier in an anti-replay memory of the terminal. This anti-replay memory is sometimes called an anti-replay cache. On the other hand, if this message is received for the second time or more, the terminal detects this attack by replay by searching the UID identifier contained in the message among those already contained in the anti-replay memory. If the UID is already in the anti-replay memory, it means that this message has already been received and is therefore a replayed message. The diagnostic method implemented therefore comprises: a) searching for a newly received identifier among those contained in an anti-replay memory to diagnose whether it is the first reception or not of this newly received identifier, this anti-replay memory that can contain at most M identifiers.

The effectiveness of this diagnostic method of the first reception of a UID and therefore the detection of a replayed message is limited by the size of the anti-replay memory. Indeed, a memory necessarily has a limited size. The size of the anti-replay memory depends on the terminal used but can be particularly reduced when the DRM or CAS agent is in a smart card.

The anti-replay memory can therefore contain only a limited number of UID identifiers. The maximum number of recordable UID identifiers in the anti-replay memory is here denoted M. Therefore, after having received for the first time M messages and thus M UID identifiers, it is necessary to erase certain UID identifiers of the anti-replay memory for ability to register new UID credentials received It is therefore possible to replay messages whose UIDs have been deleted.

The invention aims to improve the efficiency of the diagnostic method of the first reception of an identifier.

It therefore has for object such a method comprising: b) the construction of at least one limit as a function of N identifiers already received, where N is strictly greater than M, this limit being constructed so as to delimit on one side a range identifiers that do not have have been received and on the other side a range of identifiers containing the N identifiers already received, c) the comparison of the newly received identifier to this limit to determine if the newly received identifier belongs to the range of identifiers which n have not yet been received, d) if the newly received identifier belongs to the range of identifiers that have not yet been received, the diagnosis of a first receipt of the newly received identifier and a new construction of the limit based on the newly received identifier, and e) if the newly received identifier belongs to the range of identifiers containing the N identifiers already received, the execution of step a). In the above method, since the limit is calculated according to more identifiers already received than the M identifiers contained in the anti-replay memory, this limit intrinsically retains the trace of a number of identifiers strictly greater than Thus, at least when the newly received identifier belongs to the range of identifiers that have not yet been received, the degree of certainty about the diagnosis is higher than that obtained at the end of the step a). The efficiency of this process is therefore improved. Embodiments of this diagnostic method may include one or more of the following features: a the method comprises: constructing said limit for different classes of identifiers, for each class of identifiers the boundary associated with that class being constructed in function of the N identifiers already received and belonging to this class of identifiers, the identification of the class of identifiers to which the newly received identifier belongs among the existing identifier classes, and - the step c) consists in comparing the newly received identifier at the limit associated with the identified class and not comparing the newly received identifier to the limits associated with the classes to which it does not belong; the method comprises: - the identification, using a predetermined distribution law of the different identifiable identifiers in different sections of the anti-replay memory, the section of the anti-replay memory in which the newly identified identifier received is recordable, among several existing sections, and - during step a), the search for the newly received identifier only among the identifiers contained in the section identified from the anti-replay memory and not from the identifiers contained in the sections of the replay memory in which the newly received identifier is not recordable; the method comprises: counting the number of newly received identifiers during a time interval, comparing this number with a predetermined threshold, and if and only if the predetermined threshold is crossed, detecting a replay attack; ; the method comprises: counting the number of identifiers, during a time interval, for which it is diagnosed that they are not received for the first time, comparing that number to a predetermined threshold, and - if and only if this threshold is crossed, the detection of a replay attack; B if step d) is executed, step a) is not executed for this newly received identifier;

B the construction of the limit includes the determination of a lower bound or an increase of the N identifiers already received.

These embodiments of the diagnostic method also have the following advantages:

the fact of distributing the identifiers into classes of identifiers and having a limit for each class of identifiers makes it possible to increase the efficiency of the process by increasing the number of cases in which the step a) does not have to be executed,

searching for the newly received identifier only among the identifiers contained in a particular section of the anti-replay memory makes it possible to diagnose the first reception of an identifier more quickly,

counting the number of newly received identifiers and comparing this number with a threshold makes it possible to detect replay attacks,

the count of the number of identifiers that are not received for the first time and the comparison of this number with a threshold also makes it possible to detect attacks by replay, the non-execution of step a) when the step d) is executed allows a gain in execution time because it is possible to diagnose the first reception of an identifier without having to search for this newly received identifier among the identifiers contained in the anti-replay memory.

The subject of the invention is also a method for detecting a replayed message, each message containing an identifier making it possible to distinguish it from other messages, this method comprising a diagnosis automatically from the first reception of the identifier to establish whether a received message is replayed, in accordance with the diagnostic method above.

The invention also relates to an information recording medium and a computer program comprising instructions for performing one of the above methods, when these instructions are executed by an electronic computer.

Finally, the subject of the invention is also a device for automatically diagnosing the first reception of an identifier, this device comprising:

a search module for a newly received identifier among those contained in an anti-replay memory,

the anti-replay memory, this memory possibly containing at most M identifiers to which the newly received identifier can be compared,

a constructor of at least one limit as a function of N identifiers already received, where N is strictly greater than M, the limit being constructed so as to delimit on one side a range of identifiers which have not yet been received and on the other side a range of identifiers containing the N identifiers already received,

a comparator of the newly received identifier at this limit for determining whether the received identifier belongs to the range of identifiers that have not yet been received, this comparator being able to:

- to diagnose a first reception of the newly received identifier if this new identifier belongs to the range of identifiers that have not yet been received and to activate the constructor to launch a new construction of the limit according to the newly identified identifier received, and

to activate the search module to start the search for the newly received identifier among those contained in the anti-replay memory if the newly received identifier belongs to the range of identifiers containing the N identifiers already received.

The invention will be better understood on reading the description which follows, given solely by way of nonlimiting example and with reference to the drawings in which:

FIG. 1 is a schematic illustration of the architecture of an information transmission system equipped with a device for diagnosing the first reception of an identifier,

FIG. 2 is a schematic illustration of a portion of a message transmitted in the system of FIG. 1,

FIG. 3 is a flowchart of a method for detecting a replayed message using the diagnostic device of the system of FIG. 1. In these figures, the same references are used to designate the same elements.

In the remainder of this description, the features and functions well known to those skilled in the art are not described in detail. Figure 1 shows a system 2 for transmitting information. As an illustration, this system is a system for transmitting encrypted multimedia content. It contains a license server 4 connected to a multitude of terminals via a network 6 for transmitting information. For example, the network 6 is a satellite information transmission network.

To simplify Figure 1, only a terminal 8 has been shown.

The server 4 sends messages to the terminals. These messages contain licenses that allow each terminal to decrypt previously received multimedia content. For this purpose, the server 4 comprises a generator 10 of UID identifiers. This generator 10 generates for each message sent by the server 4 a UID identifier which uniquely identifies this message among the set of sent messages. For example, the identifier

UID is obtained by building a digital thumbprint of the license using functions such as a hash function. The UID can also be obtained by drawing a random number.

The required size of the UID is a function of the number of terminals to which messages are to be transmitted and the number of messages transmitted to each terminal. Here, the number of messages transmitted to each terminal corresponds to the number of licenses purchased from this terminal. Typically, the UID is coded on 16 bytes.

The terminal 8 receives the messages transmitted by the server 4. For example, this terminal 8 is a decoder capable of receiving a license and the multimedia content encrypted then decrypting using the key contained in the license the multimedia content to allow its display in clear on a screen 10. The terminal 8 comprises a device 12 for automatic diagnosis of the first receipt of a UID. To simplify the illustrations, the device 12 is shown outside the terminal 8. However, in practice, this device 12 is integrated in the terminal 8 or implanted in a security processor connected to the terminal 8. For example, the security processor is a smart card. Typically, the device 12 is part of a DRM or CAS agent.

The device 12 comprises an anti-replay memory 14. Here, this memory 14 is divided into several sections SE ₁ . The intersection of any two sections SE ₁ is zero.

The device 12 also comprises an electronic calculator 16 able to diagnose the first reception of a UID identifier. For this purpose, this calculator 16 comprises: a module 20 for searching for UID identifiers among those contained in the memory 14,

a comparator 22 of the newly received identifier at limits,

a manufacturer 24 of the limits used by the comparator 22, a counter 26 of UID identifiers received, and

a counter 28 of replayed messages.

These elements are connected to each other as well as to the memory 14 and a memory 30 by a communication bus.

Here, the domain of the values of the identifiers UID is partitioned into different classes C _j . Each UID is therefore classified in a class C _j . For this purpose, a predetermined classification function f _c is used. This function f _c returns for each UID identifier the index [of the class to which it belongs. Here, the function f _c is such that the union of the set of classes C _j corresponds to the set of UID identifiers that can be generated in the system 2. Preferably, the two by two intersection of the classes C _j is empty. Thus, a given UID can belong to only one class C _j . Each class C _j groups together several possible UID identifiers.

Preferably, this function f _c is secret. For example, the function f _c is the function that returns the result of the integer division of the newly received UID by 2 ^{m ~ 8} where m is the maximum number of bits that can be used to code an UID in the system. , such a function f _c divides the set of identifiers UID that can be generated in ²⁸ classes. The result of this function identifies the class to which the newly received UID belongs. The memory 30 includes in particular an associative table 32. This table 32 associates with each class C _j of identifiers a limit S _mmj and a limit S _m ax _j constructed by the constructor 24. The limit S _mnj is a minor of the identifiers UID already received and belonging to the class C _j . Conversely, the limit S _m ax _j constitutes an upper bound for these same UID identifiers already received. Thus, these limits delimit a range [Smin _j ! S _ma χ _j ] containing all the identifiers UID already received and belonging to the class C _j . These limits also delimit two ranges] -2 ^{m "1} ; S _mnnj [and] S _m a _XJ ; + 2 ^{m" 1} ] UID identifiers that have not yet been received, where m is the maximum number of bits usable for encoding an identifier UID in the system 2. Here m is equal to 128. The counters 26 and 28 are connected to a reliable clock 34.

The computer 16 is for example a programmable computer capable of executing instructions recorded on an information recording medium. For this purpose, the computer 16 is connected to a memory 36 containing a program consisting of instructions for executing the method of FIG. 3. FIG. 2 represents a portion of a message transmitted from the server 4 to the terminal 8. This message contains a license L. The license L contains an identifier UID, a cryptographic key CEK, exploitation rights DE, constraints CT and a MAC signature to verify the integrity of the license. The MAC signature is calculated on the entire content of the license taking into account, in particular, the UID.

The exploitation rights as well as the constraints on these rights of exploitation have been defined in the introduction to this description.

The operation of the system 2 will now be described in more detail with regard to the method of FIG. 3.

Initially, during a step 50, the terminal 8 receives a new message transmitted by the server 4 through the network 6.

During a step 52, the terminal extracts the identifier UID contained in the message and transmits it to the device 12. More specifically, the extracted UID identifier is contained in the license L. The identifier thus transmitted to the device 12 constitutes the newly received UID.

In a step 54, the device 12 identifies the class C _j to which the newly received UID belongs. For this, the function f _c is applied to the newly received UID. Then, during a step 56, the device 12 searches in the table 32 what are the limits Smin _j and S _ma χ _j associated with the class C _j identified in step 54. The limits thus found are then used to all the steps described below.

In a step 58, the comparator 22 compares the newly received UID with the limits S _mιnj and S _m a _XJ found in step 56. If the newly received UID belongs to the range] - 2 ^{m ~ 1} ; S _m m _j [or] S _ma χ _j ;

+2 ^{m "1} [, then it is proceeded to a step 60. In the opposite case, one proceeds to a step 62.

In step 60, it is diagnosed, without making any comparison of the newly received UID to those in the memory 14, that this identifier is received for the first time. Therefore, the received message is not identified as a replayed message. For example, this information is sent to the terminal 8 which accepts the received message and processes it. The processing consists, for example, in extracting the CEK key from the license and then decrypting the multimedia content with this key in order to be able to display it on the screen 10.

In step 60, the case where the UID is strictly greater than the limit S _ma χ _j is discriminated from the case where the UID is strictly less than the limit Sminj- If the UID is strictly greater than the limit S _ma χ _j , then during a step 64, a new value of the limit S _ma χ _j is constructed according to the newly received UID. Indeed, the current value of the limit Smax _j is no longer an upper bound of the identifiers UID already received and belonging to the class C _j . For example, constructing the new value of the limit S _m a _XJ is to replace its current value with the value of the newly received UID.

Once the new value of the limit S _ma χ _j has been constructed, during a step 66, it is stored in the table 32 in place of the old value.

In the case where the newly received UID is strictly less than the limit Smin _j , in a step 68, a new value of the limit Smin _j is constructed from the value of the newly received UID. Indeed, in this case, the current value of the limit S _mιnj is no longer a minor of the identifiers UID already received and belonging to the class C _j . For example, constructing the new value of the limit Smin _j is to replace its current value with the value of the newly received UID.

In a step 70, the new value of the limit Smin _j is stored in the table 32 instead of its old value.

At the end of step 66 or step 70, there is carried out a step 71 of identifying the section SE ₁ in which the old value of the limit S _m a _XJ or S _mιnj must be recorded. . Indeed, the old value of the limit is that of an identifier UID received for the first time but which has not yet been recorded in the memory 14. It is therefore treated as a UID received for the first time. Thus, in the following of these explanations, this old value of the limit is called "newly received UID identifier". For this purpose, a predetermined distribution function f _d is used. This fd function returns for each UID identifier the index i of the section in which it must be registered. Here, the function f _d is surjective. In addition, it associates with each UID identifier that can be generated a single index i. Thus, a given UID can only be registered in a single section SE ₁ . Each SE ₁ section allows you to register multiple UIDs. On the other hand, the size of each section SE ₁ can not contain all the identifiers UID which can be generated in the system 2 and which are recordable in this section.

For example, the function f _d is identical to the function f _c . In this case, it is possible to use the result of step 54. Another example of function f _d is the function that returns the remainder of the UID modulo 1024, which in this case makes it possible to group the identifiers in 1024 sections.

Then, in a step 72, the newly received UID is registered in the section identified in step 71. If this section is not full, the newly received UID is registered in addition to the UIDs. already contained in the same section. On the other hand, if the section SE ₁ of the memory 14 is already full, the identifier UID is registered instead another UID in the same section. This other UID identifier may for example be chosen at random or on the first-in, first-out basis.

At the end of step 72, the method returns to step 50. Step 62 consists in determining in which section SE ₁ must be registered the newly received UID. This step is identical to step 71.

Then, during a step 73, the newly received UID identifier is searched for only among the identifiers registered in the section identified during step 62. It is therefore clear that the distribution of the UID identifiers in different sections of the memory at the end of the memory. Using the function f _d makes _it possible to accelerate this comparison since only part of the identifiers stored in the memory 14 must be compared with the newly received UID. If the newly received UID is identical to one of those stored in the memory 14, then, in a step 74, the device 12 diagnoses that it is not the first reception of this identifier. As a result, the message containing this identifier has been replayed. This information is communicated to the terminal 8. This identification of a replayed message triggers in the terminal 8 corrective or coercive measures. For example, the replayed message may be denied so that the CEK key is not extracted from the license, which makes it impossible to decrypt the media content.

In the case where the newly received UID is not in the section identified in step 62, then, during a step 76, the device 12 diagnostics that this UID is received for the first time. This information is communicated to the terminal 8 which reacts accordingly. For example, the terminal 8 accepts the received message, extracts the license and in particular the key CEK which authorizes the decryption of the multimedia content with the extracted key.

Then, in a step 78, the newly received UID is registered in the section identified in step 62. This step is identical to step 72.

At the end of step 74 or 78, the process returns to step 50. Here, the value of the limit S _ma χ _j is built by induction from the old value of the limit S _ma χ _j and the newly received identifier. Consequently, the value of the limit S _m a _XJ is a function of the N identifiers already received and belonging to the same class Cj. The value of the limit S _ma χ _j is not reset. Thus, rapidly, this number N exceeds the number M of recordable identifiers in the memory 14 and to which the newly received identifier can be compared. In the case where the memory 14 is divided into several sections, the number M corresponds to the maximum number of recordable UID identifiers in section SE ₁ . Indeed, here, the newly received identifier is only searched among those contained in the section SE ₁ in which it must be registered. It is the same for the construction of the limit Ominj-

In parallel with steps 50 to 78, the device 12 proceeds to a phase 84 of identification of a massive attack by replay.

Initially, during a step 86, the current instant t ₀ given by the clock 34 is recorded by the counter 26. At the same time, a counter Nm-c is initialized to zero.

Then, in a step 88, for each newly received UID, the counter Nm-c is incremented by one. Then, during a step 90, the counter Nm-c is compared with a predetermined threshold Nm-s. This threshold Nm-s is for example fixed by the operator. For example, its value is 40. If the counter Nm-c has not reached the value of the threshold Nm-s, then the process returns to step 88.

If the counter Nm-c has reached the value of the threshold Nm-s, then the current instant ti is recorded by the counter 26.

Then, during a step 92, the time interval Δt _c between the instants t ₀ and t i is compared with a predetermined time threshold Ts. This threshold Ts is fixed by the operator. For example, this threshold is equal to 6 hours.

If the interval Δt _c is below the threshold Ts, during a step 94, the device 12 detects a massive attack by replay. Indeed, a massive attack by replay results in the sending of an unusually high number of UID identifiers over a short period of time. Otherwise, no replay attack is detected. If a replay attack is detected, this information is communicated to the terminal 8. In response, the terminal 8 initiates corrective or coercive measures.

Phase 84 is repeated from time to time. In parallel with the phase 84, another phase 100 of detection of a massive attack by replay is executed.

Initially, during a step 102, the counter 28 records the current time t ₀ and initializes a counter Nm-r to zero.

Then, during a step 104, the counter Nm-r is incremented by one each time a UID is diagnosed as having already been received. Then, in a step 106, the counter Nm-r is compared with a threshold Nm-r-s. The value of this threshold Nm-r-s is for example ten.

As long as the counter Nm-r is below this threshold Nm-rs, step 104 is repeated. On the other hand, in the opposite case, the counter 28 records the current instant ti. Then, during a step 108, the interval Δt _r obtained by calculating the difference between times t ₀ and t _i is compared with a threshold T ₁ -. The value of this threshold T ₁ - is for example 5. If the interval Δt _r is lower than the threshold T ₁ -, then it means that a large number of UID identifiers are not received for the first time on a predetermined period of time. Such a situation is representative of a massive attack by replay. Thus, in a step 110, the counter 28 detects the existence of a massive attack by replay. This information is transmitted to the terminal 8 which processes it in a manner similar to that described with regard to step 94.

After step 110 or if the interval Δt _r is greater than the threshold T ₁ -, the method returned to step 102.

Thus, the phases 84 and 100 make it possible to detect replay attacks and therefore to take the corresponding corrective or coercive measures. These corrective or coercive measures can be a direct sanction such as the prohibition of any decryption using the terminal 8. These sanctions can also be progressive sanctions that increase as the number of replay attacks detected. Finally, corrective or coercive action may also be to increase the monitoring of replay attacks to confirm the reality of such attacks. Monitoring can be increased by increasing the frequency with which phases 84 and 100 are executed. Many other embodiments are possible. For example, when a server needs to detect if identifiers are received for the first time, the diagnostic device of the first receipt of an identifier described here can be implemented on the server side. For example, in this case, it is the requests transmitted from the terminals to the server which each include UID identifiers.

The terminal 8 is not necessarily a decoder. It may be a mobile terminal, a computer, a smart card, or any other electronic terminal in which it is necessary to identify the first receipt of an identifier. The memory 14 may be a file such as for example a file recorded on a hard disk.

In the memory 14, the UID identifiers may be associated with time stamps TS or "Time Stamp". These time tags indicate what was the order of registration of the UIDs in the memory 14 or what is the time of recording of each of these identifiers. These time tags make it possible to replace the oldest UID identifier contained in a section or in the whole of the memory 14 by the newly received identifier when the latter is full. When the time tags are used, the clock 34 may also be omitted. For example, for the implementation of phases 84 and 100, the time tag associated with each received UID rather than a measurement of the instant of receipt of this UID using clock 34.

The values of the S _min and S _m _XJ limits associated with each class can be reset from time to time. The values of the limits S _mn and S _m a _XJ are not necessarily initialized to zero. For example, the limits Smm _j and S _ma χ _j can be initialized to non-zero values obtained from knowledge that we have about the UID identifiers already used in the system 2.

Other functions f _c are possible. Another example of a function f _c is the function that returns the remainder of the identifier UID modulo 127, allowing in this case 127 to define classes.

The function f _d may be different from the function f _c . In this case, it is necessary to apply this function f _d to the value of the UID ID newly received in step 71 to determine in which section it should be recorded.

The functions f _c and f _d are made public or, instead, kept secret.

The function f _c or f _d can for example be chosen in cyclic redundancy codes CRC8 or CRC16 to define respectively 256 sections or 65535 sections.

In an alternative embodiment, the function f _d can be dynamically selected according to the class of the newly received identifier UID, the latter being determined by f _c . In this case, the function f _d applied may be denoted f _cd or f _d (f _c ,). Messages containing UIDs are not necessarily received over a telecommunications network. For example, these messages can be transported from the server 4 to the terminal 8 via a recording medium such as a CD-ROM or a USB key (Universal Serial Bus). The associative table 32 may be replaced by other similar mechanisms. For example, the limits Smin _j and S _ma χ _j can be stored in the section of the memory 14 corresponding to the class with which they are associated.

During step 58, it is also possible to transform, using a monotone function g, the newly received UID identifier into a UID identifier '.

Then, it is this UID 'identifier which is compared with the limits S _mn ' and Sm _3x /.

In this variant, the limits S _mn 'and Sm _3x / are constructed as described with respect to steps 64 and 68 except that the construction of the new value of the limits S _mn ' and S _max 'is carried out using the identifier UID' instead of the UID. These limits Smm _j 'and S _m a _XJ ' are therefore constructed as a function of N identifiers UID already received. In addition, the function g is a monotone function increasing or decreasing. Thus, the comparison of the identifier UID 'with the limits Smin _j ' and Smax _j 'is the functional equivalent of a comparison of the identifier UID at the limits S _mnj and S _m a _XJ . Thus, this comparison is also referred to as the identifier UID 'at the limit S _mmi ' or Smax _j 'of step of "comparison of the newly received identifier UID at the limit S _mιnj or S _m a _XJ ".

Preferably, the limits Smin _j and S _ma χ _j are used simultaneously. However, what is described also works if one of these limits Smin _j or Smax _j is used alone.

In a simplified embodiment, the UID identifiers are not distributed among different classes. In this case, there is only one limit Smin and one limit S _ma χ associated with all the identifiers that can be generated. Similarly, in a simplified embodiment, the memory 14 is not divided into several sections. This avoids the use of a distribution function. The thresholds used in the phases 84 and 100 can be set according to a message exchange history between the terminal 8 and the server 4 or according to a user profile.

In another embodiment, the observation period Δt _c or Δt _r is fixed. In another simplified embodiment, the counters 26 and 28 are omitted and the phases 84 and 100 are also omitted. Thus, in these embodiments, replay attacks are not detected based on the number of UIDs received or the number of times a UID is diagnosed as not being received for the first time.

Claims

1. A method for automatically diagnosing the first reception of an identifier, said method comprising: a) searching (73) for a newly received identifier among those contained in an anti-replay memory, said anti-replay memory being able to contain at most M identifiers to which the newly received identifier can be compared, characterized in that the method comprises: b) constructing (64, 68) at least one limit as a function of the N identifiers already received, where N is strictly greater than M, this limit being constructed so as to delimit on one side a range of identifiers which have not yet been received and on the other side a range of identifiers containing the N identifiers already received, c) the comparison (58) from the newly received identifier to this limit to determine whether the newly received identifier belongs to the range of identifiers that have not yet been received, d) whether the newly received identifier belongs to the range of identifiers that have not yet been received, the diagnosis (60) of a first receipt of the newly received identifier and a new construction (64, 68) of the limit based on the newly received identifier, and e) if the newly received identifier belongs to the range of identifiers containing the N identifiers already received, the execution of step a).

The method according to claim 1, wherein the method comprises: constructing (64, 68) said limit for different classes of identifiers, for each class of identifiers, the limit associated with that class being constructed based on said at least one class of identifiers N identifiers already received and belonging to this class of identifiers, the identification (54) of the class of identifiers to which the newly received identifier belongs among the existing identifier classes, and the step c) consists in comparing (58) the newly received identifier at the limit associated with the identified class and not comparing the newly received identifier to the limits associated with the classes to which it does not belong.

The method of any one of the preceding claims, wherein the method comprises: the identification (62, 71), using a predetermined distribution law of the different receivable identifiers in different sections of the anti-replay memory, of the anti-replay memory section in which the newly received identifier is recordable, among several existing sections, and in step a), the search (73) of the newly received identifier among the only identifiers contained in the identified section of the anti-replay memory and not among the identifiers contained in sections of the anti-replay memory in which the newly received identifier is not recordable.

The method of any of the preceding claims, wherein the method comprises:

counting (88) the number of newly received identifiers during a time interval,

the comparison (90) of this number with a predetermined threshold, and

- if and only if the predetermined threshold is crossed, the detection of a replay attack (94).

A method according to any one of the preceding claims, wherein the method comprises: counting (104) the number of identifiers, during a time interval, for which it is diagnosed that they are not received for the first time time, - the comparison (106) of this number with a predetermined threshold, and if and only if this threshold is crossed, the detection of a replay attack (1 10).

The method of any of the preceding claims, wherein, if step d) is performed, step a) is not performed for this newly received identifier.

7. Method according to any one of the preceding claims, wherein the construction of the limit comprises the determination of a lowering or an increase of the N identifiers already received.

8. A method for detecting the replay of a message, each message containing an identifier to distinguish it from other messages, the method comprising: an automatic diagnosis of the first reception of the identifier to establish whether a received message is replayed, characterized in that the diagnosis is carried out in accordance with the diagnostic method of any one of the preceding claims.

9. Support (36) for recording information, characterized in that it comprises instructions for the execution of a method according to any one of the preceding claims, when these instructions are executed by an electronic computer.

10. Computer program, characterized in that it comprises instructions for carrying out a method according to any one of claims 1 to 8, when these instructions are executed by an electronic computer.

1 1. Device for automatically diagnosing the first reception of an identifier, this device comprising:

a search module (20) for a newly received identifier among those contained in an anti-replay memory,

the anti-replay memory (14), this memory possibly containing at most M identifiers to which the newly received identifier can be compared, characterized in that the device comprises:

a constructor (24) of at least one limit as a function of N identifiers already received, where N is strictly greater than M, the limit being constructed so as to delimit on one side a range of identifiers which do not have have been received and on the other side a range of identifiers containing the N identifiers already received,

a comparator (22) of the newly received identifier at this limit for determining whether the received identifier belongs to the range of identifiers that have not yet been received, this comparator being able to: