WO1999031845A1

WO1999031845A1 - Method for making secure the transmission of a message from a transmitting device to a receiving device

Info

Publication number: WO1999031845A1
Application number: PCT/FR1998/002753
Authority: WO
Inventors: Lionel Brahami; Vincent Rigal
Original assignee: Schlumberger Systemes
Priority date: 1997-12-16
Filing date: 1998-12-16
Publication date: 1999-06-24
Also published as: FR2772532A1; EP1040620A1; JP2002509269A; CN1284227A; FR2772532B1

Abstract

The invention concerns a method for making secure the transmission of a message (Prgm) from a transmitting device (E) to a receiving device (R), characterised in that: the message (Prgm) is split into n elementary units (I), n being a number not less than 1; a logical property (P) is defined such that, for each elementary unit (I), the logical property (P), applied to an authentic elementary unit (I), gives a true logical value; the message (Prgm) is encrypted by the transmitting device (E) encryption means using an encryption algorithm comprising a key (Kc) so as to obtain a result Kc(Pgrm); The encrypted result Kc(Pgrm) is transmitted by the transmitting device (E) to the receiving device (R); the encrypted result Kc(Pgrm) is decrypted by the receiving device (R) using a decryption algorithm comprising a secret key (Kd) so as to obtain a decrypted result Kd(Kc(Pgrm)); the decrypted result Kd(Kc(Pgrm)) is split into elementary units (I); the logical property (P) is applied to the elementary units (I) so as to obtain, for each unit, a true logical value or a false logical value. The method is particularly applicable to smart cards.

Description

METHOD FOR SECURING THE TRANSMISSION OF A MESSAGE FROM A TRANSMITTING DEVICE TO A DEVICE

RECEIVER

The invention relates to a method for securing the transmission of messages from a sending device to a receiving device.

When information is transmitted from a sending device to a receiving device, this information, contained in a message, is likely to be altered during its transmission. This alteration can come either from a defect in the transmission, transmission or reception of the message or from fraud by a third party. The received message is then not intact.

This is the reason why procedures have been developed which make it possible to verify the integrity of the messages transmitted. Furthermore, when information is transmitted from a sending device to a receiving device, it is sometimes useful to make the message confidential so as to reserve access to said information to a limited number of people, in general the sender and the receiver of the message. This is the reason why procedures have been developed which make it possible to preserve the confidentiality of a message.

Finally, when information contained in a message is transmitted to a receiving device, it is very often useful to authenticate this message as actually coming from the sending device.

This is the reason why we have developed message authentication methods. Known methods of verifying integrity, preserving confidentiality and authenticating, that is to say securing messages, generally consist in encrypting the message and attaching a certificate to it before it is transmitted. The receiving device then decrypts the message, verifies the certificate and, possibly, if the said message is a computer program, executes it.

These processes are obviously cumbersome, in that the decryption and verification of the certificate each impose an operation. This is the case, in particular, when the encryption and decryption operations are long.

Considering the above, a problem which the invention proposes to solve is to carry out a method of securing the transmission of a message from a sending device to a receiving device which does not require the implementation of the two aforementioned steps. decryption of the message and verification of the certificate.

In view of the problem posed above, the subject of the invention is a method for securing the transmission of a message from a sending device to a receiving device, characterized in that:

- the message is divided into n elementary units, n being a number greater than or equal to 1;

- a logical property is defined so that, for any elementary unit, the logical property, applied to an authentic elementary unit, gives a logical value of the true type;

the message is encrypted by means of encryption of the sending device using an encryption algorithm comprising a key so as to obtain an encrypted result;

- the encrypted result is transmitted by the sending device to the receiving device;

the encrypted result is decrypted by the receiving device using a decryption algorithm comprising a secret key so as to obtain a decrypted result;

- the decrypted result is divided into elementary units; the logical property is applied to the elementary units so as to obtain, for each unit, a logical value of the true type or of the false type.

- the message is considered authentic and integral if, for each unit, the logical values have a value of the true type.

The message is then advantageously stored. It will also be noted that, advantageously, the Prgm message is a computer program capable of being executed and / or of being interpreted by the receiving device R. The elementary units are instructions of the Prgm program. The property

P, applied to an elementary unit I, gives a logical value of true type when the elementary unit I is executable and / or interpretable. The property P, applied to an elementary unit I, gives a false logical value when the elementary unit I is not executable and / or interpretable. The receiving device R is a portable memory object of the smart card type. The receiving device R comprises a portable memory object of the smart card type. The portable memory object is a subscriber identification module (SIM). Prgm message is written in interpreted language high level. The high level language is the Java language. The computer program consists of a set of precompiled instructions. The Prgm message is encrypted in continuous stream or in chained blocks. The Prgm message is encrypted in blocks and the blocks of the encrypted Prgm message are swapped. One of the swapped blocks is a start or end block of the Prgm message. The result Kc (Prgm) is decrypted in blocks, each encrypted block being at the origin of a decrypted block taking the place of the encrypted block. The encryption and decryption algorithms involve a hazard, transmitted by the sending device E, to the receiving device R. The message Prgm is recorded, after verification, in a non-volatile memory of the receiving device R.

This invention will be better understood on reading the nonlimiting description which follows. According to the invention, the Prgm message is transmitted from a sending device E to a receiving device R.

The Prgm message is for example a computer program capable of being executed and / or interpreted.

The transmitter device E is, for example, a server, a computer, a transmitter station in a telecommunications network or a smart card reader with or without contact, in short, any device capable of encrypting and transmitting a message. Of course, the sending device E must be considered in a broad sense as including complex devices formed in particular of physically separate parts, one part ensuring for example the encryption of the message, another, the transmission stricto sensu of said message. The receiving device R is, for example, a computer possibly equipped with a smart card reader and a card inserted in said reader, a receiving station in a telecommunications network, a portable telephone with or without a module subscriber identification (SIM) or even a smart card or such a module, in short, any device capable of receiving a message or even storing this message and, advantageously, when the message is a computer program, to interpret and / or to run this program. In the case where the receiving device advantageously comprises a portable object with memory of the chip card type, this portable object can be a payment card or an access control card, for example, to a computer network.

In the rest of the description of the invention, we will limit ourselves to the examples where the message is a Prgm computer program. According to the invention, this Prgm computer program is divided into n elementary units I, n being an integer greater than or equal to 1. They are instructions, blocks of instructions or, in the case where the Prgm program is written in an interpretable Java-like language, from the program's precompiled instructions (or bytecodes).

According to the invention, a logical property P is defined so that, for any elementary unit I, this property P, applied to an authentic elementary unit, gives a logical value P (I) of the true type. We will nevertheless seek to find a property P which, applied to an elementary unit I, gives a logical value P (I) of the false type when said elementary unit I has been modified and corresponds for example to a non-instruction recognizable from the program, in particular not likely to be interpretable and / or executable.

According to the invention, the Prgm program is encrypted by encryption means of the sending device E using an encryption algorithm comprising a key Kc known to said device E so as to obtain a result Kc (Prgm). The encryption guarantees the confidentiality of the Prgm program during its transmission and reception, but, above all, during its transmission to the receiving device R. This result KqPrgm) is then transmitted by the device E, to the receiving device R.

It is then decrypted by this device R using an encryption algorithm comprising a secret key Kd, known to the receiving device. A decrypted result Kd (Kc (Prgm)) is then obtained. This key Kc can be specific to the device E and known to the device R, or specific to the device R and also known to the device E. An example of the first configuration is the case where the device R subscribes to a service delivered by the device transmitter. An example of the second configuration is the case where the receiving device, when requesting a transmission of the program, supplies the key Kc, the decryption key Kd remaining known only to the receiving device. Another example of the same configuration is the case where Kc and Kd are identical (private key system), and where this key is sent, in encrypted form, by the receiving device, to the sending device.

According to the invention, the decrypted result Kd (Kc (Prgm)) is divided or decomposed into n elementary units, images of or corresponding to the n elementary units resulting from the division of the Prgm program into the sending device E.

The logical property P is then applied to said n elementary units so as to obtain, for each unit, a logical value of the true type or of the false type.

In the case where all the logical values are of the true type, there is a high probability that the decrypted program is identical to the encrypted program and that the key having been used for encryption is the expected key Kc. The receiving device R deduces therefrom while the Prgm program is integral and it has been sent by a sending device E having the key Kc, therefore authentic.

On the other hand, in the case where at least one logical value is of the false type, the decrypted program is different from Prgm and the receiving device R deduces therefrom that the program Prgm has been the subject of at least one modification on transmission. , upon reception or during its transmission and / or that said Prgm program has encrypted the message with a key other than Kc, an unexpected key. The program is therefore not complete or not authentic.

The invention therefore makes it possible to guarantee, in a single encryption-decryption operation, both the integrity, the authentication and the confidentiality of the Prgm program.

If we consider for example that the instructions of the computer language in which the Prgm program is written are instructions coded on four bytes, there are, in theory, 2 ³² possible codes to define an instruction. Of course, certain codes, defined by a set of parameters, do not correspond to any comprehensible instruction. In addition, certain parameters of certain codes, typically the last three bytes, have only certain allowed values. A memory address cannot thus be negative, or be outside the space allocated to the Prgm program. This is the reason why the property P advantageously includes a test of parameters, said test depending on the type of instruction.

If the unit non-detection rate C is defined as the percentage of possible instructions which are not recognized as false by the application of the property P during decryption and following a specific modification of the Prgm program, the probability that the receiving device R does not detect the fraud is, when the punctual modification is at the origin of a modification on each instruction of the decrypted result: prob = (1 - C) ⁿ . For the following typical values, the following probabilities are obtained: n C (%) prob

256 10% 1.9E-12

128 10% 1 4E-06

512 5% 3.9E-12

128 5% 1.4E-03

It can be seen that the probability that a particularly fraudulent modification goes unnoticed is very low, except in the case of programs comprising few instructions and whose unit non-detection rate C is very high. This probability is a fortiori very low in the case where the program has been encrypted by a key other than Kc.

Compared to usual encryption operations, the application of the P property does not require too heavy an implementation in particular a too long calculation time. It allows error detection in all types of Prgm programs when the encryption algorithm is of good quality, having regard to the pseudo-random nature of any decryption of a sequence of falsified instructions.

The encryption algorithm is advantageously of the chained block or continuous flow type. Thus, a modification of an elementary instruction will involve a modification of other instructions. On the other hand, when the algorithm proceeds only by blocks, the encrypted program can be broken down into a series of for example n blocks corresponding more or less to the n elementary units. By modifying a block and observing the behavior of the receiving device, the probabil probability that the modification is not detected is then equal to 1 - C, therefore very high. In order to avoid a modification directed on the head or tail block of the encrypted program, the blocks of the encrypted program are swapped, for example, so that said head and tail blocks of the program are in a location which is not not predictable by a fraudster, but nevertheless known to devices E and R. Confidentiality is also improved when the encryption algorithm involves a hazard generated for example by the receiving device R and communicated to the sending device E. It can act, for example, of an "or exclusive operation applied to a determined number of bytes of the program or to all of it before encryption.

We can finally introduce empty instructions (NOP) at the start and / or end of the program, before encryption. receiving device will recognize by applying the P property and then eliminate.

In a first embodiment of the invention, the transmitting device E is a base station of a GSM (Global System for Mobil communication) telecommunications network or of any other mobile telephone system involving a security module , the receiving device R is a subscriber identification module SIM associated with a mobile telephone. The Prgm program, intended to be downloaded into said SIM module, is coded in the form of precompiled instructions (bytecodes) written for example in the Java language.

Of course, the invention applies in the same way to other smart card systems, such as payment or access control systems. In this first embodiment of the invention, the program is divided into n elementary units, an elementary unit being an instruction precompiled with a determined number of bits (fixed or dependent on the type of instruction).

The logical property P is defined so that it takes a true logical value when the elementary unit to which it is applied is an executable (or interpretable) instruction or corresponds to an NOP instruction.

The Prgm program is then encrypted by the emitting device E with an encryption algorithm, for example of the RSA type (Rivest, Shamir and Adelman) as described in the US patent.

4,405,829. An encryption result Kc (Prgm), depending on the key Kc, is then obtained. This result Kc (Prgm), ultimately the encrypted program, is transmitted by the base station to a transmitting station associated with it and then to means for receiving the mobile telephone. It is then loaded into the card where it is saved in a non-volatile EEPROM memory before the decryption operation, taking into account the slowness of this operation implemented on a SIM module.

The result Kc (Prgm) is then decrypted using a decryption algorithm comprising a secret key Kd. Each block of the decrypted result is recorded in the non-volatile memory EEPROM of the SIM module, at the address of the block of the corresponding encrypted result. Thus, the memory space used for the implementation of the decryption according to the invention is minimal. It will be noted that, in an alternative implementation of the invention, using at least one free memory space corresponding to a block, the blocks of the decrypted result can be saved at memory addresses different from the encrypted blocks to which they correspond. A circular permutation is also possible, improving the security of the program during the decryption stage.

The application of the property P is preferably carried out at the end of the complete decryption of the encrypted result Kc (Prgm), the final result (program accepted or refused) being given only at the end of all the verifications. Thus, the fraudster cannot simply detect the elementary unit I recognized as giving a false logical value during the application of the property P. Given the low memory available in the module

SIM, a simple function for calculating the property P is implemented. This is a function implemented by the interpreter himself even. Once the encrypted result is decrypted, the interpreter interprets the decrypted result by checking whether the instructions make sense or not. Ultimately, the interpreter performs the analysis of the program as it would during a normal interpretation, without however that said interpretation being followed by any effect other than checking that the decrypted result corresponds to a Prgm program.

In a second embodiment of the invention, the sending device E is a server comprising a precompiled and encrypted form Kc (Prgm) of a Prgm program, written for example in the Java language. The receiving device R is a personal computer, which will be usefully provided with a smart card reader in which a card is inserted. The personal computer includes a hard disk and a secure memory area, i.e. one which cannot be read or written by a third party, for the storage, temporary or permanent, of the decrypted results Kd ( Kc (Prgm)) and keys. The computer also includes software for loading Prgm programs called Loader invoked whenever it is necessary to load a precompiled Prgm program, before said Prgm program is used (interpreted or executed). In the present second embodiment of the invention, this software includes a decryption function, which advantageously includes functional elements necessary for decryption and in particular elements of the decryption algorithm. The program loading software is then said to be overloaded. Of course, other functional elements necessary for decryption can be contained in a non-volatile memory of the smart card. These elements will then called by the program loading software and the decryption function. Thus, the loading software allows, in association with the card, the decryption of the result Kc (Prgm) and the verification of the decrypted result Kd (Kc (Prgm)) before the interpretation of said decrypted result Kd (Kc (Prgm)), that is, when the P property has been successfully applied, the Prgm program, and the execution of this Prgm program.

The constraints of time and memory space which have been mentioned during the description of the first mode of implementation of the method of the invention are, in this second mode of implementation, less, since the card is here only used as a secure physical medium for one or more keys or elements, tables for example, necessary for decryption. The card can even contain the entire secret decryption algorithm. The property P can, therefore, not only be of the type of the aforementioned, or else, be a particular property for which the verification algorithm will be implemented. The verification algorithm checks in an example the precompiled instructions each time an instruction block (s) of the encrypted result is decrypted. The exchange phases between, on the one hand, the personal computer provided with the interpreter, the loading device and associated with a card reader in which the card is inserted and, on the other hand, the card, can break down into three phases: an initialization phase, a transfer phase and a decryption / verification phase.

The initialization phase is in fact a phase of exchanging a couple of public and secret keys. This phase is launched during initialization of the decryption process. Key pairs are not written to the hard drive of the personal computer and can be recalculated at any time. During this phase, a re-initialization order is transmitted by the personal computer to the card. The computer then calculates a pair of public key PKc - secret key PKd, then calculates a signature of the public key PKc using the secret key PKd. This signature is transmitted, with the public key PKc, to the card. It is then verified by the card, using the public key PKc. The card then calculates, using a secret key CKd, a signature of the public key CKc. This signature is transmitted, with the public key CKc, to the personal computer. The computer verifies the signature, using the public key CKc.

The transfer phase is a phase of loading secret information from the card into the personal computer. This information allows the computer to decrypt the precompiled and encrypted form of the Prgm program. For this phase, the computer requests the card to transfer the secret decryption key Kd which it has in its memory. The card encrypts this key using the PKc key, and sends it to the computer. This one decrypts this message using its key Kd, and thus has the key Kc. It is then possible for him to decrypt the program Kc (Prgm), in order to obtain a program Prgm ', which is none other than the original program Prgm if no attempt at fraud has taken place.

The computer can at this time decompose the Prgm 'program into elementary units, and apply the property P to them, as in the first embodiment. If the result is satisfactory, it archives the said program, for example on its hard disk. he can also calculate verification information (for example a cheksum or, better, a hashing) and archive it in the memory of the card, for later verification of program integrity.

Claims

1. Method for securing the transmission of a Prgm message from a sending device E to a receiving device R, characterized in that: - the Prgm message is divided into n elementary units I, n being a number greater than 1;

a logical property P is defined so that, for any elementary unit I, the logical property P, applied to an authentic elementary unit I, gives a logical value of the true type;

the Prgm message is encrypted by encryption means of the sending device E using an encryption algorithm comprising a key Kc so as to obtain an encrypted result Kc (Prgm); - the encrypted result Kc (Prgm) is transmitted by the sending device E to the receiving device R;

the encrypted result Kc (Prgm) is decrypted by the receiving device R using a decryption algorithm comprising a secret key Kd so as to obtain a decrypted result Kd (Kc (Prgm));

- the decrypted result Kd (Kc (Prgm)) is divided into elementary units I;

the logical property P is applied to the elementary units I so as to obtain, for each unit, a logical value of the true type or of the false type;

- the Prgm message is considered authentic and integrates if, for each unit, the logical values have a value of the type true.

2. Method according to the preceding claim, characterized in that the Prgm message is a computer program capable of being executed and / or of being interpreted by the receiving device R.

3. Method according to the preceding claim, characterized in that the elementary units are instructions of the Prgm program.

4. Method according to claim 2 or 3, characterized in that the property P, applied to an elementary unit I, gives a logical value of true type when the elementary unit I is executable and / or interpretable.

5. Method according to one of claims 2, 3 or 4, characterized in that the property P, applied to an elementary unit I, gives a logical value of false type when the elementary unit I is not executable and / or interpretable.

6. Method according to one of the preceding claims, characterized in that the receiving device R is a portable object with memory of the chip card type.

7. Method according to one of claims 1 to 5, characterized in that the receiving device R comprises a portable memory object of the smart card type.

8. Method according to claim 6, characterized in that the portable memory object is a subscriber identification module SIM.

9. Method according to one of the preceding claims, characterized in that the Prgm message is written in a high level interpreted language.

10. Method according to claim 9, characterized in that the high-level language is the Java language.

1 1. Method according to one of claims 9 or 10, characterized in that the computer program consists of a set of precompiled instructions.

12. Method according to one of the preceding claims, characterized in that the Prgm message is encrypted in continuous stream or in chained blocks.

13. Method according to one of the preceding claims, characterized in that the Prgm message is encrypted in blocks and in that the blocks of the encrypted Prgm message are swapped.

14. Method according to claim 13, characterized in that one of the permuted blocks is a start or end block of the Prgm message.

15. Method according to one of claims 1 to 12, characterized in that the result Kc (Prgm) is decrypted by blocks, each encrypted block being at the origin of a decrypted block taking the place of the encrypted block.

16. Method according to one of the preceding claims, characterized in that the encryption and decryption algorithms involve a hazard, transmitted by the sending device E, to the receiving device R.

17. Method according to one of the preceding claims, characterized in that the message Prgm is recorded, after verification, in a non-volatile memory of the receiving device R.