WO2000056006A1

WO2000056006A1 - Secure method for loading data between security modules

Info

Publication number: WO2000056006A1
Application number: PCT/FR2000/000680
Authority: WO
Inventors: Richard Dollet
Original assignee: Schlumberger Systemes
Priority date: 1999-03-17
Filing date: 2000-03-17
Publication date: 2000-09-21
Also published as: FR2791202B1; CN1353897A; FR2791202A1; EP1159798A1

Abstract

The invention concerns a secure method for loading secret data from a first security module towards a second security module, said first module comprising secret data, said second module comprising a first non-volatile memory and a second volatile memory. The invention is characterised in that said method comprises steps which consist in: recording data comprising random data in the first memory of the second module; sending to the second module secret data from the first module encrypted from the random data; transferring the data comprising the random data from the first memory to the second memory of the second module; decrypting said encrypted secret data, from the random data; and recording, in the second memory, said decrypted secret data. The invention is particularly applicable to telephone systems.

Description

METHOD FOR SECURE LOADING OF DATA BETWEEN

SECURITY MODULES

The present invention relates to a method for securely loading secret data from a first security module to at least one second security module, said first module comprising at least one secret data file, said second module comprising a first non-memory volatile and a second volatile memory.

The invention finds an application, particularly advantageous in the field of telephony.

In the field of telephony, there are terminal administration systems which comprise a first security module embedded in an administration server and second security modules generally embedded in the aforementioned terminals. The terminals are called payphones.

A second security module guarantees the validity of a user card inserted in a payphone, in particular through authentication of said card. To this end, said second security module includes in its first memory secret data making it possible to guarantee said validity of the user cards. The public phone administration systems as well as the secret data are managed by telephone operators. In order to reduce the risk of fraud consisting in spying on a communication network connecting the server and the payphones and thus in discovering said secret data, operators are required to regularly modify all or part of the secret data of a second security module of a payphone, from secret data contained in a file of the first security module.

A method known in the art comprises the steps according to which: the secret data of the first security module which must be transmitted to the second security module and which are located in the administration server are encrypted,

- the public phone connects to the administration server when no conversation is in progress,

- the secret data are transmitted to the second security module located in the public phone.

When the public phone connects to the administration server, it is unavailable to any user, so the connection is generally made at night. The data exchange is done in disconnected mode called in the English language "off-line" mode.

In order to diversify the transmissions of secret data, pseudo-random data based on a value of a counter contained in the second security module is used. At each exchange of secret data, the value of the counter is incremented, the first security module must know the value of said counter and increment a local counter dedicated to said second module.

Although this method allows loading of secret data between a first and second security module, it requires heavy administration of databases making it possible to guarantee the synchronization of the various counters. Indeed, a trace of all the exchanges carried out with a second security module must be kept. In addition, this process does not guarantee a perfectly diversified data exchange. Also, a technical problem to be solved by the object of the present invention is to propose a method for secure loading of secret data from a first security module to at least a second security module, said first module comprising at least a secret data file, said second module comprising a first non-volatile memory and a second volatile memory, which would guarantee a perfectly diversified data exchange between a first and a second security module, in "off-line" mode, while avoiding too heavy management of databases. A solution to the technical problem posed is characterized, according to the invention, in that said loading method comprises the steps according to which:

- at least one random datum is generated in the second memory of the second module, - information including said random datum is recorded in the first memory of the second module,

- the random data is sent to the first module,

in the first module, a secret datum of the file of said first module is encrypted, from the random data and an encryption algorithm, said encrypted secret datum is sent to the second module,

- the information is transferred, comprising the random data from the first memory of the second module, from the said first memory to the second memory of the said module, - the encrypted secret secret data is decrypted, using a decryption algorithm and the random data , and, in the second module, said secret data decrypted is recorded.

Thus, as will be seen in detail below, the loading method of the invention makes it possible, by using random data for loading secret data, to improve the security of loading data by perfectly diversifying the transmitted data. . Thus, a fraudster who spies on a communication network and recovers the transmitted data never obtains the same encryption value and therefore cannot discover a secret relating to the secret data transmitted. In addition, the fact of recording the random data in a non-volatile memory of the second security module makes it possible to use it in "off-line" mode, since said random data is not lost when said second security module is turned off.

The description which follows with reference to the appended drawings, given by way of nonlimiting example, will make it clear what the invention consists of and how it can be implemented.

FIG. 1 is a diagram showing a first security module and several second security modules.

FIG. 2 is a diagram showing the first module and a second module in FIG. 1.

FIG. 3 is a diagram showing an exchange of data between the first module and the second module of FIG. 2. FIG. 4 a diagram showing a second exchange of data between the first module and the second module of FIG. 2.

FIG. 5 a diagram showing a third exchange of data between the first module and the second module of FIG. 2.

FIG. 1 shows a first security module S and several second security SAM modules, each second SAM module comprising a first non-volatile memory M 1 and a second volatile memory M2 called working memory. Figure 2 shows the first S module and a second SAM module. The first module S comprises at least one file EF1 of secret data DATA and an encryption algorithm ALGO. A secret data file is generally associated with a given telephone operator. The second SAM module includes an ALGOP algorithm for reverse decryption of the ALGO encryption algorithm and secret DATA.

In order to modify a secret data of the second SAM module, you must load a secret data from the EFl file of the first security module S. Charging must be done in a secure manner. The secret data is thus transmitted in an encrypted manner. The loading phase includes several steps described below.

In a first step, at least one random data item RAND is generated in the volatile memory M2 of the second SAM module.

In a second step, as shown in FIG. 3, information INFO is recorded comprising said random data

RAND in the non-volatile Ml memory of the second SAM module. A memory location in said non-volatile memory M1 is reserved for this purpose and is initialized by default to an initialization value V.

In a first embodiment, the information INFO, comprising said random data RAND, includes an index relating to a secret data DATA. The index being for example a secret data number to be modified or a memory location index in which a secret data must be loaded in the second SAM module. Thus, in the case where the second SAM module is switched off for reasons of energy saving, the random data RAND and the associated information are not lost.

In a third step, the first random data RAND is sent to the first module S. Note that the second and third steps can be swapped.

In order to reduce the number of accesses to the second SAM module, the generation and sending of the random RAND data as well as the recording of the INFO information in the second SAM module are done by means of a first ASKLOADING command. This first command is sent by the administration server to the second SAM module via the public phone (not shown).

In a fourth step, in the first module S, the secret data DATA of the file EF1 is encrypted which must be transmitted in the second module SAM. Encryption includes an encryption step using the ALGO encryption algorithm and random RAND data. The use of the random data RAND avoids having the same encryption value for a secret data DATA. Thus, a fraudster can hardly make a link between the different data transmitted over the communication network, these being different on each transmission. The encryption can also comprise, on the one hand, a step of signing the secret data DATA based on the random data RAND, and, on the other hand, a step of certifying the transmitted data. The signature verifies the authenticity of the secret DATA loaded and the certificate verifies the integrity of the transmitted data.

In a fifth step, as shown in FIG. 4, said encrypted secret data DATAC is sent to the second SAM module. In a sixth step, the information INFO is transferred, comprising the random data RAND from the non-volatile memory M1 of the second SAM module, from said memory Ml to the working memory M2 of said SAM module. Thus, the random data RAND, which was used to encrypt the secret data DATA, as well as the associated information, is recovered in the working memory M2. The duplication of the RAND random data and associated information in two different memories of the second SAM module can generate inconsistencies in said module and security problems. Also, only one set of INFO information is kept in the second SAM module. To this end, after recording the information INFO comprising said random data RAND in the first memory M1 of the second SAM module (FIG. 3), the information INFO located in the second memory M2 of said second SAM module is deleted. In the same way, after the transfer of the information INFO comprising the random data RAND, from the first memory M 1 of the second module SAM in the second memory M2 of said module (FIG. 4), said information INFO is deleted in said first memory M 1.

Finally, in a last step, said encrypted secret data DATAC is decrypted, from the algorithm ALGOP for decrypting the second SAM module and the random data RAND, and, said secret decrypted DATA is recorded in the second SAM module.

In order to reduce the number of accesses to the second SAM module, the transfer of information INFO, the decryption of the secret data DATA in the second SAM module and the recording, are done by means of a second command ADMINRECOVER. This second command is sent by the administration server to the second SAM module via the public phone (not shown). In the event that an incident occurs during loading, or at the end of said loading, the memory location, in the non-volatile memory Ml, where the information INFO including the random data RAND is located, is reset to the initialization value V. If an incident has occurred, other random RAND data is generated and the various steps of the method described above are carried out again. When the second ADMINRECOVER command is sent, it is checked that a random RAND datum has been generated and recorded. Thus, it is verified that the memory location of the first non-volatile memory Ml of the second SAM module, reserved for the random data RAND, does not include the initialization value V. If this is the case, the second command ADMINRECOVER is executed . Otherwise, it is not executed and the first step of the process is carried out.

Generally, a second SAM module manages different types of user card and consequently comprises several secret data DATA associated with each type of user card, a type of card commonly corresponding to a given operator, supplier of said cards. It is usual to want to modify all of the secret DATA associated with a type of card. In this case, the first steps of the method of the invention are carried out as described above, but by applying them to all of the secret data DATA to be modified. Thus, several random data RAND are successively generated in the second memory M2 of the second SAM module and the information INFO comprising the random data generated RAND is recorded in the first memory M1 of the second SAM module, following each generation of random data RAND. As shown in the example of FIG. 5, three random data RAND1, RAND2 and RAND3 are generated in the second module SAM and they are recorded in the non-volatile memory M1 of said module. Thereafter, the three random data generated are sent to the first module S of the administration server. We encrypt three secret data DATAI, DATA2 and DATA3 found in the file EF1 of the first module S and corresponding to the three secret data to be modified in the second module SAM. The correspondence is carried out for example using three indices (1, 2 and 3) of secret data sent at the same time as the three random data RAND. Finally, to transmit the three secret data DATAI, DATA2 and DATA3 in said second SAM module, all the steps of the method of the invention are carried out as described above, from the fifth step for each secret DATA data to be loaded or for the the secret DATA as in the previous steps. Thus, according to a first embodiment of the loading of several data described above, during each loading, a random data RAND is used to load a secret data DATA. According to a second embodiment, in order to reduce the loading time of the secret data, during each loading, a single random data RAND is used to load several secret data DATA.

Of course, the invention is in no way limited to the field of telephony, it can extend to other fields in which a data exchange system is implemented between a centralized module having secret data and off-site modules capable of receiving said secret data.

Claims

1 - Method for secure loading of secret data from a first security module (S) to at least a second security module (SAM), said first module (S) comprising at least one file (EFl) of secret data (DATA), said second module (SAM) comprising a first non-volatile memory (Ml) and a second volatile memory (M2), characterized in that it comprises the steps according to which: - at least one random datum is generated (RAND ) in the second memory (M2) of the second module (SAM),

- information (INFO) comprising said random data (RAND) is recorded in the first memory (MI) of the second module (SAM), - the random data (RAND) is sent to the first module (S),

- in the first module (S), a secret datum (DATA) of the file (EFl) of said first module (S) is encrypted, based on the random datum (RAND) and an encryption algorithm (ALGO), - said encrypted secret data item (DATAC) is sent to the second module (SAM),

the information (INFO), comprising the random data (RAND) of the first memory (MI) of the second module (SAM), is transferred from said first memory (MI) to the second memory (M2) of said module (SAM),

- we decrypt said encrypted secret data (DATAC), from an algorithm (ALGOP) decryption and random data (RAND), and, we record in the second module (SAM), said secret data (DATA) decrypted . 2 - Method according to one of the preceding claims, characterized in that it comprises an additional step according to which:

- after recording information (INFO) comprising said random data (RAND) in the first memory (Ml) of the second module (SAM), the information (INFO) located in the second memory (M2) of said second is deleted module (SAM).

3 - Method according to one of the preceding claims, characterized in that it comprises an additional step according to which:

- after the transfer of information (INFO) comprising the random data (RAND), from the first memory (Ml) of the second module (SAM) in the second memory (M2) of said module, said information is erased

(INFO) in said first memory (Ml).

4 - Method according to one of the preceding claims, characterized in that the generation and sending of the random data (RAND) as well as the recording of information (INFO) in the second module (SAM), are done by means of a first order (ASKLOADING).

5 - Method according to one of the preceding claims, characterized in that the transfer of information (INFO), the decryption of the secret data (DATA) in the second module (SAM) and the recording, are done by means of a second order (ADMINRECOVER).

6 - Method according to one of the preceding claims, characterized in that the information (INFO), comprising said random data (RAND), includes an index relating to a secret data (DATA). 7 - Method according to one of the preceding claims, characterized in that successively generates several random data (RAND) in the second memory (M2) of the second module (SAM) and is recorded in the first memory (Ml) of the second module (SAM), following each generation of random data (RAND), the information (INFO) comprising the random data (RAND) generated.

8 - Method according to one of the preceding claims, characterized in that, during each loading, a random data RAND is used to load a secret data DATA.

9 - Method according to one of claims 1 to 7, characterized in that, during each loading, a single random data RAND is used to load several secret data DATA.