Cryptographic method for protection against fraud

• US 20030159038A1
• Filed: 02/26/2003
• Published: 08/21/2003
• Est. Priority Date: 03/22/2000
• Status: Active Grant

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Gilbert, Henri, Girault, Marc
• Granted Patent: US 7,284,122 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention relates to a cryptographic method of protection against fraud in transactions between an application (1) and an electronic chip (2) of a user.

The method consists in:

both the electronic chip (2) and the application (1) computing (15, 16) a certificate (Sp, S) which is the result of applying a non-linear function f to a list of arguments (e₁, e₂) comprising at least a seed R and a secret key K,

allocating to the electronic chip (2) a second secret key K′ known only to the electronic chip (2) and to the application (1) and kept secret (6) in the electronic chip (2),

on each authentication of the electronic chip (2), determining (17, 18) a mask M computed from at least a portion of the secret key K′,

masking (19) the value of the certificate (Sp) by means of the mask M to make available to the application (1) only the masked value of the certificate (Spm), and

using the application (1) to verify the masked value of the certificate (Spm) computed by the electronic chip (2).

Claims

1. A cryptographic method of providing protection against fraud in transactions between an application (1) and an electronic chip (2) of a user, the method comprising the following steps:

determining a non-linear function f known to the application (1) and implanted (4) in the electronic chip (2),

allocating to the electronic chip (2) a first secret key k known only to the electronic chip (2) and to the application (1) and kept secret (5) in the electronic chip (2),

on each authentication of the electronic chip (2), generating a variable input word r referred to as a random seed, and

computing (15, 16) by both the electronic chip (2) and the application (1) a certificate (sp, s) which is the result of applying the non-linear function f to a list of arguments (e₁, e₂) comprising at least the seed R and the secret key K,

which method is characterized in that it further comprises the following steps;

allocating to the electronic chip (2) a second secret key K′

known only to the electronic chip (2) and to the application (1) and kept secret (6) in the electronic chip (2),

on each authentication of the electronic chip (2), determining (17, 18) a mask M computed from at least a portion of the secret key K′

,

masking (19) the value of the certificate (Sp) by means of the mask M to make available to the application (1) only the masked value of the certificate (Spm), and

using the application (1) to verify the masked value of the certificate (Spm) computed by the electronic chip (2).

2. A method according to claim 1, characterized in that verification by the application (1) of the masked value of the certificate (Spm) computed by the electronic chip (2) consists in:

using the mask M to unmask the masked value of the certificate (Spm) computed by the electronic chip (2), and

comparing the value of the certificate (Sp) computed by the electronic chip (2) with that (S) computed by the application (1).

3. A method according to claim 1, characterized in that verification by the application (1) of the masked value of the certificate (Spm) computed by the electronic chip (2) consists in:

using the mask M to mask (23) the value of the certificate (S) computed by the application (1), and

comparing (22) the masked value of the certificate (Sp) computed by the electronic chip (2) with the masked value of the certificate (Sm) computed by the application (1).

4. A method according to claim 1, characterized in that the seed R is determined by the application (1) from a random number generated by the application (1) and in that the seed R is transmitted to the electronic chip (2) by the application (1).

5. A method according to claim 1, characterized in that the seed R is determined from a series of consecutive integers generated by the application (1) and by the electronic chip (2).

6. A method according to claim 1, characterized in that the certificate (Sp, S) is the result of applying the non-linear function f to a list of arguments (e₁, e₂) comprising at least the seed R, the secret key K, and data D internal to the electronic chip.

7. A method according to claim 1, characterized in that the certificate (Sp, S) is the result of applying the non-linear function to a list of arguments (e₁, e₂) comprising at least the seed R, the secret key K, and data D′

supplied to the electronic chip (2) by the application (1) at the time of authentication.

8. A method according to claim 1, characterized in that the secret keys K and K′

are chosen independently of each other.

9. A method according to claim 1, characterized in that K′

consists of a sequence of values K′

[i], M is equal to a linear combination modulo 2 of the bits of the values K′

[i], and the characteristics of the combination are determined at the time of authentication.

10. A method according to claim 1, characterized in that K′

consists of a sequence of values K′

[i] and M is equal to values K′

[c] from among the values K′

[i] and determined by the choice of a parameter c at the time of authentication.

11. A method according to claim 10 characterized in that the value of the parameter c is computed from at least the value of a counter in the electronic chip which is incremented on each authentication.

12. A method according to claim 10, characterized in that the value of the parameter c is computed from at least the seed R and the value of a counter in the electronic chip which is incremented on each authentication.

13. A method according to claim 1, characterized in that the masking of the certificate S by means of the mask M is computed by means of an encryption function (F).

14. A method according to claim 13, characterized in that the encryption function (F) is an exclusive-OR operation applied bit by bit.

15. A method according to claim 1, characterized in that the certificate (Sp, S) and the mask M have the same number of bits.

16. A method according to claim 1, characterized in that the number of authentications of the electronic chip (2) is limited to a maximum value V determined by the application (1) and written into the electronic chip (2).

17. A method according to claim 16, characterized in that the electronic chip (2) contains a counter which is incremented on each authentication and the electronic chip (2) terminates all authentication computation if the value of the counter reaches the maximum value V.

18. A cryptographic method of providing protection against fraud in transactions between an application (1) and an electronic chip (2) of an user, the method comprising the following steps:

determining a non-linear function f known to the application (1) and implanted (4) in the electronic chip (2),

allocating to the electronic chip (2) a first secret key K known only to the electronic chip (2) and to the application (1) and kept secret (5) in the electronic chip,

on each authentication of the application (1), generating an input word R referred to as a random seed, and

computing by both the electronic chip (2) and the application (1) a certificate (Sp, S) which is the result of applying the non-linear function f to a list of arguments (e₁, e₂) comprising at least the seed R and the secret key K,

which method is characterized in that it further comprises the following steps;

allocating to the electronic chip (2) a second secret key K′

known only to the electronic chip (2) and to the application (1) and kept secret (6) in the electronic chip (2),

on each authentication of the application (1), determining a mask M computed from at least a portion of the secret key K′

,

masking the value of the certificate (S) by means of the mask M to make available to the electronic chip (2) only the masked value (Sm) of the certificate (S), and

using the electronic chip (2) to verify the masked value (Sm) of the certificate (S) computed by the application (1).

19. A method according to claim 18, characterized in that the seed R is determined by the electronic chip (2) from a random number generated by the electronic chip (2) and in that the seed R is transmitted to the application (1) by the electronic chip (2).

20. A method according to claim 18, characterized in that the seed R is determined from a series of consecutive integers generated by the application (1) and by the electronic chip (2).