Portable electronic device and method for securing such device

• US 9,047,727 B2
• Filed: 12/21/2007
• Issued: 06/02/2015
• Est. Priority Date: 12/26/2006
• Status: Active Grant

• Current Assignee: IDEMIA France (Advent International Corporation)
• Original Assignee: Oberthur Technologies SA (Advent International Corporation)
• Inventors: Goyet, Christophe
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US12/521,231
• Publication Number:
  US 20100017881A1
• Time in Patent Office: 2,720 Days
• Field of Search: 726/2, 726/4, 726 23- 25, 713/170, 380/229, 380/232
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/352 Contactless payments by cards
• CPC Class Codes: G06Q 20/35765 Access rights to memory zones
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07F 7/084 Additional components relating to data transfer and storing, e.g. error detection, self-diagnosis
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1083 Counting of PIN attempts
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

A portable electronic device includes a first interface adapted for establishing a communication with a first external electronic entity. A first security element is adapted for detecting at least one type of attack and forbidding at least one data communication using the first interface after the detection of an attack. A second interface is different from the first interface and is adapted for establishing a communication with a second external electronic entity. A management element of the first security element uses the second interface for managing the first security element.

Claims

1. A portable electronic device, comprising:

a first interface comprising means for emitting data and means for receiving data, said first interface being adapted to establish communication with a first external electronic entity,

first means for security adapted to detect at least one type of attack and to prohibit at least one communication of data using said first interface after detection of one of said attacks,

a second interface comprising means for emitting data and means for receiving data, said second interface being different from the first interface adapted to establish communication with a second external electronic entity, and

means for administration of the first means for security using the second interface to administer the first means for security, wherein said administration means comprises de-blocking said first interface thereby de-blocking at least the reception and/or the execution of data by said first interface.

2. The portable electronic device according to claim 1, wherein the first means for security use authentication data, the means for administration being adapted to modify said authentication data.

3. The portable electronic device according to claim 2, wherein the means for administration are adapted to re-authorize communication of data using said first interface after prohibition, by the first means for security, of said communication on detection of one of said attacks.

4. The portable electronic device according to claim 2, wherein the first interface is provided with first means for receiving data from a first external electronic entity, a first data memory area containing at least one first counter element, at least one first indicator element and at least one first threshold value, said first counter element counting at least one number of occurrences of a predetermined event that has occurred in said device on reception of data by said first means for receiving, and said first counter element being able to reach said first threshold value, said first indicator element going from a first state to a second state if said first counter element has reached said first threshold value.

5. The portable electronic device according to claim 1, wherein the means for administration are adapted to re-authorize communication of data using said first interface after prohibition, by the first means for security, of said communication on detection of one of said attacks.

6. The portable electronic device according to claim 5, wherein the first interface is provided with first means for receiving data from a first external electronic entity, a first data memory area containing at least one first counter element, at least one first indicator element and at least one first threshold value, said first counter element counting at least one number of occurrences of a predetermined event that has occurred in said device on reception of data by said first means for receiving, and said first counter element being able to reach said first threshold value, said first indicator element going from a first state to a second state if said first counter element has reached said first threshold value.

7. The portable electronic device according to claim 1, wherein the first interface is provided with first means for receiving data from a first external electronic entity, a first data memory area containing at least one first counter element, at least one first indicator element and at least one first threshold value, said first counter element counting at least one number of occurrences of a predetermined event that has occurred in said device on reception of data by said first receiving means, and said first counter element being able to reach said first threshold value, said first indicator element going from a first state to a second state if said first counter element has reached said first threshold value.

8. The portable electronic device according to claim 7, wherein the second interface is provided with second means for receiving data from a second external electronic entity, a second data memory area containing at least one second counter element, at least one second indicator element and at least one second threshold value, said second counter element counting at least one number of occurrences of said predetermined event that has occurred in said device on reception of data by said second receiving means, and said second counter element being able to reach said second threshold value, said second indicator element going from a first state to a second state if said second counter element has reached said second threshold value.

9. The portable electronic device according to claim 7, wherein the first memory area and the second memory area are different.

10. The portable electronic device according to claim 7, which includes means for blocking at least one part of the operation of said device when an indicator element is in the second state.

11. The portable electronic device according to claim 7, which includes means for blocking that block all execution on reception of data via the corresponding interface when the corresponding indicator element is in the second state except the reception of an unblocking instruction.

12. The portable electronic device according to claim 7, which includes means for switching adapted to use more secure means for security of the device when an indicator element is in the second state than when said indicator element is in the first state.

13. The portable electronic device according to claim 7, wherein said event includes a failed attempt at authentication by the electronic device.

14. The portable electronic device according to claim 7, which includes means for commanding at least one indicator element to go from the second state to the first state in an event of a successful attempt at authentication using an interface that does not correspond to said indicator element.

15. The portable electronic device according to claim 7, which includes means for initialization of the corresponding counter, said initialization means reinitializing said corresponding counter if authentication using the corresponding interface succeeds.

16. The portable electronic device according to claim 1, wherein the second interface is provided with second means for receiving data from a second external electronic entity, a second data memory area containing at least one second counter element, at least one second indicator element and at least one second threshold value, said second counter element counting at least one number of occurrences of said predetermined event that has occurred in said device on reception of data by said second receiving means, and said second counter element being able to reach said second threshold value, said second indicator element going from a first state to a second state if said second counter element has reached said second threshold value.

17. The portable electronic device according to claim 1, wherein said second interface includes means for receiving data using a protocol conforming to an ISO 7816 standard.

18. A method for securing a portable electronic device, comprising:

a step of communicating with a first external electronic entity via a first interface comprising means for emitting data and means for receiving data,

a step of detecting at least one type of attack using the first interface and of prohibition of at least one communication of data using said first interface after detection of one of said attacks,

a step of communicating with a second external electronic entity via a second interface different from the first interface, the second interface comprising means for emitting data and means for receiving data and

a step of administering an operation of the detection and prohibition step, wherein said administration step comprises de-blocking said first interface thereby de-blocking at least the reception and/or the execution of data by said first interface.

19. A portable electronic device, comprising:

a first interface adapted to establish communication with a first external electronic entity,

first means for security adapted to detect at least one type of attack and to prohibit at least one communication of data using said first interface after detection of one of said attacks,

a second interface different from the first interface adapted to establish communication with a second external electronic entity, and

means for administration of the first means for security using the second interface to administer the first means for security,

wherein said second interface is configured for receiving authentication data authorizing the administration of the first means for security,

wherein said administration means comprises de-blocking said first interface thereby de-blocking at least the reception and/or the execution of data by said first interface.

20. A portable electronic device, comprising:

a first interface adapted to establish communication with a first external electronic entity,

first means for security adapted to detect at least one type of attack and to prohibit at least one communication of data using said first interface after detection of one of said attacks,

a second interface different from the first interface adapted to establish communication with a second external electronic entity, and

means for administration of the first means for security using the second interface to administer the first means for security,

wherein said means for emitting and receiving data of the first interface use a contactless communication protocol and said means for emitting and receiving data of the second interface use a contact communication protocol,

wherein said administration means comprises de-blocking said first interface thereby de-blocking at least the reception and/or the execution of data by said first interface.

21. A portable electronic device, comprising:

a first interface adapted to establish communication with a first external electronic entity,

first means for security adapted to detect at least one type of attack and to prohibit at least one communication of data using said first interface after detection of one of said attacks,

a second interface different from the first interface adapted to establish communication with a second external electronic entity, and

means for administration of the first means for security using the second interface to administer the first means for security,

wherein said second interface is configured for receiving authentication data authorizing the administration of the first means for security, and

wherein said means for emitting and receiving data of the first interface use a contactless communication protocol and said means for emitting and receiving data of the second interface use a contact communication protocol.

22. The portable device of claim 21, wherein wherein said administration means comprises de-blocking said first interface thereby de-blocking at least the reception and/or the execution of data by said first interface.