Method for secure storage of sensitive data in a silicon chip integrated system storage, in particular a smart carp, and integrated system therefor

Method for safely storing sensitive data in embedded microchip system, especially smart card memory, and embedded system implementing the method

Technical field

The invention relates to a method for safely storing sensitive data in the memory of an embedded microchip system.

More specifically, it involves smart cards.

The invention also relates to an embedded system implementing the method.

Background technique

Within the scope of the present invention, the term "embedded system" refers to various systems or devices that use a microchip including data storage and data processing devices. The microchip is usually composed of a microprocessor or a microcontroller. In particular, this kind of embedded system can be constituted by a smart card.

Understand the term "sensitive" in its most general aspect. It involves all the secret or confidential data stored in one or more types of smart card-equipped memories, including encryption algorithms, secret encryption keys, identification data or confidential information, and so on. This type of data is hereinafter referred to as "secret".

The present invention relates particularly but not exclusively to the storage of secret keys stored for the secure pre-initialization of smart cards. In fact, it is well known that security-related functions are transferred to smart cards. Here again, the term "security" should be understood in a broad sense. This term actually includes different concepts: confidentiality, authentication, and so on.

Hereinafter, in order to illustrate each concept without any limitation on its scope, we will consider the best application of the present invention, unless otherwise proposed.

In the prior art, the secrets contained in the smart card are usually stored linearly in the same storage area. Specifically, the secret is stored in a permanent read-only memory ("ROM") or semi-permanent, that is, an electrically erasable programmable read-only memory of the "EEPROM" type. The memory of the microchip is vulnerable to hacker attacks, and attacks are becoming more and more sophisticated.

"Dumping" (or copying) of "ROM" memory is an old problem of smart cards.

At present, most of the known attacks are aimed at "EEPROM" type memory that usually contains so-called sensitive data.

Summary of the invention

The objective of the present invention is to eliminate some of the aforementioned disadvantages of prior art devices.

The object of the present invention is to provide a method for safely storing sensitive data in a smart card memory, and more generally, an embedded microchip system memory.

The invention also relates to an embedded microchip system for realizing the method. Microchips include data storage and data processing devices that are generally controlled by an operating system (or "OS").

To this end, according to an advantageous feature, the secret is physically and logically "divided" into several storage devices equipped with microchips.

In an advantageous embodiment, the memory of the aforementioned microchip is divided into different parts, the first part is composed of a "ROM" type memory, usually a permanent ROM, and the second part is composed of an "EEPROM" type memory, usually a semi-permanent EEPROM constitute.

According to the first variant of the method of the present invention, the same secret is "split" in two or more physically different memory sections.

Specifically, in the optimal application field of the present invention, when the "EEPROM" type memory part does not contain any other data except the data programmed in by the entity called the "chip manufacturer", this method allows the The smart card is authenticated during the initialization phase.

Within the scope of the present invention, the term "pre-initialization" has a general meaning. It particularly relates to the manufacturing stage of traditional smart cards, or the stage before the so-called initialization stage of open smart cards.

According to another advantageous embodiment, most of the data constituting a secret is stored in the "ROM". Only a small part of this data is stored in "EEPROM".

According to this additional feature of the present invention, most of a secret key is contained in a "ROM" type memory part. In order to enable the above-mentioned operating system to use the secret key as a whole, the chip manufacturer only needs to write a small part of the secret key into the "EEPROM" type memory part. Due to its specific storage method, it should be noted that the secret key is divided into two parts and shipped to two different departments of the manufacturer, which makes it possible to reduce the risk of fraud during secret transmission.

This specific storage method keeps the number of bytes programmed into the chip by the manufacturer to a minimum, and therefore has the advantage of reducing the cost of the manufacturer. In fact, in order to ensure a high degree of security, the actual key used is very long. By storing the largest part separately in ROM, these very long keys can usually be stored in EEPROM.

According to a second variant of the embodiment, a first secret is stored in a first part of the memory, and one or more other secrets derived directly or indirectly from the first secret are stored in at least one other part of a physically separate memory Inside. The above-mentioned additional secret can be obtained through encryption.

For example, in a typical application of the method according to the present invention, a (symmetric) encryption key is stored in the "ROM" type first storage area of the smart card during its mask period. During the use of the smart card, a piece of confidential information is stored in a second storage area of the "EEPROM" type. This information is encrypted using the aforementioned encryption key provided in the ROM area (for example, using the so-called triple DES algorithm). This method is very advantageous. In fact, in addition to preventing memory "dumping", it obviously also provides protection for information when it is written to the smart card. Even the entity that "writes" the key does not know the key.

As described above, no matter what embodiment or embodiment variant is involved, a successful fraud attack on a part of the memory cannot obtain the full knowledge of the secret. In fact, as long as the secret elements are wisely distributed on different parts of the memory, the partial secret knowledge obtained in a fraudulent manner and the appropriate mathematical operation that can derive all the secrets from the above partial knowledge are used to try to decrypt the secret, the secret will never be found. Those skilled in the art can accomplish this wise distribution. The attack will eventually fail.

In addition, as described below, the method of the present invention can be used in combination with verification, authentication and/or encryption, where verification, authentication and/or encryption are well known in the first place, but the combination of the present invention enhances the security that can be achieved degree.

Therefore, the subject of the present invention is a method for safely storing a piece of so-called sensitive data in the memory of an embedded microchip system. The embedded microchip system includes at least two physically different storage devices. The data segment is divided into at least two parts, and each of the above-mentioned divided parts is stored in the above-mentioned one physically different storage device.

Another subject of the present invention is an embedded microchip system that implements this method.

According to a specific embodiment, the method is characterized in that the above-mentioned sensitive data fragments are divided into first (d) and second (d) parts and stored in physically different first (1) and second (2) parts, respectively. ) In the storage device, an operation called checksum is performed on the sensitive data and the second part (d) is stored at the same time, and the result is in the form of information data fragments, and the information data is stored in the first storage device In (1), the method includes reading the above-mentioned information data, performing an additional checksum operation on the above-mentioned sensitive data, comparing the read information data with the result of performing the above-mentioned additional checksum operation using the above-mentioned sensitive data to verify it Completeness.

According to a specific embodiment, the method is characterized in that the above-mentioned sensitive data fragments are divided into first (d) and second (d) parts and stored in physically different first (1) and second (2) parts, respectively. ) In the storage device, when storing the second part (d), an operation called checksum is performed on the sensitive data, and the result is in the form of information data fragments, and the information data is stored in the first storage device In (1), the method includes reading the above-mentioned information data, performing an additional checksum operation on the above-mentioned sensitive data, comparing the read information data with the result of performing the above-mentioned additional checksum operation using the above-mentioned sensitive data to verify it Completeness.

Description of the drawings

The present invention will now be described in more detail with reference to the accompanying drawings, in which:-Figure 1 illustrates an exemplary structure of a smart card memory based on an aspect of the present invention for an application using the above method to store a secret key; and-Figure 2 illustrates A variation of the embodiment of the smart card memory structure of FIG. 1.

detailed description

As mentioned in the preamble of this specification, from now on we will consider the optimal application range of the present invention, that is, considering the security of the pre-initialization phase of the smart card.

More precisely, we will describe the method based on the present invention in conjunction with the application of storing the symmetric secret key denoted by the symbol d thereafter. This key d allows the smart card to generate a ciphertext according to an appropriate asymmetric algorithm. When it is returned to a smart card authentication terminal, this cipher text can be used to authenticate the smart card.

Figure 1 illustrates an exemplary architecture of a smart card DP. The smart card contains a memory M. In the described example, the memory M is composed of a so-called "RAM" type random access memory 3 and a non-volatile memory. The above-mentioned non-volatile memory includes a "ROM" type permanent part 1 and a Semi-permanent part 2 of "EEPROM" or similar type. The smart card CP also contains a data processing device that cooperates with an operating system 4, such as a microprocessor represented as a CPU. The operating system is a software segment composed of a sequence of microinstructions, and the sequence of microinstructions described above can be completely or partially stored in the ROM area 1 and/or the EEPROM area 2 of the memory M.

According to a feature of the present invention, the key d is stored in at least two physically different parts of the memory M. More precisely, in the illustrated example, this key d is stored in a non-volatile part of the memory M: a part in the "ROM" type permanent memory 1, and a "EEPROM" or similar type of semi-permanent memory Part of 2.

Therefore, the secret key d includes a part that is stored in the ROM 1 before reaching the entity called the "chip manufacturer", and a part that is written into the EEPROM 2 by the chip manufacturer during the so-called "sous pointe" operation. section. The bytes programmed into EEPROM2 are very sensitive data and are regarded as security bytes. Of course, this requires knowing the secret key d at the time of masking.

For example, to illustrate the concept, hereafter we will consider a 1024-bit (or 128-byte) secret key d.

In an optimal embodiment of the method of the present invention, the key d resides entirely in ROM1, but some bytes are false or changed. For example, every sixteen-byte module has one byte as a dummy byte, and an error value is deliberately written into the ROM code.

In Fig. 1, the symbols B1-B8 are used to denote modules with different keys d. The error bytes are represented as O1-O8. The correct byte value expressed as O'1-O'8 is stored in EEPROM2 and has the form of eight corresponding bytes. These bytes O'1-O'8 constitute a partial key d'.

In this example, eight (or 128/16=8) bytes must be programmed into EEPROM2. However, it should be understood that since the operating system 4 and the data processing device CPU jointly reconstruct the complete key in RAM3, they can be stored in EEPROM2 in any way, and the above key is called d" when in use. Simply by using The correct bytes O'1-O'8 replace the error bytes O1-O8 to complete the reconstruction in the above example.

Obviously, a key d or d'obtained by any means, especially through the above-mentioned fraudulent "dumping" operation, cannot derive "all secrets", that is, a completely correct key d".

As mentioned above, in order to obtain good security, the key is usually longer, such as 128 bytes or 1024 bits in length. In addition to the degree of security it provides, the method based on the present invention can store only a very small part of the total key d in the EEPROM2, that is, 8 bytes or 64 bits. The chip manufacturer should only "probate" the part of the key written into it. The above method is an important advantage due to the long and expensive operation time.

It should be understood that many other structures may be used to distribute keys in two types of memories, namely ROM1 and EEPROM2. The two byte strings only need one-to-one correspondence. However, the expert must confirm that this distribution does not allow to know one of the two partial keys d (having the same length as all the correct keys d", but being partially "altered") or d'to prevent mathematical or other methods based on this Part of the knowledge derives all keys. The distribution described above with reference to Figure 1 can meet this requirement for the key length considered.

In another variant of the method of the present invention, in order to further improve security, an additional piece of information data is stored in ROM1, so that the integrity of the secret key d can be guaranteed and the integrity of the memory ROM1 and EEPROM2 can be maintained in the future. This piece of data may have the form of a checksum calculated based on the secret key. The data segment can also be obtained through a hash function or a "hash" of the same key. For this reason, in the latter case, an algorithm called "SHA-1" is used. Therefore this specific algorithm must be installed in the smart card. The length of the result of this hash function is 160 bits. The key d is stored in the ROM 1 during the initial calculation to obtain the above key.

Whenever the secret key is used, a checksum or hash is calculated and compared with the pieces of information data stored in the memory ROM1.

Figure 2 illustrates the architecture of a smart card CP that stores such "hash" data in ROM1. Units common to FIG. 1 have the same symbolic representations and are described only when needed.

The data fragment H is stored in the ROM1 and the data fragment H is verified every time the key is used in order to maintain the integrity of the storage areas ROM1 and EEPROM2. This verification is done under the control of the data processing device CPU and the program stored in the memory.

It has been assumed so far, at least implicitly, that the secret data distributed between two physically different parts of the memory M constitutes an identical secret.

In another variant of the method of the present invention, the secret data stored in ROM1 may constitute a first secret. The second secret data derived from the first secret data can constitute a second secret. According to a feature of the present invention, this data is then stored in a second physically different part of the memory M, such as EEPROM2. Regardless of whether it is symmetrical or not, this data can be obtained by encrypting the first data using any appropriate algorithm. When the secret cannot be inferred from the knowledge about a part of the memory M, it can be considered that the secret is correctly "divided" or "divided" within the scope of the method based on the present invention.

It is obvious from reading the above content that the present invention achieves the above objectives.

By physically distributing sensitive data such as keys or similar data to at least two physically different parts of the memory of the smart card, especially the embedded microchip system, the present invention provides high security for the storage of sensitive data.

However, it must be understood that the present invention is not limited to the explicitly described exemplary embodiments, especially the embodiments described in conjunction with FIGS. 1 and 2.

Specifically, the secret data can be distributed to more than two physically different memory sections. Similarly, when the distributed data does not represent the same secret, the number of secrets derived from the first secret cannot be greater than one. It is also possible to derive the cascaded secrets and store them in physically different memory sections.

The present invention is not limited to the authentication application in which the smart card pre-initialization phase is described in detail above. As long as an encryption key or any other sensitive data segment must be stored in the memory of the embedded system, the present invention is applicable.