FR2852469A1 - Data encryption/decryption method, for data transmission, involves identification of the operator, and implementing encryption algorithm for which the encryption key once programmed becomes inaccessible - Google Patents

Abstract

Encrypting/decrypting process (10) is characterized by an encryption algorithm for which the encryption key once programmed becomes inaccessible, and involves: initialization and optional blocking (12) of the person performing the process; supplying data (11) to be processed; implementing the algorithm; optional addition of complementary data; and supplying the processed data (13).

Description

The present invention relates to a method of encryption / decryption by

  encryption algorithm for which the private key once programmed becomes inaccessible. This method makes it possible to encrypt / decrypt a block of data by applying an encryption algorithm using a microprocessor or a microcontroller from a key contained in a separate memory not accessible after programming.

  For this purpose, the method is exploited as follows: * Initialization and optional unlocking by an authentication of the owner / carrier of the process.

  * Provision of data to process (encryption or decryption) to the process.

  * Implementation of the algorithm by the method.

  * Provision of data processed by the process.

  The interest is that the process is produced so as to not be able to give access to the crucial information which is notably the key of encryption / decryption.

  Data privacy has become a growing problem with the development of the Internet. In recent years, cryptography has developed in the consumer field.

  At the same time security and authentication issues have spawned a number of initiatives such as the development of public key infrastructure. These infrastructures are based on asymmetric key encryption algorithms such as RSA encryption. Their particularity is to require two different keys for encryption and decryption. Thus one of the keys is made public and the other remains the sole possession of its owner.

  Security around this so-called private key is crucial for the proper functioning of this infrastructure. We must ensure that it remains the property of the person who is deemed to have this private key.

  The method which is the subject of this invention goes in the direction of this search for security. Of course, it is not limited to securing private keys but can also be used to secure any type of key.

  A data source is requesting the method for encryption or decryption. To unblock the process and be able to use it for this purpose, the operation of the process may be conditioned by a recognition of the carrier of the process. This recognition can take the form of a simple secret code and go to the provision of a biometric recognition of the carrier.

  If this optional recognition has been successful, the data is processed using the key contained in the method in a secure manner.

  The data thus processed are then returned to the applicant.

  These features and advantages will appear more precisely in the following description of nonlimiting exemplary embodiments, read in conjunction with the appended drawings in which: FIG. 1 shows the general architecture of the process, FIG. flow diagram of the operation of the process.

  * Figure 3 shows an internal synoptic of the process.

  The data to be encrypted 11 and 20 is sent to process 10 for processing. Optionally an identification 12 under an authentication request 21.

  Authentication 22 is returned to method 10. Data is processed before being returned to data source 24.

  Internally, the data to be processed is processed by the algorithm 31 to provide the processed data 33. The algorithm 31 uses this purpose of the key 32 in the protected memory 37. Only the algorithm 31 has access to the key 32.

  During the optional authentication, the identification data 36 is compared by the comparator 34. These data are compared to the reference identification 35.

  In some cases the processed data 33 may be supplemented with additional data 39 such as a certificate proving the identity of the owner of the process.

  In practice, it can be envisaged to use as an encryption algorithm, the RSA or DSA algorithm and to keep a private key associated with one of these algorithms in the protected memory. The method can thus be used to electronically sign data, encrypt or decrypt data.

  The identification can also be done by a simple secret code entered by the user using an ad hoc process or by biometric data such as a fingerprint.

  In practice a number of smart cards are available on the market and 30 have a microcontroller coupled to a memory protectable by a system of "<fuses>" that prevent reading and writing this memory after programming is complete.

  These cards can be advantageously used to put into practice the method considered in this document.

Claims (3)

claims   A method (10) of encryption / decryption characterized by an encryption algorithm for which the encryption key once programmed becomes inaccessible and which performs the following steps: * Initialization and optional unlocking by an authentication of the owner / carrier of the process (12). ); * Providing data to be processed (11) (encryption or decryption) to the process; * Implementation of the algorithm by the method; * Optional addition of additional data by the process; * Providing processed data (13) by the method.   2. Method according to claim 1 characterized by the use of a memory protected against reads and writes from outside the process (37) to contain the key (32) and possibly the identity of the carrier (35).   3. Method according to claim 1 and 2, characterized by the optional addition (38) of the complementary data (39) to the processed data (33).