A system for switching the connection of a secure element from a public network to a private network, corresponding applet and entity The present invention proposes a system (300) for switching a connection of a secure element (30) from a public network to a private network. The system (300) comprises an entity (32) connected to or comprising a global private network database (37) storing a physical topology of the private network. The entity (32) comprises the secure element (30) cooperating with a telecommunication terminal (31). The secure element (30) having access to the private network and cooperating with telecommunication terminal (31), comprises an applet (33). The applet (33) switches the connection of the secure element (30) from the public network to the private network when the applet (33) determines that the telecommunication terminal (31) with which the applet (33) cooperates enters in a coverage of the physical topology of the private network, based on the content of the local private network topology database (34).
H04W 4/021 - Services concernant des domaines particuliers, p. ex. services de points d’intérêt, services sur place ou géorepères
H04W 4/60 - Services basés sur un abonnement qui utilisent des serveurs d’applications ou de supports d’enregistrement, p. ex. boîtes à outils d’application SIM
H04W 48/16 - ExplorationTraitement d'informations sur les restrictions d'accès ou les accès
H04W 48/18 - Sélection d'un réseau ou d'un service de télécommunications
2.
METHOD FOR PRODUCING DATA CARRIER AND DATA CARRIER PRODUCED THEREOF
A method of forming a data carrier for a security document, the method comprising: providing a first outer layer and second outer layer, forming a first security feature at the interface between at least two adjacent layers, said first security feature comprising a first deformation of one of the layers, forming a stacked structure with said first outer layer and said second outer layer, said stacked structure being formed by lamination, wherein said first deformation is formed by laser marking.
A method of forming a data carrier for a security document, the method comprising: providing a first outer layer and second outer layer, forming a first security feature at the interface between at least two adjacent layers, said first security feature comprising a first deformation of one of the layers, providing at least one revealing layer, forming a stacked structure with said first outer layer, said second outer layer and said revealing layer, said stacked structure being formed by lamination, wherein said first deformation is formed by ultrasonic welding.
A method of forming a data carrier for a security document, the method comprising: providing a first outer layer and a second outer layer, forming a first security feature at the interface between at least two adjacent layers, said first security feature comprising a first deformation of surface of one of the layers, forming a stacked structure with said first outer layer and said second outer layer, said stacked structure being formed by lamination, wherein the first deformation of the surface of one of the layer is replicated during lamination such that at least one replicated deformation is formed inside the data carrier at the interface between at least some of the layers.
This method (100), which is implemented by a mobile terminal, consists in combining (300), in a final result (RF), a first result (RR) relating to an instantaneous probability of cell change, and a second result (RL) relating to an exchange latency on a signalling plane between the mobile terminal and a base station of a serving cell, the first result, respectively the second result, being obtained (150, 250) by comparing a measurement (Xi(t+1)) of a first quantity, respectively a measurement (L(t+1)) of a second quantity, with a prediction (X'i(t+1)) of the first quantity, respectively a prediction (L'(t+1)) of the second quantity, a telephone identifier-capturing device being detected when one and/or the other of the first and second results indicates a mismatch between the measurement and the prediction of the associated quantity.
A method for maintaining a secure channel between a client and a server through a wireless network, a secret being shared between the client and the server. the method including while the client is in sleep mode and data must be transmitted from the client to the server, wake-up of the client and initiating, by the client, a procedure for restoring the secure channel by transmitting to the server a change of state wake-up message, protected by using the secret, and while the client is in sleep mode and that data must be transmitted from the server to the client, wake-up of the client by the server by means of the transmission of a paging message and launching by the client, the restoring procedure of the secure channel by transmitting to the server, a change of state wake-up message using the secret.
The invention provides a method to execute a suitable hybrid signature by a secure element during communication with a reader; the method comprising: - the reader sends to the secure element a command to execute the hybrid signature, - the secure element prompts the reader to fetch parametrized instructions to proceed with the hybrid signature, - the secure element sends a data structure containing pre-configured cryptographic parametrization to perform at least one hybrid signature, - the reader receives the data structure and maps the cryptographic parametrization of the secure element with a set of instructions to cause the secure element to perform the suitable hybrid signature, - the reader sends the set of instructions, and, in response, the secure element sends the result of executing the suitable hybrid signature.
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
Provided is a method for enrolling a public key if a payment card in a server that embeds a private key and a certificate comprising the public key. The method includes operating a payment transaction by performing an off-line data authentication during which a POS terminal receives from the payment card the certificate and verifies its genuineness, and receiving by the POS terminal a card identifier permanently allocated to the payment card. Only if the genuineness of the certificate is successfully verified, it further forms by the POS terminal a trusted data by uniquely binding said card identifier and public key, the trusted data comprising said card identifier and public key, sends the trusted data from the POS terminal to the server, and enrolls the public key by storing the trusted data in a memory of the server.
G06Q 20/38 - Protocoles de paiementArchitectures, schémas ou protocoles de paiement leurs détails
G06Q 20/20 - Systèmes de réseaux présents sur les points de vente
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
9.
LAWFUL INTERCEPTION OF ACTIVITY OF AN APPLICATION FUNCTION
Provided is a method to enable lawful interception of activities of a user equipment UE with an application function AF associated to a bootstrapping technology, said activities using an AF key, while the UE is in a roaming situation with a visited Public Land Mobile Network vPLMN using a Generic Universal Temporary Identifier GUTI, said vPLMN having been provided, for lawful interception purposes, with a said provided application function key by a third party controlling the AF. Other embodiments disclosed.
The invention relates to non-volatile memory circuit comprising a plurality of memory cells, a synchronization circuit for providing internal synchronization signals for controlling read amplifiers and performing a read operation on at least one of the memory cells when a reading signal is activated. The non-volatile memory comprises at least one check circuit (390), said check circuit (390) receiving at least one internal synchronization signal (ATD, SEN, DLA) and providing at least one check signal (CHKATD, CHKSEN, CHKDLA), said check signal toggling each time an internal synchronization signal (ATD, SEN, DLA) comprises an active edge.
G11C 16/22 - Circuits de sécurité ou de protection pour empêcher l'accès non autorisé ou accidentel aux cellules de mémoire
G11C 7/24 - Circuits de protection ou de sécurité pour cellules de mémoire, p. ex. dispositions pour empêcher la lecture ou l'écriture par inadvertanceCellules d'étatCellules de test
G11C 16/26 - Circuits de détection ou de lectureCircuits de sortie de données
G11C 7/22 - Circuits de synchronisation ou d'horloge pour la lecture-écriture [R-W]Générateurs ou gestion de signaux de commande pour la lecture-écriture [R-W]
G11C 7/12 - Circuits de commande de lignes de bits, p. ex. circuits d'attaque, de puissance, de tirage vers le haut, d'abaissement, circuits de précharge, circuits d'égalisation, pour lignes de bits
G11C 16/24 - Circuits de commande de lignes de bits
A method of producing a data carrier (1) comprising at least one target element (2) comprises the steps of i) arranging a processing layer (3) and a background layer (4) above one another, ii) irradiating electromagnetic radiation (R) onto the processing layer (3), wherein the processing layer (3) at regions of impingement of the electromagnetic radiation (R) is cut and sealed to the background layer (4), and iii) removing the processing layer (3) after the irradiation of the electromagnetic radiation (R), wherein a remaining part (5) of the processing layer (3) being sealed to the background layer (4) remains on the background layer (4), whereby the at least one target element (2) is formed.
A system (100) and method (800) for verifying the authenticity of communication between a mobile client (102) and a server (106) includes creating (802) a self-signed application binding certificate (104), establishing (804) a secure channel to communicate the application binding certificate with an application binding service (302), validating (806) the application binding certificate by the application binding service to register a public key at the server, setting (807) a validity and expiration for the application binding service, and sending (808) validation of the binding to the client. The system and method after successful binding, can sign (810) all sensitive requests at an HTTP level by the application binding private key that is verified by the application binding service ensuring the request's origin from a rightful mobile application and return (812) a verification status and application binding public key Id by the application binding service to a Backend Service (312).
H04W 12/48 - Dispositions de sécurité utilisant des modules d’identité utilisant la liaison sécurisée, p. ex. liant de manière sécurisée les modules d'identité aux dispositifs, aux services ou aux applications
H04W 12/069 - Authentification utilisant des certificats ou des clés pré-partagées
13.
METHOD FOR GETTING THE AGREEMENT OF THE USER TO PURSUE A FINANCIAL TRANSACTION
The invention is a method for managing a contactless financial transaction involving a payment instrument (10) assigned to a user (50) and comprising both a sensor (52) and a contactless unit (16) able to communicate a in contactless mode with a payment terminal. During a first tap, the payment instrument gets a transaction data (61) from the payment terminal, and during a second tap after the first tap, the payment instrument sends to the payment terminal a decision data (71) reflecting an agreement or a refusal of the user to pursue the transaction. The payment instrument comprises a wireless unit (15) for communicating with a personal equipment (30). During the first tap, as soon as the payment instrument detects an electromagnetic field, the payment instrument immediately powers the wireless unit, then sends the transaction data to the personal equipment.
G06Q 20/20 - Systèmes de réseaux présents sur les points de vente
G06Q 20/32 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des dispositifs sans fil
G06Q 20/34 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des cartes, p. ex. cartes à puces ou cartes magnétiques
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
G07F 7/08 - Mécanismes actionnés par des objets autres que des pièces de monnaie pour déclencher ou actionner des appareils de vente, de location, de distribution de pièces de monnaie ou de papier-monnaie, ou de remboursement par carte d'identité codée ou carte de crédit codée
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
G06K 19/073 - Dispositions particulières pour les circuits, p. ex. pour protéger le code d'identification dans la mémoire
The invention relates to a method for detecting a reading error caused by a photoelectric or radiative attack of a non-volatile memory having memory cells (MCj,i) connected to at least one bit line (BLi), and comprising each a floating gate transistor, wherein the reading of a memory cell (MCj,i) is made by pre-charging a bit line (BLi) to a preload voltage and comparison of the bit line voltage to this preload voltage after a reading time during which a selected cell (MCj,i) charges or discharges the bit line (BLi) polarized by a constant current, the constant current being provided by a reference generator (320), characterized in that the detection of the photoelectric or radiative attack is made by a monitoring of the constant current, and wherein an alarm signal (ALARM) is provided when an abnormal constant current is detected.
G11C 16/22 - Circuits de sécurité ou de protection pour empêcher l'accès non autorisé ou accidentel aux cellules de mémoire
G11C 16/26 - Circuits de détection ou de lectureCircuits de sortie de données
G11C 7/24 - Circuits de protection ou de sécurité pour cellules de mémoire, p. ex. dispositions pour empêcher la lecture ou l'écriture par inadvertanceCellules d'étatCellules de test
The invention relates to a non-volatile memory circuit (300) comprising a plurality of memory cells (MCj,i), a plurality of bit lines (BLi) and a plurality of word lines (WLj to WLj+2), each memory cell (MCj,i) comprising a floating gate transistor (Tfg) for memorizing a bit value and being located at the intersection of a bit line (BLi) and of a word line (WLj), said non-volatile memory circuit (300) comprising a polarization circuit (360) for polarizing the bit lines (BLi) with a constant current, and reading amplifiers (370) connected to bit lines (BLi) for reading the value of memory cells (MCj,i) selected by one of the word lines (WLj). The memory circuit (300) further comprises an attack detector (390) comprising at least one detection circuit (391) having a first input terminal connected to at least one bit line (BLi) for detecting an abnormal voltage on the bit line (BLi) and for providing an alarm signal (ALARM) on an output terminal when the abnormal voltage is detected.
G11C 16/22 - Circuits de sécurité ou de protection pour empêcher l'accès non autorisé ou accidentel aux cellules de mémoire
G11C 16/26 - Circuits de détection ou de lectureCircuits de sortie de données
G11C 7/24 - Circuits de protection ou de sécurité pour cellules de mémoire, p. ex. dispositions pour empêcher la lecture ou l'écriture par inadvertanceCellules d'étatCellules de test
The invention concerns a method for authentication a device (102) comprising an eUICC (104). The method comprises binding in a factory the eUICC (104) with an authorized device (102) comprising the eUICC (104). The binding is performed through storing in the eUICC (104) and the authorized device (102) at least a cryptographic key permitting to authenticate the authorized device (102) by the eUICC (104). The method comprises authenticating, upon an occurrence of an event, the device (102) by the eUICC (104) by performing a cryptographic operation and, if the authentication fails, determining that the device (102) comprising the eUICC (104) is not the authorized device (102), and, if the authentication is successful, determining that the device (102) comprising the eUICC (104) is the authorized device (102).
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
H04W 12/02 - Protection de la confidentialité ou de l'anonymat, p. ex. protection des informations personnellement identifiables [PII]
H04W 12/04 - Gestion des clés, p. ex. par architecture d’amorçage générique [GBA]
The invention is a method for managing a payment transaction involving a payment instrument (10) assigned to a user (50) and including both a sensor (52) and a credit transfer application (17) comprising an internal key and a first reference of a first banking. The credit transfer application receives from a payment terminal a request command (70) to authorize a money transfer from the first banking account to a second banking account assigned to a merchant. The request command comprises a transfer amount and a second reference of the second banking account. Upon receipt of the request command, the payment instrument detects whether the sensor is activated by the user or not. Only if the sensor turns out to be activated, the credit transfer application computes a signature using both the transfer amount, the internal key and said first and second references and sends the signature to the payment terminal.
G06Q 20/20 - Systèmes de réseaux présents sur les points de vente
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
G06K 19/073 - Dispositions particulières pour les circuits, p. ex. pour protéger le code d'identification dans la mémoire
G06Q 20/34 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des cartes, p. ex. cartes à puces ou cartes magnétiques
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
G07F 7/08 - Mécanismes actionnés par des objets autres que des pièces de monnaie pour déclencher ou actionner des appareils de vente, de location, de distribution de pièces de monnaie ou de papier-monnaie, ou de remboursement par carte d'identité codée ou carte de crédit codée
18.
A METHOD FOR ESTABLISHING A SECURE COMMUNICATION CHANNEL BETWEEN A MOBILE DEVICE AND AND A GNB OF A VISITED NETWORK AND CORRESPONDING EQUIPMENT
The invention relates to a method to perform a mutual authentication according to a predefined authentication scheme between a User Equipment UE and a 5G communication serving ground network in a context where the UE having a Subscription Permanent Identifier (SUPI) registered at a home network is connected via a non-geostationary satellite access in store and forward operation The invention proposes to reverse the authentication flow by initiating the authentication flow on the UE side.
A method for mobile application instantaneous secure communication is provided. It provides for issuing of application specific cryptographic material for public applications in the platform specific app stores in a secure and trusted manner. The method includes receiving a diversified mobile app injected with cryptographic material by way of an application diversification process according to one of: a no delegation mode, a partial delegation mode, and a full delegation mode. Upon completion of said application diversification process, said diversified mobile app uses said cryptographic material to instantaneously establish a secure communication channel for out-of-the-box provisioning and secure onboarding with an Application vendor associated with said mobile app binary, or licensing to consume said service from another platform other than that of said Application vendor hosting said mobile app binary. Other embodiments are disclosed.
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
21.
ELECTRONIC CIRCUIT AND METHOD FOR SECURING AND DESYNCHRONIZING REGISTER TRANSFERS TO MITIGATE SIDE CHANNELS ATTACKS
An electronic device is provided for securing and desynchronizing register transfers as a mitigation strategy to side channel attacks that employ power analysis profiling, whereby leakage information produced as a result of register switching at the bit-level, by way of random delay cell insertions, is decorrelated from actual power consumption. The technical effect of the solution constructively produces overlapping of current power profiles/signatures, maximally spanning across bit value profiles of a register, which when analyzed from a Hamming Weight or Distance model introduces a wider time-spread of resulting current power profiles thereby impeding deep learning of the transistor switching/flipping state behavior, and consequently disrupting efficacy of profile/signature matching/mapping of transistor state changes characteristic of a traditional power analysis side channel attack. Other embodiments are disclosed
G06F 21/75 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information par inhibition de l’analyse de circuit ou du fonctionnement, p. ex. pour empêcher l'ingénierie inverse
The present invention relates to a method to create and manage a unique virtual identity, called ID-token, for a user. The ID-token enables user status verification across different virtual environments managed by different operators where the user has diverse identifiers. A trusted party receives and verifies personal identity data, selects parameters, and calculates the ID-token, which serves as proof of identity ownership and includes metadata for status verification. The ID-token is linked to a unique identifier and a smart contract. The ID-token and its smart contract are recorded on a blockchain accessible to virtual environment operators, with calculation data securely transferred to the user. Operators manage a banishment list of banished ID-tokens and validate registration requests by verifying the presence of ID-token in banishment list.
G06F 21/62 - Protection de l’accès à des données via une plate-forme, p. ex. par clés ou règles de contrôle de l’accès
G06F 21/64 - Protection de l’intégrité des données, p. ex. par sommes de contrôle, certificats ou signatures
G06Q 20/36 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des portefeuilles électroniques ou coffres-forts électroniques
G06Q 20/06 - Circuits privés de paiement, p. ex. impliquant de la monnaie électronique utilisée uniquement entre les participants à un programme commun de paiement
G06Q 20/12 - Architectures de paiement spécialement adaptées aux systèmes de commerce électronique
23.
A METHOD FOR INSTALLING A PROFILE ON AN EMBEDDED SIM
A virtual bound profile, created by the steps of generating by an In-Factory Binding Box a virtual eSIM, wherein the virtual eSIM comprises a virtual eSIM identifier and a virtual one-time key pair, wherein the virtual one-time key pair includes a virtual one-time public key and a virtual one-time private key; preparing by the In-Factory Binding Box an output file comprising the virtual eID and the virtual one-time public key of the virtual IFPP Key that corresponds to the virtual eSIM, and binding by a profile manager the virtual one-time public key of the output file with a profile to form the virtual bound profile. Other aspects are discussed.
The present invention provides a system or method for self-issued verifiable credentials (VC) can include a tamper-proof environment in the form of a secure element or trusted execution environment (SE/TEE) within or operatively coupled to an application and a master verifiable credential template secured and protected from unauthorized modification of credential data or from unauthorized modification of secrets of the master verifiable credential template, where the master verifiable credential template is a trusted application securely delegated by an issuer and executed inside the tamper-proof environment within a user's premises to issue a self-issued verifiable credential upon a verifiable presentation request by a verifier. The user's premises can be a client device or element such as a smart phone, a mobile phone, a subscriber identity module, a smart card, a lap top computer, a notebook computer, or a tablet computer.
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
G06F 21/64 - Protection de l’intégrité des données, p. ex. par sommes de contrôle, certificats ou signatures
25.
SECURELY GENERATING AND MULTI-PARTY SHARING OF A ROOT OF TRUST IN A CLUSTERED CRYPTOSYSTEM
Provided is a system (100) for securely generating, and multi-party sharing of, a Root of Trust (RoT) in a clustered cryptosystem (110) by way of a secure enclave (55) within each node (50). It improves cluster loading crypto command performance such as digital signing and signature verification without use of an HSM. Each node attests to a Remote Server (40), submits a join request, and receives obfuscated key splitter logic. A different Remote Server provides a deobfuscator code to the node. Nodes share attestation information amongst themselves for joining the cluster (110). A primary node generates the RoT and splits it into partitions, which are then shared with other nodes. Each node thereafter regenerates the same RoT. Communications between secure enclaves are secured over a TLS channel. Other embodiments are disclosed.
H04L 9/00 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité
H04L 9/30 - Clé publique, c.-à-d. l'algorithme de chiffrement étant impossible à inverser par ordinateur et les clés de chiffrement des utilisateurs n'exigeant pas le secret
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
The invention relates to a method to entrust requested data at a relying party, said requested data coming from an unsecure software component in a user equipment of a user, said user equipment having a secure component storing data hash of said data and having a pseudonym. The secure component produces a cryptogram being a concatenation of several ciphertexts successively obtained by chaining executions of a trust cryptography function using a secure component's secret key, said function being applied to successive plaintexts comprising at least the secure component's pseudonym and data hash of the data corresponding to data's references requested by the relying party which then receives and deciphers the requested data that has been enciphered by the software component using the last ciphertext concatenated in at least said cryptogram and an applicative cryptography algorithm. The cryptogram is sent to a trust service for de-concatenation and chaining executions of a trust cryptography function correlated to the trust cryptography function of the secure component to extract the secure component's pseudonym and the data hash of the data corresponding to the given data's reference in successive de-ciphered plaintexts. The method entrusts received deciphered data only if the extracted pseudonym corresponds to the received pseudonym, and if the data hash corresponding to the given data's reference extracted by the trust service corresponds to the data hash corresponding to the given data's reference calculated by the relying party.
H04L 9/06 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité l'appareil de chiffrement utilisant des registres à décalage ou des mémoires pour le codage par blocs, p. ex. système DES
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
The present invention relates to a method to manage transmission of a very small aperture terminal (VSAT UE) adapted to determine its geographical location and being in connection in new radio frequencies with a satellite access node (SAN) covering a Non-Terrestrial Network cell, where other Terrestrial Network user devices (TN UE) are active in new radio frequencies and/or where local regulations apply. Said method comprises exchanges of messages as predefined in (5G) NR RRC Connection Setup protocol, one of the predefined messages of the protocol sent from the VSAT UE to the SAN has a new field comprising at least a VSAT geographical location as determined by the VSAT UE and the SAN is configured to evaluate the interferences' situations and local regulations in the Non-Terrestrial Network cell in relation with the received VSAT UE location and to determine a transmission status to be applied to the VSAT UE accordingly. The subsequent predefined message as sent from the SAN to the VSAT UE has a new field comprising a VSAT transmission configuration command and the VSAT UE applies the transmission configuration command as received in the subsequent message.
The invention is a method for managing a monetary transaction for an amount involving a banking terminal (20) and a payment instrument (10) assigned to a user (75) and comprising a payment application (11) designed to participate to the monetary transaction in a first way by using a conventional account uniquely assigned to the user and in a second way by using a relay account uniquely assigned to another person (77). Responsive to a command (81) requesting a cryptogram to be generated, the payment instrument performs a selection procedure leading to select the second way only if a predefined condition is met. Only if the second way is selected, the payment instrument sends to the banking terminal a relay request comprising a first identifier of the relay account and requesting that the amount be paid from the relay account, subject to agreement of the person specifically for said monetary transaction.
G06Q 20/32 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des dispositifs sans fil
G06Q 20/34 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des cartes, p. ex. cartes à puces ou cartes magnétiques
G06Q 20/38 - Protocoles de paiementArchitectures, schémas ou protocoles de paiement leurs détails
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
G06Q 20/42 - Confirmation, p. ex. contrôle ou autorisation de paiement par le débiteur légal
30.
VARIABLE-APPEARANCE LASER MARKING OVER PRINTED LAYERS
A data carrier extends along an extension direction (E) and comprises at least one carrier body and at least one processing layer. The processing layer, at least in an unprocessed state of the processing layer, comprises one or more reactive elements and one or more unreactive elements. The reactive elements are configured to interact with impinging electromagnetic radiation (R) upon a processing of the processing layer. The processing layer, in a processed state of the processing layer, comprises one or more reacted elements being generated from the reactive elements. The processing layer in the processed state furthermore comprises one or more further reacted elements being generated from one or more of the unreactive elements upon the interaction of the reactive elements with the impinging electromagnetic radiation (R) and furthermore comprises one or more unreactive elements remaining non-interacting. The processing layer in the processed state furthermore comprises at least one personalization element, which personalization element comprises or consists of the non-interacting unreactive elements.
G03F 7/00 - Production par voie photomécanique, p. ex. photolithographique, de surfaces texturées, p. ex. surfaces impriméesMatériaux à cet effet, p. ex. comportant des photoréservesAppareillages spécialement adaptés à cet effet
31.
METHOD FOR DETECTING A FORGERY OF AN IDENTITY DOCUMENT
Provided is a method for detecting a forgery of an identity document including a visual security element. A neural network is trained with a training data set such that an input to the dedicated neural network is a filtered image for a given identity document and an output of the dedicated neural network is an indicator of the forgery or not of said given identity document, wherein said output is based on geometrical objects in said input filtered image created by a replacement or a displacement of a security element in said given identity document and revealed by said digital image filtering, thereby producing a set of parameters for the dedicated neural network with which the processor of the security device has been programmed. Other embodiments disclosed.
G06V 20/00 - ScènesÉléments spécifiques à la scène
G06V 10/70 - Dispositions pour la reconnaissance ou la compréhension d’images ou de vidéos utilisant la reconnaissance de formes ou l’apprentissage automatique
The disclosure concerns a method for updating a secure element cooperating with a telecommunication terminal in a telecommunication network, the updating being performed by an OTA server, the method including sending from the OTA server to the secure element a trigger of polling message through a LwM2M channel, in order to ask to the secure element to establish a https channel with the OTA server, the OTA server updating the secure element through the https channel after establishment of the https channel.
A modular identity verification system includes an agent interface module (AIM) that interacts with at least one traveler interface module and one or more processors using computer instructions which when executed by the one or more processors causes the one or more processors to perform the function of arrayed parallel processing of traveler biometric inputs and credential inputs from the at least one traveler interface module and from a second traveler interface module. The traveler interface module can have one or more processors configured for at least biometric capture and recognition and for document scanning of credentials. In some embodiments, the modular identity verification system further includes a visual signaling indicating system that indicates a status to an agent and at least a waiting traveler.
The invention relates to a LED circuit breaker (23) intended to be mounted serially between a LED driver (21) and a LED source (22), the LED circuit breaker (23) comprising: - a controlled switch (231) serially mounted between the LED driver (21) and a LED source (22) for closing or opening the circuit, - a sensor (232) measuring the power provided by the LED driver (21) to the LED source (22), the sensor (232) providing a measure, - a control circuit (233) connected to the sensor (232) for receiving the measure and connected to the controlled switch (231) for controlling said switch, the control circuit (233) being configured for: o making a time integration of the measure for obtaining an illumination value (CNT) representative of a quantity of illumination, o opening the controlled switch (231) when the illumination value exceeds a predetermined threshold.
The invention provides a method for increasing the security of a FDO-compliant communication device, wherein the method comprises the following steps: • providing a hardware-based secure element comprising an IoT SAFE applet; wherein the IoT SAFE applet comprises at least one empty persistent container configured to store cryptographic data generated by the IoT SAFE applet; • providing the FDO-compliant communication device; • connecting the hardware-based secure element to the FDO-compliant communication device; • generating, by the IoT SAFE applet, a public and a private device key, the public and private keys being stored in the empty container of IoT SAFE applet; • producing a device certificate by using the public and private device keys of the IoT SAFE applet; and • computing a Device Initialization, DI, protocol to establish a device ownership chain.
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
H04W 4/70 - Services pour la communication de machine à machine ou la communication de type machine
H04W 12/069 - Authentification utilisant des certificats ou des clés pré-partagées
H04W 4/35 - Services spécialement adaptés à des environnements, à des situations ou à des fins spécifiques pour la gestion de biens ou de marchandises
The invention is a method for manufacturing a smart card (10) including a card body (11) in which the body is provided with an antenna (30), first and second user interface sensors (24, 25) and a secure entity including a processing unit (21) having a wireless communication module (22) connected to the antenna and a sensor controller (23). The method comprises the steps of: providing the card body with a first connecting unit (26) connecting the sensor controller (23) to said first user interface sensor (24) and providing the body (ID with a second connecting unit (27) connecting the sensor controller (23) to said second user interface sensor (25); and providing the card body with an intermediate inlay (40) carrying an electrical circuit formed by a conductive wire integrated on the inlay. Said first and second user interface sensors are capacitive buttons and said electrical circuit constitutes both said first and second user interface sensors, said first and second connecting unit and the antenna.
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
G06K 19/077 - Détails de structure, p. ex. montage de circuits dans le support
37.
COMPUTER-IMPLEMENTED METHOD FOR REFINED LOCALIZING AN IRIS OF AN EYE
The invention relates to a first computer-implemented method (1) for localizing an iris (20.0) of an eye (2), wherein said first computer-implemented method (1) comprising: - a detection of a first position (B1) of the iris (20.0) within a first image (11) of an eye (2), - a cropping of said first image (11) according to said first position (B1) so as to obtain a second image (I2), - a detection of a second position (B2) of the pupil (20.1) of said eye (2) based on said second image (I2), - a coarse estimation of the pupil (20.1) based on said second position (B2) of the pupil (20.1), - a refined localization of said iris (20.0) based on said first image (11) and on said pupil's coarse estimation.
G06V 10/25 - Détermination d’une région d’intérêt [ROI] ou d’un volume d’intérêt [VOI]
G06V 10/46 - Descripteurs pour la forme, descripteurs liés au contour ou aux points, p. ex. transformation de caractéristiques visuelles invariante à l’échelle [SIFT] ou sacs de mots [BoW]Caractéristiques régionales saillantes
G06V 40/18 - Caractéristiques de l’œil, p. ex. de l’iris
38.
METHOD FOR SECURELY PROTECTING EXECUTION OF A SOFTWARE CODE AGAINST FAULT INJECTION ATTACKS
The present invention relates to a method for protecting execution of a function of a software code against fault injection attacks, said method being performed by an electronic system comprising a hardware processor and comprising performed by said hardware processor: - a) saving (S1) an initial context of said function to be executed, - b) successively executing at least two times said function, said initial context being restored before each execution after a first one, until a comparison between at least two checksums computed from the context of said function after successive executions of the function is indicative that no effect of any fault injection attack has disturbed the last execution of said function (S2) and, - c) keeping a result of the last execution of said function as result of the function execution (S3).
G06F 21/54 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par ajout de routines ou d’objets de sécurité aux programmes
G06F 21/52 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données
The present invention relates to a method of securing a software code comprising at least one expression, said method generating a secure software code and comprising performed by a processor, the steps of: □ determining (S1) in the software code an expression to be protected comprising first variables, □ generating (S2) from said expression to be protected a modified expression by inserting a plurality of second variables in said expression to be protected such that said modified expression is equivalent to said expression to be protected when said second variables verify a first predetermined condition, □ generating (S3) a mixed Boolean-arithmetic expression semantically equivalent to said modified expression, □ selecting (S4) at least one variable among said second variables in said mixed Boolean-arithmetic expression and choosing a constant value for each of said at least one selected variable, □ partially evaluating (S5) said generated mixed Boolean-arithmetic expression by setting each of said at least one selected variable to said chosen constant value and replacing in the software code said expression to be protected with said partially evaluated mixed Boolean-arithmetic expression, □ securely ensuring (S6) that, when said partially evaluated mixed Boolean-arithmetic expression is evaluated at runtime, said first predetermined condition to be verified by said second variables is met.
A secure element for a device includes an operative system the secure element including a first security applet configure to communicate with the device operative system, wherein the first security applet is configure to accept any first external application, after performing a key registration, as a local administrator application for some first data provided by the first external application, so that no other external application may access the first data without a permission of the first external application. The disclosure also provides a telecommunications device and a method of management of secure information in such a secure element.
A method for updating the firmware of a device while preserving a previously established set of diversification data, including creating a common firmware (FW) image for a plurality of devices and loading the FW image to the devices; generating per-device diversified data and loading the data to the devices; and for each device, generating diversified data and grouping the diversified data into a Binary Large Object (BLOB).
The invention relates to code updating method for updating a previous program code (100), the method comprising the loading of an updated program code (200) for replacing the previous program code (100) and the following steps: - allocating a duplication area (300) of non-volatile memory, - copying non-volatile data (DO(A), DL(A)) of the previous program code (100) into the duplication area after adding a signature of the data in a header of said data (DO(A), DL(A)), the signature authenticating the data to be originating from the previous program code (100), - formatting and transferring the copied data (DO(B), DL(B)) from the duplication area (300) to a non-volatile memory area (250) allocated for the non-volatile data of the updated program code (200), - validating the updated program code (200) replaces the previous program code, - releasing the non-volatile memory area (150) allocated for the non-volatile data of the previous program code (100).
G06F 21/57 - Certification ou préservation de plates-formes informatiques fiables, p. ex. démarrages ou arrêts sécurisés, suivis de version, contrôles de logiciel système, mises à jour sécurisées ou évaluation de vulnérabilité
The invention relates to tamper resistant elements and, more particularly, to rollback of code operable on tamper resistant elements and selective rollback of data related to code images. The tamper resistant element according to the invention provides a mechanism for selectively retaining data from a previous version, rolling back data to a version of a program being rolled back to, or rolling back to an original version of the program.
G06F 21/57 - Certification ou préservation de plates-formes informatiques fiables, p. ex. démarrages ou arrêts sécurisés, suivis de version, contrôles de logiciel système, mises à jour sécurisées ou évaluation de vulnérabilité
The present invention relates to a method for securely protecting execution of a software code against physical attacks, said software code comprising calls to a plurality of functions and, before a call to a first function among said plurality of functions, an instruction storing the address of said first function into a global variable, said method being performed by an electronic system comprising a hardware processor, a non-volatile memory and a detection system configured to detect an attack on said electronic system during an execution of a function among said plurality of functions, and comprising: - detecting (S1), by said detection system, during an execution of said first function, an attack on said electronic system, - after said detection of an attack, retrieving the address from where the first function was called, storing said retrieved address in said non-volatile memory and stopping the execution of said first function (S2), - on the next startup of the electronic system (S3): o determining if an attack has occurred during a previous execution of said first function by checking if an address of a call to said first function is stored in said non- volatile memory, o when it is determined that an attack has occurred during a previous execution of said first function, updating the software code in said non-volatile memory by replacing at said address stored in said non-volatile memory the call to the first function by a call to a function which: activates security countermeasures, calls said first function using the address saved in said global variable and deactivates said activated security countermeasures after the execution of said first function.
G06F 21/54 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par ajout de routines ou d’objets de sécurité aux programmes
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
45.
METHOD FOR SECURELY TRANSFERRING DATA ELEMENTS VALUES
Provided is a method for securely transferring data element values stored in a first device to a second device, where each stored data element value being encrypted with a storage key (KSi). It includes mutually agreeing on a short term session key (STK), determining, for each stored data element value an ephemeral key as a sub-sequence of a pseudorandom sequence (bsi) derived from the short term session key (STK), encrypting, each stored data element values using said ephemeral key, decrypting, each data element value encrypted with an ephemeral key, using the storage key (KSi), to obtain KSi-decrypted data element values, transferring said KSi-decrypted data element values from the first device to the second device, obtaining, by the second device, the ephemeral keys from the short term session key (STK), and decrypting the transferred data element values using the obtained ephemeral key.
H04L 9/06 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité l'appareil de chiffrement utilisant des registres à décalage ou des mémoires pour le codage par blocs, p. ex. système DES
46.
METHOD AND SYSTEM FOR UPGRADING THE FIRMWARE OF A DEVICE
A method for upgrading a firmware of a device by an upgrade agent, wherein the firmware comprises a persistent data and an operating system binary code, including determining by the upgrade agent whether the device is running in a regular mode, a loader mode, or a data upgrade mode; if the device is in regular mode, requesting that the device switches to loader mode; if the device is in loader mode, loading a new version of an operating system binary code, and requesting the device to switch to data upgrade mode; and if the device is in data upgrade mode, triggering an upgrade of a preexisting persistent data, and requesting the device to switch to regular mode.
A method for providing a safe backup for an operating system (OS) of an embedded device that is in communication with a server, wherein embedded device comprises the OS and a loader, wherein the loader is a component of the embedded device that is separate from the OS, the method includes detecting that there has been an interruption in a normal operation of the OS, and engaging a safe mode of the loader, wherein the safe mode sustains connectivity between the embedded device and the server, and diagnoses an error that caused the interruption.
G06F 11/14 - Détection ou correction d'erreur dans les données par redondance dans les opérations, p. ex. en utilisant différentes séquences d'opérations aboutissant au même résultat
The invention provides a method of generating a digital contract between at least a first user of a first terminal and a second user of a second terminal, wherein the method comprises: - obtaining (300) contract information, the contract information comprising a first identifier associated with the first user and a second identifier associated with the second user; - generating (301), based on the obtained contract information, a digital contract having a data structure with at least a first section including terms of the digital contract and a second section comprising the first identifier and the second identifier; - giving access (302) to the generated digital contract to the first terminal and to the second terminal, in order to obtain a first digital signature from the first user and a second digital signature from the second user.
G06F 21/64 - Protection de l’intégrité des données, p. ex. par sommes de contrôle, certificats ou signatures
G06Q 20/02 - Architectures, schémas ou protocoles de paiement impliquant un tiers neutre, p. ex. une autorité de certification, un notaire ou un tiers de confiance
G06Q 20/38 - Protocoles de paiementArchitectures, schémas ou protocoles de paiement leurs détails
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
G06Q 30/06 - Transactions d’achat, de vente ou de crédit-bail
H04L 9/00 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité
The invention is a method for managing a remote server that assigns to a user agent (30) a session reference (31) and a user authentication request. The user agent (30) delegates the authentication request to an identity wallet (20) that sends a proof (21) of identity to the remote server (10). The user agent and the identity wallet are two separate devices, one of which generates and displays an ephemeral confirmation token (60) and sends to the remote server a control token (65) generated from the ephemeral confirmation token. The other of said devices gets a code (61) entered by the user then communicates with the remote server for contributing to a checking of the code by using the control token. The remote server grants rights associated to the session reference only if the proof of the identity is valid and if said checking is successful.
The invention is a method for authenticating a user (50) using a biometric sensor (40) comprising capturing a candidate biometric data (60) of the user and extracting candidate elements (61). Based on a ranking (12), identifying a selected group (22) of reference templates stored in the portable device and initializing an incremental matching score (13); - While an ending condition is not met, iteratively performing the steps: - Identifying a selected reference template in the selected group based on metadata previously assigned to the selected reference template during a preliminary enrollment phase; - Updating the incremental matching score with both a result of a match checking between said candidate elements and the selected reference template and a result of an overlapping check between said candidate elements and the selected reference template; - If the incremental matching score is higher than a first threshold (15), considering the ending condition is met, then: - Computing a coherence score (16) by checking that relative positions of the reference templates used to compute the incremental matching score are consistent with affine transformations between the reference templates used for computing the matching score, - then considering the user is successfully authenticated only if the coherence score is higher than a second threshold (17).
The invention is a method for relay attack protection of a transaction involving a payment instrument (10) receiving a command (71) from a coupled terminal (20); the transaction having a transaction type and an amount. The method comprises the following steps: - upon receipt of the command, the payment instrument sends, through a wireless channel, to an appliance (30) a decision request (72) comprising said amount and transaction type; - responsive to the decision request, the appliance determine an agreement or a refusal of a user using said amount and transaction type; - the appliance sends to the payment instrument a decision message (73) reflecting said agreement or refusal; - upon receipt of the decision message, the payment instrument generates a cryptogram (84) either authorizing the transaction to continue only in case of agreement or refusing the transaction only in case of refusal; then sends it to the terminal.
G06Q 20/32 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des dispositifs sans fil
G06Q 20/34 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des cartes, p. ex. cartes à puces ou cartes magnétiques
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
G06Q 20/18 - Architectures de paiement impliquant des terminaux en libre-service, des distributeurs automatiques, des bornes ou des terminaux multimédia
G06Q 20/20 - Systèmes de réseaux présents sur les points de vente
G06Q 20/06 - Circuits privés de paiement, p. ex. impliquant de la monnaie électronique utilisée uniquement entre les participants à un programme commun de paiement
G06Q 20/42 - Confirmation, p. ex. contrôle ou autorisation de paiement par le débiteur légal
G07F 7/10 - Mécanismes actionnés par des objets autres que des pièces de monnaie pour déclencher ou actionner des appareils de vente, de location, de distribution de pièces de monnaie ou de papier-monnaie, ou de remboursement par carte d'identité codée ou carte de crédit codée utilisée simultanément avec un signal codé
G07F 7/08 - Mécanismes actionnés par des objets autres que des pièces de monnaie pour déclencher ou actionner des appareils de vente, de location, de distribution de pièces de monnaie ou de papier-monnaie, ou de remboursement par carte d'identité codée ou carte de crédit codée
52.
A METHOD FOR EXPORTING A TELECOMMUNICATION PROFILE FROM A SOURCE SECURE ELEMENT TO A TARGET SECURE ELEMENT AND CORRESPONDING SECURE ELEMENTS
The invention concerns a A method for exporting a telecommunication profile from a source secure element (10) to a target secure element (13) through the LPAs of devices comprising the source and target secure elements (10, 13), the method comprising: - sending from the source secure element (10) its certificate and at least a signed profile ID to the target secure element (13); - verifying at the target secure element (13) the validity of the certificate based on the source certificate and signed profile ID; - if the verification is positive, sending from the target secure element (13) to the source secure element (10) a signed download request of the profile and a certificate of the target secure element (13); - at the source secure element (10), verifying the certificate of the target secure element (13) authenticity, generating a Profile Encryption Key, PEK, and a Credential Encryption Key, CEK; - Ciphering the credentials of the profile with CEK; - Ciphering the profile including the ciphered credentials with PEK; - Ciphers CEK and PEK respectively into CEK* and PEK* with the target secure element (13) public key; - Sending from the source secure element (10) to the target secure element (13) the ciphered profile and the PEK*; - at the target secure element (13), deciphering the received PEK* with its private key to obtain PEK, deciphering the profile with PEK and installing the profile; - sending from the target secure element (13) to the source secure element (10) a first signed message indicating that the profile has been installed successfully; - at the source secure element (1O), when receiving the first signed message indicating that the profile has been installed successfully, removing the profile and sending to the target secure element (13) a second signed message with the source secure element (10) private key indicating that the profile in the source secure element (10) has been removed successfully and CEK*; - at the target secure element (13), verifying the validity of the second signed message, deciphering CEK* to obtain CEK and deciphering the credentials with CEK.
Filtering subjects subject to facial image processing in a face-tracking environment by capturing at least one image using an image capture device, defining an inclusion polygon having at least three vertices such that at least one angle formed at at least one of said vertices is not a right angle, identifying a plurality of faces in said at least one image, defining a geometric shape around each said identified plurality of faces, respectively, excluding from further processing any of said identified faces with a defined geometric shape that that fails an inclusion criteria. Performing further processing on not-excluded identified faces to thereby determine an identification-linked property linked to such identified faces.
A data carrier (1), in particular a smart card, comprises a first electronic module (2) being associated with first contact elements (3, 3a,...) and a second electronic module (4) being associated with second contact elements (5, 5a,...). At least one or exactly one first contact element (3) being associated with the first electronic module (2) is in electrical connection with at least two or exactly two second contact elements (5b, 5c) being associated with the second electronic module (4).
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
Provided is a data carrier comprising at least a first metallic layer, at least one electronic module, at least one antenna, and at least a second metallic layer. The second metallic layer is arranged after the first metallic layer with respect to an extension direction (E). The antenna is in connection with the electronic module. The first metallic layer is a continuous metallic layer delimiting a recess, and wherein the electronic module is at least partially arranged within said recess. Other embodiments disclosed.
G06K 19/02 - Supports d'enregistrement pour utilisation avec des machines et avec au moins une partie prévue pour supporter des marques numériques caractérisés par l'utilisation de matériaux spécifiés, p. ex. pour éviter l'usure pendant le transport à travers la machine
G06K 19/077 - Détails de structure, p. ex. montage de circuits dans le support
56.
METHOD SECURED AGAINST SIDE-CHANNEL ATTACKS PERFORMING A CRYPTOGRAPHIC ALGORITHM COMPRISING A POLYNOMIAL OPERATION
Provided is a method to secure against side channel attacks performing a cryptographic operation of a cryptographic algorithm. It includes selecting a multiplier integer t and determining a second integer q′ by multiplying said first integer q, determining (S2) an invertible random polynomial R[X] in said first polynomial ring Rq, randomizing (S3) the coefficients Ai of said input polynomial A[X] based on said determined second integer q′ and said determined random polynomial R[X], performing (S4) the polynomial operation of the cryptographic operation on said randomized input polynomials A″[X], and unmasking (S5) the result polynomial Res″(X) by applying to its coefficients a modulo said first integer q operation. Other embodiments disclosed.
H04L 9/30 - Clé publique, c.-à-d. l'algorithme de chiffrement étant impossible à inverser par ordinateur et les clés de chiffrement des utilisateurs n'exigeant pas le secret
BOARD OF TRUSTEES OF MICHIGAN STATE UNIVERSITY (USA)
INRIA INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE (France)
Inventeur(s)
Anghelone, David
Faure, Philippe
Chen, Cunjian
Ross, Arun
Dantcheva, Antitza
Abrégé
Provided is a cross-spectral face recognition learning method based on a set of associated face images, a thermal image and a visual image, of a plurality of persons. The thermal image is coded in two different ways. A style encoder provides a style code of the thermal image. An identity encoder provides an identity code of the thermal image. The visual image is coded in a similar way with a style encoder providing a style code and with an identity encoder providing an identity code. The two face images of the same person share in the identity features a common part in the respective identity codes, noted as common identity code, whereas the style codes for the two images comprise features only relevant two the specific style, i.e. either thermal or visual, of the image. Other embodiments disclosed.
H04N 23/11 - Caméras ou modules de caméras comprenant des capteurs d'images électroniquesLeur commande pour générer des signaux d'image à partir de différentes longueurs d'onde pour générer des signaux d'image à partir de longueurs d'onde de lumière visible et infrarouge
H04N 23/23 - Caméras ou modules de caméras comprenant des capteurs d'images électroniquesLeur commande pour générer des signaux d'image uniquement à partir d'un rayonnement infrarouge à partir du rayonnement infrarouge thermique
BOARD OF TRUSTEES OF MICHIGAN STATE UNIVERSITY (USA)
INRIA (France)
Inventeur(s)
Anghelone, David
Faure, Philippe
Chen, Cunjian
Dantcheva, Antitza
Strizhkova, Valeriya
Abrégé
Provided is a thermal face and landmark detection method for providing a ground truth reference database, capturing a thermal image comprising at least one face, detecting a face in the thermal image, cropping the thermal image creating a cropped face thermal image, applying a Gaussian filters method to the cropped face thermal image creating an improved cropped face thermal image and applying a landmark detector to the improved cropped face thermal image creating an landmarked cropped face thermal image. Other embodiments disclosed.
A data carrier (1) for a secure article (10) extends along an extension direction (E) and along a transverse direction (T) extending perpendicularly to the extension direction (E) and comprises at least one light guiding element (2) and at least one security element (3). The light guiding element (2) is configured to guide light such that light illuminating the light guiding element (2) is guided along the light guiding element (2). The light guiding element (2) and the security element (3) are arranged such, that light being guided along the light guiding element (2) is illuminating the security element (3). The security element (3) comprises or consists of at least one light scattering element (4) being configured to scatter light upon an illumination with light by the light guiding element (2).
Provided is a method for generating, by a random number generator of a cryptographic system, an independent bit sequence from a binary candidate random stream, said random generator comprising a source of randomness configured to generate a random noise, an analog to digital converter configured to generate a binary raw random stream by digitizing said random noise, said candidate random stream being obtained from said raw random stream. Other embodiments disclosed.
The present disclosure relates to a data processing system comprising a bus interconnect structure, a slave device coupled to the bus interconnect structure, a slave protection unit coupled to the bus interconnect structure, a plurality of master devices coupled to the bus interconnect structure, each master device of said plurality of master devices having a master identifier, wherein a master device is configured to run concurrently different threads, and, when a thread run by said master device requests access to said slave device, for issuing on the bus interconnect structure an access request comprising its master identifier and a thread identifier assigned to said thread.
Method for provisioning a secure element with a profile, said secure element cooperating with a M2M terminal and being connected to the network of a first MNO thanks to a first profile, including requesting by a M2M service provider a second profile to the network of a second MNO; provisioning by said second MNO said second profile in the network of said second MNO; sending from said network to a subscription manager an order to download said second profile; terminating said first profile to the network of said first MNO; barring by said first MNO said subscription in the network of said first MNO; performing by said secure element a Fall-Back procedure; attaching said secure element to a provisioning HLR by using said provisioning profile; downloading from said subscription manager to said secure element said second profile; and enabling said second profile to become an operational profile.
Provided is a method for non-repudiable endorsement of a private attestation. The method includes receiving an attestation from a Private Attribute Provider responsive to a request from a user declaring the attestation, securely binding pivotal attributes in the Attestation selected by the user once authenticated to an Issuing Authority, and securely binding the user to the attestation by way of their connected device. The method produces an endorsed attestation that includes signed server proof. This is provided by the user through their connected device to a service provider for receiving a service otherwise requiring third party trusted proof. Other embodiments are disclosed.
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
The present invention provides a biometric enrollment apparatus for associating biometric data to a user identity, the apparatus comprising: - a first capturing module comprising at least one biometric data capturing device; - a second capturing module comprising at least one biometric data capturing device, the biometric data of this second capturing module being of the same kind as the biometric data of the first capturing module; - a data processing module configured to ○ receive biometric data from the first capturing module, ○ receive biometric data from the second capturing module, ○ authenticating locally the biometric data from the second capturing module against the data received from the first capturing module, outputting an authentication score; wherein, only if the authentication score is above a pre-defined score, the data processing module associates the biometric data from the first capturing module to the user identity.
G06F 21/32 - Authentification de l’utilisateur par données biométriques, p. ex. empreintes digitales, balayages de l’iris ou empreintes vocales
G06V 10/98 - Détection ou correction d’erreurs, p. ex. en effectuant une deuxième exploration du motif ou par intervention humaineÉvaluation de la qualité des motifs acquis
G06V 40/50 - Traitement de données biométriques ou leur maintenance
G06V 10/80 - Fusion, c.-à-d. combinaison des données de diverses sources au niveau du capteur, du prétraitement, de l’extraction des caractéristiques ou de la classification
G06V 40/18 - Caractéristiques de l’œil, p. ex. de l’iris
G06V 40/16 - Visages humains, p. ex. parties du visage, croquis ou expressions
65.
METHOD TO SECURE A SOFTWARE CODE AGAINST SUPERVISED SIDE CHANNEL
The present invention relates to a method for securing against supervised side-channel attacks a secret data stored as at least one N-bit machine word and used in a sensitive operation to be executed by a processing device among a plurality of processing devices having M-bit words architectures, with M and N integers and N < M, wherein a pool of constant values is associated to each processing device of said plurality of processing devices, each pool of constant values associated to a processing device being different than the pool of constant values associated to the other processing devices of the plurality of processing devices, said method being performed by a processor of a first processing device among said plurality of processing devices and comprising: - for each N-bit machine word of said secret data: encoding and storing in a memory of said first processing device, said N-bit machine word as a M- bit machine word comprising said N bits of said N-bit machine word and a constant value selected from said pool of constant values associated to the first processing device (S1), - executing said sensitive operation using said secret data M-bit machine words stored in said memory (S2).
The invention relates to a method of indexing a human fingerprint image. The method of the invention comprises the steps of defining a plurality of classes, each class corresponding to a local pattern of a fingerprint; building a ground truth by allowing a machine learning model to determine the inference probability to each class for acquired fingerprint images; inputting an original fingerprint image; assigning by the machine learning model to the original fingerprint image a multi-dimensional vector according to the inference probability determined for each class based on the ground-truth; generating an indexing key from the multi-dimensional vector of the original fingerprint; and indexing the fingerprint indexing key, the indexing comprising multi-stage checks including both exclusive and continuous classification checks.
G06V 10/44 - Extraction de caractéristiques locales par analyse des parties du motif, p. ex. par détection d’arêtes, de contours, de boucles, d’angles, de barres ou d’intersectionsAnalyse de connectivité, p. ex. de composantes connectées
The invention provides a presentation attack detection method comprising the steps of: - receiving (801) at least one thermal image from a thermal camera; - determining (802) whether a face of a target person is detected in the thermal image or not; - if the face of the target person is detected in the thermal image, performing (806) a domain translation based on the thermal image to obtain an image in a second spectral domain, the second spectral domain being distinct form a thermal domain; - determining (807) a first category indicating whether the target person is live or spoof, based on the image in the second spectral domain; - determining (808) a final decision representative of the liveness of the target person, based on the determined first category and/or based on whether the face of the target person is detected in the thermal image.
G06V 40/40 - Détection d’usurpation, p. ex. détection d’activité
G06V 10/143 - Détection ou éclairage à des longueurs d’onde différentes
G06V 40/16 - Visages humains, p. ex. parties du visage, croquis ou expressions
G06V 10/82 - Dispositions pour la reconnaissance ou la compréhension d’images ou de vidéos utilisant la reconnaissance de formes ou l’apprentissage automatique utilisant les réseaux neuronaux
68.
A SYNCHRONOUS CODE EXECUTION FOR ENHANCED PERFORMANCE AND SECURITY MEASURES PROTECTING DIGITAL SECURITY DEVICES
Provided is a method and device for protecting a computerized digital security device against side-channel, fault injection, and timing attacks, the method comprising identifying asynchronous tasks to be performed by the computerized digital security device by placing identified asynchronous tasks in an asynchronous task queue; and executing a first application, including non-linearizing execution of the application by selecting at least one task from the asynchronous task queue, executing the selected at least one task, removing the selected at least one task from the asynchronous task queue. Other embodiments disclosed.
The invention concerns a method for activating a subscription by a first secure element embedded or integrated in a first device (1), the subscription being called second subscription and being installed in a second secure element embedded or integrated in a second device (2), the method comprising: - sending an activation command from the first secure element to the second secure element, through a short range channel, after having performed a mutual authentication between the first and second secure elements; - sending from the second secure element to the first secure element an acknowledgment message through the short range channel, if the second secure element receives the activation command from the first secure element; - deactivating the subscription, called first subscription, in the first secure element upon receiving the acknowledgment message; - sending from the first secure element to the second secure element a transfer acknowledgment message through the short range channel; - activating the second subscription in the second secure element upon receiving the transfer acknowledgment message.
H04W 8/18 - Traitement de données utilisateur ou abonné, p. ex. services faisant l'objet d'un abonnement, préférences utilisateur ou profils utilisateurTransfert de données utilisateur ou abonné
H04W 12/30 - Sécurité des dispositifs mobilesSécurité des applications mobiles
H04W 12/45 - Dispositions de sécurité utilisant des modules d’identité utilisant des modules multiples d’identité
H04W 8/20 - Transfert de données utilisateur ou abonné
H04W 4/80 - Services utilisant la communication de courte portée, p. ex. la communication en champ proche, l'identification par radiofréquence ou la communication à faible consommation d’énergie
Securing of Internet of Things (IoT) devices by compiling IoT applications against diversified virtual machines. IoT protection sets are defined and assigned diversification parameters. A virtual machine is diversified using the assigned parameters. An IoT application is diversified against the diversified virtual machine to be solely executable by the diversified virtual machines by applying the diversification parameters associated with the virtual machines, respectively. Loading diversified object programs for the diversified IoT applications and diversified virtual machines corresponding to respective IoT devices associated with the protection sets.
G06F 21/14 - Protection des logiciels exécutables contre l’analyse de logiciel ou l'ingénierie inverse, p. ex. par masquage
G06F 21/53 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p. ex. "boîte à sable" ou machine virtuelle sécurisée
71.
A SYSTEM AND METHOD FOR ACTIVATING A PROFILE OF A CONNECTED DEVICE
A method for activating a profile of a connected device of a user is disclosed. The method includes transmitting, by the service provider, a resource address to the user; accessing, by the connected device, the resource address; launching, by the connected device, an application; downloading to the mobile device, by the application, a profile; and activating on the mobile device, by the application, the profile.
H04W 12/30 - Sécurité des dispositifs mobilesSécurité des applications mobiles
H04W 4/50 - Fourniture de services ou reconfiguration de services
H04W 8/20 - Transfert de données utilisateur ou abonné
H04W 8/18 - Traitement de données utilisateur ou abonné, p. ex. services faisant l'objet d'un abonnement, préférences utilisateur ou profils utilisateurTransfert de données utilisateur ou abonné
H04W 36/00 - Dispositions pour le transfert ou la resélection
72.
A METHOD FOR REPLACING BY A HPLMN OR A USER EQUIPMENT A SET OF URSP RULES USED BY SAID USER EQUIPMENT AND CORRESPONDING SECURE ELEMENT
A method for replacing by a HPLMN or a user equipment a set of URSP rules used by the user equipment communicating with a MNO network, the set of URSP rules being called current set of URSP rules, by another set of URSP rules, called new set of URSP rules, the user equipment cooperating with a secure element, the method including storing in the secure element a plurality of URSP rules; when the home network or the user equipment decides to switch from the current set of rules to the new set of rules, sending to the secure element a switching command comprising a list of selection criteria of the new set of URSP rules; replacing in the secure element the current set of URSP rules by the new set of URSP rules, and sending a refresh command.
Provided is a method for managing a card comprising a user output interface. The method comprises a control operation of the card for getting, by the card, a parameter which can evolve dynamically during card lifespan, generating, by the card, a decision which may be positive or negative by executing a preset function applied to said parameter, and, only if said decision is positive, identifying, by the card, a message and notifying a user of the card directly through the user output interface that the card has the message to deliver to the user. Other embodiments disclosed.
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
74.
METHOD TO STORE DATA PERSISTENTLY BY A SOFTWARE PAYLOAD
A method to store data persistently by a payload of an owner, the method including establishing a secure channel between the owner and the software payload itself when running into a hardware-based trusted executed environment, HW TEE, at the instance of a cloud service provider; generating, by the owner, a payload identifier using information shared from the payload during the establishment of the secure channel; generating, by the owner, a key initiator and persistently storing at the owner side the key initiator associated to the payload identifier; sending, by the owner, the payload identifier and the key initiator to the payload; using the key initiator, by the payload, to encrypt data; and persistently storing, by the payload, the encrypted data and the payload identifier.
G06F 21/53 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données par exécution dans un environnement restreint, p. ex. "boîte à sable" ou machine virtuelle sécurisée
Provided is a data carrier of significantly improved level of security that introduces only a minor modification into their manufacturing process. Other embodiments disclosed. In a first aspect a data carrier is provided, wherein the data carrier comprises at least one carrier body, at least one printing layer, at least one marking layer, and at least one security element. The carrier body comprises a top surface, wherein the printing layer is arranged on the top surface of the carrier body. The printing layer and the marking layer are arranged at least partially above one another with respect to an extension direction. The marking layer is configured to interact with impinging electromagnetic radiation such, that a marking element is generated in the marking layer upon the irradiation of electromagnetic radiation.
Provided is a secure execution of a first instruction by processing means of an electronic system, comprising fetching (S1) said first instruction in an execution pipeline of the processing means, determining (S2) that said first instruction to be executed is an instruction sensitive to a determined attack, selecting (S3), based on said determined attack, from an internal memory of said processing means, at least one second instruction, which, when executed by the processing means, causes the processing means to perform a combination of said first function and a dedicated security countermeasure against said determined attack, and executing (S4) said selected second instructions instead of said first instruction.
G06F 21/52 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade de l’exécution du programme, p. ex. intégrité de la pile, débordement de tampon ou prévention d'effacement involontaire de données
Method to establish a secure channel between the party of a software payload and the software payload itself when running into a hardware-based trusted execution environment, HW TEE, at the instance of a cloud service provider, including sending, by the party, a nonce to the software payload; generating, by the software payload, a payload key pair: public key and private key; mixing, by the software payload, the payload public key with the nonce; computing, by the HW TEE, an attestation using this nonce mixed with the payload public key; sending, by the software payload, the attestation, and the payload public key to the party; verifying, by the party, the attestation using the sent nonce mixed with the received payload public key; generating, by the software payload and the party, a session key; and establishing a secure channel between the party and the software payload running into the HW TEE.
H04L 9/14 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité utilisant plusieurs clés ou algorithmes
H04L 9/32 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité comprenant des moyens pour vérifier l'identité ou l'autorisation d'un utilisateur du système
78.
METHOD FOR CONSTRUCTING A LIMITED-USE KEY REQUIRED FOR A FINANCIAL TRANSACTION
The invention is a method for constructing a limited-use key (80) required by a payment application (10) hosted in a portable device (30) and able to perform a financial transaction for an amount. The payment application is able to construct the limited-use key in two distinct ways, the first way and the second way. During the financial transaction the payment application or a payment terminal coupled to the portable device determines that the financial transaction is a High Value Transaction (HVT) if said amount is higher than a preset threshold and considers that the financial transaction is a Low Value Transaction (LVT) in the opposite case. Then the payment application constructs the limited-use key (80) either by said first way only in case of High Value Transaction or by said second way only in case of Low Value Transaction.
G06Q 20/32 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des dispositifs sans fil
G06Q 20/38 - Protocoles de paiementArchitectures, schémas ou protocoles de paiement leurs détails
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
79.
REMOVABLE SECURE ELEMENT HAVING IMPERSONATION PROTECTION
The present invention relates to a removable secure element having a memory to store at least a universal user identifier, a security context, a list of mobile equipment identifiers in which the removable secure element was previously inserted, said removable secure element being dedicated to be inserted in a mobile equipment compliant with plastic roaming connecting and authenticating automatically the mobile equipment to a serving network using the security context stored in the removable secure element as soon as the universal user identifier stored in the removable secure element is the same as the one associated to the security context on the serving network side, said removable secure element further having an application to monitor an identifier of a mobile equipment in which the removable secure element is inserted, said application implementing a retrieval of the identifier of the mobile equipment in which the removable secure element is inserted, a check of the presence of the retrieved identifier in the stored list of mobile equipment identifiers as stored, and, if the retrieved identifier is present in the list, a deletion of the security context as stored.
H04W 12/48 - Dispositions de sécurité utilisant des modules d’identité utilisant la liaison sécurisée, p. ex. liant de manière sécurisée les modules d'identité aux dispositifs, aux services ou aux applications
H04W 12/126 - Dispositions antivol, p. ex. protection contre le clonage de module d’identité d’abonné [SIM]
The present invention relates to a method for securely verifying a candidate password value derived from user credentials against a reference password value dedicated to a client application on a client device storing a try counter, said method being performed by the client application of the client device, said client device comprising : a secure hardware component storing a current cryptographic key pair comprising a current public cryptographic key and a current private cryptographic key specific to the client device, a first application memory storing a current try counter value of said try counter, and a second application memory storing a current signature of a try counter value with a private cryptographic key of a cryptographic key pair, and said method comprising : - a) verifying (S1) the current try counter value stored in the first application memory and, - b) verifying (S2) that the current signature stored in the second application memory of the client device is a valid signature of the current try counter value stored in the first application memory using the current public cryptographic key of the current cryptographic key pair stored in said secure hardware component, - c) when the verifications of the current signature and of the value of the try counter are successful: • generating (S31) a new current cryptographic key pair, • updating (S32) said current try counter value, • generating (S33) a new current signature of the updated current try counter value with the generated new current private cryptographic key of the generated new current cryptographic key pair, - d) verifying (S4) the candidate password value against said reference password value.
The present invention relates to an electronic system (1) comprising a secure processor (102) and an integrated sensor (101) configured for monitoring side channel emissions of said secure processor, wherein: - the integrated sensor is electrically disconnected from the secure processor, - said secure processor is configured for performing a processing operation generating a specific side channel emission called trigger side channel emission, - said integrated sensor is configured such that monitoring said trigger side channel emission causes the integrated sensor to switch to an operation mode depending on said trigger side channel emission.
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/74 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information opérant en mode dual ou compartimenté, c.-à-d. avec au moins un mode sécurisé
G06F 21/75 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information par inhibition de l’analyse de circuit ou du fonctionnement, p. ex. pour empêcher l'ingénierie inverse
H04L 9/00 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité
82.
METHOD FOR PROTECTING AGAINST SOFTWARE- BASED SIDE CHANNEL ATTACKS AN ELECTRONIC SYSTEM COMPRISING A SECURE PROCESSOR AND AN INTEGRATED SENSOR
The present invention relates to a method for protecting an electronic system (1) comprising a secure processor (102) and an integrated sensor (101) against software-based side channel attacks targeting said secure processor using said integrated sensor, said electronic system further comprising an untrusted processor (104), a sensor register (103) isolated from said untrusted processor for storing at least one output value of the integrated sensor, a blurring device (109) connected to the sensor register and configured for outputting at least one blurred sensor output value whose bits are at least partly blurred, and a memory mapped register (110) accessible by said untrusted processor and storing outputs of the blurring device, said method comprising: - measuring, by the integrated sensor, a physical quantity representative of an activity of the secure processor to obtain a sensor output value, - storing said sensor output value into said sensor register, - generating, by said blurring device, from said sensor output value stored in the sensor register, a blurred sensor output value wherein one or more bits of said blurred sensor output value are blurred according to a blurring device configuration, - storing said blurred sensor output value in said memory mapped register.
G06F 21/55 - Détection d’intrusion locale ou mise en œuvre de contre-mesures
G06F 21/74 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information opérant en mode dual ou compartimenté, c.-à-d. avec au moins un mode sécurisé
G06F 21/75 - Protection de composants spécifiques internes ou périphériques, où la protection d'un composant mène à la protection de tout le calculateur pour assurer la sécurité du calcul ou du traitement de l’information par inhibition de l’analyse de circuit ou du fonctionnement, p. ex. pour empêcher l'ingénierie inverse
H04L 9/00 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité
83.
DATA CARRIER WITH SECURED SURFACE PERSONALIZATION ELEMENT
Provided is a data carrier that extends along an extension axis and comprises a carrier body having a top surface, at least one personalization element being arranged on the top surface of the carrier body, and at least one security element. The security element is at least partially arranged at least on and/or in a top surface of the personalization element and at least partially at least on and/or in the top surface of the carrier body and/or at least partially within the carrier body. Other embodiments disclosed.
The present invention relates to a method to create a digital twin in a virtual environment dedicated to be visually displayed in real world, said digital twin being a visual representation in the virtual environment of an entity identifiable in real world, said method comprising the steps of determining at least one parameter enabling to uniquely identify the identifiable entity represented by said digital twin, said parameter being besides stored in a secure database associating the parameter to the identifiable entity, generating a readable tag from said parameter, said readable tag being suitable to be read, in real world, from any kind of visualization of the virtual environment in real world, to retrieve the parameter and to identify the identifiable entity, inserting the readable tag in the visual representation in the virtual environment of the entity identifiable in real world, said virtual tag being permanently displayed in the virtual environment whatever is the position of the digital twin in the virtual environment.
G06Q 10/063 - Recherche, analyse ou gestion opérationnelles
G06Q 10/08 - Logistique, p. ex. entreposage, chargement ou distributionGestion d’inventaires ou de stocks
G06Q 50/00 - Technologies de l’information et de la communication [TIC] spécialement adaptées à la mise en œuvre des procédés d’affaires d’un secteur particulier d’activité économique, p. ex. aux services d’utilité publique ou au tourisme
G06K 19/06 - Supports d'enregistrement pour utilisation avec des machines et avec au moins une partie prévue pour supporter des marques numériques caractérisés par le genre de marque numérique, p. ex. forme, nature, code
85.
DYNAMIC SET-UP AND ENROLMENT OF A LOGICAL SECURE ELEMENT
The present invention relates to a physical secure element installed in a communication device, said physical secure element having an operating system having a supervisor adapted to create various execution environments, said supervisor being further configured to: - receive, from a specific application enrolment server managing a key ecosystem dedicated to the specific application, a command to create a Logical Secure Element, said command comprising enrolment data comprising at least a type of Logical Secure Element to be created for the specific application and a set of keys to be used for subsequent remote provisioning in relation with the Logical Secure Element to be created, - create a Logical Secure Element of the type requested in the command as an execution environment onboard the secure element.
A contactless electronic module for a data carrier comprises a substrate, at least one electronic chip, and at least one electrical connector. The electronic chip is arranged on the substrate, and the electrical connector is in connection with the electronic chip. The substrate is electrically non-conductive. Other embodiments disclosed.
G06K 19/077 - Détails de structure, p. ex. montage de circuits dans le support
G06K 19/02 - Supports d'enregistrement pour utilisation avec des machines et avec au moins une partie prévue pour supporter des marques numériques caractérisés par l'utilisation de matériaux spécifiés, p. ex. pour éviter l'usure pendant le transport à travers la machine
Provided is a method for securely executing an application, wherein a memory space of said application comprises an execution enclave configured to access a memory of the second device storing sealed data obtained by a sealing enclave by sealing on a first device a predetermined message with a first hardware key associated to said first device based on a value depending on an identity of said sealing enclave, and comprising, performed by said execution enclave to verify that the second device is authorized to execute the application. Other embodiments disclosed.
G06F 21/51 - Contrôle des utilisateurs, des programmes ou des dispositifs de préservation de l’intégrité des plates-formes, p. ex. des processeurs, des micrologiciels ou des systèmes d’exploitation au stade du chargement de l’application, p. ex. en acceptant, en rejetant, en démarrant ou en inhibant un logiciel exécutable en fonction de l’intégrité ou de la fiabilité de la source
G06F 21/64 - Protection de l’intégrité des données, p. ex. par sommes de contrôle, certificats ou signatures
88.
METHOD OF SECURELY PERFORMING A PROCESSING OPERATION AND A FUNCTION IN THE HOMOMORPHIC DOMAIN
The present invention relates to a method of secure performing, by a system comprising a processing unit and a secure element and on request by a requesting device, at least one processing operation and a function whose execution by the processing unit in the homomorphic domain does not fulfill a predetermined criteria, said method comprising : -performing (S1), by said processing unit, said at least one processing operation, in the homomorphic domain, on data encrypted using a homomorphic encryption algorithm, to generate first ciphertexts, - determining (S2) by said processing unit that execution of said function taking as inputs said first ciphertexts is to be outsourced to said secure element, - sending (S3) to said secure element said generated first ciphertexts and said function, - decrypting (S4) said first ciphertexts into first cleartexts by said secure element, - applying (S5) said function to said first cleartexts by said secure element to generate a second cleartext.
Provided is a method of manufacturing a data carrier, in particular a smartcard, comprising steps for providing at least one carrier body, and providing at least one metallic foil. The method further comprises the step of providing at least one transferring element being at least temporarily in connection with the metallic foil. The metallic foil is transferred from the transferring element to the carrier body in a step of transferring. Other embodiments disclosed.
Provided is a data carrier that comprises at least one carrier body, at least one electronic module, at least one antenna, and at least one metallic layer. The electronic module is at least partially arranged in the carrier body. The antenna is in connection with the electronic module. The metallic layer comprises at least one recess, and the antenna comprises an electrically conducting wire that is at least partially arranged in the recess. At least part of the metallic layer is part of the antenna. Other embodiments disclosed.
G06K 19/077 - Détails de structure, p. ex. montage de circuits dans le support
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
91.
METHOD FOR ENROLLMENT OF A BIOMETRIC REFERENCE IN A PORTABLE DEVICE
The invention is a method for enrollment of a reference (51) in a portable device (10) embedding a biometric sensor (14) in which a first phase includes the following step executed for a plurality of transactions with one or more terminals (20): - during each current transaction of said plurality of transactions, capturing a candidate biometric data (60) from a subject identifier of a user (50), assigning an indicator (58) to the candidate biometric data (60), said indicator allowing to determine if the user was successfully authenticated during said current transaction and storing the candidate biometric data and said assigned indicator in the portable device; and in that the method comprises a second phase, in which, upon detection of an event, the portable device identifies a list of candidate biometric data whose assigned indicator reflects a successful authentication of the user, and builds the reference using only said list.
G06F 21/32 - Authentification de l’utilisateur par données biométriques, p. ex. empreintes digitales, balayages de l’iris ou empreintes vocales
G06F 21/34 - Authentification de l’utilisateur impliquant l’utilisation de dispositifs externes supplémentaires, p. ex. clés électroniques ou cartes à puce intelligentes
Provided is a method for managing a till e-receipt during a payment transaction involving an Electronic Cash Register and a smart card. The method comprises the steps of: sending a URL from the Electronic Cash Register to the smart card, receiving by the Electronic Cash Register a card identifier which has been permanently allocated to the smart card, sending the card identifier and the till e-receipt from the Electronic Cash Register to a first server, and uniquely associating said card identifier and till e-receipt to the URL, such that the e-receipt can be subsequently retrieved by connecting to the URL. Other embodiments disclosed.
G06Q 20/20 - Systèmes de réseaux présents sur les points de vente
G06Q 20/34 - Architectures, schémas ou protocoles de paiement caractérisés par l'emploi de dispositifs spécifiques utilisant des cartes, p. ex. cartes à puces ou cartes magnétiques
G06Q 20/40 - Autorisation, p. ex. identification du payeur ou du bénéficiaire, vérification des références du client ou du magasinExamen et approbation des payeurs, p. ex. contrôle des lignes de crédit ou des listes négatives
93.
SECURITY DEVICE FOR SECURING AN ARTICLE SUCH AS A PASSPORT
Provided is a security device for securing a substrate comprises at least one connection device, and at least one output device. The security device is configured to be connected to the substrate via the connection device. The output device is configured to emit at least one output signal. The output signal is outputted to an outside of the security device when the connection device and the output device are coupled to one another. A change in the coupling between the connection device and the output device results in a change in the output signal or in an absence of the output signal, and wherein the change in the output signal or the absence of the output signal is indicative of a manipulation of the security device and/or of the substrate. Other embodiments disclosed.
G06K 19/07 - Supports d'enregistrement avec des marques conductrices, des circuits imprimés ou des éléments de circuit à semi-conducteurs, p. ex. cartes d'identité ou cartes de crédit avec des puces à circuit intégré
A data carrier (1) for a secure article comprises a carrier body (2) and a security element (3) being provided on the carrier body (2). The security element (3) comprises at least one image (4) being printed on at least one surface structure (5) comprising elevations (8) extending away from the carrier body (2) and/or depressions (9) extending towards the carrier body (2) and extending along an extension direction (E). The image (4) comprises at least one primary image (6) and at least one secondary image (7) being encoded in the primary image (6). The primary image (6) is observable when the data carrier (1) is viewed under a first viewing angle and a second viewing angle. The secondary image (7) is hidden when the data carrier (1) is viewed under the first viewing angle but observable when the data carrier (1) is viewed under the second viewing angle.
A METHOD FOR INDICATING TO A READER OF AN EMBEDDED SECURE ELEMENT THAT THE EMBEDDED SECURE ELEMENT HAS DATA TO BE TRANSMITTED TO THE READER THROUGH A SPI BUS, CORRESPONDING EMBEDDED SECURE ELEMENT AND READER
The present invention concerns a method for indicating to a reader (10) of an embedded secure element (11) that the embedded secure element (11) has data to be transmitted to the reader (10) through a SPI bus, Serial Peripheral Interface, the reader (10) and the embedded secure element (11) being comprised in a device, the SPI bus comprising: - a CSN line, Chip/slave select; - a CLK line, Serial Clock; - a MOSI line, Master Out Slave In; - a MISO line, Master In Slave Out; - a SPI RST line, Reset, not directly part of the SPI bus but adding a hardware way to reset the SPI bus, the method comprising sending from the embedded secure element (11) to the reader (10) on the SPI RST line a signal for indicating that the embedded secure element (11) has data to transmit to the reader (10), in order that the reader (10) fetches data stored in the embedded secure element (11).
G06F 1/24 - Moyens pour la remise à l'état initial
G06F 13/24 - Gestion de demandes d'interconnexion ou de transfert pour l'accès au bus d'entrée/sortie utilisant l'interruption
G06F 13/42 - Protocole de transfert pour bus, p. ex. liaisonSynchronisation
G06F 21/85 - Protection des dispositifs de saisie, d’affichage de données ou d’interconnexion dispositifs d’interconnexion, p. ex. les dispositifs connectés à un bus ou les dispositifs en ligne
Provided is a digital Virtual Function ID Wallet (VFIDW) (150) containing a Verifiable Identity Document (VID) (131), an Identifier (161), and Verifiable Credentials (VC) (141) and keys pairs (171) associated with a workload (151) of a Virtual Function (VF) instance of a VF to be executed and trusted The VFIDW (150) along with an Identity Agent (120) provide an identity presentation by way of a VID presentation to a Relying Party (160) to enable trust with the VF for the workload (151), by adding relevant attributes from the VFIDW (150) described in security policies that prove identity and correct instantiation of the workload (151) of the VF instance. Other embodiments disclosed.
A secure device for securing an article that includes at least one connection element, at least one data carrier, and at least one security element. The connection element is configured to be connected to the article, and the data carrier is in connection with the connection element and is configured to be connected to the article via the connection element. The connection element is configured to interact with impinging electromagnetic radiation such, that at least one marking element is generated in the connection element upon the impingement of the electromagnetic radiation. The data carrier is configured to interact with impinging electromagnetic radiation such, that at least one further marking element is generated in the data carrier upon the impingement of the electromagnetic radiation. The security element comprises or consists of the marking element of the connection element and of the further marking element of the data carrier.
The disclosure proposes a method for switching from a first subscription of a first telecommunication network operator to a second subscription of a second telecommunication network operator on a plurality of smart cards, the method comprising, for each smart card pre-provisioning the smart card with a batch of secret keys at the level of a personalization factory; thanks to a first input file transmitted by the first telecommunication network operator to the personalization factory, generating at the personalization factory an output file comprising a first secret key selected in the batch, a corresponding first IMSI and a first ciphered operator code; transmitting the output file to the first telecommunication network operator; and transmitting OTA keys and the first IMSI to an OTA server of a service provider managing the smart card in order to attach the smart card to the first telecommunication network.
H04L 9/06 - Dispositions pour les communications secrètes ou protégéesProtocoles réseaux de sécurité l'appareil de chiffrement utilisant des registres à décalage ou des mémoires pour le codage par blocs, p. ex. système DES
99.
A METHOD FOR SELECTING A VIRTUAL CARD AMONG TWO VIRTUAL CARDS COMPRISED IN A SECURE ELEMENT COOPERATING WITH A TERMINAL AND CORRESPONDING SECURE ELEMENT
The invention concerns a method for selecting a virtual card among two virtual cards comprised in a secure element cooperating with a terminal, a first of the virtual cards being compliant with ISO 14443-3 and the second virtual card being compliant with ISO 14443-3 and ISO 14443-4, the secure element communicating with a NFC, Near Field Communication, reader through a CLF, Contactless Frontend, comprised in the terminal, the method comprising: - activating the first and second virtual cards by the secure element; - provisioning by the secure element the CLF with the UID, Unique Identifier, of the first virtual card; - provisioning by the secure element the CLF with the default parameters of the second virtual card, according to Amendment C of GlobalPlatform Card Specification and ETSI 102.613; - if the CLF detects that the communication protocol used by the NFC reader is compliant with ISO 1443-3 but not compliant with ISO 14443-4, switching the CLF to the UID of the first virtual card, in order to establish a communication between the first virtual card and the NFC reader; if the CLF detects that the communication protocol used by the NFC reader is compliant with ISO 1443-3 and compliant with ISO 14443-4, keeping the default parameters of the second virtual card in the CLF, in order to establish a communication between the second virtual card and the NFC reader.
The present invention relates to a method for securing a trained neural network against adversarial attacks in a computer system, wherein said neural network comprises an input layer, hidden layers and an output layer whose parameters are subject to training and is defined by structural elements of the neural network, comprising functions and structural parameters, which are not subject to training, the method comprising : - programming the computer system with the trained neural network, - presenting, by the computer system, a test sample to the trained neural network, - selecting a value, for said test sample, of at least one of said structural elements based on input or output values of a layer of the trained network, - updating said trained neural network by applying said selected value of at least one of said structural elements to the trained neural network, - evaluating an output of said updated trained neural network for said test sample.
brevets
