HK123795A

HK123795A - Method of generating a pseudo-random number in a portable electronic objects system and a system for carrying out the method

Info

Publication number: HK123795A
Application number: HK123795A
Authority: HK
Inventors: Hazard Michel
Original assignee: Cp8 Technologies
Priority date: 1989-12-19
Filing date: 1995-07-27
Publication date: 1995-08-04
Also published as: CA2046320A1; FR2656126A1; DE69016764T2; ES2072410T3; CA2046320C; DK0434550T3; WO1991009382A1; JPH04503885A; EP0434550A1; EP0434550B1; JPH0727460B2; FR2656126B1; DE69016764D1; ATE118284T1

Abstract

Method for generating a random number in a system comprising portable objects such as cards incorporating memory chips and microcircuits. A random number is generated by the processing circuits of the portable objects, taking into account a first parameter (PA1) constituted by the data from a field (RB) of the memory (MC) of the object, this data being modified on each random number request during a session, and a second parameter (PA2) constituted by data from another memory zone (13) of the object, this data being modified at least once during each session, and retained between two successive modifications from one session to the next.

Description

The invention relates to a process for generating a random number in a system with portable electronic objects such as memory cards and microcircuits and a system for implementing this process.

The rise of applications that use portable objects, such as memory cards and microcircuits, is mainly due to the fact that these cards have processing circuits that usually include a microprocessor that can perform calculations not only on data entered from outside but also on internal and inaccessible data from outside.

Such cards are distributed to users by authorised bodies offering the provision of services via devices or terminals made available to the public and to which the user temporarily couples the portable object handed over to him when requesting a service.

Depending on the nature of the service provided by a particular portable object, it may be necessary for data that travels between the portable object and the terminal to maintain some confidentiality, and therefore systems using portable objects, such as microcircuit boards, are arranged so that they can perform encryption (also called encryption) of this data that travels. To this end, encryption programs are stored inside the processing circuits of the portable objects, as well as encryption programs are stored inside the circuits of the associated terminals.

In addition, many functions for the secure performance of such transactions have been provided for and are described and protected by a number of patents in the name of the applicant, including procedures for verifying that a decoded data actually corresponds to the original data and that no alteration has taken place during transmission; and procedures for mutual authentication of the terminal by the portable object to which it is connected and of the portable object by the terminal, so that the terminal can be certain that the portable object connected to it is actually intended for the service in question or that the portable object can verify that it is actually connected to a terminal intended for the service in question.

These functions often require secret data, specific to the application in question, which cannot be decoded from outside.

The various functions mentioned above can be used when a portable object has been put into circulation by a service provider, and also before the portable objects are put into service, during the so-called personalization phase of these portable objects, which consists of entering into their memory the data specific to the application for which the object could be used, some of which are secret.

Moreover, in some cases, data encryption is subject not only to the inclusion of a secret encryption key but also to the inclusion of a random number, which allows that when encrypting the same data taking into account, among other things, different random numbers, a different coded message appears.

Many patent applications, on behalf of the applicant or third parties, including the French patent application published under No 2 601 535, on behalf of the applicant, mention systems implementing data encryption and decryption algorithms and showing various ways of using random numbers, particularly in microcircuit board systems.

In such systems, the term random number is usually used to actually refer to the result of a calculation performed on certain parameters, which may be contained in certain areas of the memory of the portable object.

Thus, a competent fraudster who would observe at each random number draw the value of the parameters used to calculate the random number and would note what random number is obtained for each combination of parameters would be able to determine in advance what the next random number calculated would be if the parameters used to calculate the random number were to have a value identical to a value that the fraudster could have observed previously.

Therefore, in order to make the system as reliable as possible, the probability of identical combinations of parameters occurring when using these systems should be reduced as much as possible, if not eliminated, in order to minimise the risk of fraud.

In some operating modes, the random number is calculated by the portable object using parameters or data that are contained in the memory of the portable object to obtain it.

Thus, in the French patent application published under No 2 601 535 in the name of the applicant, it is provided that a random number is obtained from parameters taken from the memory control area, i.e. an area of memory where the content is changed each time the card is used, in order to remember, for example, fraudulent attempts at use, or errors, or any other type of control operation required by the particular use for which a particular portable object is intended.the control zone word that was changed at the last use. The random number may result from a ciphering of this control zone word that was changed at the last use. However, in order to save memory, usually the control zone is changed bit by bit, not word by word. This results in that, since a memory is normally divided into n-bit words, each word being at a different address, the content of a word at a given address is likely to be changed n times, so that the content of a word at a given address in the control memory can be used once to constitute the random number,The resulting random number becomes unpredictable.

However, the content of this word at a different address is likely to take on the configurations of the previous address word successively, so that the same random numbers can be found. Consequently, a fraudster who observed the previous series of random numbers would be able to determine the result of subsequent ciphers, in case a random number used would be used again to encrypt a given value. Therefore, in this application, it was considered to use not only the content of a value of the control word at a given address, but also an element of the address and the number of the address, which is calculated from the same value.

This solution is satisfactory in terms of memory consumption, since the random number is calculated from data necessary for the operation of the system.

However, in some applications the control area can only be changed once in a session, i.e. between the time the portable object is connected to the terminal and the time it is disconnected, whereas in the current session the system processing circuits may require the use of a random number several times.

The purpose of the present invention is therefore to remedy these disadvantages by proposing a process which makes it possible to obtain, in a microcircuit board system, numbers which can be described as random when considered by an outside observer, in so far as the combination of the parameters used as the basis for their calculation is not identical twice during the use of the system.

The invention relates to a method of generating a random number in a system of portable objects, such as electronic memory cards and microcircuits, such as having the processing circuits (TC) of a portable object generate each random number required during data processing when the portable object is connected to a processing device, such a method of running a computation program recorded in the circuits of the object and taking into account, for each random number request in a session, at least one first parameter (PA1) consisting of the input of a request field (RB) from a memory area of the object, this input being modified as a result of each random number request in a session, and a second parameter (PA2).

One such process is known as EP-A-231702.

According to the invention, the memory zone is volatile and the second parameter is data from another memory zone of the object, which is changed at least once during each session and is stored between the end of one session and the next session, this other zone being otherwise such that the second parameter (PA2) is not likely to have the same value twice during the life of the card.

In a preferred embodiment of the invention, the first parameter is the value of the contents of a field with a specific address in a volatile memory area of the card, which is used to store the last random number calculated during the current session. Since the field in question is in a volatile memory area, it loses its contents when the card circuits are switched off, so that after the reset of the card circuits following the reset, the contents of the field in question remain the same from session to session.

This is of no importance, since from one session to the next the second parameter, which is taken from a non-volatile memory area between two sessions, is changed, so that even if the first parameter has the same value at the beginning of each session, the result is that the first random number calculated during a session is not predictable, since it depends on the value of at least two parameters, one of which (the second) cannot be found twice the same value during the life of the card.

In one embodiment, the second parameter is taken from a specific memory area, which is not volatile from session to session, but whose contents can be changed at the request of the microprocessor embedded in the card, for example after resetting circuits following power-on at the beginning of a session.

In a preferred implementation, in order to prevent the second parameter from returning to the same value twice during the life of the card, its value is controlled by increasing it from session to session.

Preferably, at least one of the elements taken into account for the calculation of a random number is secret. Preferably, the secret element is one of the parameters used during the calculation. This precaution prevents a fraudster from having all the elements taken into account for the calculation of the random number at his disposal, and can simulate in advance the result of a later calculation.

The invention also relates to a portable electronic object, such as a memory card (MC) and processing microcircuits (TC), for the implementation of the process of the invention, arranged to run a random number program, stored in a non-volatile memory zone by taking into account, for each random number request during a session, at least one first parameter (PA1) consisting of data from a field (RB) of a memory zone of the object, that data being changed as a result of each random number request during a session, and a second variable parameter (PA2). According to the invention, this memory zone is volatile and the second parameter is changed by another value of the said random number, being at least twice the duration of the said memory zone and not at the end of the session, and is stored by another variable, such as the second parameter (PA2).

Other features and advantages will be described below, in relation to the figures in the Annex on which: Figure 1 is a schematic of a system for the implementation of the invention; Figure 2 illustrates a variant of the organization of the memory of a portable object for the implementation of the invention; Figure 3 illustrates the principle of the calculation of a random number; Figures 4, 5A and 5B illustrate a way in which the second parameter can be modified; Figures 6A-6B and 7A-7B illustrate two variants of the organization of the memory of a portable object.

The minimum elements necessary for a memory card to function and be used are shown in Figure 1. The present invention is applicable to the generation of a random number at any stage of the card's life cycle. Thus, the invention can be applied to the generation of a random number during the customization of the card, i.e. at a stage immediately following the manufacture of the card, which involves the introduction of secret or otherwise data that will be necessary for the operation of the card in question.

It shall also apply where the card has been handed over to an end-user, provided that random numbers need to be generated when the card is used.

To be used, a memory card (1) must be connected to a device (2) which may be a terminal or a transaction device. The card (1) and the device (2) are connected via a transmission link (3). The link may be electrical, in which case the card is provided with contact bands which are intended to be interconnected with corresponding contact bands of a connector incorporated in the device (2); the link may also be optical, magnetic, or other, without being outside the scope of the present invention.

Err1:Expecting ',' delimiter: line 1 column 199 (char 198)

The card (1) shall contain at least one memory (MC) and data processing (DC) circuits, allowing the processing of data contained in the card's memory (MC) or data from outside, e.g. data directly from the device (2), or relayed by the device, where the system consists of several devices interconnected in a network.

As is well known, the memory (MC) of the card can be partitioned into several different memory zones, which are distinguished from each other by their electronic nature.

Thus, the memory (MC) of the card (1) may contain a first zone (11) of ROM memory, i.e. a non-volatile memory zone, which contains in particular the data constituting the instructions of a program (PC) executable by the processing circuits (TC) of the card.

The memory (MC) may also contain a second zone (12) of non-volatile memory, which is however programmable during the life of the card, e.g. under control of the card's processing circuits (TC), respecting access conditions which are managed by the program (PC). This second zone (12) is of the PROM type. It is in this zone that the information or personalization data of each card, such as the serial number, secret codes allowing access to the system, after a check of a corresponding code entered on a keyboard of a transaction device, are entered.The card is used for the purpose of identifying the user's identity, such as the device (2), and in general all types of data, secret or otherwise, which would appear during the use of the card and which would need to be kept for the remainder of its life. For example, in some applications, the card is provided to its end user with a secret code predetermined by the service provider providing the card. In some cases, the user is allowed to change his secret code, to enter one that he has deliberately dialled.It is also in this area that the state memory mentioned in the preamble to this application can be created, which serves to store, for example, access attempts or the number of operations performed with the card (1) since its first use.

As mentioned above, this second area (12) of memory may contain information which must remain secret from the outside, such as access codes, which means that only the processing circuits (PCs) of the card can exploit this information, while other parts of this second area can be accessed read and/or write by either the processing circuits (PCs) of the card or the processing circuits (PCs) of the device (2). This structure is well known from the previous art and has been in use for many years on the applicant's products.

A card for the implementation of the process of the present invention has a third EEPROM-type memory zone (13), i.e. a nonvolatile memory when the card's power supply is no longer provided, but which can nevertheless be modified at the request of the processing circuits, or at the external request, either word by word, or in part, or in its entirety.

In a preferred embodiment, the present invention exploits the presence of this third zone in a particularly advantageous way, to obtain random numbers without excessive memory consumption.

It should be noted that the use of EEPROM memory zones in memory cards has been considered for some time to increase the lifetime of these cards. Although the possibilities for integrating increasingly efficient components are becoming available, the memory capacity of portable objects, such as microcircuit boards, is limited. A memory card is a medium of information that contains information that must remain permanent, such as information to identify the cardholder, and/or information that can only be useful temporarily.In the early memory card types, it was considered to write such information into the PROM type memory area, i.e. the inscribble memory area, but not volatile thereafter. This results in that when a new balance was to be written, the previous balance was kept, which consumed memory unnecessarily. For the same type of use, i.e. banking or monetary use, the use of EEPROM type memory allows this kind of information which is not useful for the entire life of the card,But it must be kept temporarily, or memorized.

In all types of applications, there is information or data that does not need to be stored forever, and an EEPROM is particularly suitable in this case.

The management of this memory area, in particular the determination of when all or part of the fields contained in it must be erased in order to be able to reuse them, is not the subject of the present invention but depends more particularly on the type of application for which the portable object is intended.

The memory (MC) of the card may also contain a fourth zone (14) of volatile RAM type memory, i.e. a memory zone whose data or information is lost when the card is no longer powered. This zone may be used to store information or data which is known in advance that it will not be needed from one session to the next.

Thus, in banking applications, the balance of a customer account that would be in the third EEPROM zone should be transferred to this fourth zone (14) of memory (RAM type), before the EEPROM type zone is erased, and then it would be transferred again from the fourth zone (14) to the third (13).

The present invention also benefits from the presence of this fourth memory zone (14) when calculating random numbers.

Finally, the memory (MC) of the portable object (1) may contain a fifth zone (15) of EPROM-type memory, i.e. a zone which is not volatile when the portable object's electrical power is cut off, but which can nevertheless be completely erased, for example by exposing it to ultraviolet radiation.

A device (2) for exchanging data or information with a card (1) and for processing all or part of that information has a known structure in itself. Numerous patents can be referred to in the name of the applicant in this field, and in particular the French patent application No 2 601 535, to name but a few. Such a device (2), which may be a transaction terminal or a part of a personalisation machine, includes data processing (DPC) circuits, which can run appropriate programmes whose instructions (DPC) are recorded in a memory (DCP) incorporated in, inter alia,The memory (MA) of the device may be much larger than the card's (MC) size (1), and may be typed from electronic elements, and/or from peripheral memories, such as floppy disks, or other media known in the field. The memory (MA) of the device may contain a non-volatile zone, with secret data to be used in various transactions, and in the validation processes of the cards connected to it. Such processes are called authentication processes.

The secret data and the program (or at least part of it) of the device can be incorporated into an integrated security module, more commonly referred to in the field by the abbreviation MCS.

Figure 2 illustrates a variant of object memory organization for obtaining a random number in such a system implementing the present invention.

A random number is obtained by applying a computation algorithm to at least two parameters, the first of which (PA1) is data from a memory field (RB) of the card or portable object, the content of which is changed at each random number request during a session, and the second of which (PA2) is data from another memory field (RI) the content of which is changed at least once during each session.

In a preferred implementation, the first parameter (PA1) is the value of the last random number calculated during the current session. In order to allow the use of the last random number calculated during the current session for a later calculation, it is necessary to provide in the memory of the portable object or card a memory field (RB) in which the last number is stored. As in any computer system, each of the memory areas can be divided into fields or several words, which are identifiable by their address.in order to allow the last random number calculated during a session to be stored, the field (RB) is provided in the fourth (14) RAM area, i.e. the area whose contents are destroyed at each disconnection of the portable object, to store the last random number calculated during the current session. When a random number is calculated, this field (RB) is filled with the said random number which is the first parameter (PA1) in a subsequent calculation. When a subsequent calculation is performed, the newly calculated random number is replaced by the previously calculated and stored random number.This aspect is not of major importance, the only important aspect being that the processing system is able to determine the location (14) in memory of the last random number calculated.

The first parameter is likely to return to the same value at each power-on of the portable object or card, since it is stored in a memory area whose contents are erased at each power-off of the circuits, an area which is reset at each power-on. This is not important, since this random number calculation program takes into account not only this first parameter, but also a second parameter whose value is not likely to return to the same twice during the life of the card.

This method of implementation is particularly memory-efficient, since it is sufficient to provide in the area (13) of volatile memory (RAM) only a memory field containing a number of bits corresponding to the format of the random number to be calculated, and since it is sufficient for each random number calculation to replace the value contained in this field at the end of the previous calculation or when the circuits are restarted by the newly calculated number.

For example, the different memory areas of a memory card and electronic microcircuits, in the format of credit cards, contain 32-bit words. In a preferred implementation of the invention, the calculation of random numbers is carried out on 64-bit, so that it is sufficient to reserve two 32-bit words in the fourth (14) volatile memory area (RAM) of the memory of the card or portable object to form the memory field (RB) for the memory of the random words calculated successively during a session.

The following is a detailed representation of a portable object memory for the implementation of the invention: the fourth zone (14) of volatile memory with several fields is represented. In the field (RB) a dash appears to indicate that the field (RB) may consist of one or more words, which is the case when the random number is calculated on 64 bits, whereas the memory contains 32 bits.

Figure 2 also shows which other parts of the memory may be used in the calculation and generation of a random number.

In particular, in the fourth memory zone (14), i.e. the volatile zone, a field (ZT), consisting of several memory words (ZT1, ZT2), was represented, which is used during the phase of changing the second parameter from one session to another, as will be explained below.

The third memory area (13) contains a field (RI), which can also consist of several words (PA21, PA22).

The random number calculation program is preferably stored in a nonvolatile part of the memory, which can be stored in the first read-only memory zone (11), when the memory is masked, or after the card or portable object has been put into operation, in the second PROM zone (12).

This calculation program implements a more or less complex function (F). For the calculation of the random number, the processing circuits of the portable object come to read and extract the contents (PA1) of the field (RB) of the fourth memory zone, they come to read the second parameter (PA2) contained in the field (RI) of the third zone (13), and the function (F) of calculation of the random number is applied, so that a random number (RN) is a function of both parameters:

RN = F (valeur de PA1, valeur de PA2).

Then, after a random number has been calculated, the operating program of the card or portable object is such that the processing circuits (TC) of the card or portable object enter the result of this calculation into the field (RB), so that it can be used for any subsequent calculation of a random number in the current session.

Of course, when calculating a random number for the first time in a session, the content of the field (RB) is not dependent on the result of a previous calculation, since the field (RB) is located in a volatile memory zone. As already mentioned, this is not important, since the content of the field (RB) is only one of the parameters taken into account for calculating a random number, the other parameter (PA2) being the content of a field (RI) in the third zone (13) memory.

The content of the field (RI) of the third zone (13), constituting the second parameter (PA2) taken into account in a random number calculation, is preferably changed at the beginning of each session, before a random number has been calculated. The change of the content (PA2) of this field (RI) follows, for example, immediately after the reset of the circuits of the portable object card, after powering up. This systematic change, after the reset, or at least before a first random number, would prevent fraudulent calculation problems. Indeed, if this precaution is not taken, a fraudster could disconnect his card before the content (PA2) of the field (RI) has been changed to its value after the beginning of the next session, so that the results of the second session would have been resolved during the next session.

In one embodiment, the modification of the second parameter (PA2) contained in the field (RI) of the third memory zone (13) is done by increasing the value of this parameter using the processing circuits of the card or the portable object. Since this parameter is contained in an electrically erasable and reprogrammable area, the operating program of the processing circuits of the portable object or the memory card and microcircuits is such that the content (PA2) of this field (RI), or only part of it, can be changed from one session to the next without the need to intervene in the fields of this zone (13).

Err1:Expecting ',' delimiter: line 1 column 289 (char 288)

Preferably, moreover, the generation of a random number takes into account at least a third parameter (PA3) which allows the results of the calculations to be differentiated from one portable object or card to another.The first parameter (PA3) is the second parameter (PA3) of the second non-volatile zone of the card, which is the memory field of the second non-volatile zone of the card.could also be installed in an EEPROM-type memory zone, i.e. an area corresponding to the third zone (13) in Figures 1 or 2, provided that the card's operating program is such that, if this third parameter is installed in an EEPROM memory zone, it cannot be erased during the life of the card.

Thus, the third parameter (PA3) can be considered to be the serial number of the card, or any other key or data specific to each card, if any, as it has been said before that random numbers may be required at any stage of the card's life, i.e. either during the manufacturing phase, during the pre-personalization phase, during the personalization phase or when the card has been handed over to its end user.

During the manufacturing or pre-customisation phases, cards are encountered where there is no distinctive data between the different cards in the same batch, so that it is not possible or difficult to obtain different random numbers between two cards in the same batch.

During the manufacture of the components, a manufacturer's key, i.e. a specific data to the manufacturer of a batch of cards, is entered. Each random number required during the manufacturing and pre-customisation phases, after the manufacturer's key has been entered, will be obtained using this manufacturer's key as the third parameter (PA3).

Err1:Expecting ',' delimiter: line 1 column 493 (char 492)

Finally, in an unrepresented variant, the third parameter (PA3), or more generally, all or part of the personalisation data, is entered in the third zone (13) of the EEPROM type.

Figure 3 shows a complete scheme of the calculation of a random number, and Figure 4 shows a procedure for incrementing the second parameter (PA2) in the case where each of the memory areas is composed of 32-bit words and where, at least for the calculation of the random number, work is being done on 64-bit, i.e. two-word, memory areas and in the case where this second parameter (PA2) is stored in an EEPROM-type memory area.

In the first phase (31), the contents of the field (RI) containing the second parameter (PA2), in the third zone (13) of type EEPROM, are loaded into the buffer of the DES (DES BUFFER).The operation, performed between the contents of the field (RB) and the contents of the buffer register (DES) during phase (32), is a logical operation such as an EXCLUSIVE OR, an ET, etc., which allows the contents of the buffer register (DES) and the contents of the field (RB) to be combined.

Figure 3 illustrates the case where the generation of a random number takes into account not only the first two parameters but also a third parameter (PA3), such as a specific key as mentioned earlier. Thus, in a phase (34), the algorithm (DES), or all or part of it, or any other algorithm for performing an encryption, is applied to the new contents of the register of (DES), resulting from the operation performed during phase (32), and to the specific key that has been mentioned, which is, in turn, taken from the memory area where it is appropriate. The result of the operation performed during this phase (34) is then inserted into the internal register (DESFFER), before being in the field of the memory card (BOR) or in the field of a new random number, with a view to the subsequent calculation.

In order to ensure that the notion of random number is total and that any risk of fraud is excluded, in a preferred implementation, additional precautions are provided which apply in all variants of the distribution of the different parameters in the various zones.

The above shows that the invention prevents the same combination of parameters from occurring during the life of the card, so that the mere observation or knowledge of the parameters does not allow the random number to be derived immediately.

However, knowledge of these parameters and the calculation algorithm would allow a skilled fraudster with appropriate equipment to calculate the future random number in advance.

This could be the case with the use of an algorithm such as DES or part of it, since this algorithm is disclosed to the public.

Therefore, in a preferred implementation mode, at least one of the elements taken into account when calculating the random numbers is secret, thus blocking the possibility for competent fraudsters to predict in advance the results of subsequent calculations.

The first parameter (PA1) taken from the field (RB) of the fourth memory zone is the previously calculated random number, this first parameter cannot be secret since it is called to be transmitted from the card to the device (2) to which the card is connected.

There are known methods, which the applicant also uses in many of its products, for making information contained in specified areas of memory secret. e most well-known method is to attach to the words which are to be protected from reading in relation to external circuits a locking bit which is positioned in a specified state to indicate to the processing circuits (PCs) of the portable object (1) whether or not the information in question must remain secret in relation to the external circuits.

Thus, in the particular case of the present invention, the second parameter (PA2) or the third parameter (PA3) can be made read and write-only by the processing circuits (TC) of the portable object by associating with these parameters at least one bit indicating to the processing circuits that the value of the parameter must not be transmitted to the outside world.

Of course, the parameters (PA2) and (PA3), as well as the parameter (PA1), must also be unchangeable on external request. Indeed, a fraudster, if he knew the algorithm and managed to impose the desired value on the parameters, could fool the system. Therefore, all the parameters used for the calculation of the random number are protected by writing, from the outside, and their content can only be changed under the control of the processing circuits (TC) of the portable object. This protection can also be provided by locking bits, or by the object management program itself.

As mentioned above, the second parameter (PA2) contained in the field (RI) of the third memory zone (13) is changed incrementally at each session. In a preferred embodiment of the invention, it is provided that when customizing the memories of portable objects, the second parameter (PA2) is not initialized to the same value in each of the portable objects. This precaution is useful for applications in which only one first (PA1) and one second (PA2) parameter are taken into account. In this case, if the second parameter was identical at manufacture in each of the cards or portable objects, then a fraud would occur that could, from the observations made on the first card, mislead the system by providing several cards at its disposal.

In one embodiment, this initialization to values different from the second parameter (PA2) is performed when the portable object is customized (1). The value of the second parameter is calculated or extracted from the processing circuits (TA) of the customization device, and then is entered into the field (RI) of the third zone (13), while the latter is not yet write-protected from the outside.

The determination of the initial value of the second parameter (PA2) to be entered in each card can be done by a calculation performed either in the processing circuits (TC) of the card when connected to the customization machine or in the processing circuits (TA) of the customization machine. When the calculation is performed by the processing circuits (TC) of the portable object (1), it may take into account the value of the serial number of the object, since it is different from one object to another, so that the initial value of the second parameter (PA2) has a high probability of differing from one portable object to another.

When the calculation is performed by the processing circuits (CP) of the personalisation device, the value of the second parameter to be entered into the memory of the portable object may be obtained from a calculation using a random number generated at the level of the personalisation device, or it may be a value from a memory register (MA) of the personalisation device, incremented with each new portable object introduced.

Other solutions can be considered to initialize the second parameter after the portable object has been manufactured, the main thing being that a fraudster knows, if he has several portable objects, that they do not necessarily have the same initialization values, and that, therefore, he cannot simulate in advance the results he will obtain with each of the objects he has.

When a third parameter (PA3) is used for the calculation of a random number, as discussed above, this parameter (PA3) must be secret, whereas the parameter (PA2) is not, and the maximum degree of security is to be provided.

As mentioned, the third parameter (PA3) may be the serial number of the portable object, or a specific key entered when the portable object is customized. Generally, the serial number must remain readable on any processing circuit (TA) of an external data processing device (2) in the memory of the portable object. In this case, when the third parameter used is the serial number, then the second parameter (PA2) must be inaccessible on readable by processing circuits (TA) of an external device (2).

Figure 4 illustrates a procedure for incrementing the second parameter when it consists of two memory words, for example two 32-bit words, so that the second parameter has 64 bits.

This figure 4 can be understood by referring also to figure 2, the elements of which have not been described before are now described.

As shown in Figure 2, in such a case the field (RI) of the third zone (13) containing the second parameter (PA2) is made up of two subfields (PA21 and PA22), each made up of a memory word.

In addition, in the volatile memory (14), a buffer field (ZT) has been provided, also including two subfields (ZT1 and ZT2) which are used during this incrementation phase, which takes place, it is recalled, after each reset of the circuits of the card or portable object, after the power is restored, i.e. after communication between the portable object or card (1) and the appropriate transaction device (2).

A first step is to load the contents of the first subfield (PA21) of the third zone (13) into the first subfield (ZT1) of the fourth zone (14).

As a result, following these loading operations, the buffer field (ZT) of the fourth zone (14) has the same content (PA2) as the field (RI) of the third zone (13), i.e. it contains the second parameter.

Following these loading operations, a test is carried out between the contents of the sub-fields (ZT1 and ZT2) of the fourth zone (14) to verify whether the value of the contents of the first sub-field (ZT1) is greater than or equal to the value of the contents of the second sub-field (ZT2).

If yes, the value of the first subfield (ZT1) of the fourth zone is incremented, and the second subfield (PA22) of the third zone (13), i.e. the one whose content had been loaded into the second subfield (ZT2) of the fourth zone (14), is deleted, and the new value of the first subfield (ZT1) of the fourth zone (14) is entered into the second subfield (PA22) of the third (13) so that the new second parameter is constructed as follows: the content of the first subfield (PA21) is the same as that of the previous session, and the content of the second subfield (PA22) corresponds to the content of the first subfield (PA21) incremented from the previous session.

When the above test shows that the content of the second subfield (ZT2) is in fact greater than that of the first (ZT1), which means that the content of the second subfield (PA22) is in fact greater than that of the first subfield (PA21), then the content of the second subfield (ZT2) of the fourth volatile zone (14) is incremented, then the content of the first subfield (PA21) of the third zone (13) is erased and replaced by the content of the second subfield (ZT2) obtained after incrementation.

It is clear that the procedure just described is not restrictive and that any other procedure could have been chosen.In particular, if one had wanted to be satisfied with random numbers whose length corresponds to the length of the words in memory, it would have been sufficient if the second parameter (PA2) consisted of only one word, and the incrementation procedure would have been much simpler, since it would have been done in the manner of what happens in a meter.

The procedure just described is therefore particularly suitable when the random number is to be sufficiently large to be sufficiently significant.

It is noted that, with the procedure just described, when the second parameter (PA2) is made up of two memory words, the evolution of this parameter (PA2) during successive increments from one session to the next is such that each of the words constituting this parameter is changed once every two, and that the modification of one word consists in replacing that word by the other word after it has been incremented.

However, the fact that the second parameter is made up of two words each having a specified number of bits does not significantly increase the number of possible combinations to make up this second parameter.

Since each constituent word of the second parameter is changed once every two years, the total NT number of different second parameters (PA2) that can be obtained is calculated as follows: NT = 2N + 1. If the parameter (PA2) had been formed using a single N-bit word, then the total NT′ would have been: NT′ = 2N. This is illustrated by Figures 5A and 5B which show how the second parameter (PA2) evolves when it is composed of a three-bit word (Figure 5A), or two three-bit words (Figure 5B) as described in Figure 4.

In one embodiment, the second parameter (PA2) is made up of two 32-bit words, and it is then determined that it can take about 4.3 billion different values. This is largely sufficient, since assuming the card is permanently connected to a terminal, and a random number is computed every second, it would take a 136 year permanent connection to exhaust the possibilities, also assuming that the initial value of the second parameter (PA2) is zero (0 binary) and that each increment is per unit. Indeed, in a number of practical applications, the lifetime or use is voluntarily restricted to a few years.

When the present invention is applied to a portable object or a card with an EEPROM-type memory area, it is possible to generate random numbers in memory in a particularly economical manner, as has just been shown.

However, not all applications implement cards or portable objects with an EEPROM-type memory area, but the invention is nevertheless applicable to systems using cards or portable objects without such an EEPROM-type memory area, as illustrated in Figures 6A to 7B.

Figure 6A illustrates a first variant of a system that does not have EEPROM type memory, and Figure 6B illustrates more specifically how parameters (PA1, PA2, PA3) are stored in memory.

A system as shown in Figure 6A shall include a portable object (100) such as a card with a memory (MC) and memory data processing (TC) circuits. The system shall also include at least one transaction device or machine (200) identical or similar to that shown in Figure 1, thus comprising processing (TA) circuits and memory (MA) part of which is used to store an operating program (PA).

The memory (MC) of the portable object (100) has a first area (110) of ROM memory, into which the operating program (PC) of the portable object can be written. Such memory would also have a second area (120) of PROM type, i.e. a programmable and non-volatile area, and finally a third area (140) of RAM type.

Figure 6B illustrates how parameters are managed and distributed in the different areas of the memory (MC) of the portable object.

The first parameter (PA1) is stored in a field (RB) of the area (140) of the RAM type. Preferably, as was the case with the variant illustrated in Figures 1 to 5 above, the first parameter (PA1) is the last random number calculated during the current session. Also, this first parameter (PA1) can occupy several memory words, which is illustrated by a dash through the field (RB) in Figure 6B.

As in the variants shown in Figures 1 to 5, the third parameter (PA3), which can also occupy several memory words, is stored in a field in the memory area (120) of the PROM type.

The difference between the variant illustrated in Figures 6A and 6B and the variants illustrated in the previous Figures is that, because of the absence of an EEPROM-type memory area, the second parameter, which is changed in each session, must be stored and managed differently. In this case, the second parameter (PA2) is data from the PROM-type memory area (120), i.e. the area which also contains the third parameter.In other words, if a word in the control memory contains eight bits, then the control memory is a single word, and the control memory contains only one bit. In other words, if each word in the control memory contains eight bits, then the control memory contains only one bit.so theoretically, each word is likely to record eight different control operations, before the next word in the control memory starts to be changed. In practice this is not entirely true, since some control operations are encoded on several bits, for example two or three bits. However, it is well understood that it will be very rare for a word in the control memory to be changed at once. So as long as there are bits available in a word in the control memory, that is, bits that have not been modified from their original state,However, as also explained in the preamble to this application, a control memory word may take the same binary configuration as another previously modified word in that memory, and therefore, in a preferred implementation, the second parameter (PA2) is the last modified control memory word, and the memory address of that word.

Thus, taking into account not only the value of the last word changed in the control memory, i.e. a word known to have been changed from the previous session, but also the value of the address of this word, it is certain that the second parameter (PA2) cannot have the same value twice during the life of the card.

This solution is memory efficient, since it avoids the need to provide a specific memory area to constitute the second parameter (PA2), taking advantage of the existence of a part of memory whose data may change from one session to another.

In a variant, which would be usable in cases where the memory (MC) of the portable object (100) does not have control memory, or in cases where the control memory is not likely to be changed at each session, then a part of the area (120) of PROM type is reserved to constitute the second parameter. More specifically, a number of words in this area are reserved and modifiable, for example, bit by bit.so that at the beginning of a session, after the portable object processing circuits are reset, one bit of a word is changed, and at the next session, the next bit of the same word is changed. When all the bits of the same word have been changed, then the next change affects the first bit of the next word in that part of the zone. This way, for each random number request in a session, the second parameter is at least the last changed word in that part of the zone and the memory address of the last changed word.This prevents the second parameter from returning to its previous value when the word in question changes, since the address is also taken into account.

This solution is a bit more memory-intensive, since part of the zone is specifically reserved for the second parameter, but the additional consumption is all relative. Indeed, assuming a portable object whose memory would consist of 32-bit words, whose lifetime would be voluntarily limited by the service provider to two years, and which would be used during two sessions per day, 46 words would have to be reserved in the zone (120) of PROM type memory, which corresponds to 184 bytes of memory. This is relatively small compared to the usual memory size of portable objects of this type.

In general, the control memory must be read from the outside and, if the second parameter is the last word modified in the control memory, it cannot be secret, in which case the third parameter (PA3) must be secret and data specific to the portable object in question is chosen for this third parameter (PA3).

However, where the second parameter is the last modified word of a specific part of the area (120) of PROM type memory, it is possible to make it secret, and in this case the third parameter (PA3) is not necessarily secret and may be simply the serial number, or any other data specific to the portable object in question.

Figure 7A illustrates another variant of the invention in which the memory (MC) of the portable object (100) does not have an EEPROM-type memory area. This variant differs from Figure 6A in that it contains, in addition to the areas described in Figures 6A and 6B, an EPROM-type memory area (150), i.e. a non-volatile area, but erasable, for example by exposure to ultraviolet light. Unlike EEPROM-type areas, it is not possible to select which parts of the area are likely to be erased, so that erasing affects the entire area.

The variant shown in Figure 7A allows the second and third parameters to be stored and retrieved in the PROM type area (120) as in the variants shown in Figures 6A and 6B, the first parameter being always stored in the type memory area (140) (RAM). The second parameter may consist of the last modified word in the control area, if any, and the address of the last modified word, or a last modified word, and its address in a specific part of that PROM type area (120). The third parameter (PA3) may consist of the serial number of the portable object, or any other data specific to the portable object, whether or not the second parameter (PA2) is secret or not, depending on whether the second parameter is secret.

However, it is quite possible that the presence of the EPROM type zone (150) can be used to store the second and/or third parameter, with the same criteria as those defined in Figures 6A and 6B. This is illustrated by Figure 7B, where the field (RI) containing the second parameter has been represented in the EPROM type memory zone (150).

This field containing the second parameter (PA2) may be the control memory or a specific field as described above in Figures 6A, 6B and 7A.

The calculation of a random number in a system that would not have an EEPROM-type memory area would nevertheless be identical to that illustrated in Figure 3 and described in the corresponding description section.

Claims

A method for generating a random number in a system with portable objects, such as cards with electronic memories and microcircuits, of the type comprising causing the processing circuits (TC) of a portable object (1, 100) to generate each random number required at the time of the data processing, when the portable object is connected to a processing apparatus (2, 200), said method consisting in executing a calculation program recorded in the circuits of the object and taking into account, for each demand for a random number at the time of a session, at least one first parameter (PA1) constituted by the datum of a field (RB) of a memory zone (14) of the object, said datum being modified following each demand for a random number during one session, and a second variable parameter (PA2) characterized in that said memory zone (14) is volatile and the second parameter is constituted by a datum of another memory zone (120, 13, 150) of the object, said datum being modified at least once during each session and being preserved between the end of one session and the next session, this other zone (13) moreover being such that the second parameter (PA2) is incapable of having the same value twice in the course of the duration of the life of the card.
A method for generating a random number according to claim 1, characterized in that it consists in providing, in the volatile memory zone (14), a specific field (RB) for memorizing each random number calculated successively at the time of a session, the new number being substituted for the old in this field, and that the first parameter (PA1) is constituted by the datum contained in this specific field (RB).
A method for generating a random number according to claim 1, characterized in that the second parameter (PA2) is kept inaccessible for reading and writing to the processing circuits (TA) of an apparatus (2, 200) for processing the data contained in the portable object (1, 100).
A method for generating a random number according to daim 3, characterized in that each portable object intended for the same application is initialized such that the second parameter that it contains is not the same in the set of said portable objects.
A method for generating a random number according to claim 1, characterized in that it consists in causing at least one third parameter (PA3), constituted by a datum specific to the portable object in question, to be taken into account, in addition to the two aforementioned parameters (PA1, PA2).
A method for generating a random number according to claim 5, characterized in that the third parameter (PA3) is kept inaccessible for reading and writing to the processing circuits (TA) of an apparatus (2, 200) for processing the data contained in the portable object (1, 100).
A method for generating a random number according to claim 1, characterized in that the second parameter (PA2) is modified at the beginning of each session, after the reinitialization of the circuits of the portable object (1, 100), following its connection to the appropriate processing apparatus (2).
A method for generating a random number according to any one of the preceding claims 1 to 7, characterized in that each memory zone of the portable object being divided into words, the second parameter (PA2) is constituted by at least one word of a memory zone (120, 13, 150) that is nonvolatile between two sessions, and that the modification of this second parameter consists in incrementing the value of at least one of its constituent words (PA21, PA22).
A method for generating a random number according to claim 8, characterized in that the second parameter (PA2) is constituted by the latest word modified and its address in memory, in a portion of a PROM- or EPROM-type zone (120, 150), the contents of one of the words of which are modified at least once during each session.
A method for generating a random number according to claim 9, characterized in that said portion of the zone (120, 150) is the control memory of the portable object, and that the second parameter (PA2) is constituted by the latest word modified of this control memory during the current session, and by the address in memory of this word.
A method for generating a random number according to claim 9, characterized in that said portion of the zone (120, 150) is a specific portion, the contents of which are modified upon request of the processing circuits (TC) of the portable object, after the reinitialization of the electronic circuits of this object, and that each modification of this portion affects a different bit of one of the words of this portion.
A method for generating a random number according to claim 8, characterized in that the second parameter is constituted by two words (PA21, PA22) of a field (RI) of the other zone (13); that this zone is of the electrically erasable and reprogrammable type (EEPROM); and that to increment this second parameter (PA2), its two binary words (PA21, PA22) are memorized in a buffer memory field (ZT) of the volatile memory zone (14); that in this buffer memory, the one of the two words (ZT1, ZT2) having a value higher than the other is detected; that the word having a higher value is incremented; and that in the EEPROM memory zone (13), the word thus incremented is substituted for the word that had the lowest value (PA21) or (PA22).
A portable electronic object, such as a card with memory (MC) and processing microcircuits (TC), for implementing the method according to one of claims (1-12), arranged to execute a program for calculating a random number, memorised in a nonvolatile memory zone (11, 12) by taking into account, for each demand for a random number, at least one first parameter (PA1) constituted by the datum of one field (RB) of a memory zone (14) of the object, said datum being modified following each demand for a random number at the time of a session, and a second variable parameter (PA2), characterized in that said memory zone is volatile and the second parameter is constituted by a datum of another memory zone (120, 13, 150) of the object, this datum being modified at least once at the time of each session and being conserved between the end of one session and the following session, this other zone (13) being moreover such that the second parameter (PA2) is incapable of having the same value twice in the course of the duration of the life of the object.
A portable electronic object according to claim 13, characterized in that the other zone intended to memorize the second parameter (PA2), is a PROM- type (120) or EPROM-type (150) memory zone.
A portable object according to claim 13, characterized in that the other zone (13) for memorizing the second parameter (PA2) is of the EEPROM type, and that the volatile memory zone (14) serving to memorize the first parameter (PA1) further comprises a field (ZT) reserved for temporarily memorizing the second parameter (PA2) at the time of its modification.
A portable object according to claim 13, characterized in that it comprises, memorized in a nonvolatile memory zone (12, 13), at least one datum specific to the portable object in question, constituting a third parameter (PA3) taken into account at the time of the generation of the random number.
A portable object according to claim 16, characterized in that the third parameter (PA3) is constituted by the serial number of the portable object.
A portable object according to claim 16, characterized in that the third parameter (PA3) is constituted by a secret diversified datum belonging to the portable object.
A portable object according to claim 13, characterized in that the first parameter (PA1) memorized in the field (RB) of the volatile zone (14) of the memory, following each calculation of a random number, is the random number itself.
A data processing system for implementing the method defined by one of claims 1 to 12, characterized in that it comprises a portable object (1) according to one of claims 13 to 19, and a processing apparatus (2) to which the portable object can be connected.