Method for cloning a secure element

The invention proposes a method for cloning a first secure element from a backup secure element of a user, said backup secure element comprising at least credentials of said user. The method comprises a preliminary phase of checking the authenticity of the first secure element using a second secure element, said second secure element being able to be paired with a third secure element.

FIELD OF THE INVENTION

The present invention relates generally to secure elements and more specifically to a method for cloning secure elements.

BACKGROUND OF THE INVENTION

An eGo device relies on the eGo technology combining two wireless technologies and a secure element. The two wireless technologies are, for example, Body-Coupling Communication (a.k.a BCC) with a very short operational range allows to unambiguously select the device to connect with and the Ultra-Wide Band (UWB) with RTLS (Real Time Location Service)/basic distance measurement with a medium operational range allows a high-speed exchange for application data into a secure element. For using the eGo secure elements, a first step consist in securely pairing two eGo devices and bootstraping the UWB communication. A second step consists in starting an application via a fast and secure wireless point-to-point communication and monitoring the distance between the two devices to control an operational and secure application bubble. The eGo secure element can be a dedicated component or embedded in a System On Chip. The eGo secure element has a means to check the authenticity and the integrity of the eGo technology related subsystems integrated within the eGo device.

Security access codes are required as the eGo device is personalized at least with a user's credentials and access rights. Then for using such credentials and access rights, the user has a device comprising such eGo secure element or having same functions as the eGo secure element on his or her person, such as a watch or other wearable item containing a secure element. If authorized, the user when touching a secured door also equipped with the eGo technology has access via an Ultra Wide Band transmitter/receiver. Thanks to such eGo secure devices a user has just to touch a device to authenticate herself.

Nevertheless a problem may occur if a user purchases a new eGo device containing a blank eGo secure element and wants to clone it. Indeed he has no clue about the authenticity of said secure element wherever he purchased it. There is then a need for a method for cloning such secure elements from an initialized secure element in a trusted and secured way.

SUMMARY OF THE INVENTION

It is then an object of the invention to provide a method for cloning a blank eGo secure element from an initialized eGo secure element.

Thereto, the present invention provides a method for cloning a first secure element from a backup secure element of a user, said backup secure element comprising at least credentials of said user, characterized in that it comprises a preliminary phase of checking the authenticity of the first secure element using a second secure element, said second secure element being able to be paired with a third secure element.

According to another aspect of the invention, the preliminary phase may comprise a step of activating the first secure element and capturing a biometric data of the user.

According to another aspect of the invention, the preliminary phase may comprise a step of detecting the first secure element and transferring pairing data between the first and the second secure elements so that said first and second elements are able to communicate directly.

According to another aspect of the invention, the preliminary phase may comprise a step of authenticating the first secure element by the second secure element using a biometric means.

According to another aspect of the invention, the preliminary phase may comprise a step of establishing a secure communication channel between the first and the second secure elements.

According to another aspect of the invention, the preliminary step may comprise informing the user on the authenticity of the first secure element.

According to another aspect of the invention, the method may comprise remotely processing the preliminary phase of checking the authenticity of the first secure element.

According to another aspect of the invention, the method may comprise requesting an activation of the second secure element by a trusted user, a pairing of said second secure element with the third secure element, said third secure element being connected to the network, an identification data.

According to another aspect of the invention, the method may comprise activating and connecting the first secure element to the network via a fourth secure element, said fourth secure element being able to be securely paired with the first secure element.

According to another aspect of the invention, the method may comprise sending identification data of the user and identification of the trusted user to the network so that to pair the first secure element and the second secure element establishing a secure communication channel between said first and second secure elements.

According to another aspect of the invention, the preliminary phase may comprise using a secure element of a trusted user as second secure element.

According to another aspect of the invention, the preliminary phase may comprise using the backup element of the user as second secure element.

According to another aspect of the invention, the preliminary phase may comprise using the backup element of the user as second secure element and further comprising a step of preregistering biometric data of the trusted user on the second secure element.

According to another aspect of the invention, the method may comprise a cloning phase wherein it comprises initiating the cloning of said credentials from the backup secure device to the first secure element after a two-factor authentication is successful.

According to another aspect of the invention, the method may comprise processing the cloning phase locally and using the backup secure element of the user for the two-factor authentication.

According to another aspect of the invention, the method may comprise establishing a secure channel between the first secure element and the backup secure element.

According to another aspect of the invention, the cloning phase may comprise capturing biometric data of the user on the first secure element and the backup secure element, transferring said biometric data captured on the first secure element to the backup secure element and authorizing the cloning if said biometric data match.

According to another aspect of the invention, the method may comprise processing the cloning phase locally and using a secure element of a second trusted user for the Two-factor authentication.

According to another aspect of the invention, the method may comprise preregistering biometric data of the user on the secure element of said second trusted user before processing the cloning phase.

According to another aspect of the invention, the method may comprise establishing a secure communication channel between the first secure element and the secure element of the second trusted user.

According to another aspect of the invention, the cloning step may comprise capturing biometric data of the user on the first secure element and the secure element of said second trusted user, and in that it may further comprise the step of authorizing the cloning of the credentials of the backup secure element of the user into the first secure element if biometric data captured on the first secure element match with biometric data preregistered in the secure element of the second trusted user.

According to another aspect of the invention, the method may comprise processing the cloning phase remotely, wherein the backup secure element of the user for the Two-factor authentication is a remote secure element.

According to another aspect of the invention, the method may comprise preregistering biometric data of a second trusted user on the backup secure element of the user before processing the cloning phase.

According to another aspect of the invention, the method may comprise requesting an activation of the backup secure element by said second trusted user, an identification data of said second trusted user, a remote pairing of said backup secure element with the first secure element.

According to another aspect of the invention, the method may comprise capturing biometric data of the user on the first secure element, transferring said biometric data to the remote backup secure element, and authorizing the cloning if biometric data match.

Thanks to the invention, the use of fingerprints database which may be prohibited by law is advantageously avoided.

The invention provides advantageously a method to authenticate a blank eGo device in an unknown environment.

DETAILED DESCRIPTION

The present invention may be understood according to the detailed description provided herein.

Shown inFIG. 1is a user1who has purchased out off the shelf first device containing a secure element10. The first device is an eGo device containing a blank secure element.

The first secure element10of the first device is then compliant with the eGo technology as described in the above description and thus is able to communicate to another secure element using the same technology, for example, a secure element located in another eGo device.

A backup secure element11comprises at least credentials of the user1and access rights associated to the user1. The backup secure element11is a secure element comprised in an eGo device and which comprises at least credentials of the user1and access rights associated to the user1. The backup secure element11is able to be securely paired to a third secure element30.

A method for cloning data from the backup secure element11into the first secure element10, i.e. transferring the at least credentials and access rights of the user1comprises two main phases: a preliminary phase of checking the authenticity of the first secure element10wherein the user is able to determine the authenticity of the first secure element10as the user1has no clue about the authenticity of this first secure element10, and a cloning phase wherein the at least credentials are effectively transferred from the backup secure element11into the first secure element10.

The preliminary phase and the cloning phase can be made either locally or remotely. In the following description, different embodiments for processing these phases locally or remotely will be described separately. It will be well understood that when possible a local preliminary phase can also be combined with a remote cloning phase, or a remote preliminary phase can also be combined with a local cloning phase, . . . .

According to a first embodiment of the invention, the method comprises a preliminary phase of checking the authenticity of the first secure element10using a second secure element20. In this first embodiment, the preliminary phase comprises using a secure element of a trusted user as second secure element20. The second secure element20then belongs to a trusted user2like a friend, and is also able to be paired with the third secure element30of same type. The second secure element20is an authenticated secure element.

The preliminary phase comprises a step P1of activating the first secure element10and capturing a biometric data of the user1such as a fingerprint before pairing the first and the second secure element10,20with the third secure element30.

It will be well understood in all the specification that a fingerprint is not a limitated example and that any other biometric data suitable for the present invention can be used. For pairing the first secure element10and the second secure element20with the third secure element30, the user1and the trusted user2for example touch together an eGo device containing the third secure element30. The third secure element30is equipped with means for enabling the authentication and the pairing and is for example a secure element contained in a mouse called “eGo-ready mouse” in the following description.

The preliminary phase further comprises a step P2of detecting the first secure element10and transferring pairing data between the first and the second secure element10,20so that the first secure element10and the second secure element20are able to communicate directly. The eGo-ready mouse30detects the blank secure element10and pairing data are transferred between the two secure elements10,20in such a way that the secure elements10,20can communicate directly together.

The preliminary phase further comprises a step P3of authenticating the first secure element10by the second secure element20. The customized and trustable eGo secure element20authenticates the blank eGo secure element10.

The preliminary phase further comprises a step P5of establishing a secure communication channel between the first and the second secure elements10,20. Once established, the preliminary phase comprises a step P6of informing the user1on the authenticity of the first secure element10. The secure channel is established between the two eGo secure elements10,20allowing the transfer of settings enabling the step P6wherein the user is able to determine the authenticity of the blank first secure element10. To inform the user about the authenticity of the blank eGo element, the first and the second devices that contain secure elements10,20comprise means for indicating the success or the failure of the preliminary phase. Such means are for example a LED securely controlled by each secure element10,20. The LEDs of the two eGo devices for example blink synchronously by using a same colour when the authentication is successful and blink using a different colour when the authentication fails.

It will be understood that such means are not limited examples and other means either visual means, e.g. direct visual means or via a webcam, or sound's means are possible.

An asynchronous blinking using same colour may also be used for informing about a failure of the preliminary phase.

In another embodiment, the three secure elements have a means to measure the distance between each of them by using the UWB technology and the SDS-TWR (Symmetric Double-Sided Two-Way Ranging) principle as described in the IEEE802.15.4a. The equivalent triangle defines by three corners as the blank eGo device, the initiated eGo device and the eGo ready mouse shall be consistant, i.e. less than 1.5 m per edge. This embodiment allows improving the security checking against fake blank eGo device transmitting verbatim the data to a distant and spied authentic blank eGo device.

In another embodiment, the preliminary phase comprises using the backup element11of the user1as second secure element20. Then the second secure element20is the backup secure element11of the user himself.

In this embodiment the authenticity checking preliminary phase can advantageously be done either by using a secure element of a friend or trusted person or with the secure element to be cloned.

In another embodiment, the method comprises remotely processing the preliminary phase of checking the authenticity of the first secure element10as shown inFIG. 2.

For doing so, the method comprises requesting an activation of the second secure element20by the trusted user, a pairing of said second secure element20with the third secure element30, said third secure element30being connected to the network, an identification data of said trusted user.

A first step of the identification can be performed by using an email address and a second step of the identification may use a second way of communication such as a user's mobile phone or the mobile phone of a friend. The first step of identification can also be performed by using a phone number. The server may challenge vocally the user to check her authenticity (e.g. Birthday of her mother, . . . ).

The method comprises activating and connecting the first secure element10to the network, then securely pairing a fourth secure element40with the first secure element10.

In this embodiment, the second secure element20and the third secure element30are used by a trusted friend who is far from the user1.

The user1for example contacts by mobile phone her friend and requests her to activate the second secure element20, to touch a device that contains the third secure element30such as an eGo-ready mouse of a computer connected to the network.

An identification data is also required for identification within a secure element database such as the eGo ecosystem URI (Uniform Resource Identifier). The registration and the initialization of the connection between the eGo devices via the network is for example performed by using SIP (Session Initialization Protocol) as defined in the RFC3261 standard. After its activation, if the eGo device that contains the second secure element20is connected to the network, i.e. internet, then it will perform a registration of its IP address and its SIP URI (Uniform Resource Identifier). The SIP URI is similar as the user's email but prefixed with “sip:” as “sip:user@domain.com” to a SIP registrar.

Any eGo device may contact the SIP registrar for prompting (INVIT) another eGo device for a peer-to-peer communication. If the invitation is successful then the two eGo devices get the means (IP address) for a direct connection, i.e. a peer-to-peer connection. Other protocols offering the same capability are possible as for example XMPP (a.k.a Jabber): Extensible Messaging and Presence Protocol.

The user1then touches a device that contains the fourth secure element40such as an eGo-ready mouse of a computer connected to the network. A wizard pops up on the computer displays a form to fill. Each user's email address may be used to build a SIP URI allowing the registration of the eGo device to a SIP registrar.

The method further comprises sending identification data of the user and identification of the trusted user to the network so as to pair the first secure element10and the second secure element20, establishing a secure communication channel between said first and second secure elements10,20. The connections and identification data are for example based on the SIP or XMPP protocol.

A secure channel is then established between the two secure elements10,20allowing the transfer of settings enabling the step P6as described above, allowing the user1to be informed on the authenticity of the first secure element10.

The friend of the user for example informs the user1when the LED is ON and OFF and what the colour of the LED is on the second secure element20.

In another embodiment the remote preliminary phase comprises using the backup element11of the user1as second secure element20. The second secure element20used by the friend is the backup secure element11of the user1. When doing do, the remote preliminary phase further comprises a step of preregistering biometric data of the trusted user2on the second secure element20. Thus the friend2can activate the backup element11remotely as he can be recognised as being the backup secure element11. The friend enters the email address of the user. This email address is used for building the SIP URI of the backup secure element11. Then the backup secure element11is registered on the SIP registrar and can be contacted anytime until the backup secure element11is plugged on the network.

After the preliminary phase either processed locally or remotely, i.e. after the authenticity of the first secure element10is checked, the method comprises initiating the cloning of said authentication data, i.e. the credentials, from the backup secure device11to the first secure element10after a two-factor authentication is successful.

According to an embodiment, the cloning phase is processed locally and the method comprises using the backup secure element11of the user for the Two-factor authentication.

The backup secure element11is not remote but in hands of the user1. The cloning phase comprises establishing a secure channel between the first secure element10and the backup secure element11.

The user1for example activates the blank first secure element10and captures biometric data such as her fingerprint. The user also activates the backup secure element11, and also captures biometric data, for example her fingerprint. The user1then touches a device that contains the third secure element30such as the eGo-ready mouse used in the preliminary phase. It will be well understood that any other secure element having same functions as the third secure element30can be used.

The first secure elements10and backup secure element11are paired with the third secure element30. The secure element30of the eGo-ready mouse detects the blank first secure element10and transfers the pairing data between the two secure elements10,11in such a way that the first secure element10and the second secure element11can communicate directly together.

The backup secure element11authenticates the blank first secure element10. A secure channel is established between the first secure element10and the backup secure element11. The cloning phase then comprises capturing biometric data of the user on the first secure element10and the backup secure element11, transferring biometric data captured on the first secure element10to the backup secure element11and authorizing the cloning if said biometric data match. A fingerprint minutia is for example captured on the blank first secure element10and is transferred to the backup secure element11. If the fingerprint transferred matches with the preregistered fingerprint, i.e. successful then the two authentication factors is valid and the blank first secure element gets from the backup secure element the essential digital credentials to allow the connection to a server, also called TSM server, refreshing the blank first secure element10. Any eGo secured element is registered within a first level TSM server. This TSM server is named eGo issuer TSM server. The eGo Issuer TSM server is in charge to contact, by using the user identification, e.g. user's email address, all eGo Issuer TSM servers to know if the user has already an eGo device registered. The eGo Issuer TSM server creates within the blank eGo secure element all Authority Secure Domains, as described in Global Platform standards, related to a second level of TSM servers named Authority TSM servers. All these Authority TSM servers are notified. Each Authority TSM server creates the Delegated Secure Domains within their Authority Secure Domains related to the given user and then notifies each Service Provider about the creation of the Delegated Secure Domain for a given user. The Service Provider clones the application of the user in the Delegate Secure Domain.

In another embodiment, the cloning phase is processed locally and the method comprises using a secure element200of a second trusted user201for the Two-factor authentication.

The backup secure element11is also in hands of the user1. The cloning phase comprises establishing a secure channel between the first secure element10and the secure element200of the second trusted user201.

In this embodiment, the method comprises preregistering biometric data of the user1on the secure element200of said second trusted friend201before processing the cloning phase.

The cloning phase comprises capturing biometric data such as the fingerprint of the user on the first secure element10and on the secure element200of said second trusted user201, and in that it further comprises the step of authorizing the cloning of the credentials of the backup secure element11of the user1into the first secure element11if biometric data captured on the first secure element10match with biometric data preregistered in the secure element200of the second trusted user201.

The user for example captures her fingerprint on the secure elements10and the secure element200of the trusted friend201. If there is a match between biometric data of the user on both secure elements, i.e. if the user's fingerprint matches with her fingerprint preregistered in the secure element200of the trusted user201, then the two-authentication factors is valid and the blank first secure element10gets from the backup secure element11the least credentials to allow the connection to the TSM server refreshing the blank first secure element10.

According to another embodiment, the method comprises processing the cloning phase remotely, wherein the backup secure element11of the user1for the two-factor authentication is a remote secure element.

The method comprises preregistering biometric data of the second trusted user201on the backup secure element11of the user1before processing the cloning phase.

The method comprises requesting an activation of the backup secure element11by said second trusted user201, an identification data of said second trusted user201, and requesting a remote pairing of said backup secure element11with the first secure element10.

The method comprises capturing a biometric data as a fingerprint of the user on the first secure element10, transferring said biometric data to the remote backup secure element11, and authorizing the cloning if said biometric data match.

For doing so, biometric data of a trusted second user201as fingerprints of the friend are previously registered in the remote backup secure element11. The user1for example activates the blank secure element10and captures her biometric data such as her fingerprint on the first secure element10. The user1calls the second trusted user201and asks him to activate the remote backup secure element11owned by the user1, to touch device containing a secure element such as the third secure element used in the preliminary phase, e.g., an eGo-ready mouse of a computer connected to the Internet. The second trusted user201then enters her email address so that to be able to identify the secure element200on the network.

The remote backup secure element200has limited functions as it is not activated by its legitimate owner. The user1then touches a device containing a secure element such as the fourth secure element used in the remote preliminary phase, as an eGo-ready mouse of a computer connected to the Internet. A wizard pops up on the computer displays a form to fill. The user1enters her email address. After the pairing of the secure elements, a secure channel is established between the first secure element10and the backup secure element11.

The user1then captures her fingerprint on the first secure element10. The fingerprint minutia captured on the blank first secure element is then transferred to the remote backup secure element11. If the fingerprint matching is successful then the two-authentication factors is valid and the blank first secure element10gets from the remote backup secure element the credentials to allow the connection to the TSM server refreshing the blank first secure element10.

It will be well understood that the trusted user20in the preliminary phase and the second trusted user201in the cloning phase can be a same or different trusted user. Thus when it is the same trusted user in both phases, it will be also well understood that the secure element200of the second trusted friend201in the cloning phase can be either the same secure element20used in the preliminary phase or a different secure element.

It is then possible to use this method in a non trustable environment and allow the recovery of digital credentials to a blank secure element and to check the authenticity of this blank secure element.

In another embodiment, the first and the second secure elements are not eGo devices. Devices using other technology such as Bluetooth, RFID, . . . are also used.