Abstract:
A data processing method pertains to a step (E 308 ) including in verifying a criterion indicative of the normal running of the method and a step (E 320 ) including in processing performed in case of negative verification. The processing step (E 230 ) is separated from the verifying step (E 308 ) by an intermediate step (E 312,  E 314 ) of non-null duration. The intermediate step (E 312,  E 314 ) and/or the processing step (E 320 ) includes at least one action (E 314 ) performed in case of positive verification. The invention also concerns a corresponding device.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    The present invention concerns a method of processing data, used for example in a microcircuit card. 
         [0002]    In certain contexts, one seeks to render secure the operation of data processing apparatus. This is in particular the case in the field of monetics, in which an electronic entity (for example microcircuit card) carries information representing a pecuniary value and which can therefore be modified only in accordance with a particular protocol. It may equally be a question of an electronic entity for identifying its carrier, in which case operation must be rendered secure to prevent any falsification or abusive use. 
         [0003]    One such electronic entity is for example a bank card, a telephone SIM card (the acronym SIM stemming from the English Subscriber Identity Module), an electronic passport, a secure module of the HSM type (from the English Hardware Security Module) such as a PCMCIA card of the IBM4758 type, without these examples being limiting. 
         [0004]    In order to make operation more secure, one seeks to be protected against the various types of attack that may be envisaged. One large category of attacks to be combated consists of attacks known as fault generation attacks, during which malicious persons seek to cause the data processing apparatus to depart from its normal, and thus secure, operation. 
         [0005]    To parry this kind of attack, the data processing methods commonly used provide steps for verification of the normal running of the method, with the aim of detecting anomalies one possible origin whereof is a fault generation attack. If an anomaly is detected (i.e. if normal running is not verified), the anomaly is processed immediately, and this is generally called security processing. This type of processing consists in fact in a countermeasure intended to combat the attack, for example by prohibiting all subsequent operation of the data processing apparatus. 
         [0006]    As indicated, the processing of the anomaly is usually thought of as following on immediately from detection, since the fact of continuing the processing in the presence of an anomaly clearly entails the risk of further degrading the operation of the data processing apparatus and therefore its security. 
         [0007]    However, the inventor has noted that this ordinary thinking gives the attacker information as to the moment at which the anomaly is detected. In fact, the time of detection of the anomaly is in itself difficult to access from outside. It is nevertheless thought that the attacker, by observing and analyzing the electrical consumption (or the electromagnetic radiation) of the apparatus, can obtain access to the time of implementation of the processing of the anomaly, for example in the case where this processing consists in an action on an external device. Since according to the ordinary thinking this processing follows on immediately from the detection of the anomaly, the attacker could deduce relatively easily from this the time of detection of the anomaly. 
         [0008]    Accordingly, because of the proximity of the detection of the anomaly and of the processing thereof in the usual systems, the attacker has access to additional information on the operation of the data processing apparatus, which of course compromises making the method secure. 
       SUMMARY OF THE INVENTION 
       [0009]    In order in particular to avoid this problem, and consequently to improve further the security of the data processing methods, the invention proposes a data processing method comprising a step of verification of a criterion indicative of the normal running of the method and a processing step effected in the case of negative verification, wherein the processing step is separated from the verification step by an intermediate step of non-null duration. 
         [0010]    A first action being effected in the case of positive verification, the intermediate step entails effecting at least one second action having at least one first characteristic in common with the first action. 
         [0011]    An attacker seeking to understand the operation of the method will therefore have difficulties in distinguishing normal operation (positive verification) from operation in the case of an anomaly (i.e. negative verification). 
         [0012]    The second action is different from the first action, for example. Thus the second action may comprise fewer risks, or even no risk, to the security of the system. 
         [0013]    If a third action is effected in the case of positive verification, the processing step may entail effecting at least one fourth action having at least one second characteristic in common with the third action. 
         [0014]    Thus an attacker will not be able to distinguish between the modes of operation. He will therefore not be able to prevent the processing of the anomaly. 
         [0015]    If the method is implemented in electronic apparatus, the first or second common characteristic is for example the electrical consumption or the electromagnetic radiation of the apparatus generated by the first, respectively the third, action and by the second, respectively the fourth, action. Thus an attacker will not be able to distinguish the normal mode of operation from the abnormal mode of operation by observation of the electrical and/or electromagnetic behavior of the electronic apparatus. 
         [0016]    The first or second common characteristic may equally be the number of instructions used in the first, respectively the third, action and in the second, respectively the fourth, action, which makes it impossible to distinguish between the modes of operation by the duration of said actions. 
         [0017]    The first or second common characteristic may further be the type of instruction used by the first, respectively the third, action and by the second, respectively the fourth, action, which ensures great similarity in the electrical and/or electromagnetic signature of said actions. 
         [0018]    The first or second common characteristic may also be the type of data processed by the first, respectively the third, action and by the second, respectively the fourth, action, which also ensures such similarity. 
         [0019]    If the first, respectively the third, action entails access to a first area of a memory, the second, respectively the fourth, action may entail access to a second area of said memory different from the first area. The processing of the data therefore appears similar in both the modes of operation mentioned above although it is in fact effected in different contexts. 
         [0020]    According to another possibility, the first or second common characteristic is communication with an external device, which may be for example a cryptoprocessor, a memory (e.g. a rewritable semiconductor memory), or a user terminal. Communication with such external devices is in fact observed by attackers and this common characteristic is therefore particularly likely to lead them into error. 
         [0021]    The first action may entail a secure step, for example a cryptographic algorithm, which is thus protected against fault generation attacks. 
         [0022]    The processing step entails for example writing blocking data into a physical memory. 
         [0023]    According to a particularly interesting possibility, the writing of blocking data may be effected in accordance with a chronology identical to writing data into the physical memory in the case of normal running of the method. 
         [0024]    In one embodiment, this data represents a pecuniary value. Thus an attacker will not be able to distinguish a priori between blocking of the apparatus and an operation on the value that it represents. 
         [0025]    The criterion is negative for example if an erroneous signature is provided or if an anomaly is detected. 
         [0026]    The criterion may also be negative if an attack is detected. As has been stated, the invention is of particular interest in this context. 
         [0027]    The criterion may equally be negative if a functional error is detected. Such processing in the case of functional error is unusual but proves interesting for enhancing the security of the system, in particular because such functional errors are very rare outside attack situations and thus reflect the probable presence of an attack. 
         [0028]    According to one possible feature, the intermediate step entails at least one instruction determined during the execution of the method, for example randomly. The understanding of the operation of the system by the attacker is further complicated by this. 
         [0029]    According to one possible embodiment, a microcircuit card comprises a microprocessor and the method is executed by the microprocessor. 
         [0030]    The invention also proposes a data processing device comprising means for verification of a criterion indicative of the normal operation of the device and processing means used in the case of negative verification characterized by separation means for separating the operation of the verification means from the operation of the processing means by a non-null duration. 
         [0031]    According to one implementation possibility, first action means are used in the case of positive verification and the separation means have at least one first characteristic in common with the first action means. 
         [0032]    According to another implementation possibility, second action means are used in the case of positive verification and the processing means have at least one second characteristic in common with the second action means. 
         [0033]    This device is for example a microcircuit card. 
         [0034]    The invention further proposes, in a manner that is novel in itself, a method of processing data comprising a step of verification of a criterion indicative of the normal running of the method and a processing step effected in the case of negative verification, characterized in that, a first action being effected in the case of positive verification, the processing step entails effecting at least one second action having a characteristic in common with the first action. 
         [0035]    In this context, there may be provision for the second action to take place with a chronology identical to the first action in the case of normal running of the method. 
         [0036]    Here the first action is for example writing data into a physical memory and the second action is for example writing blocking data into that physical memory. 
         [0037]    This method may moreover have the characteristics associated with the method proposed hereinabove and the advantages that flow therefrom. Moreover, a device which comprises means for implementing the various steps of this method is proposed in the same line of thinking. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0038]    Other characteristics and advantages of the present invention will become more apparent on reading the following description, given with reference to the appended drawings, in which: 
           [0039]      FIG. 1  represents diagrammatically the main elements of one possible embodiment of a microcircuit card; 
           [0040]      FIG. 2  represents the general physical appearance of the microcircuit card from  FIG. 1 ; 
           [0041]      FIG. 3  represents a method implemented in accordance with a first embodiment of the invention; 
           [0042]      FIG. 4  represents a method implemented in accordance with a second embodiment of the invention; 
           [0043]      FIG. 5  represents a method implemented in accordance with a third embodiment of the invention. 
       
    
    
     DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0044]    The microcircuit card  10  the principal elements whereof are represented in  FIG. 1  includes a microprocessor  2  connected on the one hand to a random access memory (or RAM from the English Random Access Memory)  4  and on the other hand to a rewritable semiconductor memory  6 , for example a read-only memory that can be erased and programmed electrically (or EEPROM from the English Electrically Erasable Programmable Read Only Memory). Alternatively, the rewritable semiconductor memory  6  could be a flash memory. 
         [0045]    The memories  4 ,  6  are each connected to the microprocessor  2  by a bus in  FIG. 1 ; alternatively, there could be one common bus. 
         [0046]    The microcircuit card  10  also includes an interface  8  for communication with a user terminal that here takes the form of contacts one of which provides a bidirectional link with the microprocessor  2 , for example. The interface thus enables bidirectional communication to be set up between the microprocessor  2  and the user terminal into which the microcircuit card  10  will be inserted. 
         [0047]    Thus, on insertion of the microcircuit card  10  into a user terminal, the microprocessor  2  executes a method of operation of the microcircuit card  10  in accordance with a set of instructions stored for example in a read-only memory (or ROM from the English Read-Only Memory)—not shown—or in the rewritable memory  6 , which defines a computer program. This method generally includes the exchange of data with the user terminal via the interface  8  and the processing of data within the microcircuit card  10 , and precisely within the microprocessor  2 , possibly using data stored in the rewritable memory  6  and data stored temporarily in the random access memory  4 . 
         [0048]    Examples of such methods that use the invention are given hereinafter with reference to  FIGS. 3 to 5 . 
         [0049]      FIG. 2  represents the general physical appearance of the microcircuit card  10  produced with the general shape of a rectangular parallelepiped of very small thickness. 
         [0050]    The communication interface  8  provided with the contacts already mentioned is clearly apparent on the face of the microcircuit card  10  visible in  FIG. 2 , in the form of a rectangle inscribed within the upper face of the microcircuit card  10 . 
         [0051]      FIG. 3  represents a method of reading in the rewritable memory  6  such as may be used by the microcircuit card  10  shown in  FIG. 1 , for example thanks to the execution of a computer program within the microprocessor  2 . This method is given as a first example of use of the invention. 
         [0052]    Such a method is used for example if the data written in the rewritable memory (or EEPROM)  6  must be used by the microprocessor  2  during a data processing operation; the data written in rewritable memory  6  is read beforehand in order to be transferred into the random access memory  4  in which it can be easily manipulated. 
         [0053]    As represented in the step E 302  of  FIG. 3 , the method receives as input the address ADR at which it must effect the read operation in the rewritable memory (or EEPROM)  6 . 
         [0054]    In the step E 304 , the method initializes to the value 0 an error flag S. 
         [0055]    The variables being correctly initialized, there follow verification steps dedicated to ensuring safe operation of the system as is generally required in the secure contexts of use of microcircuit cards. 
         [0056]    Thus the step E 306  proceeds to the verification of a checksum. Naturally, other verifications are possible but have not been represented in  FIG. 3  to clarify the explanation of the invention. 
         [0057]    The step E 306  of verification of a checksum consists in verifying that the data written in rewritable memory  6  is consistent with the checksum (sometimes designated by the Anglo-Saxon terminology “checksum”) associated with that data. 
         [0058]    There is then an alternative in the step E 308 : if the checksum is not erroneous, i.e. the verification of the checksum is positive, normal operation continues with the step E 314  described hereinafter; if on the other hand an error is detected in the checksum, i.e. the step of verification of the checksum gives a negative result, there follows the step E 310 . 
         [0059]    It may be noted that the presence of an erroneous checksum, although it indicates in all cases abnormal operation of the microcircuit card, may have diverse origins: it may be a question of a functional error (for example an error in the content of the rewritable memory  6 ), but it may equally be a question of the trace of a fault generation attack. 
         [0060]    In the step E 310 , the error flag S is updated to the value 1 to indicate that an anomaly has been detected. 
         [0061]    There then follows the step E 312  in which the read address ADR received as input to the method (see the step E 302  described hereinabove) is replaced by the address of a “bait-area” situated in the rewritable memory  6 . The bait-area is a memory area a priori different from the address received in the step E 302 ; it is for example an address at which no reading should normally be effected in normal operation (i.e. during the normal and anomaly-free operation of the microcircuit card). 
         [0062]    By way of example, these bait-areas may include data determined randomly and/or data of the same structure as the data that was initially to be read at the address ADR received in the step E 302 . 
         [0063]    Note that the step E 312  that has just been described does not constitute a step of processing of the anomaly detected in the step E 308 : for example, it is not a question of the transmission of a code relating to the detected anomaly, the display of a message relating to that anomaly, or a countermeasure when it is considered that the anomaly stems from a fault generation attack. 
         [0064]    After the step E 312  (effected like the step E 310  only in the case of abnormal operation of the microcircuit card, i.e. in the case of negative verification of normal operation in the step E 306 ), there follows the step E 314  which, as indicated hereinabove, forms part of the normal operation of the microcircuit card (in the case of positive verification of the checksum as indicated with regard to the step E 308 ). 
         [0065]    The step E 314  consists in transferring the data from the rewritable memory  6  to the random access memory  4  and therefore constitutes in this regard the core of the  FIG. 3  method, following the initialization and verification steps. 
         [0066]    Precisely, the step E 314  reads in the rewritable memory  6  at the address specified by the variable ADR previously mentioned and writes the data it has read in random access memory  4  in an area usually referred to as buffer memory that is generally used to manipulate data. 
         [0067]    It may be noted that, if the checksum has been verified positively in the preceding steps, the variable ADR actually points to the address in rewritable memory  6  received as input, i.e. to the data that must actually be read. On the other hand, if an erroneous checksum has been detected (i.e. the verification was negative in the preceding steps), the variable ADR points to the bait-area defined in the step E 312  with the result that the step E 314  will in fact transfer data from the bait-area into the buffer memory area in random access memory  4 , and not effect the reading operation required by the address received in the step E 302 . 
         [0068]    Accordingly, if an operating anomaly is detected by the negative verification of the step E 306 , no access is effected to the rewritable memory  6  at the address provided in normal operation, at which is generally stored data that is relatively sensitive from the security point of view. This gives protection against an attacker finding out this sensitive data if the origin of the detected anomaly is a fault generation attack. 
         [0069]    Furthermore, the step E 314  being effected in normal operation as after detection of an operating anomaly (although with different data), it is virtually impossible for an attacker to detect a departure from normal operation, for example by current measurements. 
         [0070]    After the step E 314 , the method proceeds to the step E 316  in which the error flag S is tested. 
         [0071]    If the error flag S has the value 1, which corresponds to the situation in which the step E 310  has been effected (i.e. the case of detection of an anomaly by negative verification of the checksum in the step E 306 ), there follows the step E 320  in which the anomaly previously detected is processed, for example by writing blocking (or lock) data in the rewritable memory  6 . 
         [0072]    Writing a lock in the rewritable memory  6  consists in writing certain data into that memory  6  that will prevent any subsequent use of the microcircuit card  10 . For example, if the microcircuit card  10  is subsequently inserted into another user terminal, the microprocessor  2  of the microcircuit card  10  will detect the presence of the blocking data in the rewritable memory  6  and will not carry out any processing or exchange of information with the user terminal. 
         [0073]    Writing a lock in the rewritable memory  6  constitutes a particularly effective countermeasure against a fault generation attack. This type of processing of the detected anomaly is therefore of particular interest if this anomaly stems from a fault generation attack or in situations where security must be of such a level that any operating anomaly must entail the blocking of the microcircuit card. 
         [0074]    The countermeasure may equally consist in deleting confidential data, for example secret keys, from the rewritable memory  6 . 
         [0075]    Alternatively, the step of processing the anomaly could consist in updating a flag (stored in random access memory  4  or in rewritable memory  6 ) representative of the anomaly detected during the  FIG. 3  method. This solution does not lead immediately to the blocking of the microcircuit card, but keeps a trace of the presence of an operating anomaly in order to analyze the problem encountered and where appropriate then to proceed to blocking the card (for example if other elements corroborate the hypothesis of a fault generation attack). 
         [0076]    If the step E 316  previously described indicates that the error flag S does not have the value 1 (i.e. that the verification of the step E 306  was positive), the method continues its normal operation with the step E 318 , in which the address of the buffer memory area in random access memory  4  previously mentioned is sent to the output in order to enable use of the data read in the rewritable memory  6  in subsequent operation of the microcircuit card. 
         [0077]    For example, if the method is a Read Record routine as defined by the ISO 7816 standard, the content of the buffer memory area is sent in the subsequent steps. 
         [0078]      FIG. 4  shows a method of reading in rewritable memory  6  carried out in accordance with a second embodiment of the invention. 
         [0079]    This method is for example implemented by the execution of the instructions of a computer program by the microprocessor  2 . 
         [0080]    As for the method of  FIG. 3 , the method described here receives as input, in the step E 402 , the address ADR at which it must read data in the rewritable memory  6 . 
         [0081]    There then follows in the step E 404  a verification of the type of file read. The step E 404  may for example consist in reading in the rewritable memory  6  the header of the file designated by the address ADR and verifying that the data of that header corresponds to data indicative of the type that must be read using the method described here. 
         [0082]    If the file type designated by the header does not correspond to the type of file that must be read, there is a departure from the normal running of the method in the step E 406  to go to the step E 430  described hereinafter. If on the other hand the file type is correct, the step E 406  leads to the step E 408  of normal operation as now described. 
         [0083]    In the step E 408 , it is verified that reading in the rewritable memory  6  is authorized by comparing the necessary access rights specified in the header of the file to those presented by the user, this information being accessible in random access memory  4 . 
         [0084]    If reading in rewritable memory  6  is not authorized according to the data read in random access memory, the verification of the possibility of access to that memory  6  is negative and there then follows the step E 432  described hereinafter. 
         [0085]    On the other hand, if it is determined in the step E 410  that access to the rewritable memory  6  is authorized, there follows the step E 412  for the continuation of normal operation of the microcircuit card. 
         [0086]    The steps E 404  to E 410  therefore proceed to verifications of the normal operation of the microcircuit card. Verifications other than those given here by way of example could naturally be carried out. 
         [0087]    The step E 412  already mentioned, which follows if the various verifications relating to normal operation have been positive, consists in reading the data stored at the address ADR in the rewritable memory  6  in order to store it in random access memory  4  to use it subsequently during data processing effected by the microprocessor  2 . 
         [0088]    This step therefore brings about repeated access in read mode to the rewritable memory  6  and repeated access in write mode to the random access memory  4 . 
         [0089]    Once the transfer of data from the rewritable memory  6  to the random access memory  4  is finished (either by reading a fixed number of bytes in rewritable memory  6  or by reading the precise number of bytes to read received for example as input in the step E 402 ), there follows a step E 414  of verifying the accuracy of the read data. To do this, for example, the data in the rewritable memory  6  is read again and that data is compared to the corresponding data previously stored in the random access memory  4  in the step E 412 . 
         [0090]    If an error is detected during the comparison, the step E 434  described hereinafter follows on from the step E 416 . 
         [0091]    On the other hand, if all the data has been read correctly (i.e. the second reading in the rewritable memory  6  generates data identical to that read during the step E 412 ), the step E 416  leads to the continuation of normal operation in the step E 418  now described. 
         [0092]    The step E 418  consists in returning as output the address at which the data read in the rewritable memory  6  is stored in random access memory in order for the latter data to be available for the continuation of the normal operation diagrammatically represented by the step E 420  in  FIG. 4 . When it is a question of a Read Record command defined by the ISO 7816 standard, this step E 420  consists for example in sending the data that has been read. 
         [0093]    In the situation where an erroneous file type has been detected in the step E 406 , there follows in the manner previously indicated the step E 430  of updating an error report E so that the latter indicates an error stemming from the file type. 
         [0094]    The step E 430  is followed by the step E 450  in which a bait-area in random access memory  4  is read. The bait-area is for example a dedicated area, with no other use, that contains data dedicated to this use and that is different here for example from the access rights relating to the authorization to read in rewritable memory  6  mentioned in relation to the step E 408 . 
         [0095]    There then follows the step E 452  in which the data read in the step E 450  (i.e. the data read in the bait-area which can therefore be referred to as “bait-data”) is compared to the value 0. 
         [0096]    It may be noted that the steps E 450  and E 452  have no functional role in the operation of the card, i.e. neither the data that is processed therein nor the result of the comparison that is effected has any impact on the other portions of the method. 
         [0097]    Nevertheless, for an external observer such as an attacker who is measuring the current consumption of the microcircuit card, executing these two steps is not distinguished from operations carried out during the normal operation step E 408  described hereinabove. In fact, the operations of the steps E 408  and E 410  that consisted in reading data in random access memory and comparison thereof have a signature similar to the similar operations of reading in random access memory and comparison with the value 0 effected in the steps E 450  and E 452 . 
         [0098]    Thus, at this stage of the method, it is impossible for an attacker to determine by means of observations conducted from the outside that an anomaly has been detected in the step E 406 . 
         [0099]    The step E 452  is followed by the step E 454  that will be described hereinafter. 
         [0100]    In the same line of thinking as that which has just been described with regard to the detection of an erroneous file type, there follows as already stated in the case of prohibition of access to rewritable memory (steps E 408  and E 410 ) a step E 432  in which the error report E is updated to indicate that the error stems from a prohibition of reading the rewritable memory  6 . 
         [0101]    The step E 432  is also followed by the step E 454  already mentioned and that will now be described. 
         [0102]    In the step E 454 , the method reads in a bait-area of the rewritable memory  6  and writes in a bait-area of the random access memory  4 . 
         [0103]    As indicated hereinabove, the bait-areas in the memories  4 ,  6  are areas of those memories in which data is written that has no particular function in normal operation. Access in read or in write mode to these bait-areas nevertheless allows simulation, for an external observer of the running of the method, the steps carried out during normal operation, for example in the step E 412 , without impacting on the data used elsewhere by the method or on the security thereof. 
         [0104]    The step E 454  is followed by a step E 456  of reading bait-areas in the random access memory  4  and in the rewritable memory  6 . As indicated hereinabove, this access in read mode has no functional role in the normal operation of the program (i.e. the data read in the bait-areas is not used in other portions of the method). However, for an attacker who is attempting to discover the internal working of the method by means of observations (for example of the electrical consumption of the microprocessor or the memories  4 ,  6 ), the steps E 454  and E 456  generate signatures that are respectively similar to the signatures generated by the steps E 412  and E 414  during normal operation. 
         [0105]    Thus, at this stage of the method, it is impossible for an attacker, by external observation of the operation of the microcircuit card, to determine if the method is effecting the steps E 412  and E 414  of normal operation or the steps E 454  or E 456  subsequent to detection of an operating anomaly (whether that be an anomaly caused by an erroneous file type or a departure from normal operation through prohibition of access to the rewritable memory  6 ). 
         [0106]    Like the steps E 450  and E 452 , the steps E 454  and E 456  are not steps of processing the detected anomaly, since these steps work on bait-data, without seeking to remedy a functional error or to implement a countermeasure if the anomaly stems from a fault generation attack. 
         [0107]    The step E 456  is followed by the step E 458  described hereinafter. 
         [0108]    On the assumption mentioned hereinabove to the effect that the verification of the accuracy of the data read in the step E 412  by the step E 414  is negative, the step E 416  is followed by the step E 434  of updating the error report E in order for the latter to indicate that the error detected stems from an error in reading the rewritable memory  6 . 
         [0109]    The step E 434  is then followed by the step E 458  already mentioned and now described. 
         [0110]    The step E 458  consists in sending the error report as determined during a preceding step (i.e. during one of the steps E 430 , E 432  and E 434 ). The error code may be sent to another method (or another part-method) implemented in the microcircuit card. For example, if the method represented in  FIG. 4  represents a subroutine executed if the main program managing the operation of the microcircuit card requires the rewritable memory  6  to be read, the step E 458  may consist in returning the value of the error report to the main program. 
         [0111]    Alternatively, the error report may be sent in the step E 458  to the user terminal via the interface  8 . 
         [0112]    The method represented in  FIG. 4  therefore has two main branches: 
         [0113]    a first branch which corresponds to the normal running of the method (steps E 402  to E 420 ); 
         [0114]    a second branch made up of steps at least some of which are effected after an anomaly has been detected (steps E 450  to E 458 ). 
         [0115]    As has been seen, many steps of the first branch are simulated, in the case of detection of an anomaly, by a corresponding step of the second branch. For this purpose, the corresponding step of the second branch uses an instruction of the same type as the corresponding step of the first branch, and where necessary uses a call with a device identical to that used in the corresponding step of the first branch, to generate for an attacker the same signature, for example in terms of electrical consumption or electromagnetic radiation. 
         [0116]      FIG. 5  represents a method used in an electronic purse type microcircuit card (sometimes designated by the English word purse) according to the teachings of a third embodiment of the invention. 
         [0117]    This method is implemented for example by the execution of a program consisting of instructions in the microprocessor  2  of the microcircuit card. 
         [0118]      FIG. 5  represents the main steps of the method used to credit the electronic purse, i.e. to modify the data stored in the microcircuit card that represents the value of the electronic purse in the sense of an increase in that value. 
         [0119]    This method therefore begins with the step E 502 , in which the microprocessor  2  of the microcircuit card  10  receives from the user (via the interface  8 ) a credit command code C, the amount M to be credited and a signature S, as represented in the step E 502 . 
         [0120]    As will be seen hereinafter, the signature S ensures that the user actually has an authorization to effect this credit; in fact, without this precaution, anyone could command the increase in the value of the electronic purse, which is obviously unacceptable. 
         [0121]    The steps effected during normal operation of the electronic purse crediting method are now described. 
         [0122]    In the step E 504 , which follows the step E 502  in normal operation, the microprocessor commands the reading in the rewritable memory  6  of a key K by specifying the storage address of this key in the rewritable memory  6 . The key K stored in the rewritable memory  6  is secret and is therefore not accessible from the outside. 
         [0123]    The microprocessor  2  then proceeds to the step E 506  of sending the secret key K read in the rewritable memory  6  and the control code C to a cryptoprocessor (not shown in  FIG. 1 ). The cryptoprocessor effects a cryptographic calculation on the basis of the data received (secret key K, command code C) using conventional cryptographic algorithms, for example the DES algorithm. More precisely, an algorithm is applied here to the control code C using the secret key K in order to obtain a calculated signal S 1 . 
         [0124]    The cryptoprocessor then returns to the microprocessor  2  the calculated signature S 1  (step E 508 ). 
         [0125]    If the user who commands the execution of the method is effectively authorized to effect the credit, he also knows the secret key K and can therefore determine the signature S in exactly the same way as the calculation that has just been effected to calculate the signature S 1 . 
         [0126]    This is why in the step E the signature received from the user S is compared to the signature S 1  calculated on the basis of the secret key K stored in the microcircuit card, which makes it possible to determine if writing the credit is authorized. 
         [0127]    Accordingly, if the comparison between S and S 1  is positive in the step E 510 , there follows the step E 512  in which the amount M to be credited, or alternatively the value of the electronic purse resulting from that credit, is written in the rewritable memory  6 . 
         [0128]    On the other hand, if it is determined in the step E 510  that the signature S received from the user does not correspond to the calculated signature S 1 , crediting the electronic purse cannot be authorized and there then follows the step E 514  in which the microprocessor  2  sends the user terminal an error report. 
         [0129]    There have just been described the main steps of a method of crediting an electronic purse. Naturally, to ensure secure working of this method, these main steps are separated by steps for verification of the normal running of the method, which by various tests detect functional errors on the one hand and attacks on the other hand, for example fault generation attacks. 
         [0130]    In the case of detection of an attack, the microprocessor  2  carries out steps different from those of normal operation, as now described. According to a variant that may be compatible with what is described hereinafter, the method may also use these different steps (or other steps different from normal operation) if a functional error is detected (rather than an attack). 
         [0131]    As represented in dashed line in  FIG. 5 , if an attack is detected between the step E 502  of receiving data and the step E 504  of reading the secret key K in the rewritable memory  6 , there follows the step E 520  in which data is read in the rewritable memory  6  at an address K′ that constitutes a bait-area corresponding to the area containing the secret key K read in the step E 504  during normal operation. 
         [0132]    Accordingly, if an attacker generates a fault attack that is detected by the microprocessor  2 , there follows the step E 520  whereof the electrical or electromagnetic signature (as observed by the attacker) is similar to that of the step E 504  effected in normal operation. The attacker therefore thinks that his attack has not been detected and that the microprocessor  2  is actually reading the secret key K in the rewritable memory  6 . 
         [0133]    After the step E 520 , there follows the step E 522 . This step E 522  also follows if an attack is detected by steps of verification of the normal running of the method situated between the steps E 504  and E 506  previously described. 
         [0134]    The step E 522  consists in sending to the cryptoprocessor (previously mentioned with regard to the steps E 506  and E 508 ) data C′ and K′ that constitutes bait-data. Thus the step E 522  has no particular functional role, but simulates the step E 506  for an attacker who is observing the operation of the microcircuit card  10  by simply studying the electrical consumption of or the electromagnetic radiation generated by the card. 
         [0135]    If the step E 522  is preceded by the step E 520 , the bait-data K′ may be the data read during the step E 520 . Alternatively, it may be predetermined data, and preferably data unrelated to the secure operation of the microcircuit card  10 . 
         [0136]    As previously, the signature of the step E 522  being similar to that of the step E 506  effected in normal operation, an attacker is unaware when the step E 522  is executed that his attack has in fact been detected. 
         [0137]    The step E 522  is followed by the step E 524  described hereinafter. 
         [0138]    As before, the steps E 506  and E 508  may be separated by steps of verification of the normal operation of the method adapted to detect an attack, as represented in dashed line in  FIG. 5 . If an attack is detected, the method also continues at the step E 524 . 
         [0139]    The step E 524  consists in receiving a signature calculated by the cryptoprocessor. As previously for the steps E 520  and E 522 , the step E 524  simulates a step of normal operation (here the step E 508 ) in order to prevent an attacker detecting that his preceding attack has been detected. 
         [0140]    If the step E 522  has previously been effected, the signature S 1 ′ is for example the signature calculated by the cryptoprocessor on the basis of the data C′ and K′ transmitted during the step E 522 . In this case, the calculated signature S 1 ′ has no functional role since it is based on bait-data. 
         [0141]    When the method reaches the step E 524  following the detection of an attack between the steps E 506  and E 508 , the step E 524  may for example consist in actually receiving only a portion of the signature calculated by the cryptoprocessor on the basis of the data C and K sent in the step E 506 . The rest of the signature S′ is for example forced to a predetermined value, such that the result obtained (signature S 1 ′) does not correspond to the signature S 1  in order to preserve the security of the operation of the microcircuit card. 
         [0142]    The step E 524  is followed by the step E 526  in which there is effected for example a comparison of the value S 1 ′ that has just been determined with itself. As previously, this step has no functional role (since the result of the comparison of a number with itself is obviously known in advance), but simulates the step E 510  for an attacker who is observing the electrical and/or electromagnetic behavior of the microcircuit card  10 . In fact, the steps E 526  and E 510  using the same instruction, they have very similar electrical (and electromagnetic) signatures. 
         [0143]    Thus, if an attack has been detected between the steps E 502  and E 508  of normal operation, normal operation has been interrupted (by the switch to the bait-steps E 520  to E 526 ) without this change being detectable by an attacker, however. 
         [0144]    The step E 526  is followed by the step E 528  in which blocking (or lock) data is written in the rewritable memory  6 . 
         [0145]    As already mentioned with regard to the first embodiment described with reference to  FIG. 3 , writing blocking data in the rewritable memory  6  prevents all subsequent use of the microcircuit card  10 . It is therefore a particularly severe and effective countermeasure in response to the detection of an attack. 
         [0146]    Note further that the step E 528  is executed at a time when normal operation would have executed the step E 512  of writing the amount in rewritable memory  6 . Thus the step E 528  is initially confused by the attacker with the step E 512  of normal operation that has the same electrical and/or electromagnetic signature, in particular because the steps E 512  and E 528  correspond to instructions of the same type that both effect a communication from the microprocessor  2  to the rewritable memory  6 . 
         [0147]    As clearly visible in  FIG. 5 , the step E 512  and the preceding steps of normal operation each have a similar signature step executed in the case of detection of an attack. In particular, the step E 512  of writing the amount in the rewritable memory  6 , which constitutes an important step in the execution of the method, is associated with the step E 528  of writing blocking data, which precisely constitutes the countermeasure in the case of detection of an attack against this method. 
         [0148]    Thus not only is an attacker unable to determine the detection of his attack because of the steps E 520  to E 526  simulating normal operation, but the countermeasure (here the writing of blocking data) is also applied with a chronology such that it is confused with a step of normal operation having a similar electrical and/or electromagnetic signature. 
         [0149]    The examples that have just been described are merely possible embodiments of the invention.