The invention relates to a method of establishing a cryptographic key shared between a first and a second terminal. The invention also relates to methods for the execution, by the first terminal and the second terminal respectively, of the steps required for implementing the method of establishing a shared cryptographic key. Finally, the invention also relates to a data recording medium and to a first and a second terminal for implementing this method of establishment.
There are many situations in which it is necessary to establish a cryptographic key shared between two terminals. “Shared cryptographic key” denotes a secret cryptographic key that is known to these two terminals only. This cryptographic key makes it possible, for example, to establish a secure link for exchanges of data between these two terminals. Specifically, these data may then be, for example, encrypted with the shared cryptographic key by one of the terminals, before being transmitted over a data transmission network, and then decrypted, with the same shared cryptographic key, by the other terminal when it receives these data.
There are also situations in which it must not be possible to establish such a secure data exchange link unless, additionally, the two terminals are in the proximity of one another, that is to say geographically close to one another.
The following documents are known in the prior art:
The invention proposes a method, as claimed in claim 1, of establishing a cryptographic key KA20 shared between a first and a second terminal, the establishment being conditional on the fact that these two terminals are in the proximity of one another.
The embodiments of this method of establishment may have one or more of the characteristics of the dependent claims.
The invention also relates to a method for the execution by the first terminal of the steps required for implementing the claimed method of establishing a shared cryptographic key.
The invention also relates to a method for the execution by the second terminal of the steps required for implementing the claimed method of establishing a shared cryptographic key.
The invention also relates to a data recording medium readable by a cryptoprocessor or a microprocessor, this medium comprising instructions for the implementation of the claimed method of establishment when these instructions are executed by this cryptoprocessor or this microprocessor.
The invention also relates to a first terminal for implementing the claimed method of establishment.
The invention also relates to a second terminal for implementing the claimed method of establishment.
The invention will be more readily understood from a perusal of the following description which is provided solely by way of non-limiting example, and which refers to the drawings, in which:
In these figures, the same references are used to denote the same elements.
In the remainder of this description, characteristics and functions that are well known to those skilled in the art are not described in detail.
For this purpose, each wireless transmitter transmits electromagnetic waves, or “radio waves”, having a range of less than X meters. Typically, in the case of WiFi access terminals, X is less than or equal to 750 m or 500 m, or possibly even less than or equal to 350 m or 250 m. Usually, the range X is greater than 2 m or 10 m. Beyond this distance of X meters, the power of the transmitted electromagnetic waves is generally less than a detectability threshold Pmin, below which the electromagnetic waves cannot be detected or used by terminals. In this embodiment, for simplicity, it is assumed that the sensitivities of all the terminals are identical. Therefore, the sensitivity thresholds below which they cannot detect or use an electromagnetic wave transmitted by any of the transmitters 4 to 7 are all equal to Pmin. For example, in the case of a WiFi network, the threshold Pmin is equal to −80 dBm or −90 dBm or −100 dBm. Thus, the range of X meters corresponds to the distance beyond which the power of the electromagnetic waves transmitted by the wireless transmitter is below the threshold Pmin. In practice, this distance is not necessarily the same in all directions, because, for example, it depends on the presence of an obstacle or other interferences. However, in order to simplify
The electromagnetic waves transmitted by each transmitter are modulated on the basis of a characteristic data element of the wireless transmitter. Here, the characteristic data element is a data element which makes it possible to identify unambiguously the wireless transmitter that is transmitting these electromagnetic waves, among the set of the wireless transmitters of the set 2. This characteristic data element will subsequently be denoted Idi, where the index i is an identifier of the wireless transmitter. For example, in the case of WiFi wireless transmitters, the electromagnetic waves transmitted by these transmitters are modulated, notably, on the basis of:
These characteristic data elements of the transmitter may be extracted by each terminal capable of establishing a wireless connection with this transmitter. Subsequently, the main embodiments are described in the special case where the characteristic data element Idi is the MAC address of the transmitter.
The terminals 20 and 22 are also connected to one another by means of a network 24. The network 24 is, for example, a long-distance data transmission network. The network 24 may enable the terminals 20 and 22 to communicate with one another regardless of the distance separating them. Here, the network 24 is a network that operates independently of the set 2 of wireless transmitters. For example, the network 24 is a wireless telephone network or the Internet.
As in
In this set 30, the terminal 20 is situated at a location where only the transmitters 32 to 34 are in its range. The terminal 22 is situated at a location where only the transmitters to 37 are in its range.
The transceiver 54 is a WiFi transceiver capable of detecting and establishing a WiFi connection with any of the wireless transmitters of the sets 2 and 30. Authorization for access to the local network by such a wireless transmitter, or to the network 24 via this wireless transmitter, is commonly conditional on the fact that the terminal has the necessary access rights. However, even without having the necessary access rights, the transceiver 54 is capable of extracting the data element Idi from the electromagnetic waves transmitted by the wireless transmitter.
The cryptoprocessor 56 is capable of executing data encryption and decryption functions, as well as hash functions. The cryptoprocessor 56 is designed to be more resistant to attempted cryptanalysis than, for example, the microprocessor 50. For this purpose, it comprises, notably, a secure non-volatile memory 60. The memory 60 is only accessible and readable by the cryptoprocessor 56. In particular, the memory 60 is not accessible and is not readable by the microprocessor 50. Here, the memory 60 stores a key Kma and an initialization vector VI. The memory 60 also stores instructions for executing the steps required for implementing any of the methods of
For simplicity, it is assumed that the architecture of the terminal 22 is identical to that of the terminal 20. In particular, the secure non-volatile memory of the terminal 22 also comprises the key Kma and the vector VI.
The operation of the terminals 20 and 22 for establishing a shared cryptographic key KA20 will now be described with reference to the method of
In a step 98, the terminals 20 and 22 are each placed in one or more reception areas of a set of wireless transmitters such as those described with reference to
In a step 100, the terminal 20 transmits a synchronization signal to the terminal 22, for example, via the network 24.
Then, Δt20 seconds after the transmission of the synchronization signal, in a step 102, the terminal 20 captures and receives the electromagnetic waves transmitted by the N wireless transmitters that are in its range. By way of illustration, the interval Δt20 is equal to 0 seconds. Additionally, in this step, the transceiver 54 measures the power of each of the electromagnetic waves received, in order to obtain an indicator of the power of the received electromagnetic wave. Such an indicator is known by the acronym RSSI (“Received Signal Strength Indicator”) in the case of a WiFi network.
In a step 104, the transceiver 54 demodulates solely the received electromagnetic waves whose powers are above the threshold Pmin. In this step, the transceiver 54 also extracts from each of these received demodulated signals the characteristic data element Idi of each wireless transmitter located in its range. Here, the characteristic data element Idi comprises at least the MAC address of this wireless transmitter. Each of the characteristic data elements Idi extracted is associated with the RSSI indicator obtained for the electromagnetic wave on the basis of which this data element Idi has been extracted. It will be recalled that all the wireless transmitters have different MAC addresses, such that the characteristic data element Idi makes it possible here to identify unambiguously the transmitter of the electromagnetic wave received among the set of wireless transmitters. The extracted characteristic data element Idi may also comprise additional information such as the SSID label of the network and/or the name of the manufacturer of the wireless transmitter. The transceiver 54 then transmits each extracted data element Idi and the RSSI indicator associated with it to the cryptoprocessor 56.
In a step 106, the cryptoprocessor 56 receives these extracted data elements Idi and the associated RSSI indicators. At the end of this step, the cryptoprocessor 56 therefore has a list Le20 comprising, for each wireless transmitter in its range, a line containing:
In a step 108, the cryptoprocessor 56 compares the number 120 of lines contained in the list Le20 with a predetermined threshold Lmax.
If the number 120 of lines is less than the threshold Lmax, the cryptoprocessor 56 proceeds directly to a step 110. In the contrary case, it proceeds to a step 112.
In step 112, the cryptoprocessor 56 selects a limited number of lines in the list Le20 to obtain a shortened list Le20r containing only Lmax lines. For this purpose, the cryptoprocessor 56 uses a first predetermined set of selection criteria. For example, this first set here comprises a single criterion which selects only the Lmax lines containing the highest RSSI indicators. This selection criterion therefore results in the selection of only the Lmax characteristic data elements Idi extracted from the Lmax most powerful electromagnetic waves received. The Lmax most powerful electromagnetic waves received usually correspond to the Lmax wireless transmitters closest to the terminal 20. The threshold Lmax is usually less than 10 or 7. In the remainder of this description, Lmax is equal to 9.
At the end of step 112, the list Le20r replaces the list Le20 and the method continues via step 110.
In step 110, the cryptoprocessor 56 constructs an intermediate key Kdi,20 for each characteristic data element Idi contained in the list Le20. The index “20” will be used subsequently to indicate that a data element, for example the key Kdi,20 in this case, has been constructed by the terminal 20. For this purpose, each key Kdi,20 is constructed on the basis of a single corresponding characteristic data element Idi. The aim of this step is to make it difficult for any third party who knows the characteristic data elements Idi to construct the intermediate keys Kdi,20. Here, for this purpose, each intermediate key Kdi,20 is also constructed on the basis of secret information known only to the terminals 20 and 22. In this example, the secret information used is the key Kma and the vector VI. For example, each intermediate key Kdi,20 is constructed using the following relation: Kdi,20=fch(VI XOR Idi, Kma), where:
For example, the function fch is the AES (“Advanced Encryption Standard”) function.
Each constructed key Kdi,20 is associated with the RSSI indicator of the characteristic data element Idi on the basis of which this key Kdi,20 has been constructed. For example, the key Kdi,20 is added to the corresponding line of the list Le20.
In a step 114, the cryptoprocessor 56 determines a number Ns of common wireless transmitters which must also be detected by the terminal 22 for the terminals and 22 to be considered as being in the proximity of one another. Here, this number Ns is determined on the basis of the number 120 of lines in the list Le20. It is therefore determined on the basis of the number of wireless transmitters in the range of the terminal 20. If appropriate, the determination of the number Ns may also allow for the ability of at least one of the terminals 20 and 22 to be a wireless transmitter without detecting itself as such to be taken into account. For example, the cryptoprocessor 56 uses for this purpose the following table Tc:
where:
In a step 116, the cryptoprocessor 56 then constructs, on the basis of the possible subsets, K corresponding encryption keys KSk,20. More precisely, each key KSk,20 is constructed on the basis of each of the keys Kdi,20 of a single corresponding subset. For example, the key KSk,20 is constructed using the following relation: KSk,20=Kdi1,20 XOR Kdi2,20 XOR . . . XOR KdiNs,20, where KdiN,20 denotes a respective key Kdi,20 of the subset. In other words, the key KSk,20 is obtained by performing an “exclusive OR” between all the keys Kdij,20 of the subset corresponding to this key KSk,20. Given that there are Kmax different subsets here, by the end of step 116 the cryptoprocessor 56 has constructed Kmax different keys KSk,20. In other words, in this embodiment, K is equal to Kmax.
In a step 118, the cryptoprocessor 56 obtains the key KA20 to be shared with the terminal 22. Here, for example, the cryptoprocessor 56 generates the key KA20 by random or pseudo-random drawing.
In a step 120, the cryptoprocessor 56 encrypts the key KA20 with each of the keys KSk,20 to obtain K different cryptograms KA*k,20. For example, in this step, each cryptogram KA*k,20 is obtained by using the following relation: KA*k,20=fch(KA20, KSk,20). The encryption function fch is, for example, the same as that described above.
In a step 122, the cryptoprocessor 56 constructs a digital fingerprint KA20-Check of the key KA20, using a hash function, that is to say using what is called a one-way function, in other words one that is non-reversible for practical purposes. For example, the fingerprint KA20-Check is constructed using the following relation: KA20-Check=fH(KA20), where fH is a hash function. For example, the function fH is the function known by the name SHA256.
In a step 124, the terminal 20 transmits a “challenge” message to the terminal 22. This message contains, notably:
This message is, for example, transmitted to the terminal 22 via the network 24.
In response to the synchronization signal, the terminal 22 launches, Δt22 seconds after the reception of this signal, the execution of steps 132 to 144. The period Δt22 is chosen so that steps 132 and 134 are executed at the same time, or practically at the same time, as steps 102 and 104. For example, for this purpose, here, the period Δt22 is chosen to be equal to the period Δt20. Steps 132 to 144 are identical, respectively, to steps 102 to 114, except in that they are executed by the terminal 22. In particular, the first set of selection criteria used in step 142 is the same as that used in step 112. However, as shown in
In a step 150, the terminal 22 receives the challenge message.
In response to the reception of this challenge message, in a step 152, the cryptoprocessor of the terminal 22 decrypts each of the cryptograms KA*k,20 contained in this message. More precisely, as long as a received cryptogram KA*k,20 has not been correctly decrypted, the cryptoprocessor of the terminal 22 reiterates operations 154 to 160 in a loop. Before proceeding to the reiteration of operations 154 to 160, the cryptoprocessor of the terminal 22 selects a cryptogram KA*k,20 from among the K cryptograms KA*k,20 received in step 150.
In operation 154, the cryptoprocessor of the terminal 22 constructs a new key KSm,22 which has not already been used to attempt to decrypt the cryptogram KA*k,20. To construct the key KSm,22, the cryptoprocessor of the terminal 22 proceeds in exactly the same way as that described with reference to step 116. Thus, in operation 154, each key KSm,22 is constructed using the following relation: KSm,22=Kdi1,22 XOR Kdi2,22 XOR . . . XOR KdiNs,22, where Kdij,22 denotes a respective key Kdi,22 of the subset. The number Ns used to construct the keys KSm,22 is that which was received in step 150. The keys Kdi,22 used are those constructed in step 144.
Given that the list Le22 does not necessarily contain the same characteristic data elements as the list Le20, the keys KSm,22 constructed by the terminal 22 are not necessarily the same as the keys KSk,20 constructed by the terminal 20. However, if the terminal 22 is sufficiently in the proximity of the terminal 20, as for example in the situation shown in
Conversely, if the terminals 20 and 22 are sufficiently distant from one another, as in the situation shown in
In operation 156, the cryptoprocessor of the terminal 22 decrypts the selected cryptogram KA*k,20 with the key KSm,22 constructed in operation 154. At the end of operation 156 it obtains a key KA22. For example, this operation is performed using the following relation: KA22=fch−1(KA*k,20, KSm,22). The decryption function fch−1 is the inverse of the function fch described above.
In operation 158, the cryptoprocessor of the terminal 22 constructs the digital fingerprint KA22-Check of the key KA22 obtained at the end of operation 156. For this purpose, the same hash function fH as that used in step 122 is used. Here, the fingerprint KA22-Check is therefore constructed according to the following relation: KA22-Check=fH(KA22).
In operation 160, the cryptoprocessor of the terminal 22 compares the fingerprint KA22-Check constructed in operation 158 with the fingerprint KA20-Check received in step 150.
If the fingerprints KA22-Check and KA20-Check are different, this means that the cryptogram KA*k,20 has not been decrypted correctly. This is typically what happens when the key KSm,22 used to decrypt the cryptogram KA*k,20 is different from the key KSk,20 used to obtain this cryptogram. In this case, the method returns to operation 154. The subsequent reiteration of operations 154 to 160 is executed with a new key KSm,22, constructed in the new execution of operation 154, which has not already been used to decrypt the selected cryptogram KA*k,20.
If all the keys KSm,22 have already been used unsuccessfully in an attempt to correctly decrypt the currently selected cryptogram KA*k,20, then, in a step 162, the cryptoprocessor of the terminal 22 selects, from among the K cryptograms KA*k,20 received in step 150, a new cryptogram KA*k,20 which has not been selected already. Operations 154 to 160 are then reiterated for this new selected cryptogram KA*k,20.
In step 162, if the K cryptograms KA*k,20 received in step 150 have all been selected already, then the method stops. In this case, the key KA20 is not shared between the terminals 20 and 22. This is because the terminal 22 has not succeeded in correctly decrypting any of the cryptograms KA*k,20 received in step 150, and therefore has not succeeded in obtaining the key KA20. This is due to the fact that these two terminals 20 and 22 are not in the proximity of one another.
If, in operation 160, the cryptoprocessor of the terminal 22 determines that the fingerprints KA20-Check and KA22-Check are identical, the cryptogram KA*k,20 has been correctly decrypted. In this case, the key KA22 obtained at the end of step 156 is identical to the key KA20. The method then continues via an operation 164.
In operation 164, the cryptoprocessor of the terminal 22 stores the key KA22 as being the key shared with the terminal 20. Additionally, here, in operation 164, the terminal 22 sends a message to the terminal 20 to indicate that it now also has the key KA20.
The method then continues via a phase 170 of secure data exchange. For example, in phase 170, the terminals 20 and 22 establish a secure data exchange link between them. For this purpose, the cryptoprocessor 56 encrypts with the key KA20 the data transmitted to the terminal 22, via the network 24 for example, and the terminal 22 decrypts these received data with its key KA22. In this phase 170, in a reciprocal manner, the data transmitted from the terminal 22 to the terminal 20 are encrypted with the key KA22 and the cryptoprocessor 56 decrypts these data with the aid of the key KA20.
Preferably, steps 100 to 152 are reiterated at regular intervals to ensure that the terminal 22 is still in the proximity of the terminal 20. For example, the regular interval is less than 24 hours or 4 hours or 1 hour or 30 minutes.
Step 166 is identical to step 116, except in that the cryptoprocessor 56 selects a number K of subsets strictly below the maximum number Kmax of possible subsets. For this purpose, the cryptoprocessor 56 uses a second predetermined set of selection criteria.
For example, here, this second set comprises a single selection criterion which requires each of the K selected subsets to comprise:
For example, Nh is a constant which is predetermined, or preferably determined on the basis of the number of lines 20 in the list Le20.
Thus, each of the K keys KSk,20 is constructed using the following relation: KSk,20=Ks1 XOR Ks2 XOR . . . XOR KsNs-Nh XOR Kh1 XOR . . . XOR KhNh, where:
The terminal 20 transmits the number Nh to the terminal 22, in step 124 for example. For example, the number Nh is contained in the challenge message.
Step 172 is identical to step 152, except in that operation 154 is replaced by an operation 178.
In operation 178, the cryptoprocessor of the terminal 22 uses the same second set of selection criteria to select the subsets from which it constructs the keys KSm,22.
In step 190, each key Kdi,20 is also constructed on the basis of a data element which varies whenever step 110 is executed. Thus, even if the characteristic data elements Idi extracted are the same, each new execution of step 190 results in the construction of different keys Kdi,20. For example, in step 190 a new vector VI is drawn randomly or pseudo-randomly for this purpose, and this new vector VI is then transmitted to the terminal 22. For example, the new vector VI is incorporated in the challenge message transmitted to the terminal 22. Step 192 is executed only after the new vector VI has been received. Step 192 is identical to step 140 except in that it uses the new vector VI received to construct each of the keys Kdi,22.
Consequently, on each new execution of step 116, the constructed keys KSk,20 are different from those constructed during the preceding executions of step 116. Therefore, it is no longer possible to try to exploit the fact that the keys KSk,20 remain unchanged on each iteration of steps 102 to 116 in order to obtain the key KA20 when the terminals 20 and 22 are not in the proximity of one another. In fact, if the keys KSk,20 remain unchanged as long as their electromagnetic environment remains unchanged, a pirate terminal may try to record the keys KSm,22 constructed during a preceding iteration of step 152. Then, for the subsequent executions of step 152, instead of constructing the keys KSm,22 on the basis of the characteristic data elements extracted from the current electromagnetic environment of this pirate terminal, it uses the recorded keys KSm,22 in order to decrypt the received cryptograms KA*k,20. Such a fraud, although very difficult to carry out, would enable the pirate terminal to establish the shared key KA22 even if this terminal has been moved away from the terminal 20, provided that the wireless transmitters in the range of the terminal 20 remain unchanged.
In step 200, a number Na is drawn randomly or pseudo-randomly. Then, also in this step 200, this number Na is used in order to choose, from the second set of selection criteria, the criterion that will be used to select the subsets used for constructing the keys KSk,20. This number Na is also transmitted to the terminal 22 before the execution of step 172 begins.
Then, on the basis of the received number Na, and applying the same choice algorithm as that used by the terminal 20, in step 202 the terminal 22 chooses a selection criterion from the second set of selection criteria. This selection criterion is then used in operation 178 for selecting the subsets used for constructing the keys KSm,22. Given that the terminal 22 uses the same number Na and the same choice algorithm, it chooses the same selection criterion as that used by the terminal 20. As in the method of
In the set of variants described here, those skilled in the art will understand that, when modifications of the method executed by the master terminal are proposed, corresponding modifications must usually be made on the slave terminal. Thus, in the remainder of this chapter, only the modifications of either the master terminal or the slave terminal are described.
There are numerous encryption and decryption functions that can be used in the embodiments described here. For example, in a simplified embodiment, the encryption function is simply an “exclusive OR” between the key KA20 and the characteristic data elements Idi extracted, or the keys Kdi,20 or the key KSk,20.
Numerous methods are possible for generating the key KSk,20 on the basis of the characteristic data elements Idi extracted. For example, in a simplified embodiment, each key KSk,20 is constructed using the following relation: KSk,20=Idi1 XOR Idi2 XOR . . . XOR IdiNs. In this case, the intermediate keys Kdi,20 are not used, and the key Kma and the vector VI may be omitted. In another variant, the key KSk,20 is constructed using the following relation: KSk,20=fch(Idi1 XOR Idi2 XOR . . . XOR IdiNs Kma). In this case, the steps of constructing the intermediate keys Kdi,20 may be omitted.
The key Kma may be common to all the terminals.
The intermediate key Kdi,20 may be constructed differently. For example, the key Kdi,20 may also be constructed using the following relation: Kdi,20=fch(Kma; VI XOR Idi). In this case, it is the key Kma that is encrypted, using the result of the operation VI XOR Idi as the key. Evidently, there are numerous other possibilities for obtaining the key Kdi,20 on the basis of the characteristic data element Idi and a secret piece of information. For example, the use of the vector VI may be omitted.
In all the embodiments, the XOR operation may be replaced by any commutative operation, such as the NAND operation.
Step 110 may be omitted. In this case, the keys KSk,20 are directly constructed on the basis of the characteristic data elements Idi without using a secret piece of information such as the key Kma or the vector VI.
In a variant, the key KA20 is obtained in a different way. For example, instead of being generated by random or pseudo-random drawing, it is prerecorded in a non-volatile memory of the first terminal. Consequently, obtaining the key KA20 is simply a matter of reading the key KA20 from this non-volatile memory. In another variant, the key KA20 is generated on the basis of the characteristic data elements Idi extracted. In fact, the methods described here for sharing the key KA20 are applicable regardless of the method of obtaining the key KA20.
Variants of the Sets of Selection Criteria:
Other embodiments of the first set of selection criteria are possible. The first set may comprise other selection criteria in addition to, or in place of, the selection criterion based on the RSSI indicator. For example, in a variant, it comprises a selection criterion that excludes from the list Le20r all the wireless transmitters manufactured by a particular manufacturer. In another example, it comprises a selection criterion such that the terminal preferentially selects the characteristic data elements Idi of wireless transmitters whose manufacturers belong to a prerecorded list of known manufacturers. Similarly, a plurality of different selection criteria may be combined. In the last-mentioned case, the different selection criteria may be weighted with respect to one other, using weighting coefficients.
The first set may also comprise a selection criterion that automatically eliminates each characteristic data element Idi extracted from a received electromagnetic wave whose power is below a predetermined threshold Pr. For example, the threshold Pf is equal to −70 dBm.
When the selection criterion of the second set is used, for selecting the Ns-Nh keys Kdi,20, the selection criterion may be that of selecting the Ns-Nh keys Kdi,20 constructed on the basis of characteristic data elements Idi extracted from received electromagnetic waves having a power in the range [Pm; Ph[, where Pm is a predetermined threshold that is strictly less than Ph. For selecting the Nh keys Kdi,20, the selection criterion may be that of selecting these Nh keys Kdi,20 from a subset containing solely the Nh keys Kdi,20 associated with the Nh largest MAC addresses. Nh is strictly less than Ns and is preferably greater than two. This selection criterion is a first example of a selection criterion that does not depend on the power of the received electromagnetic waves. More generally, any other method capable of leading, in a deterministic way, to the same selection of keys Kdi,20 by the terminals 20 and 22 when these terminals 20 and 22 are situated in the same location is acceptable.
In a variant, the number Nh is a constant prerecorded in each terminal, for example during manufacture. In this case, the number Nh does not need to be transmitted to the terminal 22.
In other variants, the selection criteria for the second set do not take into account the power of the received electromagnetic waves. For example, the keys Kdi,20 are classified in increasing or decreasing order of MAC addresses, and only the subsets containing only keys Kdi,20 belonging to the first half of this classification are selected. The keys Kdi,20 may also be classified in increasing or decreasing order of a digital fingerprint fH(@MAC) instead of using their MAC address directly, where @MACi is the MAC address associated with the key Kdi,20. In another variant, after having been classified in increasing or decreasing order of MAC addresses or RSSI indicator, only the subsets containing only keys Kdi,20 of even or odd rank in this classification are selected.
The second set of selection criteria may additionally or alternatively comprise selection criteria other than those described above. For example, instead of comprising a selection criterion that selects only the subsets that have Nh keys Kdi,20 obtained on the basis of characteristic data elements Idi extracted from high-power electromagnetic waves, the second set comprises a selection criterion that selects only the subsets in which:
Variants of the Determination of the Number Ns:
The number Ns may be determined differently. For example, in a simplified embodiment, Ns is a constant equal to one.
In variants, the terminal 20 does not transmit the number Ns to the terminal 22. In this case, the terminal 22 must also successively try out the different possible values of the number Ns. This causes the terminal 22 to construct keys KSm,22 successively on the basis of a single key Kdi,22, then of two keys Kdi,22, then of three keys Kdi,22, up to a predetermined threshold Nsmax for the number Ns.
In another variant, the number Ns is a constant. For example, the number Ns may be recorded in all the terminals at the time of manufacture. In this embodiment, it is not necessary to transmit the number Ns to the terminal 22 in step 124. This embodiment may be used, notably, in the case where the number of wireless transmitters in the environment of each of the terminals is a constant known in advance.
Other Variants:
Step 100 may be omitted. In this case, the launch of steps 102, 104 and 132, 134 takes place asynchronously, that is to say without the launches being temporally synchronized with one another.
In another variant, it is the challenge message that also acts as a synchronization signal. In this case, steps 132 to 144 are launched solely in response to the reception of the challenge message.
The above method may also be used to share a key among more than two terminals. For this purpose, the terminal 20 transmits the challenge message to a third terminal, in addition to the terminal 22. This third terminal then executes the same operations and the same steps as the terminal 22 for establishing the key KA20 shared with the terminals 20 and 22.
The embodiments described here may easily be adapted to make use of the presence, in the proximity of the terminals, of wireless transmitters other than those of a WiFi network. For example, the description given here is applicable to Bluetooth or LoRa networks or any other support network of the IoT (for “Internet of Things”). In particular, the same set may comprise wireless transmitters compatible with different standards. For example, there may be both WiFi transmitters and Bluetooth transmitters in the same set of wireless transmitters. In this case, the terminals are equipped with both a WiFi transceiver and a Bluetooth transceiver so that some of the keys Kdi,20 are constructed on the basis of characteristic data elements of WiFi transmitters and other keys Kdi,20 are constructed on the basis of characteristic data elements of Bluetooth transmitters. Thus, in this embodiment the simultaneous presence of a plurality of wireless transmitters conforming to different standards is exploited to ensure the proximity of the terminals.
In a variant, in response to the reception of the challenge message, the terminal 22 launches a timer which counts down a period D1. When the period D1 has expired, the cryptoprocessor of the terminal 22 automatically interrupts the execution of step 152, even if the shared key KA22 has not yet been obtained. Preferably, the period D1 is initialized on the basis of the number Ns.
The keys KSk,20 may also be constructed by taking other local information into account. For example, in the case where the terminals 20 and 22 are also connected to the same local wired network, the terminals 20 and 22 detect the MAC addresses of all the devices connected to this local wired network. The terminal 20 then generates each key KSk,20 by additionally taking into account, for example, the detected MAC addresses. For example, for this purpose the cryptoprocessor adds the detected MAC addresses to one another. It then combines the sum thus obtained with each of the constructed keys KSk,20, using an “exclusive OR” operation for example, to obtain a new key KSk,20 which is then used in place of the preceding key KSk,20. Consequently, the terminal 22 cannot correctly decrypt the cryptogram KA*k,20 unless it is also connected to the same wired network as the terminal 20.
A wireless transmitter may be a repeater of wireless signals transmitted by another source wireless transmitter. In this case, the signals transmitted by the repeater comprise the same SSID label as those transmitted by the source wireless transmitter. On the other hand, the MAC address of the repeater is different from that of the source wireless transmitter.
In a variant, the cryptoprocessor 56 is omitted. In this case, the set of steps is executed by the microprocessor 50.
In a variant, the terminal 20 is configured solely for acting as a master terminal and the terminal 22 is configured solely for acting as a slave terminal. Thus, in this embodiment, the roles of the terminals 20 and 22 cannot be reversed.
In a variant, the terminals 20 and 22 communicate with one another by means of the wireless transmitters. In this case, the network 24 is the WiFi network supported by the signal transmitted by one of the wireless transmitters which is also in the range of the terminals 20 and 22. In another variant, the network 24 is a WiFi network supported by a signal transmitted by one of the terminals 20, 22.
The sensitivities of all the terminals are not necessarily identical. For example, in a variant, the thresholds Pmin of the terminals 20 and 22 are different. In this case, the sensitivity threshold of the terminal 20 is denoted Pmin20 and the sensitivity threshold of the terminal 22 is denoted Pmin22.
The threshold Lmax used by the terminal 22 may be different from the threshold Lmax used by the terminal 20. In this case, the thresholds Lmax of the terminals 20 and 22 are denoted, respectively, Lmax1 and Lmax2.
Characteristic data elements other than the MAC address of the wireless transmitters may be used to implement the methods described here. For example, in a variant, the characteristic data element comprises not the MAC address, but the network identifier known by the acronym SSID and/or the name of the manufacturer of the wireless transmitter. The characteristic data element may also be a combination of a plurality of characteristic data elements extracted from the electromagnetic waves received.
Preferably, the number K is less than the number N. However, in the embodiments where Ns is greater than two or three, the number K may be greater than the number N.
In the methods described here, the terminals 20 and 22 cannot succeed in establishing a shared cryptographic key unless these terminals are in the proximity of one another. This is because, if they are distant from one another, the wireless transmitters located in the range of the terminal 20 are then different from those located in the range of the terminal 22. In these conditions, the characteristic data elements Idi extracted from the electromagnetic waves transmitted by the wireless transmitters in the range of the terminal 20 are not the same as those extracted by the terminal 22. In this case, the terminal 22 cannot construct a key KSm,22 identical to one of the keys KSk,20 constructed by the terminal 20. Therefore, the terminal 22 cannot correctly decrypt the cryptogram KA*k,20 received, and consequently cannot obtain the shared key KA20.
This method also has numerous other advantages. In particular, this method is reliable, because in order to determine the proximity of the terminals:
The propagation time, the parameters of the data frames exchanged between the terminals, and the IP addresses of these terminals are elements that can easily be modified to give the impression that these terminals are in the proximity of one another.
The methods described also make it possible to establish a cryptographic key shared among more than two terminals. Furthermore, it is not necessary for a communication channel to be established between the two terminals before the shared key is generated.
The fact of synchronizing the extraction by the terminals of the data elements Idi enables the method to be made less sensitive to the addition or removal of wireless transmitters.
The use of the MAC address as the characteristic data element increases the reliability of the method, because the MAC address of a wireless transmitter is difficult to modify, and in any case is more difficult to modify than an SSID label.
Limiting the number of characteristic data elements Idi used enables the execution of the subsequent steps to be accelerated.
Limiting the number of keys KSk,20 on the basis of a selection criterion taking into account the power of the electromagnetic waves received makes it possible to limit even further the maximum distance Dmax that can separate two terminals while still allowing them to be considered as being in the proximity of one another. This is because, in this case, it is not only necessary for the terminals 20 and 22 to detect the same wireless transmitters, but the power of the electromagnetic waves received from these wireless transmitters must also be similar.
The fact that the cryptogram KA*k,20 is constructed solely on the basis of a combination of a plurality of extracted characteristic data elements means that, in order to establish the shared key, the terminal 22 must also be in the proximity of these Ns wireless transmitters. This reduces the maximum distance Dmax. This also makes it more difficult to mount attacks in the form of attempts to reproduce the environment of the terminal 20 around the terminal 22.
Requiring the use of Nh characteristic data elements Idi extracted from electromagnetic waves having a power greater than Ph, and Ns-Nh characteristic data elements extracted from electromagnetic waves having a power of less than Pf, further decreases the distance Dmax. This also decreases the number of keys KSk,20, thereby accelerating the execution of the method.
By choosing the selection criteria of the first or second set on the basis of a random or pseudo-random number, it is possible to renew the keys KSk,20 even if the wireless transmitters in the environment of the terminal 20 remain unchanged.
Number | Date | Country | Kind |
---|---|---|---|
1763371 | Dec 2017 | FR | national |
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/FR2018/053481 | 12/20/2018 | WO | 00 |