WO2002099608A2

WO2002099608A2 - Method for secure individual authentication for connection to an internet server by stealthy remote access

Info

Publication number: WO2002099608A2
Application number: PCT/FR2002/001839
Authority: WO
Inventors: Marguerite Paolucci; Jean-Pierre Brissaud
Original assignee: Marguerite Paolucci; Jean-Pierre Brissaud
Priority date: 2001-06-05
Filing date: 2002-05-31
Publication date: 2002-12-12
Also published as: FR2825489A1; FR2825489B1; WO2002099608A3

Abstract

The invention concerns a method for setting up a confidential nomadic connection to an INTERNET server, which guarantees that the user is duly authorised to the transaction. The method uses a removable non-rewritable medium, a non-resident applicative kernel on the machine used, protected by a random graphic password capable of generating a neutral remote connection, and an applicative kernel temporarily installed on the hard disk so as to prevent faults in a potential abnormal interruption of the session. The method comprises security devices for ensuring integrity of the random access memory, and not giving rise to attempts at fraudulent authentication.

Description

SECURE INDIVIDUAL IDENTIFICATION OF CONNECTION TO A SERVER

INTERNET / INTRANET BY REMOTE ACCESS FUR7TF

The present invention relates to an individual, secure, nomadic electronic identification method intended to authenticate the author of a connection to an INTERNET site from any PC xx86 ₄ machine having a level of security and confidentiality. not achieved to date by any other process.

In the current state of the art, the solutions proposed are of several types: Software devices with asymmetrical or symmetrical keys Hardware devices of the “jungle” type - Mixed software / hardware devices of the “smart” or “smartcard” card type

- Mixed software / hardware devices such as CD recognition.

1 / Software devices with asymmetric or symmetrical keys.

In such devices, the user is identified by the presence, on the hard drive of the machine he is using, of a qualified authentication certificate assigned by an authorized trusted third party authority, generally claiming the use of a "pass phrase" (long password).

The disadvantages of such devices reside in the persistence of specific information (in particular the certificate) on the hard disk of the machine used after the end of the connection session, as well as the vulnerability of the “passphrase”.

Indeed, the certificate consists of one or more elements, files and / or records, especially in the Windows registry. These elements, like any element present on a hard disk, are liable to be fraudulently copied to (Unbeknownst to the user, by direct manipulation on the machine or remotely by the introduction of "trojans", then to be installed on another machine for fraudulent use.

In addition, the "passphrase", however long and complex it is, is vulnerable to the manipulation of "keyioggers" keyboard monitoring applications, widely available in free use on

INTERNET.

Dje. such, application: have the effect of. collect in, a text file, removed. of. the machine by the. fraudster, or sent automatically by Email to his destination, all of the keystrokes made during a given period which may cover several days. Finally, the permanent presence of such applications (certificates) on the machine used presents a vulnerability to fraudulent modifications aimed at modifying the behavior of said applications. In other words, even if such applications are entrusted with monitoring and controlling the "healthiness" of the machine used, such functionalities could easily be fraudulently deactivated by Unsu of the authorized user. On the other hand, intrinsically, a certificate installed on one machine cannot be used on any other without reinstallation, which is generally complex because it is allegedly secure. It is obvious that if a certificate could be installed on any machine, there would be no guarantee that the user is really the authorized person. Finally, the entry point to the INTERNET network is left to the free choice of the user, creating a risk of questionable paths to the server.

2 / Hardware devices of the “jungle” type

Such devices, consisting of a plug applied to one of the output connectors of the machine, parallel or serial connector, USB connector, etc. support specific information sent to the machine at your request from an application resident on the disk. hard (eg certificate type).

It is therefore an improvement made to type 1 / devices, but which still include the vulnerabilities linked to the permanent presence of the application core on the machine's hard disk.

Furthermore, compatibility with the extremely diverse fleet of machines is absolutely not guaranteed. It is very common for such devices to be faulted by a particular machine configuration.

The very design of such devices does not allow them to be made active, because they cannot include complex software sequences embedded on the key. In other words, their role is limited to answering a query, but in no case does it can extend to the initiation of complex software operations. In other words, a health check of the OS

(Operating System) of the machine is out of the range of such devices.

3 / Mixed software / hardware devices such as “smart” or “smartcard” cards.

Such devices have characteristics similar to those of the previous type

The remarks concerning type 2 devices / also apply. On the other hand, these devices require the use of particular readers, resulting in additional cost and a limitation of use to machines specifically equipped

Such a solution therefore has no nomadic character.

4 / Mixed devices hardware software such as CD recognition.

Such devices using a burned CD, interrogated during a connection session by the connection application or a JAVA "applet" originating from the server, can be an improvement to type 1 / devices, and present in particular the advantage of nomadism, because they work on any machine with a conventional CD player.

However, in the current state of the art, the behavior of such devices is either limited to the response to a request from the machine, and does not allow the control and monitoring of the salubrity of the machine used, or claims direct launch of an application without installation on hard disk, with possible deletion at the end of the session of Internet consultation files (Internet temporary files in particular). However, nothing in this case is provided in case the session ends abnormally, and the files consulted generally remain intact. Furthermore, the word processing work possibly carried out during the protected session is not deleted.

Finally, the “passphrases” used are subject to the same vulnerabilities as seen above, namely: possibility of fraudulent recovery by “keyioggers”. On the other hand, the access point to the INTERNET network generally depends on the remote access configuration previously carried out on the machine used. In the case where a connection is created by subscription or prepaid card, this connection is not deleted after the session and disturbs the operation of the subscriptions previously installed on the host machine. The method according to the invention:

It is characterized by a set of devices which resolve the weaknesses previously mentioned.

The method according to the invention is supported by a CD, removable, non-rewritable medium, usable on any machine of the PC xx86 type having a current CD player.

The only insertion of the CD into the drive automatically triggers, according to the means offered by the BIOS and the commonly implemented operating systems, a series of software operations whose purpose is either to prepare a use of the operating system (OS) present to a confidential session, or to close your session of the operating system in service on the machine used, to then launch an operating system, specific to the CD and resident there, which will not be installed on the hard disk. This O.S. owner burned on the CD, cannot be subject to any fraudulent alteration insofar as the support used is not rewritable. It is not installed on the hard disk, and can be used directly from the CD.

The choice between O.S. resident or O.S. external owner is made according to the nature of the resident operating system: - If. the resident system is unmanaged (of the Windows 95/98, Millenium or XP home type - Microsoft registered trademarks) application prepares the session by temporary installation on the hard disk (the time of the session) of a mini program intended to be executed automatically with the restarting of your host machine to complete the erasures of the passage, then to neutralize itself.

If the resident system is of the administered type (Windows NT72000 / XP pro - registered trademarks of Microsoft), the application identifies the connection characteristics of the host machine in the registry and the specific files, then creates a temporary text file on the hard drive. After which, a loadlin.exe routine is launched in order to stop the O.S. resident and launch the proprietary operating system directly from the CD. The opening of the confidential session is subject to a particular password entry device, described below. This password is completely unrelated to any passwords for accessing the various sites accessed.

Furthermore, the entry point on the INTERNET network can be created specifically automatically on the machine used to obtain a specific temporary entry, which will be deleted from the machine used at the end of the session. This entry point can be created in particular from the characteristics of a standard type prepaid code card. The creation of this temporary remote access connection is carried out in such a way that it circumvents the barriers posed by any binding subscriptions present on the host machine (a good binding subscription-free is given by AOL - registered trademark - in the measure or it is usually not possible to install a competitor subscription after this one ...), and that, once the session ended, it does not disturb the proper functioning of said subscriptions. To do this, all the characteristics of the present subscription (s) are memorized before the creation and configuration of the temporary connection, with a view to being reinstalled at the end of your session.

On the other hand, the software operations launched include a verification of the integrity of the RAM as well as a verification that the TCP / IP ports of the machine are not under abnormal control. In addition, if the application runs under O.S. resident The resident system registry is set to prevent viewing of the CD from a network machine other than the host machine.

Under O.S. resident as under O.S. owner, a proprietary browser, itself residing on the CD and not installed or residing on the hard drive of the machine is then launched.

Then, the identification of the user is determined from a specific file, unique, of several thousand characters, protected against comparative analysis, in such a way that your possible possession of several of these unique files does not allow to identify any repetitive algorithm, resemblance or difference. This unique strong identification file is, of course, neither installed nor resident on the hard drive.

It should be noted that the strong identification of the user can be constituted in various ways, qualified certificate, identifier of indefinite length, graphic file, or others ...

Thus, none of the information specific to the identification of the user is installed on the hard drive, and does not give rise to any temporary file whatsoever, and cannot be subject to fraudulent recovery after departure. of the user.

Password input device according to the invention:

One of the weaknesses of the existing solutions identified above concerns the fact that any keyboard input is liable to fraudulent recovery by spying on the "keylogger" keyboard, by TEMPEST effect for monitoring electro-agjetic emissions, or even in public places , by keypad surveillance camera.

Also, the input device according to the invention does not use the keyboard, but only the mouse pointer.

The application developed for the needs of the device successively displays on the screen a number of panels equal to the number of characters in the password.

Each of its panels is positioned randomly on the screen, waiting for a click-mouse, then disappears to make room for the next.

On each of these panels, appears all the possible characters, for example your alphabetic characters in lowercase, the alphabetic characters in uppercase and the numbers from 0 to 9. In this way, we can even consider creating passwords designed as sequences of graphic symbols.

Thus, the only events that a keyboard spy application could detect would be limited to click-mouse at an insignificant location on the screen, insofar as the panels appear at random locations and that IO.S. being proprietary, it is not possible to reconstruct the display logic, which is itself random.

In order to reinforce the defenses of the password identification device, each of the characters thus entered graphically is included in a control loop of several thousand characters, provided with a non-countable delay of several seconds.

It is therefore not possible to envisage a break-in by systematic interrogation: for a password of 5 alphanumeric characters, upper and lower case, the number of combinations is around one billion, and a total exploration time amounting to several hundred years, whatever the computing power of the machine used ... Furthermore, this looping interrogation makes it possible to combat your response time comparison techniques, character by character, sometimes used for cracking.

In a particular application of the method according to the invention, called Stealth Remote Access:

The support CD is in business card format, not rewritable, and can be used in any CD or platter CD player. - An O.S., designed specifically for the application, is resident on the CD and works directly from the CD, if there is a managed operating system on the machine.

The password entry device includes the randomly positioned display of 5 successive tables of alphanumeric characters (upper case, lower case and numbers).

The password entry device selects the characters sent by the user by mouse click, without taking the keyboard into account.

- The password control device has a time delay of 5 seconds before confirming or invalidating your entry.

- The password control device manages a loop of 10,000 successive checks, among which are embedded the checks of the 5 characters entered. - The INTERNET session launching application creates, on the machine used, the configuration of a remote access point thanks to the characteristics of a prepaid INTERNET access card on a specific call number.

- The INTERNET session launching application includes integrity checking functionalities aimed at ensuring that the machine memory is not corrupted, and that the TCP / IP access ports are not abnormally used. Part of the functionality on the CD is obtained, in particular, by automatic secure connection to one or more sites specializing in anti-virus treatment.

- The application for launching your Internet session directly opens the home page of a publisher / advertiser site. - The INTERNET session closure causes the deletion of the configuration of the remote access connection possibly installed during the session opening and the reinstatement of the parameters of the priority connection previously present on the host machine. In addition, in the case of operation under OS resident the erasure of the traces of passage are selective: only Internet files, history, etc., consulted during the session are deleted, to the exclusion of all other files consulted previously during the session. On the other hand, operations outside the Internet (copy and paste, clipboard, word processing) are also taken into account in the management of erasures, finally the utility initially installed in order to correct an abnormal interruption of the session is erased .

Said utility ensures, in the event of an accidental stop during a session, the same functionalities as described above. Industrial applications:

The method according to the invention, in addition to its obvious advantage in the field of personalizing the use of collective machines, such as the creation of constant personalized environments on public machines of the cyber cafe type and the direct addressing (direct marketing) of Prospects new to the Internet provides unmatched security in the area of authenticating users of INTERNET services, and naturally finds many applications in sectors requiring strong identification and easy to use. In particular, online services from banks, tax administration (VAT declarations, among others), information providers, newsletters, administrative services, online, etc.

A. particularly interesting application, concerns the signature, eiefctrσπique, including the. legal definition states that it must be able to be protected by the signatory against any use by third parties. Indeed, qualified electronic certificates, devices currently admitted as capable of fulfilling the functions of electronic signature cannot be validly protected against any use by third parties, since they reside on the user's hard drive and can be " and the exponential development of the number of people connected to the INTERNET creates every day additional and new risks of amateur, mercenary, and even institutional hacking from all nations.

* * *

Claims

* * *

1 / Nomadic individual authentication method of connection to an INTERNET server using a xx86 type PC, and running directly from the removable medium from a current or proprietary operating system (OS), characterized in that 'it includes the following steps: a) installation on the host hard drive of a utility to correct the effects of an abnormal session break. b) detection of the state of the administration mode of the resident operating system

- c) launch of a password control device using displays of character sets, randomly positioned in which it is necessary to select, with the mouse, the characters making up the password, and excluding any keyboard input; - d) if necessary, memorization of the parameters of a resident connection and generation of the parameters allowing the creation of a temporary remote access connection to the INTERNET, from the simple entry of the characteristics of a prepaid code card or a subscription;

- e) establishing a connection with one or more specialized sites intended to carry out an integrity check of the memory of the machine used in order to verify that the memory of the PC used is not infected with viruses or trojans; f) checking that the TCP / IP ports are not used without authorization; g) automatic connection or not, to one or more sites requiring identification; h) identification by exchange of messages using one or more encryption methods; i) erasing traces of the session and all types of files used during the session, when operating under the resident operating system. j) possible erasure of the temporary connection created and reinstallation of the parameters of the previously resident connection. k) erasure of the session termination correction utility.

2 / A method according to claim 1, characterized in that step b) results in an automatic choice between the option of operating on a resident operating system or the option of forcing on an on-board proprietary operating system .

3 / A method according to claim 1, characterized in that step c) of password control introduces a systematic delay of several seconds before confirming or invalidating the entry. 4 / A method according to claims 1 and 3 characterized in that the password relates only to the operation of the CD and not to any sites accessed.

5 / A method according to claim 1, characterized in that the generation of the connection of step d) does not introduce any disturbance on the subsequent use of the priority connection previously resident.

6 / A method according to claim 1, characterized in that (Identification of step h) is based on an identifier burned on the CD, never installed on the host disk. 7 / A method according to claim 1, characterized in that the erasures of step i) does not only concern Internet consultation files, but also all other tasks performed during the CLAIMS

* * *

8 / removable support for performing the steps of the method according to claim 1, characterized in that it is not rewritable.

9 / computer product program comprising program code instructions recorded on a medium usable in a computer according to claim 8, comprising programming means for performing the steps of the method according to claims 1,2,3,4,5 , 6 and 7.