System and method for securing data

1. A system for making data secure, comprising:

a monotonic counter configured to store an encrypted current value of the monotonic counter (v c );

a hardware processor;

a physical data medium comprising:

at least one data block written on the physical data medium,

a first master block comprising a value equal to the value of the monotonic counter plus 1 (v c+1 ), an identifier of a last data block of the at least one data block written on said physical data medium, a first authentication code guaranteeing an authenticity of the at least one data block written on the physical data medium, a second authentication code calculated from the last data block written on the physical data medium, said last data block written on the physical data medium being fixed at a pre-specified value, and a third authentication code guaranteeing the authenticity of the first master block, and

a second master block forming a replica of the first master block, wherein the at least one data block, the first master block and the second master block are contiguous to one another on the physical data medium; and

an authentication key.

2. The system as claimed in claim 1 , wherein a size of the at least one data block is configurable.

3. The system as claimed in claim 1 wherein the first authentication code further guarantees an integrity of the at least one data block written on written on said physical data medium and the third authentication code further guarantees the integrity of at least one of the first and second master blocks.

4. The system as claimed in claim 1 , wherein the second authentication code is calculated from the last data block written on the physical data medium, data in this last block being fixed at a pre-specified value, and from data in other data blocks of the at least one data block, which is saved as is.

5. The system as claimed in claim 1 wherein the authentication key is contained in the first and the second master blocks.

6. The system as claimed in claim 5 further comprising a system key and wherein the authentication key is encrypted by said system key.

7. The system as claimed in claim 1 , wherein the at least one data block is encrypted by an encryption key.

8. The system as claimed in claim 7 , wherein the encryption key is encrypted by a system key.

9. The system of claim 1 , wherein the pre-specified value is a sequence of zeros.

10. A method for making data secure implemented in a system for making data secure, comprising the following steps of:

providing a monotonic counter, a hardware processor, a physical data medium and an authentication key, the monotonic counter being configured to store a current value of the monotonic counter (v c );

the hardware processor writing, on said physical data medium, at least one data block;

the hardware processor retrieving the current value of the monotonic counter (v c );

the hardware processor generating a first master block comprising a value equal to the current value of the monotonic counter plus 1 (v c+1 ), an identifier of a last data block of the plurality of data blocks written on said physical data medium, a first authentication code guaranteeing an authenticity of the at least one data block written on the physical data medium, a second authentication code calculated from the last data block written on the physical data medium, said last data block written on the physical data medium being fixed at a pre-specified value, and a third authentication code guaranteeing the authenticity of the first master block, and of a second master block forming a replica of the first master block, wherein the at least one data block, the first master block and the second master block are contiguous to one another on the physical data medium;

the hardware processor incrementing the monotonic counter to equal v c+1 after the first master block has been generated; and

the hardware processor writing the first master block on the physical data medium.

11. The method as claimed in claim 10 , wherein a coherence of the system is verified when the system is started up.

12. The method as claimed in claim 11 , wherein, to verify the coherence of the system, a legality of a format of the first master block is verified and, on a condition that said first master block is verified to be unlawful, the legality of the second master block is verified in knowledge that, on a condition that the format of the second master block is verified to be lawful, the first master block is replaced by the second master block and, on a condition that the format of the second master block is verified to be unlawful, the system is deemed to be permanently corrupted.

13. The method as claimed in claim 11 , wherein, to verify the coherence of the system, the third authentication code is verified and then, on a condition that said third authentication code is successfully verified, the first authentication code is verified, in knowledge that, on a condition that the verification of the third authentication cod fails, a procedure for recovering the first master block is triggered and, if the verification of the first authentication code fails, a data recovery procedure is triggered.

14. The method as claimed in claim 10 wherein, to write new data, a legality of a format of the first master block is verified and then the third authentication code is verified.

15. The method as claimed in claim 10 wherein, to write new data, a new first master block is generated, the monotonic counter is incremented, the new first master block is written, the new second master block is written and then the new data is written.

16. The method as claimed in claim 15 , wherein, to generate the new first master block, an identifier of the last data block written on the physical data medium is updated, a current value of the monotonic counter is recovered, the current value of the monotonic counter plus 1 of the monotonic counter is noted in the new first master block, and then the first, second and third authentication codes are calculated based at least on the updated identifier of the last data block written on the physical data medium and the count value of the monotonic counter plus 1 of the monotonic counter that is noted in the new first master block.

17. The method as claimed in claim 10 , wherein, to read data, a legality of the first master block is verified and then the third authentication code is verified.

18. The method as claimed in claim 10 , further comprising a data recovery step, said data recovery step being performed automatically, without the system being rebooted.

19. The method as claimed in claim 10 further comprising a step for automatically recovering a master block.

20. The method as claimed in claim 19 , wherein, to recover a master block, a current value of the monotonic counter is recovered, and if a value of the monotonic counter indicated in the master block is equal to the current value of the monotonic counter value plus 1, the third authentication code is verified assuming that the value of the monotonic counter is equal to the current value plus 1.

21. The method as claimed in claim 20 , wherein, on a condition that verification is completed successfully, the value of the monotonic counter is incremented whereas on a condition that verification fails, the authentication code of the second master block is verified.

22. The method as claimed in claim 10 further comprising the following successive steps:

writing the second master block; and

writing the last data block.

23. The method as claimed in claim 9 wherein the computational entity performs data block MAC computations, at least one of said data blocks being encrypted.

24. The method of claim 10 , wherein the pre-specified value is a sequence of zeros.