Access control mechanism for a secure element coupled to an NFC circuit
A method for protecting a security module equipping a telecommunication device equipped with a near-field communication router, against an attempt of diversion of a communication channel between a gate of this security module and a gate of the router, wherein, for each request from the router to the security module, the module verifies the rights of access to the information that is contains according to the origin of the request.
1. A method to protect a security module of a telecommunication device equipped with a near-field communication (NFC) router against an attempt to divert a communication channel, comprising:
forming the communication channel between a gate of the security module and a gate of the NFC router;
storing in a non-volatile memory in the security module rights of access to information contained within the security module;
creating a table in the non-volatile memory, the table containing, for each request capable of being received by the NFC router, a router gate identifier and an identifier of a logic source from which the request originates;
for each request from the NFC router to the security module, verifying by said security module the rights of access to the information contained within the security module according to the origin &the request; and
rejecting an attempt to divert the communication channel based on the verifying.
2. The method of claim 1 , wherein the security module only allows a transaction if the request originates from a near-field communication.
3. The module of claim 1 , wherein the right of access is conditioned by the logical source.
4. A telecommunication device equipped with a near field communication router and with the security module of claim 1 .
5. A telecommunication device arranged to resist an attempt of diversion of a communication channel that passes secret information, comprising:
a security module having at least one gate;
a near-field communication (NFC) router having at least one gate, the at least one gate of the NFC router connectable to the at least one gate of the security module to form the communication channel that passes the secret information;
a non-volatile memory associated with the router, the non-volatile memory arranged to store rights of access to the secret information and further arranged to store a table containing, for each request capable of being received, a router gate identifier and an identifier of a logic source from which the request originates, wherein, for each request from the router to the security module, said security module is configured to verify the rights of access to the information contained within the security module according to the origin of the request and reject an attempt to divert the communication channel based on verifying the rights of access.
6. The telecommunication device of claim 5 , wherein the security module is configured to ignore a transaction when a request does not originate from an NFC terminal.
7. The telecommunication device of claim 6 , wherein ignoring the transaction includes transmitting an error message.
8. The telecommunication device of claim 5 , wherein the stored table is configured to store information representing an NFC reader, an emulation device, and a terminal host.
9. A method to protect a security module of a mobile device having a near-field communication (NFC) router integrated therein, comprising:
providing an input structure to the NFC router configured to receive requests for access to the security module;
providing, in a non-volatile memory associated with the NFC router, rights of access information associated with each request for access to the security module that is capable of being received, the rights of access information identifying valid requestors to information contained within the security module, the rights of access information including a router gate identifier and an identifier of a logic source from which the request originates;
receiving, at the NFC router, a request from a logic source attempting to divert a communication channel between a gate of the security module and a gate of the router;
retrieving, from the non-volatile memory associated with the NFC router, the rights of access information associated with the logic source attempting to divert the communication channel;
verifying, based on the retrieved rights of access information, whether the attempted diversion is permitted; and
allowing or preventing the diversion based on the verifying.
10. The method of claim 9 , wherein the rights of access information is retrievable according to an origin of the request to divert the communication channel.
11. The method of claim 9 , wherein the security module only allows a transaction if the request originates via a near-field communication.
12. The method of claim 9 , wherein the security module only allows a transaction if the request originates from an NFC terminal.
13. The method of claim 9 , comprising:
ignoring, by the security module, a transaction when a request does not originate from an NFC terminal.
14. The method of claim 13 , comprising:
transmitting an error message when a request not originating from an NFC terminal is received.
15. The method of claim 9 , wherein the rights of access information includes information representing an NFC reader, an emulation device, and a terminal host.
16. The method of claim 9 , wherein the rights of access information is stored in a table in the non-volatile memory of the security module.