Category Archives: EviCore NFC HSM Technology

image_pdfimage_print
Articles, Digital Security, EviCore NFC HSM Technology, EviPass NFC HSM technology, NFC HSM technology

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures

Posted on by FMTAD
TETRA Security Vulnerabilities secured by EviPass or EviCypher NFC HSM Technologies from Freemindtronic-Andorra
27
Nov
TETRA Security Vulnerabilities by Jacques Gascuel: This article will be updated with any new information on the topic.

TETRA Security Vulnerabilities

Tetra is a radio communication standard used by critical sectors worldwide. But it has five security flaws that could expose its encryption and authentication. How can you protect your Tetra system from hackers? Read this article TETRA Security Vulnerabilities to find out the best practices and tips.

Shadowy hacker with a laptop in front of a digital map of Russia highlighted in red, symbolizing the origin of Kapeka Malware.

2024 Digital Security

Kapeka Malware: Comprehensive Analysis of the Russian Cyber Espionage Tool
April 18, 2024
A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense
April 15, 2024
Illustration of an Apple MacBook with a highlighted M-series chip vulnerability, surrounded by symbols of data security breach and a global impact background.

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security
March 25, 2024
Digital world map with cybersecurity icons representing the Cybersecurity Breach at IMF.

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation
March 15, 2024
Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?
March 10, 2024
PrintListener technology concept with NFC security solutions.

2024 Digital Security

PrintListener: How to Betray Fingerprints
February 22, 2024
A visual representation of BitLocker Security featuring a central lock icon surrounded by elements representing Microsoft, TPM, and Windows security settings.

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks
February 10, 2024
Digital shield by Freemindtronic repelling cyberattack against Microsoft Exchange

2024 Articles Digital Security News

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts
February 8, 2024

TETRA Security Vulnerabilities: How to Protect Critical Infrastructures from Cyberattacks

TETRA (Terrestrial Trunked Radio) is a radio technology that is used worldwide for critical communications and data, especially in the sectors of security, energy, transport and defense. But this technology, which has been kept secret for more than 25 years, hides serious security vulnerabilities, including a backdoor that could allow devastating cyberattacks.

What is TETRA?

TETRA is a European radio standard that was developed in the 1990s to meet the needs of professional mobile services, such as police, firefighters, emergency services, military, prison staff, etc. TETRA allows to transmit data and voice encrypted on frequencies ranging from 380 to 470 MHz, with a range of several kilometers.

TETRA is used by more than 2000 networks in more than 150 countries, according to the TETRA and Critical Communications Association (TCCA), which brings together the manufacturers, operators and users of this technology. Among the main manufacturers of TETRA radios, we find Motorola Solutions, Hytera, Airbus, Sepura and Rohill.

TETRA offers several advantages over other radio technologies, such as:

  • better sound quality
  • greater transmission capacity
  • greater security thanks to encryption
  • greater flexibility thanks to the possibility of creating communication groups
  • greater interoperability thanks to the compatibility of equipment

Source french: TETRA digital mode & F4HXZ – Blog radioamateur

What are the vulnerabilities of TETRA?

Despite its strengths, TETRA also has weaknesses, which have been revealed by a group of Dutch researchers from Radboud University Nijmegen. These researchers conducted a thorough analysis of the TETRA standard and its encryption algorithms, which were until then kept secret by the manufacturers and authorities.

The researchers discovered two types of major vulnerabilities in TETRA:

  • A backdoor in the encryption algorithm TEA1, which is used in radios sold for sensitive equipment, such as pipelines, railways, power grid, public transport or freight trains. This backdoor allows an attacker to decrypt the communications and data transmitted by these radios, and possibly to modify or block them. The backdoor exists since the creation of the algorithm TEA1, in 1998, and cannot be corrected by a simple software update. The researchers managed to extract the secret key of the backdoor by analyzing the binary code of the radios.
  • A weakness in the encryption algorithm TEA2, which is used in radios intended for professional mobile services, such as police, firefighters, emergency services, military or prison staff. This weakness allows an attacker to reduce the number of possible keys to test to decrypt the communications and data transmitted by these radios. The researchers estimated that it would take about 10 minutes to find the right key with a standard computer. This weakness was corrected by the manufacturers in 2016, but the radios that have not been updated remain vulnerable.

To find the backdoor in the TEA1 algorithm, the researchers used a technique called “differential analysis”, which consists of comparing the outputs of the algorithm for slightly different inputs. By observing the differences, they were able to identify a part of the code that was not normally used, but that was activated by a special condition. This condition was the presence of a secret key of 64 bits, which was hidden in the binary code of the radios. By analyzing the code, they were able to extract the secret key and test it on encrypted communications with the TEA1 algorithm. They were thus able to confirm that the secret key allowed to decrypt the communications without knowing the normal key of 80 bits. The researchers published their official report and the source code of the TETRA encryption algorithms on their website.

Source: https://cs.ru.nl/~cmeijer/publications/All_cops_are_broadcasting_TETRA_under_scrutiny.pdf

What are the risks for critical infrastructures?

The vulnerabilities identified in TETRA represent a danger for the critical infrastructures that use this technology, because they could be exploited by cybercriminals, terrorists or spies to disrupt or damage these infrastructures.

For example, an attacker could:

  • listen to the communications and confidential data of the security or defense services
  • impersonate an operator or a manager to give false instructions or orders
  • modify or erase data or commands that control vital equipment, such as valves, switches, signals or brakes
  • cause failures, accidents, fires or explosions

These scenarios could have dramatic consequences on the security, health, economy or environment of the countries concerned.

How to protect yourself from cyberattacks on TETRA?

The users of TETRA must be aware of the vulnerabilities of this technology and take measures to protect themselves from potential cyberattacks. Among the recommendations of the researchers, we can mention:

  • check if the radios used are affected by the vulnerabilities and ask the manufacturers for correction solutions
  • avoid using the algorithm TEA1, which contains the backdoor, and prefer safer algorithms, such as TEA3 or TEA4
  • use encryption keys that are long and complex enough, and change them regularly
  • set up verification and authentication procedures for communications and data
  • monitor the radio traffic and detect anomalies or intrusion attempts
  • raise awareness and train staff on cybersecurity and good practices

TETRA digital mode: how to transfer data via TETRA

TETRA (Terrestrial Trunked Radio) is a digital and secure radio communication standard used by emergency services, law enforcement, public transport and industries. TETRA uses a π/4-DQPSK phase modulation and a TDMA time division multiplexing to transmit voice and data on a bandwidth of 25 KHz per transmission channel. Each channel is divided into four timeslots, one of which is reserved for signaling in trunked mode (TMO).

TETRA allows file transfer via radio in two ways: by the packet data service (PDS) or by the circuit data service (CDS).

The PDS uses the IP protocol to transmit data packets on one or more timeslots. It offers a maximum throughput of 28.8 kbit/s per timeslot, or 86.4 kbit/s for three timeslots. The PDS can be used to send small files, such as images, text messages or forms.

The CDS uses the LAPD protocol to transmit data by circuit on a dedicated timeslot. It offers a constant throughput of 4.8 kbit/s per timeslot, or 19.2 kbit/s for four timeslots. The CDS can be used to send large files, such as documents, videos or maps.

The choice of the data service depends on the type of file, the size of the file, the quality of the radio link, the cost and the availability of radio resources. The PDS offers more flexibility and performance, but it requires a good signal quality and it can be more expensive in terms of battery consumption and spectrum occupation. The CDS offers more reliability and simplicity, but it requires a prior allocation of a timeslot and it can be slower and less efficient.

Securing TETRA file transfers with Freemindtronic’s EviCypher technology

However, both data services are subject to the TETRA security vulnerabilities that we have discussed in the previous sections. These vulnerabilities could allow an attacker to intercept, modify or corrupt the files transferred via TETRA, or to prevent their transmission altogether. Therefore, the users of TETRA must ensure the integrity and the confidentiality of the files they send or receive, by using encryption, verification and authentication methods. Freemindtronic’s EviCypher technology can be a valuable solution for encrypting data with post-quantum AES-256 from an NFC HSM with your own randomly generated keys before transferring them via TETRA. This way, even if an attacker corrupts the data transmitted by TETRA, they will not be able to decrypt the data encrypted by a product embedding

How to secure file transfers via TETRA with Freemindtronic’s EviCypher technology

La technologie EviCypher de Freemindtronic peut être une solution précieuse pour chiffrer les données avec AES-256 post-quantique à partir d’un HSM NFC avec vos propres clés générées aléatoirement avant de les transférer via TETRA. Ainsi, même si un attaquant corrompt les données transmises par TETRA, il ne pourra pas décrypter les données cryptées par un produit embarquant la technologie EviCypher NFC HSM technology, such as DataShielder NFC HSM or DataSielder Defense NFC HSM. These products are portable and autonomous devices that allow you to secure the access to computer systems, applications or online services, using the NFC as a means of authentication and encryption.

The management of encryption keys for TETRA

To use encryption on the TETRA network, you need an encryption key, which is a secret code of 80 bits, or 10 bytes. This key must be shared between the radios that want to communicate securely, and must be protected against theft, loss or compromise.

There are several methods to save and enter encryption keys for TETRA, depending on the type of radio and the level of security required. Here are some examples:

  • The manual method: it consists of entering the encryption key using the keyboard of the radio, by typing the 10 bytes in hexadecimal form. This method is simple, but impractical and unsafe, because it requires to know the key by heart or to write it down on a support, which increases the risk of disclosure or error. For example, a 80-bit key could be 3A4F9C7B12E8D6F0.
  • The automatic method: it consists of using an external device, such as a computer or a smart card, which generates and transfers the encryption key to the radio by a cable or a wireless link. This method is faster and more reliable, but it requires to have a compatible and secure device, and to connect it to the radio at each key change.
  • The EviPass method: it consists of using the EviPass NFC HSM technology which allows to generate, store and manage keys and secrets in a secure and independent NFC HSM device. This method is the most innovative and secure, because it allows to create keys higher than 80 bits randomly in hexadecimal base 16, 58, 64 or 85, to store them in a physical device protected by an access code and a robust AES-256 post-quantum encryption algorithm, and to transfer them by various contactless means, via a computer. This method does not require to know or write down the key, which reduces the risk of disclosure or error. For example, a 10-byte key of 80 bits could be 3F 8A 6B 4C 9D 1E 7F 2A 5B 0C.

The EviPass NFC HSM technology of Freemindtronic allows to create secure gateways between the NFC devices and the computer systems, using advanced encryption protocols, such as AES, RSA or ECC. The EviPass NFC HSM technology is embedded in the PassCyber NFC HSM product, which is a portable and autonomous device that allows to secure the access to computer systems, applications or online or offligne services, using the NFC as a means of authentication.

Conclusion

TETRA is a radio technology that was designed to offer secure and reliable communication to professional mobile services and critical infrastructures. But this technology, which has been kept secret for decades, presents vulnerabilities that could be exploited by cyberattackers to compromise these communications and infrastructures. The users of TETRA must be vigilant and take measures to protect themselves from these threats, by updating their equipment, choosing robust encryption algorithms, using strong keys, verifying and authenticating data and monitoring radio traffic. The EviPass NFC HSM technology of Freemindtronic can be an effective solution to strengthen the security of keys and secrets used for verification and authentication, by storing them in a secure and independent NFC device. The researchers who revealed the vulnerabilities of TETRA hope that their work will contribute to improve the security of communications in critical domains.

2023, Articles, DataShielder, Digital Security, EviCore NFC HSM Technology, EviCypher NFC HSM, EviCypher Technology, NFC HSM technology

FormBook Malware: How to Protect Your Gmail and Other Data

Posted on by FMTAD
FormBook Malware: how to protect your gmail and other data
23
Nov
Protect your Gmail Account FormBook malware – Jacques Gascuel: This article will be updated with any new information on the topic.

Secure Your Gmail from FormBook Attacks

FormBook is a malware that can steal your Gmail credentials, messages, and attachments. Learn how to use the Freemindtronic devices to encrypt your Gmail data and use passwordless and 2FA.

Shadowy hacker with a laptop in front of a digital map of Russia highlighted in red, symbolizing the origin of Kapeka Malware.

2024 Digital Security

Kapeka Malware: Comprehensive Analysis of the Russian Cyber Espionage Tool
April 18, 2024
A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense
April 15, 2024
Illustration of an Apple MacBook with a highlighted M-series chip vulnerability, surrounded by symbols of data security breach and a global impact background.

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security
March 25, 2024
Digital world map with cybersecurity icons representing the Cybersecurity Breach at IMF.

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation
March 15, 2024
Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?
March 10, 2024
PrintListener technology concept with NFC security solutions.

2024 Digital Security

PrintListener: How to Betray Fingerprints
February 22, 2024
A visual representation of BitLocker Security featuring a central lock icon surrounded by elements representing Microsoft, TPM, and Windows security settings.

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks
February 10, 2024
Digital shield by Freemindtronic repelling cyberattack against Microsoft Exchange

2024 Articles Digital Security News

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts
February 8, 2024

How to Protect Your Gmail Account from FormBook Malware

Introduction

Imagine that you receive an email from your bank, asking you to confirm your identity by clicking on a link. You open the link, and you find yourself on a page that looks like your bank’s website, but it is actually a fake. You enter your credentials, and you think you are done. But in reality, you have just given access to your bank account to hackers, who will use it to steal your money, or worse. This is what FormBook can do, a malware that can steal your sensitive data, and that Google cannot stop. In this article, we will explain what FormBook is, how it works, and how to protect yourself from this malware.

What is FormBook and why is it a threat?

FormBook is a malware that can record your keystrokes, take screenshots, and steal your passwords, cookies, and clipboard data. It can also download and execute other malicious files on your device.

FormBook is distributed through phishing emails that contain malicious attachments. These attachments are usually disguised as invoices, receipts, or shipping confirmations. When you open them, they ask you to enable macros or content. If you do, the malware will be installed on your device.

FormBook can target any web browser, but it has a special feature for Chrome. It can inject a fake Gmail login page into your browser, and trick you into entering your credentials. The malware will then send your Gmail username and password to a remote server controlled by the hackers.

FormBook is a threat because it can compromise your Gmail account and access your personal and professional information. It can also use your Gmail account to send spam or phishing emails to your contacts, or to access other online services that are linked to your Gmail account, such as Google Drive, Google Photos, or Google Pay.

How to protect yourself from FormBook?

Google has not yet found a way to detect and block FormBook. Therefore, you need to be extra careful when you use Gmail and other online services. Here are some tips to protect yourself from FormBook and other malware:

  • Do not open or download attachments from unknown or suspicious senders. If you are not sure about the legitimacy of an email, contact the sender directly or check the official website of the company or organization.
  • Do not enable macros or content in any document unless you trust the source. Macros are small programs that can run malicious code on your device.
  • Use a strong and unique password for your Gmail account and other online accounts. Do not reuse the same password for different services. Change your password regularly and use a password manager to store and generate your passwords.
  • Enable two-factor authentication (2FA) for your Gmail account and other online accounts. 2FA adds an extra layer of security by requiring a code or a device confirmation in addition to your password.
  • Use a reputable antivirus software and keep it updated. Antivirus software can scan your device for malware and remove it. You can also use a browser extension that can block malicious websites and pop-ups.

How to encrypt your Gmail messages and attachments with DataShielder NFC HSM

DataShielder NFC HSM is a device that allows you to encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021.

With DataShielder NFC HSM, you can encrypt and decrypt your data with AES-256 keys that are randomly generated and stored in the NFC HSM. You can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM. You can also use different keys for the message and the attachment.

To encrypt your Gmail message and attachment, you need to use the EviCrypt and EviFile applications that are embedded in the DataShielder NFC HSM. These applications allow you to encrypt and decrypt your data with a simple tap of your NFC phone on the DataShielder NFC HSM. You can also share your encrypted data with other users who have the same device and the same key.

By using DataShielder NFC HSM, you can protect your Gmail messages and attachments from FormBook or any other malware that can access your Gmail account. Even if your Gmail account is hacked, your encrypted data will remain encrypted and unreadable by the hackers. Only you and the authorized recipients can decrypt your data with the DataShielder NFC HSM.

How to protect your web Gmail account with passwordless and 2FA using PassCypher NFC HSM

Do you want to manage your web accounts with complicated and complex passwords that you do not need to know, remember, or type? If yes, then you should try PassCypher NFC HSM. This device uses the EviPass NFC HSM technology, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021.

With PassCypher NFC HSM, you can create and store your usernames and passwords of more than 256-bit in the NFC HSM. Moreover, you can store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

To use PassCypher NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass and EviOTP applications that are embedded in the PassCypher NFC HSM. These applications allow you to create, edit, and delete your web accounts and OTP secret keys with a simple tap of your NFC phone on the PassCypher NFC HSM.

By using PassCypher NFC HSM, you can secure your web accounts with passwordless and 2FA. You do not need to display, know, or type your username and password. You just need to tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your web account. You also do not need to check for a typosquatting attack, since the extension will verify the URL of the website before logging in. And you do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

How to protect your Gmail account from FormBook with PassCypher NFC HSM

FormBook is a dangerous malware that can access your Gmail account and other sensitive data. Google has not yet found a solution to stop it. Therefore, you need to be vigilant and follow the best practices to protect yourself from cyberattacks. One of them is to use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA.

By using PassCypher NFC HSM, you can protect your Gmail account from FormBook or any other malware that can access your web browser. Even if your web browser is hacked, your usernames and passwords will remain encrypted and inaccessible by the hackers. Only you can decrypt your Gmail account with the PassCypher NFC HSM. And even if the hackers manage to steal your session cookies, they will not be able to log in to your Gmail account without the 2FA code that is generated by the PassCypher NFC HSM.

To use PassCypher NFC HSM with your Gmail account, you need to follow these steps:

  • Create a Gmail account in the EviPass application on the PassCypher NFC HSM. You can use the default username and password, or you can generate a random and complex password with the EviPass application.
  • Enable 2FA for your Gmail account on the Google website.
  • Choose the option to use an authenticator app, and scan the QR code with the EviOTP application on the PassCypher NFC HSM. This will store your OTP secret key in the NFC HSM.
  • Log in to your Gmail account with the Freemindtronic extension on your web browser. Tap your NFC phone on the PassCypher NFC HSM and the extension will autofill and auto login your Gmail account. You will also see a pop-up window with the 2FA code that you need to enter on the Google website.

By following these steps, you can use PassCypher NFC HSM to secure your Gmail account with passwordless and 2FA. You can also use PassCypher NFC HSM with other web accounts that support 2FA, such as Facebook, Twitter, or Amazon. This way, you can protect yourself from FormBook and other malware that can access your web browser.

Recent statistics on FormBook

FormBook is a malware that was first discovered in 2016, but it remains very active and dangerous. According to the Check Point report on cybersecurity in 2022, FormBook was the third most widespread malware in 2021, attacking 5% of enterprise networks. It was also the most prolific infostealer malware, accounting for 16% of attacks worldwide.

FormBook spreads mainly through phishing emails that contain malicious attachments. These attachments are often RAR self-extracting archives, which are compressed files that can run malicious code when opened. The RAR files contain a legitimate document, such as a PDF or a Word file, and a hidden executable file, which is the FormBook malware. When the user opens the RAR file, the document is displayed, but the malware is also installed in the background.

FormBook can also spread through other methods, such as drive-by downloads, malicious links, or removable media. The malware can infect any Windows device, from Windows XP to Windows 10. The malware can also evade detection and removal by using various techniques, such as encryption, obfuscation, or anti-analysis.

Here are some recent statistics on FormBook, based on the data from Check Point and ANY.RUN:

  • FormBook was the most popular malware in August 2021, affecting 4.5% of organizations worldwide, followed by Trickbot and Agent Tesla, affecting respectively 4% and 3% of organizations worldwide.
  • FormBook was the fourth most common malware in 2020, according to the ranking of malware families by ANY.RUN. It accounted for 8% of the samples analyzed by the online sandboxing service.
  • FormBook was used in many phishing campaigns targeting various industries, such as defense, aerospace, health, education, finance, retail, etc. It was also used to attack Ukrainian targets during the war between Russia and Ukraine in 2022.
  • FormBook has a successor called XLoader, which appeared in 2020 and which is able to infect macOS users. XLoader is sold on the dark web for $59 for a Windows license and $49 for a macOS license.

Danger level of FormBook compared to other malware

FormBook is a very dangerous malware, because it can steal sensitive information, such as credentials, passwords, credit card numbers, 2FA codes, etc. It can also download and execute other malware, such as ransomware, banking trojans, spyware, etc. It can also remotely control the infected device and perform various malicious actions, such as deleting browser cookies, taking screenshots, restarting or shutting down the system, etc.

FormBook is also hard to detect and remove, because it uses advanced evasion techniques, such as code injection, string obfuscation, data encryption, anti-analysis, etc. It also changes frequently its name, path, and file extension, and uses random Windows registry keys to maintain its persistence.

To compare the danger level of FormBook with other known malware in its category, we can use the following criteria:

  • The number of organizations affected worldwide
  • The type and amount of information stolen
  • The ability to download and execute other malware
  • The ability to remotely control the infected device
  • The evasion techniques used
  • The ease of detection and removal

Here is a table that compares FormBook with other popular infostealer malware, such as Trickbot, Agent Tesla, LokiBot, and Raccoon:

MalwareNumber of organizations affectedType and amount of information stolenAbility to download and execute other malwareAbility to remotely control the infected deviceEvasion techniques usedEase of detection and removal
FormBook4.5% in August 2021Credentials, passwords, credit card numbers, 2FA codes, screenshots, keystrokes, etc.YesYesCode injection, string obfuscation, data encryption, anti-analysis, etc.Hard
Trickbot4% in August 2021Credentials, passwords, banking information, personal data, etc.YesYesCode injection, string obfuscation, data encryption, anti-analysis, etc.Hard
Agent Tesla3% in August 2021Credentials, passwords, banking information, personal data, screenshots, keystrokes, etc.NoYesString obfuscation, data encryption, anti-analysis, etc.Medium
LokiBot1.5% in August 2021Credentials, passwords, banking information, personal data, etc.NoYesString obfuscation, data encryption, anti-analysis, etc.Medium
Raccoon0.8% in August 2021Credentials, passwords, banking information, personal data, etc.NoYesString obfuscation, data encryption, anti-analysis, etc.Medium

From this table, we can see that FormBook is the most dangerous infostealer malware, because it affects the most organizations, steals the most types of information, and can download and execute other malware. It is also the hardest to detect and remove, because it uses more evasion techniques than the other malware.

Forms of attacks of FormBook

FormBook can be delivered through different forms of attacks, depending on the delivery mechanism chosen by the malicious actor. Here are some forms of attacks of FormBook:

  • Phishing: FormBook can be sent by email as a malicious attachment, such as a Word, Excel, PDF, or ZIP or RAR file. The email can have a misleading subject, such as an invoice, a receipt, a contract, a job offer, etc. When the user opens the attachment, the malware runs and infects the device.
  • Exploitation of vulnerabilities: FormBook can exploit vulnerabilities in popular software, such as Microsoft Office, Windows, Adobe Reader, etc. For example, FormBook used the vulnerability CVE-2017-8570 in Microsoft Office to run malicious code from a RTF file. FormBook also used the vulnerability CVE-2021-40444 in Microsoft MSHTML to run malicious code from a CAB file.
  • Drive-by downloads: FormBook can be downloaded without the user’s knowledge when they visit a compromised or malicious website. The website can use a script or an exploit kit to trigger the download and execution of the malware on the user’s device.
  • Removable media: FormBook can be copied to removable media, such as USB drives, external hard drives, memory cards, etc. When the user connects the removable media to their device, the malware runs automatically and infects the device.
  • Social media: FormBook can be spread by messages or posts on social media, such as Facebook, Twitter, Instagram, etc. These messages or posts can contain links or images that redirect to malicious websites or infected files. When the user clicks on the link or image, the malware is downloaded and executed on their device.

Here is a type of formbook malware attacks image:

Type of Formbook MalwareAttacks

How PassCypher NFC HSM and DataShielder NFC HSM can protect you from FormBook attacks

PassCypher NFC HSM and DataShielder NFC HSM are two devices that use the EviPass NFC HSM technology from Freemindtronic, which is a contactless hardware password manager that won the Silver Medal for International Inventions in Geneva on March 2021. These devices can help you protect your web accounts and your Gmail messages and attachments from FormBook attacks, by using passwordless, 2FA, and encryption.

PassCypher NFC HSM can create and store your usernames and passwords of more than 256-bit in the NFC HSM. It can also store your OTP TOTP or HOTP secret keys in the NFC HSM to generate the 2FA code for your web accounts. The NFC HSM can store up to 100 web accounts and one pair of RSA-4096 keys.

DataShielder NFC HSM can encrypt and decrypt your Gmail messages and attachments with your own encryption keys that you create and store offline. It uses the EviCypher NFC HSM technology, which is a contactless hardware security module (NFC HSM) that won the Gold Medal for International Inventions in Geneva on March 2021. It can store up to 100 keys and one pair of RSA-4096 keys in the NFC HSM.

To use PassCypher NFC HSM and DataShielder NFC HSM, you need to install the Freemindtronic extension for your web browser based on Chromium or Firefox. This extension uses the EviCore NFC HSM Browser technology, which allows you to communicate with the NFC HSM via your NFC phone. You also need to use the EviPass, EviOTP, EviCrypt, and EviFile applications that are embedded in the PassCypher NFC HSM and DataShielder NFC HSM. These applications allow you to create, edit, delete, encrypt, and decrypt your web accounts, OTP secret keys, messages, and attachments with a simple tap of your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM.

By using PassCypher NFC HSM and DataShielder NFC HSM, you can secure your web accounts and your Gmail messages and attachments with passwordless, 2FA, and encryption. You do not need to display, know, or type your username, password, or encryption key. You just need to tap your NFC phone on the PassCypher NFC HSM or DataShielder NFC HSM and the extension will autofill, auto login, encrypt, or decrypt your web account, message, or attachment. You also do not need to use another device or application to generate the 2FA code, since the PassCypher NFC HSM will do it for you.

Here is a table that shows how PassCypher NFC HSM and DataShielder NFC HSM can protect you from different FormBook attack vectors, such as keylogger, password stealer, file transfer, screenshot, etc. I used a check mark or a cross mark to show visually what PassCypher NFC HSM and DataShielder NFC HSM protect.

 

FormBookPassCypherDataShielder
Keylogger✔️✔️
Password stealer✔️✔️
File transfer❌✔️
Screenshot✔️✔️
Remote control❌❌
Phishing✔️✔️
Exploit kit❌❌
Drive-by download❌❌
Removable media❌✔️
Social media❌❌

This table shows that PassCypher NFC HSM and DataShielder NFC HSM can protect your web accounts from FormBook’s keylogger, password stealer, and phishing, by using passwordless and 2FA. They can also protect your Gmail messages and attachments from FormBook’s file transfer and screenshot, by using encryption and decryption. DataShielder NFC HSM can also protect your data stored in computers or removable media, by using encryption and decryption. However, neither device can protect your device from FormBook’s remote control, exploit kit, drive-by download, or unsecured social media, which can compromise your system and your data. Therefore, you should also use an antivirus software and a firewall to prevent FormBook from accessing your device.

Articles, EviCore NFC HSM Technology, legal, News, Training

Dual-Use Encryption Products: a regulated trade for security and human rights

Posted on by FMTAD
Dual-Use encryption products a regulated trade for security and human rights by Freemindtronic-from Andorra
17
Nov
Dual-use encryption products by Jacques Gascuel: This article will be updated with any new information on the topic.

Dual-use encryption products: a challenge for security and human rights

Encryption is a technique that protects data and communications. Encryption products are dual-use goods, which can have civilian and military uses. The export of these products is controlled by the EU and the international community, to prevent their misuse or diversion. This article explains the EU regime for the export of dual-use encryption products, and how it has been updated.

A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense
April 15, 2024
EU military defense of cryptocurrency

2024 Crypto Currency Cryptocurrency Cyberculture Legal information

EU Sanctions Cryptocurrency Regulation: A Comprehensive Overview
March 15, 2024

2024 Cyberculture Uncategorized

Chinese cyber espionage: a data leak reveals the secrets of their hackers
March 2, 2024
European Commission logo symbolizing the Cyber Resilience Act and NFC HSM technology.

2024 Cyberculture

Cyber Resilience Act: a European regulation to strengthen the cybersecurity of digital products
February 24, 2024
ECHR landmark ruling in favor of encrypted messaging, featuring EviCypher NFC HSM technology by Freemindtronic.

2024 Cyberculture Legal information

Encrypted messaging: ECHR says no to states that want to spy on them
February 21, 2024
Digital image showing a confused user at a computer surrounded by complex password symbols

2024 Articles Cyberculture EviPass Password

Human Limitations in Strong Passwords Creation
January 22, 2024
Telegram and the information war in Ukraine

2023 Articles Cyberculture EviCypher NFC HSM News Technologies

Telegram and the Information War in Ukraine
January 5, 2024
The American Intelligence How It Works : Section 702

2023 Articles CyberStealth legal Legal information News Spying

The American Intelligence: How It Works
December 26, 2023

The international regulations on dual-use encryption products

The main international regulations that apply to dual-use encryption products are the Wassenaar Arrangement and the EU regime for the control of exports of dual-use goods.

The Wassenaar Arrangement

The Wassenaar Arrangement is a multilateral export control regime that aims to contribute to regional and international security and stability. It promotes transparency and responsibility in the transfers of conventional arms and dual-use goods and technologies. It was established in 1996 and currently has 42 participating states, including the United States, Canada, Japan, Australia, Russia, China and most of the EU member states.

The Wassenaar Arrangement maintains a list of dual-use goods and technologies that are subject to export control by the participating states. The list is divided into 10 categories, with subcategories and items. Category 5, part 2, covers information security, including encryption products. The list of encryption products includes, among others, the following items:

  • Cryptographic systems, equipment, components and software, using symmetric or asymmetric algorithms, with a key length exceeding 56 bits for symmetric algorithms or 512 bits for asymmetric algorithms, or specially designed for military or intelligence use.
  • Cryptanalytic systems, equipment, components and software, capable of recovering the plain text from the encrypted text, or of finding cryptographic keys or algorithms.
  • Cryptographic development systems, equipment, components and software, capable of generating, testing, modifying or evaluating cryptographic algorithms, keys or systems.
  • Non-cryptographic information security systems, equipment, components and software, using techniques such as steganography, watermarking, tamper resistance or authentication.
  • Technology for the development, production or use of the above items.

The participating states of the Wassenaar Arrangement are required to implement national export controls on the items listed in the arrangement, and to report annually their exports and denials of such items. However, the arrangement does not impose binding obligations on the participating states, and each state is free to decide whether to grant or refuse an export license, based on its own policies and national interests.

The EU regime for the control of exports of dual-use goods

The common legal framework of the EU for dual-use goods

The EU regime for the control of exports of dual-use goods is a common legal framework. It applies to all EU member states, and it has two main goals. First, it aims to ensure a consistent and effective implementation of the international obligations of export control. Second, it aims to protect the security and human rights of the EU and its partners. The regime is based on the Regulation (EU) 2021/821, which was adopted in May 2021 and entered into force in September 2021. This regulation replaces the previous Regulation (EC) No 428/2009.

The Regulation (EU) 2021/821: the principles and criteria of export control

The Regulation (EU) 2021/821 establishes a Union list of dual-use goods. These are goods that can have both civilian and military uses, such as software, equipment and technology. These goods are subject to an export authorization, which means that exporters need to obtain a permission from the competent authorities before exporting them. The Regulation also sets out a set of general principles and criteria for granting or refusing such authorization. The Union list of dual-use goods is based on the international export control regimes, including the Wassenaar Arrangement. It covers the same categories and items as the latter. However, the EU list also includes some additional items that are not covered by the international regimes. These are cyber-surveillance items that can be used for internal repression or human rights violations.

The Union list of dual-use goods: the categories and items subject to an export authorization

The Union list of dual-use goods consists of ten categories, which are:

  • Category 0: Nuclear materials, facilities and equipment
  • Category 1: Materials, chemicals, micro-organisms and toxins
  • Category 2: Materials processing
  • Category 3: Electronics
  • Category 4: Computers
  • Category 5: Telecommunications and information security
  • Category 6: Sensors and lasers
  • Category 7: Navigation and avionics
  • Category 8: Marine
  • Category 9: Aerospace and propulsion

Each category contains a number of items, which are identified by a code and a description. For example, the item 5A002 is “Information security systems, equipment and components”. The items are further divided into sub-items, which are identified by a letter and a number. For example, the sub-item 5A002.a.1 is “Cryptographic activation equipment or software designed or modified to activate cryptographic capability”.

The novelties of the Regulation (EU) 2021/821: the due diligence obligation, the catch-all clause, the human security approach and the transparency and information exchange mechanism

The Regulation (EU) 2021/821 also provides for different types of export authorizations. These are individual, global, general or ad hoc authorizations, depending on the nature, destination and end-use of the items. Moreover, the Regulation introduces some novelties, such as:

  • A due diligence obligation for exporters. This means that exporters have to verify the end-use and the end-user of the items, and to report any suspicious or irregular transaction.
  • A catch-all clause. This allows the competent authorities to impose an export authorization on items that are not listed, but that can be used for weapons of mass destruction, a military end-use, human rights violations or terrorism.
  • A human security approach. This requires the competent authorities to take into account the potential impact of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.
  • A transparency and information exchange mechanism. This requires the competent authorities to share information on the authorizations, denials and consultations of export, and to publish annual reports on their export control activities.

The dual-use encryption products: sensitive goods for security and human rights

The dual-use encryption products are a specific type of dual-use goods that fall under the category 5 of the Union list. These are products that use cryptographic techniques to protect the confidentiality, integrity and authenticity of data and communications. These products can have both civilian and military uses, and they raise important issues for security and human rights.

The dual-use encryption products: a definition and examples

The dual-use encryption products are defined by the Regulation (EU) 2021/821 as “information security systems, equipment and components, and ‘software’ and ‘technology’ therefor, which use ‘cryptography’ or cryptanalytic functions”. The Regulation also provides a list of examples of such products, such as:

  • Cryptographic activation equipment or software
  • Cryptographic equipment for mobile cellular systems
  • Cryptographic equipment for radio communication systems
  • Cryptographic equipment for computer and network security
  • Cryptanalytic equipment and software
  • Quantum cryptography equipment and software

The dual-use encryption products: security issues

The dual-use encryption products can have a significant impact on the security of the EU and its partners. On the one hand, these products can enhance the security of the EU and its allies, by protecting their sensitive data and communications from unauthorized access, interception or manipulation. On the other hand, these products can also pose a threat to the security of the EU and its adversaries, by enabling the encryption of malicious or illegal activities, such as terrorism, espionage or cyberattacks. Therefore, the export of these products needs to be carefully controlled, to prevent their misuse or diversion to undesirable end-users or end-uses.

The dual-use encryption products: human rights issues

The dual-use encryption products can also have a significant impact on the human rights of the EU and its partners. On the one hand, these products can protect the human rights of the EU and its citizens, by safeguarding their privacy and freedom of expression on the internet. On the other hand, these products can also violate the human rights of the EU and its partners, by enabling the repression or surveillance of dissidents, activists or journalists by authoritarian regimes or non-state actors. Therefore, the export of these products needs to take into account the potential consequences of the items on human rights, international humanitarian law, regional stability and sustainable development, especially for cyber-surveillance items.

The modification of the Union list of dual-use goods by the Delegated Regulation (EU) 2022/1

The Union list of dual-use goods is not static, but dynamic. It is regularly updated to reflect the changes in the technological development and the international security environment. The latest update of the list was made by the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the Regulation (EU) 2021/821.

The changes made by the international export control regimes in 2020 and 2021

The Delegated Regulation (EU) 2022/1 reflects the changes made by the international export control regimes in 2020 and 2021. These are the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group and the Missile Technology Control Regime. These regimes are voluntary and informal arrangements of states that coordinate their national export control policies on dual-use goods. The EU is a member of these regimes, and it aligns its Union list of dual-use goods with their lists of controlled items. The changes made by these regimes include the addition, deletion or modification of some items, as well as the clarification or simplification of some definitions or technical parameters.

The new items added to the Union list of dual-use goods: the quantum technologies, the drones and the facial recognition systems or biometric identification systems

The Delegated Regulation (EU) 2022/1 also adds some new items to the Union list of dual-use goods. These are items that are not covered by the international export control regimes, but that are considered to be sensitive for the security and human rights of the EU and its partners. These items include:

  • Certain types of software and technology for the development, production or use of quantum computers or quantum cryptography. These are devices or techniques that use the principles of quantum physics to perform computations or communications that are faster or more secure than conventional methods.
  • Certain types of equipment, software and technology for the development, production or use of unmanned aerial vehicles (UAVs) or drones. These are aircraft or systems that can fly without a human pilot on board, and that can be used for various purposes, such as surveillance, reconnaissance, delivery or attack.
  • Certain types of equipment, software and technology for the development, production or use of facial recognition systems or biometric identification systems. These are systems or techniques that can identify or verify the identity of a person based on their facial features or other biological characteristics, such as fingerprints, iris or voice.

The entry into force and application of the Delegated Regulation (EU) 2022/1

The Delegated Regulation (EU) 2022/1 entered into force on 7 January 2022. It applies to all exports of dual-use goods from the EU from that date. The exporters of dual-use goods need to be aware of the changes and updates to the Union list of dual-use goods, and to comply with the export control rules and procedures established by the Regulation (EU) 2021/821. The competent authorities of the member states need to implement and enforce the new Union list of dual-use goods, and to cooperate and coordinate with each other and with the Commission. The Commission needs to monitor and evaluate the impact and effectiveness of the new Union list of dual-use goods, and to report to the European Parliament and the Council.

The national regulations on dual-use encryption products

How some countries have their own rules on dual-use encryption products

The case of the United States

Some countries have their own national regulations on dual-use encryption products, which may differ or complement the existing regimes. For example, the United States has a complex and strict export control system, based on the Export Administration Regulations (EAR). The EAR classify encryption products under category 5, part 2, of the Commerce Control List (CCL). The EAR require an export license for most encryption products, except for some exceptions, such as mass market products, publicly available products, or products intended for certain countries or end-users. The EAR also require that exporters submit annual self-classification reports, semi-annual sales reports, and encryption review requests for certain products.

The case of Andorra

Andorra is a small country between France and Spain. It is not an EU member, but it has a customs union with it. However, this customs union does not cover all products. It only covers those belonging to chapters 25 to 97 of the Harmonized System (HS), which are mainly industrial products. Agricultural products and products belonging to chapters 1 to 24 of the HS are free of import duties in the EU. But they are subject to the most-favored-nation (MFN) treatment in Andorra.

Andorra has adopted the EU list of dual-use goods. It requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. This regulation came into force on 9 September 2021 and replaced the previous Regulation (EC) No 428/2009. Andorra has also adopted the necessary customs provisions for the proper functioning of the customs union with the EU. These provisions are based on the Community Customs Code and its implementing provisions, by the Decision No 1/2003 of the Customs Cooperation Committee.

Andorra applies the EU regulation, as it is part of the internal market. Moreover, Andorra has adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods. This modification reflects the changes made by the international export control regimes in 2020 and 2021. It also adds some new items, such as software and technologies for quantum computing, drones or facial recognition. The Delegated Regulation (EU) 2022/1 came into force on 7 January 2022, and applies to all exports of dual-use goods from the EU from that date.

Andorra entered the security and defense sector for the first time by participating in Eurosatory 2022. This is the international reference exhibition for land and airland defense and security. Andorra became the 96th country with a security and defense industry on its territory. Among the exhibitors, an Andorran company, Freemindtronic, specialized in counter-espionage solutions, presented innovative products. For example, DataShielder Defense NFC HSM, a device to protect sensitive data against physical and logical attacks. It uses technologies such as EviCypher NFC HSM and EviCore NFC HSM, contactless hardware security modules (NFC HSM). The president of Coges events, a subsidiary of GICAT, identified these products as dual-use and military products. They need an export or transfer authorization, according to the Regulation (EU) 2021/821. Freemindtronic also showed its other security solutions, such as EviKey NFC HSM, a secure USB key, a security token. These products were displayed in the Discover Village, a space for start-ups and SMEs innovations.

Switzerland

Switzerland is not an EU member, but it has a free trade agreement with it. Switzerland has adopted the Regulation (EU) 2021/821 by the Ordinance of 5 May 2021 on the control of dual-use goods. Switzerland applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Switzerland has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

Turkey

Turkey is not an EU member, but it has a customs union with it. Turkey has adopted the Regulation (EU) 2021/821 by the Presidential Decree No 3990 of 9 September 2021 on the control of exports of dual-use goods. Turkey applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. Turkey has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

United Kingdom

The United Kingdom left the EU on 31 January 2020. It has adopted the Regulation (EU) 2021/821 by the Dual-Use Items (Export Control) Regulations 2021, which came into force on 9 September 2021. The United Kingdom applies the EU list of dual-use goods and requires an export or transfer authorization for these goods, according to the Regulation (EU) 2021/821. The United Kingdom has also adopted the Delegated Regulation (EU) 2022/1 of the Commission of 20 October 2021, which modifies the EU list of dual-use goods.

The challenges and opportunities for the exporters of dual-use encryption products

The exporters of dual-use encryption products face several challenges and opportunities in the current context of export control regulations. Among the challenges, we can mention:

  • The complexity and diversity of the regulations, which may vary depending on the countries, the products, the destinations and the end-uses, and which require a deep knowledge and a constant monitoring from the exporters.
  • The costs and delays related to the administrative procedures, which can be high and unpredictable, and which can affect the competitiveness and profitability of the exporters, especially for small and medium enterprises (SMEs).
  • The legal and reputational risks, which can result from an involuntary or intentional violation of the regulations, or from a misuse or diversion of the products by the end-users, and which can lead to sanctions, prosecutions or damages to the image of the exporters.

Among the opportunities, we can mention:

  • The growing demand and innovation for encryption products, which are increasingly used in many sectors and domains, such as finance, health, education, defense, security, human rights, etc.
  • The contribution to the security and human rights of the exporters, their customers and the general public, by enabling the protection of data, privacy, freedom of expression, access to information and democratic participation, thanks to encryption products.
  • The cooperation with the competent authorities, the civil society and the international community, to ensure the compliance and accountability of the exporters, and to support the development and implementation of effective and balanced encryption policies and regulations, that respect the security and human rights of all stakeholders.

Conclusion

Dual-use encryption products can have both civil and military uses. They are subject to export control regulations at different levels: international, regional and national. These regulations aim to prevent the risks that these products can pose for security and human rights. At the same time, they allow the development and trade of these products. Therefore, the exporters of dual-use encryption products must comply with the regulations that apply to their products. They must also assess the impact of their products on security and human rights. The exporters of dual-use encryption products can benefit from the demand and innovation for these products. These products are essential for the digital economy and society. They can also enhance the security and human rights of the exporters, their customers and the public.

Freemindtronic Andorra is a company that specializes in dual-use encryption products. It offers secure and innovative solutions for data, communication and transaction protection. Freemindtronic Andorra respects the export control regulations that apply to its products. It is also committed to promoting and supporting the responsible and lawful use of its products. It follows the principles of security and human rights. Freemindtronic Andorra cooperates with the authorities, the civil society and the international community. It ensures the transparency and accountability of its activities. It also participates in the development and implementation of effective and balanced encryption policies and regulations. It respects the interests and needs of all stakeholders.

2023, Articles, EviCore HSM OpenPGP Technology, EviCore NFC HSM Technology, NFC HSM technology, Technical News, Technologies

Quantum computing RSA encryption: a threat and a solution

Posted on by FMTAD
Quantum computing RSA encryption
12
Nov
Quantum computing RSA encryption by Jacques Gascuel: This article will be updated with any new information on the topic.

Quantum computers RSA cryptography: how to secure your data

Quantum computers can break RSA encryption, which secures our online data. But there are solutions that are resistant to quantum attacks. One of them is Freemindtronic, an Andorran company that notably uses NFC HSM technology to share AES-256 keys using RSA-4096 encryption, which quantum computers cannot decipher.

Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2023 Articles Cardokey Eco-friendly EviSwap NFC NDEF Technology GreenTech

NFC Business Cards with Cardokey free for life: How to Connect without Revealing
November 8, 2023

2023 Articles Cyberculture Eco-friendly Electronics GreenTech Technologies

The first wood transistor for green electronics
April 29, 2023
Hardware Secrets Manager, Eco-friendly, NFC devices, works contactless from Freemindtronic is sustainable technology respects the environment design & product made in Andorra

Eco-friendly GreenTech

Hardware secrets manager Eco-friendly
April 25, 2021

Quantum computing RSA encryption: a challenge and a solution

Quantum computing RSA encryption is a challenge for online security. Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. One of these things is breaking RSA encryption, which secures data online. RSA encryption is based on the difficulty of factoring large numbers. Quantum computers can factor large numbers faster than classical computers. They use algorithms like Shor’s algorithm, which exploits quantum properties.

However, this threat is not imminent. Building and using quantum computers is still challenging and uncertain. Two recent announcements claimed to have cracked RSA encryption with quantum systems. But they have not been verified. The experts are skeptical and doubtful. They have not provided any evidence or details. They have made unrealistic or too good to be true claims. They have not been peer-reviewed or reproduced.

What is RSA encryption?

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

How does RSA encryption work?

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

What is quantum computing and how does it work?

Quantum computing is a new way of computing that uses quantum physics. It can do things that classical computers cannot or are too slow to do. Here is how it works:

  • Qubits: Quantum computers use quantum bits, or qubits. They can be 0 or 1, or both at the same time. This is called superposition. When we measure a qubit, it becomes either 0 or 1. This gives us more information than a classical bit, which is always 0 or 1.
  • Entanglement: Quantum computers can also use entanglement. This is when two qubits share a quantum state and affect each other, even if they are far apart. This allows us to manipulate multiple qubits at once and create complex quantum states.
  • Parallelism: Quantum computers can use these properties to perform parallel computations. This means they can do many calculations at the same time, using fewer qubits than classical bits. This can speed up some tasks that are hard for classical computers.

One of these tasks is breaking RSA encryption, which is based on factoring large numbers. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. This can break RSA encryption by finding the private key from the public key. However, this requires a quantum computer with many qubits and low errors, which we do not have yet.

Quantum computing RSA encryption: a challenge and a solution

The ability to find an RSA private key from its public key by a quantum computer poses a serious threat to online security. However, this threat is not imminent, as there are still many challenges and uncertainties in building and using quantum computers. Two recent announcements have claimed to have cracked RSA encryption with quantum systems, but they have not been verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

How quantum computers can break RSA encryption

RSA encryption is a type of asymmetric encryption. It uses two keys: a public key and a private key. The public key can be shared with anyone, but the private key must be kept secret. They are mathematically related, but it is very hard to find the private key from the public key.

RSA encryption uses large prime numbers to generate the keys. The public key and the private key are based on the product of two prime numbers. It is easy to multiply two prime numbers, but very hard to factor their product. For example, 17 x 23 = 391, but finding that 391 = 17 x 23 is much harder.

RSA encryption uses keys that are 2048 or 4096 bits long. These are numbers that have 2048 or 4096 binary digits (0 or 1). They are so large that it would take billions of years for a classical computer to factor them. Therefore, RSA encryption is very secure and widely used for online security.

Quantum computers can break RSA encryption by finding the prime factors of the composite number that is used to generate the public and private keys. Once the prime factors are known, the private key can be easily calculated from the public key, and the encrypted messages can be decrypted. Quantum computers can use a quantum algorithm, called Shor’s algorithm, to factor large numbers faster than classical computers. Shor’s algorithm can factor a large number in polynomial time, which means that the time it takes to factor a number grows relatively slowly as the number gets larger. In contrast, the best classical algorithms for factoring are exponential, which means that the time it takes to factor a number grows very fast as the number gets larger.

Two claims of breaking RSA encryption with quantum systems

Two recent announcements have raised concerns about quantum computing RSA encryption. One is from a team of Chinese researchers, who published a paper on arXiv in December 2022. They claim to have found a faster way to break RSA encryption with a quantum computer of 372 qubits. They combine a classical algorithm, called Schnorr’s algorithm, with a quantum algorithm, called QAOA (Quantum Approximate Optimization Algorithm). Schnorr’s algorithm is a method of factoring large numbers that uses a probabilistic approach and a lattice reduction technique. QAOA is a method of finding approximate solutions to optimization problems using a quantum computer.

The researchers say that by applying QAOA to the most computationally intensive step of Schnorr’s algorithm, they can reduce the number of qubits and the number of operations needed to factor a large number. They also say that they tested their method on a 10-qubit quantum computer and succeeded in factoring a 48-bit number. They extrapolate that their method can scale to factor a 2048-bit number, which is the standard for RSA encryption.

The other announcement is from a researcher named Ed Gerck, who posted on LinkedIn in November 2023. He claims to have decrypted RSA-2048 encryption, the most used public-key algorithm, with a quantum system implementable on a smartphone or a PC running Linux. He says that he developed a quantum algorithm that can calculate prime numbers faster than Shor’s algorithm and that he proved several mathematical conjectures, such as Goldbach’s conjecture. He published an excerpt of his work, but has not provided any proof or detail of his method.

Both announcements are not verified and have been met with skepticism and doubt from the experts. They have not provided any evidence or details of their work. They have made assumptions and claims that seem unrealistic or too good to be true. They have not been peer-reviewed or reproduced by other sources.

Quantum computing RSA encryption: possible solutions

How to protect RSA encryption from quantum attacks?

However, this announcement is not yet verified, and it raises many questions in the scientific community. It is therefore premature to draw hasty conclusions, and we must wait for the publication of the evidence of his work. It is also possible that RSA encryption can be adapted to resist quantum attacks, for example by increasing the length of the keys, or by using masking techniques. In addition, there are alternatives to RSA encryption, supposed to be more robust against quantum computing. These are post-quantum cryptography algorithms, based on other mathematical problems that are difficult to solve for quantum computers. Post-quantum cryptography is a very active field of research, which aims to anticipate the threats that quantum computers would pose to the security of communications. There are several potential candidates to replace RSA encryption, but they must be evaluated and compared in order to choose the most suitable ones for different needs and constraints. The NIST has launched an international competition to select and standardize the best post-quantum encryption algorithms, which should be ready by 2024.

What are the alternatives to RSA encryption?

Some of the alternatives to RSA encryption that are considered to be more resistant to quantum attacks are:

  • Lattice-based cryptography: This is based on the hardness of finding the shortest vector in a high-dimensional lattice, or the closest vector to a given point. Lattice-based cryptography has the advantage of being fast, versatile, and allowing for advanced features such as homomorphic encryption and digital signatures. Some examples of lattice-based algorithms are NTRU, BLISS, and NewHope.
  • Code-based cryptography: This is based on the hardness of decoding a general linear code, or finding the error vector in a noisy transmission. Code-based cryptography has the advantage of being simple, efficient, and having a long history of security analysis. Some examples of code-based algorithms are McEliece, Niederreiter, and BIKE.
  • Multivariate cryptography: This is based on the hardness of solving a system of multivariate polynomial equations over a finite field. Multivariate cryptography has the advantage of being compact, flexible, and allowing for various applications such as encryption, signatures, and identification. Some examples of multivariate algorithms are Rainbow, HFE, and GeMSS.
  • Hash-based cryptography: This is based on the hardness of finding collisions or preimages for a cryptographic hash function. Hash-based cryptography has the advantage of being simple, provably secure, and relying on minimal assumptions. Some examples of hash-based algorithms are XMSS, SPHINCS, and LMS.

How Freemindtronic protects data with RSA-4096 and NFC technology

Freemindtronic is an Andorran company that specializes in security and cybersecurity of information and computer systems. It designs and develops products and services based on NFC (Near Field Communication) technology, which allows wireless communication at short distance.

The HSM of Freemindtronic: devices that store and protect cryptographic keys

One of the products of Freemindtronic is the HSM (Hardware Security Module), which is a device that stores and protects cryptographic keys. The HSM of Freemindtronic uses two technologies: EviCore HSM OpenPGP and EviCore NFC HSM.

  • EviCore HSM OpenPGP is an implementation of the OpenPGP standard, an open standard for encryption and signature of data. It can manage symmetric and asymmetric encryption keys, both standard and OpenPGP. It can also create HSM on any type of storage device, such as key store, key chain, SD card, SSD, USB drive, NAS, cloud, etc. It can work in fixed, offline, or online mode (LAN/WAN).
  • EviCore NFC HSM is a technology that allows to share AES-256 standard keys using RSA-4096 standard encryption. It works without contact with NFC HSM, which use a pair of RSA-4096 keys for secret sharing (AES-256 encryption keys).

The AES-256 standard: a type of symmetric encryption with high level of security

The AES-256 standard is a type of symmetric encryption, which means that it uses the same key to encrypt and decrypt messages. The AES-256 standard offers a high level of security, as it uses keys that are 256 bits long, which are very hard to crack by brute force. The AES-256 standard is widely used for encrypting data and communications, such as files, emails, or messages.

The RSA-4096 encryption: a type of asymmetric encryption that protects the AES-256 keys from quantum attacks

However, the AES-256 standard requires that the key be securely transmitted between the sender and the receiver, without being intercepted, modified, or forged by an attacker. This is where the RSA-4096 encryption comes in, as it provides a way to protect the AES-256 keys from quantum attacks.

The RSA-4096 encryption is a type of asymmetric encryption, which means that it uses two different keys to encrypt and decrypt messages: a public key and a private key. The public key can be shared with anyone, while the private key must be kept secret. The RSA-4096 encryption uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers. The RSA-4096 encryption can encrypt the AES-256 keys with the public key of the receiver, and decrypt them with the private key of the receiver. Thus, only the receiver can access the AES-256 keys, and use them to encrypt or decrypt the messages. The RSA-4096 encryption can also sign the AES-256 keys with the private key of the sender, and verify them with the public key of the sender. Thus, the receiver can ensure the identity of the sender, and the integrity of the AES-256 keys.

The RSA-4096 encryption is therefore an effective way to protect the AES-256 keys from quantum attacks, as it uses keys that are 4096 bits long, which are out of reach of the current or future quantum computers.

The RSA-4096 encryption is also a practical way to share the AES-256 keys between the HSM, as it uses the NFC technology, which allows wireless communication at short distance. The RSA-4096 encryption is therefore a major asset for the technologies of Freemindtronic, which offer an optimal security for the encryption of data.

Conclusion

Quantum computing is a new paradigm of computing that could break RSA encryption, the most common encryption method on the internet. With only 372 qubits, a quantum computer could break RSA encryption, exposing our online data and communications. However, there are solutions and alternatives that can resist quantum attacks. One of them is Freemindtronic, an Andorran company that uses NFC technology to share AES-256 standard keys using RSA-4096 standard encryption, which is beyond the reach of quantum computers. Freemindtronic’s technologies are based on the EviCore HSM OpenPGP and the EviCore NFC HSM, which are hardware devices that store and protect cryptographic keys. EviCore HSM OpenPGP transforms your smartphone, tablet or computer into a hardware security module compatible with the OpenPGP standard. EviCore NFC HSM allows you to store and use your crypto keys and secrets in a contactless NFC device, such as a card, a sticker, or a keychain. Both technologies offer features such as offline isolation, seamless integration, enhanced user experience, and multi-factor authentication. Therefore, Freemindtronic’s technologies are innovative and secure solutions for data and communication encryption, which can withstand quantum attacks and ensure the privacy and integrity of online activities.

Articles, Cyberculture, EviCore NFC HSM Technology, EviCypher NFC HSM, EviCypher Technology

Communication Vulnerabilities 2023: Avoiding Cyber Threats

Posted on by FMTAD
Person working on a laptop within a protective dome, surrounded by falling hexadecimal ASCII characters, highlighting communication vulnerabilities
30
Sep
The hidden dangers of communication vulnerabilities in 2023  by Jacques Gascuel: This article will be updated with any new information on the topic.

Beware of communication vulnerabilities in 2023

Communication is essential for our personal and professional lives, but it also exposes us to cyber threats. In 2023, hackers will exploit the hidden dangers of communication vulnerabilities to steal data, disrupt services, and spy on users. This article will explain the main types of communication vulnerabilities, their impact, and how to protect yourself from them.

Shadowy hacker with a laptop in front of a digital map of Russia highlighted in red, symbolizing the origin of Kapeka Malware.

2024 Digital Security

Kapeka Malware: Comprehensive Analysis of the Russian Cyber Espionage Tool
April 18, 2024
A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense
April 15, 2024
Illustration of an Apple MacBook with a highlighted M-series chip vulnerability, surrounded by symbols of data security breach and a global impact background.

2024 Digital Security

Apple M chip vulnerability: A Breach in Data Security
March 25, 2024
Digital world map with cybersecurity icons representing the Cybersecurity Breach at IMF.

2024 Digital Security

Cybersecurity Breach at IMF: A Detailed Investigation
March 15, 2024
Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?
March 10, 2024
PrintListener technology concept with NFC security solutions.

2024 Digital Security

PrintListener: How to Betray Fingerprints
February 22, 2024
A visual representation of BitLocker Security featuring a central lock icon surrounded by elements representing Microsoft, TPM, and Windows security settings.

2024 Articles Digital Security News

BitLocker Security: Safeguarding Against Cyberattacks
February 10, 2024
Digital shield by Freemindtronic repelling cyberattack against Microsoft Exchange

2024 Articles Digital Security News

How the attack against Microsoft Exchange on December 13, 2023 exposed thousands of email accounts
February 8, 2024

Communication Vulnerabilities in 2023: Unveiling the Hidden Dangers and Strategies to Evade Cyber Threats

2023 Security Vulnerabilities in Means of Communication

Communication is essential for individuals and professionals, but it is also exposed to many cyber threats. In 2023, several security breaches affected emails and messages, compromising the security of data, services, and users. These breaches showed the vulnerability of communication systems, which are exposed to increasingly sophisticated and targeted attacks. To protect themselves, users need to encrypt their data and communications with their own keys that they created and stored offline. One of the solutions that can help them achieve this is EviCypher NFC HSM technology by Freemindtronic.

The Reality of Security Breaches in Communication Systems

However, we wanted to highlight a disconcerting reality: users often found themselves defenseless against the hidden dangers of communication vulnerabilities in 2023 that festered beneath the surface for long periods of time. Unaware of these current, imminent or future risks, they unwittingly provided gateways to espionage activities, whether motivated by legitimate or malicious intentions. These vulnerabilities enabled a relentless cycle of cyber victimization, perpetuating the very threats they aimed to mitigate.

For example, iCloud Email operated without end-to-end encryption from its launch in 2011 until December 2022 – a troubling reality that put users in a vulnerable position, their security at the mercy of external factors they could not control.

Another example, several reports by the Citizen Lab have revealed the existence and the use of Pegasus spyware developed by the Israeli company NSO Group, which sells its services to governments and private actors to spy on targets around the world. Moreover, several investigations by the consortium Forbidden Stories have revealed that more than 50,000 phone numbers have been selected as potential targets by NSO Group’s clients, including heads of state, journalists, human rights activists, etc.

Among the most recent examples of these vulnerabilities, we can mention the cyberattack against the US State Department, which was attributed to hackers linked to China.

Chinese hackers hacked 60,000 emails from the US State Department

In March 2023, Chinese hackers hacked 60,000 emails from the US State Department. Some of them were very sensitive to national security and foreign affairs. They used a Microsoft Exchange flaw named Log4Shell. This vulnerability allows hackers to remotely execute malicious code on servers that use this software. It affects millions of servers worldwide. Senator Mark Warner revealed the attack and criticized the lack of transparency and security of the State Department. He called for strengthening cooperation between government agencies and the private sector to cope with cyberthreats. This attack is part of a context of rising tensions between the US and China, who accuse each other of espionage and sabotage on cyberspace.

The other sensitive organs targeted by the attack

Besides the State Department emails, the attack also targeted other sensitive organs, such as:

  • The Bureau of the Coordinator for Cyber Issues, which is responsible for coordinating the State Department’s efforts to prevent and respond to cyberattacks.
  • The Bureau of Consular Affairs, which is in charge of issuing passports and visas, as well as protecting US citizens abroad.
  • The Bureau of Intelligence and Research, which provides analysis and assessments on foreign policy and national security issues.

These sensitive organs hold confidential or personal information that could be used by the Chinese hackers for espionage, blackmail or sabotage. For example, the hackers could access the biometric data of visa applicants, the reports of intelligence agents or the action plans in case of crisis.

The security flaw exploited by the Chinese hackers

The most serious thing is that some servers that were hacked by the Chinese had not been updated with the patch released by Microsoft on December 10, 2022. This shows that the updates are not automatic and that they have to be installed manually. This also shows the lack of responsiveness and vigilance of the IT security managers. They let the Chinese hackers exploit this flaw before it was fixed by Microsoft, who released security updates. Indeed, this cyberattack shows the vulnerability of communication systems and the need to protect them effectively.

A Case of Satellite Messaging Security Vulnerability

Satellite messaging is a means of communication that allows the transmission of electronic messages or calls via a network of artificial satellites. It is used by professionals and individuals in areas with no cellular coverage or those seeking discreet communication. However, satellite messaging is not immune to security vulnerabilities that can compromise data confidentiality and integrity.

In September 2023, a team of cybersecurity researchers uncovered a significant security vulnerability in the Bullitt satellite messaging service. This vulnerability allowed hackers to read and modify messages sent and received by users, as well as access their personal information, including GPS coordinates and phone numbers. Hackers could also impersonate users by sending messages on their behalf. The vulnerability was found in the PubNub-Kotlin API used by the Bullitt Messenger app to manage communication between devices and the service’s servers. Despite alerting Bullitt, the service provider, about this vulnerability, the researchers received no satisfactory response.

This security flaw poses a high risk to satellite messaging users, as their data can be exposed or manipulated by hackers.

Security Vulnerabilities in Communication Systems: A Closer Look

2023 Security Flaws in Communication Channels is a paramount concern for individuals and organizations across the globe. Hackers frequently exploit vulnerabilities within communication protocols and services to launch attacks that can compromise data confidentiality, integrity, and availability. To illustrate the magnitude and gravity of this issue, we have compiled statistics based on our web research:

Security Vulnerabilities in Emails

Emails serve as a central vector for cyberattacks, representing a significant portion of security incidents, with up to 91% of reported incidents, as per cybermalveillance.gouv.fr. Among these email-targeted threats, ransomware attacks are the most prevalent, comprising 25% of reported security incidents. Additionally, it’s striking to note that 48% of malicious files attached to emails are Microsoft Office documents. These statistics underscore the critical importance of implementing robust security measures for emails to guard against evolving threats.

Furthermore, an analysis conducted by the Verizon Data Breach Investigations Report for 20232 highlights that emails remain the primary variety of malicious actions in data breaches, underscoring their continued relevance as a vector for cyberattacks.

However, it is essential to note that email-specific vulnerabilities can vary based on factors such as email protocol vulnerabilities, server configuration errors, human mistakes, among others.

Security Vulnerabilities in Encrypted Messaging Services

Encrypted messaging services like Signal, Telegram, or WhatsApp are not immune to security vulnerabilities, which can compromise message and file confidentiality, integrity, and availability. In March 2023, Cellebrite, an Israeli data extraction company, claimed to have successfully decrypted messages and files sent via Signal. In June 2023, Google disclosed a vulnerability in its RCS service that allowed hackers to send fraudulent messages to Android users, containing malicious links redirecting victims to compromised websites.

Security Vulnerabilities in Communication Protocols

Communication protocols such as SMTP, RCS, or SMS are also susceptible to security vulnerabilities that can enable hackers to intercept, modify, or spoof messages and calls. SS7 vulnerabilities involve attacks exploiting the vulnerabilities of the SS7 protocol, used to establish and terminate telephone calls on digital signaling networks. These attacks can allow hackers to intercept, modify, or spoof voice and SMS communications on a cellular network. In January 2023, a hacking group named Ransomware.vc launched a data extortion campaign targeting organizations using the Progress MOVEit file transfer tool. The hackers exploited an SS7 vulnerability to intercept verification codes sent via SMS to MOVEit users, gaining access to sensitive data. In February 2023, the Ukrainian power grid was hit by a new malware called Industroyer2, attributed to Russian hackers. The malware used an SS7 vulnerability to take control of network operator phone calls, disrupting electricity distribution in the country. In March 2023, Samsung suffered a data breach that exposed the personal and financial information of millions of customers. The breach was caused by an SS7 vulnerability that allowed hackers to access SMS messages containing online transaction confirmation codes.

An Overview of Security Vulnerabilities in Communication Systems

Communication systems exhibit various vulnerabilities, with each element susceptible to exploitation by hackers. These weaknesses can have severe consequences, including financial losses, damage to reputation, or national security breaches.

  • Protocols: Communication protocols, like Internet Protocol (IP), Simple Mail Transfer Protocol (SMTP), Signaling System 7 (SS7), and Rich Communication Services (RCS), can contain security vulnerabilities. These vulnerabilities enable hackers to intercept, modify, or spoof communications on the network. For instance, an SS7 vulnerability allows hackers to eavesdrop on phone calls or read SMS messages on a cellular network.
  • Services: Network services, such as messaging, cloud, streaming, or payment services, possess their own vulnerabilities. These vulnerabilities may permit hackers to access, modify, or delete data within the service. For instance, a vulnerability in an encrypted messaging service enables hackers to decrypt messages or files sent via the service.
  • Applications: Software applications, including web, mobile, desktop, or IoT applications, are prone to security vulnerabilities. These vulnerabilities empower hackers to execute malicious code on a user’s device or gain control of the device itself. For example, a vulnerability in a web application allows hackers to inject malicious code into the displayed web page.
  • Devices: Physical devices, such as computers, smartphones, tablets, or IoT devices, feature their own set of security vulnerabilities. These vulnerabilities can enable hackers to access the device’s data or functionalities. For instance, a vulnerability in a smartphone grants hackers access to the device’s camera, microphone, or GPS.

In conclusion, the multitude of security vulnerabilities in communication systems presents a significant challenge to all stakeholders. Protecting against these vulnerabilities and enhancing cybersecurity is essential to safeguard sensitive data and infrastructure.

How communication vulnerabilities exposed millions of users to cyberattacks in the past years

Communication is essential for our personal and professional lives, but it also exposes us to cyber threats. In the past years, hackers exploited the hidden dangers of communication vulnerabilities to steal data, disrupt services, and spy on users. These vulnerabilities affected software and services widely used, such as Log4j, Microsoft Exchange, Exim, Signal, Telegram, or WhatsApp. Some of these vulnerabilities have been fixed, while others remain active or in progress. The following table summarizes the main communication vulnerabilities in the past years, their impact, and their status.

Name of the breachType of breachImpactStatusDate of discoveryDate of patch
Log4jCommand injectionControl of servers and Java applicationsFixedNovember 24, 2021December 18, 2021
Microsoft ExchangeRemote code executionData theft and backdoor installationFixedMarch 2, 2021
EximMultiple vulnerabilitiesControl of email serversJune 5, 2020
SignalDenial of serviceBlocking of messages and callsFixedMay 11, 2020May 15, 2020
TelegramDeserializationAccess to messages and filesFixedJanuary 23, 2021
WhatsAppQR code spoofingAccount hackingFixedOctober 10, 2019
File-based XSSCode injectionExecution of malicious code in the browserNot fixedDecember 17, 2020N/A
RCSQR code spoofingInterception, modification or spoofing of messages and callsNot fixedJune 17, 2020N/A
SMSSIM swap fraudAccount takeover and identity theftActive or in progress
MMSStagefright vulnerabilityRemote code execution and data theftFixedJuly 27, 2015August-September 2015
SolarWinds OrionSupply chain compromiseData theft and backdoor installationFixedDecember 8, 2020February 25, 2023
API PubNub-KotlinPrivilege escalation by deserialization of untrusted dataArbitrary command execution on SolarWinds Platform websiteFixedFebruary 8, 2022April 19, 2023
SS7Multiple vulnerabilitiesData theft, interception, modification or blocking of communications, location tracking or spoofing, fraudActive or in progress2014N/A

This table provides a concise overview of the hidden dangers of communication vulnerabilities in 2023, their types, impacts, and current statuses.

EviCypher NFC HSM: The technology that makes your communications invulnerable to security breaches

Security vulnerabilities in the means of communication pose a high risk to users, including satellite messaging, as their data can be exposed or manipulated by hackers. Therefore, effective protection against this threat is essential. This is precisely where the EviCypher NFC HSM technologies mentioned in this article come in as an innovative and secure solution.

EviCypher NFC HSM Technology for Messaging Protection

EviCypher NFC HSM technology is a solution that enables contactless encryption and decryption of data using an NFC card. It employs a hardware security module (HSM) that securely stores encryption keys. It is compatible with various communication services, including emails, SMS, MMS, satellite messaging, and chats.

To use EviCypher NFC HSM technology, simply pair the NFC Card, to an NFC-enabled Android phone and activate it with your fingerprint. Messages sent and received through messaging services are encrypted and decrypted using the NFC card. Only the card owner can access their messages and files. No one can intercept or alter them, even if the  service is compromised by a security vulnerability.

EviCypher NFC HSM technology offers optimal protection for commincation, ensuring data confidentiality and integrity. It also safeguards against other types of security vulnerabilities that may affect communication methods, such as Log4Shell or SolarWinds. It is a simple, effective solution that requires no change in user habits.

What is EviCypher NFC HSM technology?

EviCypher NFC HSM technology is a contactless encryption technology that uses hardware security modules (HSM) devices that communicate via NFC (Near Field Communication) protocols. These devices are EviTag and Evicard, which are small and portable devices that can be attached to a keychain or a card holder. They allow users to store and manage their keys and secrets securely, without relying on third-party services or cloud storage.

How does EviCypher NFC HSM technology work?

EviCypher NFC HSM technology works by encrypting and decrypting data and communications with the user’s own keys that they created and stored offline. The user can use the devices for various applications, such as encrypting emails, messages or files.

To use NFC HSMs, the user must first pair it with their phone. He chooses the option of encryption or decryption on his phone, writes or reads his messages on his phone. Encryption and decryption operations are performed from the NFC HSM itself, without exposing keys or secrets to the phone. The same operation is available on computer via a phone-paired web extension and using the NFC HSM.

Why is EviCypher NFC HSM technology secure and reliable?

EviCypher NFC HSM technology is integrated into a hardware security module that stores encrypted secrets, such as encryption keys, in the highly secure NFC eprom memory. It enables to encrypt contactless communications upstream, in post-quantum AES 256, before sending them. It is thus secure and reliable, because it encrypts the data before transmitting them without ever keeping the message in plain text.

How can EviCypher NFC HSM technology protect you from security breaches?

EviCypher NFC HSM technology can protect you from security breaches by encrypting your data and communications in advance in volatile memory before sending them encrypted without ever keeping the message in clear automatically destroyed and replaced by its encrypted version in AES 256 symmetry considered post quantum. Thus, even if there are security flaws the messages and emails and their attachments remain always encrypted. This can be done from an Android NFC phone and/or from the Freemindtronic extension.

This way, you can avoid being exposed to past, present or future security vulnerabilities, since the encryption is done on the device itself, without exposing the keys or secrets to the phone or computer. Even if your phone or computer is compromised by a hacker or a spyware, they cannot access your data or messages in clear text. Only you can decrypt them with your device and your PIN code.

EviCypher NFC HSM technology is an innovative solution that offers a high level of security and privacy for your communication systems. It is developed by Freemindtronic, an Andorran company specialized in NFC security. It is based on EviCore NFC HSM technology, which is a hardware security module that combines hardware encryption and NFC communication protocols.

In conclusion, the EviCypher NFC HSM technology is integrated into a hardware security module that stores encrypted secrets, such as encryption keys, in the highly secure NFC eprom memory. It allows to encrypt contactless communications upstream, in post-quantum AES 256, before sending them. It is thus secure and reliable, because it encrypts the data before transmitting them without ever keeping the message in plain text.

2023, Articles, Cyberculture, EviCore HSM OpenPGP Technology, EviCore NFC HSM Browser Extension, EviCore NFC HSM Technology, Legal information, Licences Freemindtronic

Unitary patent system: why some EU countries are not on board

Posted on by FMTAD
Unitary Patent system European why some EU countries are not on board
01
Aug

Unitary patent system by Jacques Gascuel: This article will be updated with any new information on the topic.  

Why some EU countries don’t want the unitary patent

The unitary patent system promises to simplify and unify patent protection in Europe. But not all EU countries are on board. Discover why some countries like Spain have opted out and what it means for inventors.

A modern cybersecurity control center with a diverse team monitoring national cyber threats during the Andorra National Cyberattack Simulation.

2024 Cyberculture Digital Security News Training

Andorra National Cyberattack Simulation: A Global First in Cyber Defense
April 15, 2024
EU military defense of cryptocurrency

2024 Crypto Currency Cryptocurrency Cyberculture Legal information

EU Sanctions Cryptocurrency Regulation: A Comprehensive Overview
March 15, 2024

2024 Cyberculture Uncategorized

Chinese cyber espionage: a data leak reveals the secrets of their hackers
March 2, 2024
European Commission logo symbolizing the Cyber Resilience Act and NFC HSM technology.

2024 Cyberculture

Cyber Resilience Act: a European regulation to strengthen the cybersecurity of digital products
February 24, 2024
ECHR landmark ruling in favor of encrypted messaging, featuring EviCypher NFC HSM technology by Freemindtronic.

2024 Cyberculture Legal information

Encrypted messaging: ECHR says no to states that want to spy on them
February 21, 2024
Digital image showing a confused user at a computer surrounded by complex password symbols

2024 Articles Cyberculture EviPass Password

Human Limitations in Strong Passwords Creation
January 22, 2024
Telegram and the information war in Ukraine

2023 Articles Cyberculture EviCypher NFC HSM News Technologies

Telegram and the Information War in Ukraine
January 5, 2024
The American Intelligence How It Works : Section 702

2023 Articles CyberStealth legal Legal information News Spying

The American Intelligence: How It Works
December 26, 2023

Why some EU countries are not on board

What is the unitary patent?

The unitary patent is a new scheme that allows inventors and innovative companies to protect their inventions in 17 EU member states by filing a single request to the European Patent Office (EPO) 1. It is an alternative option to the classical European patent, which requires individual validation and maintenance in each country where the patent holder wants to benefit from protection 1. The unitary patent  entered into force on 1 June 2023, after the ratification of the Agreement on a Unified Patent Court (UPC Agreement) by 17 states participating in enhanced cooperation 2. It is expected that more EU states will join this scheme in the future 1.

The unitary patent is based on the European patent granted by the EPO under the rules of the European Patent Convention (EPC), so nothing changes in the pre-grant phase and the same high standards of quality search and examination apply. After a European patent is granted, the patent holder can request unitary effect, thereby obtaining a European patent with unitary effect (unitary patent) that provides uniform protection in initially 17 EU member states.

What is the current status of the unitary patent?

The unitary patent system is a new scheme that allows inventors and innovative companies to protect their inventions in 17 EU member states by filing a single request to the European Patent Office (EPO) . It is an alternative option to the classical European patent, which requires individual validation and maintenance in each country where the patent holder wants to benefit from protection . The unitary patent is expected to start in early 2023, after the ratification of the Agreement on a Unified Patent Court (UPC Agreement) by 17 states participating in enhanced cooperation . It is expected that more EU states will join this scheme in the future.

The UPC Agreement

The UPC Agreement is an international treaty that establishes the Unified Patent Court (UPC), a supranational specialised court that will have exclusive jurisdiction to settle disputes relating to unitary patents and European patents . The UPC Agreement was signed by 25 EU member states in 2013, but it requires the ratification by at least 13 states, including France, Germany and Italy, to enter into force.

As of June 2021, 16 states have ratified the UPC Agreement, including France and Italy . Germany has also ratified the UPC Agreement in December 2020, but its ratification is pending before the German Constitutional Court, which has received two constitutional complaints against it . The German government has expressed its intention to deposit its instrument of ratification as soon as possible after the resolution of these complaints . The UK, which was initially one of the mandatory ratifying states, has withdrawn from the unitary patent system after leaving the EU in 2020.

The main obstacle and challenges

The main remaining obstacle for the implementation of the unitary patent system is therefore the outcome of the German constitutional complaints. If they are dismissed or overcome, Germany could deposit its instrument of ratification and trigger the entry into force of the UPC Agreement within three months . However, if they are upheld or delayed, Germany could be prevented from joining the unitary patent or cause further uncertainties and complications for its launch.

Other challenges for the implementation of the unitary patentinclude the practical and logistical arrangements for the operation of the Unified Patent Court, such as the recruitment and training of judges, the establishment of IT systems and facilities, and the adoption of procedural rules and guidelines . Moreover, some legal and political issues may arise from the withdrawal of the UK from the unitary patent, such as the impact on the linguistic regime of the unitary patent, the distribution of the workload and the cases among the different divisions of the Unified Patent Court, and the compatibility of the UPC Agreement with EU law.

What are the advantages?

The unitary patent system offers several advantages for inventors and innovative companies who want to protect their innovations in the EU. Among these advantages, we can mention:

  • The simplification of the procedure: the patent holder no longer needs to carry out complex and costly procedures with national offices to validate their European patent in each country 1.
  • They only need to request unitary effect from the EPO, which is their single interlocutor 2.
  • The reduction of costs: the patent holder no longer has to pay validation fees, translation fees, representation fees or annual national fees to keep their patent in force in the countries covered by the unitary patent 1.
  • They only pay a single annual fee to the EPO, which is calculated according to a progressive scale 3.
  • The legal certainty: the patent holder benefits from a uniform protection in all countries where the unitary patent takes effect, without risk of fragmentation or divergence between national rights 1.
  • They can also enforce their rights before a supranational specialised court, the Unified Patent Court (UPC), which has exclusive jurisdiction to settle disputes relating to infringement and validity of unitary patents.

How does the unitary patent compare with other patent systems?

The unitary patent system is not the only option for obtaining patent protection in multiple countries. There are other regional or international patent systems that offer different advantages and disadvantages for inventors and innovative companies. Here are some examples:

The European Patent Convention (EPC)

The EPC is an international treaty that allows applicants to file a single application at the European Patent Office (EPO) and obtain a European patent that can be validated in up to 38 contracting states . The EPC is not affected by the unitary patent system and will continue to operate in parallel with it. The EPC offers more flexibility than the unitary patent, as applicants can choose which countries they want to validate their European patent in. However, it also involves more costs and formalities than the unitary patent, as applicants have to pay validation fees, translation fees and annual national fees in each country where they want to maintain their European patent.

The Patent Cooperation Treaty (PCT)

The PCT is an international treaty that allows applicants to file a single international application at a national or regional office and obtain an international search report and a preliminary examination report on their invention . The PCT does not grant patents directly, but facilitates the entry into national or regional phases in up to 153 contracting states . The PCT offers more time than the unitary patent system, as applicants can delay their decision on which countries they want to pursue their patent protection in for up to 30 or 31 months from the priority date . However, it also involves more complexity than the unitary patent, as applicants have to comply with different requirements and procedures in each country where they enter the national or regional phase.

The Eurasian Patent Convention (EAPC)

The EAPC is an international treaty that allows applicants to file a single application at the Eurasian Patent Office (EAPO) and obtain a Eurasian patent that can be validated in up to 8 contracting states . The EAPC is not related to the unitary patent system and operates independently from it. The EAPC offers more simplicity than the unitary patent, as applicants do not have to pay any validation fees or translation fees in the countries where they want to validate their Eurasian patent . However, it also involves more risk than the unitary paten system, as applicants cannot opt out of the jurisdiction of the Eurasian Court of Patent Disputes, which can invalidate their Eurasian patent in all contracting states.

How Freemindtronic’s international patents are related to the unitary patent

Freemindtronic is an Andorran company that creates innovative solutions for security, cyber-security and counter-espionage, using contactless technology (NFC). We have several inventions that are protected by international patents in the fields of embedded systems, access control and segmented key authentication. For example, our patented technologies EviCore NFC HSM, which manage encryption keys in an NFC HSM device, EviCore HSM OpenPGP, which manage encryption keys in a security element of phones, EviVault NFC HSM Cold Wallet operating without contact, EviKey NFC a contactless secured USB key and the technology EviCypher NFC HSM which encrypts all types of data. These technologies implement our patents and especially the one based on the segmented key authentication system. The latter received the gold medal of international inventions of Geneva 2021.

Our patent options

Our patents are based on the European patent granted by the European Patent Office (EPO) under the rules of the European Patent Convention (EPC). Therefore, we could benefit from the unitary patent system, which is a new scheme that allows inventors and innovative companies to protect their inventions in 17 EU member states by filing a single request to the EPO. However, we would also have to consider the disadvantages and risks of the unitary patent, such as the risk of total invalidation, the lack of flexibility and the exclusion of some countries. Moreover, we would have to deal with the legal issues of the unitary patent for non-participating countries, such as cross-border infringement cases and jurisdictional conflicts.

Our patent strategy

We have opted for the unitary patent only for our segmented key authentication system, and we have added some non-participating countries to our other European patents. The reasons behind this choice are related to our market strategy, our innovation potential and our risk assessment. For instance, we have decided to use the unitary patent for our segmented key authentication system because we consider it as our core invention and we want to protect it in a uniform and effective way in most EU countries. On the other hand, we have decided to add some non-participating countries to our other European patents because we want to preserve our flexibility and avoid possible invalidation challenges in those countries.

Conclusion

Our international patents are relevant examples of how the unitary patent system can affect inventors and innovative companies in Europe, both positively and negatively. They illustrate the opportunities and challenges that the unitary patent poses for innovation and competitiveness in the EU.

How can legal issues of the unitary patent for non-participating countries be resolved?

The legal issues of the unitary patent system for non-participating countries are complex and not yet fully resolved. One of the main questions is how to deal with cross-border infringement cases involving unitary patents and national patents. For instance, if an inventor from a non-participating country, such as Spain, wants to enforce his rights on his classic European patent in a participating country, such as France, where a unitary patent holder claims to infringe his patent, which law should he consider? Well, the question is not easy to answer, because he will have to take into account many international standards. In the end, this very important aspect will be “subjected” to a very complex situation that will necessarily be defined with the successive application of the law.

Another question is how to ensure a fair balance between the rights and obligations of unitary patent holders and national patent holders in non-participating countries. For example, if a unitary patent holder wants to enforce their rights in a non-participating country, such as Poland, where a national patent holder is allegedly infringing their patent, which court should they go to? Well, the answer is not clear, as it will depend on the interpretation and application of various international agreements. In principle, the unitary patent holder should go to the national court of Poland, but they may face some difficulties or disadvantages in comparison with the national patent holder, such as higher costs, longer procedures or different standards of proof.

One possible way to resolve these legal issues is to harmonise the rules and practices of the unitary patent and the national patent systems in Europe. This could be achieved by adopting common standards and guidelines for patent examination, grant, validity and enforcement, as well as by establishing mechanisms for cooperation and coordination between the UPC and the national courts. Another possible way is to extend the scope and coverage of the unitary patent and the UPC to all EU member states and other EPC contracting states. This could be achieved by encouraging and facilitating their participation in the enhanced cooperation and ratification of the UPC Agreement.

However, these solutions may face some practical and political challenges, such as the lack of consensus or willingness among the different stakeholders, the respect for national sovereignty and diversity, or the compatibility with EU law and international obligations. Therefore, it is important that the unitary patent and its legal implications are carefully monitored and evaluated, and that its benefits and drawbacks are balanced and communicated to all parties involved.

What are the disadvantages?

The unitary patent system is not without disadvantages for some actors in the patent market. Among these disadvantages, we can mention:

  • The risk of total invalidation: the patent holder faces the possibility that their patent will be cancelled in all countries where it takes effect, if the UPC finds that it does not meet the requirements of patentability. They do not have the possibility to limit or amend their patent to avoid this fatal outcome.
  • The lack of flexibility: the patent holder cannot choose the countries where they want to protect their invention, nor renounce their patent in some countries to avoid paying fees or to circumvent legal obstacles. They must accept or refuse unitary effect as a whole.
  • The exclusion of some countries: the patent holder cannot benefit from protection in all EU member states, since some countries have decided not to participate in the unitary patent or have not yet ratified the UPC Agreement 1.
  • This is notably the case of Spain, which is one of the few EU countries that does not intend to be part of the unitary patent

What are the best practices or strategies for using or avoiding the unitary patent?

The unitary patent system offers a new opportunity for inventors and innovative companies who want to protect their inventions in Europe. However, it also poses some challenges and risks that need to be carefully considered. Depending on their needs and goals, they may decide to use or avoid the unitary patent, or to combine it with other patent systems. Here are some factors to consider when making this decision:

The scope of protection

The unitary patent system provides a uniform protection in 17 EU member states, which may cover a large part of the European market. However, it does not cover all EU member states, nor non-EU countries that are part of the EPC or the PCT. Therefore, inventors and innovative companies should assess whether the unitary patent covers their target markets, or whether they need to seek additional protection in other countries.

The cost of protection

The unitary patent reduces the cost of protection in Europe, as it eliminates the need to pay validation fees, translation fees and annual national fees in each country where the unitary patent takes effect. However, it also introduces a single annual fee for the unitary patent, which is calculated according to a progressive scale . Therefore, inventors and innovative companies should compare the cost of the unitary patent with the cost of other patent systems, and consider whether they need protection in all countries covered by the unitary patent, or whether they can save money by choosing a smaller number of countries.

The risk of invalidation

The unitary patent increases the risk of invalidation in Europe, as it exposes the unitary patent to a single challenge before the UPC, which can invalidate it in all countries where it takes effect. Moreover, the UPC is a new court that may have some uncertainties and inconsistencies in its interpretation and application of the law. Therefore, inventors and innovative companies should evaluate the strength and validity of their inventions, and consider whether they want to avoid this risk by opting out of the UPC for their European patents, or by using other patent systems that allow them to limit or amend their patents in case of invalidation challenges.

The enforcement of rights

The unitary patent facilitates the enforcement of rights in Europe, as it allows the holders of unitary patents to sue infringers before the UPC, which can grant pan-European injunctions and damages. However, it also exposes them to counterclaims for invalidity before the UPC, which can invalidate their unitary patents in all countries where they take effect. Therefore, inventors and innovative companies should assess the likelihood and impact of infringement and invalidity actions, and consider whether they want to benefit from this facilitation by opting in to the UPC for their European patents, or whether they want to retain more control over their litigation strategy by using national courts or other patent systems.

Why do some EU countries not want to join the unitary patent

The reasons for some EU countries’ exclusion from the unitary patent are diverse. Spain, for example, considers that the linguistic regime of the unitary patent, which relies on the three official languages of the EPO (English, French and German), is discriminatory and harms its economic and cultural interests. It believes that Spanish, which is the second most spoken native language in the world, should be recognised as an official language of the unitary patent, or at least, that the holders of unitary patents should be required to provide a full translation in Spanish of their patents. It also fears that the unitary patent will strengthen the dominant position of the English-speaking and German-speaking countries in the field of innovation and will reduce the development opportunities of Spanish companies.

Croatia, on the other hand, has not joined enhanced cooperation for setting up the unitary patent, because it joined the EU after the launch of this initiative. However, it has expressed its interest in joining the unitary patent in the future.

Poland and the Czech Republic have participated in enhanced cooperation, but have not signed or ratified the UPC Agreement, which is a prerequisite for being part of the unitary patent 2. These countries have invoked economic and legal reasons to justify their withdrawal. Poland has estimated that the unitary patent would have a negative impact on its national budget and on its competitiveness. The Czech Republic has expressed doubts about the compatibility of the unitary patent with EU law and about the quality of automatic translations .

Slovakia has also participated in enhanced cooperation, but has opposed the regulation on the unitary patent and has challenged it before the Court of Justice of the EU (CJEU). It has argued that the regulation was contrary to the principle of equal treatment between the member states and the official languages of the EU. It has also questioned the legal basis of the regulation and its respect for national competences in the field of industrial property. The CJEU rejected its request in 2015.

Hungary has ratified the UPC Agreement in 2018, but has denounced it in 2020, following a decision of its Constitutional Court that declared that the Agreement was incompatible with its Constitution. The Court considered that the Agreement infringed on Hungary’s sovereignty in the matter of intellectual property and that it violated the principle of separation of powers by entrusting the settlement of disputes relating to patents to a supranational court not integrated into the Hungarian judicial system.

Here is a table that summarizes that gives the list of European countries that accept the unitary patent and the European countries that have excluded themselves from the unitary patent:

CountryStatusReason
GermanyAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
AustriaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
BelgiumAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
BulgariaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
CyprusAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
CroatiaExcludedHas not joined enhanced cooperation
DenmarkAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
SpainExcludedHas opposed enhanced cooperation and has challenged the linguistic regime of the unitary patent
EstoniaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
FinlandAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
FranceAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
GreeceAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
HungaryExcludedHas ratified the UPC Agreement but has denounced it following a decision of its Constitutional Court
IrelandAcceptsParticipates in enhanced cooperation but has not yet ratified the UPC Agreement
ItalyAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
LatviaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
LithuaniaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
LuxembourgAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
MaltaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
NetherlandsAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
PolandExcludedParticipates in enhanced cooperation but has not signed or ratified the UPC Agreement
PortugalAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
Czech RepublicExcludedParticipates in enhanced cooperation but has not signed or ratified the UPC Agreement
RomaniaAcceptsParticipates in enhanced cooperation but has not yet ratified the UPC Agreement
SlovakiaExcludedHas opposed enhanced cooperation and has challenged the regulation on the unitary patent
SloveniaAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement
SwedenAcceptsParticipates in enhanced cooperation and has ratified the UPC Agreement

What are the consequences of these countries’ exclusion from the unitary patent?

The exclusion of these countries from the unitary patent has consequences for both the holders of unitary patents and the national patent holders in these countries. For the holders of unitary patents, this means that they cannot protect their inventions in these countries through the unitary patent, but they have to resort to the classical European patent or the national patent . They therefore have to bear the costs and formalities related to the validation and maintenance of their patent in these countries, as well as the risks of a fragmented protection and legal uncertainty . For the national patent holders in these countries, this means that they cannot benefit from the advantages of the unitary patent, but they have to face the increased competition of the holders of unitary patents in the other EU countries . They also have to adapt to the rules and procedures of the UPC, which can be seized by the holders of unitary patents to assert their rights against them or to challenge the validity of their classical European patents .

What are the legal issues of the unitary patent for non-participating countries?

The legal issues of the unitary patent system for non-participating countries are complex and not yet fully resolved. One of the main questions is how to deal with cross-border infringement cases involving unitary patents and national patents. For example, if an inventor from a non-participating country, such as Spain, wants to exercise their rights on their classical European patent in a participating country, such as France, where a unitary patent holder is allegedly infringing their patent, which law should they take into account? Well, the question is not easy to answer, as it will have to take into account many international norms. In the end, this very important aspect will be “subjected” to a very complex situation that will necessarily be defined with the successive application of the law.

Another question is how to ensure a fair balance between the interests of the holders of unitary patents and those of national patent holders in non-participating countries. For instance, if a national patent holder in Spain wants to challenge the validity of a unitary patent that covers an invention similar to theirs, how can they do so without having to go before the UPC, which may not be accessible or convenient for them? Conversely, if a unitary patent holder wants to enforce their rights against a national patent holder in Spain who is allegedly infringing their patent, how can they do so without having to go before a national court that may not be familiar or favourable with the unitary patent? These questions raise issues of jurisdiction, recognition and enforcement of judgments, as well as substantive law harmonisation.

These legal issues are likely to generate uncertainty and litigation for both unitary patent holders and national patent holders in non-participating countries. They may also create barriers and distortions in the internal market and affect innovation and competitiveness. Therefore, it is desirable that these issues are addressed and clarified as soon as possible, either by legislative or judicial means.

Conclusion

The unitary patent is a new scheme that offers a simplified, economical and uniform protection in 17 EU member states. It is accompanied by a Unified Patent Court, which has exclusive jurisdiction to settle disputes relating to unitary patents. The unitary patent has advantages and disadvantages for inventors and innovative companies, depending on their strategy and market. Spain is one of the few EU countries that does not intend to join the unitary patent, mainly for linguistic reasons. Its exclusion has consequences for both unitary patent holders and Spanish actors in the patent market. The unitary patent also raises legal issues for non-participating countries, which are not yet fully resolved.

In conclusion, the unitary patent system is a major innovation in the field of intellectual property in Europe, but it also poses significant challenges for its implementation and acceptance. It aims to foster innovation and competitiveness in the EU, but it also creates disparities and conflicts between participating and non-participating countries. It offers a simplified and uniform protection for inventors and innovative companies, but it also exposes them to risks and uncertainties in cross-border litigation. It is therefore important that the unitary patent is carefully monitored and evaluated, and that its benefits and drawbacks are balanced and communicated to all stakeholders.

(1) https://www.epo.org/applying/european/unitary/unitary-patent.html

(2) https://www.epo.org/applying/european/unitary.html

(3) https://www.gov.uk/guidance/the-unitary-patent-and-unified-patent-court

Articles, EviCore NFC HSM Technology, EviCypher Technology, International Inventions Geneva, multi-factor authentication, News, NFC HSM technology

Geneva International Exhibition of Inventions 2021

Posted on by FMTAD
Geneva International Exhibition of Inventions 2021 EviCypher HSM Technology Golden Medal Award Andorra Jacques Gascuel
30
May

Geneva International Exhibition of Inventions 2021: Celebrating Inventors’ Achievements

In March 2021, the Geneva International Exhibition of Inventions achieved a historic milestone by transitioning to a virtual format, transcending geographical boundaries and bringing together inventors from 25 countries. This global event served as a platform for groundbreaking solutions across various domains. A significant highlight was Andorra’s exceptional performance at the 2021 Geneva Inventions Expo, marking its inaugural appearance in the competition’s 49-year history.

Andorra’s Historic Triumph at the 2021 Geneva Inventions Expo

In a momentous turn of events, Jacques Gascuel, a French expatriate in Andorra, clinched the prestigious Gold Medal in the C category at the Exposition Internationale des Inventions de Genève, making history for Andorra.

Redefining Data Security: The EviCypher HSM Innovation

Gascuel’s invention, the EviCypher HSM, represents a groundbreaking leap in data security and confidentiality. This innovation facilitates secure data exchange while preserving utmost anonymity. At its core lies a state-of-the-art NFC HSM (Near Field Communication Hardware Security Module) enabling the creation, exchange, and secure utilization of encryption keys.

Andorra’s Historic Win 2021 Geneva Inventions Expo: Why It Matters

Andorra’s participation in the Geneva International Exhibition of Inventions holds immense historical importance, considering it had never taken part in this prestigious event since its inception in 1972. This competition stands as the largest annual gathering dedicated solely to invention, featuring participation from over 45 countries. It enjoys substantial support from the Swiss Federal Government, the State of Geneva, the city of Geneva, the World Intellectual Property Organization (WIPO), and the International Federation of Inventors’ Associations (IFIA).

Invention vs. Innovation: What’s the Difference and Why Does It Matter?

Invention and innovation are two different but complementary concepts in technology. According to the OECD, innovation is the implementation of a new or significantly improved product or process, a new marketing method, or a new organizational method. Innovation can be of product, process, marketing, or organization. Innovation aims to create added value, meet user needs, or solve social problems. According to WIPO, invention is a technical solution to a technical problem. An invention can be a product or a process and must be new, inventive, and industrially applicable to be patentable. Invention aims to make an original contribution to the state of the art, exploit scientific opportunities, or overcome technical limitations.

Therefore, it is essential to distinguish between invention and innovation. While innovation often refers to the improvement or refinement of existing concepts or products, invention involves the creation of entirely new solutions or technologies. To participate in such a prestigious event as the Geneva International Exhibition of Inventions, inventors must generally hold a patent or have a revolutionary concept protected by a patent application.

The Different Categories of Inventions at the Geneva International Exhibition of Inventions 2021

Inventions at the 2021 Geneva International Exhibition are classified into various categories based on their nature and application. Common categories include:

ClassCategory Description
AMechanics, Engines, Machinery, Tools, Industrial Processes, Metallurgy
BClocks and Watches, Jewelry, Machinery, Tools
CComputer Sciences, Software, Electronics, Electricity, Communication Methods
DBuilding, Architecture, Civil Engineering, Construction, Materials, Woodwork
ESanitation, Ventilation, Heating
FSecurity, Rescue, Alarm
GIronmongery, Do-It-Yourself
HFurnishing, Interior Architecture
IDomestic Science, Restaurant Equipment
JCommercial, Industrial, and Office Equipment
KAgriculture, Horticulture, Gardening
LClothing, Textiles, Machines, and Accessories
MMedicine, Surgery, Hygiene, Orthopedics, Material for the Handicapped
NOptics, Photography, Cinematography
OTeaching Methods and Materials, Musical Instruments, Art Materials
PTransport, Motor Vehicles, Ships, Aviation, Accessories
QFoodstuffs, Drinks, Cosmetics, Paramedical, Health, Hygiene
RSport, Leisure
SPractical Novelties, Presents
TPublicity, Printing, Packaging
UGames, Toys
VProtection of the Environment, Energy

These diverse classes encompass a wide spectrum of inventions, from cutting-edge technology to practical everyday solutions. Each class represents a unique field where inventors contribute their creativity and expertise.

As we explore the full list of participants, we’ll witness the remarkable impact of human ingenuity across these categories.

The Diversity of Participating Countries at the Geneva International Exhibition of Inventions 2021

A total of 352 inventors from 25 countries participated in this global celebration of innovation and creativity. Here’s a breakdown of participating countries and their contributions:

CountryNumber of Participants
Andorra1
Argentina1
Canada1
China97
Egypt10
France5
Hong Kong32
Iran18
Malaysia15
Peru1
Poland10
Qatar4
Romania2
Russia5
Saudi Arabia27
Senegal1
South Korea43
Spain3
Switzerland3
Taipei (Chinese Taipei)21
Thailand46
Ukraine3
United States of America (USA)1
Vietnam1
Yemen1

The Best Inventions from the 77 Class C Participants at the Geneva International Exhibition of Inventions 2021

They classify the innovations at the 2021 Geneva Fair into various categories based on their nature and application. Common categories include:

1GASCUEL JacquesANDORRAC
2BEIJING UNIVERSITY OF POSTS AND TELECOMMUNICATIONSCHINAC
3CHANGSHA UNIVERSITY OF SCIENCE AND TECHNOLOGYCHINAC, D
4CHINA UNITED NETWORK COMMUNICATIONS GROUP COMPANY LIMITEDCHINAC
5CHONGQING THREE GORGES UNIVERSITYCHINAC
6CHUNPENG WANG, YIYANG ZHAI, SHENG SU, SITAN JIANGCHINAC
7COLLEGE OF ELECTRICAL ENGINEERING (ZHEJIANG UNIVERSITY)CHINAC, P
8DALIAN UNIVERSITY OF TECHNOLOGYCHINAA, C, D, M, V
9DEPARTMENT OF ELECTRICAL ENGINEERING, TSINGHUA UNIVERSITYCHINAC
10FUDAN UNIVERSITYCHINAC, J, M, Q, V
11GREE ELECTRIC APPLIANCES, INC. OF ZHUHAICHINAA, C, E, V
12GUODIAN UNITED POWER TECHNOLOGY COMPANY LTD.CHINAC
13HARBIN ENGINEERING UNIVERSITYCHINAC
14HUAZHONG UNIVERSITY OF SCIENCE AND TECHNOLOGYCHINAA, C, J, M, Q, V
15JIUJIANG JUNIOR MIDDLE SCHOOLCHINAC
16NANJING UNIVERSITYCHINAA, C, M, P, V
17NORTH CHINA ELECTRIC POWER UNIVERSITYCHINAC
18NORTH UNIVERSITY OF CHINACHINAC
19NORTHEASTERN UNIVERSITYCHINAC
20QINGDAO HAIER AIR-CONDITIONER GEN. CORP., LTD.CHINAC, E, V
21SCHOOL OF ELECTRICAL AND INFORMATION ENGINEERING, TIANJIN UNIVERSITYCHINAC
22SHANGHAI JIAO TONG UNIVERSITYCHINAC, P
23SICHUAN ENERGY INTERNET RESEARCH INSTITUTE, TSINGHUA UNIVERSITYCHINAC, F, V
24SOUTHEAST UNIVERSITYCHINAA, C, D, N, P, V
25STATE GRID CORPORATION OF CHINACHINAC
26TSINGHUA UNIVERSITYCHINAA, C, D, K, P, V
27TSINGHUA UNIVERSITY – JINGBO TANCHINAC
28TSINGHUA UNIVERSITY – ZHENG XIAOPINGCHINAC
29XI’AN JIAOTONG UNIVERSITYCHINAC
30ZHEJIANG UNIVERSITYCHINAC
31TAIPEI CITY UNIVERSITY OF SCIENCE AND TECHNOLOGYCHINESE TAIPEIC, D, E, F, J, P, R
32TAIWAN HUIXIN TECHNOLOGY LTD. CO.CHINESE TAIPEIA, C, D, I, N, Q
33AIVAZAN InèsFRANCEC
34APPLICATION TECHNOLOGY COMPANY LIMITEDHONG KONGC
35BLUE PIN (HK) LIMITEDHONG KONGC, J
36CITY UNIVERSITY OF HONG KONGHONG KONGC, D, M
37ELECTRICAL AND MECHANICAL SERVICES DEPARTMENT, THE GOVERNMENT OF THE HKSARHONG KONGC, D, E, J, S
38HONG KONG APPLIED SCIENCE AND TECHNOLOGY RESEARCH INSTITUTE (ASTRI)HONG KONGC, N, V
39HONG KONG BAPTIST UNIVERSITYHONG KONGB, C, M, Q
40HONG KONG PRODUCTIVITY COUNCILHONG KONGA, B, C, D, E, F, M, P, R, V
41INNOSPIRE TECHNOLOGY LIMITEDHONG KONGC
42LOGISTICS AND SUPPLY CHAIN MULTITECH R&D CENTRE (LSCM)HONG KONGC, P
43THE CHINESE UNIVERSITY OF HONG KONGHONG KONGA, C, M, V
44MIRKOHI Mohammadamin, MIRKOHI DorsaIRANC
45NIROUMAND Vahid, ABBASZADEH HamzehIRANC
46SIDHU Manjit SinghMALAYSIAC
47TIONG Sieh KiongMALAYSIAC
48LUBLIN UNIVERSITY OF TECHNOLOGYPOLANDC
49UTP UNIVERSITY OF SCIENCE AND TECHNOLOGYPOLANDC
50AL-RAHIMI Rashed, ZIAD MohamedQATARC
51ABDULLAH Ziyad Ahmed AbdulmatinSAUDI ARABIAC
52ABORAYA Dalia RefatSAUDI ARABIAC
53AL-BOGAMI Amjad SalmanSAUDI ARABIAC
54AL-JOHANI Samar OlaythahSAUDI ARABIAC
55AL-SHEHRI Samia Fayez MohammedSAUDI ARABIAC
56ALKHALIFAH Rayan, GHALY SidiSAUDI ARABIAC
57ALYAHYA Munirah, ALKHALIFAH Sadeem, ALAYBAN Dalal, ALMUHRIJ Alreem, ALOWISHEQ AreebSAUDI ARABIAC
58UNIVERSITY OF TABUKSAUDI ARABIAC
59ALPHAO CO., LTD.SOUTH KOREAC
60HWANG Gi TaekSOUTH KOREAC
61JUNGLEMONSTERSOUTH KOREAC
62KIM Sung RyongSOUTH KOREAC
63LEE JonghoSOUTH KOREAC
64PARK KiHoonSOUTH KOREAC
65SEUNGYONG KimSOUTH KOREAC
66YOO CheolyongSOUTH KOREAC
67ARAMVITH Supavadee, MUHAMMAD Wazir, RUANGSANG WatcharaTHAILANDC
68CHUEAMUEANGPHAN JirachetTHAILANDC
69KETCHAM MahasakTHAILANDC
70KETCHAM MahasakTHAILANDC
71KLINHOM Tunchanok, TANGKOCHAREON ThanaTHAILANDC
72MANOSNGIAM RonnakornTHAILANDC
73PHOTHA WatcharpolTHAILANDC
74SOONTORNPIPIT PichitpongTHAILANDC, F, Q
75SUDTHONGKHONG ChudanatTHAILANDC
76TUNTISITTHIKORN OranuchTHAILANDC
77HASSAN MarwanUNITED STATES OF AMERICAC

Table: Outstanding Participants in Class C – Insert Table Here

EviCypher’s Breakthrough Invention in Class C

In the Class C category of the 2021 special edition of the Geneva International Exhibition of Inventions, one invention truly shone. EviCypher, an inventor hailing from the small principality of Andorra, achieved a remarkable feat that garnered the attention of the 82 international experts comprising the jury. These experts represented diverse technical, scientific, industrial, and commercial fields, and they hailed from 25 different countries and regions. The countries and regions included Switzerland, France, Spain, Italy, Germany, the United Kingdom, China, Hong Kong, Japan, South Korea, the United States, Canada, Brazil, India, Iran, Thailand, Malaysia, Singapore, Australia, and New Zealand.

The revolutionary invention of EviCypher HSM, known as EviCypher NFC HSM (Near-Field Communication – Hardware Security Module) based on EviCore NFC HSM technology or EviCypher HSM OpenPGP (Hardware Security Module Open Pretty Good Privacy) based on EviCore HSM OpenPGP technology, won the prestigious gold medal for its revolutionary innovation in the field of highly secure authentication. via segmented keys, without the need for a server or database. What sets EviCypher HSM apart is its unique approach, enabling end-to-end anonymized human-to-human interaction.

EviCypher HSM introduced two remarkable technologies: EviCypher HSM and EviCore HSM, both of which garnered international recognition. These implementations are distinguished by the EviCypher NFC HSM technology, which leverages an individual cryptography NFC HSM device based on NFC. This technology offers a secure means to create, exchange, and utilize encryption keys without the requirement for physical contact.

This exceptional accomplishment not only highlights EviCypher’s ingenuity but also underscores the far-reaching impact and global significance of the inventions showcased at the Geneva International Inventions Fair. EviCypher’s success stands as a testament to the innovative spirit that propels inventors from all corners of the world to participate in this prestigious event—a platform where revolutionary concepts come to life.

The Success Story of Andorra at the Geneva International Exhibition of Inventions 2021

The 2021 Geneva International Exhibition of Inventions also marked a historic moment for Andorra. This tiny European principality made its debut in the competition, a testament to the event’s global appeal. While Andorra is renowned for its picturesque landscapes, it unveiled a new facet—the innovation and creativity of its residents.

Jacques Gascuel, a resident of Andorra, represented his nation on the international stage. His invention, the EviCypher HSM, is a testament to human ingenuity and technological advancement. It introduced the world to cutting-edge data security and authentication solutions, showcasing the transformative power of invention.

Not only did Jacques Gascuel participate, but he also achieved a milestone by securing the prestigious Gold Medal in the C category. This historic win serves as an inspiration to inventors worldwide, proving that innovation knows no boundaries, and even the smallest nations can make significant contributions to the world of invention.

A Recap of the Inventors Showcase 2021 Geneva

This brief highlights the historic significance of the Geneva International Inventions Fair 2021, where an inventor from Andorra won a gold medal for his groundbreaking invention, the EviCypher HSM. It also explains the difference between invention and innovation and the importance of celebrating both.

A Remarkable Event for Invention and Innovation

The 2021 fair in Geneva was historic for many reasons. It displayed revolutionary inventions from around the world. It also marked a turning point for the event and for Andorra. PALEXPO SA organized this event. It praised the spirit of invention and innovation. These are two different but complementary concepts in technology.

Andorra’s First Participation: A Milestone for Inclusion and Creativity

For the Geneva International Exhibition of Inventions, this edition was truly unprecedented. It saw the inaugural participation of an inventor from Andorra, a country better known for the beauty of its landscapes than for its inventions. This milestone welcomed a new nation into the global fraternity of inventors, highlighting the universal appeal of invention and innovation. The inclusion of Andorra underlined the event’s commitment to inclusion and the promotion of creativity, regardless of a nation’s size or importance on the world stage.

Jacques Gascuel’s Gold Medal: A Breakthrough for Data Security and Privacy

This technology uses segmented key authentication, a disruptive innovation that redefines data security, access, confidentiality and individual sovereignty. This technique creates, exchanges and uses contactless secrets, using physical trust factors (authorized geographical area, local network BSSID, telephone identifier and/or barcode and/or password or original biometric elements (fingerprint , facial recognition, DNA, etc.). If a segment is not validated, the secret is physically and digitally unusable. Thus, sensitive data (such as personal, financial, medical, professional, etc.) is protected against any unauthorized access, modification, disclosure or destruction. Jacques Gascuel has shown the spirit and power of invention and innovation, as defined by WIPO. His invention is already used in the United States, China , in South Korea, Europe, Japan and Algeria.

A Message for Inventors Around the World

This historic achievement sets an inspiring example for inventors around the world. It shows that innovation knows no borders and that even the smallest of nations can have a significant impact on the global stage. The Geneva International Inventions Fair 2021 celebrated not only inventors and their creations, but also the collaborative and inclusive spirit of the inventions community. Innovation is the implementation of a new or significantly improved product or process, a new marketing method or a new organizational method, according to the OECD.

A Reminder of Innovation’s Role in Progress

As we reflect on this exceptional event, we are reminded that innovation drives progress and that inventions like the EviCypher HSM are paving the way for a more secure and connected future. It is a testament to the unwavering human spirit and the limitless potential of inventors to shape a better world through their creations. The 2021 Geneva International Exhibition of Inventions stands as a shining example of how innovation can transcend boundaries, bringing nations together in celebration of human creativity and ingenuity.

Conclusion

We look forward to future editions of this prestigious event, where inventors from around the world will continue to push the boundaries of what is possible and redefine the future. To participate in this event, inventors must hold a patent or have filed a patent application for a patentable concept. Therefore, it is essential to distinguish between invention and innovation and to celebrate both.

In the end, it’s not just about winning medals; it’s about changing the world, one invention at a time. And in this endeavor, inventors like Jacques Gascuel are leading the way.

EviCypher Technology NFC hardware wallet encryption key manager password manager gold medal 2021 of the Geneva international inventions secret keeper management by Freemindtronic Andorra

Downloads and more informations:

More information of golden Medal EviCypher NFC HSM click here 
Download list of participants in alphabetical order click here
Download Geneva-Exhibition-Brochure.pdf click hereD
ownload press releases: The following press releases are freely available for download click here