[001] The invention pertains to a method by which an attempt to attack a security processor is detected by the security processor itself. An object of the invention is also an information-recording medium as well as a security processor to implement this method.
[002] Security processors are generally hardware components containing confidential information such as cryptographic keys or access rights which only legitimate users can use. To preserve the confidentiality of this information  these processors are designed to be as robust as possible against attack attempts by computer hackers. For example  a security processor is a chip card equipped with an electronic processor.
[003] Security processors are subjected to different types of attack. Some of these attacks are aimed at extracting or determining the confidential information contained in the security processor. To this end  a multitude of attacks have been developed. For example  certain of these attacks seek to obtain an abnormal functioning of the security processor by making it process messages built by computer hackers. Other more invasive methods try to disturb the functioning of the security processor at key moments in its operation by playing on its supply voltage or again by means of a laser beam directed towards the security processor.
[004] Other types of attack do not seek to extract or determine the confidential information contained in the security processor but consist simply of the abusive use of this security processor. For example  in pay television  control sharing and card sharing come under this type of attack. To put it briefly  control sharing consists of the sharing of the control word deciphered by the security processor amongst several receivers. These receivers can then decipher the scrambled multimedia contents with this control word whereas the subscription has been paid for by only one receiver.
[005] In card-sharing a same security processor is made to decipher several enciphered control words coming from different receivers. As above  all these receivers can then descramble the scrambled multimedia contents whereas only one of these receivers is entitled to access the content.
[006] To combat these attacks  there are known ways of detecting attack attempts and  in response to this detection  to execute countermeasures.
[007] One example of a method for detecting attack attempts and for executing countermeasures in response is described for example in the patent application EP 1 575 293.
[008] A countermeasure is an action aimed at preventing an attack against the security processor from being long-lasting or successful. There are a large number of countermeasures that can be executed by a security processor. These measures range from a simple increase in security measures in the security processor up to the definitive and irreparable blocking of the security processor which then becomes unusable.
[009] Methods for detecting an attack attempt have already been proposed. These methods comprise:
measuring several different events occurring independently of one another in the absence of attack attempts  then
comparing each measurement with a predetermined respective threshold to detect the presence or absence of an attack attempt.
[0010] However  the difficulty comes from the fact that the events representing an attack attempt can also occur when there is no attack attempt. Now  it is necessary to prevent the production of false detections of attack attempts because these may result in the untimely execution of countermeasures which then inconvenience the legitimate user of the security processor. For this reason  there are known ways of choosing a far higher value for the predetermined threshold than the values of all the measurements that can be obtained when there are no attacks. However  the choice of a high predetermined threshold makes certain attacks undetectable or slows down the detection of an attack attempt.
[0011] The invention seeks to overcome this problem by proposing a method for detecting an attack attempt which also comprises:
- building a value of at least one attack indicator as a function of at least one index of concomitance between at least two different events measured  the index of concomitance representing the temporal proximity between the two different events measured  and
- detecting an attack attempt if the value of the attack indicator crosses a predetermined threshold.
[0012] The above method takes account of the temporal proximity between different events occurring in the security processor. This enables the swifter detection of an attack attempt or the detection of an attack attempt that could not be detected by observation of the measurement of a single event. Indeed  it can happen that the measurement of each of these events  taken individually  does not constitute a speedy representation of an attack attempt since these events occur during a normal operation of the security processor. On the contrary  when these events occur almost concomitantly whereas they should normally occur independently of one another  it can be taken to mean  with a high degree of confidence  that an attack attempt has taken place. The above method therefore enables the security processor to make a swift detection  with a high degree of confidence  of detect the fact that it has been the victim of an attack attempt. The execution of appropriate countermeasures can then be activated with greater speed.
[0013] The embodiments of this method may comprise one or more of the following characteristics:
the value of the attack indicator is built out of several indices of concomitance between different events measured and by weighting the importance of these indices of concomitance relatively to one another by means of a predetermined set of weighting coefficients;
the method comprises the building of several attack indicator values through the use of several different sets of weighting coefficients between the same indices of concomitance  each set of weighting coefficients being predetermined so as to be more sensitive to an attack attempt that is different from the ones to which the other indicators are more sensitive;
the weighting coefficient of a same index of concomitance is the same in all the sets of weighting coefficients used to build the different attack indicator values;
the measurement of an event is limited to a sliding time slot so as to not take account of events have occurred outside this time slot  this being done so to establish the fact that these events are concomitant in the measurement of this time slot;
at least one of the events measured is the detection of an error in the functioning of the security processor  each occurrence of which leads the security processor to stop the processing operations in progress and to get automatically reset to resume these operations from the start;
the measurement of an event lies in the counting  in a counter  of the number of times that this event has occurred  the value of the counter constituting the measurement;
the index of concomitance between at least two measurements is obtained by multiplying these measurements with one another. l
[0014] These embodiments of this method furthermore have the following advantages:
the use of weighting coefficients between the indices of concomitance simply modifies the sensitivity of the attack indicator built to a particular type of attack by modifying the value of these weighting coefficients 
the use of several different sets of weighting coefficients makes it possible  in using the same set of indices of concomitance  to build several attack indicators each dedicated to the detection of a different attack attempt 
the systematic use of the same weighting coefficient for the same index of concomitance limits the quantity of memory required to store these different weighting coefficients 
limiting the measurement of an event to a sliding time slot limits the number of false detections of attack attempts caused by the accumulation in time of measured events when there are no attack attempts 
when one of the measured events is the detection of an error of the security processor causing this security processor to be reset  then the security is increased through prevention of the untimely blocking of this security processor.
[0015] An object of the invention is also an information-recording medium comprising instructions for executing the above method  when these instructions are executed by an electronic computer.
[0016] Finally  an object of the invention is also a security processor comprising:
- registers in which there are stored measurements of several events occurring independently of one another in the absence of attack attempts  and
- a computer capable of
building the value of at least one attack indicator as a function of at least one index of concomitance between at least two different events measured  the measurements of which are stored in the registers  this index of concomitance representing the temporal proximity between the two different events measured  and
detecting an attack attempt if the value of the attack indicator crosses a predetermined threshold.
[0017] The invention will be understood more clearly from the following description  given purely by way of a non-restrictive example and made with reference to the appended drawings of which::
Figure 1 is a schematic illustration of a system for transmitting scrambled multimedia contents that comprises a security processor 
Figure 2 is a schematic illustration of a matrix of weighting coefficients used by the security processor of the system of Figure 1 
Figure 3 is a schematic illustration of a table of warning thresholds used by the security processor of Figure 1  and
Figure 4 is a flowchart of a method for detecting an attack attempt on the security processor of the system of Figure 1.
[0018] In these figures  the same references are used to designate the same elements.
[0019] Here below in this description  the characteristics and functions well known to those skilled in the art shall not be described in detail. Furthermore  the terminology used is that of systems ofr conditional access to multimedia contents. For more information on this terminology  the reader may refer to:
“Functional model of a conditional access system” EBU Review – Technical
European Broadcasting Union  Brussels  BE  No 266  21 December 1995.
[0020] Figure 1 represents a system for subscriber broadcasting of multimedia contents. For example  the system 2 is a system for broadcasting several scrambled television channels. The descrambling of each of these television channels or groups of television channels is conditional upon the payment of a subscription by subscribers. In this description  the terms “scramble”/“encipher” and “descramble”/“decipher” are considered to be synonymous.
[0021] The system 2 has at least one transmitter 4 of scrambled multimedia contents and a multitude of receivers capable of descrambling the multimedia content broadcast by the transmitter 4. To simplify Figure 1  only one receiver 6 has been shown. For example  the other receivers are identical to the receiver 6.
[0022] The receiver 6 is connected to the transmitter 4 by means of a long-distance information-transmitting network 8. The network 8 may be a wireless communications network or a wired network such as the Internet.
[0023] Typically  the transmitter 4 broadcasts multiplexed scrambled multimedia contents with ECM (Entitlement Control Message) and EMM (Entitlement Management Message) type control messages. Each ECM message comprises at least one cryptogram CW* of a control word CW used to descramble the scrambled multimedia content.
[0024] The receiver 6 has a decoder 10 and a security processor 12 connected detachably to the decoder 10.
[0025] The decoder 10 has a receiver 14 of the data transmitted by the transmitter 4 connected to a demultiplexer 16. The demultiplexer 16 demultiplexes the data received and transmits the scrambled multimedia content to a descrambler 18 and the ECM or EMM messages to the security processor 12.
[0026] The processor 12 receives the cryptogram CW* and deciphers this cryptogram in order to send the control word CW in unencrypted form to the descrambler 18. This deciphering is permitted only if the access rights contained in the ECM correspond to the access rights stored in the security processor 12. For example  the processor 12 is the processor of a chip card.
[0027] The descrambler 18 descrambles the scrambled multimedia content by means of the control word CW deciphered by the security processor 12. The descrambled multimedia content is then for example displayed in unencrypted form on a screen 20 so that the displayed multimedia content is directly perceptible and comprehensible to the user.
[0028] The functions and characteristics of the processor 12 for performing the different operations related to the deciphering of the control word CW are known and shall not be described herein in greater detail.
[0029] The processor 12 has an electronic computer 24 connected to sensors 26  27 and a set 30 of registers.
[0030] The sensor 26 has a voltage transducer capable of converting the power voltage of the processor 12 into a piece of digital data that can be exploited by the computer 24.
[0031] The sensor 27 comprises a light transducer capable of converting the photons of a laser beam directed to the processor 12 into digital data that can be exploited by the computer 24.
[0032] By way of an illustration  the set 30 comprises eleven registers referenced C0 to C10. Each of the registers C1 to C10 is designed to contain a measurement of an event which may be activated by an attack attempt on the processor 12. The measured events may also occur in the absence of attack attempts. However  when there is no attack attempt  these measured events occur independently of one another. Thus  it is improbable that the measured events will occur concomitantly when there is no attack attempt. The term “concomitantly” designates the fact that these events occur during a same time slot. Here  one time slot is associated with each measured event. This time slot may have a finite duration or on the contrary an infinite duration. In the case of a finite duration it means that the events which occur outside this time slot are not taken into account in the measurement of this event. Here  a time slot of finite duration is a sliding time slot. This sliding time slot has a finite duration which is shifted as and when time elapses  so that only the most recent events are taken into account for the measuring of this event. An infinite duration means that all events  starting with the time of activation of the measurement of this event  are taken into account for the measurement.
[0033] Here  the measurement of an event consists in counting the number of times in which this event has occurred during the time slot associated with this event. Thus  each of the registers contains a number representing the number of occurrences of a same event. Consequently  here below in the description  the registers Ci are called counters Ci.
[0034] There are a large number of measurable events. Typically  the measured events come under one of the following categories:
normal events that a legitimate user can activate but which  if they occur in large numbers  represent an abnormal use of the processor 12 
the reception by the processor 12 of erroneous or unnecessary images  i.e. messages which do not exist during normal and error-free use 
the detection of errors of functioning of the processor 12.
[0035] There are many errors of functioning. For example  the errors of functioning may be errors in the execution of the code of the operating system of the processor 12  an abnormal situation measured by the sensors 26 or 27  errors of integrity discovered in the data processed  etc. In general  in the event of a detection of operating errors  the processing operations in progress are interrupted and the processor 12 gets automatically reset.
[0036] An example of events measured for each counter shall now be described in detail.
[0037] The counter C1 contains the number of times in which a command for consulting data from the processor 12 has been received. Indeed  a certain number of pieces of data contained in the processor 12 can be freely consulted. For example  there are commands for consulting the identification number of the processor 12 or access rights recorded in the processor 12. The reception of a consultation command is therefore a normal event so long as it remains occasional. However  the counting of a large number of commands for consulting data in the processor 12 within a short period of time may be caused by an attack attempt.
[0038] The counter C2 indicates a presence of unusual rights recorded in the processor 12. An unusual right is a right which the operator of the system 12 does not normally use. For example  most operators never record a right in the security processors for which the duration of validity is greater than one year. This means that a right recorded in the processor 12 with a duration of validity greater than one year  for example a right with an infinite duration of validity  is an unusual right even if this possibility is technically provided for. Similarly  normally the operator never records a right authorizing access to and deciphering of all the multimedia contents in the security processors. Thus  the registering of a right permitting access to all the multimedia contents in the processor 12 is considered to be an unusual right. The recording of an unusual right in the processor 12 may come from an error by the operator but may also represent an attack attempt.
[0039] The counter C3 counts a number of messages received by the processor 12 that have no functional utility for the processor. For example  such a message with no functional utility may be:
a message for consulting data that is non-existent in the processor 
a message for erasing a non-existent piece of data (for example access code etc) in the processor  or
two successive messages for reading the same piece of data in the processor 12.
[0040] These messages are syntactically correct and do not prompt any error of execution in the processor 12. However  they are unnecessary. Such unnecessary messages may be sent erroneously by the operator. They may also be used during an attack attempt.
[0041] The counter C4 counts the number of syntax errors in the messages transmitted to the processor 12  i.e. in the ECM and EMM messages transmitted to this processor. Indeed  the syntax or structure of the ECM and EMM messages complies with a predetermined grammar. The processor 12 can therefore detect these errors of syntax and count them in the counter C4. The errors of syntax can be caused by an error of the operator but also during an attack attempt.
[0042] The counter C5 is a counter of replayed commands whereas they should normally not have to be replayed several times. The replaying of a command consists in sending the security processor the same command several times. For example  the command may be an updating message for updating certain pieces of data recorded in the processor 12. A replay of a message can be detected by the processor 12 by recording the date of the last updating message.
[0043] The counter C6 counts the number of integrity errors detected in the messages received by the processor 12. Indeed  the messages received by the processor 12 contain data as well as a cryptographic redundancy of these pieces of data  enabling the processor 12 to check that there is no error in the data received. For example  redundancy in data may be obtained by integrating a signature or a CRC (Cyclic Redundancy Check) of the data contained in this message. Errors in the data contained in the message may be prompted by disturbances when they are being transported in the network 8 or in the decoder 10. However  erroneous data are also used during an attack attempt.
[0044] The counter C7 counts the number of integrity errors in the pieces of data contained in the processor 12. Indeed  a certain number of pieces of data recorded in the processor 12 are associated with a cryptographic redundancy used to check the integrity of the respectively recorded pieces of data. Once again  it can happen accidentally following for example electromagnetic disturbances that a piece of data recorded in the processor 12 will be erroneous. However  the presence of erroneous data recorded in the processor 12 can also represent an attack attempt.
[0045] The counter C8 counts the number of bad branches during the execution of the execution of the code of the operating system of the processor 12. A bad branch is an untimely or erroneous jump in an instruction executed by the processor 12 to another instruction. These bad branches in the execution of the code may be detected by executing the same instructions on the same pieces of data twice in succession. If the two executions of the code do not give the same result  this means that there has been a bad branch. Untimely jumps from instructions in the code executed by the processor 12 may be prompted by playing on the supply voltage of the processor 12 or directing a laser beam toward this processor 12.
[0046] The counter C9 counts the number of times that the data retrieval procedure is executed after the processor 12 has been wrenched out. The wrenching out of the processor 12 consists of the removal of the processor 12 from the decoder 10 during operation so that the power supply to the processor 12 is interrupted during data processing. The data retrieval procedure makes it possible  after such a power cut  to return the processor 12 to the state in which it had been before the power cut. The processor 12 can be accidently wrenched out of the decoder 10. However  untimely cuts in power supply to the processor 12 are also frequently used during an attack attempt to prevent the execution of countermeasures by the processer 12.
[0047] The counter C10 counts the number of times that the abnormal power supply is measured by the sensor 26 totalled up with the number of times that a laser beam is detected by the sensor 27. Indeed  abnormal voltages as well as the presence of a laser beam are typical of an attack attempt on the processor 12. However  these sensors 26 and 27 can also detect abnormal voltage or the presence of a laser beam accidentally following for example electromagnetic disturbances caused by an apparatus in the vicinity of the processor 12  even when there is no attack attempt. For example  the powering on of the decoder 12 can result in the detection of an abnormal voltage by the sensor 26.
[0048] The counter C0 must be distinguished from the previous counters because it counts an event which that occurs only during normal operation of the processor 12 and cannot be caused by an attack attempt. For example  the event counted by the counter C0 here is the number of ECM and EMM messages properly processed by the processor 12.
[0049] The value of this counter C0 is used to limit the temporal memory of certain previous counters to a sliding time slot with finite duration. For example  to this end  the value of the counter C0 is subtracted from the value of the counter Ci  where i > 0  and only the difference between these two counters  brought to 0 if it is negative  is used to compute an index of concomitance as described further below. For example here  except for the value of the counters C8 and C10  only the difference between the values of the counters Ci and C0 is used to compute indices of concomitance. Through the use of the value of the counter C0  the events that have occurred outside the sliding time slot thus defined are not taken into account to detect an attack attempt. It will be noted that the duration of the sliding time slot defined by means of the counter C0 is not constant and depends on the use made of the processor 12.
[0050] The computer 24 is connected to a memory 32 containing the different pieces of data and instructions needed for the functioning of the processor 12. In particular  the memory 12 comprises:
instructions needed to compute the method of Figure 4 when they are executed by the computer 24 
a matrix 36 of weighting coefficients and a table 38 of warning thresholds.
[0051] An example of a matrix 36 is represented in greater detail in Figure 2. This matrix 36 contains as many pieces of data as there are event counters liable to be activated by an attack attempt. Here  the matrix 36 is therefore a matrix with 10 columns each associated with a counter Ci. The matrix 36 also contains nine rows associated respectively with the counters C2 to C10.
[0052] The cell situated at the intersection of the ith column from the left and the jth row from the top contains a weighting coefficient mi j associated with an index of concomitance CiCj+1. An index of concomitance CiCj+1 is an index computed from the value of the counters Ci and Cj+1 which gives an indication on the concomitance between the events counted by the counter Ci and those counted by the counter Cj+1. Here  each index of concomitance is built so that its value is all the higher as a large number of events measured respectively by the sensors Ci and Cj+1 have occurred in proximity at the same instant. To this end  in this embodiment  each index of concomitance CiCj+1 corresponds to the product of the values of the counters Ci and Cj+1 at the same point in time.
[0053] The table of warning thresholds 38 illustrated in Figure 3 comprises a first column containing four warning thresholds S1 to S4. Each warning threshold is a numerical value and these warning thresholds are classified in rising order from top to bottom in the table 38.
[0054] The table 38 also has a second column associating one or more countermeasures denoted as CMi with each threshold Si. The countermeasures are actions executed by the security processor 12 which are designed to make it more difficult to extract or determine data contained in the processor 12 or wrongfully use this processor 12.
[0055] Here  the countermeasures CMi associated with the threshold Si are less strict and entail fewer penalties for the user of the processor than those associated with the higher warning threshold Si+1. Thus  the higher the warning threshold Si crossed  the stricter will be the countermeasures CMi executed in response.
[0056] By way of an illustration  the countermeasures CM1 consist of the adding of a redundancy to the additional branching of the code to be executed by the processor 12. For example  this redundancy is obtained by executing the conditional branch several times and checking that the result obtained is the same at each execution.
[0057] The counter measure CM1 consists in furthermore adding redundancy to the operations for checking the integrity of the processed data. For example the integrity of the data is checked several times whereas  if the threshold S1 is not crossed  it is verified only once. It also consists in checking the integrity of the data whose integrity is not checked if the threshold S1 is not crossed.
[0058] The countermeasures CM2 consist for example in adding restrictions to the possibilities of stringing instructions of the code executed by the processor 12. This can be obtained by forcing the processor 12 to execute a full block of instructions without allowing for any interruption between the execution of the instructions of this block.
[0059] The countermeasure CM2 also consists in eliminating certain functions of the processor 12 hitherto permitted when the threshold S2 was not crossed. For example  the addition of new services such as the addition of a new operator or a new subscriber is prohibited. The access to the administrative functions of the processor 12 can also be prohibited if the threshold S2 is crossed.
[0060] For example  the countermeasures CM3 consist in modifying the weighting coefficients present in the matrix 36 so that the upper threshold  i.e. S4 is easily and speedily reached when events are measured. Thus  as described with reference to Figure 4  the sensitivity of the processor 12 to the detection of an attack attempt is increased. The countermeasures CM3 also include the systematic and duplicate checking of the integrity of each message received. The countermeasure CM3 can also consist in boosting controls on the execution flow. This may especially consist getting each portion of an executable code to be executed twice by the processor 12 and in checking  by comparison at the end of these two executions  that the results obtained are the same. In the event of discrepancy between the results obtained  the counter C8 is incremented.
[0061] Finally  the countermeasures CM4 definitively invalidate the processor 12 so that it is definitively unusable. For example  to this end  the confidential information contained in the processor 12 is erased.
[0062] The functioning of the processor 12 shall now be described in greater detail with reference to the method of Figure 4.
[0063] Along with the normal operation of the processor 12  this processor also executes a method for detecting an attack attempt. To this end  at a step 50  it measures events likely to have been caused by an attack attempt. Here  this measurement consists in counting the corresponding event in the counters Ci.
[0064] Then  during a step 52  the processor 12 builds three attack indicators  I1  I2 and I3 respectively.
[0065] The indicator I1 is conceived so as to be more sensitive to attack attempts using laser disturbance than the indicators I2 and I3. An attack by laser disturbance consists in pointing a laser beam to the security processor to prompt instruction jumps in the code executed by this processor at key moments in its execution. The key moments typically correspond to conditional branches.
[0066] Here  the value of the indicator I1 is given by the following relationship:
I1 = m2 6C2C7 + m2 7C2C8 + m2 9C2C10 + m7 7C7C8 + m7 9C7C10 + m8 9C8C10
where :
mi j is the weighting coefficient  the value of which is contained in the matrix 36.
[0067] The indicator I2 is designed to be more sensitive to logic attacks than the other two indicators. A logic attack consists in making a search for a logical flaw or an error of implementation in the code executed by the processor 12 so as to obtain an abnormal behavior in this processor. For example  the logic attack consists in sending a very large number of erroneous messages to the processor 12 which are all different from one another until one of these messages prompts an abnormal behavior in the processor 12.
[0068] For example  the value of the indicator I2 is built by means of the following relationship:
I2 = m1 2C1C3 + m1 3C1C4 + m3 3C3C4
[0069] Finally  the indicator I3 is designed to be more sensitive to DPA (Differential Power Analysis) attack attempts. A DPA attack is an attack in which a large number of messages are sent to the processor 12 to prompt a large number of executions of cryptographic algorithms on a large number of different pieces of data and at the same time the consumption of current of the processor 12 is measured. Then  through a statistical analysis on the data collected  it is possible to discover the values of the keys or confidential data recorded in the processor 12.
[0070] For example  the indicator I3 is built by means of the following relationship:
I3 = m4 4C4C5 + m4 5C4C6 + m5 5C5C6.
[0071] Then  once the value of the indicators I1 to I3 has been built  in a step 54  the value of these indicators is compared with the different warning thresholds recorded in the table 38 to detect an attack attempt.
[0072] If none of these indicators has had its value cross the threshold Si then  in a step 56  no countermeasure is executed.
[0073] Conversely  if the value of one of these indicators crosses one of the thresholds Si  then a countermeasure associated with the highest crossed threshold l Si is executed in a step 58.
[0074] At the end of the steps 56 and 58  the method returns to the step 50.
[0075] At the same time as the steps 50 to 58  during a step 60  the transmitter 4  using for example an EMM or ECM type message  transmits new values for the weighting coefficients. Then  in a step 62  the processor 12 receives this message and updates the values of the weighting coefficients contained within the matrix 36.
[0076] The updating of the weighting coefficients makes it possible to easily modify the sensitivity of an indicator to a particular attack attempt. In particular  it may be noted that  to modify this sensitivity of the indicator to a particular attack attempt  that is necessary only to modify the weighting coefficients recorded in the matrix 36 without its being necessary to modify other instructions executable by the processor 12.
[0077] Many other embodiments are possible. For example  the processor 12 can include several different matrices of weighting coefficients. Each of these matrices can be used to compute a respective attack indicator. This then makes it possible to assign each index of concomitance a different weighting coefficient as a function of the attack indicator built. The use of several weighting coefficient matrices can also be useful for modifying the weighting matrix used when a new warning threshold is crossed.
[0078] Conversely  a single attack indicator can be built instead of several indicators.
[0079] As a variant  there are as many warning threshold tables as there are attack indicators built. In this variant  the warning thresholds associated with one particular attack indicator are not necessarily the same as the warning thresholds associated with another attack indicator.
[0080] The table 38 can also be replaced by a single warning threshold associated with countermeasures.
[0081] One of the counters Ci can simply account for the existence of an event without counting the number of occurrences of this event. In this case  the value of this counter is encodable by means of a single information bit. Even in this case  the value of the existence counter can be associated with a time slot of infinite or finite duration.
[0082] Sensors other than those described can be implemented in the processor 12. For example  the processor 12 can also include a temperature sensor.
[0083] The index of concomitance is not limited to the product of two measurements. For example  it may also correspond to a product of more than two measurements. However  the increase in the number of measurements multiplied together also increases the size of the matrix of weighting coefficients.
[0084] It is also possible to compute an index of concomitance representing the time proximity between at least two events by mathematical operations other than a multiplication.
[0085] Many countermeasures other than those indicated here above can be executed in response to the crossing of a warning threshold by one of the attack indicators. For example  other countermeasures may consist in modifying the cryptographic algorithm executed by the processor 12. A countermeasure can also consist of the use of or the measurement of many events to build an attack indicator which hitherto was not measured. For example  in response to the crossing of a warning threshold  the events measured by one of the sensors 26 or 27 can be counted whereas they were not counted previously.
[0086] The computer 24 can be formed by one or more processors. For example  it can be formed by a processor with which there is an associated co-processor. The method of detection can then be executed both by the processor and by the co-processor.
[0087] The measurement has been described here in the particular case where the number of occurrences of an event has to be counted. However  the measurement can also consist of the recording  in one of the registers  of the value of an event such as for example a value measured by one of the sensors 26 or 27. To count the number of occurrences of an event  the value of the counters can also be decremented instead of being incremented as described here above.
[0088] The architecture of the receiver 6 is herein illustrative solely of a particular situation. In particular  the descrambler 18 can also be detachable. Conversely  the descrambler and the security processor can be implemented without any degree of freedom in the decoder. In this case  the descrambler and the security processor can take the form of software components.
CLAIMS

1. Method wherein an attempt to attack a security processor is detected by the security processor itself  this method comprising measurements (50) of several different events occurring independently of one another in the absence of attack attempts 
characterized in that the method also comprises:
- obtaining at least one index of concomitance between at least two measurements by multiplying these measurements with one another   the index of concomitance representing the temporal proximity between the two different events measured 
- building (52) the value of at least one attack indicator as a function of said at least one index of concomitance between at least two different events measured  and
- detecting (54) an attack attempt if the value of the attack indicator crosses a predetermined threshold.

2. Method according to claim 1  wherein the value of the attack indicator is built (52) out of several indices of concomitance between different events measured and by weighting the importance of these indices of concomitance relatively to one another by means of a predetermined set of weighting coefficients.
3. Method according to claim 2  wherein the method comprises the building (52) of several attack indicator values through the use of several different sets of weighting coefficients between the same indices of concomitance  each set of weighting coefficients being predetermined so as to be more sensitive to an attack attempt that is different from the ones to which the other indicators are more sensitive
4. Method according to claim 3  wherein the weighting coefficient of a same index of concomitance is the same in all the sets of weighting coefficients used to build the different attack indicator values.
5. Method according to any one of the above claims  wherein the measurement (50) of an event is limited to a sliding time slot so as to not take account of events have occurred outside this time slot.
6. Method according to any one of the above claims  wherein at least one of the events measured is the detection of an error in the functioning of the security processor  each occurrence of which leads the security processor to stop the processing operations in progress and to get automatically reset to in order to resume these operations from the start.
7. Method according to any one of the above claims  wherein the measurement (50) of an event lies in the counting  in a counter  of the number of times that this event has occurred  the value of the counter constituting the measurement.
8. Information-recording medium characterized in that it comprises instructions for executing a method for detecting according to any one of the above claims  when these instructions are executed by an electronic computer.
9. Security processor comprising:
- registers (C1 to C10) in which there are stored measurements of several events occurring independently of one another in the absence of attack attempts  and
- a computer (24)
- characterized in that the computer (24) is capable of
- obtaining at least one index of concomitance between at least two measurements by multiplying these measurements with one another  the measurements of which are stored in the registers  the index of concomitance representing the temporal proximity between the two different events measured 
- building the value of at least one attack indicator as a function of saidat least one index of concomitance between at least two different events measured  and
- detecting an attack attempt if the value of the attack indicator crosses a predetermined threshold.