FR3049807A1 - TECHNIQUE FOR CONTROLLING ACCESS TO A RADIO ACCESS NETWORK - Google Patents

Abstract

The invention relates to a technique for controlling access to a radio access network administered by an access device. This obtains (E1) data indicating that a presence of a user has been detected in a detection zone. A security function for limiting access to the radio access network to authorized devices is then inhibited by the access device. An access request (M3) to the radio access network is received (E30) from a requesting device. When the requesting device has accessed the radio access network, the security function is activated again (E50).

Description

The invention relates to the general field of telecommunications. The invention more particularly relates to a technique for controlling access to a radio access network administered by an access device. This access device implements at least one security function for limiting access to the radio access network to authorized devices.

The access device corresponds for example to a radio access point. This radio access point may be implemented by an access gateway, allowing user devices located in a customer site to access a Wide Area Network (WAN), such as the Internet network. These devices correspond, for example, to a set-top-box TV decoder, a mobile terminal. Some of these devices exchange data in the local area network via the radio access network, via radio communication channels, using, inter alia, wireless transmission technology based on the IEEE 802.11 radio network standard. and its developments commonly referred to as Wi-Fi (for "Wireless Fidelity"). In order to enhance the security on the radio access network, the access device can also implement a security function, making it possible to limit access to the radio access network to authorized devices.

Such a security function corresponds, for example, to not broadcasting an identifier of the radio access network. In this case, a pilot signal broadcast periodically by the access device does not include a network identifier and the access device does not respond to "Probe Request" messages sent by user devices and asking the access devices to declare themselves. Thus, the radio access network is not identifiable by a receiving device that performs a scan of the available access networks. In order to connect to the radio access network, a user of a requesting device must interact with his man-machine interface in order to enter the radio access network identifier and a security key, which can be judged as binding by this user.

Another example of such a security function is a function known as filtering based on physical addresses, such as MAC addresses (for "Medium Access Control"). Such a MAC address makes it possible to identify each device. The filtering function based on MAC addresses makes it possible to limit access to devices whose MAC address is known by the access device. A device whose address is not allowed can thus access the radio access network. The implementation of this security function raises the problem of managing the MAC addresses authorized to connect, particularly in the case of devices temporarily connecting to the radio access network. It is generally complex for a user of the access device to define the allowed MAC addresses. It is necessary initially that it connects as an administrator to run an administration software of the access device. For some types of access points, the administrator must then manually enter the authorized MAC addresses. It is recalled here that the MAC address is in the form of six pairs of characters composed of digits, from 0 to 9, and letters from a to f, for example 59: le: 4a: c4: 21: 04. For other types of access points, the administrator can enable filtering without setting any allowed MAC addresses and then being prevented from accessing a configuration menu for the feature because of its access with an unauthorized wireless device.

For these reasons, these security functions are generally not implemented.

One of the aims of the invention is to remedy the shortcomings / disadvantages of the state of the art and / or to make improvements thereto.

According to a first aspect, the subject of the invention is a method of controlling access to a radio access network administered by an access device. This method comprises: - obtaining a data indicating that a presence of a user has been detected in a detection zone; - Inhibition of at least one security function, said security function for limiting access to the radio access network to authorized devices; - reception by the access device from a device requesting a request for access to the radio access network; - when the requesting device has accessed the radio access network, activation of the security function.

By authorized device is meant a user device that shares information with the access device. When the security function is the absence of broadcast of a network identifier in the pilot signal or the absence of response to discovery messages, an authorized device is a device whose user knows the network identifier. When the security function is the address filtering function, the authorized device is a device whose address is stored by the access device.

By access request is meant a message sent by the requesting device to the access device.

The data indicating that a presence of a user has been detected is for example obtained from a presence detector sensor. This sensor can be integrated into the access device or co-located with it. The detection zone thus depends on performance and a configuration of a presence detector.

The security function is a function that makes it possible to limit access to low layers, the physical layer or even the media access control sub-layer.

The access device is for example an access gateway, allowing the devices of a local network to access a WAN extended communication network. Such an access gateway is installed in a dwelling and the presence of a user in the detection zone is thus restricted to persons of this dwelling or authorized to access it.

In a particular embodiment, the radio access network is a Wi-Fi radio network.

The various embodiments or features mentioned below may be added independently or in combination with each other, to the steps of the access control method as defined above.

In a particular embodiment, an activated security function comprises a prohibition of access to the radio access network by the access device for a physical address device corresponding to that of said requesting device.

In other words, in this embodiment, the access method comprises: - obtaining data indicating that a presence of a user has been detected in a detection zone; - reception by the access device from a device requesting a request for access to the radio access network, access to the radio access network being prohibited by the access device for a device of access physical address corresponding to that of said requesting device; - Authorization, by the access device, access to the radio access network of the requesting device identified by said address.

A physical address is an address identifying a device. This address is transmitted by the device for access at the media access control MAC sub-layer. It is known as the MAC address.

Prior to the access device receiving the access request, the requesting device is not allowed access to the access network, although it may share a secret key with the access device. This is particularly the case when the access device implements a filter function based on physical addresses identifying devices authorized to access.

In this particular embodiment, the access to the radio access network of a physical address device corresponding to that of the requesting device becomes permitted, without the need for a connection of an administrator of the access device to a software of access. administration of the latter. Management of access permissions is thus very simple for the administrator of the access device. Because of this simplicity, the security for accessing the resources offered by the access device can be increased by implementing the filtering function based on physical addresses.

An access request includes a physical address of the requesting device. According to the implementations of the address-based filtering function at the access device, the access request may correspond to an association request message (or "Association Request"), a request message of Authentication (or Authenticate)

Request ") or any other message sent by the requesting device at the media access control MAC sublayer.

In a particular embodiment, the requesting device identified by said address becomes a device authorized by the access device for access to the radio access network.

The authorized physical addresses are for example managed in the form of a list of authorized devices. The address of the requesting device is added to this list of authorized devices when the user is in a detection zone.

Thus, during a subsequent access, the user must not be in the detection zone to be able to access the access network.

In a particular embodiment, the inhibition of a security function comprises a broadcast by the access device of an identifier of the radio access network triggered by said obtaining of data.

In a particular embodiment, the access method comprises: - obtaining data indicating that a presence of a user has been detected in a detection zone; broadcasting by the access device of an identifier of the radio access network triggered by said obtaining of data; - reception by the access device from a device requesting a request for access to the radio access network; - Authorization, by the access device, access to the radio access network of the requesting device identified by said address.

By default, the broadcast of the access network identifier is not activated. Thus, the radio access network is not identifiable by devices that are not authorized to access.

Once a presence is detected in the detection zone, the network identifier is broadcast to allow an unauthorized device to detect the radio access network. The requesting device can then establish a connection with the access device.

This embodiment can be implemented cumulatively with the security function of filtering based on physical addresses, described above. The requesting device can thus become a device authorized to access this address filtering function.

In a particular embodiment, the access method comprises: - obtaining data indicating that a presence of a user has been detected in a detection zone; broadcasting by the access device of an identifier of the radio access network triggered by said obtaining of data; - reception by the access device from a device requesting a request for access to the radio access network, access to the radio access network being prohibited by the access device for a device of access physical address corresponding to that of said requesting device; - Authorization, by the access device, access to the radio access network of the requesting device identified by said address.

Thus, the security for accessing the resources offered by the access device can be further increased, by conditioning the broadcast of the network identifier to a detection of a presence of a user in the detection zone.

In a particular embodiment, the security function is inhibited only during a time interval subsequent to said obtaining.

The diffusion of the network identifier or the modification of the access authorizations are thus possible only for a limited time once the data obtained.

In a particular embodiment, the access control method further comprises obtaining another data indicating that an output of a user of the detection zone has been detected, and in which the security function is again inhibited after obtaining said other data.

Thus, the radio access network does not remain visible or open, depending on the embodiments, to allow new devices, once the output of the detected detection area.

According to a second aspect, the invention also relates to a device for accessing a radio access network, said device comprising; a module for obtaining data, arranged to obtain data indicating that a presence of a user has been detected in a detection zone; a reception module, arranged to receive from a device requiring a request for access to the radio access network; - A security module, arranged to implement at least one security function to limit access to the radio access network to authorized devices; a control module, arranged to inhibit the security function when data indicating that a presence of a user has been detected in a detection zone is obtained and to activate the security function when the requesting device has accessed the security function; radio access network.

In a particular embodiment, the security module is in particular arranged to allow access to the radio access network to the requesting device identified by said address, when the security function is inhibited, access to the radio access network. being prohibited beforehand for a physical address device corresponding to that of said requesting device.

In a particular embodiment, cumulative or non-cumulative with the embodiment described above, the security module is in particular arranged to allow broadcast of an identifier of the radio access network when the security function is inhibited.

In another aspect, the access device comprises: a module for obtaining data, arranged to obtain data indicating that a presence of a user has been detected in a detection zone; a reception module, arranged to receive from a device requiring a request for access to the radio access network; an address management module, arranged to allow access to the radio access network to the requesting device identified by said address, after obtaining said data, access to the radio access network being prohibited beforehand for a physical address device corresponding to that of said requesting device.

The advantages stated for the access control method according to the first aspect can be directly transposed to the access device.

In a particular embodiment, this access device is an access gateway allowing access to an extended communication network for devices of a local area network, in particular devices accessing the radio access network.

According to a third aspect, the invention relates to a program for an access device, comprising program code instructions for controlling the execution of the steps of the previously described access control method implemented by the device of the present invention. access, when this program is executed by this device and a recording medium readable by an access device on which is recorded a program for a device.

The advantages stated for the access control method according to the first aspect can be transposed directly to the program for an access device and the recording medium. The invention will be better understood with the aid of the following description of particular embodiments of the access control technique, with reference to the appended drawings in which: FIG. 1 represents a local network in which the implementation is carried out; access control technique according to a particular embodiment; Figures 2a-2c illustrate a detection zone in which a presence of a user is detectable; Figures 3a-3c illustrate steps of an access control method according to particular embodiments; FIG. 4 represents an access device according to a particular embodiment.

FIG. 1 represents a private or local communication network 3. The IP (for "Internet Protocol") protocol is used by the devices in the local network to communicate with each other and also to communicate with a wide area communication network or WAN (for "Wide Area Network"), such as the Internet.

For the environment shown in FIG. 1, the term "local communication network 3" refers to a LAN (Local Access Network) network. This network can be in particular a home network or a corporate network. An access gateway 30 is arranged to provide devices of the local network 3 with access to the extended communication network (for example the Internet) via an access network 1. The access gateway 30 assures the routing of data between the access network 1 and the local network 3. This is for example a home gateway or an enterprise gateway. The access network 1 is for example an xDSL access network (for "Digital Subscriber Line", the x indicating that it may be an ADSL network, HSDL, VDSL, ...). Π can also be an FTTH network (for "Fiber To The Home") or a mobile network such as a 3G or 4G network. No limitation is attached to the type of access network 1.

The devices 32-36 of the local network 3 can be any device, for example domestic, having a wired or wireless network connection. By way of illustrative examples, various devices are shown in FIG. 1. It may be for example a touch pad 32, a mobile terminal 33, a fixed telephone 34, a computer 35, a set-top box (TV 36), a game console, appliances, etc.

Local area network 3 is at least partly a Wi-Fi type wireless radio access network, according to IEEE 802.11 "Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications" (802.1a / b) / g / n / ac). The access gateway 30 is arranged to communicate with some of the devices 32, 33 of the local network via the radio access network. As such, the access gateway 30 is an access device 31 administering the radio access network. As shown in Figure 1, the devices 32, 33 are arranged to request a connection to the radio access network and then communicate via the radio access network. The devices of the local network can access the extended communication network (Internet) via the access gateway and the access network 1. The exchanges with these devices 32, 33 are carried out at the gateway 30 , and therefore the access device 31, via a radio access module 312. It is emphasized here that the access gateway 30 can also communicate with certain other devices of the local network via a wired network connection, such as with the computer 35.

No limitation is attached to the number of such devices 32, 33, nor to the types of these devices. Furthermore, Figure 1 illustrates an embodiment in which the access device 31 managing the radio access network is integrated in the access gateway 30. No limitation is attached to this representation. In the rest of the description, it is placed at the level of the access device 31, in which the access control technique is implemented.

In the various embodiments described, the access device 31 implements at least one security function, making it possible to limit access to the radio access network to authorized devices.

In a first particular embodiment, described later in connection with FIG. 3a, the access device 31 implements a security function, for which it does not broadcast an access network identifier. More specifically, a pilot signal (known as "Beacon") broadcast periodically by the access device does not include a network identifier and the access device does not respond to discovery messages, or "Probe" Request ", sent by user devices and requesting access devices to declare themselves. The access network identifier is known as the SSID (for "Service Set Identifier"). The radio access network is thus hidden from the user devices that are not aware of the network identifier. This mechanism makes it possible to reinforce the security of the radio access network. An authorized device is thus a device that knows the network identifier, and if necessary a security key.

In a second particular embodiment, described later in connection with FIG. 3b, the access device 31 also implements a filtering function as a function of physical addresses, such as MAC addresses (for "Medium Access Control" ), for access to the radio access network. Such a MAC address is associated with each of the devices and makes it possible to identify the device. The filtering function according to MAC addresses makes it possible to limit access to devices whose MAC address is authorized by the access device 31. A device whose address is not authorized can therefore not access to the radio access network. An authorized device is thus a device whose address is known to the access device. This authorized device knows if necessary the security key.

In a third particular embodiment, described later in connection with FIG. 3c, the access device 31 implements the two security functions, the lack of broadcast of the access network identifier and the filtering according to FIG. physical addresses. An authorized device is thus a device that knows the network identifier and whose address is known to the access device. This authorized device knows if necessary the security key.

The access device 31 further comprises a presence detection module 313, arranged to obtain data indicating that a presence of a user has been detected in a detection zone. The presence detection module 313 is in one embodiment a presence detection sensor. This presence detection sensor is for example an optical proximity detector, the output of which depends on the comparison of a level of light reflected with respect to a threshold. As an illustrative example, the presence detection module 313 is a Sill02 component of Silicon Labs.

In another particular embodiment, the presence detection sensor is co-located with the access device 31 and supplies to the presence detection module 313 the data indicating that a presence of a user has been detected in a detection area.

Moreover, the user can be informed that his presence has been detected by an indication, such as the lighting of a light-emitting diode or LED (for "Light-Emitting Diode") of the access device or a display on a screen of the access device.

Figures 2a-2c illustrate in a particular embodiment a detection zone Z in which a presence of a user is detectable. Figure 2a shows the access device 31, seen from above and Figure 2b shows the same device, seen from the side. The detection zone Z is represented in the form of a circular sector centered on the module 313. The input or the output of a user in the detection zone, symbolized with arrows in FIGS. 2a and 2b, are example detected at a distance of about fifteen centimeters (detection threshold). It is thus understood that the detection module 313 is arranged to detect a proximity of the user with respect to the access device 31. The user is then at a distance allowing him to interact with the access device 31, by example via a human-machine interface. The detection threshold must remain relatively low, for example less than one meter. Indeed, only a low detection threshold makes it possible to provide sufficient security guarantees to configure a security mechanism. A threshold of the order of fifteen centimeters makes it possible to detect only users within reach of the access device 31. FIG. 2c represents the access device 31 seen from the front. The detection module 313 is for example located just behind a facade of the access device 31. The detection zone Z corresponds to a disk centered on the detection module 313.

In a particular embodiment, the data indicating that a presence of a user is detected corresponds to an event "entered in the detection zone". In a particular embodiment, another data indicating that an output of a user of the detection zone has been detected is obtained. This other data corresponds to an event "leaving the detection zone".

The access control method thus takes into account the data indicating that a presence of a user has been detected in the detection zone Z to inhibit a security function, thus allowing access of a user device 32, 33 to the radio access network for establishing a connection with the access device 31.

In the first and third embodiments, with regard to the security function corresponding to a non-broadcast of the network identifier, the latter is broadcast only when a presence is detected in the detection zone Z. The user must not enter the network identifier to which he wishes to connect via a man-machine interface of his device. Its connection to the access network is then facilitated, while retaining the advantage of a diffusion limited in time of the network identifier. This security function is then more often activated by the administrator and this enhances the security of access to the radio access network.

In the second and third embodiments, the physical address of this user device is then added to the list of devices authorized to access the radio access network. A request for subsequent access of this user device 32, 33 will not be blocked by the access device 31. The operations to be performed in a particular embodiment of the state of the art to configure a list are briefly recalled here. devices authorized to access the radio access network. The computer 35 is connected to the access device 31 via a wired link, for example Ethernet. The administrator of the local network 3 connects to the administration software of the access device 31 from the computer 35. The administrator activates the filtering function according to MAC addresses and configures this list by entering the MAC address of each device allowed to access. By comparison, in these embodiments, the address of a user device, requesting access, is added to the list of devices authorized to access, when a user, and therefore his device, are in the detection zone. Z, without requiring an administrator login. This simplifies for the administrator of the access device 31 the implementation of filtering based on MAC addresses. The latter is then more often activated by the administrator and this enhances the security of access to the radio access network.

In a particular embodiment, the WPA (for Wi-Fi Protected Access) security mechanism is used. The two user devices 32, 33 share with the access device 31 a secret key K, also called security key. When the access of the user device 32, 33 to the access network is authorized, authentication and association steps are implemented by the user device 32, 33 and the access device 31. The data sent between the user device 32, 33 and the access device 31 are then encrypted by means of the security key. It is also possible to implement other security mechanisms such as WEP (for "Wired Equivalent Privacy"), WPA2.

The access control technique, implemented by the access device 31, will now be described more precisely in particular embodiments in the environment of FIG. 1 in relation to FIGS. 3a, 3b and 3c. It is placed in the particular embodiment where the user device 32 shares with the access device 31 the security key.

FIG. 3a describes more precisely the exchanges between the access device 31 and the user device 32 during an access request made by this user device, in a first embodiment. It is recalled here that in this first embodiment, the security function for not broadcasting the network identifier is activated. In the initial state, the access device 31 broadcasts a pilot signal that does not include an access network identifier and does not respond to discovery messages. The radio access network is thus hidden from the user devices that are not aware of the network identifier.

In a step E1, the access device 31 obtains data indicating that a presence of a user has been detected in the detection zone Z.

In a step E2, triggered by obtaining data in step El, the access device 31 inhibits the security function and modifies the broadcast pilot signal MO so that it carries a network identifier of access. Thus, a user device can detect the radio access network and attempt to connect to it.

In a step Fl, the user device 32 detects the radio access network. More specifically, the user device 32 receives the broadcast pilot signal and reads the access network identifier. Still in this step F1, the user device 32, also called the requesting device, sends a message Ml discovery "Probe Request" to the access device 31. A response message M2 is transmitted to the user device 32. The message M2 corresponds to a "Probe Response" message.

In a step F2, the user device 32 sends an access request M3 to the radio access network. This M3 access request corresponds to an authentication request message "Authenticate Request". This message includes a device identifier in the form of its MAC physical address.

This access request M3 is received by the access device 31 in a step E30. An acknowledgment message M4 is transmitted to the user device 32. The message M4 corresponds to an "Authenticate Response" message. The connection is then established between the user device 32 and the access device 31 by implementing an association step, not detailed here. At the end of these steps, the user device 32 is associated with the access device 31 on the radio access network and can thus transmit and receive data from other devices of the radio network. A connection is thus established between the user device 32 and the access device 31 on the radio access network. The connection to the access network is thus simplified for the user of the device 32. In a step E50, the access device 31 activates the security function and stops the broadcast of the access network identifier, particularly in the pilot signal. This restores the additional security provided by the lack of broadcast of the network identifier.

The deactivation or inhibition of the security function is performed following the execution of step El. A timer T is then triggered in order to supervise the reception of the access request. Once the timer expires, the security function is activated again. Indeed, the radio access network must not remain visible during a too long time interval. As an illustrative example, the timer T is set at five minutes.

In another embodiment, data indicating that an output of a user of the detection zone has been detected is obtained. In this case, access to the radio access network is denied for a request received after obtaining this data. Thus, the radio access network does not remain visible for new devices, once the output of the detection zone detected.

In yet another embodiment, the radio access network is not protected by a security key. The access request M3 then corresponds to an "Association Request" message sent by the user device 32 and the acknowledgment message M4 corresponds to an "Association Response" message.

FIG. 3b more precisely describes the exchanges between the access device 31 and the user device 32 during an access request made by this user device, in a second embodiment. It will be recalled here that in this second embodiment, the security function corresponds to a filtering function as a function of physical addresses. As an illustration, in the initial state, none of the devices 32, 33 is authorized to access the radio access network. A pilot signal carrying an access network identifier is broadcast by the access device 31. In the step Fl, the user device 32 detects the radio access network. More specifically, the user device 32 receives the broadcast pilot signal and reads the access network identifier. Still in this step F1, the user device 32, also called the requesting device, sends a message Ml discovery "Probe Request" to the access device 31. A response message M2 is transmitted to the user device 32. The message M2 corresponds to a "Probe Response" message. In step F2, the user device 32 sends an access request M3 to the radio access network. This M3 access request corresponds to an authentication request message "Authenticate Request". This message includes a device identifier in the form of its MAC physical address. It is recalled here that the access to the radio access network is initially prohibited (or blocked) by the access device 31 for a physical address device corresponding to that of this requesting device 32.

This access request M3 is received by the access device 31 in a step E31. Also in this step E31, the access device 31 checks whether the user device 32 is authorized to access. This verification is performed in particular from a list of authorized MAC addresses. If the user device 32 is allowed to access, the establishment of the connection continues. The exchanges are not more detailed here. If the user device 32 is not authorized to access, the access device 31 checks whether a data indicating that a user has been detected in the detection zone Z has been obtained during a step EL 11 is emphasized here that the order of execution of these two steps E1 and E31 is indifferent. Indeed, the user device can for example initiate the sending of the access request leading to the execution of step E31 outside the detection zone Z and then be in the detection zone (step E1). , to allow the addition of his address in the list of authorized devices. Still as an example, the user device can initiate the sending of the access request leading to the execution of step E31 in the detection zone Z, the data indicating that a presence of a user has was detected (step E1) having then been obtained before step E31. It is understood, however, that there is a temporal connection between the execution of these two steps. This is described later.

If a data indicating that a presence of a user has been detected in the detection zone Z has been obtained during a step El, the access device 31 inhibits the security function and the access of the user device 32 , identified by its MAC address, to the radio access network is authorized by the access device 31. The MAC address of the requesting device is added to the list of allowed MAC addresses in a step E4. Access to the radio access network is then authorized by the access device 31 for a physical address device corresponding to that of this requesting device 32. An acknowledgment message M4 is transmitted to the user device 32. The message M4 is an "Authenticate Response" message. The connection is then established between the user device 32 and the access device 31 by implementing an association step, not detailed here. At the end of these steps, the user device 32 is associated with the access device 31 on the radio access network and can thus transmit and receive data from other devices of the radio network. A connection is thus established between the user device 32 and the access device 31 on the radio access network. The management of the MAC address list is thus simplified for the administrator of the access device 31.

In a step E51, the access device 31 activates the security function again. This restores the additional security provided by the filtering function based on physical addresses.

The access control method is more precisely defined according to the different modes of implementation of the filtering according to MAC addresses. In a particular embodiment, it is necessary to deactivate this function completely, in order to process the access request M3. This deactivation is performed following the execution of the step EL A timer T is then triggered to supervise the reception of the access request. After the timer expires, the filter function based on MAC addresses is activated again. Indeed, the radio access network must not remain "open" (to allow new devices) for a too long time interval. As an illustrative example, the timer T is set at five minutes. In a further particular embodiment, the filter function based on MAC addresses is activated again, once an access request processed by the access device. Only one user device is allowed at a time.

In another embodiment, the security function corresponds to the functional part associated with the management of the allowed physical addresses of the filtering function as a function of MAC addresses. The user device 32 is then waiting for authorization and becomes authorized after obtaining the data in step EL

In another embodiment, data indicating that an output of a user of the detection zone has been detected is obtained. In this case, access to the radio access network is denied for a request received after obtaining this data. Thus, the radio access network does not remain open to allow new devices, once the output of the detected detection area.

FIG. 3c describes more precisely the exchanges between the access device 31 and the user device 32 during an access request made by this user device, in a third embodiment. It will be recalled here that in this third embodiment, two security functions are implemented: the absence of broadcast of the network identifier and the filtering function as a function of physical addresses. In the initial state, the access device 31 broadcasts a pilot signal that does not include an access network identifier and does not respond to the discovery messages. The radio access network is thus hidden from the user devices that are not aware of the network identifier. In step E1, the access device 31 obtains data indicating that a presence of a user has been detected in the detection zone Z. In step E2, triggered by the omention of a data item. step E1, the access device 31 incorporates the two security functions and modifies the broadcast pilot signal MO so that it carries an access network identifier. Thus, a user device can detect the radio access network and attempt to connect to it. In step E1, the user device 32 detects the radio access network. More specifically, the user device 32 receives the broadcast pilot signal and reads the access network identifier. Still in this step F1, the user device 32, also called the requesting device, sends a message Ml discovery "Prohe Request" to the access device 31. An answer message M2 is transmitted to the user device 32. The message M2 corresponds to a "Prohe Response" message.

In a step F2, the user device 32 sends an access request M3 to the radio access network, as previously described in relation to the second embodiment. It will be recalled here that access to the radio access network is initially prohibited by the access device 31 for a physical address device corresponding to that of the requesting device 32.

This access request M3 is received by the access device 31 in step E31. Also in this step E31, the access device 31 checks whether the user device 32 is authorized to access. This verification is performed in particular from a list of authorized MAC addresses. If the user device 32 is allowed to access, the establishment of the connection continues. If the user device 32 is not authorized to access, the access device 31 checks whether data indicating that a presence of a user has been detected in the detection zone Z has been obtained during the step EL

If data indicating that a presence of a user has been detected in the detection zone Z has been obtained in step El, the access of the user device 32, identified by its MAC address, to the access network. radio is authorized by the access device 31. The MAC address of the requesting device is added to the list of allowed MAC addresses in a step E4. Access to the radio access network is then authorized by the access device 31 for a physical address device corresponding to that of the requesting device 32. An acknowledgment message M4 ("Authenticate Response") is transmitted to the device 32. The connection is then established between the user device 32 and the access device 31 by implementing an association step, not detailed here. At the end of this step, the user device 32 is associated with the access device 31 on the radio access network and can thus transmit and receive data from other devices of the radio network. A connection is thus established between the user device 32 and the access device 31 on the radio access network. The management of the MAC address list is thus simplified for the administrator of the access device 31. In a step E52, the access device 31 again activates the security functions and stops the broadcast of the identifier of the device. access network, especially in the pilot signal. This restores the additional security provided by the lack of broadcast of the network identifier and the filter function based on physical addresses.

The access control method is more precisely defined according to the different modes of implementation of the filtering according to MAC addresses. As described above in connection with the second embodiment, in a particular embodiment, it is necessary to disable this function completely, in order to receive the access request M3. This deactivation is performed following the execution of step E2. A timer T is then triggered to supervise the reception of the access request. After the timer expires, the filter function based on MAC addresses is activated again. Indeed, the radio access network must not remain open to allow new devices for a too long time interval. As an illustrative example, the timer T is set at five minutes. In a further particular embodiment, the filter function based on MAC addresses is activated again, once an access request processed by the access device. Only one user device is allowed at a time.

In another embodiment, as previously described in connection with the second embodiment, the security function corresponds to the functional part associated with the management of the allowed physical addresses of the filtering function as a function of MAC addresses. The user device 32 is then waiting for authorization and becomes authorized after obtaining the data in step EL

In another embodiment, data indicating that an output of a user of the detection zone has been detected is obtained. In this case, the broadcast of the radio access network identifier is stopped and the address filtering function is activated again; the network becomes hidden again. It is also possible to refuse access to the radio access network for a request received after obtaining this data. Thus, the radio access network does not remain visible and open to allow new devices, once the output of the detected detection area.

The second and third embodiments have been described for a configuration of MAC address filtering implemented for receiving an access request corresponding to an "Authenticate Request" message. In another embodiment, the configuration of the filtering according to MAC addresses is implemented after authentication of the user device 32 with the access device 31. The access request M3 then corresponds to an "Association Request" message. sent by the user device 32 and the acknowledgment message M4 corresponds to an "Association Response" message. In yet another embodiment, the radio access network is not protected by a security key. The access request M3 then corresponds to an "Association Request" message sent by the user device 32 and the acknowledgment message M4 corresponds to an "Association Response" message.

The access control method is thus easily transferable by a person skilled in the art as a function of the implementation of the filtering as a function of MAC addresses at the access device 31.

We will now describe an access device 31 to a radio access network in a particular embodiment with reference to FIG. 4. Such a device notably comprises: a memory zone 311, arranged to store a program that includes code instructions for implementing the steps of the access control method, as described with reference to FIGS. 3a, 3b and 3c; a processor 310 for executing software module code instructions; a radio access module 312, arranged to communicate on the radio access network with user devices, in particular for receiving from a requesting device 32, 33 a request for access to the radio access network; a presence detection module 313, arranged to obtain data indicating that a presence of a user has been detected in a detection zone; a security module 314, designed to implement at least one security function making it possible to limit access to the radio access network to authorized devices; a control module 315, arranged to inhibit the security function when a data indicating that a presence of a user has been detected in a detection zone is obtained and to activate the security function according to conditions such as the expiration of a time interval subsequent to receipt of the data, obtaining another data item indicating that a user's output from the detection zone has been detected, a reception of an access request .

It is emphasized here that the access device 31 also comprises other processing modules, not shown in FIG. 4, arranged to implement the various functions of such a device.

The radio access module 312 provides access to a wireless type radio access network.

Wireless.

The presence detection module 313 is for example a presence detector sensor.

In a particular embodiment, the module 313 is arranged to obtain another data indicating that an output of a user of the detection zone has been detected. The control module 315 is then arranged to activate the security function when this other data is obtained. Access to the radio access network is then refused after obtaining this other data.

In a first particular embodiment, the radio access module 312 is in particular arranged to broadcast or not an identifier of the radio access network. The security module 314 is in particular arranged to allow broadcast of an identifier of the radio access network when the security function is inhibited and not to allow this broadcast when the security function is activated. The control module 315 is then arranged to trigger the broadcast following the obtaining of the data and to stop the broadcast of the identifier of the radio access network according to conditions such that the expiration of a later time interval upon receipt of the data, obtaining another data indicating that an output of a user of the detection area has been detected, a receipt of an access request.

In a second particular embodiment, the security module 314 is designed to: block access to a physical address device whose address is not authorized and allow access to a physical address device whose address is authorized; - allow access to the radio access network to a requesting device identified by an address, after obtaining data indicating that a presence of a user has been detected in a detection zone, access to the network radio access is previously prohibited for a physical address device corresponding to that of the requesting device.

The control module 315 is then arranged to inhibit the address filtering after obtaining the data indicating that a presence of a user has been detected in a detection zone and to activate the address filtering function. such as the expiration of a time interval subsequent to receipt of the data, obtaining another data indicating that an output of a user of the detection zone has been detected, a receipt of a request for a 'access.

In this particular embodiment, the access device 31 further comprises a storage memory 316, arranged to store data used during the implementation of the access control method, as described above, including data MAC addresses allowed.

In a third particular embodiment, the security module 314 is arranged to implement the two security functions, lack of network identifier broadcast and address filtering. In this case, the control module 315 is arranged in accordance with the first and second embodiments.

In a particular embodiment, the access device 31 further comprises an authentication module, arranged to verify that a device shares with it a security key, before allowing a connection to the radio access network, and to then protect the exchanges.

In another embodiment, the access device comprises in particular: a memory zone 311, arranged to store a program that includes code instructions for implementing the steps of the access control method; a storage memory 316, arranged to store data used during the implementation of the access control method, as described above, in particular authorized MAC address data: a processor 310 for executing instructions of code of software modules; a radio access module 312, arranged to communicate on the radio access network with user devices, in particular for receiving from a requesting device 32, 33 a request for access to the radio access network; a presence detection module 313, arranged to obtain data indicating that a presence of a user has been detected in a detection zone; a module 314 for managing addresses, arranged to allow access to the radio access network to the requesting device identified by said address, activated after obtaining said data, access to the radio access network being prohibited previously for a physical address device corresponding to that of said requesting device; a module 315 for filtering according to MAC addresses, arranged to block an access of a physical address device whose address is not allowed.

It is emphasized here that the access device 31 also comprises other processing modules, not shown in FIG. 4, arranged to implement the various functions of such a device.

The radio access module 312 provides access to a wireless type radio access network.

Wireless.

The presence detection module 313 is for example a presence detector sensor.

In a particular embodiment, the module 313 is arranged to obtain another data indicating that an output of a user of the detection zone has been detected and to control a deactivation of the address management module 314. Access to the radio access network is then refused after obtaining this other data.

In a particular embodiment, the radio access module 312 is in particular arranged to broadcast or not an identifier of the radio access network. The module 313 for obtaining data is in particular arranged to trigger the broadcast following the ohtengement of the data and to stop the broadcast of the identifier of the radio access network according to conditions such as the expiration of the data. a time interval subsequent to receipt of the data, obtaining another data indicating that an output of a user of the detection zone has been detected, a reception of an access request.

The access control technique is implemented by means of software and / or hardware components. In this context, the term "module" may correspond in this document as well to a software component, to a hardware component or to a set of hardware and / or logical components, capable of implementing a function or a set of functions, as described above for the module concerned.

A software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software. Such a software component is stored in memory and then loaded and executed by a data processor of a physical entity and is able to access the hardware resources of this physical entity (memories, recording media, communication buses, electronic cards of a physical entity). input / output, user interfaces, etc.).

In the same way, a material component corresponds to any element of a material set (or hardware). Π may be a programmable or non-programmable hardware component, with or without a built-in processor for running software. This is for example an integrated circuit, a smart card, an electronic card for executing a firmware, etc.

In a particular embodiment, the modules 314, 315 are arranged to implement the previously described access control method. These are preferably software modules comprising software instructions for executing those of the steps of the access control method described above, implemented by an access device. The invention therefore also relates to: a program for an access device, comprising program code instructions intended to control the execution of the steps of the previously described access control method, when said program is executed by this device access; - A recording medium readable by an access device on which is recorded the program for a device.

The software modules can be stored in or transmitted by a data carrier. This may be a storage medium, for example a CD-ROM, a magnetic recording medium, for example a magnetic diskette or a hard disk. On the other hand, the data carrier may be a transmission medium such as an electrical, optical or radio signal, which may be routed via an electrical or optical cable, by radio or by other means. The program code instructions can in particular be downloaded to an Internet type network.

Alternatively, the data medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the access control method described above.

Claims (11)

A method of controlling access to a radio access network administered by an access device (31), said method comprising: obtaining (El) data indicating that a user's presence has been detected in a detection zone; - Inhibition (E2, E31) of at least one security function, said security function for limiting access to the radio access network to authorized devices; - receiving (E30, E31) by the access device from a requesting device (32, 33) an access request (M3) to the radio access network; - when the requesting device has accessed the radio access network, activation (E50, E51, E52) of the security function. The method of claim 1, wherein an activated security function includes a denial of access to the radio access network by the access device for a physical address device corresponding to that of said requesting device. An access control method according to claim 1 or 2, wherein the inhibition of a security function comprises a broadcast (E2) by the access device of an identifier of the radio access network triggered by said obtaining a datum. 4. Access control method according to one of the preceding claims, wherein the security function is inhibited only during a time interval subsequent to said obtaining. An access control method according to one of the preceding claims, further comprising obtaining another data indicating that an output of a user of the detection area has been detected, and wherein the function of security is again inhibited after obtaining said other data. The method of claim 2, wherein the requesting device identified by said address becomes a device authorized by the access device for access to the radio access network. 7. Access device (31) to a radio access network, said device comprising; a module (313) for obtaining data, arranged to obtain data indicating that a presence of a user has been detected in a detection zone; - a receiving module (312) arranged to receive from a requesting device (32, 33) an access request (M3) to the radio access network; a security module (314) arranged to implement at least one security function making it possible to limit access to the radio access network to authorized devices; a control module (315) arranged to inhibit the security function when a data indicating that a presence of a user has been detected in a detection zone is obtained and to activate the security function when the requesting device accessed the radio access network. 8. Device according to claim 7, wherein the security module is arranged to allow access to the radio access network to the requesting device identified by said address, when the security function is inhibited, access to the network of radio access being previously prohibited for a physical address device corresponding to that of said requesting device. 9. Device according to claim 7, wherein the security module is in particular arranged to allow broadcast of an identifier of the radio access network when the security function is inhibited. 10. Program for an access device, comprising program code instructions for controlling the execution of the steps of the access control method according to one of claims 1 to 6 implemented by the access device when said program is executed by said device. 11. Recording medium readable by an access device on which the program according to claim 10 is recorded.