WO2006100378A2

WO2006100378A2 - System and method for controlling a user's access to secure digital data, server for verifying access rights and agreement server

Info

Publication number: WO2006100378A2
Application number: PCT/FR2006/000617
Authority: WO
Inventors: Loïc HOUSSIER; Anne Gombert; Julie Loc'h
Original assignee: France Telecom
Priority date: 2005-03-22
Filing date: 2006-03-21
Publication date: 2006-09-28
Also published as: WO2006100378A3

Abstract

The invention concerns a system (10) for controlling a user's access to secure digital data (12), comprising verifying means (24) for authorizing access for said user and for storing a predetermined minimum number (N), not less than 2. The system also comprises means (28) for storing prior agreements and means (25) for summing the number of stored prior agreements. The verifying means (24) verify that the total number (n) of stored prior agreements is not less than the minimum number (N) to authorize access to the data.

Description

System and method for controlling a user's access to secure digital data, credential verification server and chord server.

The present invention relates to a system and method for controlling a user's access to secure digital data shared over a network, and a server for verifying the access rights of a user to secure digital data and a chord server.

Already known in the state of the art, a system of this type, for example a system implementing HTTPS SSL V3 protocol with client authentication. Generally, such a system comprises means for identifying the user and verification means that the identified user is authorized to access the data. These verification means interrogate for example means for storing a list of users previously authorized to access the data. If the user is present in this list, the verification means activate means for establishing access to secure data.

In such a system, the list of users authorized to access the data is recorded in the storage means by a person authorized to do so.

The problem is that a malicious person, who would achieve piracy rights of this authorized person, could easily modify the list of authorized users and add unauthorized persons who would thus have illegitimate access to secure data.

The invention aims to remedy this drawback by proposing a safer access control system.

For this purpose, the present invention relates to a system for controlling the access of a user to secure digital data, comprising verification means, able to authorize access for this user and to store a predefined minimum number, higher than or equal to 2, characterized in that it also comprises means for storing prior agreements and means for totalizing the number of prior agreements stored, and in that the verification means verify that the total number of agreements Prerequisites stored is greater than or equal to the minimum number to allow access to the data.

With such a system, it is not enough for a malicious person to hack the rights of a single person authorized to access secure data. In fact, for the means of establishing access to be activated, it is now necessary for a plurality of authorized persons to have given prior agreement, although that the malicious person must hack the rights of this plurality of people entitled to access the data, which multiplies the difficulties.

Such a system therefore allows distributed access to secure data to be controlled in a distributed manner, which is particularly advantageous for multinational companies for whom the physical meeting of people in charge of secure documents is difficult.

Note also that, thanks to the means of storing prior agreements, that is to say means configured to store agreements prior to the access request of the user, authorized persons have no need to be available in real time to allow the user to access the data, which simplifies and speeds up the access control process.

Possibly, the predefined minimum number is strictly inferior to the cardinal of a group of persons authorized to give a prior agreement. Thus, for access to data to be established, it is not essential to have prior agreement from each of the persons in this group of authorized persons. This helps to overcome the defection of some members of the group that would be unavailable.

According to a particular embodiment, the storage means are able to store a prior agreement for a limited time. Thus, it is possible to authorize access to digital data only over a time slot, specified for example in the prior agreements given by the authorized persons.

Preferably, the system comprises a communication server, called chord server, comprising means for receiving prior agreements capable of supplying the storage means. Thus, the persons authorized to give a prior agreement can connect to this server, for example via the Internet, to give their agreement.

Preferably, these reception means are activated by means of controlling the authorization of a person to give a prior agreement, including means using HTTPS SSL V3. Such means make it possible to verify that the person giving a prior agreement is authorized to do so. According to a particular embodiment, the system comprises means for invalidating a prior agreement.

According to a particular variant embodiment of the invention, the system further comprises means for automatically triggering the invalidation means, automatically activating said invalidation means when a person who has given his consent disconnects from the chord server. Thus, a person giving a prior agreement may give this agreement only for the times when it is connected to the chord server, and remove it when disconnected, so as to disable the means of establishment of access for the user.

Preferably, the system comprises means for identifying the user.

Optionally, the verification means are hosted by a first access rights verification server, the storage means are hosted by a second server different from the first, and the digital data is hosted by a third server different from the first and second. Thus, the various elements constituting the control system are housed on machines that can be geographically distant, which allows to distribute the control system in different places, without the administrators having to move.

The subject of the invention is also a server for verifying the access rights of a user to secure digital data, comprising the verification means and the means for establishing access to the data of a system as described. previously. Optionally, such a server further comprises the totalizing means.

The subject of the invention is also a chord server in a system for controlling the access of a user to secure digital data as previously described, comprising the means for totalizing this system.

Optionally, this chord server further comprises the verification means.

Finally, a subject of the invention is a method for controlling the access of a user to secure digital data, comprising the following steps implemented by computer means:

- prior agreements are stored; - total number of stored pre-agreements;

checking whether the total number of stored prior agreements is greater than or equal to a predefined minimum number, this minimum number being greater than or equal to 2; and

- This user is automatically granted access to this data if the verification is positive. The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings, in which: FIG. 1 is a diagram of an access control system according to the invention; and FIG. 2 is a diagram of a method of using the system of FIG. 1. As can be seen in FIG. 1, a system 10 according to the invention makes it possible to control the access of a user to digital data 12. These data 12 are hosted by a communication server 16, they are secured and are shared on an open network such as the Internet network 14.

The system 10 also comprises a server 18 for verifying the access rights of a user to the data 12. The verification server 18 is connected to the Internet network 14 and comprises an interface 20, means 21 for identifying the user data access establishment means 22 for the connected user, verification means 24 capable of activating the access establishment means 22, and totalization means 25.

The identification means 21 identify the user having connected to the server 18. These are for example means for receiving an electronic certificate of authentication of the user. It could also be means of processing a username and password, or other known means of identification.

The verification means 24 comprise a memory capable of storing a minimum number N, corresponding to a minimum number of prior agreements necessary to authorize the establishment of access to the data 12. This minimum number N can be parameterized, it is an integer greater than or equal to 2 (N> = 2). The verification means 24 also include means for comparing this number N with a total number n of prior agreements provided by the summing means 25.

The totalizing means 25 are connected to a server 26, hosting storage means 28, constituted here by a database, able to store prior agreements, that is to say agreements stored prior to the request of user access. These means 25 are capable of totalizing the number of prior agreements stored in the base 28.

The server 26 is connected to a communication server 32, called chord server. The chord server comprises means 30 for receiving prior agreements, able to feed the database 28 of the server 26.

The chord server 32 is also connected to the Internet network 14 and includes an interface 34, allowing authorized persons to connect to the server 32 to give prior agreements, and means 36 for controlling the authorization of these persons, activating the reception means 30. For example, the means 36 are identification means using HTTPS SSL V3.

The chord server 32 further comprises means 38 for invalidating and / or deleting a prior agreement, and means 39 for automatically triggering the means 38. These means 39 are connected to the interface 34 and automatically activate the invalidation means 38 when a person disconnects from the server 32. The method of using the system 10 will now be described with reference to FIG.

When a user 40 wishes to have access to the secure data 12, he makes a request for agreements, during a step 42 of sending an email to a group H of persons authorized to give a prior agreement. This JH group of authorized persons consists of P persons.

Following step 42, a person 44 of the group H connects to the chord server 32 through the Internet 14. As a result of this connection 46, the chord server 32 checks, during a step 48, if the person 44 who is connected is part of the group H, using the control means 36.

Once the verification 48 is done, we go to a step 50 during which the person 44 fills out a form appearing on the interface 34 of the agreement server 32. Such a form can consist of the following fields to be completed: "Name of the person for whom the prior agreement is given "," Start of the validity of the agreement "and" End of the validity of the agreement ". The form is then signed, in a step 52, by the person who filled it.

The signature 52 triggers a step 54 during which the prior agreement of the person 44 having signed is stored in the database 28. This pre-stored agreement is associated with the name of the user who has been entered in the form, and a start and end date of the agreement.

Steps 42-54 are performed by a number of people from group K

Following these steps, the database 28 includes a number of n prior agreements. This number n is between 0 and P, where P is the total number of persons authorized to give a prior agreement, ie the cardinal of group H.

For its part, the user 40 who wishes to have access to the data 12 connects to the verification server 18, during a step 56, through the Internet network 14, which amounts to formulating a request for access to the data. Once connected, it proceeds to a step 58 of identification of the user 40 by the means 21, during which the user issues an electronic certificate.

Once the user 40 has been identified, the totalizing means 25 totals the number of prior agreements stored in the database 28, counting them.

We then go to a test step 62, executed by the verification means 24, on the total number n of preliminary agreements totalized by the means 25. If the number n is strictly less than the minimum number N predefined, stored in the means 24, that is, if the database 28 does not include sufficient prior agreements for the user 40 to be authorized to access the data 12, we go to a step 64 during which the server 18 announces to the user 40, by means of its interface 20, that it is not allowed to access the data 12. If the number n is greater than or equal to the minimum number JN, i.e., if enough prior agreements are stored in the base 28, then step 66 is during which the verification means 24 activate the establishment means 22 of the access to the data 12 by the user 40.

If, subsequently, a person living in group H withdraws his prior agreement, that is to say, he activates the means 38 of invalidating his prior agreement, and if the number of previous agreements remaining in the base 28 becomes less strictly at N ₁ the connection of the user 40 is cut off.

The duration of the connection is defined by the dates of beginning and end of validity of the prior agreements. When the validity date of a prior agreement has expired, it is deleted from the database 28. Similarly, if the number of previous agreements remaining in the base 28 becomes less than N _1, the connection of the user 40 is off. If the user 40 wishes to access the resource 12 again, he must reapply to the persons in the group H.

According to another embodiment, the prior agreement is given by a person of group H only when he connects to the chord server 32. When this person disconnects, the triggering means 39 automatically activate the means 38 which invalidate or delete its prior agreement from the database 28. If the number of previous agreements remaining in the base 28 becomes strictly less than N _1, the connection of the user 40 is cut off. According to a particular embodiment of the invention, the persons of group H give their prior consent, not by using steps 42 to 54, but by sending a signed electronic mail to the chord server 32, which is responsible for to verify the authenticity of the signatures of these emails. Such messages containing the signature of the persons of the group H may possibly be sent directly by the user 40 to the chord server 32.

It should be noted that the invention is not limited by the embodiments described above.

In particular, it is described with reference to the drawings, only the case in which the means of the invention, to solve the technical problem, are concentrated in the verification server 18. However, other achievements are possible, in particular the two following cases:

The chord server 32 does not merely store, in the database 28, the prior agreement as received from the authorized person, but it updates in the database 28 a record concerning the user by incrementing the total number of prior agreements given to this user. In this case, the database 28 contains only one record per user and the verification server 18 has not totaled the number of prior agreements stored. It is thus the chord server 32 which comprises the totalizing means. The verification server 18 can simply read the record concerning the user and retrieve the number of registered pre-agreements, which is by definition the total number n of agreements that this user has received. In other words, in this case, the means of the invention are distributed between the tuning server 32, which performs the tabulations, and the verification server 38, which compOrtes the verification means and verifies that the total number of stored prerequisites is greater than or equal to the predefined minimum N number.

All the means are concentrated in the chord server 32, which includes for this purpose means of temporary storage of the prior agreements given by the authorized persons. The server 32 updates the temporary storage means and inscribes in the storage means 28 only the users having totaled a number n of prior agreements greater than the minimum number N predefined. In other words, the chord server 32 includes both the totaling means and the verification means. In this case, the verification server 18 behaves in the traditional way by simply verifying, during a request for access from a user, whether the user is registered in the database 28, and establishing the access if this is the case. Other distributions of the means of the invention between different servers reconstituting the control system of the invention are also possible.

Claims

A system (10) for controlling the access of a user to secure digital data (12), comprising verification means (24), able to authorize access for this user and to store a minimal number ( N) predefined, greater than or equal to 2, characterized in that it also comprises means (28) for storing prior agreements and means (25) for totalizing the number of prior agreements stored, and in that the verification means (24) verifies that the total number (n) of stored prior agreements is greater than or equal to the minimum number (N) to allow access to the data.

2. System according to claim 1, wherein the minimum number (N) predefined is strictly less than the cardinal (P) of a group of persons entitled to give a prior agreement.

3. System according to claim 1 or 2, wherein the storage means (28) are able to store a prior agreement for a limited time.

4. System according to any one of claims 1 to 3, comprising a communication server (32), said chord server, comprising means (30) for receiving prior agreements capable of supplying the storage means (28). ).

5. System according to claim 4, wherein the receiving means (30) are activated by means (36) for controlling the authorization of a person to give a prior agreement, including means using HTTPS SSL V3 protocol. .

6. System according to any one of claims 1 to 5, comprising means (38) for invalidating a prior agreement.

7. System according to claim 6, further comprising means (39) for automatically triggering the invalidation means (38), automatically activating said invalidation means (38) when a person who has given his consent disconnects from the server. agreements (32).

8. System according to any one of claims 1 to 7, comprising means (21) for identifying the user.

9. System according to any one of claims 1 to 8, wherein the verification means (24) are hosted by a first server (18) for verification of access rights, the storage means (28) are hosted by a second server (26) different from the first (18), and the digital data (12) is hosted by a third server (16) different from the first (18) and second (26).

10. Server (18) for verifying a user's access rights to secure digital data (12), including means of verification (24) and means (22) for establishing data access of a system according to any one of claims 1 to 9.

11. Server according to claim 10, further comprising the totalizing means (25).

A chord server (32) in a system (10) for controlling the access of a user to secure digital data (12) according to any one of claims 1 to 9, including the totalizing means ( 25) of this system.

13. Server according to claim 12, comprising the verification means (24).

14. A method of controlling the access of a user to secure digital data (12), comprising the following steps implemented by computer means:

- we store (54) prior agreements;

- the total number (n) of stored prior agreements is totaled;

- it is verified (62) whether the total number (n) of prior agreements stored is greater than or equal to a minimum number (N) predefined, the minimum number (N) being greater than or equal to 2; and

- It establishes (66) automatically access to this data (12) for this user if the verification is positive.