EP1483645A2

EP1483645A2 - Device and method for making secure sensitive data, in particular between two parties via a third party entity

Info

Publication number: EP1483645A2
Application number: EP03717408A
Authority: EP
Inventors: Murielle Rose
Original assignee: Gemplus Card International SA; Gemplus SA
Current assignee: Gemplus SA
Priority date: 2002-02-18
Filing date: 2003-02-18
Publication date: 2004-12-08
Also published as: WO2003071400A2; AU2003222576A1; FR2836251B1; WO2003071400A3; JP2005518039A; US20050177729A1; FR2836251A1

Abstract

The invention concerns a method for representing a first entity (U) by a third party entity (2) who is addressed by a second entity (FS) to request sensitive data (DS) from the first entity. The securing method consists in controlling the transmission of part at least of the sensitive data using a personal electronic medium (14) held by the first entity (U). Said medium can itself contain the sensitive data instead of the third party entity, and/or means for selectively locking or unlocking the third party entity if the latter holds it. The medium can be in the form of a smart card, for example a SIM card for the mobile telephone system.

Description

DEVICE AND METHOD FOR SECURING SENSITIVE DATA, PARTICULARLY BETWEEN TWO PARTS VIA A

THIRD PARTY ORGANIZATION

The invention relates to the management of sensitive data in data exchange systems.

An example of such systems is based on the realization of electronic contracts between two parties or entities, for example a user and a service provider, using a third party entity. The latter then acts as a representative of the user, being able to negotiate on his behalf with service providers, while protecting his personal data.

In this context, there are committees in terms of standardization of exchanges between access providers and users, respective parties to a contract. The organization called "XNS.org", whose website is located at http: //www.xns. org /. is an example of such a committee, which specifies the role of a third party as a trusted intermediary on the Internet.

The latter keeps in memory the data characteristic of a contract concluded between two entities, such as a user and a commercial entity for example. Thus, in the event of litigation subsequent to the contract, such as the non-delivery of a product, non-payment, or the improper dissemination of personal data, the trusted intermediary provides electronic proof of the contract signed. The operating principle of such an organization is presented schematically in FIG. 1. The trusted intermediary 2 has two interfaces: a so-called "service provider agent" 4 which dialogues with the service providers FS, and a so-called "agent staff "6 who dialogues with U users. These two agents 4 and 6 interact with each other via a dedicated link 8.

In the example illustrated, the user U is connected to the personal agent 6 by the Internet network 10, for example by means of a personal computer PC 12.

A disadvantage of this system is that the trusted third party 2 needs to know all of the user's personal data in order to carry out the transactions in place of the latter, and that this personal data is vulnerable in two respects of view: they are stored on a computer which is not by nature secure, and they escape the control of ^' their owner.

As a result, users are rightly reluctant to leave all their personal data on the site of the trusted organization, some of this data being sensitive for user U for various reasons, such as his number, personal telephone number, elements of his marital status, his bank details, his electronic business cards, his medical file, etc. In view of the above, the invention provides technical security means which can be integrated functionally in such a system. These means are based on a personal electronic medium held by a user and which can dialogue with the personal agent or other trusted organization. The support manages, under the own control of its holder user, the disclosure of certain sensitive data for which this user judges it undesirable to leave the management of the disclosure to his personal agent. Sensitive data as well are selected by the user. They may relate to any element of information that he considers sensitive, concerning his private, institutional life, etc. More particularly, the invention provides, according to a first aspect, a method of representing a first entity by a third entity to which a second entity is addressed to request sensitive data from the first entity, characterized in that it involves the following steps:

- the third party entity dialogues with the second entity and with the first entity using a personal agent interface; - the first entity controls the communication of at least part of the sensitive data from the third entity to the second entity by means of a personal electronic medium, via the following steps: - a security agent of the electronic medium personnel ensures dialogue with the personal agent; the security agent of the personal electronic support ensures the reading of at least the part of the sensitive data and / or of the criteria for the inhibition of their disclosure.

According to this method, the control can be carried out by interfacing with the user in order to obtain his authorization or prohibition, ensured by the security agent of the personal electronic medium, or by secure storage of at least part of the data. sensitive in the personal electronic medium, outside the third party entity.

According to a second aspect, the invention provides a system for exchanging data between a first and a second entity via a third entity, the system being characterized by a means of communication in the third entity and a support. electronics in the first entity with the characteristics described below. According to a third aspect, the invention provides a personal electronic medium intended for the method according to the first aspect, comprising:

- a memory zone intended for the storage of at least one sensitive datum whose emission is to be managed and / or for the storage of a condition of emission by the third party of at least one sensitive datum stored by it and a security agent application that ensures dialogue with the personal agent of the entity thirds, and ensures the reading of the ^memory. According to a fourth aspect, the invention provides a communicating terminal allowing a first entity to communicate with a third entity which represents it, characterized in that it implements a support according to the third aspect. According to a fifth aspect, the invention provides a third-party entity representing a first entity, characterized in that it comprises means for dialogue with a personal electronic medium according to the third aspect, making it possible to transmit at least one data item belonging to the first entity under control of said medium. This third-party entity can store in memory the characteristics of a contract concluded between the first entity and a second entity. The invention and the advantages which ensue therefrom will appear more clearly on reading the following description of a preferred embodiment, given purely by way of non-limiting example, with reference to the appended drawings in which:

- ^' Figure 1, already described, is a simplified diagram showing the operation of a trusted third party organization forming a link between service providers and users; and - Figure 2 is a diagram which reproduces that of Figure 1 by adding the elements allowing the implementation of the invention according to a ^• preferred embodiment.

The elements of Figure 2 repeating those of Figure 1 have the same references and will not be described again for the sake of brevity.

According to the invention, a user U of the trusted third party organization 2 has a personal electronic medium which ensures the management of his sensitive data. These are the data for which he wishes to retain a right of control as to their disclosure by the trusted organization 2 to a service provider for example. The latter can be a commercial enterprise offering online services or wishing to prospect online, an institutional body allowing remote exchanges, etc.

In the example, the personal electronic medium is a smart card 14 of the SIM or USIM type (English acronym for "(universal) subscriber identification module") integrated into a mobile telephone terminal 16 of the user U, thus conferring a new function to this card. Indeed, a SIM chip card in itself contains enough basic technical resources to perform this function: microprocessor 15, memories: RAM of the "RAM" type 18, frozen of the "ROM" type 20, electrically programmable of the "EEPROM" type 22, communication interface (by contacts), communication programs, means of loading data and programs , etc.

Card 14 - which constitutes the personal electronic medium - intervenes in management in two possible ways:

by storing the sensitive data or data DS in its own memory (for example the EEPROM memory 22), these data then not being stored with the personal agent 6, and / or

- by exercising a capacity to inhibit the disclosure of sensitive data stored by the personal agent.

Of course, the card 14 can selectively exercise one or the other of these ways of intervening as a function of the sensitive data in question. Management at the level of the card 14 is carried out by application software, called "security agent application" 24, contained in the support (for example in the EEPROM memory 22 of the card 14). The security application ensures in particular: i) the dialogue with the personal agent 6, ii) the reading of the memory 22 storing the sensitive data DS and / or of the criteria CD for 1 inhibition of their disclosure and iii) 1 interfacing with the user.

The personal agent 6 has software 26 for dialog with the security agent application 24.

Several cases can arise for the transmission to a third party of sensitive data by the personal agent 6 under the control of the card 14: 1. First case: the personal agent 6 does not have the sensitive data and this DS data is stored in the card 14. Two possibilities are then taken into account: - 1.1. The user U agrees to transmit the sensitive data systematically. The security guard application 24 in the card is then configured to extract the data from the memory 22 in the card and automatically transmit it to the personal agent 6 systematically at each request of the latter, without the user's authorization request. in person. The user nevertheless retains the right to make this data inaccessible by the personal agent 6, either by erasing it from the memory 22, or by removing the card 14 from its terminal 16;

1.2. The user U does not accept to transmit the sensitive data systematically. In response to a request from the personal agent, the security agent application 24 presents the user with a request for authorization to transmit (with indication of the data item and its disclosure condition).

If the user expresses his acceptance, the security agent application 24 extracts in response the sensitive data in question from the memory 22 and transmits it to the personal agent 6.

If the user refuses, the security agent application 24 blocks the sensitive data in its memory 22. 2. Second case: the personal agent 6 has the sensitive data, but in association with an indication not to disclose it to a third party only with the user's prior agreement to each request. Two possibilities are then taken into account: - 2.1. . The security guard application 24 in the card 14 includes an indication of the disclosure condition. The personal agent 6 indicates on the card, with his request, the disclosure condition (for example the name of the requesting third party). The security guard application 24 first determines whether it is able to pass judgment on the condition transmitted by the agent. If the answer is negative, it goes to the possibility presented in section 2.2 below; if the answer is positive, it compares the condition indicated by the agent with that (s) recorded for this data.

If there is a match, the security agent application 24 sends a validation signal to the personal agent 6, allowing the latter to disclose the data to the requesting third party (for example a service provider FS).

If there is no agreement, the security application 24 sends an inhibition signal to the personal agent 6, preventing the latter from extracting the data from its memory.

- 2.2. The security guard application 24 in the card 14 has not recorded conditions for disclosing the sensitive data, or is confronted with a condition indication of a type not listed among its possible conditions (for example the name of a new third party). In response to a request from the personal agent 6, the security agent application 24 presents the user U with a request for authorization to disclose (with indication of the data item and its disclosure condition).

If the user expresses his acceptance, the security application 24 sends a validation signal to the personal agent 6, allowing the latter to disclose the data to the requesting third parties. If he expresses his refusal, the security agent application sends an inhibition signal to the personal agent, preventing the latter from extracting the data from his memory. In the ^mode of realization, the safety officer applying ^• 24 is in the form of an applet (called "Applet security agent") loaded into the card 14 is in personalization, either postpersonnalisation. The security agent applet 24 also manages the interface with the user U on the mobile telephone terminal 16, in particular to communicate to him a request for authorization to transmit sensitive data or to accept a validation or inhibition signal. access by the personal agent 6. This interface advantageously uses the display 16a of the mobile terminal to present the conditions and the keyboard 16b to receive a response from the user U. The communication between the applet security guard 24 and the personal agent 6 is carried out on the wireless channel used by the mobile telephone terminal 16, for example according to the GSM protocol. In the example, this communication passes through a mobile telephone network operator 28 and the communications are advantageously made by SMS messages.

(from the acronym "short message service"), EMS

(from the acronym "enhanced messaging service") or

MMS (acronym for "multimedia messaging service").

For its part, the security agent applet 24 can respond to the personal agent 6, via the dialogue software 26, also by SMS messages, the latter serving to transmit sensitive data, a validation signal or a signal inhibition. There are many possible protocols for coding the commands and signals exchanged between the security agent applet 24 and the personal agent dialog software 26 6. As an indication, each type of sensitive data can be labeled> by a code according to a predetermined arrangement between the security agent applet 24 and the dialogue software 26 of the personal agent 6 (for example: code 012 = social security number). Similarly, FS service providers requesting sensitive data can be coded by category (for example: code C08 = commercial organization for insurance services) and by name (for example: code Al9 = La Picarde SA). An example of content of SMS coming from the personal agent 6 to the security guard applet 24 would then be C08 + Al9 + 012. L ¹ security guard applet 24 will be able to deduce from this message in which of these cases (cf. sections 1.1, 1.2, 2.1, 2.2 above) it is found. He can thus, for example, display the following message on the screen 16a of the mobile telephone terminal "Request Security No. Company of La Picarde Insurance Co.. Accept.: 1. Refusal 2." Depending on whether the user presses the 1 or 2 key, this data will be released or blocked for disclosure to this third party.

If necessary, the dialogue between the card 14 and the personal agent 6 can be secured by any known means (encryption, etc.).

The invention allows many variants, in particular at the level of: the recipient of sensitive data (or inhibition / validation signals) emitted by the medium, this recipient can be any centralized private or public management system; - the personal electronic medium held by the user, this medium being able to be a smart card of any type, an electronic token, an electronic badge, or any other personal electronic object making it possible to communicate via a platform or by himself, terminal on the user side, this terminal can be any mobile telephone, landline telephone, communicating personal digital assistant, personal computer, etc., of the link connecting the material medium held by the user or his terminal with the recipient of sensitive data , this link can be based on any wireless or wired communication protocol,

- control protocol, identification of sensitive data and inhibition / validation signals, communication with the user, - institutional and commercial applications,

- etc.

By way of illustration, the security agent applet 24 (or the like) can be provided for transmitting a secure data item not in return to the personal agent 6 (or the like) having made the request, but directly to the final recipient (for example the service provider FS), by calling the connection number of the latter. The hardware support 14, 16 held by the user can also allow an update or a controlled loading of sensitive data from the personal agent 6 (or any other authorized third party). The security agent applet 24 will then ensure the validation of the loading or modification under control of the user, either by presenting the request for loading or updating with the possibility of accepting or refusing, or by performing automatic filtering on the basis of criteria fixed beforehand by the user.

The invention is suitable for financial transactions, in particular for processing electronic payment in the context of electronic commerce. For example, the bank details will be stored on the smart card of the personal electronic medium and used as described above in section 1.2.

Claims

1. Method for representing a first entity (U) by a third entity (2) to which a second entity (FS) is addressed to request sensitive data (DS) from the first entity, characterized in that it comprises the following stages: the third entity (2) dialogues with the second entity (FS) and. with the first entity (U) using a personal agent interface (6); - the first entity (U) controls the communication of at least part of the sensitive data (DS) of the third entity (2) to the second entity (FS) by means of a personal electronic medium (14), by through the following steps: - a security agent (24) of the personal electronic support

(14) ensures dialogue with the personal agent (6);

the security guard (24) - personal electronic support

(14) reads at least the portion of sensitive data (DS) and / or criteria for inhibiting their disclosure.

2. Method according to claim 1, characterized in that the control is carried out by interfacing with the user in order to obtain his authorization or prohibition, provided by the security agent (24) of the personal electronic medium (14).

3. Method according to claim 1 or 2, characterized in that the control is carried out by secure storage of at least part of the sensitive data (DS) in the personal electronic medium (14), outside the third party entity (2 ).

4. Method according to one of claims 1 to 3, characterized in that stored data is transmitted to the third party (2) for the purpose of carrying out a financial transaction in the context of an electronic transaction.

5. Method according to any one of claims 1 to 4, characterized in that the communication between the personal electronic medium (14) and the third party entity is carried out by a wireless link.

6. Method according to claim 4, characterized in that the communication between the personal electronic medium (14) and the third party entity is carried out by a mobile operator (28).

7. Personal electronic support (14) intended for the method according to any one of claims 1 to 6, characterized in that it comprises:

- a memory area (22) intended for the storage of at least one sensitive datum whose transmission is to be managed and / or for the storage of a condition for emission by the third party entity (2) of at least one datum sensitive stored by it, a security agent application (24) which ensures the dialogue with the personal agent (6) of the third-party entity (2), and which reads the memory (22).

8. Personal electronic support (14) according to the preceding claim, characterized in that the security agent (24) also provides interfacing with the user in order to request an authorization or prohibition of disclosure of sensitive data.

9. Support according to claim 7 or 8, characterized in that it is in the form of a smart card (14).

10. Support according to claim 9, characterized in that it is in the form of a smart card (14) used for the operation of a mobile telephone terminal (16).

11. Communicating terminal (16) allowing a first entity (U) to communicate with a third entity (2) which represents it, characterized in that it comprises a personal electronic medium (14) according to any one of claims 7 to 10.

12. Third-party entity (2) representing a first entity (U), characterized in that it comprises means (26) for dialogue with a personal electronic medium (14) according to any one of claims 7 to 10 , allowing to transmit to a second entity (FS) at least one data item belonging to the first entity under control of said medium.

13. Third-party entity (2) representing a first entity (U) according to claim 12, characterized in that it further comprises means for storing the characteristics of a contract concluded

5 between the first entity and a second entity (FS).

14. Data exchange system between a first entity (U) and a second entity (FS) via a third entity (2) to which ^the o the second entity address (FS) for requesting sensitive data (DS) of the first entity, characterized in that the third entity (2) includes a personal agent communication means (6) for communicating with the first entity ^' (U) and with the

15 second entity (FS) and in that the first entity

(U) includes a personal electronic medium (14) which includes:

- a memory area (22) intended for the storage of at least one sensitive datum whose transmission is to be managed 0 and / or intended for the storage of a condition for transmission by the third party entity (2) of at least sensitive data stored by it,

- a security agent application (24) for ensuring the dialogue with a personal agent (6) of the third entity (2) and for ensuring the reading of the memory (22).