Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
  • G06F21/31—User authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/105—Multiple levels of security
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
  • H04L67/04—Protocols specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2113—Multi-level security, e.g. mandatory access control
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
  • H04L2463/102—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying security measure for e-commerce
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L67/00—Network arrangements or protocols for supporting network services or applications
  • H04L67/01—Protocols
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
  • H04W88/02—Terminal devices
  • H04W88/06—Terminal devices adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Definitions

• the present invention relates to computer terminals allowing network browsing type activities and offering users the possibility of installing applications.
• Such terminals can in particular be telephones using the wireless application protocol (WAP, "wireless application protocol”), desktop computers, portable computers or personal digital assistants (PDA, "personal digital assistant”). They have in common the characteristic of being connected to a digital data network, which in many practical cases is a network operating according to the IP protocol (“Internet protocol”), in particular the Internet.
• WAP wireless application protocol
• PDA personal digital assistant
• the opening of a terminal refers to the possibility offered to the user to install, and often to download, new applications intended to be executed by the terminal itself.
• Examples of "open" terminals incorporating this possibility are: • telephones for downloading applications, for example of the type
• "Semi-open" terminals are open terminals, certain functionalities of which are not directly accessible to applications installed by the user or downloaded. For example, in a terminal whose only "opening" is ECMAScript, the downloaded applications cannot access all the network functionalities (for example, send IP packets that do not obey the formats of the most common transport protocols, namely TCP ("transmission control protocol") or UDP ("user datagram protocol”)). These functions can be accessed indirectly and controlled. For example, an ECMAScript function can command the loading of a page via HTTP ("hypertext transfer protocol”) ,. which uses the network but in a controlled manner.
• HTTP hypertext transfer protocol
• “Completely open” terminals are open terminals in which all functionality is accessible to downloaded applications.
• the notion of opening a terminal depends to a large extent on the context in which we place our. For example, different layers of the OSI model (link / network / session / transport / 7) can have different degrees of openness.
• the "semi-open" nature of a terminal generally implies that execution rights observable from a distance, accessible to trusted applications, are not accessible to applications without confidence (for example, the right to transmit requests other than HTTP on an IP network). This allows a server to distinguish, among the requests that arrive, those that come from trusted applications and those that come from other applications. It can in particular distinguish requests from downloaded applications from requests from applications present from the outset in the terminal.
• trusted applications the server is ready to assume that these applications are not Trojans.
• the WAP browser on a WAP phone can be a trusted application.
• Another example could be a Java MIDP application downloaded with signature;
• An object of the present invention is to offer a difference in the ability to send requests of a new type between "trusted” applications and "untrusted” applications, which is flexible for applications and can nevertheless be identified by the recipient server.
• the notion of trust can be based on various criteria (signature, type of exchange, URL from which the application was downloaded, etc.).
• the invention thus provides a method of communication between a first unit and a second unit via a telecommunications network, in which the first unit comprises applications belonging respectively to a first family and to a second family having a priori a lower level of confidence than the first family.
• each request originating from an application of the second family, sent on the network intended for the second unit is forced to include a marking associated with the second family of applications.
• each request originating from an application of the second family, sent on the network intended for the second unit is forced not to include a marking associated with the first family, said marking being included in at least some of the requests issued on the network and originating from applications of the first family.
• the invention also provides a communication terminal, comprising means for implementing such a method as a first unit.
• the method allows certain particular ("trusted") applications running in the first unit to send frames to the attention of a second unit, generally a remote server, with the guarantee for this second unit of the reliable origin of these frames.
• the mandatory inclusion of marking for applications a priori without the confidence of the second family distinguishes, on issue, the frames emitted by these applications a priori without confidence compared to those emitted by trusted applications. This allows the server to sort between acceptable requests, which it trusts, and those which it must reject.
• the marking applied should be completely "waterproof", that is to say that it is not possible for an a priori application without confidence to short-circuit the checks carried out at a certain level (for example: HTTP requests), by attacking the lower layers (for example: request for a TCP connection).
• the marking included in a request sent on the network and originating from an application of the second family, is forced to include an indication of the nature and / or the origin of said application of the second family.
• This indication consists, for example, of data relating to the certification of the signature of a signed application, or else to the download address of an application downloaded via the network. It can be used by the remote unit to assess whether it can trust the application which could a priori only be judged without confidence by the first unit.
• terminals supporting the downloading of the applications can exchange data with confidence with a server, despite the risks inherent in these downloading capacities.
• a remote unit such as a server 1 to obtain in a secure and flexible manner the confidence in requests received on a telecommunications network R coming from a semi-open terminal 2.
• This terminal hosts a share of trusted applications 3, such as by example a web browser, and on the other hand a priori unreliable applications 4, in particular applications that the user of the terminal has downloaded via the network R.
• a priori unreliable applications 4 are constrained as to the frames or requests that they can send on the network R, which, in the diagram, is symbolized by a control layer 5 forming part of the network access resources 6 of which Terminal 2 is equipped.
• the control layer 5 verifies that certain properties are fulfilled by the frames emitted by the a priori untrusted applications 4. If these properties are fulfilled, the control layer lets the frames pass. Otherwise, it can either not let them pass to the network R and notify the application 4 which sent them, or modify the frames to conform to the constraints of the a priori untrusted applications. In the latter case, the frame loses its credibility in the eyes of the server 1, which may not use it.
• the aforementioned constraints relate to the presence or absence of a specific marking in the requests sent on the network R from some of the applications.
• control layer 5 requires requests from a priori unreliable applications 4 to include a marking associated with this family of applications.
• a trusted application 3 accesses functionalities which allow it to bypass the control layer 5 and issue unmarked requests.
• network access resources 6 do not make these functionalities available to a priori untrusted applications 4.
• Java virtual machine 2 (for example a mobile phone) has a Java virtual machine, which can correspond to module 6 in the figure.
• the virtual machine is used to run downloaded applications written in the Java programming language developed by the company Sun Microsystems, Inc. All instructions in the Java language are executed by the virtual machine, which calls system functions after a certain control.
• This terminal 2 is only able to download Java code, no other type of application can be installed there by the user.
• the protocols used for the exchanges of terminal 2 on the network R are the HTTP protocols (RFC 1945 ("Request For
• TCP RRC 793, IETF, September 1981
• IP RRC 791 ,, IETF, September 1981
• the service is hosted by an HTTP 1 server which stores user-owned content. He must ensure that a request (requesting the deletion of all files for example) comes from the user, and not from a malicious Java program.
• This service is of course an example, any other service that may be using this technique (electronic commerce, publication of documents, messaging, etc.).
• the marking can be included in the "User-Agent" header field of HTTP requests (see section 10.15 of RFC 1945 above). It consists of a specific string such as "Application without confidence: VM Java 1.2" which indicates by its presence that the request is not coming from an application a priori of confidence. This chain may already be present in the request produced by the application 4, in which case the control layer 5 of the virtual machine 6 is satisfied with checking its presence. Otherwise, this layer 5 inserts it so that the request is properly marked.
• the watertightness of the marking applied by the virtual machine 6 results from the fact that it is not possible for an application a priori without confidence 4 to send on the network R HTTP requests not containing this specific chain.
• application 4 cannot have access to the network R by connecting to a protocol layer lower than HTTP, in particular to TCP sockets.
• the marking is implemented directly in virtual machine 6 in which the a priori untrusted application is forced to run and which it cannot avoid in any way.
• the server 1 can thus sort, among the requests which arrive at it, those which come from a priori unreliable applications 4 and those which come from trusted applications 3 such as a web browser.
• a Java applet is generally considered to be trusted by the site from which it was downloaded, but not by other sites. Marking will therefore not always be necessary in requests intended for this download site.
• the virtual machine 6 can impose the marking on the requests originating from such an applet and sent to a site other than the one from which it was downloaded and leave the applet free to include or not the marking in the requests it makes to its original site. Another possibility is to impose the marking on any request sent by such an applet, whatever the destination.
• An alternative or a complement to the marking of requests without confidence can be the prohibition of some of these requests. For example, for untrusted applications downloaded from a given server, direct requests to different servers could be prohibited. Requests to the origin server would still be possible, with the marking.
• Such an embodiment of the invention is particularly applicable in the case of a Java application signed by a certificate.
• the virtual machine 6 must verify the signature of the Java application before issuing the requests. In practice, this verification takes place before the execution of the application 4.
• the marking can then consist of adding a specific string in the HTTP header, such as for example: "Trusted content - Application signed by ⁇ C>" where ⁇ C> is the value of the signer's certificate. the application, or a digest of it.
• This header indicates by its presence that the request comes directly from a user, and was created by software of known origin.
• the server 1 trusts the holder of the private keys associated with the certificate ⁇ C>, the server is guaranteed that the requests marked with this specific header correspond to an effective agreement of the user.
• the marking constraint prevents the application from claiming from a signatory other than the real signatory from the server.
• the virtual machine 6 is capable of identifying the download address of the application. It can thus force the request resulting from such an applet, a priori without confidence, to include its download address or data which depend on this address.
• the syntax of the marking is reversed: the control layer 5 imposes on the requests originating from the a priori unreliable applications 4 not to include a marking specific to the trusted applications 3. To manifest itself as being trusted by a server 1, an application 3 then includes the marking in the request that it addresses to it. The control layer 5 ensures that this marking is absent from each request originating from an a priori untrusted application 4, the untrusted character being able, as previously, to be assessed as a function of the site receiving the request.
• the marking is present in a request originating from an a priori unreliable application 4, the request is not sent as is: the marking is removed by the control layer 5 and the latter may or may not issue the request " unmarked "on the R network and prevent or not the application 4.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• Computer Hardware Design (AREA)
• Signal Processing (AREA)
• General Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Software Systems (AREA)
• Computing Systems (AREA)
• Information Transfer Between Computers (AREA)
• Stored Programmes (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=32406157

Family Applications (1)

Country Status (7)

Families Citing this family (6)

Citations (1)

Family Cites Families (6)

• 2002
  • 2002-12-18 FR FR0216092A patent/FR2849311B1/fr not_active Expired - Fee Related
• 2003
  • 2003-10-27 US US10/539,205 patent/US20060080448A1/en not_active Abandoned
  • 2003-10-27 JP JP2004566968A patent/JP2006511890A/ja active Pending
  • 2003-10-27 WO PCT/FR2003/003181 patent/WO2004066580A1/fr not_active Ceased
  • 2003-10-27 CN CNA2003801067564A patent/CN1729670A/zh active Pending
  • 2003-10-27 EP EP03778464A patent/EP1590936A1/de not_active Withdrawn
  • 2003-10-27 AU AU2003285463A patent/AU2003285463A1/en not_active Abandoned

Patent Citations (1)

Also Published As

Similar Documents

Legal Events