Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/069—Authentication using certificates or pre-shared keys
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
  • H04W88/02—Terminal devices

Definitions

• the present invention relates to the field of telecommunications and in particular services accessible via a central equipment, connected on the one hand, to a public telecommunications network, such as the Internet, and, on the other hand, to a local network, to manage in a centralized manner all flows related to the different services accessed by the user.
• the invention can find a particularly interesting application, among many others, in the field of authentication of a user, when the latter wishes to access a service via a terminal connected to a gateway, called " home gateway ", enabling the interconnection of various home communication terminals (PC, TV, alarm center, etc.) with telecommunication networks.
• Such a gateway can therefore support a plurality of home communication services: Internet, television, VoIP, game consoles .... It is typically equipped with so-called wireless features
• Bluetooth can also have other means of local communication, such as infrared or NFC (Near Field Communication, contactless technology).
• NFC Near Field Communication, contactless technology
• the authentication of a user when he wants to access a service carried by the home gateway from any home communication terminal, is performed at the terminal itself.
• This process may require either a basic authentication of the identifier and password type, or a strong authentication type electronic signature, in order to be able on the one hand, protect access to the service and, on the other hand, personalize the accessed content .
• the user In the case of strong authentication requested, the user must have an electronic key for example of the USB dongle type, which implies that the terminal is equipped with a USB port and that the key is inserted therein for the terminal can read the authentication data contained in the key.
• the latter solution is not feasible because the majority of home communication terminals do not have USB ports. Moreover, this solution is not ergonomic for the user either.
• the mobile SIM card advantageously allows to automate an authentication process and thus free the user tedious code entries.
• each user station must then comprise a PC type terminal equipped with means for reading a SIM card, in order to be able to use the information stored by a SIM card to transmit them to an authentication server coupled to the SIM card.
• telecommunication network telecommunication network.
• the present invention aims to overcome these disadvantages. This objective is achieved by predicting a method of exchanging data between a terminal and a memory card accessible to the terminal, via a home gateway to which the terminal is connected.
• the subject of the invention is a method for exchanging data between an application running on a terminal and a memory card, said method comprising the steps of transmitting the data over a wireless link between a gateway interconnecting said terminal with a telecommunication network, and a mobile terminal equipped with the memory card, the mobile terminal ensuring the transmission of data between the memory card and the wireless link.
• the data exchanged between the terminal and the memory card via the gateway allow the implementation of security functions offered by said memory card and are used to secure applications from said terminal.
• the wireless link is a connection according to the Bluetooth protocol, an infrared type link or an NFC type link.
• the invention also relates to a device for exchanging data between an application running on a terminal and a memory card, characterized in that it comprises means for establishing a wireless link between a gateway interconnecting said terminal with a telecommunication network, and a mobile terminal equipped with the memory card, and means for exchanging data by the wireless link between the gateway and the inserted memory card in the mobile terminal, the mobile terminal ensuring the transmission of data between the memory card and the wireless link.
• the data exchanged between the terminal and the memory card via the gateway are data enabling the implementation of security functions offered by said memory card and are used to secure applications from said terminal.
• the wireless link is a link according to the Bluetooth protocol, an infrared type link or an NFC type link.
• the device comprises a client module installed in the gateway and a server module installed in the mobile terminal, designed to establish communications via the wireless link between the gateway to which the terminal is connected and the memory card inserted in the mobile terminal.
• the client module and the server module comply with the SIM Access Profile specifications.
• the server module installed in the mobile terminal comprises means for converting APDU commands received to the memory card.
• the device comprises, installed in the terminal, a module implementing a memory card access protocol associated with an interface module with an access module installed in the gateway, designed to access the memory card. inserted into the mobile terminal via the wireless link.
• the interface module installed in the terminal complies with the specifications of the PC / SC standard and is designed to enable dialogue with any type of memory card reader via a driver of a computer. adaptation, said access module installed in the gateway acting adaptation driver. According to another embodiment, the interface module installed in the gateway implements a direct interface with the gateway.
• the access module installed in the gateway, is designed to receive from the interface module, installed in the terminal, command transmission messages to be applied to the memory card inserted in the mobile terminal, and to access a client module installed in the gateway, which is designed to establish communications via the wireless link with a server module installed in the mobile terminal and having access to the memory card inserted in the mobile terminal, for transmitting said messages to the memory card.
• the messages exchanged between the interface module installed in the terminal and the access module installed in the gateway to which the terminal is connected comply with the SOAP protocol.
• the invention also relates to a home gateway interconnecting at least one terminal with at least one telecommunications network, characterized in that said gateway comprises means for establishing a wireless link with a mobile terminal equipped with a memory card, and means for exchanging data over the wireless link with the memory card inserted in the mobile terminal.
• the architecture implemented by the invention as just described thus advantageously makes it possible to provide localized applications on user terminals connected to a home gateway, a service carried by the gateway allowing access to a memory card located in a mobile terminal via a wireless local link.
• FIG. 1 represents a block diagram of a system for exchanging data between a memory card housed in a mobile terminal and a user terminal via the gateway to which the user terminal is connected
• FIG. 2 illustrates the different software layers implemented in the different entities according to the invention.
• FIG. 1 represents the exchanges implemented according to the invention, for access to a memory card 10 located in a mobile terminal 20 by a terminal 40, when a user wishes to access, via the terminal, to a service carried by a home gateway 30 to which the terminal 40 is connected.
• Access to the memory card in this context can for example be implemented in order to access security functions offered by the memory card. , for securing applications from the terminal 40.
• the memory card can be a SIM card, a USIM card or any other UICC ("UMTS Integrated Circuit Gard”) integrated memory card, ie an integrated circuit card for UMTS. installed in a mobile terminal connected to a UMTS network ("Universal Mobile Telecommunications System"), as defined by the standards of the 3GPP Standardization Group
• the terminal 40 thus allows the execution of applications and provides a connection to an IP network 1 (Internet Protocol) via the gateway 30. It can be any home communication terminal (TV, PC, PDA , portable...) .
• An access module 60 is for this purpose integrated with the domestic gateway 30, which must also have a wireless local connection of Bluetooth, infrared, NFC or other type.
• the user when the user wishes to access a service carried by the home gateway 30 from the terminal 40, he first connects to the service access portal 50 carried by the gateway using an identifier, for example his name or a nickname.
• the access module 60 of the gateway 30 is then provided for establishing a connection with the SIM card 10 inserted in the corresponding mobile terminal 20 via the wireless link 5, for example of the Bluetooth type.
• This process of accessing a SIM card for example via the home gateway and the wireless link may advantageously be used to authenticate the user, when the latter wishes to access a service carried by the gateway from the terminal 40. way, the user does not need to have a specific SIM card to authenticate and access the desired service or to manipulate the SIM card of his mobile terminal to insert it into another reader connected to his terminal. communication.
• the access module can retrieve the authentication information coded on the SIM card and thus check the corresponding rights. If the rights allow the user to access the requested service, the gateway transmits the identifier and the corresponding password to the terminal connected to the home network. Otherwise, if the rights do not allow the user to access the service, a refusal message is notified.
• the access module 60 is therefore in the form of a software function provision of the various services and applications carried by the home gateway.
• the access module integrated into the gateway determines the address of the mobile terminal according to the user's identifier and transmits an authentication request to the SIM card of the mobile using the wireless link.
• the access module embedded on the gateway thus makes it possible to relay authentication requests from the service access portal or from the various terminals connected to the home local network to the SIM card inserted in the mobile terminal.
• SIM card access means are provided, thus providing a communication interface with the SIM card, for routing the authentication requests received from the integrated access module to the gateway to a localized application.
• the SIM card is an application authentication method for authenticating the user by PIN code request and possibly cryptographic calculation of an authentication certificate.
• Static authentication data can also be stored in the SIM card and sent encrypted to the gateway.
• the access module integrated to the gateway authenticates the user from its identifier and received authentication data and performs a verification of the access rights to the desired service according to the authentication. .
• the mobile terminal 20 and the home gateway 30 implement a set of protocols and procedures called SAP (SIM Access Profile) designed as part of the Bluetooth protocol to give access to a SIM card inserted in a terminal via a Bluetooth 5 link, in a completely transparent way.
• SAP SIM Access Profile
• the mobile terminal 20 comprises an SAP server module 21 which exchanges messages on one side with the SIM card 10 via a reader 22 in accordance with the ISO 7816-3 standard, and the other with the Bluetooth link via a layer 23 implementing the Serial Cable Emulation Protocol (RFCOMM) emulating a serial link, and a low level layer 24 making it possible to establish a Bluetooth 5 radio link with other terminals, in this case with the home gateway 30.
• the SIM card preferably comprises a Java applet-type application designed to provide security services, such as signature, Public Key Infrastructure (PKI) authentication, Secret Key Infrastructure (SKI) authentication, or password-safe type. (non-exhaustive list of services).
• the home gateway 30 comprises an SAP client module 31, which communicates with the SAP server module 21 for example via a layer 32 implementing the RFCOMM protocol and a low level layer 33 of establishment of Bluetooth radio link 5, these three layers being collected in a Bluetooth module 34.
• the server modules SAP 21 and client 31 thus make it possible to exchange messages with the SIM card, and to apply commands to it, such as placing commands under / power off the SIM card.
• the SAP client module 31 is thus designed to execute a connection procedure with the SAP server module 21 via the Bluetooth link, and a disconnection procedure.
• the SAP server module 21 is designed to interrogate the SIM card reader 22 and the SIM card 10 that can be read by the reader, and to send back to the client SAP module information on the state of the reader. 22, the presence of a SIM card in the reader and the status of the SIM card.
• the SAP client module 31 is in particular designed to issue commands for the SIM card for switching on / off, initialization and control. containing Application Protocol Data Units (APDU) messages, the SAP server module being designed to relay these commands for application to the SIM card via the reader 22.
• the SAP server module is also designed to warn the SAP client module of all the events change of state of the SIM card inserted in the reader, for example as a result of a user action of inserting or removing the card from the reader.
• the procedure for accessing the SIM card which is implemented on the terminal side 40 is carried out using a client module 44, installed in the terminal 40, and having access to a PC / SC interface module ( Personal Computer / Smart Gard) 45 with a SIM card.
• This module 44 may request access to the SIM card for example for authentication purposes. It can then be a PC identity management software (ex: VPN client, Web browser using SSL v3), TV, ... or a "plug-in" associated with a Web browser that needs to read authentication data in a remote SIM card.
• PC identity management software ex: VPN client, Web browser using SSL v3
• TV TV
• ... or a "plug-in" associated with a Web browser that needs to read authentication data in a remote SIM card.
• the module 44 therefore uses SIM card access and control functions performed by the PC / SC interface module 45.
• the PC / SC interface module 45 is usually designed to interface with smart card readers (smart card or microprocessor card) or SIM cards via drivers adapted to the type of readers, thus allowing applications to interact with these readers.
• the invention then implements an access module 35, acting as a pilot, implemented at the level of the domestic gateway 30, designed to relay and adapt the messages exchanged between the interface module 45 implemented on the terminal side and the SAP client module 31 implemented on the gateway side, these messages containing information exchanged with the SIM card 10.
• the interface module 45 comprises a resource management module 47 and a service provider module 46.
• the resource management module 47 is designed to specify the mobile terminals that can be used by the system. , specify the active mobile terminal, that is to say that which will be used by the system in the event of a request on the interface module 45, and make this information available to several applications such as the authentication application 44
• This module is also designed to manage requests for access to smart cards issued by applications, and to order smart cards.
• the service provider module 46 is designed to offer the applications functions linking several commands applied to a smart card to perform a single function for accessing or processing information provided by the latter, these functions including cryptographic functions and authentication.
• the APDU routing process uses the services offered by access module 35 on the gateway.
• the access module 35 is designed to receive from the interface module 45 command transmission messages to be applied to the SIM card, these messages from the client application 44, to transmit these messages to the SAP client module 31 so that the commands they contain are finally transmitted to the smart card 10. It is also designed to receive the responses of the SIM card and to retransmit these responses to the application 44.
• Access to the remote SIM card 10 located in the mobile terminal 20 can thus be performed using the access module 35 on the gateway, which allows proxy-mode flow management corresponding to the different requests for access to the terminals.
• the gateway-side access module provides a SOAP-type interface.
• the SOAP protocol is a communication protocol based on XML and HTTP, which ensures the interoperability of applications.
• the IP gateway is thus accessed, which is then responsible, via the access module and the Bluetooth module, for sending to the SIM card messages containing APDU commands issued by the applications.
• the SOAP interface therefore allows communication with a SIM card via APDU.
• the functions called at this interface must cause the execution of the same function at the SAP client module 31 located in the gateway. It should be noted that the embodiment described above based on the implementation of the module PC / SC interface terminal 40, is particularly suitable in cases where the client application usually uses PC / SC
• the method according to the invention integrates without impacts existing architectures.
• the application does not use PC / SC, it may be more relevant to use as a variant a SOAP or TCP direct interface to the gateway, which advantageously makes it possible to accelerate exchanges by deleting the process performed by the PC / SC interface.
• another embodiment is provided, aimed at proposing an alternative to the implementation of the SAP server module on the mobile terminal. Indeed, when using the SAP protocol in server mode on the mobile terminal, the latter is completely transparent to the user and ultimately behaves like a simple card reader. One is then dependent on the implementation chosen by the manufacturer of mobile, which prevents to have a control on the access to some data in the SIM card.
• the mobile terminal comprises a module for converting commands to the SIM card, different from an SAP server.
• An example of use would be to allow the PIN to be entered on the mobile terminal itself. So, as part of an authentication process of the user implying an access to the SIM card according to the invention, rather than requesting the PIN code on the user terminal, it would be requested on the mobile terminal. In this way, the PIN code would not have to pass on the IP link between the gateway and the user terminal, which is preferable in terms of security.
• the mobile terminal conversion module is in the form of a server which receives APDU commands, interprets them and transforms them into a call of functions of the RIL API type ("Radio Interface Layer") for example in the case of an implementation on Microsoft Windows Mobile mobile platform.
• the interpretation module then relies in the exemplary embodiment on a function library created by Microsoft, for dialogue directly with a modem and in particular with the SIM card through various functions.
• the conversion module implemented on the mobile terminal will allow access to certain data of the SIM card such as the size of certain records, as well as the information they contain.
• the mobile terminal conversion module cooperates with a network interface application.
• This application has the role of establishing a wireless connection, Bluetooth or other type, with a client during an access request received from the latter.
• the specifications of this interface may be advantageously in accordance with SAP protocol specifications.
• the conversion module based for example on the Microsoft RIL API, will then allow to send the SIM request and read its response. However, being based on the RIL API, it must first do the APDU request conversion. For that, it will be responsible for initially transforming the APDU request into the corresponding SIM command. If no order matches, an error message will be sent directly to the customer. Once the command is executed with the correct parameters, the SIM card returns a response that the conversion module will be responsible for formatting the APDU to return to the client.
• a remote SIM card via a wireless link via a home gateway can be used in many other applications, such as, for example, signature, encryption, digital data, etc.
• a signature, encryption or decryption application a certificate associated with a secret key corresponding to the user can be stored in the SIM card and used by software
• PKCS # 11 type located either in the gateway or in the terminal. More generally, the invention can be used to exchange data with a memory card via a home gateway.
• the generic implementation associated with this operation implements an application located on the SIM card offering security functions (eg signature applet, decryption, secure storage, secure counting / down counting, etc.) to a service provided. by a home gateway and accessible from a terminal connected to this gateway.
• security functions eg signature applet, decryption, secure storage, secure counting / down counting, etc.

Applications Claiming Priority (2)

Publications (1)

Family

ID=35004218

Family Applications (1)

Country Status (2)

Families Citing this family (11)

Citations (3)

Family Cites Families (2)

• 2006
  • 2006-01-24 EP EP06709160A patent/EP1849320A1/de not_active Withdrawn
  • 2006-01-24 WO PCT/FR2006/000161 patent/WO2006087438A1/fr active Application Filing

Patent Citations (3)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events