EP2041686A1

EP2041686A1 - Server for managing anonymous confidential data

Info

Publication number: EP2041686A1
Application number: EP07787274A
Authority: EP
Inventors: Frédéric Faure; Gary Chew; Lionel Martin
Original assignee: Gemalto SA
Current assignee: Thales DIS France SA
Priority date: 2006-07-10
Filing date: 2007-07-09
Publication date: 2009-04-01
Also published as: JP2009543489A; US8386518B2; US20090319488A1; WO2008006811A1

Abstract

When a user records confidential data in a communicating object, the user inputs the confidential data which are encoded and transmitted, with a reference of the user, towards a server (ADS) in order to record the encoded confidential data in association with the reference. When a user searches for a reference of another user of a communicating object in the communicating object, the user inputs a search datum which is encoded and transmitted to the server for comparing therein the encoded search datum transmitted to all of the encoded confidential data recorded in the server. The server transmits a reference associated with an encoded confidential datum corresponding to the encoded search data to the communicating object. In this way, the user of the communicating object is put into contact with the other user without knowing the data of said other user.

Description

Anonymous confidential data management server

The present invention relates to an anonymous confidential data management server.

In personal data directory management servers implemented in networks with Internet type infrastructure, such as an email server in which email addresses are stored, users must provide the server with information that characterizes them. Such a management server can be attacked by a malicious entity that accesses the database of the server to all the personal information of users to use fraudulently.

In the case of ad-hoc decentralized networks, the user terminals store their personal data locally and exchange them directly with other terminals in point-to-point communication. A first terminal wishing to communicate with a second terminal of the network must first perform a search for information characterizing the second terminal to obtain a contact identifier of the second terminal such as a telephone number or an Internet address. During this search, the first terminal must address many network terminals before obtaining a first contact with the second terminal, which leads to a long search time and a significant occupation of the network. A solution to the drawbacks mentioned above is recommended in the US patent application US 2004/0139025 filed November 10, 2003 concerning a method of protecting personal information. This process guarantees the control and confidentiality of the personal information of individuals, prevents unauthorized use thereof and allows limited use by access rights. Individual data is collected and maintained in a secure database of confidential data. The rights of access to an individual's confidential data are included in notifications transmitted from the database managing entity to other parties involved in the confidential data transactions of the individual. Thus each party involved in a transaction knows the identity of the individual and can then communicate directly with it.

The invention aims to find a contact of a user based on his private personal information without disclosing them. Thus an entity having made such a search is put in relation with the user without knowing the personal data of the user.

To achieve this objective, a method for managing confidential data of users of communicating objects stored in a server medium, the communicating objects and the server medium communicating through a telecommunications network, is characterized in that it comprises the steps following: storing encoded confidential data and a user reference transmitted from a first communicating object in the server medium, and searching for a reference of a user from stored encoded confidential data associated with other user references in the server means as a function of at least one coded search data transmitted from a second communicating object, and transmission of at least one user reference associated with a coded confidential data item corresponding to the search data coded by the server means to the second communicating object.

More particularly, the coded confidential data record may comprise an input of the confidential data of the user from the first communicating object, a coding of said confidential data and a transmission of the coded confidential data and the reference of the user to the means. server in order to record the coded confidential data in association with the reference of the user in the server medium among coded confidential data associated with references of other users. The reference search can comprise an input of at least one search data from the second communicating object, a coding of the search data into the coded search data, a transmission of the coded search data to the server means so that the one it compares the coded search data transmitted to all the coded confidential data stored in the server means, and transmits to the second communicating object at least the reference associated with the coded confidential data item corresponding to the coded search data item. According to the invention, the server means does not contain personal user data but encrypted confidential data undecipherable by a malicious entity attempting to access the data in the server medium. Thus, the method of the invention has the advantage of obtaining a reference from a user of the network from search data characterizing the user in order, for example, to relate to the latter, without the latter disclosing his information. confidential personal data.

According to one characteristic, the method comprises an update of at least a first confidential data of the user into a modified confidential data item from the first communicating object, a coding of said modified confidential data item and a transmission of the first coded confidential data item. coded modified confidential data and the reference of the user to the server means, a deletion of coded confidential data associated with the reference of the user in the server means and identical to the first coded confidential data transmitted, and a record of the modified confidential data encoded in association with the reference of the user in the server medium.

According to another characteristic of the invention, during the recording, each confidential data item is associated with a category that characterizes it and is recorded coded in the server medium in association with said category and the reference, and during the search, the reference and category associated in the server medium with a coded confidential data corresponding to the data coded search are transmitted to the second communicating object.

According to yet another characteristic of the invention, during the recording, the confidential data entered by the user in the first communicating object is declined in at least one confidential version which is also coded, transmitted to the server means and recorded in the server medium in association with the reference of the user of the first communicating object; and during the search, the search data in the second communicating object is divided into at least one search variation which is coded, transmitted to the server means and compared with the confidential coded data and associated associated coded confidential declensions in the server medium.

The invention also relates to a server means for managing confidential data of users of communicating objects through a telecommunications network. The server means is characterized in that it comprises: means for storing coded confidential data and a reference of a user transmitted from a first communicating object, means for searching a reference of a user among registered coded confidential data associated with other user references as a function of at least one coded search data transmitted from a second communicating object, and means for transmitting at least one user reference associated with a coded confidential data corresponding to the data of coded search to the second communicating object. The invention also relates to a communicating object, communicating through a telecommunications network with a server means for managing confidential data of users. The communicating object is characterized in that it comprises during a recording of confidential data of the user of the communicating object: a means for entering said confidential data; means for encoding said confidential data; and means for transmitting the encrypted confidential data and a reference of the user to the server means for storing the encoded confidential data in association with the user reference in the server medium among coded confidential data associated with references unique to other users.

The invention also relates to a communicating object, communicating through a telecommunications network with a server means for managing confidential data of users. The communicating object is characterized in that it comprises, when searching for a reference of a user of another communicating object: a means for entering at least one search data item; means for encoding the search data into coded search data; and means for transmitting the coded search data to the server means for the server to compare the transmitted coded search data with all coded confidential data stored in the server. medium server, and transmits to the communicating object at least one user reference associated with an encoded confidential data corresponding to the coded search data. More generally, a communicating object according to the invention may comprise both the means stated in the two preceding paragraphs.

Finally, the invention relates to a computer program adapted to be implemented in a server means communicating with communicating objects through a telecommunications network for managing confidential data of users of communicating objects. The program includes instructions which, when the program is executed in said server means, perform the steps according to the method of the invention.

Other features and advantages of the present invention will appear more clearly on reading the following description of several embodiments of the invention given as non-limiting examples, with reference to the corresponding appended drawings in which: FIG. a schematic block diagram of an anonymous confidential data management system implementing an anonymous confidential data management method according to the invention; Figure 2 is a more detailed block diagram of the system of Figure 1;

FIG. 3 is an algorithm representative of a first main step of the method for storing confidential user data according to the invention; and FIG. 4 is an algorithm representative of a second main step of the method according to the invention for searching a reference relating to anonymous confidential data of a user.

FIG. 1 represents an anonymous confidential data management system comprising an anonymous confidential data management server ADS and communicating objects such as a mobile radio terminal TA, a personal computer TB or any other personal communication device, through a network. RR-RPQ telecommunications network.

The telecommunications network comprises a GSM type cellular radio network with mobility management and GPRS radio access, or third generation Coded Division Multiple Access (3GPP) type multiple access type. UMTS type (Universal Mobile Telecommunications System) or UTRAN (UMTS

Terrestrial Radio Access Network), or the third generation (3GPP2) of the CDMA 2000 type, backed by an Internet-based RPQ packet-switched network. The network RT can also be a WiFi type local network (Wireless Fidelity), WiMax

(Worlwide Interoperability for Microwave Access) or

Wibro (Wireless Broadband), or a proximity network of the infrared, Bluetooth or NFC type (Near

Field Communication).

The anonymous confidential data management server ADS is connected to or comprises a database BD which contains confidential data coded DC1 to DCN respectively associated with unique references RU1 to RUN. Datas confidential DCA, DCB, with l ≤ A ≤ N, l ≤ B ≤ N, are for example personal data of a user of a communicating object TA, TB, and correspond for example to the name of the user, his first name, date of birth, home address, phone number (s), occupation, business address. The unique reference RUA, RUB of the user can be his phone number. However, it is preferable that this unique reference remains anonymous and characterizes the user and / or his terminal without allowing the user to be directly identified and to allow direct communication with him.

A user who wishes to communicate with another user without necessarily disclosing his personal data uses the management server 1 of the invention.

The management server implements an anonymous confidential data management method comprising two main steps respectively represented in FIGS. 3 and 4. These main steps are a record of confidential anonymous coded data of a user associated with a unique reference of the user in the database BD, and a search for a unique reference of a user based on a coded search data among anonymous confidential coded user data stored in the database BD.

When recording confidential data of a user of a first communicating object, for example the mobile radio terminal TA, the terminal TA transmits the confidential data in DCA encoded form and a single reference RUA characterizing the terminal user to the ADS server via the RR radio networks and RPQ packets. The ADS server stores the DCA data in association with the reference RUA in the database BD.

During a search for confidential data by a user of a second communicating object, for example the personal computer TB, the computer TB transmits to the server ADS via the packet network RPQ a request RQ containing search data encoded DRC. In response, the server sends him one or RUn user references relating to confidential data DCn stored in the database BD and corresponding to the search data DRC, with 1 <n ≤ N.

When the communicating object is a mobile terminal TA, the data exchange between the terminal TA and the server ADS takes place between the radio network RR and the packet network RPQ via, for example, a gateway. communication not shown in Figure 1. The communication gateway may include an access gateway for communicating with the ADS server through the network of high-speed RPQ packets. Another access gateway of the communication gateway communicates with at least one switch of the RR radio network, often through an access network such as an X.25 type packet network or an ISDN network (network Digital to Service Integration) or ATM (Asynchronous Transfer Mode).

The communication gateway exchanges with the mobile radio terminal TA through the RR network messages that encapsulate IP packets (Internet Protocol) forwarded to and through the ADS server through the RPQ network.

In FIG. 2, the anonymous confidential data management server ADS and the communicating object TA are represented in the form of functional blocks, most of which provide functions relating to the invention and can correspond to software modules and / or or materials. In order not to overload Figure 2, the communicating object TB is not shown.

The anonymous confidential data management server ADS comprises a data manager GD which manages various operations in the database BD, and a communication interface IC for transmitting and receiving IP packets through the packet network RPQ.

The operations managed by the manager GD include the recording of confidential coded data of a user transmitted by the communicating object of the user in association with a unique reference of the user, the search for confidential data encoded in the database BD compared to search data transmitted by another communicating object, and the establishment of a response RP containing one or references to the confidential data encoded in the database corresponding to the search data.

The communicating object TA illustrated in FIG. 2 is a mobile radio terminal associated by or without contact with a CA smart card. The mobile radio terminal TA comprises an IRT radio interface, a PT processor, an HMI human-machine interface, MT memories and an LT card reader. The various elements of the terminal are interconnected by a bidirectional bus BT.

The interface HMI controls the interaction between the terminal TA and the user of the terminal, and comprises a keyboard associated with a display and / or a touch screen and optionally a voice recognition device.

The CA smart card is a multi-media card (MMC), or SD (Secure Digital) or USB (Universal Serial Bus) or UICC (Universal Integrated Circuit (s) Card). The UICC smart card is for example a card provided with a Subscriber Identity Module (SIM) application when the terminal hosting the card is a mobile connected to a GSM / GPRS type network (Global System for Mobile Communications / General Packet Radio Service). ), or a Universal Subscriber Identity (USIM) application

Module), ISIM (Removable User Identity Module), ISIM

(IP Subscriber Identity Module) or EAP-SIM

(Extensible Authentication Protocol), when the terminal hosting the card is a mobile operating CDMA multiple access code division of the third generation (3GPP) type UMTS or UTRAN, or the third generation (3GPP2) type CDMA 2000.

The CA chip card mainly comprises a PC processor, or several processors, and three memory blocks M1 to M3. The card exchanges commands, or requests, and responses with the TA terminal through a PES input / output port and the LT reader with or without contact. The different elements of the card are connected to each other by a bidirectional bus BC.

The memory Ml is of the ROM or Flash type and includes the operating system of the card.

The memory M2 is a non-volatile memory, for example EEPROM or Flash, in particular for storing keys, identity numbers and other parameters of the profile of the user having the card, such as personal data, a PIN code and other data. of security. The memory M2 also includes the unique reference RUA of the user and an AC coding algorithm. The AC coding algorithm has the particularity of carrying out a one-way coding on a datum that does not then make it possible to retrieve the datum by applying an inverse algorithm. The coding algorithm is for example an asymmetric encryption algorithm or a generator of a graphical representation representing the data once coded.

The memory M3 is a RAM or SRAM memory used more particularly for data processing.

The CA smart card further comprises, in relation to the invention, an AE recording application, an AR search application and a software module called an AgC coding agent (applet), distributed in the memories M1 and M2.

The applications AE and AR relate to the two distinct main steps of the method of the invention and are activated from the human-machine interface HMI under the control of the user of the terminal.

The AE recording application displays on the HMI interface fields for entering and validating confidential data by the user of the terminal when he wishes to record personal data in the ADS server.

The search application AR displays on the interface HMI fields to enter and validate search data by the user when it wishes to obtain a unique reference from another user of a terminal of the telecommunications network that has already registered his personal data with the ADS server. The search application also displays the unique reference (s) obtained from the ADS server or a result derived from these references.

According to one variant, the two applications AE and AR are one and the same application.

The main function of the AgC coding agent is to memorize in the memory M2 and to code the data entered and validated on the human-machine interface HMI in order to transmit them in coded form to the ADS server.

The role of the AgC encoding agent and both applications is described in more detail with reference to FIGS. 3 and 4.

According to one variant, the MT memories of the terminal TA comprise the two applications AE and AR and optionally the coding agent AgC.

According to another variant, the communicating object of a user, such as the terminal TA associated with the smart card CA, includes only one of the two applications AE and AR for either saving personal data or performing a search to obtain one or more references from other users.

The invention is not limited to a mobile radio terminal associated with a smart card. The map to chip can also be a card included in a portable computer for example connected to a mobile terminal or directly connected to the Internet, a credit card, an electronic purse card, a health card, an electronic passport, or any other additional card linked to a mobile terminal.

According to other variants, the invention applies to other portable communicating electronic objects, such as personal computers or PDA communicating personal digital assistants.

With reference to FIG. 3 and relative to the communicating objects TA and TB of FIGS. 1 and 2, the main step of recording confidential data of the anonymous confidential data management method comprises steps E1 to E7. In step E1, the user of the mobile radio terminal TA activates the recording application AE by means of the interface HMI. It displays personal data entry fields such as a name field, a first name field, a date field, an address field, a phone number field and a profession field.

The user enters personal data DA in step E2. Optionally, the user selects from the personal data entered those DPA he wishes to register anonymously and confidentially in the ADS server to allow a subsequent search of its reference by another user.

Upon validation of the recording, after selecting a validation icon for example on the HMI interface, in step E3, the recording application AE transfers the data entered to the AgC coding agent. This one memorizes all the personal data DA transferred to the memory M2 of the card, in step E4. Then, in step E5, the AgC agent applies the AC one-way coding algorithm to the selected DPA data in order to encode them into DCA-encoded personal data.

In step E6, the agent AgC establishes a registration message MR comprising the personal data encoded DCA and the reference RUA of the user read in the memory M2. The message MR is transmitted by the radio interface IRT of the terminal TA to the server ADS.

On receipt of the message MR by the communication interface IC in the ADS server, in step E7, the data manager GD of the ADS server stores the confidential data encoded DCA in association with the reference RUA in the database BD .

According to one variant, the message MR also includes for each personal coded data transmitted the category, or an identifier of the category, of the associated input field transmitted in clear, such as "name", "first name", "date", "address" "," phone number "or" profession ". Thus in the database, each coded personal data is registered in association with its category or the category identifier, and the set of DCA data and their categories is registered in association with the unique reference RUA of the user.

After the user has stored coded confidential data in the ADS server, the user can modify some of these confidential data and thus update them in the middle server. In order to update the confidential data of the user, the recording application AE optionally displays all the confidential data stored in the memory M2 by means of the interface HMI of the terminal. The user modifies one or more confidential data some of which have been previously selected or are newly selected by the user to be recorded anonymously in the ADS database BD. On validation of the update, after selecting a validation icon for example on the HMI interface, the application AE transfers the modified data to the coding agent. It updates them in memory M2 by overwriting the corresponding initial data, and encodes the selected modified data. Then the encoding agent transmits a message containing the encoded modified confidential data, the initial encoded confidential data and the reference of the user to the ADS server.

On reception of the message, the data manager GD of the ADS server deletes from the database BD the confidential coded data associated with the reference of the user extracted from the message and which are identical to the initial confidential coded data also extracted from the message. message. The manager GD stores, in the database BD, the coded modified confidential data extracted from the transmitted message, in association with the reference of the user.

Referring now to FIG. 4 and relative to the communicating objects TA and TB of FIGS. 1 and 2, the main step of searching for confidential data of the management method of FIG. anonymous confidential data includes steps R1 through R8.

In step R1, the user of the personal computer TB wishing to obtain the reference RUA of the user of the terminal TA activates the search application AR by means of the interface HMI. It displays search fields for confidential data such as a name field, a first name field, a date field, an address field, a phone number field and a profession field.

In step R2, the user of the computer TB enters in the search field or fields at least one DR search data or often DR search data characterizing the user of the terminal TA with which the user of the computer TB wishes to be connected, for example.

At the validation of the search, after the selection of a validation icon for example on the HMI interface, in the step R3, the search application AR transfers the data or search data DR input to the agent AgC coding of the TB computer. In step R4, the agent applies the one-way coding algorithm AC, identical to that used by the coder of the terminal TA, to the search data item DR in order to code it into coded search data. DRC. The DR data is thus coded in a manner similar to the personal data stored in coded form in the database BD. In step R5, the AgC agent of the computer TB makes a request RQ including the search data encoded DRC. The request RQ is transmitted to the server ADS by a communication interface of the computer TB to the server ADS. On receipt of the request RQ by the communication interface IC in the server ADS, in the step R6, the data manager GD of the server ADS compares the confidential coded data DCn associated with each reference RUn with the transmitted coded search data. DRC extracted from the RQ request. If one or more confidential data are respectively identical to one or more DRC encoded search data, then the reference associated with the encoded confidential data is copied into a response RP established by the manager GD.

The manager GD performs the same operation for each reference recorded in the database BD, the DRC encoded search data extracted from the request RQ can be identical to certain confidential coded data associated with two or more different references RUl to RUN.

As soon as all the confidential data associated with all the references in the database have been compared, the response RP including one or more references RUn associated with confidential data identical to the search data encoded DRC is transmitted to the computer TB. In step R7, the response RP is processed by the AgC coding agent of the computer TB which instructs the search application AR to display the transmitted references RUn by means of the human-machine interface HMI, in step R8.

Alternatively, the request RQ also includes for each coded search data transmitted the category, or an identifier of the category, the associated search field, transmitted in clear, such as "name", "first name", "date", " address "," number of telephone "or" profession. "Thus the ADS GD data manager compares the DCn encoded confidential data associated with each RUn reference and the categories associated with these data with respectively the DRC encoded search data and the associated associated categories extracted from the request. This makes it possible to establish a response containing the references corresponding to the coded confidential data which are identical to the coded search data and whose associated categories are identical to the categories associated with said coded search data.

According to a second variant, the data manager GD includes in the response RP one or more references RUn in association with the coded search data identical to the confidential coded data associated with said references in the database BD. On receipt of the response RP in the computer TB, the search application AR of the computer TB displays, by means of the human-machine interface HMI, the transmitted references RUn together with the corresponding search data entered by the user. in step R1 and relating to the coded search data extracted from the RP response.

According to a third variant, for each coded confidential data corresponding to a coded search data item, the category associated with the confidential data item is included in the response RP in association with the reference relating to said confidential data item. The response RP therefore includes one or more references associated with categories of encrypted confidential data corresponding to the coded search data.

The transmitted categories are displayed on the HMI interface together with the references to which they are associated.

According to an example of use relating to the preceding variant, the user of the computer TB wishes to be put in contact with the user of the terminal TA. The user of the computer TB activates the search application AR by means of the interface HMI, and enters in the search field "name", the name of the user of the terminal TA as search data. The AgC agent of the computer TB encodes the search data and transmits it in a request RQ to the ADS server.

Upon receiving the request, the server ADS searches the database BD as described in step R6, and obtains two identical confidential data corresponding to the transmitted search data. The categories and references associated with the two confidential data obtained are respectively different. The first confidential data associated with a first reference corresponds to a first name while the second confidential data associated with a second reference corresponds to a name. The ADS server transmits an RP response including the two references and the two categories respectively associated with the computer TB.

In step R8, each category is displayed on the HMI interface together with the reference with which it is associated, indicating for example that a first reference is relative to a first name and that the second reference relates to a name. When the transmitted and displayed categories are read, the user selects the second reference relating to the category "name" and further characterizes the user of the terminal TA in order, for example, to communicate with the latter using the reference selected. .

In order to avoid collisions relating to the separate coding of two separate personal data into a single coded data item, the one-way coding algorithm AC may comprise two different coding functions. Each personal data item to be encoded is applied to each of the two functions in order to obtain from the same personal data two separate coded data concatenated into a pair registered in association with the same category in the database BD. When searching for a reference of a user, the entered search data is also encoded to obtain two distinct concatenated search data to compare with all pairs of concatenated coded confidential data stored in the database.

According to another variant, during the recording, each personal data input by means of the interface HMI and transmitted to the coding agent in the terminal TA is declined by the agent in one or more generally several declensions which can be parts of the personal data entered and / or data substantially similar to the personal data entered or parts of it, for example distinct by their spelling and / or pronunciation. These personal data and their variations are coded by the coding agent and transmitted with their references associated with the ADS server that records them.

When searching for a reference, each search data input by means of the HMI interface and transmitted to the coding agent is declined by the agent in one or more generally several variations of the entered search data. This search data and their variations are coded by the coding agent and transmitted to the ADS server which compares them with the coded confidential data and their coded declensions recorded in the database BD.

The references of the coded confidential data and / or their coded versions corresponding to the coded search data and / or their coded declensions are transmitted to the terminal requiring a search, and are displayed in order of similarity of the variations of the search data entered with the research data.

The invention described here relates to a confidential data management method. According to one implementation, the steps of the method of the invention are determined by the instructions of a computer program incorporated in an ADS server means communicating with communicating objects TA, TB through an RR-RPQ telecommunications network to manage confidential data of users of communicating objects. The program comprises program instructions which, when said program is executed in a processor of the server means, perform the steps of the method according to the invention. The program can also be executed partly in communicating objects TA, TB. Accordingly, the invention also applies to a computer program, in particular a computer program recorded on or in a computer readable information medium and any data processing device, adapted to implement the computer program. 'invention. This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code such as in a partially compiled form, or in any other form desirable to implement the method according to the invention.

Claims

1 - Method for managing confidential data of users of communicating objects (TA-TB) recorded in a server means (ADS), the communicating objects and the server means communicating through a telecommunications network (RR-RPQ), characterized in that it comprises the following steps: recording (E2 - E7) of coded confidential data (DCA) and a reference (RUA) of a user transmitted from a first communicating object (TA) in the server means, search (R2 - R6) of a reference of a user among recorded confidential coded data associated with other user references (RUl-RUN) in the server means according to at least one coded search data (DRC ) transmitted from a second communicating object (TB), and transmission (R7) of at least one user reference associated with coded confidential data corresponding to the search data coded by the server means to the second communicating object.

2 - Method according to claim 1, according to which the recording of coded confidential data (DA) comprises an entry (E2) of the user's confidential data from the first communicating object (TA), coding

(E5) of said confidential data and a transmission

(E6) coded confidential data (DCA) and the reference (RUA) of the user to the server means in order to record

(E7) the confidential data coded in association with the user's reference in the server means among coded confidential data (DCl-DCN) associated with references (RUl-RUN) of other users.

3 - Method according to claim 1 or 2, comprising an update of at least one first confidential data (DA) of the user into confidential data modified from the first communicating object (TA), a coding of said data modified confidential data and a transmission (E6) of the first coded confidential data (DCA), of the coded modified confidential data and of the reference (RUA) of the user to the server means, a deletion of a coded confidential data associated with the user's reference in the server means and identical to the first coded confidential data transmitted, and a recording of the modified confidential data coded in association with the user's reference in the server means.

4 - Method according to any one of claims 1 to 3, according to which the reference search comprises an entry (R2) of at least one search data (DR) from the second communicating object (TB), a coding ( R4) of the search data into the coded search data (DRC), a transmission (R5) of the coded search data to the server means so that the latter compares (R6) the coded search data transmitted to all the data confidential coded data recorded in the server means, and transmits (R7) to the second communicating object at least the reference associated with the coded confidential data corresponding to the coded search data. 5 - Method according to any one of claims 1 to 4, according to which during recording, each confidential data (DPA) is associated with a category which characterizes it and is recorded coded in the server means (ADS) in association to said category and to the reference (RUA), and during the search, the reference and the category associated in the server means with coded confidential data corresponding to the coded search data (DRC) are transmitted to the second communicating object (TB ) .

6 - Method according to any one of claims 1 to 5, according to which the confidential data (DPA) and research data (DR) are coded by application of a one-way coding algorithm (AC) to said data.

7 - Method according to any one of claims 1 to 6, according to which during recording, confidential data (DPA) in the first communicating object (TA) is broken down into at least one confidential variation which is also coded, transmitted to the server means (ADS) and recorded in the server means in association with the reference (RUA) of the user of the first communicating object, and during the search, the search data (DR) in the second communicating object (TB ) is broken down into at least one search variation which is coded, transmitted to the server means and compared to the coded confidential data and the associated coded confidential variations recorded in the server means. 8 - Server means (ADS) for managing confidential data of users of communicating objects (TA, TB) through a telecommunications network (RR-RPQ), characterized in that it comprises: a means (GD, BD ) for recording coded confidential data (DCA) and a reference (RUA) of a user transmitted from a first communicating object (TA), means (GD) for searching for a reference of a user among associated recorded coded confidential data to other user references (RUl-RUN) according to at least one coded search data (DRC) transmitted from a second communicating object (TB), and a means (IC) for transmitting at least one reference d The user associated with coded confidential data corresponding to the search data coded in the second communicating object.

9 - Communicating object (TA), communicating through a telecommunications network (RR-RPQ) with a server means (ADS) to manage confidential user data, characterized in that it understands during data recording confidential data of the user of the communicating object: a means for entering (IHM-AE) said confidential data; means (AgC) for encoding said confidential data; and means (IRT) for transmitting the coded confidential data (DCA) and a user reference (RUA) to the server means in order to record the coded confidential data in association with the user reference in the means server among coded confidential data (DCl-DCN) associated with references (RUl-RUN) of other users.

10 - Communicating object (TB), communicating through a telecommunications network (RR) with a server means (ADS) to manage confidential user data, characterized in that it understands when searching for a reference of a user of another communicating object: a means (IHM-AR) for entering at least one search data (DR); means (AgC) for encoding the search data into coded search data (DRC); and means (IRT) for transmitting the coded search data to the server means so that the latter compares the transmitted coded search data with all the coded confidential data recorded in the server means, and transmits to the communicating object at least one user reference associated with coded confidential data corresponding to the coded search data.

11 - Computer program capable of being implemented in a server means (ADS) communicating with communicating objects (TA, TB) through a telecommunications network (RR-RPQ) to manage confidential data of users of the objects communicators, said program being characterized in that it comprises instructions which, when the program is executed in said server means, carry out the following steps: recording (E2 - E7) of coded confidential data (DCA) and a reference ( RUA) of a user transmitted from a first communicating object (TA) in the server means, and searches (R2 - R6) for a user reference among recorded confidential coded data associated with other user references (RUl -RUN) in the server means as a function of at least one coded search data (DRC) transmitted from a second communicating object (TB), and transmission (R7) of at least one user reference associated with confidential data coded corresponding to the search data coded by the server means to the second communicating object.