FR2878047A1 - Universal serial bus key for controlling access of user to computer, has memory storing identification data related to user access space of authorized user - Google Patents

Abstract

An authentication module determines whether user is an authorized user, and allows user to access user space corresponding to identification data recorded in memory (2). A filter recognizes a request involving key file belonging to user space. A processing module processes each request to create and/or access key file and permitting the processing of corresponding request in host station (5). An independent claim is also included for information system.

Description

PERSONAL PORTABLE MASS MEMORY SUPPORT AND SYSTEM

  The invention relates to a personal portable mass memory support and a computer system that enables each user with such personal support to securely access a user computer space. its own, via a network such as the Internet, securely and from any host computer station not previously specifically configured or dedicated to manage this user space or allow access to this user space.

  Various known systems propose the use of a personal medium such as a universal serial bus (USB) to control the access of a user to a computer, or more generally to computer resources, by one or more words ( s) passwords (symmetric key (s)) saved in encrypted form on the media. For example, SECURIKEY or WIBU-KEY systems (marketed by WIBU-SYSTEMS, Karlsruhe, Germany). However, these systems do not allow a user to access computer resources in a personalized manner (user space) that may include documents, files, data, programs, etc. from any computer station not previously configured for this purpose and connected. to a network.

  In addition, with these known systems, all means of identity verification or authentication, including software, are stored on the key, so that access to personal computing resources is impossible for a user who has lost his personal support. Conversely, a third party in possession of the personal medium can access these resources if it can re-read the password (s) from the medium, which is technically not impossible.

  US-2004/0001088 discloses a portable device such as a USB key for transporting the personal computer environment of a user, in the form of files stored on the non-volatile memory of this USB key. This personal environment contains favorites, emails, contacts, cookies (cookie programs), digital signatures, wallpapers, desktop icons, calendars and calendars, toolbar configurations, audio configurations, graphics, game options ... This environment can be defined by downloading from a website whose address is stored on the USB key. This system is therefore to use the memory of the USB key to transfer a computer environment from one computer to another. But, to do this, each computer must be compatible with such an environment, and must be independently and previously programmed to perform the transfer of the personal environment from the information on the portable medium. Thus, this document does not describe a computer system making it possible to access a user space contained in whole or in part on a device other than its personal computers and that the personal medium, and this, from any station initially not specifically configured for such access.

  In addition, other solutions (for example US-2002/0133561) have proposed the realization of a virtual disk on the Internet for storing, retrieving, accessing, controlling and manipulating files remotely by a user from any terminal. But the access to this virtual disk supposes that the terminal used is itself previously configured to allow this access, contains a part of the user space, and is compatible with the technology and the operating system used to store the files. apart. In particular, each terminal must have an Internet browser compatible with the technology used to make the virtual disk.

  Thus, all the previous solutions proposed for the management of a personal user space managed on a network (and not on a specific computer station) come up against the fact that they are closely dependent on the operating system on which they are based and of the specific practical implementation they require (programming, and / or data storage architecture and / or specific technologies). However, the various computing resources that can compose a user space are today very varied and are not necessarily compatible with the programming techniques, architectures, application programs or operating systems required in known solutions.

  Thus, no known solution allows a user to instantly access a user space that may include not only personal data and information, but also data or information shared by other users, application programs installed in executable form, this user space being managed remotely on one or more server (s), and this, from any computer station not previously configured or adapted for this purpose and may contain none of the digital information (programs or data) corresponding to this user space.

  The object of the invention is generally to provide a solution to this problem.

  It therefore aims to provide a portable mass storage medium and a computer system by means of which a user can access a user's computer space of his own from any computer station not specifically configured for this purpose and can itself even not contain any digital information (programs or digital data) corresponding to this user space.

  The invention also aims to allow such access in a secure manner, but without the loss of the personal medium then makes it impossible to access the user space, nor that the mere possession of the personal medium allows this access by a person other than the authentic user.

  The invention also aims to provide such a personal support and such a computer system with which the user space information is automatically updated and synchronized, without risk of data loss, reliably, including in case of Sudden connection break from a station to the network.

  The invention further aims to provide a computer system that is efficient in terms of speed of reaction for the user, simple and ergonomic to use, and very low cost.

  Throughout the text, we adopt the following terminology: - mass memory: any non-volatile rewritable computer memory for storing digital information in a sustainable way regardless of the technology used (magnetic, optical, electronic ...) for realize it, - computer system: combination of hardware (s), software (s), information, files and / or databases, digital data, able to perform predetermined computer functions, - user: a natural or legal person or a group of natural and / or legal persons, - portable: means any object that can be handled by man, carried with one hand, and easily transported continuously, for example in pocket format, - file: this term is used in its logical sense designating a set of digital information referenced by a computer address; for example, it may be one or more physical file (s), or one or more data table (s) or part of a physical file or data table , - user space: set of computer resources, data, software or other information adapted to provide specific computer services to a predetermined user, including the recording of specific information specific to a user, and the provision of this user predetermined data and software; the user space comprises not only data or information created or managed by a user, but also data, information and programs in executable form shared by other users or providers of computing resources.

  The invention therefore relates to a portable mass storage medium, said personal medium, comprising: - at least one mass memory, said personal memory, - means of connection to any computer station, called host station, endowed with: digital processing means with a microprocessor (s) and associated random memory (s), at least one operating and file management system, means of connection combined with those of the personal medium, such that at least a part of the personal memory of the personal medium can be accessed read / write by a host station when the connection means are active, - stored in personal memory, data, called user identification data, identification of at least one human user, said authorized user, authorized to use this personal medium, characterized in that it comprises, stored in personal memory, data forming a process essus, said gateway process, adapted to be loaded into the RAM of a host station to which the personal medium is connected, this gateway process comprising: an authentication module, by the host station, of any human user performing the connection of the personal support at this host station, adapted to determine whether it is an authorized user, and to allow access to the user space corresponding to the user identification data stored in the personal memory only if a authorized user is identified and authenticated, a file query filter module adapted to be able to recognize any request involving at least one file, said CLE file, belonging to a user space of the authorized user, including digital information recorded in a part of personal memory, called local cache, and / or in at least one mass memory of at least one serve it is distinct from the host station and to which the host station having means of connection and access to at least one digital network can be connected via such a network, a module for processing each request on a CLE file adapted to be able to create a CLE file and / or accessing any CLE file and allowing a corresponding request to be processed by the host station's file management and operating system in the same way as if it were a query on a file specific to this host station.

  The invention extends to a computer system for secure access via a network by users to user spaces, comprising: computer stations, called host stations, each equipped with microprocessor-based digital processing means and associated random memory (s), at least one operating and file management system, 15. connective means for connecting connection means of at least one portable mass storage medium said personal medium, so that at least a part of the mass memory of the personal medium can be accessed read / write by the host station when the connection means are active, 20. connection means and access to at least one public digital network -especially the Internet-, - at least one server comprising at least one mass memory, called server memory, and means of connection to at least one public digital network-notably the Inter network net-, and adapted to allow read / write access to at least a portion of this server memory via such a public digital network, - each personal medium comprising: at least one mass memory, said personal memory, r 2878047 means of connection to any host station, stored in a personal memory, data, said user identification data, identification of at least one human user, said authorized user authorized to use this personal medium, each personal medium comprising, stored in personal memory, data forming a process, said gateway process, adapted to be loaded into the RAM of a host station to which the personal medium is connected, this gateway process comprising: an authentication module, by the host station , of any human user making the connection of the personal medium to this host station, adapted to determine whether it is an authorized user, and to allow access to the user space corresponding to the user identification data stored in the personal memory only if an authorized user is identified and authenticated, a file query filtering module adapted to be able to recognize any request involving at least one file, said CLE file, belonging to a user space of the authorized user, comprising digital information stored in a part of the personal memory, called local cache, and / or in at least one server memory at least one server separate from the host station, a module for processing each request on a CLE file adapted to be able to create a CLE file and / or access any CLE file and allow the processing of a corresponding request by the system the host station's file management and management in the same way as if it were a query on a iche specific to this host station.

  Advantageously and according to the invention, the personal media are free of digital processing means other than those necessary, if necessary, for the establishment and operation of the connection means between the personal media and the host stations.

  Personal media may in particular be free of microprocessor, associated RAM and any versatile information processing and / or computing unit. Advantageously and according to the invention, they are also free of human / machine interface (screen, keyboard, pointer ...) and host stations have a human / machine interface. Personal media can thus be reduced to only the elements forming their mass memory and standard connection functions with a host station.

  Advantageously and according to the invention, the connection means of a personal medium to a host station are of the type made active by bringing together and / or connecting the personal medium and the host station. A personal medium according to the invention can advantageously be made in the form of a simple USB key thus making it possible to reduce the investment cost for each user to a minimum.

  However, the invention also applies to more sophisticated personal media (such as portable personal digital assistants (PDAs) or portable computers or portable mass-storage phones ...) that can thus incorporate processing means. microprocessor information and / or a human / machine interface; in this case, however, these information processing means are not useful in the context of the present invention. The human / machine interface of such a medium can partly or completely replace that of a host station.

  Other types of connection that a USB link can be envisaged, alternatively or in combination, for example a wireless radio link (WI-FI or other) or infrared.

  In addition, advantageously and according to the invention, a system according to the invention comprises, stored in personal memory of each personal medium, ROOT_ID data identifying at least one root file recorded on a server, this root file including the architecture of the files. CLE of the user space. In this way, this architecture is not necessarily itself stored on the personal media (except possibly duplicated on the local cache of the personal medium) nor on the host stations.

  According to the invention, preferably, this root file is a CLE file and managed as such.

  Moreover, advantageously, in a computer system according to the invention, the host stations are chosen from: fixed-type personal computers, portable-type personal computers, portable digital processing devices-in particular PDA PDA's or mobile phones-.

  The host stations may be arbitrary and more or less sophisticated, as long as they make it possible to provide information processing and file management means, and preferably at least in part, the human / machine interface. For each user, these host stations can thus be personal computers of the user located at home and at his workplace, a laptop of the user, a personal assistant PDA type, access terminals to Internet with public access (such as those made available in public places such as train stations, airports, media libraries, shopping malls, cybercafé ...) or a computer or personal assistant of a friend or a colleague ... Thanks to the invention, each user thus has instant access to all the files, data and application programs of his user space, from any location, without having to previously manually specifically configure a computer, and this, with using only its personal support, in a perfectly secure way. This results in extremely great management comfort for users at a negligible cost.

  Such storage architecture and secure network access to user spaces has many other advantages related to the complete disruption of the habits and methods of modern computing that the invention involves. In particular, the various updates and evolutions of data and / or application programs can be performed directly on the servers by the Io providers of these data and / or application programs themselves, and no longer require any approach (such as for example download and / or installation) from each user. In addition, the implementation and use of the invention are not dependent on a particular operating system or technology, and are instead compatible with all the software and hardware solutions offered by the publishers or manufacturers. This universal and systematic aspect of the invention represents extremely great ergonomics and appeal for the users.

  Thus, advantageously and according to the invention, the processing module is adapted to be executed in a memory area dedicated to the application programs and accessible in user mode of the RAM of a host station.

  Furthermore, advantageously and according to the invention, the authentication module is adapted to authenticate an authorized user by input by the latter on a man / machine interface - in particular on the human / machine interface of the host station to which the support personnel is connected- a code, said user personal code, allowing validation of the identity of the user by the authentication module, and for storing the user personal code in RAM of the host station, and the process gateway is adapted to transmit the user personal code to each server to which the host station is connected for the purpose of transmitting digital information. This personal user code may be a user password entered on a keyboard, for example the keyboard of a host station, or a digital code representative of a biometric characteristic (fingerprint) entered by a sensor attached to a host station or personal support, or whatever.

  The personal user code is not recorded on the personal medium, the loss or theft of the latter is virtually without consequences for the user who can access his user space again with another personal support.

  Advantageously and according to the invention, each server is adapted to verify the validity of the user personal code before authorizing the establishment of a link between the server and a host station to which a corresponding personal medium is connected.

  Moreover, advantageously, a computer system according to the invention comprises at least one server, said central server, comprising for each user at least one record, said user account, comprising said user identification data associated with the user personal code stored in said registration in form not understandable by the man. Advantageously and according to the invention, said user identification data stored in personal memory of a personal medium comprise a code individually identifying a user and data identifying a central server.

  Advantageously and according to the invention, the processing module includes at least one encryption sub-module with a symmetrical key generated by the processing module from a code provided by the processing module.

  Furthermore, advantageously and according to the invention, each personal medium comprises, recorded in personal memory, an asymmetric encryption public key corresponding to a private key of a central server, this private key being stored in a mass memory of the central server. , and the processing module is adapted to: generate a symmetric key and encrypt it with said public key, transmit this encrypted symmetric key to the central server, itself adapted to decrypt it (with the corresponding private asymmetric key), encrypting the user identification data and the user personal code with said symmetric key before transmitting them to the central server.

  Furthermore, in an advantageous embodiment of the invention, the processing module is adapted to save by default any CLE file of the user space that is digitally processed by the host station in the local cache of the personal memory of the personal support. In this way, the operations performed by the user during a work session are saved on the local cache of the personal medium, and kept even in case of sudden break of the connection to the public network or that between the personal medium and the host station.

  In addition, advantageously, in a computer system according to the invention, the CLE files are identified by a low level identifier compatible with all the operating systems and the file management systems, and all the servers, all the host stations (and their file management system (s)) and all personal media. Thus, advantageously and according to the invention, the processing module is adapted to create each CLE file with an identifier record of this CLE file, called INFO_ID, comprising: a code identifying a server, called FILESERV ID, where this file has been initially registered, - a code identifying a user having created this file CLE, - a numerical code individually identifying the file CLE. Advantageously and according to the invention, an INFO_ID record further comprises: a code determining an encryption mode for the file CLE, a code determining a synchronization mode for the file CLE.

  The encryption mode can be chosen from: an encryption, said automatic encryption, with a symmetric key; an encryption, said manual encryption, by a code entered specifically by the user for the file CLE; and a lack of encryption.

  The synchronization mode determines how the CLE file is updated on a server. This mode of synchronization can be chosen from: a mode, called synchronized mode, in which one reads a file CLE from the local cache if it is present and up to date, and since the server in the opposite case, and one always writes the CLE file in the local cache, the processing module including an automatic update sub-module of the FILESERV ID server when the 20 connections are present; and a mode, said remote mode, in which all reading and writing of a CLE file are performed from and on the corresponding FILESERV_ID server only. The remote mode is used for example for user identification data, or for command files, or for CLE files that the user does not wish to keep on his local cache.

  Advantageously and according to the invention, each personal medium comprises, recorded in personal memory, a file called ID_GENERATION file, including data adapted to allow the processing module to generate digital codes individually identifying the CLE files created by the user.

  The invention further relates to a personal medium and a computer system characterized in combination by all or some of the features mentioned above or below.

  Other objects, features and advantages of the invention will appear on reading the following description of one of its embodiments given by way of non-limiting example, and which refers to the appended figures in which: FIG. 1 is a general diagram of a computer system according to the invention; FIG. 2 is a block diagram of an exemplary embodiment of a personal medium according to the invention in the form of a USB key, FIG. is a diagram illustrating the operation of a personal medium according to the invention and a host station in a computer system according to the invention, - Figure 4 is a flowchart illustrating steps of referencing a personal medium according to the invention in the file management system of a host station, - Figure 5 is a flowchart illustrating steps for managing requests on CLE files of a user space corresponding to a personal support according to the invention in a computer system according to the invention, - Figure 6 is a flowchart illustrating steps implemented for a read request of a CLE file of a user space corresponding to a personal medium according to the invention in a system computer according to the invention, - Figure 7 is a flowchart similar to Figure 6 illustrating steps implemented for a write request on a CLE file of the user space, - Figure 8 is a flowchart similar to Figure 6 illustrating 10 steps implemented for the creation of a new CLE file in the user space.

  As represented in FIG. 1, the computer system according to the invention constitutes a personal information network storage computer architecture allowing secure access to such personal information by any authorized and authenticated user carrying a portable mass storage medium. , says personal support 1, which is his own.

  Such a personal medium 1 according to the invention comprises at least one mass memory, called personal memory 2, which can be made in any known form, especially in the form of an electronic hard disk and / or magnetic and / or optical or other. This personal memory 2 has the property of keeping the information stored in this personal memory 2, permanently, especially when the personal medium 1 is worn by a user between two uses.

  Each personal medium 1 also comprises means 3, 4 of connection to any computer station, said host station 5, itself equipped with digital processing means with microprocessor (s) and associated memory (s) (s) associated (s) ) and at least one operating and file management system. Each host station is also provided with connection means 6, 7 conjugated with those of the personal media 1, so that at least a portion of the personal memory 2 of each personal medium 1 can be accessed read / write by a station host 5 when the means 3, 4, 6, 7 of connection are active.

  Thus, each personal medium 1 can be connected to any host station 5 allowing the user to execute, from this any host station 5, operations on a computer user area of his own, including information and / or or files representing data and / or software, stored on remote machines such as servers 9 separate from the host stations 5 and personal media 1. Of course, nothing also prevents all or part of the user space from being recorded as well. on the personal support 1 of the user. There is nothing to prevent a host station 5 from acting as a storage server for all or part of a user space. Nevertheless, in general, the different host stations 5 to which a given user can connect from his personal medium 1 to perform operations on his user space are not servers, and it is not necessary, nor in general useful, to save all or part of the user space information on a mass memory of the host station 5 itself.

  The personal medium 1 may be, as represented in FIG. 1, a universal serial bus (USB) key 1a, or a portable device lb communicating by radio frequency with a host station (it may be a mobile telephone, or a PDA-type digital personal assistant with a wireless connection, or an electronic memory card equipped with wireless connection means, for example of the so-called WI-FI type ...).

  Any other portable device can be used and considered as a personal support 1 according to the invention since this portable device can easily be worn by a user (pocket size), it is provided with a mass memory and connecting means to the host stations. Such a personal medium 1 may also be equipped with other functionalities, and in particular information processing means or means of communication via satellite or mobile telephony ... Nevertheless, it is an advantage of the invention that to allow to distribute low cost personal media 1 such as USB sticks or simple electronic cards to allow users to access their user space. Such personal media 1 reduced to their simplest expression are not only inexpensive, but lightweight and compatible with many computer standards that can be encountered in host stations 5 scattered throughout the territory.

  In general, the personal support 1 is not equipped with a man / machine interface (screen, keyboard, etc.). On the contrary, a host station 5 is generally equipped with such a man / machine interface. But the invention is of course applicable in the case where at least a portion of the various personal media 1 are equipped with such a man / machine interface. In the latter case, the user can alternatively use either the man / machine interface of his personal support 1, or that of a host station 5 he encounters and to which he connects.

  Thus, any host station 5 having connection means compatible with those of a personal medium 1, information processing means and a connection to a public digital network such as the Internet can be used by a user. to access his user space. Such host stations 5 meet very frequently in various public or private places. It can be the user's different personal computers (in the office, at home ...); computers that the user can meet in the places he visits (customers, suppliers, friends, ...); or even public access stations (Internet access terminals at airports, railway stations, restaurants or cafés ...).

  According to the invention, even if part of the user space can be stored at least temporarily on a personal support 1 of the user, in general, all the information corresponding to a user space is stored on remote servers 9 and accessed remotely via a public digital network such as the Internet from any host station connected to that network.

  Thus, in a system according to the invention, not all of the user's personal information is stored on the personal medium 1 or on a host station 5 to which this personal medium 1 is connected. In an advanced form of the invention, all of the user space information is stored only on remote servers 9 and not on the personal medium 1 or the host station 5, except for the most recent information not yet synchronized with those stored on the servers 9, and which can be temporarily saved only on the personal medium 1, in a part of the personal memory 2 reserved for this purpose, called local cache 8.

  Each personal medium 1 also comprises data, called user identification data, identifying at least one human user, said authorized user, authorized to use the corresponding personal medium 1, and these identification data are recorded in personal memory 2.

  According to the invention, each personal medium 1 comprises, stored in personal memory, data forming a process, said gateway process P, adapted to be loaded into the RAM of any host station 5 to which the personal medium 1 is connected, and to configure this any host station to allow the user to access his user space.

  This gateway process P essentially and functionally comprises three modules (these three modules can be implemented as independent programs or subprograms or on the contrary integrated in the same program), namely: an authentication module A by each host station 5 of any human user connecting a personal medium 1 to this host station 5, this authentication module A being adapted to determine whether it is an authorized user and to allow access to the user space corresponding to the user identification data stored in the personal memory of the personal medium 1 only if a corresponding authorized user is identified and authenticated; this authentication module A has the function, in its simplest embodiment, of managing a user personal code (such as a user password) entered by the user on a human / machine interface (for example the one of the host station 5), then to check whether the user personal code is the correct one each time the user enters this code, - a filter module D of file queries adapted to be able to recognize any request interesting at least one file, called CLE file, belonging to a user space of the authorized user, - a processing module C of each request on a CLE file adapted to be able to create a file CLE and / or access any file CLE (in reading and / or write) and allow the processing of a corresponding request by the operating and file management system of the host station 5, in the same way as if it were a request on a file specific to this s Hosting 5.

  A personal medium 1 according to the invention can thus be free of digital processing means other than those necessary, if necessary, for the establishment and operation of means 3, 4, 6, 7 for connection with the host stations 5. In particular, a personal medium 1 according to the invention may be free of microprocessor and associated random access memory, or more generally, central processing unit and information processing. Also, as indicated above, a personal support 1 according to the invention can be free of man / machine interface.

  According to the invention, the user identification data are only part of the set of data enabling authentication of a user authorized by the authentication module A executed by a host station 5.

  In other words, these user identification data stored in personal memory 2 of the personal medium 1 are adapted to be insufficient to allow a user to access his user space. This is an important difference from the invention with respect to prior devices by which a user can access computer resources by simply connecting a USB stick to a computer connected to these computing resources. According to the invention, on the other hand, a user carrying a personal medium 1 must, in order to access his user space, not only connect his personal medium 1 to any host station 5, but also provide additional authentication information. , ie the personal user code that must be entered on the man / machine interface at his disposal, in particular that of the corresponding host station 5.

  If a user loses or is stolen his personal medium 1, the new holder of the personal medium 1 will not be able to access the user space of the initial authorized user. Conversely, the authentic authorized user can easily access his user space again by receiving a simple personal support 1 containing the user identification data, which can be manufactured and provided to the genuine user from the data of the user. identification of his user account registered in his user space.

  The user personal code is used by the authentication module A to validate the identity of the authorized user. It can be a user password entered by the user on a keyboard (for example the keyboard of a host station 5). But it can be any other code that can be provided by the user, for example a digital code representative of a biometric characteristic, delivered by a sensor that can be integral with the host station 5 or the personal support 1. By for example, the personal medium 1 may be equipped with a fingerprint sensor or other. It should be noted however that in any case the validation of the identity using this personal user code is performed by the authentication module A and executed by the host station 5, and not by an electronic circuit personal support 1.

  Said connection means 3, 4, 6, 7 between a personal medium 1 and a host station 5 are made active by bringing the personal medium 1 and the host station 5 closer together and / or by connecting the personal medium 1 to a corresponding socket of the host station 5.

  Preferably, the authentication module A and the processing module C of a gateway process P are adapted to be executed in a memory area dedicated to the application programs of a host station 5, and therefore accessible in user mode of the 5. In this way, these modules A and C can be written in a way that is not dependent on the operating system of the host station 5, which can be arbitrary, the gateway process P adapting their loading according to the operating system detected on the host station 5. This detection can be carried out by means of a well-known command integrated in the gateway process P, for example the System.getProperty command of the JAVA language.

  The same is true in general of the filtering module D which can be realized in multicompatible form. In particular, a personal medium 1 according to the invention may comprise a plurality of filtering modules D, each being compatible with one of the commonly used operating systems (WINDOWS, UNIX, LINUX ...).

  The different user spaces can be stored in mass memories of a plurality of servers 9 separate from the host stations 5 and connected to the public digital network 10 to which these host stations 5 are themselves connected, in particular to the Internet network. These various servers 9 are at least partially made up of servers specific to the invention, but may, for the most part, consist of standard servers for providing data and / or information and / or programs by content providers. the corresponding network 10.

  At least one of the servers, called the central server 9a, is used for the management of the computer architecture and therefore of the computer system according to the invention, in particular for the management of the different user accounts, in particular different identification data. users of the computer system according to the invention.

  The user identification data stored in personal memory 2 of each personal medium 1 advantageously comprise, on the one hand, a code individually identifying a user, and, on the other hand, data identifying a central server 9a on the mass memory of which the user code identifying the user, and other information concerning his user space, can be stored. In particular, the personal code (password) entered by the user can be registered, preferably in illegible form by the man, associated with the identification code of the user, on the corresponding central server 9a.

  The authentication module A is thus adapted to authenticate an authorized user by entering the user's personal code, including a user password, on a human / machine interface (in particular the keyboard 25 of the host station 5 to which the support personal 1 is connected), and for storing this user personal code in the RAM of the host station 5, so that this user personal code can then be communicated to each server 9 to which the host station 5 wants to access. And the gateway process P, namely the processing module C, is also adapted to transmit the user personal code to each server 9 to which the host station 5 is connected for the purpose of transmitting digital information between this server 9 and the server. host station 5 in one direction or the other.

  FIG. 2 represents an exemplary embodiment of a personal medium 1 in the form of a USB key comprising a housing 20 enclosing the personal memory 2 in the form of an electronic memory, and an interface 21 with a USB link, the housing 20 carrying a plug 22 for such a USB link. This plug 22 can be plugged into a corresponding female port 6 of a host station 5.

  As shown in FIG. 2, the personal memory 2 comprises an area dedicated to forming the local cache 8, an area 23 containing the gateway process P in a form ready to be executed by any host station 5, and a zone 24 containing configuration files. of the host station 5. Among these configuration files, the zone 24 may include a file AUTORUN.BAT automatic launch of the gateway process P by the host station 5, an IP_PORT SC.XML file containing the network address and the port of connection of the central server 9a, a PCK.DATA file containing a central public key PCK used for encryption as indicated below, a file LAK.DATA containing a symmetric key LAK used for the automatic encryption of the files, as indicated below, a ID GENERATION DATA file for generating file identification codes as shown below, and a ROOT_ID.XML file containing a root file identifier ROOT_ ID for the user as shown below.

  Initially, such a personal medium 1 is not personalized, that is, does not contain the user identification data. Such a support 1 can be distributed and marketed at low cost in large series. When a user acquires such personal medium 1 and wishes to use it to access his user space, he just needs to connect it to a host station 5.

  It should be noted that the gateway process P and the configuration files can be registered in advance (in the manufacture) on the personal memory 2 of the personal medium 1. Nevertheless, in a variant, the personal mediums 1 can be supplied completely blank, and all the information they contain for the implementation of the invention, namely the gateway process P and the configuration files can be downloaded to the personal memory 2, at the request of the user, from a remote server or a removable storage medium such as an optical disk. In a variant, only a portion of this information is recorded prior to manufacture on the personal medium 1, the other being downloaded.

  Upon connection, the gateway process P is started by the host station 5, either automatically (if the operating system of the host station 5 allows the automatic launch of such a process), or on command of the user if necessary .

  The operating system of the host station 5 then loads and executes the user mode P gateway process, and this gateway process P loads and executes the processing module C which performs the following actions.

  First, the processing module C reads the network address of the corresponding central server 9a. It should be noted that, alternatively, this network address may not be stored on the personal medium 1, but may be directly recorded in the code of the gateway process P itself, or on a specific server whose address itself is known from the gateway process P. The processing module C is adapted to create each CLE file of the user space with an identifier record of this CLE file, said INFO ID, comprising: a user identification code which has created this file 5 CLE, - a code identifying a server, said FILESERV ID, where this file CLE was initially registered and where it remains always recorded, - a numerical code individually identifying the file CLE. This record INFO_ID furthermore preferably comprises: a code determining an encryption mode for the file CLE; a code determining a synchronization mode for the file CLE.

  This type of designation of the CLE files in the user spaces, common to all the user spaces, and to all the operating systems and computer technologies, makes it possible to record and retrieve any CLE file of the user space, wherever the machine on which it is registered, in a perfectly universal way.

  The code identifying the creator of this CLE file in the INFO_ID record of a CLE file corresponds to the USER ID code of this user.

  The FILESERV ID code identifying the file creation server can only consist of the network address of this server.

  The numerical code individually identifying the CLE file, called FILE_ID, is a number, for example on 64 bits. When the file CLE is created by the user, this code can be generated by the processing module C from file ID_ GENERATION.DATA stored in the personal memory 2 of the personal medium 1. This file ID_GENERATION. DATA comprises an initial number which is incremented at each creation of file CLE by the processing module C. The code determining the encryption mode for a file CLE can identify an encryption mode among at least three modes of encryption, namely: a total absence of encryption (the file is not encrypted and is accessible to the public); a manual encryption by which the contents of the file is encrypted by the host station 5 with a code specific to this KEY file which must be entered by the user, for example a password entered using the keyboard (in this mode encryption, the file is lost if the user loses this specific code); automatic encryption by a symmetric LAK key generated by the processing module C from a pseudo-random code and encrypted with the user's personal code when it is stored in the file LAK.DATA on the personal memory 2. In this last case, the CLE file is saved on the local cache 8 of the personal support 1 in encrypted form and is decrypted during playback. It is communicated via the network in decrypted form and is encrypted again during a new write.

  Thanks to this automatic encryption method, the user can modify his personal user code without losing the files stored on the local cache 8. In fact, during such a modification, said symmetric key LAK having been decrypted with the old code user's personal code, is encrypted with the new user's personal code, and then stored encrypted on the personal memory 2. This symmetric key LAK is created and stored in the personal memory 2 as soon as the user enters for the first time his personal code for the creating his personal user account.

  The code determining the synchronization mode of a file CLE indicates how the file CLE is synchronized, that is to say updated. There are at least two synchronization modes: synchronized mode and unsynchronized (or remote) mode.

  In the synchronized mode, when reading a CLE file corresponding to an INFO_ID, if this CLE file is present in the local cache 8 of the personal memory 2, and if it is up to date in this local cache 8, we read the CLE file from the cache. If, on the other hand, the file CLE is not present in the local cache 8 or is not up to date in this local cache 8, the reading is carried out from the server on which the file CLE is recorded. It is then written on the local cache 8 of the personal memory 2.

  When writing a CLE file, this CLE file is always written in the local cache 8 of the personal memory 2. The processing module C also includes an update management sub-module which, according to predetermined periods of time or according to a method known per se, to regularly update the files recorded on the servers 9.

  In the unsynchronized or remote mode, the CLE files are saved only on the servers 9 and are never saved in the local cache 8 of the personal memory 2 of the personal medium 1. During a reading, the CLE file must be read from the server 9 on which it is registered. During a write, the file CLE is directly and only written on the server 9, the update management sub-module not being useful in this case. This synchronization mode where the files are not synchronized is used for password files or specific command files or CLE files declared as such by the user. In contrast, synchronized mode is used for most other CLE files in the user area, and in particular it allows you to save the changes made by a user to CLE files, even in the event of a sudden break in the network connection or connection between the personal support 1 with the host station 5.

  In the subsequent step, the processing module tries to read a root file identifier designated ROOT_ID in the ROOT_ID file. XML stored on the personal memory 2. The ROOT ID root file identifier is constructed as any INFO ID, with the USER ID user identification code, and the SERVER ID code identifying the server 9 on which this file root is saved. At the first use, the ROOT ID.XML file containing the identifier ROOT_ID does not appear on the personal memory 2. In this case, the processing module C asks the user whether a new account should be created, and in in the affirmative, establishes a connection with the central server 9a and requests this central server 9a to prepare a new user with a user identification code designated USER ID.

  The processing module C then asks the user to enter a personal code (password) user of his choice. The personal code entered for example on the keyboard 25 of the host station 5 is then stored by the processing module C in the random access memory 26 of the host station 5, in a data storage area 27 of this random access memory 26.

  After having received the USER ID user identification code of the central server 9a, the processing module C requests a confirmation from the human user, then chooses an available server 9, creates a root file identifier ROOT ID (with the user code USER ID and the SERVER ID code of the selected server) and returns the confirmation consisting of the entered personal code (password) and ROOT ID.

  Before sending this data to the central server 9a, the processing module C performs encryption of the user's personal code at least, and preferably all of this data transmitted to the central server 9a. To do this, the processing module C is adapted to generate a symmetric key CS from a pseudo-random code provided by a pseudo-random code generator. This symmetric key CS is then used to encrypt the data during transmission between the servers 9 and a host station 5, in general, and this, thanks to an encryption sub-module incorporated in the processing module C. The public key Encryption PCK stored in the PCK configuration file. DATA in the personal memory 2 (initially at manufacture or by download) is a public asymmetric encryption key corresponding to a private key which is itself stored on the central server 9a. The processing module C is then adapted to encrypt the symmetric key CS with this public key PCK, transmit this symmetric key thus encrypted to the central server 9a, itself adapted to decrypt the symmetric key with the corresponding asymmetric private key; and encrypting the root file identifier ROOT_ID and the user personal code with this symmetric key CS, and this, before transmitting them to the central server 9a.

  The central server 9a receiving the user credentialscreate a user account, then returns a command to the processing module C for the latter to register the root file identifier ROOT ID in the file ROOT_ID.XML on the personal memory 2 of the support staff 1.

  Once this operation is performed at the first connection, the personal medium 1 is configured to be used by a predetermined human user (or a group of human users having the same user ID USER ID).

  On a new connection of the personal medium 1 to any host station 5, the authentication module A again requests the user personal code to the human user, which the latter can enter via the keyboard 25 and / or the corresponding screen, and / or in any other way (for example by voice input).

  The personal code entered by the user is then checked by the authentication module A. If the personal code is not compliant, access is denied to the user. If, on the contrary, the personal code is consistent with that registered in the central server 9a, access is allowed. At each establishment of a connection to a server 9 having the symmetric private key corresponding to the public key PCK, so that this server allows access to the user space files present on its mass memory, a symmetric key CS is generated by the processing module C, encrypted with the public key PCK, then the user ID user ID of the authenticated user and his personal user code are encrypted with this symmetric key CS, then the whole (the symmetric key CS encrypted with the public key PCK, USER ID user code and personal code encrypted with the symmetric key CS) is sent to the server 9 contacted. The latter decrypts the symmetric key CS with the private key corresponding to the public key PCK, then decrypts the user ID USER ID and the personal code with the symmetric key CS, then verifies the validity of the user by checking the corresponding personal code the user ID USER ID. This verification is done directly by a central server 9a; if the server 9 is not a central server, it contacts a central server so that it authenticates the user.

  The set of data being subsequently sent by this established connection can be advantageously encrypted with the symmetric key CS so as not to be analyzed by a malicious user of the network 10.

  It should be noted that this technique takes into account the fact that a symmetric encryption is much faster than an asymmetric encryption: that is why only the symmetric key CS is asymmetrically encrypted. In the same way, the data sent by the server 9 and received by the host station 5 can be encrypted with the symmetric key CS.

  In the case where the user has been successfully authenticated by the authentication module A and the access to the user space corresponding to the identification data of the personal support 1 connected has been authorized, the gateway process P realizes a configuration of the host station 5 so that the latter can access the CLE files of the user space, and this, in accordance with the steps shown in FIG. 4. In the first step 41, after the gateway process P has detected the system of operating the host station 5 to which the personal medium 1 is connected, the filtering module D compatible with the detected operating system is loaded into the RAM of the host station 5. In the description which follows, an example is given embodiment of the filtering module D compatible with a WINDOWS operating system, for example WINDOWS XP. This filtering module D comprises a dynamic library incorporating the functions of the operating system necessary for filtering and processing file queries.

  In the subsequent step 42, the filtering module D starts the function of establishing the list of machines present on the local network of the host station 5, then adds a local machine corresponding to the name of the personal medium 1, namely for example CLE_XX, to this list of machines on the local network of the host station 5.

  In the subsequent step 43, the filtering module D loads in the RAM of the host station 5 a request processing task on the machine CLE_XX, which is a task that then executes permanently, and described hereinafter more in detail.

  In the subsequent step 44, the filtering module D searches in the list of virtual units of the host station 5, a free virtual unit of U: format. For example, the filtering module can start such a search from the last one, that is to say from Z :. The filtering module D then associates this virtual unit with a file path of the type \\ CLE_XX \ AAA \, the directory AAA being defined by the filtering module D by default.

  At the end of step 44, the host station 5 is configured to satisfy requests on files of the virtual unit U: corresponding to the user space of the authorized user of the personal medium 1.

  FIG. 5 represents in more detail the step 43 of processing of the requests by the filtering module D. During the step 51, the filtering module D is placed in the blocking reading state by a known function (for example Netbios under WINDOWS). In this state, the filter module is waiting for a reading of a request arriving on the machine \\ CLE_XX.

  The subsequent step 52 corresponds to the arrival of a request for the machine \\ CLE_XX, as detected by the filtering module D. The latter then initiates a step 53 of interpretation SMB / CIFS of the request to translate it. according to a protocol adapted to the processing module C. In the subsequent step 54, the filtering module D calls a function corresponding to the request for its processing by the processing module C. The subsequent step 55 corresponds to the execution of this function by the processing module C and will be described in more detail below.

  The filtering module D is then placed in a waiting state of the response of the function performed by the processing module C, and this, in step 56. When this response is received by the filtering module D, it builds the byte packet corresponding to this response in step 57, according to the protocol (CIFS in the example of WINDOWS) corresponding to the operating system of the host station 5. In the subsequent step 58, the filtering module D returns the response corresponding to the request and coming from the machine \\ CLE_XX. This answerback is also a known system function incorporated into Netbios. After step 58, the filtering module D returns to the blocking read state of the initial step 51.

  It should be noted that, according to the invention, the architecture of the different directories and files CLE of each user can be organized in a standard way in the form of a tree structure, and this architecture is stored in the root file identified by ROOT_ID on a server 9 (and not on the personal medium 1 or on a host station 5). In addition, each file CLE is identified in this architecture by its path, and, moreover, by the corresponding identifier INFO_ID as described above.

  FIGS. 6, 7 and 8 illustrate the different steps performed by the processing module C to perform various functions that can be performed on CLE files, namely respectively a file read, a file write, and the creation of a file. new file.

  FIG. 6 represents for example a reading of a file CLE belonging to a designated user USER1 and whose access path is USER1 \ DIR1 \ FFF1. In a first series of steps 60, the processing module C determines which is the user space architecture of USER1. To do this, the processing module C searches the content of the root file of USER1. In order to know the identifier ROOT_ID1 of the root file of the user USER1, if the authorized user connected is not USER1, the processing module C requests in step 61 this identifier ROOT_ID 1 by the network to the central server 9a . On the other hand, if USER1 is the authorized user connected, ROOT_ID1 can be read directly in this step 61 in the file ROOT_ID.XML of the personal support 1 of USER1. In the subsequent step 62, the processing module C reads, in the identifier ROOT ID1, the identifier SERVER ID1 of the server 9 where this root file is registered, then, during step 63, the processing module C reads the architecture contained in the root file identified by ROOT_ID 1, in the server SERVER ID 1 which contains it or in the local cache 8, which makes it possible to know the identifier INFO ID1 of the file DIR1 \ FFF1 by association during step 64. The processing module C can then read the contents of this file INFO _ID 1 during step 65.

  It should be noted that all the requests for information (request for identifier, reading of a file content, request to write the contents of a file) on a server 9 are made by any known transfer technique. information on the network 10 (for example a specific bilateral network link (Socket on which the encryption protocol for the information sent and received as described above is applied, the information being encrypted with a symmetric key CS, itself encrypted with the PCK asymmetric public key.

  When writing (FIG. 7) to a CLE file of the user USER1 whose path is USER1 \ DIR1 \ FFF2, the processing module C also determines, as before, the architecture of the files of the user space of USER1, by performing the series of preliminary steps 60 described above. The processing module C then searches in step 71 for the identification code INFO ID2 of the file corresponding to DIRI \ FFF2.

  After finding the record INFO_ID2 identifying the file DIR1 \ FFF2 uniquely and certainly, step 72 is to write this file. In the case of a synchronized type file, this writing is performed in the local cache 8 of the personal medium 1, then, the update management sub-module is launched in step 73 by the processing module C for update this file, if any.

  Figure 8 shows a method for creating a new CLE file of the user USER1 whose path is USER1 \ DIR1 \ FFF3.

  First, the preliminary steps described above are performed to read the file architecture of USER1's user space. In the subsequent step 81, the processing module C creates a new identifier corresponding to this new file DIRI \ FFF3, that is to say an identifier designated INFO_ID3. In the subsequent step 82, this new record INFO_ID3 is added to the contents of the user space USER1 with a specified name (in this case DIR1 \ FFF3). The processing module C then writes during step 83, the new version of the file architecture of this user in the local cache 8 of the personal medium 1, then launches, in step 84, the submodule update management which allows, at an appropriate time, to update this file on the corresponding central server 9a.

  To facilitate the operation of the update management sub-module, it can be provided a specific file stored in the local cache 8 of the personal memory 2, in which are recorded the records identifying the various CLE files that have been subject changes by the user and then to be checked for updates by the update management sub-module.

  Moreover, when creating a new CLE file, to know which server 9 it must be registered, the processing module C can see in the central server 9a a file identifying the different servers and in which the rate of occupation of each server 9 is stored in real time. It should be noted in this regard that the different servers 9 can themselves be identified in a computer system according to the invention as specific users, that is to say, strictly identical to the personal media 1 point logical view. Thus, their network address can be stored in a specific file of their mass memory and updated by synchronization in the same way as the files of the local cache 8 of a personal medium 1.

  By default, any CLE file of the user space that is digitally processed by the host station 5 is saved in the local cache 8 of the personal memory 2. Of course, the user can nevertheless avoid such writing. in the local cache 8, for example by specifying that the file is of the unsynchronized type. The risk exists that this file is lost if the connection to the network or the connection between the personal medium 1 and the host station 5 is suddenly interrupted.

  The update management sub-module determines whether an update is necessary by consulting the metadata associated with each file, including the date of the last modification made to the file. Such an update management sub-module is known in itself and does not have to be detailed.

  The invention thus represents a considerable advance and a radical change in work habits with computer systems. Thus, users can, through the invention, manage all of their personal data or personal or personalized information, not on a portable medium that contains this information or from a workstation of their own and that contains this information, but remotely via a network such as the public Internet network and only through a personal support 1 which can reliably identify them, and save files being modified in synchronization, and secondly, from any standard host stations to which they can connect and which are automatically configured by the personal medium 1.

  It should be noted that the user space information is never recorded on the mass memory of a host station 5. Although the different files and the different information of each user space can be disseminated within a very large area. the large number of servers 9 on the network, each user sees his user space transparently as a directory of the host station 5 to which he is connected and accesses the corresponding CLE files in the traditional way, as if these files were stored on the memory 5. In addition, read / write access or creation of new files are performed in a perfectly reliable and secure manner.

  If a personal medium 1 is lost or stolen, it is sufficient for the user to acquire a new personal medium 1, if necessary to provide the gateway process P and download configuration files. In this case, the P gateway process will not find the ROOT_ID.XML file, and ask the user for a choice between creating an account or restoring an account. In the case of a restoration, the user enters his USER ID code and his personal user code, which are sent to the central server 9a. The latter checks their validity, and returns the root file identifier ROOT ID of this user, who can then access his user space again.

  The invention makes it possible not only to access data, but also to make available to different users specific programs and applications, automatically updated by the suppliers of these specific programs and applications, without the user having itself to download updates or install these updates on any computer. Indeed, a software consisting of executable files can be registered on the user space of the editor of this software. This user space is made accessible either free of charge or under condition of a subscription to a specific service by any client user wishing to access it. These files making up the software are subsequently imported directly into the RAM of the host station 5 to which the personal support 1 of the client user is connected and executed on the host station 5, without the client user having to perform any installation procedure.

  The invention also makes it possible in the same way to propose software rentals or updates of software or specific data depending on the users, and to manage the payments of the different users to access these software or updates or specific data. . The invention allows each user to have all his user space, and from any location, permanently, and perfectly reliable and synchronized.

  It also results in users no longer being encouraged to illegally hack software or data, since they do not have to install them themselves.

  In particular, the invention makes it possible to reliably and flexibly manage access to different information, data and programs that are common or individually customized by the different users or groups of users.

  Indeed, it is possible for an authenticated user to allow access to his user space to other authenticated users by configuring the servers 9 to allow access to this user space for these other users.

  The invention can be the subject of numerous applications for the storage and provision of information and various personal data such as software, word processing documents, tables, calendars, Internet favorites or others.

  In a computer system according to the invention, the different files are identified by the INFO_ID records which remain identical throughout the life of the file and do not depend on the operating systems and recording technologies. File names are thus always valid at any time regardless of the technological platforms implemented and used on the servers and / or host stations 5.

  The different servers 9 for storing files require only a very small digital processing capacity, in reality limited to the recording of the various files and their reading. They are therefore essentially mass memories and, unlike the standard computer architectures known to date, in a computer system according to the invention, the computer processing is completely deported at the level of the host stations 5 and not at the level of the servers themselves. -Same. As a result, the various servers 9 are machines that can be very light and that the interfaces between the host stations 5 and the different servers 9 are particularly simple since they only convey actions on the files and not on the files and directories. In addition, the coherence of the local caches 8 with the host stations 5 and the personal supports 1 is ensured.

  The invention involves a disruption of habits related to the use of computer data.

  It is no longer necessary to install software, these are accessible from the moment they are present in their form directly executable on the user space of a user editor and made accessible to the client users wishing to use it . The client user executes the software when necessary, on demand (a direct means being, for example, double-clicking on the icon representing him) and from any host station 5 where he has connected his personal medium 1, without have to perform any software installation procedure on the host station 5.

  Thanks to the invention, a software can, without having to be modified according to the client user, adapt to it. The software can read configuration files on the user space on which it is saved (user space of the editor) but it can also read additional configuration files on the user space of the client user. running. In this way, for example, software can load its graphical appearance on a file of the user's user space of the user and, for example if the user is visually impaired, adapt the colors to his preferences.

  A website can, in the same way, adapt its appearance, without the need to request and save user preferences in a database specific to this website. All that is needed is to read a file (for example a cascading style sheet style CSS file) on the user space of the user visiting this site.

  The CLE files of the users are not duplicated on all the stations where they must be used but are accessible in a simple and universal way on demand (for example by double-clicking on the icon representing them). It is therefore not necessary to exchange the files by manually transferring them from station to station or by sending them by e-mail. The quality of the use of the files is improved because the recipient user no longer has to accept to receive nor to receive a file when a sender user sends him such a file. It is sufficient that the recipient user accesses this file when it actually needs it.

  The data generated by the use of computer resources (documents, letters, contacts, software, images, music, various digital creations, Internet sites, databases, etc.) are globally classified and accessible in a simple and direct way by the users without suffering from penalties related to their storage on a single station (possible destruction if destruction of the station, dependence of data on the operating system present on the station, limit of the recording space, etc.). The invention defines universal access to data from any host station to which the user connects his personal medium 1.

  The invention thus rests on a clear separation between the recording and the interpretation of the data. Interpreting the data according to the host stations increases the potential for using the data. For example, an address book managed on a host station type personal computer can be classified and completed very simply with the keyboard and mouse of said host station. A user can also use this address book on a mobile-type host station when he plugs his personal support to the latter, thus allowing the mobile phone to know numbers useful to this user, and whatever the type or owner of the mobile phone itself. In the same way, a user will be able to memorize his favorite radio stations by connecting his personal medium to a host-type host radio station and then listen to them by connecting his personal medium to a radio-type host station, or still on a more advanced type host station such as an interactive seat equipped with headphones.

  By recording the data on a device separate from the host stations where they are interpreted, the invention makes it possible to create multiple access points to a user space. Instead of being grouped in a personal computer for all tasks, the functionalities are instead everywhere where the user needs them, the multiple host stations being each able to interpret at least part of the data of the user. 'user.

  As examples of other applications of the invention, the shopping list of a housewife can be interpreted by a refrigerator (host station) when it approaches with its own support identifying it. The refrigerator can calculate which foods are missing or even offer a recipe based on the family's tastes previously entered on a personal website of the house.

  The light, the heating, the operation of accessories can adapt in a living room or work according to (the) user (s) present (s).

  Or, even when traveling a long distance, a user can share a specific file of his user space interpreted by a host station type building door, for example the door of his home, with another user so that it can enter the same building (home), the door allowing this way access to it when it connects his personal support.

  The invention makes it possible to take into account the increasing importance that computing takes in everyday life, to alleviate the problem of the growing complication that currently exists for users with known systems: their data is scattered (servers, personal computers, telephones laptops, etc.), of various formats (for example, it is difficult to save a mobile phone address book on a personal computer) and difficult to access (the digital machine must be available and available to interpret them) .

  With the invention, the user space information is clearly and simply accessible, independent of the execution host stations, always synchronized (up to date), and yet recorded disseminated on the servers, which implies that the quality and durability of the are much higher than those obtained with personal computers.

  The invention also makes it possible to implement a recurring process for backing up the servers 9 making it possible to securely store the data of the user areas in the long term.

  The invention may be the subject of numerous alternative embodiments and other applications than those described above and with reference to the figures. In particular, other D filtering modules compatible with other operating systems than WINDOWS can be made in a manner similar to the example given above, and incorporated into the gateway process P. The IT functionalities, architectures and structures described above can be achieved by simple programming of known computing devices, including for example using the JAVA language to write a program in a way not dependent on the operating system, particularly useful in the case of the module of treatment C.

Claims (33)

  1 / - portable mass storage medium, said personal medium (1), comprising: - at least one mass memory, said personal memory (2), - means (3, 4) of connection to any computer station, said host station (5), provided with: digital processing means with microprocessor (s) and associated random memory (s), at least one operating and file management system, means ( 6, 7) of the personal medium (1), so that at least a part of the personal memory (2) of the personal medium (1) can be accessed read / write by a host station ( 5) when the means (3, 4, 6, 7) of connection are active, - stored in personal memory (2), data, called user identification data, identification of at least one human user, said authorized user, authorized to use this personal medium (1), characterized in that it includes, recorded in person memory lle (2), data forming a process, said gateway process (P), adapted to be loaded into the RAM of a host station (5) to which the personal medium (1) is connected, this gateway process (P) comprising: an authentication module (A), by the host station (5), of any human user making the connection of the personal medium (1) to this host station (5), adapted to determine whether it is an authorized user, and to allow access to the user space corresponding to the user identification data stored in the personal memory (2) only if an authorized user is identified and authenticated, a filtering module (D) file queries adapted to be able to recognize any request pertaining to at least one file, said CLE file, belonging to a user space of the authorized user, comprising digital information stored in a part of personal memory, di the local cache (8), and / or in at least one mass memory of at least one server (9) separate from the host station (5) and to which the host station (5) has connection means and access to at least one digital network (10) can be connected via such a network (10), a processing module (C) of each request to an adapted CLE file to be able to create a CLE file and / or access any CLE file and allow processing of a corresponding request by the operating and file management system of the host station (5) in the same way as if it were a query on a file specific to that station host (5).   2 / - Personal medium according to claim 1, characterized in that it is free of digital processing means other than those necessary, if necessary, the establishment and operation of the means (3, 4, 6, 7) connection with host stations (5).   3 / - Personal medium according to one of claims 1 or 2, characterized in that it is free of man / machine interface.   4 / - Personal medium according to one of claims 1 to 3, characterized in that said means (3, 4, 6, 7) for connection to a host station (5) are made active by bringing and / or connecting the support staff (1) and the host station (5).   5 / - Personal medium according to one of claims 1 to 4, characterized in that said means (3, 6) for connection to a host station (5) are adapted to allow the establishment of a USB universal serial link.   6 / - Personal medium according to one of claims 1 to 5, characterized in that the processing module (C) is adapted to be executed in a memory area dedicated to the application programs and accessible in user mode of the RAM (26). ) of a host station (5).   7 / - Personal medium according to one of claims 1 to 6, characterized in that the authentication module (A) is adapted to authenticate an authorized user by input by the latter, on a man / machine interface, a code, said user personal code, enabling validation of the identity of the user by the authentication module (A), and for storing the user personal code in random access memory (26) of the host station (5), and in that the gateway process (P) is adapted to transmit the user personal code to each server (9) to which the host station (5) is connected for digital information transmission.   8 / - Personal medium according to one of claims 1 to 7, characterized in that said user identification data stored in personal memory (2) comprise: - a code individually identifying a user, - data identifying a central server ( 9a).   9 / - Personal medium according to one of claims 7 or 8, characterized in that the processing module (C) includes at least one encryption sub-module by a symmetrical key LAK generated by the processing module (C) to from a code provided by the processing module (C).   10 / - Personal medium according to one of claims 7 to 9, characterized in that it comprises, stored in personal memory (2), a PCK asymmetric public encryption key corresponding to a private key of a central server (9a). ) stored in a mass memory of the central server (9a), and in that the processing module (C) is adapted to: generate a symmetric key and encrypt it with said public key, transmit this encrypted symmetric key to a central server 25 (9a), itself adapted to decrypt it, - encrypting the user identification data and the user personal code with said symmetric key before transmitting them to the central server (9a).   11 / - Personal medium according to one of claims 1 to 10, characterized in that the processing module (C) is adapted to save by default any CLE file of the user space which is the subject of a digital processing by the host station (5) in the local cache (8) of the personal memory (2).   12 / - Personal medium according to one of claims 1 to 11, characterized in that the processing module (C) is adapted to create each file CLE with a record identifying this CLE file, said INFO_ID, comprising: - a code identifying a server, called FILESERV ID, where this CLE file was initially registered, - a code identifying a user who created this CLE file. 10 - a numerical code individually identifying the file CLE.   13 / - Personal medium according to claim 12, characterized in that an INFO_ID record further comprises: - a code determining an encryption mode for the CLE file, - a code determining a synchronization mode for the file CLE.   14 / - Personal medium according to one of claims 12 or 13, characterized in that it comprises, recorded in personal memory (2), a file called file ID GENERATION.DATA, including data adapted to allow the processing module (C) generate numeric codes individually identifying the CLE files created by the user.   15 / - Personal medium according to one of claims 1 to 14, characterized in that it comprises, stored in personal memory (2), ROOT_ID data identifying at least one root file recorded on a server (9), wherein the architecture of the CLE files of the user space is saved.   16 / - Computer system for secure access via a network (10) by users to user spaces, comprising: - computer stations, called host stations (5), each equipped with: digital processing means with microprocessor (s) and associated memory (s), at least one operating and file management system, means (6, 7) for connecting connection means (3, 4) at least one portable mass storage medium, said personal medium (1), so that at least a portion of the mass memory of such a personal medium (1) can be accessed read / write by the station host (5) when the connection means (3, 4, 6, 7) are active, means for connection and access to at least one public digital network (10), - at least one server (9) comprising at least one mass memory, said server memory, and means of connection to at least one public digital network (10), and adapted to allow read / write access to at least part of this server memory via such a public digital network (10), - each personal medium (1) comprising: at least one mass memory, said personal memory (2), means (3, 4) for connecting to any host station (5), stored in a personal memory (2), data, called user identification data, identifying at least one human user, said authorized user, authorized to use this personal medium (1), each personal medium (1) comprising, stored in personal memory, data forming a process, said gateway process (P), adapted to be loaded into RAM (26) a host station (5) to which the personal medium (1) is connected, said gateway process (P) comprising: an authentication module (A), by the host station (5), of any human user making the connection of the personal medium (1) at this hosting station (5) , adapted to determine whether it is an authorized user, and to allow access to the user space corresponding to the user identification data stored in the personal memory (2) only if an authorized user is identified and authenticated, a filter module (D) file queries adapted to be able to recognize any request involving at least one file, said CLE file, belonging to a user space of the authorized user, including digital information recorded in a part of the personal memory (2), called local cache (8), and / or in at least one server memory of at least one server (9) separate from the host station (5), a processing module (C) of each request on a CLE file adapted to be able to create a file CLE and / or to access any file CLE and to allow the treatment of a corresponding request by the operating system and file management of the station host (5) in the same way as if it were a query on a file specific to this host station (5).   17 / - Computer system according to claim 16, characterized in that the personal supports (1) are free of digital processing means other than those necessary, if necessary, to the establishment and operation of connection means between the supports personnel (1) and host stations (5).   18 / - Computer system according to one of claims 16 or 17, characterized in that the personal supports (1) are free of human / machine interface, and in that the host stations (5) have an interface man / machine.   19 / - Computer system according to one of claims 16 to 18, characterized in that the means (3, 4, 6, 7) for connecting a personal support (1) to a host station (5) are made active by bringing together and / or connecting the personal medium (1) and the host station (5).   20 / - computer system according to one of claims 16 to 19, characterized in that said means (3, 6) for connecting a personal support (1) to a host station (5) are adapted to allow the establishment Universal USB serial link.   21 / - Computer system according to one of claims 16 to 20, characterized in that the processing module (C) is adapted to be executed in a memory area dedicated to the application programs and accessible in user mode of the RAM (26). ) of a host station (5).   22 / - Computer system according to one of claims 16 to 21, characterized in that the authentication module (A) is adapted to authenticate an authorized user by input by the latter on a human / machine interface, a code , said user personal code, enabling validation of the identity of the user by the authentication module (A), and for storing the RAM user personal code (26) of the host station (5), and the gateway processes (P) is adapted to transmit the user personal code to each server (9) to which the host station (5) is connected for digital information transmission.   23 / - computer system according to claim 22, characterized in that each server (9) is adapted to check the validity of the user personal code before authorizing the establishment of a link between a server (9) and a host station (5) to which a corresponding personal medium (1) is connected.   24 / - computer system according to one of claims 22 or 23, characterized in that it comprises at least one server, said central server (9a), comprising for each user at least one record, said user account, comprising said data user identification associated with the user personal code stored in said record in a form that is not understandable by the man.   25 / - Computer system according to claim 24, characterized in that said user identification data stored in personal memory (2) of a personal medium (1) comprise: a code identifying a user individually, data identifying a central server (9a).   26 / - Computer system according to one of claims 22 to 25, characterized in that the processing module (C) includes at least one encryption sub-module by a symmetrical key generated LAK by the processing module (C) to from a code provided by the processing module (C).   27 / - computer system according to one of claims 22 to 26, characterized in that each personal medium (1) comprises, stored in personal memory (2), an asymmetric encryption public key corresponding to a private key of a server central (9a) stored in a mass memory of the central server (9a), and in that the processing module (C) is adapted to: - generate a symmetric key and encrypt it with said public key, - transmit this symmetric key encrypted to the central server (9a), itself adapted to decrypt it, - encrypt the user identification data and the user personal code with said symmetric key before transmitting them to the central server (9a).   28 / - Computer system according to one of claims 16 to 27, characterized in that the processing module (C) is adapted to save by default any CLE file of the user space being digitally processed by the host station (5) in the local cache (8) of the personal memory (2) of the personal medium (1).   29 / - computer system according to one of claims 16 to 28, characterized in that the processing module (C) is adapted to create each file CLE with a record identifying this CLE file, said INFO ID, comprising: - a code identifying a server, said FILESERV ID, where this CLE file was initially registered, - a code identifying a user who created this CLE file, - a numerical code individually identifying the CLE file. 30 / - computer system according to claim 29, characterized in that an INFO_ID record further comprises: - a code determining an encryption mode for the file CLE, a code determining a synchronization mode for the file CLE.   31 / - computer system according to one of claims 16 to 30, characterized in that it comprises, recorded in personal memory (2) of each personal medium (1), a file said ID_GENERATION file. DATA, comprising data adapted to enable the processing module (C) to generate digital codes individually identifying the files created by the user of this personal medium (1).   32 / - computer system according to one of claims 16 to 31, characterized in that it comprises, stored in personal memory (2) of each personal medium (1), ROOT_ID data identifying at least one root file recorded on a server (9), this root file including the architecture of the CLE files of the user space.   33 / - Computer system according to one of claims 16 to 32, characterized in that the host stations (5) are chosen from: - personal computers of the fixed type, - personal computers of the portable type, - processing devices portable digital.