WO2007113406A2

WO2007113406A2 - System for secure access from a terminal to communication networks

Info

Publication number: WO2007113406A2
Application number: PCT/FR2007/050871
Authority: WO
Inventors: Jean-Philippe Fassino; Florence Germain; Olivier Lobry; Etienne Annic
Original assignee: France Telecom
Priority date: 2006-03-17
Filing date: 2007-03-02
Publication date: 2007-10-11
Also published as: WO2007113406A3

Abstract

Secure system for executing, in a terminal (10) intended to be connected to a plurality of communication networks (60, 61, 62), at least one application dedicated to a given communication network. According to the invention, said system comprises:- at least one central manager (31 ) for at least one execution space (11, 12), able to: * identify said given communication network through a request originating from said application, * create an execution space, and dedicate said execution space to said given communication network, - at least one manager (32, 33) of at least one memory addressing space, able to: * allocate a memory addressing space to said application in response to said request, and to associate said memory addressing space with said dedicated execution space, * prevent applications that are executing on execution spaces other than said dedicated execution space from accessing data present in said dedicated execution space, - at least one network multiplexer (34) able to prevent the exchange of data between said dedicated execution space and other communication networks.

Description

SYSTEM FOR SECURE ACCESS OF TERMINAL TO NETWORKS

COMMUNICATION

The present invention relates to a secure access system of a terminal to at least one communication network.

The invention finds a particularly advantageous application in the field of application services involving the transmission of data between a terminal and separate communication networks.

In order to develop paid application services oriented towards the transmission and the processing of data, in particular contents providing sensitive information, it is necessary that the communication networks used offer a guarantee of confidentiality (personal information), security (transactions financial information) and non-disclosure (banking information) of the data exchanged. The guarantee of non-disclosure of data located on a communication network allows the one-to-one association between a communication network and an economic model, and in fact, the deployment of exclusive service offers segmented into "bouquets" dedicated to a category customers well identified, and isolated from each other. This perspective is now considered a real opportunity to boost the content trade. In concrete terms, data accessible from a network A must not be able to be transmitted and / or accessible via a network B: this is the principle of network isolation. This isolation is already offered by many categories of networks, such as GPRS, UMTS-PS or ATM.

However, the protection thus obtained is limited to the transfer of data between the communication networks themselves, but it does not extend to the user terminal, which can then become the origin of short circuits of information between separate networks. Indeed, the security functions implemented by the current terminal operating systems are user-centric. We then understand that, if he has the rights necessary access, it can take data or contents of a network A at will and transmit them to a network B. This potentiality is all the more important since the GPRS standard allows a mobile terminal to access multiple communication networks, each identified by an "access point name", or APN (initials of the English words "Access Point Name").

In the following, operating system will be understood as a platform for managing the sharing and protection of terminal resources between applications. An operating system typically consists of a kernel with access to all hardware resources, where the processor can execute privileged instructions in supervisor mode, and services higher level systems used by applications.

We know different modes of isolation implemented in existing systems currently.

According to a first type of protection, commonly called "memory" isolation, each application or service running in a memory space remains confined and can not corrupt the rest of the system.

A second level of protection, by system services isolation, is to check the access rights of an application to the system services before requesting them. Thus, when an application wants to access a service, it issues a request to the kernel that controls access according to its security strategy. If access is allowed, the kernel routes the request to the requested service. For example, the system may limit the use of certain services (such as the machine reboot service) to users with administrative rights.

In addition, a third level of protection, concerning the isolation of resources, can be implemented by each system service in order to refine the security strategy. This type of protection is mainly used by resource management services, including file systems. The security policy proposed by them is mainly to verify that an application running on behalf of a given user has the rights to write or read the file concerned before satisfying the request. Thus, to each file can be associated different rights depending on the user.

It is understood that, if they respond relatively well to the problem of protecting the resources and the system services running on the terminal, the known operating systems can not guarantee the absence of data short circuits between communication networks. for two reasons:

- No mechanism can prevent an application from establishing two links on two separate networks and short-rruit them, via the RAM of the terminal, by copying the data from one into the other,

- two malicious applications running on separate communication networks on behalf of the same user can always use the same file, or even shared memory, to transmit data from a communication network to a single other. The origin of these two problems is different. The first is due to the fact that there is no access control to the networks managed by the current operating systems, access control, when it exists, being managed by the access network itself by an authentication of the type identifier / password for example. The second is because resource protection is "user-centric" in the sense that the beneficiaries of a resource are users.

Therefore, the applications, running on two separate communication networks A and B, are able to exchange data between them via the terminal. In this "user-centric" protection configuration, the applications are not confined to their original communication network since they are capable of exchanging data between the two communication networks by said terminal.

Therefore, problems of confidentiality, disclosure, security and piracy are encountered concerning the data transmitted by the applications of the different communication networks. These problems are particularly felt, for example, when accessing a communication network to exchange sensitive banking data, or when accessing a communication network to download a paid movie. Also, the technical problem to be solved by the object of the present invention is to propose a secure execution system, in a terminal intended to be connected to a plurality of communication networks, of at least one application dedicated to a network. given communication, which would ensure the complete absence of information transfer between said given communication network and other communication networks, through the terminal's own resources.

The solution to the technical problem posed consists, according to the present invention, in that said system comprises means for isolating the execution of said application application dedicated to communication networks other than said given communication network.

According to the invention, said isolation means comprise at least one execution space dedicated to the execution of said dedicated application to said given communication network. Thus, the secure execution system according to the invention realizes the confinement of the executions of the applications within resource spaces, namely said dedicated execution spaces, dynamically associated and unequivocally with each of the communication networks. In this way, the isolation of separate communication networks is obtained in the terminals because of the control, from the operating system of the terminal, of the access of the applications to the communication networks, and the implementation of a strategy of resource protection "network centered" and no longer "user centric", the beneficiaries of a resource being the communication networks themselves. It should be noted that the isolation between said dedicated execution space and the execution spaces dedicated to other communication networks can be realized, at least partially, by construction and / or, at least partially, by control of access.

According to one embodiment of the invention, said system comprises: at least one central manager of at least one execution space, capable of:

^* identify said given communication network through a request from said application,

^* create an execution space, ^* dedicate said execution space to said given communication network,

^* destroy said dedicated execution space,

- at least one manager at least one memory address space, adapted to: ^* allocate a memory address space to said application in response to said request for the execution of said application on said address space memory,

^* Associating said memory address space to said dedicated execution space, ^* prohibit the use of applications running on the execution spaces other than said execution space dedicated to said given communications network accessing of data in said space dedicated execution,

at least one network multiplexer capable of prohibiting, on the one hand, sending data from said dedicated execution space to communication networks other than said given communication network, and, on the other hand, receiving by said dedicated execution space of data from communication networks other than said given communication network. The following description with reference to the appended drawing, given by way of non-limiting example, will make it clear what the invention consists of and how it can be achieved.

Figure 1 is a diagram of a secure access system according to the invention.

In Figure 1 is shown a secure access system of a terminal to a set of communication networks through an access network. "Access to a communication network" includes any communication link with a device separate from the terminal, regardless of the underlying physical medium and whatever the communication protocol used. In the description below, a link may be, for example, access to an APN in the GPRS / UMTS standard, a virtual path in the ATM standard, access to a "PicoNet" in the Bluetooth standard, access to a "VPN" (initials of the words "Virtual Private Network") in the general theory of private networks. More generally, all communication devices (Ethernet, Bluetooth, ZigBee, Wifi, Wimax, etc.) are intended to be managed by the secure access system according to the invention.

The secure access system of FIG. 1 comprises, in the terminal, equipped with an operating system, a GEED manager of at least one execution EED space dedicated to said communication network, said dedicated execution space being intended to house the execution of at least one application in the context of the associated communication network.

The said GEED manager of at least one dedicated execution space comprises the following devices: at least one central GEEDC manager of at least one execution space, at least one GEAV manager of spaces

Volatile addressing EAVs, at least one GEAP manager for persistent addressing EAP spaces, and at least one MR network multiplexer. The data channel between the GEEDC and the MR is referred to in the following "connection", while the data channels between the MR communication networks are called "access".

The roles of the different devices are distributed as follows: - the central GEEDC manager of at least one execution space, is responsible for:

^* the life-cycle management (creation / destruction / suspension) of EEDs, ^* the one-to-one association between EED and one and only one communication network,

^* isolation between EEDs,

^* The switching of the data stream from a PST to the connection associated with the PST, and multiplexing between the EED associated with said connection and the existing connections associated with other EED

^referencing data flows from the connection associated with said EED to an EED, and demultiplexing between the connection associated with this EED and the existing connections associated with the other EEDs,

^* the isolation between the data flows transmitted over a connection associated with an EED and the data flows transmitted over the existing connections associated with the other EEDs,

^* management of connections associated with EEDs,

^* the uniqueness of the names of EEDs, ^* the isolation of its own data vis-à-vis the rest of the system;

- the GEAV manager of volatile address EAV spaces is responsible for:

^* life-cycle management (creation / destruction) of AVEs, ^* association between an EAV and one and only one EED (an EAV is associated with one and only one EED),

^* the effective addressing of EAVs by running applications: an EAV can only be addressed by an application that runs in the context of the EED with which the EAV is associated, ^* the memory isolation between EAVs (two separate EAVs can not share memory space),

^* The writing and reading operation by application of volatile data stored in this EAV,

^* the uniqueness of the EAV identifiers; - the persistent address space manager GEAP EAP is responsible for:

^* life-cycle management (creation / destruction) of EAPs,

^* the association between an EAP and one and only one EED (an EAP is associated with one and only one EED), ^* the effective addressing of the EAP by the applications that execute: a

EAP can only be addressed by an application that runs in the context of the EED with which the EAP is associated,

^* memory isolation between EAPs (two separate EAPs can not share memory space), ^* the operation of writing and reading by an application persistent data stored in this EAP,

^* the uniqueness of the EAP identifiers. For example, an EAP identifier may be the concatenation of the EED name and an incremental value;

- the network multiplexer MR is responsible for: ^* the one-to-one association between an EED and one and only one communication network, ^* the isolation of data streams transmitted on each connection associated with an EED from the data flows transmitted on other connections associated with other EEDs,

^* Insulation of the transmitted data flow on each port associated with a communication network with the data stream transmitted on other associated access to other communications networks,

^* The switching of the data stream from the connection associated with the PST to the associated access to the communication network which is associated with this PST by performing, on the one hand, demultiplexing between the connection associated with the EED and the connections associated with the other EEDs and, on the other hand, the multiplexing between the access associated with this communication network and the accesses associated with the other communication networks,

^* The switching of the data flow from the access associated with a communication network to the connection associated with the PST which is associated with this communications network by performing, on the one hand, demultiplexing between the associated access to this communication network and accesses associated with other communication networks and, on the other hand, the multiplexing between the connection associated with this EED and the existing connections associated with the other EEDs, ^* the management of the network protocols used to communicate with the access network (eg GPRS / UMTS network, ADSL network, etc.) including support for the configuration of the physical link (s),

^* the management of accesses associated with communication networks, such as the creation, modification, suspension and deletion of a "PDP context" access defined by the GPRS / UMTS standard or the establishment of defined paths by the ATM standard,

^* the management of the connections associated with the different EEDs.

EED management rules The EED management rules are as follows:

any application is executed on the terminal in one and only one execution environment, namely an EED; this EED is irrevocably associated with it throughout its life cycle; - an EED can house the execution of several applications;

- an EED is associated with more than one communication network, in a unique and irrevocable way; in particular, an EED can be associated with the terminal itself, the terminal being considered as a communication network; this case typically occurs for applications that do not require access to a communications network during their execution; it should be noted that if at most one communication network is associated with an EED, several accesses to the same communication network can nevertheless be established; - an EED confines all the executions it houses, more precisely:

^* at no time can an application establish communication with another communications network other than that associated with its EED,

^* at no time can an application access data other than that stored in the context of its PST, nor communicate with an application residing in another PST;

- an EED consists of:

^* from zero, one or more volatile address spaces EAV, this number may vary during the execution of the EED: the case where there is no EAV corresponds to that where no application is executed at within the EED, which is typically the case when the terminal is off,

^* Zero, one or more EAP persistent address spaces, this number may vary during execution of the EED; the case where there is no associated EAP typically corresponds to that where no application would need to store information persistently, or where storage would not be allowed in this EED.

Management rules for AVEs

A volatile address space EAV designates all the data present in volatile memory, a random access memory RAM for example, accessible by one or more applications running within the same EED. An EAV is characterized by the following management rules:

- at any time, the AVEs are disjoint two by two, whether they belong to the same EED or to two different EEDs: the same memory address necessarily represents two different data in two different AVEs;

- any application runs in one and only one EAV associated with its EED; however, two applications can run within the same EAV as long as they belong to the same EED; therefore two applications belonging to two different EEDs are running in isolation;

- the destruction of an EAV implies the erasure of the data it contains.

EAP management rules A persistent EAP address space refers to all data in persistent memory, such as flash memory, accessible by all applications running within the same EED. An EAP is characterized by the following management rules:

- at any time, the EAPs are disjoint two by two, whether they belong to the same EED or to two different EEDs: the same memory address necessarily represents two different data in two different EAPs;

- any application can read and write data in the EAP associated with its EED, but can not read or write any data in an EAP of another EED; therefore, no data can be exchanged between two EDIs through EAPs; however, two applications running in two separate EAVs, but associated with the same EED, share the EAPs of the EED;

- the destruction of an EAP implies the erasure of the data it contains.

Description of the functioning of the GEEDC

In order to achieve the coupling between each EED, the communication network to which it is dedicated, the associated EAVs and EAPs, the GEEDC relies on an association table. This association table is only accessible by the GEEDC. It can possibly be decomposed into several association tables, some being stored in volatile memory and others in persistent memory, possibly secured, for example by being stored on the UICC card, also commonly called the SIM card in the case of a mobile terminal.

Said association table associates with an EED name:

- the identifier of the communication network which is definitively associated with it during the creation of the EED,

- the identifiers of the AVEs associated with it,

- the identifiers of the EAP associated with it.

In addition, the GEEDC acts as a window between GEAV and GEAP applications and devices. This means that it receives EAV / EAP creation / destruction requests from the applications and redirects them for processing to the GEAV / GEAP device. When requests reach the GEEDC, they do not include a reference to the EED within which the creation / destruction is to take place. The strategy implemented by the GEEDC is to identify the EED in the context of which the application is running, then to pass the name of this EED as a parameter of the request it sends back to the GEAV / GEAP. This strategy ensures that an application can only create / destroy address spaces within the scope of the EED in which it runs: this forms the basis of the isolation between EEDs.

Under EED management, the GEEDC offers the following interfaces:

- a liaunchEED interface allowing the creation of an EED or the reactivation of a suspended EED; this interface takes among other parameters such as the identifier of the communication network and an identifier of the initial application; - an IsuspendEED interface allowing the suspension of an existing EED;

- an Ides _t royEED interface allowing the destruction of an existing EED. Activation of the haunchEED interface leads:

^* as a first step, to reactivate the EED if the EED already exists, or, if the EED does not exist, to create the name of the EED, to its information in the association table to the association in the association table of the name of the EED and the identifier of its respective communication network,

^* in a second step, if the activation of the creation / reactivation of the EED does not emanate from the communication network, to the activation by the device GEEDC of the IO _P ΘΠACCESS interface of the MR device to create the connection associated with the EED and the associated access to the communication network.

Activation of the IsuspendEED interface leads to suspension of the EED, activation by the GEEDC device of the IsuspendAccEss interface of the MR device to destroy the connection associated with the EED and to suspend the access associated with the communication network, the closing of the applications associated with the EED and the destruction of the AVEs associated with the latter by the activation by the GEEDC device of the IdestroyEAv interface of the GEAV device. The association table retains the persistent data of the EED such as the association with the identifier of its respective communication network and its respective EAPs.

The activation of the Ides _t royEED interface leads to the destruction of the EED and the activation by the GEEDC device of the I _C IOSΘACCESS interface of the MR device to destroy the connection associated with the EED and the access associated with the communication network. The GEEDC sends requests to the GEAV / GEAP device to release all EAV / EAP address spaces associated with the EED. Then, the association table is cleared of all the data associated with the EED.

As part of the MR's management of the connection management associated with EEDs, the GEEDC offers the following interfaces:

an interface IO _P CONNECTION opening a connection associated with an EED,

an interface I _C IOSΘCONNECTION closing a connection associated with an EED. These two interfaces take as parameter the identifier of the communication network for which the opening / closing of connection must take place. These interfaces can only be activated by the MR device following a request from a communication network.

Activation of IO _P ΘΠCONNEXION interface means that the active GEEDC its interface li _aunchEED to create / reactivate PST corresponding to the communication network where the request and creates the connection associated with EED between GEEDC and MR to allow exchanges between the communication network and its respective EED. Activation of the I _C IOSΘCONNECT interface implies that the GEEDC activates its IsuspendEED interface to suspend this EED.

As a window between applications and connections associated with EEDs, the GEEDC admits the following interfaces:

an I _SΘΠC I _DATA interface for sending data to the connection associated with an EED,

an IΓΘCΘIVΘDATA interface for receiving data from the connection associated with an EED. The UPDATA and IΓΘCΘIVΘDATA interfaces can only be activated by applications in the context of data exchange through the connection associated with their EED.

Activation by an application of the U _PDATA interface implies that the

GEEDC activates the ImcomeDATA interface of the MR device to transmit the data transmitted by the application to the connection associated with the EED corresponding to this application.

Activation of the IΓΘCΘIVΘDATA interface implies that the GEEDC transmits to the application the data transmitted by the connection associated with the EED corresponding to this application.

As part of the data exchange with the MR device, the GEEDC admits the following interface:

- UtcomeDATA interface for sending data between a communication network and its associated EED, This interface can be activated exclusively by the MR device.

Activation of the interface _out comeDATA implies that the MR transmits the connection associated with EDI, data to the EED.

As a window between GEAV / GEAP applications and devices, the GEEDC supports the following interfaces:

- an interface lapphcationcreateEAv allowing the creation of a new EAV. The call to this interface can take as parameter the identifier of an application that will be launched as soon as the EAV in question is created, a UppiicationdestroyEAv interface allowing the destruction of an existing EAV,

- an interface _PP iιcatιoncreateEAP allows the creation of a new EAP,

- UppiicationdestroyEAP interface allowing the destruction of an existing EAP.

The activation of the interface _has ppiιcatιoncrθateEAv / lappiιcatιoncrθateEAP by an application means that the GEEDC identifies EED which the application belongs, and activates the interface IcreateEAv / lcreatΘEAP with the GEAV / GEAP device. The latter creates an EAV / EAP identifier, allocates the memory space requested by the request and associates in its management table the identifier of the EAV / EAP and the memory space. The GEAV / GEAP device sends back to the GEEDC the identifier of the EAV / EAP. The GEEDC provides its association table by matching the name of the EED and the identifier of the EAV / EAP and, depending on the mode of implementation, it transmits or not back to the application the identifier of EAV / EAP.

Activation of the EAstroyapplication / TroyEAPpplication interface implies that the GEEDC activates the IdestroyEAv / ldestroyEAP interface with the GEAV / GEAP device. The latter deletes from its management table the correspondence between the EAV / EAP identifier and its memory space. The GEEDC removes from its association table the correspondence between the name of the EED and the EAV / EAP identifier.

Description of the functioning of GEAV

The GEAV offers the following interfaces: - an IcreateEAv interface allowing the creation of a new EAV. The call to this interface can take as parameter the identifier of an application that will be launched as soon as the EAV in question is created,

- An IdestroyEAv interface allowing the destruction of an existing EAV, These two interfaces can take in parameter the name of the EED in which the creation / destruction must take place.

These interfaces can only be activated by the GEEDC device.

Description of the functioning of EGPA EGPA offers the following interfaces:

an Icre _at eEAP interface allowing the creation of a new EAP,

- an IdestroyEAP interface allowing the destruction of an existing EAP. These two interfaces can take as parameter the name of I ¹ EED in which the creation / destruction must take place.

These interfaces can only be activated by the GEEDC device.

Description of the MR's operation

The MR offers the following interfaces: - an _OPΘΠACCESS I interface to open a connection associated with a

EED and associated access to the communication network associated with this EED,

an IsuspendAccEss interface for suspending a connection associated with an EED as well as access associated with the communication network associated with this EED,

an I _C IOSΘACCESS interface for closing a connection associated with an EED as well as access associated with the communication network associated with this EED.

These three interfaces take as parameter the identifier of the communication network for which the opening / suspension / closing of connection and access must take place.

These interfaces can only be activated by the GEEDC device.

Activation of the IO _P ΘΠACCESS interface implies that the MR creates the connection associated with the EED, located between the MR and the GEEDC, and dedicated to the exchanges between the EED and its associated communication network, and active with the access network the creation / restoration procedure (the restoration procedure applies only if the access was previously suspended) of the access associated with this communication network allowing the transmission of data between the communication network and his respective EED.

Activation of the UuspendAccEss interface implies that the MR destroys the connection associated with the EED, between the MR and the GEEDC, dedicated to the exchanges between the EED and its associated communication network, and active with the access network The procedure for suspending the access associated with this communication network allowing the transmission of data between the communication network and its respective EED.

Activation of the I _C IOSΘACCESS interface implies that the MR destroys the connection associated with the EED, between the MR and the GEEDC, dedicated to the exchanges between the EED and its associated communication network, and active with the network. access the procedure of removing access to this communication network allowing the transmission of data between the communication network and its respective EED.

As part of the data exchange with the applications, the MR admits the following interface:

- LcomeDATA interface for sending data between an EED and its associated communication network. This interface can only be activated by the GEEDC device.

The activation of the LcomeDATA interface implies that the MR transmits, to the recipient communication network, the data transmitted by the connection associated with the EED, between the GEEDC and the MR, reserved for the transmission of the exchanges between this communication network. and his respective EED.

The following description is given by way of non-limiting example. It is intended to make clear what is the operation of the secure access system according to the invention, and more particularly the operation of the GEEDC during the life of a EED and the operation of GEAV during life an EAV associated with EED.

When requesting the launch of an EED via a call to the interface liaunchEED, with the parameters R = "communication network" and A = "application", the GEEDC creates the EED associated with the communication network R if this EED does not exist. This creation consists firstly of adding an entry in the association table initially containing the identifier of the communication network R. An additional parameter P makes it possible to specify the creation of an initially empty EAP in this EED. In this case, the GEEDC requests the GEAP, via IcreateEAP, the creation of an EAP by passing in parameter the reference of the current EED. The GEAP creates an EAP identifier, allocates the memory space requested by the GEEDC request and associates in its management table the EAP identifier and the memory space. The GEAP sends back to the GEEDC the identifier of the EAP. The GEEDC adds the identifier of the EAP thus created in the entry of the association table corresponding to the EED. After the creation of the EED, if the initial EAV does not exist, the GEEDC requests the GEAV to create an initial EAV and launch Application A as a parameter in this EAV. The creation of this EAV involves the invocation of the GEAV Icre _at eEAv interface, passing in parameter the reference of the current EED. New EAVs and EAPs can be associated with EED over time, as discussed below. The suspension of the EED is conditioned by the request for termination of the terminal or the explicit request for suspension of said EED. When the terminal is shut down, the GEEDC requests the GEAV to destroy all the EAVs associated with this EED (IdestroyEAv), but retains all the EAPs as well as the entry in the association table. When requesting the destruction of an EED, all the data of this EED are destroyed, namely the associated EAVs and EAPs respectively via IdestroyEAv and IdestroyEAP, and, consequently, the data they contain as well as the corresponding entry to this EED in the association table.

When requesting the creation of an EAV resulting from a call to the IcreateEAv interface, with the passage of an application as a parameter, the GEAV adds the identifier of the EAV thus created in the association table corresponding to EED. It then runs the application passed as a parameter in the newly created EAV. This application can then request the launch of new applications (and therefore if necessary the creation of new AVEs) or ask EGAP, via Icre _at eEAP, the creation of a new EAP. In both cases, namely EVA creation application or EAP, an application address its request to GEEDC using lapphcationcreateEAV OR lapphcationcreateEAP interfaces carried by C ^β d ^β Mier. The request ^β n question does not include any mention to the EED that hosts the application (the application having no knowledge of the EED that hosts it). AT receiving the request, the GEEDC extracts the name of I ¹ EED associated with the application issuing the request, and redirects the request on the GEAV or GEAP, after having added in parameter of the request the reference to I ¹ EED and obtained. The GEEDC plays here typically its role of "window" with respect to GEAV and GEAP devices. The destruction of a EAV can occur either explicitly via Ides _t royEAv or implicitly at the end all the applications that run it. This destruction implies the erasure of the data contained in the EAV and the deletion of its identifier in the entry of the association table corresponding to its EED. An exemplary embodiment of the invention implementing a construction-based confinement will now be described in the context of mobile terminals accessing GPRS / UMTS compliant communication networks.

It will be recalled that, within the meaning of the GPRS / UMTS standard, the selection of a communication network supposes the selection of an identifier called "APN" ("Access Point Name"). To establish a communication between a terminal and a given communication network, the APN is transmitted over the mobile network to a communication network access management equipment designated by "GGSN" (initials of the words "Gateway GPRS Support"). Node "). This gives rise to the creation of a link with the selected communication network (called "PDP context"), thus allowing access to all the services hosted by the latter. The concepts of APN as well as GGSN are standardized by IΕTSI / 3GPP. The standard thus provides that several accesses can be established simultaneously to several communication networks from the same terminal.

This example supposes the existence of several bouquets of services, respectively available on as many communication networks. The terms "communication network", APN and service package will therefore be used indiscriminately. In the context of construction-based confinement, the memory isolation consists, for example, in attributing to each application a single address space, the address spaces being disjoint two by two, and forbidding the designation, and therefore the access, resources from another space addressing. Access building isolation consists, for example, of a secure communication network access system systematically seeking to establish the access link with the communication network identified by the APN associated with its EED. found in the association table.

In the proposed embodiment, all features are executed by software components. For example, the TCP / IP type protocol stacks are implemented by a set of components each implementing a protocol. The GEEDC, GEAV, GEAP and MR devices are similarly made by GEEDC, GEAV, GEAP, MR. In addition to these are peripheral drivers, modems and human-machine interfaces (HMIs).

The GEED is executed directly on the terminal hardware, in its own address space, so as to be totally isolated from the potentially active AVEs on the terminal. Its functionalities consist of multiplexing and protecting resources according to a security strategy focused on network access. In this exemplary embodiment, the GEED is constructed using components as follows:

- the development of the GEEDC component can be inspired by the window function for the management of memory space, as it exists on a Unix-like operating system, modified however to integrate the protection of resources centered "networks" ; in addition to this function, the GEEDC integrates the management of EEDs and a window for access to communication networks allowing the multiplexing / demultiplexing of exchanges via the MR between the applications and the communication networks; the multiplexing of the connections associated with the EEDs between the GEEDC and the MR for the exchanges between the EEDs and the communication networks can be realized by associating for each connection two "pipes", namely a "pipe" for the exchanges EED towards network and a "pipe" for network exchanges to EED (the "pipe" is an inter-application exchange function existing especially in Unix operating systems);

- The GEAV component uses a "MMU Manager" component to manage the hardware protection device (MMU); the role of this component is to configure the MMU so that the latter ensures the isolation of the different EAVs between them, the isolation of the GEEDC with the EAVs, as well as the lifecycle of the EAVs; thus, each EAV of each EED corresponds to a dedicated virtual address space; in a MMU, each address space is identified by an ASID (initials of the words "Address Space Identifier"); since the number of ASIDs is by nature limited, this ASID serves as an identifier for AVEs; an ASID is temporarily associated as the identifier of an EAV during the lifetime of this EAV; an ASID is reused, ie the destruction of an AAV does not result in the destruction of the ASID, which can later be used as an identifier of another AVE possibly belonging to another EED ; thus, over time, an ASID, as an identifier of an EAV in volatile memory, may appear associated with a particular EAV in the association table, but can never be associated with two EAVs at one time. same moment; likewise, over time, an EAV identifier may appear several times in different entries but never twice at one time; in order to allow the multiplexing of the processor resource between the various applications, the GEAV uses a "Scheduler" component (multiplexer of the computing resource); GEAV is also responsible for the multiplexing of the HMIs between the different AVEs, such as the transition from the on-screen display of an EAV application to that of another application of another EAV;

- the GEAP component is a specific secure file system whose role is to associate each EED with a separate file naming context; the isolation of these contexts is done in a similar way to the memory isolation by preventing the designation and thus the access of a file belonging to an EED from another EED; such a file system can easily be realized using a conventional file system; this consists, for example, in creating in the file tree an APN name directory for each EED, and prefixing in a transparent manner the symbolic name of a file by the name of the APN (thus the file "titi" from the NPC "Leisure" becomes "/ Leisure / titi");

the MR component is implemented in the context of GPRS and UMTS by an "L2TP" component implementing the L2TP protocol layer whose The role is to multiplex the different streams coming from the communication networks identified by the APNs on the same physical network link, here the serial link to the GPRS / UMTS modem; in addition to this function, it includes a window for access to EEDs for multiplexing / demultiplexing exchanges (via GEEDC) between communication networks and applications; the multiplexing of the connections associated with the EEDs between the MR and the GEEDC for the exchanges between the communication networks and the EEDs can be realized by associating for each connection two "pipes", namely a "pipe" for the exchanges EED towards network and a "pipe" for network exchanges to EED.

Still in this exemplary embodiment, an EED is constructed with the following components:

a set of network protocols specifically dedicated to exchanges with the communication network associated with the EED; in the context of GPRS and UMTS, these protocols are, for example, the "PPP", "IP", and so on; the advantage of implementing the protocol layers at the level of the EED is to guarantee by construction the isolation of the data flows transiting in the terminal, even in case of failure or attack;

- a set of human-machine interfacing components "IHM library" managing the peripherals of the platform, such as the screen, the keyboard, and so on;

a set of high level execution component, called "runtime", allowing navigation within the service bundle associated with the EED; the "runtime" is an integral part of the system and is incorporated into the system during its design; for example, three "runtimes" respectively associated with three EEDs are simultaneously present on the terminal:

^* the "XHTML Browser" allowing the display of XHTML page from a "Banking" banking service bundle,

^* a runtime "MIDP" allowing the execution of games in networks and the listening of music MP3 whose contents are accessible exclusively by a bouquet of leisure service of name "Leisure",

^* An MPEG4 "runtime" allowing multimedia streams to be read from a "TV" television service package. In the exemplary embodiment which has just been described, the confinement of the network accesses is carried out integrally by construction, which means that the confinement of the network accesses, the confinement of the accesses to the volatile memory and the confinement of the accesses to the memory persistent are all made by construction. However, several other embodiments involving completely or partially a defensive confinement (confinement of network access and / or memory access) may exist. Thus, volatile (GEAV) or persistent (GEAP) memory isolation can be achieved via access control mechanisms. In this case, an application may request the reading or modification of data belonging to another application, the system checking at runtime if it has the rights (defensive containment of memory access). Similarly, in this embodiment, the application can specify to which APN it wants to connect, and the system could then check at run time if it has the rights to establish access (defensive confinement of network access) .

Claims

A secure execution system, in a terminal (10) intended to be connected to a plurality of communication networks (60, 61, 62), of at least one application dedicated to a given communication network, characterized in that said system comprises means for isolating the execution of said application application dedicated to communication networks other than said given communication network.

2. System according to claim 1, characterized in that said isolation means comprise at least one execution space dedicated to the execution of said dedicated application to said given communication network.

3. System according to claim 2, characterized in that said system comprises:

at least one central manager (31) with at least one execution space (11, 12), capable of:

^* create an execution space,

^* dedicate said execution space to said given communication network, ^* destroy said dedicated execution space,

at least one manager (32, 33) of at least one memory address space, capable of:

^* Allocate a memory address space to said application in response to said request for the execution of said application on said memory address space,

^* Associating said memory address space to said dedicated execution space,

^* forbid that applications running on execution spaces other than the execution space dedicated to said given communication network access data present in said dedicated execution space, at least one network multiplexer (34) able to prohibit, on the one hand, sending data from said dedicated execution space to communication networks other than said given communication network, and on the other hand receiving by said dedicated execution space data from communication networks other than said given communication network.

4- System according to claim 3, characterized in that said application (21, 22) is equipped with at least one interface for transmitting and transmitting information, at least one interface for creating and destroying a volatile address space and at least one interface for creating and destroying a persistent address space with said central manager (31) of said dedicated execution space (1 1, 12).

5. System according to claim 3 or claim 4, characterized in that said central manager (31) is equipped with at least one interface with at least one user interface (43) of said terminal and with at least one multiplexer (34). network of said terminal for creating, suspending and destroying a dedicated execution space.

6. System according to any one of claims 3 to 5, characterized in that said central manager (31) is equipped with at least one interface with at least one manager (32) of volatile address space of said terminal for the creation and destruction of a volatile address space.

7- System according to any one of claims 3 to 6, characterized in that said central manager (31) is equipped with at least one interface with at least one manager (33) persistent address space of said terminal for creating and destroying a persistent address space. 8- System according to any one of claims 3 to 7, characterized in that said central manager (31) is equipped with at least one interface with at least one network multiplexer (34) of said terminal for transmission and transmission. transmission of information. 9- System according to any one of claims 3 to 8, characterized in that said central manager (31) is equipped with at least one interface with said network multiplexer (34) of said terminal for creation, suspension and transmission. deleting a connection associated with said dedicated execution space (11, 12). 10- System according to any one of claims 3 to 9, characterized in that said network multiplexer (34) is equipped with at least one interface with at least one network interface (42) of said terminal for transmission and transmission. transmission of information. 1 1 - System according to claim 10, characterized in that said network multiplexer (34) is equipped with at least one interface with said network interface (42) of said terminal for creating, suspending and deleting an access said communication network (60, 61, 62).

12- System according to any one of claims 3 to 1 1, characterized in that said central manager (31) is equipped with at least one association table of at least one execution space (1 1, 12 ) dedicated to associate said execution space (1 1, 12) dedicated to said communication network (60, 61, 62) and at least one address space.

13- method for the secure management of at least one volatile address space in a terminal (10) for at least one execution space (1 1, 12) dedicated to a communication network (60, 61, 62), characterized in that said method comprises the operations of:

requesting by an application that executes in a dedicated execution space (11, 12) an allocation of a volatile address space, identifying by a central manager (31) said execution space (1 1, 12) corresponding to said application (21, 22),

requesting by said central manager (31) the creation of said volatile address space, specifying said dedicated execution space (1 1, 12), at least one volatile address space manager (32) of said terminal creating a volatile address space by said volatile address space manager (32),

responding by said volatile address space manager (32) to said volatile address space creation request, specifying said volatile address space, to said central manager (31), executing said application (21); , 22) on said volatile address space.

14. A method for securely managing at least one persistent address space in a terminal (10) for at least one execution space (1 1, 12) dedicated to a communication network (60, 61, 62), characterized in that said method comprises the operations of:

requesting by an application that executes in a dedicated execution space (11, 12) an allocation of a persistent address space, identifying by a central manager (31) said execution space (1 1, 12) corresponding to said application (21, 22),

- Request by said central manager (31) the creation of said persistent address space, specifying said dedicated execution space (1 1, 12) to at least one manager (33) persistent address space of said terminal to create a persistent address space by said persistent address space manager (33),

responding by said persistent address space manager (33) to said persistent address space creation request, specifying said persistent address space, to said central manager (31), storing data by said applying (21, 22) to said persistent address space,

extracting data by said application (21, 22) on said persistent address space.

15-Method for secure access, in a terminal (10), of at least one execution space (11, 12) dedicated to a communication network (60, 61, 62), characterized in that said method comprises operations consisting of:

- Activate on the terminal at least one execution space (1 1, 12) dedicated to a communication network (60, 61, 62),

establishing a dedicated connection to said dedicated execution space (1 1, 12) between a central manager (31) and a network multiplexer (34),

establishing reserved access to said dedicated execution space (1 1, 12) between said network multiplexer (34) and said communication network (60, 61, 62) associated with said dedicated execution space (1 1, 12) ,

transmitting data from said dedicated execution space (1 1, 12) to said communication network (60, 61, 62) by switching said data, on the one hand, by said central manager (31), said space of execution (1 1, 12) dedicated to said reserved connection, and secondly, by said network multiplexer (34), said connection reserved to said reserved access, transmitting data from said communication network (60, 61, 62) to said dedicated execution space (1 1, 12) by switching said data, on the one hand, by said network multiplexer (14), said reserved access to said reserved connection, and secondly, by said central manager (31), said reserved connection to said dedicated execution space (1 1, 12).

16- Computer program characterized in that it comprises portions of code for performing the steps of the method according to claims 1 to 15.

Computer-readable recording medium on which said computer program is recorded according to claim 16.