WO2013050674A1

WO2013050674A1 - Computer case for securely accessing an information system

Info

Publication number: WO2013050674A1
Application number: PCT/FR2012/000401
Authority: WO
Inventors: Jean-François TESSERAUD
Original assignee: Cassidian Sas
Priority date: 2011-10-06
Filing date: 2012-10-08
Publication date: 2013-04-11
Also published as: FR2981177B1; FR2981177A1

Abstract

The invention relates to a computer case provided with: an integrated information system; a gateway (4) for accessing the integrated information system (52), including a casing (4) provided with a power supply, a hub (25) for connecting the gateway to a local network (12), a first firewall (26) for connecting the gateway to the integrated information system (52) and an external communication Internet network; and a central processing unit (27) including: at least one remote connection server (28, 29, 30) that is accessible from the external communication network in a secure tunnel via the first firewall; and a virtual server (31) with strong authentication.

Description

"Computer case for secure access to an information system."

The present invention relates to a computer box for access to an information system.

Currently, most companies have an information system that employees have access to work with. When a user is traveling to the outside of the company, it is necessary to provide completely secure access to the information system.

Many solutions exist to remotely access a company's resources. The present invention aims to contribute to a rapid deployment of an information system without specialist intervention on site. Another object of the invention is a system allowing inter-network collaborative work while guaranteeing a partitioning of networks and the segregation of data. The invention still has a purpose-an autonomous and portable solution for connecting to a data communication system. information regardless of the terminal used.

At least one of the above objects is achieved with a portable computer package comprising:

- an integrated information system,

an access gateway to an integrated information system, this gateway comprising:

- a box with a power supply,

a hub for connecting the gateway to a local area network,

a first firewall for connecting the gateway to the integrated information system and to an external communication network of the Internet type, and

a processing unit comprising:

at least one remote connection server accessible from the external communication network in a secure tunnel via the first firewall, and

a virtual server, called an authentication server, configured to interact with said at least one remote connection server for strong authentication of each user accessing the first firewall, this strong authentication being performed from a unique identifier of the user's terminal;

a networked storage server, called NAS server,

a switch for managing the internal connections of the box, and

a second firewall arranged between said computer gateway and the other components.

With the housing according to the invention, the integrated information system is accessible from the Internet by any terminal. The hub allows a connection of a user terminal locally. Access rights to an information system element can be managed by the hub and / or the first gateway firewall.

The box according to the invention acts as a switchman integrating application functions for the distribution of services and for authentication.

an ease of deployment. The housing is advantageously an industrial rackable system and adaptable to the environmental context. This provides a complete information system that can easily be deployed in specific environments (site, factory, platform, outdoor work ...), without any IT resources. A decentralized information system can therefore be deployed in offices, campus offices, with or without interconnections with central systems, and without IT resources and for which a certain level of security (availability, integrity, confidentiality) must be insured and controlled. Such an integrated information system can be set up, for example, to share information between companies while guaranteeing the compartmentalization of project information and company-specific information. This housing can in particular be deployed for crisis cells or emergency operations.

Said at least one remote connection server may comprise: a first virtual server, called virtual office server, accessible from the external communication network by remote display in a secure tunnel via the firewall; and or a second virtual server, called a nomadic server, accessible from the external communication network by client-server link with data exchanges in a secure tunnel via the firewall; and or

a third virtual server, called server for voice, accessible from the external communication network by a voice over IP link in a secure tunnel via the firewall.

By server for virtual office, we mean a server to access a virtual office, but also to other applications such as WEB applications.

In particular, the virtual desktop server allows the connection of any known or unknown terminal of the information system. It is sufficient that this terminator is able to generate a strong authentication identifier. This identifier can be integrated in the terminal or generated from a lightweight executable stored within the terminal or in a portable storage means such as a USB key or other. The communication with the virtual office server is done by remote display which advantageously avoids the transfer of data, including malicious data that could pass from the user terminal to the information system.

The server for nomad allows the connection of known terminals of the information system and preferably comprising a heavy client application for dialogue with a server application in the gateway with data exchange.

With the gateway according to the invention, the information system of a company is accessible from the Internet by any terminal. The hub allows a connection of a user terminal locally. The rights of access to a particular element of the information system can be managed by the hub and / or the firewall.

The gateway according to the invention acts as switchman integrating application functions for the distribution of services and for authentication. This gateway is a single box allowing multi-service interconnection (different types of access) multi-environment

(for any application in the information system). It also allows redirection to shared services.

INCORPORATED BY REFERENCE (RULE 20.6) With the third virtual server, the gateway according to the invention allows any terminal to also access the voice applications of the information system in addition to the given applications.

According to an advantageous characteristic of the invention, the virtual office server can be configured to execute each session in an isolated virtual environment. Thus, different sessions of the same user or of several users are partitioned with respect to each other. With isolated sessions, the integrity of data and applications of the information system is preserved.

Advantageously, the virtual desktop server may include several browsers to access the information system. Each browser can be configured to access a set of specific elements of the information system. We thus define several browsers, each dedicated to one or more specific applications. Browsers are run in the gateway and not locally in the user terminal. This ensures the integrity of the user terminal against any malicious act from the Internet for example. The virtual desktop server allows a user terminal to access web applications, or application publishing tools such as Citrix® or TSE (for "Terminal Server" Windows®) information system .

According to an advantageous characteristic of the invention, the virtual servers are arranged in an isolated environment such as a DMZ demilitarized zone.

Preferably, the secure tunnels may be SSL or IPSEC encrypted VPN tunnels

With the gateway according to the invention, it ensures the complete security of the information system and data.

According to other advantageous features of the invention, the nomadic server comprises:

a server module of a multi-access composer, a client module of the composer being contained in a user terminal,

a server module of a remote access application for establishing an SSL VPN tunnel, in particular with encapsulation of exchanges in secure http mode, and for accessing the information system via a dedicated gateway. The multi-access dialer is a connection wizard that allows the user terminal to connect to the mobile server from different wired or wireless physical networks.

According to another advantageous characteristic of the invention, the housing further comprises an electronic card for managing the supply of the various components of the housing. This electronic card is advantageously configured to start sequentially automatically different components of the housing after a stop. In particular, the housing according to the invention comprises a single power supply for starting and stopping the components of the housing in a predefined sequence.

Furthermore, there is provided an electronic card administration of the various components of the housing. According to an advantageous characteristic of the invention, the information system comprises:

- applications in publication mode,

- a web server,

- a print server,

- IP address management server, and

- a module for managing the publication of applications.

It is also possible to provide application servers according to the needs of the user (server applications / client applications) A box according to the invention has the particular advantage of enabling scalability by stacking boxes. To do this, the switch comprises at least two connectors, including HDMI type (for "High Definition Multimedia Interface" in English) for cascading several equivalent boxes.

Of course, the various features, forms and embodiments of the invention may be associated with each other in various combinations to the extent that they are not incompatible or exclusive of each other. Other advantages and characteristics of the invention will appear on examining the detailed description of a non-limiting embodiment, and the appended drawings, in which:

FIG. 1 is a simplified schematic illustration of a system for accessing information systems according to the invention,

FIG. 2 is a simplified schematic illustration of a secure access computer gateway according to the invention,

FIG. 3 is a simplified schematic illustration of an authentication process according to the prior art,

FIG. 4 is a simplified schematic illustration of an authentication process according to the invention,

FIG. 5 is a simplified schematic illustration of a secure access box integrating an information system. In FIGS. 1 to 5, the various elements common to the variants or embodiments have the same references.

FIG. 1 shows a simplified diagram of a system for accessing information systems according to the invention. There is an information system 1 of a company. This information system is represented by physical or virtual servers comprising all the components of a conventional information system including an application publication, storage means, centralized management means IP addresses, a manager of printing and application of administration of the information system of the company, business applications, (non-exclusive and non-exhaustive list). This information system is integrated in a local area network 2 which may be a wired or wireless local area network or a wide area network. User terminals 3 can access the information system 1 via the local network. The gateway according to the invention aims to develop the following uses:

- individual mobility,

- team mobility,

- teamwork,

- telework, and

- sedentary work. Furthermore, the system according to the invention makes it possible to distribute an information system and to set up an application publication in "SaaS" mode for "Software as a Service", an application as a service allowing the use of an application without installing it locally.

To do this, we use a new secure access gateway 4 connected on the one hand to the information system 1, and on the other hand to the Internet (5). The secure access gateway 4 is intended to allow access to the information system 1 from terminals 6 to 9 of different types. These terminals can be known from the information system 1 because belonging for example to the local network 2, but they can advantageously be any other user terminal. Other terminals 10 and a second local area network 11 constitute a remote site without its own information system. The gateway 4 allows us to offer this site all access networks and connecting means available at the local site 2, but through an Internet connection or WAN (direct Internet access, remote access, ^ _^ ccess invited segregation - customer networks ....)

The distribution of the information system is obtained by integrating all or part of the information system into an infrastructure unit 12 which will be described in more detail below. Several infrastructure boxes can be connected in a group or "cluster" 13 comprising all or part of the information system. The user terminals 6 to 9 connecting to the information system 1 can also access, via the gateway 4, a SaaS application publishing server 14 to benefit from a certain number of applications without downloading them. locally on the user terminal. These terminals 6 to 9 can also access via gateway 4 to a storage server 15. A centralized service management module 16 and a centralized supervision module 17 for the security of exchanges in the system are provided. In Figure 2, we see a little more in detail the contents of the secure access gateway 4 according to the invention. It is a box containing a concentrator 25 which is connected to a local network architecture, simply represented here by the local network 2. This concentrator allows access to the user terminals connected to the local network 2. typically company terminals. It also helps to manage rights of access to defined services. The firewall 26 makes it possible to pass authorized communications originating from the local network 2 via the concentrator 25 or from the remote terminals 6 to 9 (in FIG. 1) via the Internet 5, to a processing unit 27 and / or to the information system 1. The firewall can also control communications to the Internet, (standard navigation with URL filtering, antivirus and intruder probe) and the establishment of IPSEC tunnels to different sites or administration. In particular, the communications from the Internet are directed to the processing unit 27 for establishment of secure communication and for strong authentication of the terminals and users. Depending on the remote terminal 6 to 9, the communication is directed to a virtual office server 28, a nomadic server 29 or a voice server 30. Each of the virtual servers 28 to 30 closely interacts with an authentication server 31. By way of non-limiting example, the virtual desktop server can be obtained from the Common It's Virtual Browser® product, the Login People® product which is an authentication server, as well as an interface developed to enable the interaction between the Virtual Browser® product and the Login Peopfe® product. A Virtual Browser product is described in particular in document WO 2010136317.

The nomadic server may also be non-limitatively implemented by means of the product IMomadio® from Ibelem as a dialer 29A, associated with the product IPDIVA® as a remote access application 29B, these products being adapted to collaborate with the Login People® as a strong authentication server.

These virtual servers are advantageously arranged in a demilitarized zone to protect the information system against any malicious intrusion.

When a user is within the local network 2, he can connect through his terminal to the hub 25 for identification. The latter identifies the user as well as the network or networks for which he has a right of access.

When this user is outside Local Area Network 2, if he is using an unknown terminal, that is, not listed in the local network, such as for example the machine of a cyber café or a personal computer, it is the servers for virtual office and authentication that will intervene.

When this user is outside the local network 2, if he uses a known terminal, the hub 25 intervenes for the identification of the terminal.

The implementation of the virtual desktop server addresses the problem of connecting to the information system regardless of the terminal used and to ensure that this connection does not allow the data leak or the attack of the information system. This mode allows collaborative work (access to the shared space and access to the user's personal information system while ensuring that no transfer can be made from one space to another).

As previously mentioned, the virtual desktop server can be implemented using the connected Web-enabled Virtual Browser® product allowing access to web-based applications from a virtual browser installed on a DMZ (Demilitarized Zone). firewall. The access to this virtual browser is done by means of executable files stored either on a terminal (PDA, Smartphone) or on key of type USB (standard key), external disks or others.

The authentication server can be implemented with the product LOGIN PEOPLE® allowing to perform strong authentication without the use of cryptographic "token" or specific cryptographic mechanism. This solution relies on specific parameters of a terminal to make its identification unique and not falsifiable. In virtual desktop mode, the virtual desktop server and the authentication server are interoperable.

In practice, the virtual desktop access process may be as described below.

The user launches a virtual desktop executable stored either on the terminal or on a USB key. This executable does not require any installation or special privilege.

The communication between the terminal and the gateway is encrypted, and authenticated in the case of certificate use.

Encryption is done via OPENSSL. Once the communication is established, the user has access to the virtual desktop server and to the various services authorized to him according to his profile. The choice of a service automatically opens a specific session on the information system concerned. By default, there is no information transfer between the client and the virtual desktop server. We can consider a data exchange depending on the context.

Regarding the implementation of the authentication server from the product Login Peopfe®, the authentication of the terminal is done by means of several parameters intrinsic to the terminal. This authentication is performed by means of an extension module or "plugin" installed in a browser (ActiveX / Java Applet or specific components depending on browsers).

FIG. 3 shows an authentication process according to the prior art in which user terminals 40 want to access an information system 39 through an authentication server 37 (ID_BOX) and a VPNSSL gateway 38. connection is usually made through a web page. In step 32, the user enters a PIN code and sends this pin code and the signature of the terminal used for the connection (from his smartphone, his USB key, his terminal, etc.). ■ The authentication server verifies the pin code and the signature and returns to the user in step 33 a one-time password (OTP). A VPNSSL client (not shown) installed on the terminal retrieves ΟΤΡ and returns in step 34 the identifier of the terminal to the gateway VPNSSL 38. The latter returns, in step 35 for verification, i-ΌΤΡ to the gateway d authentication, usually according to the RADIUS protocol. The communication is thus authenticated and encrypted. The VPNSSL gateway 38 authorizes access to the information system in step 36.

In Figure 4, this authentication process is modified in combination with the secure access process by the virtual desktop server.

The combined process is terminal independent (zero adhesion) and works on all terminals. It allows user and terminal authentication uniquely and before accessing the information system. Communication can be established by wired or radio (WiFi, 3G, ...). Single sign-on (SSO) at the information system level is also possible.

In practice, the implementation can be done, without this being limited to the mentioned products, through the development of one or more interfaces for dialogue between Virtual Browser® and Login People® products. Other developments and / or products may be envisaged in order to implement the functions defined according to the invention.

The interfaces make the two products interoperable. In particular, in the conventional case, the generation of the signature resulting from Login people® requires the implementation of a software component integrated in the browser on the client computer. Or Virtual Browser® uses a centrally installed browser, so not on the client machine. With the interface between Virtual Browser ® and Login People®, we recover the signature fingerprint without ^" installing software component on the client.

In Figure 4, the terminal 40 to be identified is the one having access to an executable file adapted to initiate a connection with the virtual desktop server (Virtual Browser®). This executable file is stored in the terminal 40 or in any storage means such as a USB key. The terminal 40 is a device capable of connecting to the Internet, it may be a smartphone or a PC (any OS confused). No installation is necessary on the terminal.

- When the user opens the executable file, a modified Virtual Browser® client module runs and connects in step 4i to the modified Virtual Browser® server (virtual desktop server) 28. By modified Virtual Browser® means a Virtual Browser® type application associated with an interface (a dedicated application) allowing the exchange of data between the Virtual Browser® application and another application such as, for example, the Login People® application. The communication is secured by SSL but not authenticated.

In step 42, the virtual desktop server 28 requests a unique identifier or signature of the terminal. A specific web page opens. The terminal signature is calculated by running a local program to the client and integrated into the modified Virtual Browser® client module. A pin code is requested from the user. The user enters the pin code. In steps 43 and 44, the pin code and the signature are transmitted for authentication to the authentication server 31 via the virtual desktop server.

- The authentication server generates in step 45 a unique password says OTP (for "One Time Password") and transmits it to the virtual desktop server.

In step 46, the valid virtual desktop server returns the password and the signature to the authentication server 31 to request a login. User groups may be retrieved from an LDAP server (not shown).

In step 47, the authentication server authorizes the opening of a session for the virtual office according to the rights of the user.

In step 48, the terminal 40 accesses the information system, in particular to web applications, desktop and published applications.

When the user uses his usual terminal of the company, this terminal contains a client module able to communicate with a server module in a client mode ^ server with data exchange. The connection process can be as follows:

The user initiates a connection by activating a connection wizard.

This connection wizard is for example a client module capable of communicating with a server module forming the dialer 29A, the client-server set can for example be obtained from the product Nomadio®. The connection wizard installed on the user terminal detects and proposes all possible means of communication of the terminal: 3G, WiFi, ... The user chooses a communication mode. The wizard can indicate a preferential mode according to various parameters such as the place of connection, the quality, the time of the connection ... The connection wizard points the firewall 26 which directs the connection to the composer 29. The latter initiates a strong authentication process by interfacing with the authentication server 31. The latter retrieves a unique identifier of the terminal. This identifier has been developed from the software and hardware characteristics to identify simply and quickly each terminal. When the authentication is completed and accepted, the remote access application 29B is launched, such as the IPDIVA® product. in order to set up an SSL VPN tunnel between a client application in the user terminal and the server portion of the remote access application contained in the processing unit 27. The user terminal is then connected to a software gateway in the information system to enable the user terminal to access the different elements of the information system with data exchange. The authentication server uses an identifier of the terminal, this identifier being a lightweight identifier, unlike conventionally used certificate or token systems, which are identifiers that are heavy in terms of size and handling.

In Figure 5, there is shown a secure access gateway 4 integrated into an infrastructure box 50 comprising an information system. It is a case which, in addition to all the components of the gateway 4 of FIGS. 1 and 2, further comprises:

a firewall 51 connected with the firewall 26 (FIG. 2) present in the gateway 4 to enable and monitor the communication between the gateway 4 and the other elements of the infrastructure box;

an integrated information system 52 comprising in particular an application publication, a web server associated with an http relay, a folder and print server, means for centralized management of IP addresses (DNS, DHCP, AD) , and an administration application for managing the publication of applications;

a NAS network storage server 53 ("Network Attached Storage") for managing disk spaces;

a switch 54 for managing the communication between the different elements of the infrastructure box, it also makes it possible to cascade several infrastructure boxes of the same type;

a processing unit or electronic card 55 for administering the other elements of the infrastructure box; and

another processing unit or electronic card 56 for managing the power supply of the infrastructure box, in particular stopping and sequential startup of the elements of the infrastructure box; for example, a start-up sequence may be the following: the switch 54, the processing unit 55, a NAS network storage server 53, the system integrated information 52, and the gateway 4 secure access; stopping in the opposite direction.

The cascading of the infrastructure boxes makes it possible to create a redundant system. The different services are thus always available in case of failure of one of the infrastructure boxes.

In a general manner and in addition to the above, and in accordance with FIGS. 1 to 4, the system according to the invention can be defined in the form of kits that can be implemented for each family of equipment to be taken into account. The system according to the invention comprises in particular the following families:

• Client equipment family (remote or local):

o For the nomadic kit: a portable access kit allowing a company station to access the resources of the enterprise, the infrastructure box integrating an information system, the SaaS server and the Store server. The kit includes dialer, secure communication and strong authentication.

o For the virtual desktop kit: A solution that allows a user to access corporate resources, an infrastructure appliance that includes an information system, the SaaS server, and the Store server. It also allows you to store and use data stored in a secure space.

o For the mobile voice kit (Smartphone): identical solution to the server for virtual office and / or server for nomad but dedicated to the world of smartphones.

• Infrastructure equipment family

o The infrastructure box integrating an information system: a complete information system, integrated (network - published applications - storage), scalable (stacking or networking) offering voice image data services, integrating security services (security of communications (voice and data), Internet access security, data security (encryption and Data Loss Prevention (DLP) data loss prevention) / Backup / Synchronization), high availability), which can be easily deployed.

o The secure access gateway: Shared access gateway, allowing client solutions to access a customer information system. Access gateway allowing a remote site to integrate into the architecture of the system according to the invention without specific deployment on the remote site while retaining the features offered in the infrastructure box integrating an information system (multi VLAN access guest, LAN to LAN access)

Family service

o SaaS server: Access portal for applications in service mode (application publishing and remote execution) and compatible with the solutions of the client family. The SaaS server is shared between several companies while ensuring a partitioning of communications and data and access. It is compatible with strong authentication solutions,

o Store server: Library of virtualized applications that can be:

• used by the SaaS server (from infrastructure and client solutions)

• downloaded and used by the products of the client family

• used on a client workstation without specific installation Family Management

o Centralized Service Management Server: centralized management console for complete system administration. Customer Administration, Infrastructure, and Services. The management includes the management of the services and the configuration / deployment of the different solutions, o The centralized monitoring server for the security of exchanges in the system (alarm reporting, correlation, log management, vulnerability). This server also provides security management (configuration of firewalls, links inter * systems, security policy and compliance, patch management ....)

We will now detail below, some principles implemented hardware and application level:

The system according to the invention is a coherent solution but adaptable because designed in brick mode.

The technical architecture of the system according to the invention is based on bricks providing the various functions of an information system ranging from communication (network architecture) to the provision of application in SAAS or local mode (virtualization of application, application publishing) by integrating strong authentication mechanisms and storage / backup of secure data either in the central infrastructure or on a remote support (nomad, virtual office, Smartphone).

Communications Architecture:

All communications between the various elements of the system are secure (encryption and authentication).

This communication architecture between the different elements is provided by several IPSEC (for "Internet Protocol Security") and / or SSL (for "Secure Socket Layer") tunnels depending on the elements to be connected.

All communications are managed from the centralized service management server.

An architecture according to the invention can be built either on the Internet or on a private network, or both. The minimum throughput depends on the services requested.

The local network architectures, implemented in the gateway and in the infrastructure box, make it possible to provide several networks for different uses divided into three classes:

• Access to local information system: allows a user to access any location at the local IS • Guest Access: allows a person to access the Internet (in guest mode) by providing communications control and connection data backup

• LAN to LAN access. Offers a group of users an extension of its corporate network without using remote access.

Each network class can be subdivided into several isolated classes of each other.

Network architectures rely on VLAN technologies and rely on WiFi or wired architectures, or both, to make deployment quick and easy.

All client / infrastructure communications are encrypted and authenticated by different mechanisms based on network typology.

15 System Virtualization:

The various servers of the system work on specific equipment, custom built but common base. The basic systems running on the different devices rely on OS virtualization technologies, allowing simple evolution and interoperability of the elements between them (in a given family). VMWare virtualization software solution that offers high availability and load sharing capabilities can be used.

Information system:

The information system may be for example a Microsoft system

(Active Directory / File / Print ..) with an architecture in the infrastructure box able to interact with the architecture of the SaaS server (implementation of rights approval solution between two disjointed Windows architectures: federation of identities)

0

Strong authentication:

Several strong authentication mechanisms can be used:

• Strong certificate-based authentication (software or hardware)

β strong authentication without certificate (eg terminal fingerprint) Enrollment of users or creation of certificates can be either external to the system or integrated into the architecture. Strong authentication coupled with unique identification (SSO) allows a given user to access data and networks using only one authentication sequence. Identity federation mechanisms enable a user to access distributed systems that do not have user base consistency without replaying the authentication mechanisms. The implemented certificates can also be used for data encryption.

Storage:

The infrastructure box integrating the information system offers storage capacities per user, which can evolve and be distributed over several boxes. Synchronization mechanisms make it possible to ensure the high availability of data in case of malfunction of one of the infrastructures. The data can also be backed up / synchronized on specific servers while guaranteeing the same level of security (confidentiality / integrity) of the initial data.

The storage architecture also makes it possible to synchronize in two directions data stored on a local station (nomad and smartphone) or on a key (virtual office) keeping the same security levels. In this case, data synchronization requires the terminal to be connected to a system architecture (partial or complete).

Voice solution:

The system offers a default secure voice solution (voice encryption) that allows you to either loop back to an enterprise IP PBX (IP PBX) or have your own access to switched networks (this applies to the infrastructure box only) . The voice infrastructures are compatible with the infrastructure box and the gateway and work on all the clients of the system as well as on standard telephones (TOIP for "Telephony over Internet Protocol"). Data protection :

Specific bricks make it possible to protect the data stored in the various products of the system. Data protection includes the protection of the data itself (confidentiality / integrity) as well as the audit / control of the use thereof.

Application Publication:

The SaaS server and the infrastructure box provide application publishing solutions that allow a user to access an application without installation on the remote station. This solution is compatible with all system clients and wherever the application is located. The application virtualization mechanisms are identical for the infrastructure box and the SaaS server. Virtualization of the terminal:

This solution coupled with the application publication allows a user to access the information system from any terminal or from a specific terminal but belonging to another information system. The solution guarantees by default that no data can be stored on the quoted item. This is a default configuration that can be changed based on the group to which the client node belongs (Adaptive policy based on context). The usage policy may be related to the strong authentication mechanism.

Virtualized application:

It is a solution to virtualize applications to run locally (on a user's computer) without having to install these applications. The applications are available for download from, for example, the Store server.

Security :

All elements of the range enjoy the same level of security. This ensures a consistent level of security. This level is defined according to known risks and user requirements. Security is global. In the case where the latter applies to a system existing information, it can either be independent of the latter with a specification of the level of security for the interfaces, or integrated with security mechanisms of the user.

Security includes:

• The security of systems and applications (patch management, updating, compliance control, management of control tools, ...)

• Data security (encryption, backup, access control ...)

• User management and associated rights. Administration / supervision:

This solution covers the supervision and administration of the various elements of the system:

β Provisioning user accounts

• Start stop service

• Added additional service

• Systems monitoring

• Put into production.

Modularity of the range:

The gateway can be integrated into the infrastructure box or used independently.

Of course, the invention is not limited to the examples that have just been described and many adjustments can be made to these examples without departing from the scope of the invention.

Claims

A portable computer case comprising:

- an integrated information system (52),

a gateway (4) for access to an integrated information system (52), this gateway comprising:

- a box (4) with a power supply,

a hub (25) for connecting the gateway to a local area network (12),

a first firewall (26) for connecting the gateway to the integrated information system (52) and to an external Internet type communication network, and

a processing unit (27) comprising:

at least one remote connection server (28, 29, 30) accessible from the external communication network in a secure tunnel via the first firewall, and

a virtual server (31), said authentication server, configured to interact with said at least one remote connection server (28, 29, 30) for a strong authentication of each user accessing the first firewall, this authentication strong being made from a unique identifier of the user's terminal;

a networked storage server, called NAS server,

a switch for managing the internal connections of the box, and

a second firewall disposed between said computer gateway and the other components.

2. Housing according to claim 1, characterized in that said at least one remote connection server (28, 29, 30) comprises a first virtual server (28), said server for virtual office, accessible from the external communication network by deporting display in a secure tunnel via the first firewall.

The enclosure of claim 2, characterized in that the virtual desktop server (28) is configured to execute each session in an isolated virtual environment.

4. Housing according to claim 2 or 3, characterized in that the virtual office server (28) comprises several browsers to access the information system (1).

5. Housing according to claim 4, characterized in that each browser is configured to access a set of applications of the information system (1).

6. Housing according to any one of the preceding claims, characterized in that said at least one remote connection server (28, 29, 30) comprises a second virtual server (29), said server for nomad, accessible from the network external communication via client-server link with data exchange in a secure tunnel via the first firewall.

7. Housing according to claim 6, characterized in that the nomadic server (29) comprises:

a server module (29A) of a multi-access composer, a client module of the composer being contained in a user terminal,

a server module (29B) of a remote access application for establishing an SSL VPN tunnel and for accessing the information system.

8. Housing according to any one of the preceding claims, characterized in that said at least one remote connection server (28, 29, 30) comprises a third virtual server (30), said server for voice, accessible from the network external communication by a voice over IP link in a secure tunnel via the first firewall.

9. Housing according to any one of the preceding claims, characterized in that the virtual servers are arranged in an isolated environment.

10. Housing according to any one of the preceding claims, characterized in that the secure tunnels are SSL encrypted VPN tunnels.

11. Housing according to any one of the preceding claims, characterized in that it further comprises an electronic card (56) for managing the supply of the various components of the housing.

Housing according to claim 11, characterized in that the electronic card (56) is configured to automatically start sequentially different components of the housing after a stop.

13. Housing according to any one of the preceding claims, characterized in that it further comprises an electronic card (55) for administering the various components of the housing.

Housing according to any one of the preceding claims, characterized in that the integrated information system comprises:

- applications in publication mode,

- a web server,

- a print server,

- IP address management server, and

- a module for managing the publication of applications.

15. Housing according to any one of the preceding claims, characterized in that the switch comprises at least two connectors for cascading several equivalent housings.

16. Housing according to any one of the preceding claims, characterized in that it comprises a single power supply for starting and stopping the housing components in a predefined sequence.