WO2017060624A1

WO2017060624A1 - Means for managing access to data

Info

Publication number: WO2017060624A1
Application number: PCT/FR2016/052563
Authority: WO
Inventors: Gildas MOREL DES VALLONS
Original assignee: Novathings
Priority date: 2015-10-09
Filing date: 2016-10-05
Publication date: 2017-04-13
Also published as: EP3360293A1; FR3042362B1; FR3042362A1

Abstract

The present invention relates to means for transmitting a data set, accessible by a management module on a first network, to an access module coupled to a second network. The first and second networks are coupled by means of a third network. A communication module is coupled to the third communication network and configured to allow a two-way communication channel to be established between the management module and the access module. A first request, sent by the communication module and generated by the access module, is received by the management module. The first request comprises information allowing the management module to determine that the access module is requesting access to the data set. The first data set is saved to a location on the third network described by a first address. The management module sends the communication module a first reply intended for the access module, said first reply comprising the first address.

Description

Means of managing access to data

Introduction

The present invention relates to data management means that can be used by users, particularly in a mobility situation. More particularly, the invention relates to a method and a system capable of enabling automated data backup from a plurality of devices, duplication of data saved on various devices coupled to one or more networks, secure sharing of data. secured data with a plurality of users, and remote access to the data of each user, including when said user is in a mobility situation.

Prior art

There are now various data management systems that allow a user group to manage data, for backup, sharing, duplication or remote access purposes. Thus, it is known to deploy centralized storage means, accessible via a local network, to a user group. To access, manage and / or save data, each user can use a dedicated application, executed on a device such as a computer or a phone, itself connected to the local network. However, it is also desirable to provide similar functionalities to users when they are in a mobility situation. A mobile device running a dedicated application can be used for this purpose, the mobile device not being connected directly to the local network, but to the Internet. It is then necessary for the mobile device to be able to exchange requests and data, with the data management system, via the Internet, in a rising voice - that is, from the mobile device to the mobile device. data management system - and in descending voice - that is to say from the data management system to the mobile device.

To enable the data management system to be accessible from the Internet by the mobile device, it is known to use, in the local network, network termination equipment coupled to the Internet. The network termination equipment generally has a public address - for example an address designated by the acronym "IP" for "Internet Protocol", representing an entry point accessible via the Internet, to the network. local. Network termination equipment is typically coupled to a firewall device that handles inbound and outbound connections to terminals connected to the local network. Typically, the firewall device is configured to allow outgoing connections using the hypertext transfer protocol - more generally referred to by the acronym "HTTP" for "HyperText Transfer Protocol" - or the outgoing connections using the transfer protocol secure hypertext, more generally referred to by the acronym "HTTPS" for "HyperText Transfer Protocol Secure". Therefore, the data management system can transmit requests and data to the mobile device connected to the Internet, using usual means, for example using the HTTP or HTTPS protocol. On the other hand, the firewall device is generally configured to block incoming connections using the HTTP or HTTPS protocol to the terminals connected to the local network. The transmission of requests and data from the mobile device connected to the Internet to the data management system, therefore requires the implementation of specific solutions.

A first solution is to manually modify the rules implemented by the firewall device to allow incoming connections to the data management system from the mobile device. However, this solution is impractical and difficult to implement because it requires the user to an additional step of configuration of the network termination equipment, which can be difficult for an inexperienced user complex and tedious if many terminals must be allowed.

A second solution is to use an automatic configuration protocol, compatible with the terminating equipment. Among the automatic configuration protocols, mention may be made of the UPnP protocol IGD (English acronym for "Universal Plug and Play Internet Gateway Device"), the PCP (Portorean Protocol for Port Control Protocol) or the protocol NAT Port Mapping Protocol (acronym for "Network Address Translation Port Mapping Protocol"). However, the network termination equipment is not necessarily compatible with the automatic configuration protocols mentioned, or be available only after a configuration and activation phase. Also, to deal with the situation where the network termination equipment only manages certain automatic configuration protocols, it is necessary to test the protocols one after the other to define those compatible with the equipment of the network. network termination to which the data management system is connected. For example, the data management system must test the support of the UPnP IGD protocol, then, if it is not supported, the PCP protocol, etc. until you find a supported protocol. This solution is therefore complex because it requires the implementation of various automatic configuration protocols by the data management system. In addition, to be accessible via the Internet, each data management system must have a URL (acronym for "Uniform Resource Locator") of its own. This URL must therefore be configured to point to the public IP address of the network termination equipment, which poses various security problems by exposing the local network to different types of attacks such as denial of service attacks, or deviation (more commonly referred to as "pharming"), etc. In addition, the use of an automatic configuration protocol may cause conflicts with other terminals coupled to the local network that may use the same configuration options as the data management system.

Therefore, there is still a need for a data management system, coupled to a local area network provided with a network termination equipment itself coupled to an external network, the data management system being accessible by a network. terminal connected indifferently to the local network or the external network, without requiring a prior configuration step by a user of the network termination equipment.

An object of the invention is to provide efficient data management means, coupled to a local area network provided with a network termination equipment itself coupled to an external network, the data management system being accessible through a terminal connected indifferently to the local network or to the external network, without requiring a prior configuration step by a user of the network termination equipment. Another object of the invention is to provide efficient means of data management, ensuring a high level of security, in particular by guaranteeing access to the data to authorized users only. Another object of the invention is to allow the use of reliable, inexpensive and widely used means, without requiring the use of infrequent protocols or specific or dedicated technical infrastructure. Another object of the invention is to allow access to data by a user, when the latter is in a mobility situation.

One or more of these objects are filled by the method and system according to the independent claims. The dependent claims further provide solutions to these objects and / or other advantages.

More particularly, according to a first aspect, the invention relates to a method for transmitting, a first set of data accessible by a management module on a first communication network, to an access module coupled to a second communication network. . The first communication network and the second communication network are coupled via a third communication network. A communication module is coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module. The method comprises:

A first step during which a first request, transmitted by the communication module and generated by the access module, is received by the management module, the first request containing information enabling the management module to determine that the access module requests access to the first set of data;

A second step in which the first set of data is stored in a location on the third network described by a first address;

A third step during which the management module transmits a first response to the communication module for the access module; the first response containing the first address.

Advantageously, during the second step, the management module can transmit the first set of data to a storage module coupled to the third communication network. The location on the third network described by the first address can then be determined by the storage module, the first set of data then being stored by the storage module at the location on the third network described by the first address, the first address then being transmitted by the storage module to the management module.

In one embodiment, during the second step, the management module transmits the first set of data to the storage module in an encrypted form capable of guaranteeing access to the data of the first set only to the entities having knowledge of at least one first security element, the first data set in its encrypted form then being stored by the storage module at the location on the third network described by the first address. The security element is for example a password, a certificate or any cryptographic element adapted to allow encrypting the first set of data.

The management module can transmit the first set of data to the storage module, via a secure communication channel, for example using the HTTPS secure hypertext transfer protocol.

Advantageously, the storage module can erase the first set of data at the location on the third network described by the first address, after a predetermined lapse of time after storing the first set of data at the location described by the first set of data. first address. In one embodiment, the third step is implemented only if a user at the origin of the transmission of the first request has been previously authenticated and / or has rights necessary and sufficient to access the first set of data. An authentication method using authentication tokens, more generally designated by the Anglo-Saxon term "token", can be used for this purpose.

The invention relates to a management module, and optionally a storage module, adapted to implement the method according to the first aspect.

According to a second aspect, the invention relates to a method for receiving, on an access module coupled to a second communication network, a first set of data accessible by a module of management on a first communication network. The first communication network and the second communication network are coupled via a third communication network. A communication module is coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module. The method comprises:

A first step during which the access module transmits, to the communication module, a first request to the management module, comprising information indicating that the access module requests access to the first set of data;

A second step during which the access module receives a first response, transmitted by the communication module and generated by the management module in response to the first request, the first response comprising a first address designating a location on the third communication network where the first set of data is stored; the first set of data then being obtained by the access module by means of the first address.

During the second step, the access module can obtain the first set of data by transmitting a request to download the first set of data to a storage module coupled to the third communication network, the download request comprising the first set of data. address, the location on the third network described by the first address is then used by the storage module to access the first set of data, the first set of data then being transmitted by the storage module to the access module.

The invention also relates to an access module and optionally a storage module, adapted to implement the method according to the second aspect.

According to a third aspect, the invention relates to an interconnection method, by a communication module coupled to a third communication network, capable of allowing reception, on an access module coupled to a second communication network, a first set of data accessible by a management module on a first communication network. The first communication network and the second communication network are coupled via the third network of communication. communication. The communication module is configured to allow the establishment of a bidirectional communication channel between the management module and the access module. The method comprises:

A first step of transmitting, to the management module, a first request, issued by the access module and comprising information indicating that the access module requests access to the first set of data;

A second step of transmitting, to the access module, a first response, sent by the management module in response to the first request, the first response comprising a first address designating a location on the third communication network where the first set of data is stored.

The invention also relates to a communication module adapted to implement the method according to the third aspect.

According to a fourth aspect, the invention relates to a method for receiving a second set of data accessible by an access module on a second communication network, on a management module coupled to a first communication network, the first network. communication network and the second communication network are coupled via a third communication network. A communication module is coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module. The method comprises:

A first step during which the management module receives a second request, transmitted by the communication module and generated by the access module, the second request comprising a second address designating a location on the third communication network where the second set of data is stored; the second set of data then being obtained by the management module by means of the second address.

Advantageously, during the first step, the management module can obtain the second set of data by transmitting a request to download the second set of data to a storage module coupled to the third communication network, the download request comprising second address, the location on the third network described by the second address being then used by the storage module for accessing the second set of data, the second set of data then being transmitted by the storage module to the access module.

The invention also relates to a management module, and optionally a storage module, adapted to implement the method according to the fourth aspect.

According to a fifth aspect, the invention relates to a method for transmitting a second set of data accessible by an access module on a second communication network, to a management module coupled to a first communication network. The first communication network and the second communication network are coupled via a third communication network. A communication module is coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module. The method comprises:

A first step in which the second set of data is stored in a location on the third network described by a second address;

A second step during which the access module transmits, to the communication module, a second request to the management module, comprising the second address and information indicating that the access module wishes to transmit the second set data to the management module.

Advantageously, during the first step, the access module can transmit the second set of data to a storage module coupled to the third communication network. The location on the third network described by the second address can then be determined by the storage module, the second set of data then being stored by the storage module at the location on the third network described by the second address, the second address is then transmitted by the storage module to the access module.

In one embodiment, during the first step, the access module transmits the second set of data to the storage module in an encrypted form capable of guaranteeing access to the data of the second set only to the entities having knowledge of the second set of data. 'at least one second security element, the second set of data in its encrypted form then being stored by the storage module at the location on the third network described by the second address. The security element is for example a password, a certificate or any cryptographic element adapted to allow encrypting the first set of data.

The access module can transmit the second set of data to the storage module, via a secure communication channel, for example using the HTTPS secure hypertext transfer protocol.

Advantageously, the storage module can erase the second set of data at the location on the third network described by the second address, after a predetermined period of time after storing the second set of data at the location described by the second set of data. second address.

In one embodiment, the second step is implemented only if a user at the origin of the transmission of the second request has been previously authenticated and / or has rights necessary and sufficient to request the transfer of the second set of data. to the management module. An authentication method using authentication tokens, more generally designated by the Anglo-Saxon term "token", can be used for this purpose.

The invention also relates to an access module, and optionally a storage module, adapted to implement the method according to the fifth aspect.

According to a sixth aspect, the invention relates to an interconnection method, by a communication module coupled to a third communication network, able to allow the reception, on a management module coupled to a first communication network, of a communication module. a second set of data accessible by an access module on a second communication network. The first communication network and the second communication network are coupled via the third communication network, the communication module being configured to enable the establishment of a bidirectional communication channel between the management module and the communication module. 'access. The method comprises: A first step of transmitting, to the management module, a second request, sent by the access module destined for the management module, the second request comprising the second address and information indicating that the access module wishes to transmit the second set of data to the management module.

The invention also relates to a communication module adapted to implement the method according to the sixth aspect.

According to a seventh aspect, the invention relates to a computer program comprising instructions for carrying out the steps of the method according to the first aspect, according to the second aspect, according to the third aspect, according to the fourth aspect, according to the fifth aspect, or according to the sixth aspect, when said program is executed by a processor.

Each of these programs can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any form what other form is desirable. In particular, it is possible to use scripting languages, such as in particular tel, javascript, python, perl that allow "on demand" code generation and do not require significant overhead for their generation or modification.

According to an eighth aspect, the invention relates to a computer-readable recording medium on which is recorded a computer program comprising instructions for executing the steps of the method according to the first aspect, according to the second aspect, according to the third aspect, according to the fourth aspect, according to the fifth aspect, or according to the sixth aspect.

The information carrier may be any entity or any device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a diskette or a hard disk. On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed by an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet or Intranet network. Alternatively, the information carrier may be an integrated circuit in which program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

According to a ninth aspect, the invention also relates to a system comprising:

at least one management module according to the first and / or fourth aspect, coupled to a first communication network;

at least one access module according to the second and / or fifth aspect, coupled to a second communication network;

at least one communication module according to the third and / or sixth aspect, coupled to a third communication network;

at least one storage module, according to the first and / or second aspect, coupled to the third communication network.

Brief description of the figures

Other features and advantages of the present invention will become apparent from the following description of embodiments with reference to the accompanying drawings, in which:

FIG. 1 is an architecture diagram of a system for remote access to data, according to one embodiment of the invention;

Figure 2 is a diagram of a management module according to one embodiment of the invention;

Figure 3 is a diagram of an access module according to one embodiment of the invention;

FIG. 4 is a block diagram of the steps of a method of access to data by an access module, according to one embodiment;

Figure 5 is a block diagram of the steps of a data backup method, accessible from the computer access module, according to one embodiment;

FIG. 6a is a block diagram of the steps of a method of authenticating a user with the management module, according to one embodiment;

FIG. 6b is a block diagram of the steps of a service request method, formulated by an authenticated user, with the management module, according to one embodiment. detailed description

Figure 1 is an architecture diagram of a remote access system to data, according to one embodiment of the invention. The system comprises a management module 12, a communication module 14, a storage module 16, and at least one access module 18, 20, 22.

As illustrated in FIG. 2, the management module 12 comprises a processing device 32 equipped with a central computing unit (more generally designated by the acronym "CPU" for "Central Processing Unit") and memories. vives (more generally referred to by the English acronym

"RAM" for "Random-Access Memory"). The management module 12 is adapted to execute a set of instructions forming a software, in order to implement the steps of the method to be executed by the management module 12 and described hereinafter with reference to FIGS. 4, 5 and 6a. and 6b. The management module 12 further comprises a communication interface 34, coupled to the processing device 32, adapted to allow access to a local area network Rd of communication. The local network Rd is interconnected to a network 10 so as to allow the management module 12 to exchange data with the devices coupled to the local network Rd or the communication network 10. For example, the local network Rd is a home network, interconnected via network termination equipment (not shown in the figures), to the Internet. The management module 12 also includes storage means 36, for example a hard disk and / or an electronic disk (more generally designated by the acronym "SSD" for "solid-state drive"). The storage means 36 make it possible to store data and to authorize the access module to read and / or write said data. The management module 12 can be implemented on a standalone device. Alternatively, the management module 12 can be implemented on a device having other functionalities, for example a home application server, a network termination equipment or a computer. Said at least one access module can be a mobile device access module 18, a v, or a web browser access module 22. The system can comprise several modules, each access module can be one of the three types presented above. As illustrated in FIG. 3, the access module comprises a processing device 42 equipped with a central computing unit (more generally designated by the acronym "CPU" for "Central Processing Unit") and memories. vives (more generally referred to by the acronym "RAM" for "Random-Access Memory"). The access module is adapted for executing a set of instructions forming a software, in order to implement the steps of the method to be performed by the access module and described below with reference to Figures 4, 5, 6a and 6b. The access module includes storage means 44, for example a hard disk and / or an electronic disk (more generally designated by the acronym "SSD" for "solid-state drive"). The storage means 44 can store data and allow the access module to read and / or write said data. The access module also comprises a communication interface 46, coupled to the processing device 42, adapted to allow access to an external REXT communication network. The external REXT network is interconnected to the network 10 so as to allow the access module to exchange data with the devices coupled to the local network R _d or the communication network 10. The external REXT network may be a network accessible to a user in a mobility situation, typically via wireless access, and interconnected to the Internet. The access module also comprises a user interface 48, provided for example with input and display means. The communication interface 46 may also be adapted to allow access to the local network R _d , so that the access module can be used in a mobility situation but also in a local situation. The mobile device access module 18 can be implemented on a device of the mobile phone or tablet type, provided with an application adapted to implement the steps of the method to be executed by the access module and described herein. - next with reference to Figures 4, 5, 6a and 6b. The computer access module 20 can be implemented on a device of the desktop or laptop type, provided with an application adapted to implement the steps of the method to be executed by the access module and described hereinafter with reference to FIGS. 4, 5, 6a and 6b. The web browser access module 22 can be implemented on any device adapted to execute a Web browser, and provided with a Web application adapted to implement the steps of the method to be executed by the access module and described below with reference to Figures 4, 5, 6a and 6b.

The storage module 16 is coupled to the communication network 10. The storage module 16 is configured to receive data from terminals connected to the network 10, for storing said data and for transmitting to the terminals connected to the network 10 said data. The storage module 16 is for example a file server coupled to the Internet. In particular, the storage module 16 is accessible by the mobile device access module 18, by the computer access module 20, and by the web browser access module 22, when the access module is coupled to the local network R _d Or to the external network REXT.

The communication module 14 is coupled to the communication network 10. The communication module 14 is configured to allow bidirectional exchange, via the communication network 10, of requests and / or data between the management module 12, the storage module 16, and the module (s). s) access 18, 20, 22. In particular, the communication module 14 is configured to establish bidirectional communication channels (or "full-duplex" in English) in connected mode using the transmission control protocol - more generally designated by the acronym "TCP" for "Transmission Control Protocol", suitable for browsers and Web servers. More particularly, the communication module 14 is configured to enable the implementation of the Web standard protocol WebSocket designating an application layer network protocol and a programming interface of the World Wide Web. The WebSocket protocol is described in particular in the document Request For Comments 6455 (http://tools.ietf.org/html/rfc6455). The use of the communication module implementing the WebSocket protocol makes it possible, in particular, to exchange messages between the entities of the access system according to the invention in a bidirectional manner, without the need for a prior request to be made. has been issued by one of the system entities so that another system entity has the right to send a message to it: thus all entities in the system can send a request directly to the other entities.

The communication channels used to exchange information between on the one hand the management module 12, the storage module 16, and the access module (s) 18, 20, 22 and on the other hand the module communication 14 can be secured, for example by using the HTTPS protocol. In addition, the messages exchanged between the management module 12, the storage module 16, the access module (s) 18, 20, 22 and the communication module 14 may be in a structured data format, for example. for example the JSON format (of the English "Javascript Object Notation"), described in particular in the document Request For Comments 7159. Each access module 18, 20, 22 is configured to access the communication module 14 and, by the intermediate of the latter, to exchange messages with the management module 12, the storage module 16, and optionally with the other access modules 18, 20, 22.

As an alternative to the WebSocket protocol, the communication module 14 can be configured to use an active waiting method, more generally referred to by the English term "polling": the communication module 14 can send to each entity of the system according to the invention, at regular intervals, an HTTP request and immediately receive a response. The latter is subsequently used by the communication module 14 to transfer a message, as soon as said entity sends to the communication module 14 a request.

As an alternative to the WebSocket protocol, the communication module 14 can be configured to use a broadcasting method, more generally referred to by the Anglo-Saxon term "streaming": Each access module 18, 20, 22 sends a complete request to the module 14. The latter returns and maintains an open response, updated continuously. The communication module 14 can then respond to said access module 18, 20, 22 with a message, without closing the response, so that the connection between the communication module 14 and the access module remains open, for future exchanges.

The steps of the method described below with reference to FIGS. 4, 5, 6a and 6b can be implemented in software by the execution of a set of instructions or a program by a programmable processing device, such as a personal computer, a signal processing processor and / or a microcontroller; or alternatively in a material manner by a machine or a dedicated component, such as a programmable logic circuit - for example of the type commonly designated by the acronym "FPGA" for "Field Programmable Gate Array", or an integrated circuit specific to an application more commonly referred to by the acronym "ASIC" for "Application-Specific Integrated Circuit".

Referring to Figure 6a, a method of authenticating a user to the management module 12, according to one embodiment, will now be described. The following example describes the case where a user wishes to authenticate with the management module 12, using the web browser access module 22. The authentication method could be implemented by the user. using the mobile device access module 18 or the computer access module 20.

In a first step 310, after input by the user, AUTH authentication information, able to enable the authentication of the user by the management module 12, is received by the access module for web browser 22. AUTH authentication information is for example an identifier and a password. The web browser access module 22 then transmits, to the communication module 14, a RAUTH request to the management module 12 to authenticate the user. The request R1 comprises for example the following elements:

· AUTH authentication information

An identification element to make it possible to determine from the sender of the request, in this case the web browser access module 22;

• a description of the actions requested by the issuer, in this case to authenticate the user.

In a second step 320, after receiving the RAUTH request, the communication module 14 transmits the RAUTH request to the management module 12.

In a third step 330, after receiving the RAUTH request transmitted by the communication module 14, the management module 12 checks the validity of the authentication information AUTH. For example, the management module 12 may ensure that the AUTH authentication information received corresponds to that of one of the users of a list of users authorized to access the management module 12.

During the third step 330, if the AUTH authentication information is considered valid by the management module 1 2, the latter generates a TOK authentication token, specific to the user, more generally designated by the term Anglo -saxon "token". The security token is used to prove an identity electronically (such as a customer trying to access his bank account). The management module 1 2 then transmits, to the communication module 14, a RPAUTH response to the web browser access module 22. The response RPAUTH comprises for example the following elements:

• the TOK authentication token;

· Information indicating that the user authentication has been successful.

During the third step 330, if the authentication information AUTH is not considered valid by the management module 1 2, the latter then transmits, to the communication module 14, a RPAUTH response to the access module for web browser 22. The response RPAUTH comprises for example the following elements:

• the TOK authentication token; • information indicating that user authentication has failed.

In a fourth step 340, after receiving the RPAUTH response, the communication module 14 transmits the RPAUTH response to the web browser access module 22.

In a fifth step 350, after receiving the RPAUTH response transmitted by the communication module 14, the web browser access module 22 records, for later use, the TOK authentication token included in the response RP2, and can display and / or record the information of the success of the authentication, or display, if necessary, an error message indicating that the authentication has failed.

Referring to Figure 6b, a service request method, formulated by an authenticated user, to the management module 12, according to one embodiment, will now be described. The following example describes the case where a user has previously been authenticated, for example following the implementation of the method illustrated in FIG. 6a. The service request method could be implemented by the user using the mobile device access module 18 or the computer access module 20.

In a first step 360, the access module for web browser 22 transmits, to the communication module 14, a request R3 to the management module 12 to request a service. In the following example, the service corresponds to a request to obtain a list of images accessible via the management module 12. The request R3 comprises for example the following elements:

• the TOK authentication token;

• a description of the actions requested by the issuer, in this case obtain a list of images accessible via the management module 12.

In a second step 370, after receiving the request R3, the communication module 14 transmits the request R3 to the management module 12.

In a third step 380, after receiving the request R3 transmitted by the communication module 14, the management module 12 verifies the validity of the TOK authentication token. For example, the management module 12 can ensure that the authentication token TOK corresponds to a token it has previously generated, and / or if the TOK authentication token is still valid.

During the third step 380, if the authentication token TOK is considered valid by the management module 12, the latter executes the actions requested in the request R3, in this example, determine a list of accessible images. The management module 12 then transmits, to the communication module 14, a response RP3 to the web browser access module 22. The response RP3 includes the list of accessible images.

During the third step 380, if the authentication token TOK is not considered valid by the management module 12, the management module 12 then transmits, to the communication module 14, a response RP3 to the module The response RP3 includes information that the requested actions can not be performed because the user has not been authenticated.

In a fourth step 390, after receiving the response RP3, the communication module 14 transmits the response RP3 to the web browser access module 22.

In a fifth step 350, after receiving the response RP3 transmitted by the communication module 14, the web browser access module 22 can display and / or save the list of accessible images or display, where appropriate the message indicating that the requested actions can not be performed because the user has not been authenticated.

With reference to FIG. 4, a method of accessing data by an access module, according to one embodiment, will now be described. The data can be of various kinds, for example images, documents, videos, etc. The data can be accessed by the management module 12. The data may for example be stored on storage means, coupled to the local network Rd, to which the management module 12 can access. The following example describes the case where a user wishes to access an F1 file, accessible by the management module 12, using the mobile device access module 18. The method could be applied indifferently to the module of the device. computer access 20 or the web browser access module 22.

In a first step 1 10, the access module for mobile device 18 transmits, to the communication module 14, a request R1 to destination of the management module 12 to obtain the file F1. The request R1 comprises for example the following elements:

An identification element to make it possible to determine from the transmitter of the request, in this case the access module for mobile device 18;

• a description of the resource to which the sender of the request wishes to access, for example the name of the file F1;

• a description of the actions requested by the issuer, in this case obtain the F1 file.

In a second step 120, the communication module 14 transmits the request R1 to the management module 12.

In a third step 130, the management module 12 receives the request R1 and transfers the file F1 to the storage module 16. Advantageously, to improve the security level, the management module 12 can encrypt the file F1 before the to transmit to the storage module 16. Thus the F1 file arrives on the storage module in encrypted form and is stored as well. In addition, the management module 12 can still use a secure communication channel to the storage module 16, for example by transferring the file F1 using the HTTPS protocol.

In a fourth step 140, after receiving the file F1, the storage module 16 determines an address A1, for example a URL address, by means of which the terminals connected to the communication network 10 can reach the location on the module. storage 16 where the F1 file is stored. The storage module 16 then transmits said address A1 to the management module 12.

In a fifth step 150, after the end of the transmission of the file F1 to the storage module 16, the management module 12 transmits a response RP1 to the communication module 14 to the access module for the mobile device 18. The response RP1 for example includes the following elements:

The A1 address of the file F1 on the storage module 16;

Security elements making it possible to decrypt the file F1, if the file F1 has been transmitted by the management module 12 in encrypted form to the storage module 16.

In a sixth step 160, the management module 12 receives the response RP1, then transmits the response RP1 to the mobile device access module 18. In a seventh step 170, the mobile device access module 18 receives the response RP1. After extraction of the address A1 from the response RP1, the mobile device access module 18 downloads the file F1 to the address A1, on the storage module 16. For this, the management module 12 can send, at the storage module 16, a request to download the F1 file with I address A1. Once downloaded, if the file F1 is in encrypted form, the mobile device access module 18 can decrypt the file F1 using the security elements received in the response RP1. The F1 file can then be saved or displayed.

Advantageously, once the F1 file downloaded by the mobile device access module 18, the storage module 16 can store the file F1 for a predetermined period - typically a few minutes - during which the file F1 could be downloaded again , then automatically deleted. Thus, the storage module erases the F1 file at the address F1, after having passed a predetermined lapse of time - typically a few minutes - after the completion of the fourth step 140.

In one embodiment, the data access method described in FIG. 4 requires the prior authentication of the user of the mobile device access module 18 to download the file F1. For this, the method of authenticating a user with the management module 12, described in Figure 6a, can be used, after which the user has a TOK authentication token. The service request method, illustrated in FIG. 6b, can then be implemented, the service then corresponding to the access to the file F1. In particular, the request R1 will still include the authentication token TOK, and the third step 130, fourth step 140, and fifth step 150 are executed only if the management module considers the TOK authentication token received in the request R1 as valid. In addition, the data access method may also require that the user of the access module has rights necessary and sufficient to download the file F1.

With reference to FIG. 5, a data backup method accessible from the computer access module 20, according to one embodiment, will now be described. The data can be of various kinds, for example images, documents, videos, etc. The data can be accessed by the computer access module 20. The data can be for example stored on the storage means 44 of the computer access module 20. The following example describes the case where a user wishes to save an F2 file, using the computer access module 20. The method could be applied indifferently using the module. mobile device access port 20 or the web browser access module 22.

In a first step 210, the computer access module 20 transmits the file F2 to the storage module 16. Advantageously, in order to improve the security level, the access module 12 can encrypt the file F2 before transmitting it. to the storage module 16. Thus the file F2 arrives on the storage module in encrypted form and is stored as well. In addition, the computer access module 20 can still use a secure communication channel to the storage module 16, for example by transferring the file F2 using the HTTPS protocol.

In a second step 220, after receiving the file F2, the storage module 16 determines an address A2, for example an address

URL, with which the terminals connected to the communication network 10 can reach the location on the storage module 16 where the file F2 is stored. The storage module 16 then transmits said address A2 to the computer access module 20.

In a third step 230, the computer access module

20 receives the address A2 and transmits to the communication module 14, a request R2 to the management module 12 to save the file F2. The request R2 comprises for example the following elements:

An identification element to make it possible to determine from the sender of the request, in this case the computer access module 20;

• address A2;

• a description of the actions requested by the issuer, in this case save the file F2.

In a fourth step 240, after receiving the request R2, the communication module 14 transmits the request R2 to the management module 12.

In a fifth step 250, the management module 12 receives the request R2. After extraction of the address A2 from the request R2, the management module 12 downloads the file F2 from the address A2, on the storage module 16. For this, the management module 12 can send to the storage module 16 , a request to download the file F2 with I address A2. Once downloaded, the file F2 can then be saved by the management module 12, for example by using backup means and / or storage connected to the local network RD. If the file F2 has been encrypted, the management module 12 can save the file F2 in an encrypted form. If the file F2 has not been previously encrypted, the management module 12 can save the file F2 in an encrypted form.

Advantageously, once the file F2 downloaded by the management module 12, the storage module 16 can store the file F2 for a predetermined period - typically a few minutes - during which the file F2 could be downloaded again, then automatically deleted .

During the fifth step 250, after the end of the backup of the file F2, the management module 12 transmits a response RP2 to the communication module 14 to the computer access module 20. The response RP2 comprises for example a confirmation that the F2 file has been successfully saved or, if so, an error message if the backup operation failed.

In a sixth step 260, the communication module 14 receives the response RP2, then transmits the response RP2 to the computer access module 20.

In a seventh step 270, the computer access module 20 receives the response RP2, and can display and / or record the success information of the backup of the file F2 or display, where appropriate the error message.

In one embodiment, the data backup method requires the prior authentication of the user of the computer access module 20 to save the file F2. For this, the method of authenticating a user with the management module 12, described in Figure 6a, can be used, after which the user has a TOK authentication token. The service request method, illustrated in FIG. 6b, can then be implemented, the service then corresponding to the backup of the file F2. In particular, the request R2 will still include the TOK authentication token, and the third step 230, fourth step 240, and fifth step 250 are executed only if the management module considers the TOK authentication token received in the request R2 as valid.

Claims

1. A method for transmitting a first set of data accessible by a management module (12) on a first communication network (R _D ) to an access module (18, 20, 22) coupled to a second communication network ( REXT), the first communication network and the second communication network being coupled via a third communication network (1 0), a communication module (14) being coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module, characterized in that it comprises:

A first step (130) during which a first request (R1), transmitted by the communication module and generated by the access module, is received by the management module, the first request comprising information enabling the module management to determine that the access module requests access to the first set of data;

A second step (140, 1 50) during which the first set of data is stored in a location on the third network described by a first address (A1);

A third step (1 60) during which the management module transmits a first response to the communication module intended for the access module; the first response containing the first address.

The method of claim 1, wherein, in the second step, the management module transmits the first set of data to a storage module (16) coupled to the third communication network (10), the location on the third network described by the first address is then determined by the storage module (1 6), the first set of data then being stored by the storage module (1 6) at the location on the third network described by the first address, the first address then being transmitted by the storage module to the management module.

3. The method as claimed in claim 2, in which, during the second step, the management module transmits the first set of data to the storage module (1 6) in an encrypted form able to guarantee access to the data of the data store. first set to only entities having knowledge of at least a first security element, the first data set in its encrypted form then being stored by the storage module (16) at the location on the third network described by the first address .

4. The method of claim 2 or 3, wherein during the second step, the management module transmits the first set of data to the storage module (16), via a secure communication channel.

The method of any one of claims 2 to 4, wherein the storage module erases the first set of data at the location on the third network described by the first address, after a predetermined period of time after the first set of data. storing the first set of data at the location described by the first address.

The method according to any one of claims 1 to 5, wherein the third step (1 60) is implemented only if

a user at the origin of the transmission of the first request (R1) has been previously authenticated and / or has rights necessary and sufficient to access the first set of data.

7. Method for receiving, on an access module (18, 20, 22) coupled to a second communication network (REXT), a first set of data accessible by a management module (12) on a first communication network (R _D ), the first communication network and the second communication network being coupled via a third communication network (1 0), a communication module (14) being coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module, characterized in that it comprises: a first step (1 1 0) during which the access module transmits, to the communication module, a first request (R1) to the management module, comprising information indicating that the access module requests a access to the first set of data;

a second step (1 70) during which the access module receives a first response (RP1), transmitted by the communication module and generated by the management module in response to the first request, the first response comprising a first an address (A1) designating a location on the third communication network where the first set of data is stored; the first set of data then being obtained by the access module by means of the first address.

The method of claim 7, wherein, in the second step, the access module obtains the first set of data by transmitting a request to download the first set of data to a storage module (16) coupled to the first set of data. third communication network (1 0), the download request comprising the first address, the location on the third network described by the first address then being used by the storage module (1 6) to access the first set of data, the first set of data is then transmitted by the storage module to the access module.

9. Interconnection method, by a communication module (14) coupled to a third communication network (1 0), able to allow reception, on an access module (1 8, 20, 22) coupled to a second communication network (REXT), a first set of data accessible by a management module (12) on a first communication network (R _D ), the first communication network and the second communication network being coupled by intermediate of the third communication network (1 0), the communication module (14) being configured to allow the establishment of a bidirectional communication channel between the management module and the access module, characterized in that it comprises :

A first step (120) of transmission, to the management module, of a first request (R1), issued by the access module and with information indicating that the access module requests access to the first set of data;

A second step (160) of transmission, to the access module, of a first response (RP1) sent by the management module in response to the first request, the first response comprising a first address (A1) designating a location on the third communication network where the first set of data is stored.

A method for receiving a second set of data accessible by an access module (1 8, 20, 22) on a second communication network (REXT), on a management module (12) coupled to a first network of communication (R _D ), the first communication network and the second communication network being coupled via a third communication network (1 0), a communication module (14) being coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module, characterized in that it comprises:

A first step (250) during which the management module receives a second request (R2), transmitted by the communication module and generated by the access module, the second request comprising a second address (A2) designating a location on the third communication network where the second data set is stored; the second set of data then being obtained by the management module by means of the second address.

1 1. A method for transmitting a second set of data accessible by an access module (18, 20, 22) on a second communication network (REXT), to a management module (18, 20, 22) coupled to a first network of communication (R _D ), the first communication network and the second communication network being coupled via a third communication network (10), a communication module (14) being coupled to the third communication network and configured to enable the establishment of a bidirectional communication channel between the management module and the access module, characterized in that it comprises: A first step (21 0) during which the second set of data is stored in a location on the third network described by a second address (A2);

A second step (230) during which the access module transmits, to the communication module, a second request (R2) destined for the management module, comprising the second address and information indicating that the module access wishes to transmit the second set of data to the management module.

1 2. Interconnection method, by a communication module (14) coupled to a third communication network (1 0), able to allow reception, on a management module (1 2) coupled to a first communication network (R _D ), a second set of data accessible by an access module (1 8, 20, 22) on a second communication network (REXT), the first communication network and the second communication network being coupled via the third communication network (1 0), the communication module (14) being configured to allow the establishment of a bidirectional communication channel between the management module and the access module, characterized in that that it comprises:

A first step (240) for transmitting, to the management module, a second request (R2) sent by the access module destined for the management module, the second request comprising the second address and information indicating that the access module wishes to transmit the second set of data to the management module.

1 3. System comprising:

at least one management module, coupled to a first communication network (R _D ), adapted to allow the implementation of the steps of the methods according to claims 1 to 6 and / or 10;

at least one access module, coupled to a second communication network (REXT), adapted to allow the implementation of the steps of the methods according to any one of claims 7 to 8 and / or 1 1; at least one communication module, coupled to a third communication network (10), adapted to allow the implementation of the steps of the methods according to claims 9 and / or 12;

at least one storage module (16), coupled to the third communication network, adapted to allow the implementation of the steps of the methods according to claims 2 to 6 and / or 8.

14. A computer program comprising instructions for executing the steps of one of the methods according to any of claims 1 to 12, when said program is executed by a processor.

15. A computer-readable recording medium on which is recorded a computer program comprising instructions for executing the steps of the methods according to any one of claims 1 to 12.