Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F17/00—Coin-freed apparatus for hiring articles; Coin-freed facilities or services
  • G07F17/0014—Coin-freed apparatus for hiring articles; Coin-freed facilities or services for vending, access and use of specific services not covered anywhere else in G07F17/00
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/08—Payment architectures
  • G06Q20/12—Payment architectures specially adapted for electronic shopping systems
  • G06Q20/123—Shopping for digital content
  • G06Q20/1235—Shopping for digital content with control of digital rights management [DRM]
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/346—Cards serving only as information carrier of service
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/351—Virtual cards
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/355—Personalisation of cards for use
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/38—Payment protocols; Details thereof
  • G06Q20/385—Payment protocols; Details thereof using an alias or single-use codes
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
  • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
  • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/76—Proxy, i.e. using intermediary entity to perform cryptographic operations
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless

Definitions

• the present invention generally relates to the authentication domain on a data transmission network and relates, in particular, to a method of accessing a service on a data transmission network, via a connected user terminal. to the network.
• a service may designate any exchange of information, via a digital data transmission network or telecommunication network between two or more users, or between a user and a service provider.
• the present invention aims to provide a robust authentication system, very flexible to implement, and can be implemented on inexpensive user terminals with limited computing resources, for access to services, including services voice over IP, on a data transmission network.
• the subject of the invention is a method of accessing a service on a data transmission network, via a user terminal connected to said network, characterized in that it comprises a phase for subscribing to said service where: an information container associated with the user is generated, comprising a first set of authentication data of the access to the service and a second set of useful data relating to said user and access rights to said service, said first and second sets of data being encrypted, and wherein said container is transmitted securely on said user terminal, and access to said service where: said container is transmitted securely from said user terminal to at least one management server connected to the network during a request for access to said service, and where the server verifies, after decryption of the constituent data of said container, the validity of said first set of authentication data and, if successful verification, authorizes access to the service for its execution according to said access rights of the second set of data.
• the subscription phase to the service includes the payment of said service by the user to a payment server.
• the subscription phase further comprises the provision of a one-time password by the payment server to the user, the transmission of the password of the user terminal to the management server, triggering securely transmitting the container from said server to said terminal.
• a step of updating the useful data of the container relating to the access rights to the service is implemented. server-side, said updated data being saved on the management server side.
• the first and second sets of data of the container are encrypted on the server side, then the said updated container is transmitted securely from the management server to the user terminal for an access phase. at the later service.
• the secure transmission of the container consists in transmitting in encrypted form the constituent data of said container by applying a symmetric encryption algorithm using a secret key shared by the user terminal and by the server.
• the secret key implemented is renewed by configurable period.
• the renewal of the secret key consists in transmitting a new key at the same time as the container during its secure transmission from the server to the user terminal for a subsequent service access phase.
• the symmetric encryption algorithm implemented at the terminal and server side is of the RC4 type.
• the encryption of the first and second sets of constituent data of the container before their secure transmission is obtained by applying to said data of a public key encryption algorithm, the corresponding private key being stored only on the server side.
• the first set of authentication data is represented by hashing function collisions.
• the server-side verification step consists in checking that the authentication data actually form hashing function collisions.
• the verification step consists in checking the correspondence of the authentication data from the container with authentication data referenced in a user database for this user.
• a service cost billing element is generated at the server after execution of said service, from the payload data of the container relating to the service access rights for the user, the authentication data being associated with said service. billing item generated as evidence that access to that service has been authorized.
• the billing element is stored for use for subsequent financial compensation.
• the service accessed is a voice over IP service.
• the transmission of the container from the user terminal to the server or from the server to the user terminal for access to the service is integrated into a protocol allowing voice over IP transmissions, for example the SIP protocol.
• the transmission of the container from the user terminal to the management server during a phase of access to a service is performed via an intermediate gateway of the network, said gateway implementing a preliminary verification step of the validity of the container before routing it to said server.
• the preliminary verification step of the validity of the container consists in checking the validity of a third set of authentication data of said container.
• the invention also relates to a server connected to a data transmission network, for accessing a service via a user terminal connected to said network, characterized in that it comprises means for implementing process steps as just described.
• FIG. 1 schematically illustrates an exemplary network architecture in which the invention can be described
• FIG. 2 illustrates, according to a preferred exemplary embodiment, the steps implemented when registering a user with a service on a data transmission network
• FIG. 3 illustrates a possible model for the structure of a secure container bearing the information necessary for accessing and performing the service on the network
• FIG 4 illustrates steps of obtaining the secure container by the terminal following the subscription to the service for access to it;
• FIG. 5 is a block diagram illustrating a sequence of steps implemented on the server side during access to the service.
• the invention therefore relates to a method of accessing a service on a data transmission network.
• Access to the service is preferably performed via a user terminal 30 connected to an access network RA coupled by a PA gateway to the data transmission network, typically the Internet network and generally with its couplings to other autonomous networks, such as the PSTN public switched telephone network.
• the access network can be either a wireless local area network, for example a Wifi network, a public or private network operating with the IP protocol or with a protocol other than IP, a public or private switched telephone network.
• the service subscribed by the user may be an IP telephony service, video telephony or a download service for digital files, for example music files type MP3.
• IP telephony service for example IP telephony service
• video telephony for example video files type MP3.
• download service for digital files
• music files type MP3 for example music files type MP3.
• FIG 2 illustrates precisely this phase of subscription of the user to the service, which is more particularly materialized by a deed of payment
• the user obtains (b) an activation number of the subscribed service.
• This activation number includes a OTP one-time password and a secret key Ko, the use of which will be explained later.
• the transaction between the user and the payment server is preferably implemented according to a protocol allowing the secure transmission of information, such as the SSL protocol for example.
• the activation number could be transmitted to the user by any other suitable means, for example by mail, a call to an interactive voice response system or via a card to scratch.
• a secure container is an encrypted numerical value representative of various information associated with a user subscribed to a service and, in particular, access rights to this service. It allows this information to pass between different nodes of the network in a secure manner without the need to provide for the implementation of a channel figure.
• the container also allows its owner, in this case a user terminal, to be authorized to access a service on the network according to the access rights to this service as they were defined at the time of subscription in the service and stored in digital form in the secure container.
• FIG. 3 illustrates an exemplary structure of a TOKEN secure container, which is generated on a network management server during the subscription phase to the service by the user. It comprises a first set of CBF data forming the core of the container, essentially comprising authentication data of access to the XO service, Xl, X2 and X3, which form the proof that the access to the service can be authorized for its execution.
• the value and the origin of this first set of authentication data must be easily authenticated and verifiable by the entity authorizing the access and this, of course.
• a TPID field can thus be inserted in this first set of data, representative of the producer entity of the container.
• the authentication data of the access to the service denoted X0, X1, X2 and X3 in the example of FIG. 3, are manufactured according to a method described in FIG. article entitled "PayWord and Micromint - Two Simple Micropayment Schemes" by RL RIVEST and A. SHAMIR and presented on January 26, 1996 at the 1996 RSA conference. manufacturing electronic coins, represented by bit strings whose validity can be verified by anyone, but which are very difficult to produce. In this system, parts are represented by hashing function collisions.
• the container also comprises a second set of useful data PBF, including data relating to the user of the service and rights of access to this service that were defined at the time of subscription to the service by the user.
• PBF useful data
• an RBF field of the container includes data defining the conditions of access to the services, for example indicating whether the user can make local calls and / or national and / or international.
• a UBF field includes value data associated with the service for establishing a billing, for example a number of units representative of the amount of the payment paid by the user when subscribing to the service.
• a TCBF field comprises time data, for example data representative of a communication time. Other critical information could still be inserted in the second set of useful data PBF, such as for example an expiry date of the validity of the container.
• the second payload data set may also include a SID / PN field including user data, such as a subscriber ID number and / or its telephone number.
• the first set of authentication data thus provides the security and integrity functions of the second set of useful data and can be likened to a unique non-forgeable key for authenticating access to a given service.
• the container can thus guarantee, by means of a verification of the first set of authentication data, that access to a given service can be authorized, depending on the access rights defined in the container, and that the latter has already been paid or the user can be charged for this service.
• a public key encryption algorithm E PK for example an RSA type algorithm.
• E PK public key encryption algorithm
• This container thus secured is intended to be stored on the user terminal side, in order to allow the implementation, from this terminal, of a service access phase, which will be implemented at a PA gateway of data transmission network, typically the management server.
• the private key corresponding to the public key implemented as part of the RSA algorithm for the encryption of the constituent data of the container is stored only on the server side.
• the data transmission network must comprise, at the level of each management server involved in a phase of access to the service by the user terminal, a data processing system programmed so as to perform the various steps of the method of the invention.
• This data processing system can be individualized as a separate system from the computer system managing the server, or integrated into the computer system by the addition of integrated software.
• the secure container must first be stored on the user terminal side. This step is described with reference to FIG.
• the server 40 is a server placed in the network in front of a voice over IP VoIP infrastructure and which will transmit all the signaling packets of the call to the next VoIP device of this infrastructure, once the information of a TOKEN container received from a terminal or, alternatively, from another node of the network, as part of an access request VoIP service will have been recovered and verified as explained below.
• the server 40 is for example a SIP proxy server ("Session Initiation Protocol").
• the container and its use in a data transmission network as described in the present description to authenticate access to a given service can also be implemented in the context of a communication protocol between two nodes of the network involved in the access to the service, for example between two servers of the SIP proxy type.
• step c of transmitting the password OPT of the user terminal 30 to the management server 40 is implemented, triggering the secure transmission to step d, of the container TOKEN, itself already secured by heavy RSA type encryption, from the server 40 to the terminal 30.
• the secure transmission of the TOKEN container over the network is ensured by the application of a symmetric encryption algorithm C K 0 / for example of type RC4, with the secret key Ko, provided beforehand to the user and shared by the user. management server.
• Two types of encryption are applied to the container.
• the first set of data of the CBF container is securely linked to the second set of PBF data by heavy RSA type encryption, managed server side.
• the container has a second level of encryption, lighter, type RC4 for its secure transmission through the network.
• this last type of encryption is intended to be implemented on both the server and the terminal side, so as to provide anti-replay properties to the secure container.
• the secret keys used in the secure transmission of the container on the network are changed very often so as to further enhance the security given the light encryption algorithm used.
• the secret keys implemented are thus renewed by configurable period.
• the renewal of the secret key K 0 is carried out by transmitting a new key K1 at the same time as the TOKEN container during its secure transmission of the the
• the server 40 to the user terminal 30.
• the server 40 therefore sends C ⁇ o (TOKEN, K1) to the terminal 30.
• the terminal 30 decrypts the received value using the secret key K 0 which it already has, and thus retrieves the TOKEN container value, always encrypted RSA, and the secret key K1.
• a service access request sent by the terminal 30 consists of transmitting the (C) securely to the container C RI (TOKEN). to the server 40, by application on the terminal side of the algorithm RC4 with the secret key K1 on the container.
• the process steps can advantageously be implemented on user terminals with few available CPU resources.
• the heavy security operations of the container being managed mainly on the management server side, including RSA encryption of the data constituting the container, client-side implementation on the user terminal requires only a simple application that can ensure secure storage of the container on the terminal and the implementation of RC4 encryption, used for the secure transmission of the container.
• step f the server performs a decryption operation of the data received from the terminal. It first decrypts C K i (TOKEN) with the secret key K1 in order to retrieve the TOKEN container whose data is encrypted with RSA. Then, in a second step, it retrieves the first set of authentication data CBF and the second set of user data UBF from the container by the decryption operation RSA with the corresponding private key of which it is the only one to dispose.
• a step of checking the validity of the first set of authentication data XO, X1, X2, X3 is implemented. This step can simply consist in checking that the authentication data X0, X1, X2, X3 actually form hashing function collisions.
• the server 40 authorizes access to the service for its execution according to the access rights to this service referenced in the second set of useful data of the container.
• the service accessed may be a SIP call to an international number, authorized under the RBF / UBF / TCBF values, the signaling packets of this call being then transmitted by the server to the VoIP infrastructure.
• the properties of the container implemented thus provides a great deal of flexibility in managing access to the IP telephony service.
• the container we do not have to go back to a centralized database to identify the user.
• the access rights of the user to access the service can indeed be verified directly from the container without having to go back to a user account defining these rights.
• the server 40 may, however, use a user database.
• the verification can thus consist in verifying the correspondence of the authentication data of the transaction coming from the container with authentication data referenced in a user database for this user.
• Authentication data access to the service may indeed be formed in one variant by a digital fingerprint of the user, having the same security guarantees that the use of hashing function collisions.
• the server can also check in the user database that the useful data RBF, UBF and TCBF from the container actually correspond to the current useful data for access to the service stored for this user in the database.
• a step i of updating the payload data of the container relating to the access rights to the service is implemented, in particular, a step of updating the data RBF, UBF and TCBF. For example, if a prepaid period of 500 minutes had been subscribed by the user, at the end of a 7 minute call session, the initial value 500 of the TCBF field of the payload data of the container is decreased by 7. The updated payloads are then saved to the management server side in the user database.
• a service cost billing element may optionally be generated and stored at the server 40, the content of which is determined from the payload data of the container relating to the service access rights for the user. .
• the variations of the TCBF data, giving the communication time, and UBF for the cost of a communication unit can be memorized to form the billing element.
• the authentication data is also associated with the generated billing item as evidence that access to the service has been authorized.
• the billing element thus stored on the server side 40 can then be used subsequently with a third party organization to obtain financial compensation on the basis of the accumulated data.
• an RSA encryption step of the first set of authentication data CBF and the second set of payload data PBF with the updated data is implemented. In this way, the updated secure container is obtained.
• the updated secure container is transmitted in step k securely to the user terminal 30 for a subsequent service access phase, the secure transmission being provided as previously explained by the application of the RC4 algorithm with Kl.
• the renewal of the secret key Kl is performed during this step, by transmitting a new key K2 which will be used during the subsequent service access phase.
• the new secret key K2 is transmitted together with the updated container TOKEN during the secure transmission of the server 40 to the user terminal 30.
• the server 40 sends thus C ⁇ i (TOKEN, K2) to the terminal 30 .
• the secure transmission of the TOKEN container, whose data are already encrypted, from the user terminal 30 to the management server 40, or from the server to the user terminal, or between two servers of the network, for the implementation of the access the service and its execution, is intended to be integrated in a protocol for voice transmissions over IP, for example the SIP protocol, according to the embodiment described with reference to a subscribed VoIP service.
• a protocol for voice transmissions over IP for example the SIP protocol
• IP for example the SIP protocol
• a header in order to allow the appropriate processing according to the invention of container-carrying packets. This header could for example consist of several fields such as the size of the data, a control number, a session identifier or other control information.
• the TOKEN information container may comprise a third set of authentication data, the role of which will be described below.
• an intermediate gateway of the network is implemented to carry out the transmission of the container of the user terminal to the management server during a phase of access to a service on the network.
• the intermediate gateway is then provided to perform a preliminary verification of the validity of the container before routing it to the management server, consisting of checking the validity of the third set of authentication data of the container.
• the third set of authentication data can be represented by bit strings obtained by hashing function collisions, in the same way as for the first set of data of the container.
• the third data set of the container can also be encrypted using a symmetric key encryption algorithm, type RC4.

Landscapes

• Engineering & Computer Science (AREA)
• Business, Economics & Management (AREA)
• General Physics & Mathematics (AREA)
• Accounting & Taxation (AREA)
• Physics & Mathematics (AREA)
• Computer Networks & Wireless Communication (AREA)
• Theoretical Computer Science (AREA)
• Strategic Management (AREA)
• General Business, Economics & Management (AREA)
• Computer Security & Cryptography (AREA)
• Microelectronics & Electronic Packaging (AREA)
• Signal Processing (AREA)
• Finance (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Telephonic Communication Services (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34950840

Family Applications (1)

Country Status (4)

Families Citing this family (24)

Family Cites Families (21)

• 2004
  • 2004-08-10 FR FR0408797A patent/FR2874295B1/fr not_active Expired - Fee Related
• 2005
  • 2005-08-05 WO PCT/FR2005/002034 patent/WO2006021661A2/fr not_active Ceased
  • 2005-08-05 EP EP05796271A patent/EP1829280A2/de not_active Withdrawn
  • 2005-08-05 US US11/659,836 patent/US8359273B2/en not_active Expired - Fee Related

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events