WO2008037912A2

WO2008037912A2 - Method and system for a user to access a service, and related authentication server and computer program

Info

Publication number: WO2008037912A2
Application number: PCT/FR2007/051979
Authority: WO
Inventors: Jacky Buyck; Christophe Beziau; Lionel Courval
Original assignee: France Telecom
Priority date: 2006-09-26
Filing date: 2007-09-20
Publication date: 2008-04-03
Also published as: WO2008037912A3

Abstract

The present invention relates to a method for a user to access a service (25) from a first terminal (21), characterised in that it comprises: the step of transmission, by the user and from a second terminal (22), of a request for accessing a service (25) by the first terminal (21) to an authentication server (27); a step of validation, by the authentication server (27) and to a service server (24), of the access to the service (25) by the first terminal (21); and a step of access by the user to the service (25) from the first terminal (21).

Description

Method and system for user access to a corresponding service, authentication server and computer program

The present invention relates to a method of access by a user, through means forming an information transmission network and from a first terminal, to a service implemented by a service server.

It also relates to a corresponding access system, an authentication server and a computer program for this application. More particularly, the invention relates for example to secure access to a voice service implemented by a voice server. It is then, for example, to make accessible, in a secure way from the outside, a corporate voice server, regardless of the number of the call terminal, this service being accessible only to certain people (eg company staff).

Currently, two solutions for secure access to a voice server exist.

In the first solution, the voice server is associated with a list of authorized or refused access terminal numbers. This list can be static or dynamic.

In the second solution, the user first calls the voice server. He is then given an ID number, and then connects to a web server to enter this identifier. If the identifier entered is the same, he can then access the voice service. This type of service access architecture is that used for access to paid services for example.

The current methods of accessing a voice service are therefore not optimal. Indeed, they have several constraints. Thus in the case of access by static list, it is necessary to maintain the list of accepted terminal numbers and denied terminal numbers. Moreover, and although it is possible to have access by dynamic list, these access often require web access to transmit the identifier to the access control system. In addition, in the dynamic list access mode, it is difficult to manage real and secure authentication of the natural person making the call. It is therefore understandable that the access solutions of the state of the art do not meet the current needs in the sense that the voice service is accessible to all numbers and not only to people whose number has been declared and authorized. Furthermore, it is difficult, if not impossible, to keep a list of the numbers of the terminals that can access the services up to date because, because of the mobility of people, the list quickly becomes unmanageable.

The access method according to the invention is a method of access by a user, from a second terminal, to a service characterized in that it comprises: a transmission step by the user, from a second terminal, a request for access to the service by the first terminal, to an authentication server;

a step of validation by the authentication server with a service server of access to the service by the first terminal; and - a step of access by the user to the service from the first terminal.

This method may also have one or more of the following features:

the step of validation by the authentication server with the service server of access to the service by the first terminal is associated with a step of transmission by the authentication server towards the second terminal of a message of access authorization ;

it includes a step of encrypting and signing the access request generated from the second terminal before it is transmitted to the authentication server;

- The access request is transmitted from the second terminal to the authentication server on a data transmission channel and access to the service server from the first terminal is performed on a voice transmission channel; The invention also relates to a user access system, from a first terminal, to a service characterized in that it comprises:

means for transmission by the user, from a second terminal, of a request for access to the service by the first terminal, destined for an authentication server; means for validation by the authentication server with a service server of access to the service by the first terminal; and

means of access by the user to the service from the first terminal. This system may also have one or more of the following features:

the service and the service server are respectively a service and a voice server;

the first terminal is a fixed telephone and the second terminal is a mobile telephone;

the first terminal and the second terminal are constituted by the same mobile telephone apparatus operating in voice transmission and in data transmission,

The invention also relates to an authentication server characterized in that it comprises:

means for receiving an access request by a first terminal to a service implemented by a service server;

means for validating this request; and

means for transmitting to the service server a service access authorization by the first terminal.

The invention also relates to a computer program comprising code instructions which when this code is executed in an authentication server allows:

- Receiving an access request by a first terminal to a service implemented by a service server;

- the validation of this request; and

- The transmission to the service server of a service access authorization by the first terminal.

Thus, the invention overcomes the disadvantages of the state of the art by allowing a user to access a service, for example voice, from a first terminal in an authenticated manner. The specificity of the invention lies in the fact that the user makes his access request, using a second terminal, to an authentication server. Then, the authentication server validates access to the service by the first terminal the service server, for example the voice server, and simultaneously transmits an access authorization message to the user at the second terminal. The invention also allows strong authentication of the user through the use of cryptography and public key infrastructures. In addition, securing the authentication via the use of the cryptographic means mentioned above and the use of timestamp information can prevent "replay" type attacks. Type attacks

"Replay" refers to an attacker intercepting messages exchanged during user authentication and "replay" them a little later after possibly modifying them to try to gain access.

Furthermore, the access request is transmitted from the second terminal to the authentication server on a data transmission channel often harder to hack than the voice transmission channel, the authentication is stronger. In addition, since there is no contact with the voice server prior to authentication, this reinforces voice service access policies.

Thus, no unauthenticated access is allowed.

Note also that in the case of GPRS access ("General

Packet Radio Service ") for authentication, there is a very low consumption of time and / or data on the user's package in the sense that we send a simple information of a few kilobytes and where we do not do a website consultation.

The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the appended drawings in which:

FIG. 1 represents a block diagram illustrating the structure and operation of a method and a static list access system to a service of the state of the art;

FIG. 2 represents a block diagram illustrating the structure and operation of a method and a dynamic list access system to a service of the state of the art;

FIG. 3 represents a block diagram illustrating the structure and operation of a method and system for accessing a service according to the invention; FIG. 4 represents a block diagram illustrating the operation of the authentication server according to the invention;

FIG. 5 represents a flowchart illustrating the general operating structure of the access method according to the invention; and FIG. 6 represents a flowchart illustrating the operation of the method for generating and transmitting an access request to the service server according to the invention.

As mentioned previously, the invention relates to a method and a system for access by a user, via information transmission network means and from a first terminal, to a service implemented by a service server.

Two solutions are known in the state of the art for accessing a service, for example voice service, by a user through means forming an information transmission network. These are the methods of access by static list and dynamic list. These access methods of the state of the art are illustrated in FIGS. 1 and 2.

FIG. 1 illustrates a method of access by static list to a service, for example voice service, by a user.

According to this method, access to a voice service is managed by the voice server which maintains a list of incoming numbers of authorized or refused terminals. The update of this list is done manually or automatically in a conventional manner.

In fact, FIG. 1 shows a block diagram of one embodiment of this static list access method to a voice service of the state of the art.

In this exemplary embodiment, the user has at his disposal an access terminal, designated by the general reference 1, making it possible to access through an information transmission network designated by the general reference 2, to a server of service designated by the general reference 3 and constituted for example by a voice server allowing the user to access a service for example voice 4.

The voice server 3 is also associated with storage means 5 of a database which, as will be described in more detail later, contains a list of authorized and denied terminal call numbers. As illustrated in this figure, update means of this list designated by reference 6 can be updated manually or automatically in a conventional manner.

According to this embodiment, the user sends a call from the terminal 1 through the information transmission network 2 to access the voice server 3. This voice server then compares the number of the terminal 1 to the numbers contained in the list. authorized terminal numbers stored in the database 5, to allow or not access. The user can then access or not the voice service 4 through the terminal 1. In the case where the user wishes to access the voice service 4 by a terminal whose number is not listed in the list of authorized numbers, such as c is the case for a terminal 7 illustrated in this figure 1, the call made at 8 is rejected in 9 by the voice server 3 after consultation of the database 5. As mentioned, such a process is difficult to implement because, because of the mobility of people, updating the list of accepted terminal numbers and numbers of denied terminals quickly becomes unmanageable.

An attempt has been made to solve this problem by proposing a dynamic list access method.

FIG. 2 illustrates an embodiment of this method of the state of the art.

In this embodiment, a user designated by the general reference 10 has at his disposal two terminals namely a first terminal designated by the general reference 1 1 and a second terminal designated by the general reference 12. The first terminal 1 1 is constituted a fixed telephone and the second terminal 12 consists of a computer, for example.

The first terminal 1 1 is connected through a voice transmission channel designated by the reference 13 to a service server, for example a voice server designated by the general reference 14, implementing a service, for example a voice designated by the general reference 15. The second terminal 12 is connected through a data transmission channel designated by the reference 16 to an access control server designated by the general reference 17 and consisting of a web server for example. According to this method, the user 10 calls through the voice transmission channel 13, the voice server 14 using the first terminal 11. The voice server 14 then gives him an identifier number that he transmits in same time at 18 to the access control server 17. Next, the user 10 connects, through the second terminal 12, through the data transmission channel 16 to the access control server 17 to enter this identifier. The access control server 17 then transmits at 19 an access authorization to the voice server 14, which allows the first terminal 1 1 to access the voice service 15. However, this access method illustrated in FIG. 2 also has drawbacks. Indeed, it requires web access so that the user can provide the identifier. In addition, it is difficult to manage real and secure authentication of the natural person making the call, because the voice service is accessible to all terminal numbers and not only the terminals whose number has been declared.

The invention makes it possible to solve the problems related to the access methods of the state of the art illustrated in FIGS. 1 and 2 by providing a solution making it possible to have the possibility of contacting a given voice service while making sure of better authentication and this regardless of the terminal number of the terminal of an authorized user.

FIG. 3 illustrates the structure and operation of an embodiment of the method of access to a voice service implemented by a voice server according to the invention.

In this embodiment of the invention, the user has at his disposal two terminals, namely a first terminal designated by the general reference 21, constituted for example by a fixed telephone, and a second terminal designated by the general reference 22. , consisting for example of a mobile phone. The first terminal is connected by means of a voice transmission channel designated by the general reference 23 to a service server, for example a voice server designated by the general reference 24, implementing a service, for example a voice service, designated by the reference 25. The second terminal 22 is connected by means of a data transmission channel designated by the reference 26 to an authentication server designated by the general reference 27. According to this embodiment, the user generates and transmits from the second terminal 22 on the data transmission channel 26 an encrypted access request to the service 25 by the first terminal 21, to the authentication server 27. II It should be noted that the means of transmitting this information to the authentication server 27 is not restricted to the mobile phone. Any data link may be used: GPRS ("General Packet Radio Service"), UMTS ("Universal Mobile Telecomunication System"), ADSL line ("Asymmetric Digital Subscriber One"), data flow in VolP / TolP ("Voice over Internet Protocol / Telephony over Internet Protocol ") ...

The transmission of information to the server can be done via any network protocol: TCP (Transmission Control Protocol), UDP (User Datagram Protocol) or any other higher layer protocol. The HTTP / HTTPs (Hyper Text Transfer Protocol) protocols can be very good candidates in the sense that there is no filtering of these protocols on the data networks. In this case, the authentication server may be a module of a web server.

The authentication server 27, after receiving the access request, validates this request. It then transmits at 28 to the voice server 24 an access authorization for the call number of the first terminal 21 and transmits to the second terminal 22 a message confirming the access authorization. This can be done, for example, by means of an SMS message ("Short Message") sent by the authentication server 25 to the mobile telephone constituting the second terminal 22. Thus, the user can call, at from the first terminal 21 the voice server 24 and thus access the requested service 25. The terminal 21 is indeed authorized to access the service 25.

The operation of the authenticated access method is described in more detail with reference to FIGS. 4 to 6.

Fig. 4 shows a flowchart illustrating the operation of the authentication mechanism associated with the access method according to an embodiment of the present invention.

This figure 4 recognizes the authentication server designated by the reference 27 in FIG. 3. This server 25 comprises various entities namely an access front module designated by the reference 31, a cryptographic module designated by the reference 32, an access rights management module designated by the reference

33 and a file management module designated by the reference 34. Furthermore, this figure shows an entity representing an authentication software designated by the reference 35 and installed on the second terminal 22 of the user as well as the voice service 25.

According to this embodiment of the invention, the authentication software 35 transmits, at 36, the access request constituted by an authentication token to the access front module 31 of the authentication server 27. The front-end module The access control 31 transmits this request to the different modules of the authentication server 27. The cryptographic module 32 validates the authenticity of the authentication information received at 37 and decrypts it to access the information conveyed, for example the number the first terminal 21 to access the voice service 25. The access rights management module 33 checks at 38 the access rights associated with the call number of the first terminal 21. It should be noted that this module is optional. It simply makes it possible to refine the voice service access policy 25. The file management module

34 used to manage the files in which all the accesses of the authentication server 27 are archived, records in 39 the access request.

Finally, in the event of a positive verification at 38 of the access rights, the front access module 31 transmits at 40 the authorization to open the service to the voice service 25.

Thus, according to the invention, access to a voice service is authorized for a given terminal number only from the moment when this terminal number is transmitted on a band other than the voice transmission band. cryptographic means thus ensuring the authentication and confidentiality of the information. Only the terminal numbers thus received to make the calls, end up on the voice server, all the others are rejected (if the access policy so wishes).

Alternatives exist such as, for example, authentication via a DTMF type code ("Dual Tone Multi Frequency"). However, this represents an authentication that can not be described as reliable. Indeed, the data of a couple connection / password ("login / password") plus possibly a phone number, all transmitted over an unreliable channel, is not sufficient to provide authenticated access to sensitive services.

Thus, thanks to the invention, it is possible to imagine voice services accessible without constraint within the company (normal operating conditions), but also from any other telephone number external to the company.

Authentication is strong thanks to the use of cryptographic systems (certificate, PKI (Public Key Infrastructure), signature and encryption). This ensures the aspects of identification, authentication, non-repudiation, anti-replay and integrity control related to the access request.

FIG. 5 represents a flowchart illustrating the general operation of the access method according to one embodiment of the invention.

In this figure, the steps implemented in the access method according to the invention on the user side designated by the reference 10 and on the authentication server side designated by the reference 27 are recognized.

Thus, the user 10, wishing to use a voice service using a terminal whose number is not known to the service, specifies at 41 on his mobile phone or by any other means for communicating in transmission mode. data with the authentication server 27, the voice service he wishes to use and indicates the terminal number with which he wishes to interact with this service (in the case where it is not the number of the mobile phone that will be used ). Software installed on his mobile phone then generates an access request. This software encrypts this request at 43 by means of encryption and signature methods. Then, this access request is transmitted at 44 to the authentication server 27.

The authentication server 27 receives in 51 the access request to the service. It verifies at 52 that the certificate used for the signature and the encryption is valid (not repudiated and not suspended). In the event that the signature is invalid or the certificate is expired or suspended, he refuses in 59 access to the voice service. If the signature and the certificate are valid, it decrypts in 53 the information and after optional analysis in 54 rights, decides in 55 to authorize in 56 or to refuse in 59 the access to the vocal service.

The authorization for access to the requested service for the specified number is obtained in 56, a confirmation in 57 by SMS for example is sent on a data transmission channel to the user 10 which confirms at 45 that he is authorized to access the specified terminal number at the service at 46. If rejected at 45, the user is not authorized to access the service in 47.

FIG. 6 represents a flowchart illustrating the operation of the method for generating and transmitting an access request to the voice server according to the invention.

Indeed, it is recognized in this Figure 6, the mechanisms used to generate the access request at the second terminal.

Thus, a software according to the invention, installed on the second terminal of the user, for example a mobile telephone, proposes to the user to specify the necessary information (selection of the service and terminal number to be used for example) and generates a request according to the principle illustrated in FIG.

In this FIG. 6, the information contained in the access request according to one embodiment of the invention is recognized. This is the call number of the first terminal, designated by the reference 61, the timestamp information designated by the reference 62 and the identifier of the desired service designated by the reference 63. This information is encrypted by means in encryption and signature 64. Then the encrypted and authenticated data designated by the reference 65 are transmitted at 66 to the authentication server 27.

Of course, other embodiments may be envisaged.

Claims

1. Method of access by a user from a first terminal (21) to a service (25), characterized in that it comprises:

a step of transmission by the user, from a second terminal (22), of a request for access to the service (25) by the first terminal (21), to an authentication server (27);

a validation step by the authentication server (27) with a service server (24) of access to the service (25) by the first terminal (21); and a step of user access to the service (25) from the first terminal (21).

2. Method according to claim 1, characterized in that the step of validation by the authentication server (27) from the service server (24) access to the service (25) by the first terminal (21) is associated with a step of transmission by the authentication server (27) to the second terminal (22) of an access authorization message.

3. Method according to claim 1 or 2, characterized in that it comprises a step of encrypting and signing the access request generated from the second terminal (22) before transmission to the authentication server (27). .

4. Method according to any one of the preceding claims, characterized in that the access request is transmitted from the second terminal (22) to the authentication server (27) on a data transmission channel (26). and in that access to the service server (24) from the first terminal (21) is performed on a voice transmission channel (23).

5. System for access by a user, from a first terminal (21), to a service (25), characterized in that it comprises:

means for transmission by the user, from a second terminal (22), of a request for access to the service by the first terminal (21), intended for an authentication server (27) ;

means for validation by the authentication server (27) with a service server (24) of access to the service (25) by the first terminal (21); and means for user access to the service (25) from the first terminal (21).

6. System according to claim 5 characterized in that the service (25) and the service server (24) are respectively a service and a voice server.

7. System according to claim 5 or 6, characterized in that the first terminal (21) is a fixed telephone and the second terminal (22) is a mobile phone.

8. System according to any one of claims 5 to 7, characterized in that the first terminal (21) and the second terminal (22) consist of the same mobile telephone device operating in voice transmission and data transmission. .

Authentication server (27) characterized in that it comprises:

means for receiving an access request by a first terminal (21) to a service implemented by a service server (24);

means for validating this request; and

means for transmitting to the service server (24) a service access authorization by the first terminal (21).

A computer program comprising code instructions which, when executed in an authentication server (27) according to claim 9, enables:

- receiving an access request by a first terminal (21) to a service implemented by a service server (24);

- the validation of this request; and - the transmission to the service server (24) of a service access authorization by the first terminal (21).