KR20080026071A - Method for securing sessions between a wireless terminal and equipment in a network - Google Patents

Abstract

A method for securing a session between a wireless terminal and a network device is provided to manage contents, such as music and video, at a mobile communication domain by using a DRM(Digital Right Management) agent. A wireless terminal(10) is coupled with a network device(20) through a secured session. The terminal is registered(50) in an RI(Right Issuer) server which issues user rights to an RO(Right Object). The RI server registers ID data(D) of the terminal. Elements are provided to the terminal, so that the terminal copes with a communication condition for the RI server. A secret key to be used for the terminal is distributed, so that a session is established and the user rights are transmitted. The user right includes permission to the network device. The terminal is identified by an authentication system which is linked with the RI server and generates the secret key.

Description

Method for securing sessions between a wireless terminal and equipment in a network}

The present invention relates to the area of wireless mobile telephones, and more particularly, to a method for establishing a secure session between a wireless communication terminal and a device item in a network.

In the remainder of this specification, a terminal may operate in a mobile radiotelephone network such as GSM, GPRS, UMTS, CDMA and any type of similar network, for example a wireless local area network (WLAN). Portable transceiver equipment.

In the prior art, the problem of securing exchange and data processing infrastructure has long been noted. To date, based on known cryptographic techniques, various solutions have been proposed. In particular, the public key infrastructure (" Public Key Infrastructure " -PKI) is the best developed solution based on asymmetric key technology (public key (Kp), private key (Ks)). The public key Kp corresponds to a number of sequences used to encode or decode a message transmitted between the transmitter and the receiver, and is associated with a pair of secret keys, called private keys Ks. do. Thus the message can be encoded by the public key, known to the user group, decrypted by the secret key known only to the recipient, or vice versa, encoded by the private key Ks and decrypted by the public key Kp. Can be. Encoding with the public key Kp ensures the confidentiality of the message, while encoding with the private key Kp ensures its integrity.

This solution for initiating a secure exchange or for accessing guaranteed content provides for the use of a public signing key (Kp) to ensure that only the owner of the relevant private key (Ks) can decrypt the message, It provides the use of a certificate that securely links identity with the public key Kp, since it is authenticated (encoded by the private key Ks) by a certification authority ("Authorization Center" = AUC).

In a known manner, an authentication center (AUC) ensures the subscriber's authentication and enables the confidentiality of data transmitted on the air interface between the mobile terminal and the base station attached at a given time.

However, the above mentioned solution is not completely safe. For example, because many certification authorities do not have the same degree of security, the initialization of the certification process is a weakness. The average user has no knowledge of this, and knows that getting a certificate certified by some authority can be very dangerous.

It can also be seen that storing the private key Ks is a problem, especially when the user wants to know this key in order to access the protected content. The protection of content against copyright infringement should be appropriate when the intruder does not come from the outside, but is generally the user himself. Most existing solutions do not take this possibility into account.

The prior art prepares for securing mechanisms for distributing digital content. Thus, access to the content can be protected by access rights, for example via technology of the DRM type (" digital rights management "). In recent versions (eg, the OMA DRM v2 standard by the Open Mobile Alliance), security includes initialization and storage of private keys / certificates at the terminal. This type of security applies to the distribution of content over mobile telephone networks. In addition, special structures or mechanisms are provided in various forms of embodiments of mobile terminals available in the market, in particular to reduce the risk of breaching a private key on the mobile terminal.

In general, the method used to distribute secure content applies to mechanisms that allow secure delivery of user rights to protected content (DRM content), as well as keys to allow content to be decrypted. March 03, 2006 OMA-TS-DRM-DRM-V2_0-20060303-A Version 2.0, the DRM Manual, provides an example of the transfer of the rights of these users (Rights Object-RO).

In order to establish a secure session between the terminal and the "target" device provided as a network resource, a separate security mechanism is to be discovered.

For GSM / UMTS, the mobile terminal is equipped with a (U) SIM card, which is a secure element, which allows identification and authentication of the subscriber via an identifier-synchronous key pair (IMSI-KI).

For a private network (virtual private network-VPN), the presence of a private key and a certificate at the terminal is used to establish a secure session between the terminal and the device.

For Internet access providers, a security relationship is often established over Wi-Fi to allow interconnecting access device items (commonly referred to as boxes) and terminals.

One disadvantage of these security methods is the need to perform a laborious configuration / initialization step, so that certain characteristics of the terminal are taken into account for the session. Therefore, there is a need for a security method that guarantees strong authentication of the terminal when a session / connection is established, which overcomes the need for a main component such as (U) SIM card or is the same as that implemented for a VPN network. Overcome the usual configuration process, or establish a secure link to the box.

It is an object of the present invention for the connection of a device to allow access of a terminal's server, network or any URL address (whether the device is a server or a connection box [eg ADSL box or similar type]). This eliminates one or more disadvantages of the prior art by determining how to combine security authentication with a simple requesting procedure.

To this end, the present invention provides a method for establishing a secure session between a wireless terminal and a device item interconnected via a network.

A priority registration step of the terminal with a rights issuer server distributing user rights to a rights object, which allows the server to record identification data of the terminal and provides elements to the terminal to adapt to communication conditions with the server Including a registration step,

Deploying a secret to be used by the terminal to establish a session, sending user rights to the terminal, the transmitted user rights including permissions to access the device 20,

The method is characterized by identifying the terminal and generating the secret using an authentication system linked with a server distributing user rights before a particular communication is established between the terminal and the server to allow access to the device.

The method of the present invention therefore proposes the use of a secure element for the management of secure content at the terminal in order to allow a secure session / connection to be established between the terminal and the device item. In this way, it is therefore possible to ensure strong authentication of the terminal when a session / connection is established, and to avoid the need to configure a secret / secure element that is rarely or never used when starting the terminal. Authentication is strong because it represents an element / security mechanism used in DRM, e.g., a delicate security microcircuit mounted on a terminal.

According to another aspect, in order to establish a session, the method

A terminal identification step by an authentication system linked with said server, through the use of identification data and authentication data of the terminal;

If the identification step of the terminal is successful, then the generation step in which the authentication system generates the session key is followed by the reception of the session key by the terminal;

Generating a rights object protected by means separate from the session key by the server, the rights object enclosing the user rights taking into account the characteristics of the terminal identified by the identification data;

A communication step between the terminal and the server, wherein the server delivers a rights object to the terminal;

-Accessing the device by the terminal through the use of a session key generated by the first authentication system and a user right contained in the rights object delivered by the server.

According to another aspect of the invention, the method comprises a storing step for storing identification data of the terminal in a memory means useful for the authentication system.

According to another aspect of the invention, the method, the step of generating a rights object by the server is performed according to the DRM specification of the OMA V2 standard.

Thus, the distributed content that allows access to the device can be distributed in particular in the form of an encoded object DCF, which can be protected by the rights object RO in the sense of standard OMA V2, which is the content of the wireless terminal. Only users can access it. In the method of the present invention, the authentication and DRM encoding mechanism (OMA V2 specification) is unique for exchanging one or more secrets that enable the establishment of one or more secure sessions or connections between one or more terminals and one or more device items. Used in a way.

According to another aspect, the identification step of the terminal is followed by a communication step between the authentication system and the server, and the authentication system transmits a unique connection identifier attached to the terminal to the server.

According to another aspect, the communication step between the terminal and the server is initiated by a request step sent by the terminal to the server to obtain a rights object protected by encoding a key associated with the terminal.

According to another aspect, the communication step between the terminal and the server is initiated by the server to one side to deliver the protection rights object associated with the terminal.

According to another aspect, the communication step between the terminal and the authentication server is initiated by a request step sent by the terminal to the authentication server.

According to another aspect, the communication step between the terminal and the authentication server is initiated to one side by the authentication server to deliver the encoded object to the terminal.

According to another aspect, the communication step between the terminal and the DRM proxy server is initiated by a request step sent by the terminal to the DRM proxy server.

According to another aspect, the communication step between the terminal and the DRM proxy server is initiated to one side by the DRM proxy server to deliver the encoded object DCF and the rights object RO.

According to another aspect, the method comprises the step of decrypting the rights object and the encoded object DCF at the terminal by the encryption module of the terminal identified by the server during the registration step.

According to another aspect, the method includes a step of communicating between an authentication system and the server, the authentication system transmitting at least one encoding / decryption key to the server.

According to another aspect, the encoded object DCF delivered by the authentication system and the rights object RO delivered by the server are received by the terminal and processed by a DRM agent (suitable for the DRM OMA V2 standard), and an access step for the device. The decoding is performed after decoding the encoded object DCF through the use of the right object associated with the terminal and the use of the connection module of the terminal for authentication with the device.

According to another aspect, the authentication server inserts at least one encoding / decoding key into the encoded object DCF delivered to the terminal.

According to another aspect, the authentication system transmits the URL resource address of the derived server providing the DCF format object carrying the session key to the device 20, so that the connection module of the terminal allows the terminal to access the device ( An object in DCF format (which carries a session key) may be requested from this derived server, and the session key is recovered in decrypted form at the terminal after use by the terminal DRM agent of the encoding / decryption key.

According to another aspect, the authentication system transmits the URL resource address of the server to the device so that the terminal can perform the registration step by using the URL resource address when requesting a connection to the device.

According to another aspect, the terminal receives, together with the rights object, data specifying the validity period of the session key and conditions of use of the session key.

According to another aspect, the authentication server retrieves the stage characteristics during the step of generating the encoded object DCF to determine and indicate in the encoded object the session type most suitable for the device and the terminal.

According to another aspect, the method comprises the steps of organizing between a terminal and another terminal communicating with the network to domain match a box or several terminals connecting to the network, and the encoded object DCF and rights object RO generated by the authentication system. Sharing the included conditions of use.

Another object of the present invention is to establish a session with a device of a wireless telephone network through the use of a program that can retrieve necessary data from a wireless communication terminal and ensure the security authentication of the terminal.

For this purpose, the present invention is a calculation program that can be downloaded directly into the internal memory of a digital processing device located in a wireless communication terminal capable of communicating with a wireless telephone network, the terminal storing for storing identification data of the terminal. Means for including when the program is executed by a digital processing device;

Transmitting and transmitting identification data so that the terminal can identify itself to the authentication system of the network;

Receive a rights object issued by the server distributing the protected user rights;

Receiving an encoded object issued by an authentication server distributing authentication secrets;

Triggering decryption by the DRM agent of the object encoded using the rights object;

Extract, from the encoded object DCF, a user right comprising permission to access an item of the device 20 of the network N;

Extracting at least one secret generated by the authentication system, using a DRM agent, from the data received over the network;

-Portions of software code to perform the use of the secret and user rights to establish a secure session between the wireless terminal and the device of the network.

The present invention having these features and advantages will become more apparent upon reading the description with reference to the accompanying drawings, given by way of non-limiting example.

Referring to FIG. 3, the wireless communication terminal 10 may be equipped with a DRM agent that guarantees a high level of security. Such a DRM agent is fully compliant with the OMA Version 2 standard (Open Mobile Alliance) and includes at least one cryptographic module 12. In one embodiment of the present invention, the DRM agent supports a flexible use model such as content sharing. DRM agents provide security and management of content such as music or video in the mobile domain. Usefully, this DRM agent can be used by a connected program or module of the terminal 10 responsible for the use of the secret and user rights recovered through the network N, so that the program can be used by the wireless terminal 10 and the device 20. Makes it possible to manage the establishment of a secure session between

The invention is explained below with reference to FIGS. 1, 2 and 3.

Rights Issuer Server Distributing User Rights The registration step 50 of the terminal 10 together with the RI enables the RI server to record identification data D of the terminal 10. The RI server thus first manages a list of registered wireless terminals 10 so that these terminals can receive user rights issued by this RI server. The registration step 50 may also enable the terminal 10 to be adapted to the communication conditions by the RI server providing an adaptation element to the terminal. Thus, the configuration of the terminal 10 can be adjusted, and the server can adapt itself to communication conditions that allow for exchange with the terminal 10. The Open Mobile Alliance (OMA) defines a mode called " fourth route registration protocol " that enables the terminal 10 to register with the rights issuer RI. After this step, the terminal 10 may acquire the secret in a secure manner, for example, through a data item protecting a sensitive content called DCF under the OMA V2 standard. In the method of the present invention, the mechanism for the encoded object DCF is not used to access protected content (this content is carried as DCF data) but allows a secure session to be established with at least one device 20 item. It can be used to transmit data (eg secrets and identifiers). As indicated in the DRM specification of the OMA Alliance (version 2), the communication conditions may include, for example, protocol parameters, protocol version to be used, cryptographic algorithms, certificate exchange priority, optional certificate exchange, mutual authentication of terminal 10 and server RI, protocol message Protected integrity and time synchronization of optional DRM devices.

These various communication conditions are essentially known to the person skilled in the art (see DRM manual, approved versions 2.0-2006. 03. 03, OMA) and will not be described in detail here.

To allow for the establishment of a secure session between the item of device 20 and the wireless terminal 10 interconnected via the network N, as particularly shown in FIGS. 1 and 2, the method includes:

First registering the terminal 10 with the RI for distributing user rights in the rights object RO (50),

The distribution of secrets to be used by terminal 10 to establish a session, and the transfer of user rights to terminal 10, wherein the transmitted user rights allow permission to use the secret and access to device 20. Including, and

A specific use of authentication system A in connection with an RI server distributing user rights to identify terminal 10 and generate the secret.

The RI server is responsible for registering the terminal 10 and distributing the rights object RO to the terminal. The authentication system A thus generates a secret to allow authentication of the terminal 10 upon session / connection to the device 20 and distributes the secret to the terminal via the DCF. The secret consists of a session key, which may be distributed to the device 20 by the authentication system A in an optional step 54. In this optional step 54 it is also possible to prepare for distribution of the public key associated with the secret given to the terminal 10. In the following, in the encoding process, which may or may not be asymmetric, the session key means private key Kc, or other secret data allows a secure session / connection to be established.

Compared with the DRM mechanism of the OMA V2 standard, the method of the present invention is used for the management of secure content in a terminal, in order to enable the establishment of a secure session / connection between the terminal 10 and the device 20 item. Allows reuse of security elements (of the network [RI and optionally DRM proxy server P]). Thus, strong authentication of the terminal can be assured when a session / connection is established, while cumbersome configurations such as need to be performed for a VPN network or to overcome the need to master components such as (U) SIM cards. Overcome the need for procedures

In one embodiment of the present invention, establishment of a secure session / connection between the device 20 item and the subscribing wireless communication terminal 10 may be performed to identify and authenticate the terminal 10 and to establish a secure session / connection with the session key Kc. It is based on the authentication mechanism provided in the OMA DRM v2 standard for distributing secrets with optional additional data, such as the validity of the session key Kc allowing establishment. Authentication system A may also optionally or additionally use a mechanism to limit the use of the secret a limited number of times.

Referring to FIG. 2, the terminal 10 simultaneously encapsulates a session key for the session between the right object RO generated by the RI server and the terminal 10 and the device 20 item through the DRM proxy server P at the same time. The encoded object DCF generated by the authentication server A may be received during the generation step 500 of forming the encoded object DCF. One advantage of delivering secrets through server P is to minimize the interaction of the terminal 10 with multiple device items (here, server A and server RI). As shown in FIG. 1, the server A searches for a feature of the terminal 10 during the step 500 of generating the encoded object DCF, so that the session type most suitable for the device 20 and the terminal 10 in the encoded object DCF. Determine and show.

Referring to FIG. 1, a method of establishing a session includes the following.

An identification step 540 of identifying the terminal 10 by the authentication server A connected with the RI server via the terminal identification data D and the terminal 10 authentication data DA (the authentication data can be communicated with the terminal);

A generation step 500 of generating a session key by the authentication system A if the terminal identification step 540 is successful and a reception step 550 of the session key protected by the terminal 10 following the DCF object;

A creation step 560 of the rights object RO by the RI server encapsulating the user rights taking into account the characteristics of the terminal 10 identified using the identification data D;

The RI server communicating a rights object RO to the terminal 10, the communication step 57 between the terminal 10 and the RI server;

An extraction step 58 of extracting, by the DRM agent, the session key generated by the authentication system A and the rights object RO delivered by the RI server from the DCF;

An access step 580 of the terminal 10 of the terminal 10 using the session key extracted during step 58;

Thus, in the example of FIGS. 1 and 2, the terminal 10 may receive the secret in the form of a standard object containing protected information called DCF (DRM Content Format). This information is encoded by one or more keys that are individually transmitted in objects that are themselves encoded by public and private keys, which objects form < RTI ID = 0.0 > " rights < / RTI >

Referring to Fig. 1, EO 53, which has received a request, authentication system A provides DCF content (step 550) containing the secret requested to terminal 10, which is encoded by key K. At the same time, authentication system A may also provide a secret or key associated with the secret distributed to terminal 10, which enables device 20 to authenticate such terminal, as indicated by step 54. It is the RI server that guarantees the distribution of user rights to digital content. The RI server may also distribute session keys or keys that allow content to be decrypted through transmission of the encoded object RO or protected information DCF. In other words, authentication server A provides a secret in the form of an encoded object DCF, which is completed by the associated rights object provided by the RI server.

While the delivery of the protection information DCF and the rights object RO are made in the combining method in the example of FIG. 2, this delivery may be made separately as shown in FIG. 1. In this case the request step 53 by the terminal 10 relates only to the encoded object DCF carrying the session key and the rights object for the user rights. In addition, the step 53 of requesting the session key generated by the authentication system A initialized by the terminal 10 may be replaced by the request step 53 'by the device E, which makes it possible to reduce the communication time.

According to one embodiment of the invention, the device 20 may operate like the DRM proxy server P shown in FIG.

In one embodiment of the invention, the protected information may be distributed by a secondary server providing the object in DCF format. In this case, the authentication system A may send the device 20 the URL resource address (including the secret and connection unique identifier) or the name of the derived server that supplies the object in DCF format and conveys the session key. The device 20 transmits this information to the terminal 10. Accordingly, the connection module of the terminal may request the derivative server of the DCF format object carrying a session key capable of making access to the terminal 10 device 20 possible, and the session key is a DRM agent of the terminal 10. After using the key 6 to enable the decryption of the protection information DCF is recovered to the decrypted form in the terminal 10, this encoding / decryption key 6 is given to the rights object RO. In other words, in this case, the step 57 in which the rights object RO is transmitted may include at least one encoding / decoding key 6 required by the decryption module 12 of the terminal 10 to extract available content from the protection information DCF. Allow the transfer of

In the embodiment shown in Figs. 1 and 2, authentication system A transmits the encoding / decryption key 6 during the communication step 55 with the RI server, such that the RI transmits the key 6 via the protected rights object. . Referring to Fig. 3, retrieval 60 of this encoding / decryption key 6 generated and stored by authentication system A after requesting 530 to retrieve this encoding / decryption key 6 by the RI server. Can be done. The encoding / decoding key 6 may be replaced with another key or secret data protecting the content of the DCF information.

Step 53 corresponds to the terminal sending a request to the authentication server A to obtain a secret that makes it possible to establish a secure connection or session with the device. Once created in step 500, these secrets become the content to be processed in relation to the DRM specification of the standard OMA V2. In other words, generating the rights object and / or DCF information 560 corresponds to an extension of the application of DRM technology and general related structures. For this purpose, the method of the present invention manages a session established with the device 20 via a network N and a DRM architecture entity distributing user rights of the terminal to a user terminal / set, i.e., RI server. Use a new link between the gateway and the authentication system A connected to the communication service.

1 and 2, when an access 51 of a service requesting establishment of a connection (session) to an item of device 20 is attempted by the user's terminal 10, the device 20 is activated. The first automatic response 52 indicates that a secret for establishing a secure connection or session to the terminal 10 is required. In one embodiment of the invention, the device 20 may optionally indicate an authentication server A that distributes user rights in this response 52 and / or an appropriate derived server that delivers the appropriate rights object and / or DCF information. It may be. For example, the authentication system transmits the URL resource address of the RI server to the device 20, which uses the URL resource address when the terminal 10 sends a request for connection to the device 20. 50).

The terminal submits a request 53 to the authentication server A providing the secret. This system A may be co-located with the RI server or device 20.

In particular, the decoding step 58 of the encoded DCF object may be performed in the terminal 10 having all the elements necessary for extracting the protected data. These protected data include, for example, session keys such as user rights and certificates and / or unique identifiers for connection to the device 20. The terminal 10 has a cryptographic module 12, which is identified by the RI server during the registration step 50 for extracting protected data. An access step 580 to the device 20 is performed after decrypting the encoded object DCF and uses the connection module of Dalmar 10 for authentication on the device 20. In one embodiment of the present invention, the communication step 55 between the system A and the RI server after the identification step 540 of the terminal 10 includes the transmission of a unique connection identifier attached to the terminal 10 to the RI server. The transmission of the connection identifier to the RI server may be performed simultaneously with the transmission of the secret to be sequentially transmitted together with the encoded object DCF.

The generation step 500 in which the object DCF encoded by the authentication server A is generated takes into account the characteristics of the terminal 10 and a specific operation function. This authentication system A allows the certificate to be delivered to the terminal to establish a unique session. Thus, this type of certificate may be associated with a unique way to the user's identity (typically MSISDN).

In the example of FIG. 1, the communication step 57 between the terminal 10 and the RI server is initiated by a request step 56 sent for the rights object RO by the terminal 10 to the RI server. Referring to FIG. 1, a communication step 57 between a terminal and the RI server is initiated by an RI server unilaterally transmitting a rights object RO related to the terminal 10 and the DCF.

Similarly, in the example of FIGS. 1 and 2, the distribution of DCF to terminal 10 is initiated by distributing secret 53 to terminal 10. In the embodiment shown in FIG. 2, by applying this mechanism, the device 20 is responsible for sending identification data to the authentication server A.

In a preferred embodiment of the present invention, the network N connecting the RI server, the authentication server A and the terminal 10 is a network managed by the radiotelephone operator, and thus the terminal 10 is provided with respect to a place serviced by the network N. It can communicate with at least the RI server and the authentication server A. Referring to FIG. 3, the method provides a data storage step of storing identification data D of the terminal 10 in a memory means 4 available in the authentication system A. This identification data D is combined with the authentication data DA provided by the terminal 10, and allows identification by the authentication system A. FIG. The identification module 40 of the system A, stored in the memory means 4 of the system A, compares the received data with the desired data, and compares the generation of the session key with the DCF. If there is a match, the terminal 10 can receive the necessary secret element that is identified and opens a session to the device 20.

The authentication data DA is stored in the memory 11 of the terminal 10 and includes a certificate or an authentication key associated with the user and / or the terminal 10. For example, the RI server and the authentication system A may have the same identification data D of the terminal 10 to perform individual tasks in consideration of the characteristics of the terminal 10, and such a task may be sent to the terminal 10. Enable secure delivery of the elements needed to establish a secure session / connection with device 20 of network N. The memory means 3 of the RI server is used to store, in particular, the identification data D of the terminals in the form of a table listing the characteristics of each terminal 10. A generating model 30 for generating the rights object RO and optionally a module for generating DCF type protection information may be stored in the memory means 3 of the RI server.

In one embodiment of the invention, the device 20 may be accessed by the terminal 10 via a short-range connection (" Bluetooth ", infrared, Wi-Fi (WiFi, etc.)) without passing through the network N. In the first case, the terminal 10 uses the network to recover the elements needed to establish a connection, such as the rights object RO delivered by the RI server. Alternatively, the device 20 accessing the network may operate as a DRM proxy P and the terminal 10 does not need to use the network N because it is an EK.

The " domain " certificate can be generated by the RI server so that a group of terminals 10 belong to one and the same user and have the same rights. For the transfer of user rights, a " terminal " group can be domain matched to minimize the interaction between terminal 10 and possible RI and A servers in network N. Thus, for example, if ten or so terminals are domain matched, when one of the terminals obtains a secret that enables access to the device 20 item, the terminal will typically be able to access the DCF and rights objects in the DRM domain. The secret can be transmitted to the remaining nine terminals according to the in-transmission mechanism. Any one of the other nine terminals may thus establish a secure session or connection with the device 20 without making additional requests to the RI server that distributes the rights object RO in the sense of the standard DRM OMA V2 structure. The mechanism for domain match devices is described in the DRM OMA V2 Specification.

In this way, users can domain match their mobile terminals with a connection box (distributed by an Internet access provider) forming a second terminal. As a result, the box may send the secret obtained from the server A and the rights object RO obtained from the RI server to the mobile terminal 10, and the user may have the right to connect to the device 20 with respect to the group of reference terminals.

In this mode, the box can restrict non-secure device connections to the closed list to limit the resources allocated by the box. The box may allow these terminals to access network N, which may establish a secure session / connection with one or more device items, and may limit requests to a limited group of device items. In the example described above, the box may be considered the device 20.

The authentication server A may specify the type of secure connection / session that is most appropriate for the device 20 and the terminal 10 under consideration so that multiple mechanisms of secure connection / session may be supported. have. The advantage of identifying terminal 10 is to have an accurate knowledge of its characteristics, and thus to be able to selectively transmit certain parameters to this class of terminals upon request for connection / session.

In the example of a mobile wireless communication terminal, terminal 10 must first register with the RI that distributes the rights object, because it wants to access various network resources through a connection box distributed by an Internet access provider. The terminal 10 must also register with the authentication server A. The terminal 10 under consideration is associated with a subscription to an internet access provider. When the terminal 10 attempts to access the device 20 item through one of the providers' boxes, the device 20 indicates that it must obtain a secret from the indicated authentication server A. The terminal 10 then sends a request to the server A to obtain at least one secret that allows it to open a secure connection or session with the device 20. Upon receipt of the secret and rights object (via DCF), the terminal 10 may open a secure session or connection with the device 20.

One of the advantages of the method according to the invention is that all the necessary elements are not based on the static authentication mechanism of the terminal 10, which is recorded in advance in the terminal 10. On the contrary, the above-mentioned method proposes dynamic authentication of the terminal using network N as a dynamic authentication tool. If the terminal 10 is an intended terminal, it can successfully pass the authentication step 540 and use the protection information delivered by the RI server with knowledge of the specific characteristics of the authenticated terminal 10. There must be. For example, the connection software of the authenticated terminal 10 first knows how to connect the server A and the RI to obtain a DCF and associated RO after receiving a response from the device 20, and then the device 20 and the authentication server. It knows how to use the secrets included in the object DCF encoded to be authenticated. In addition, the connection software of the terminal 10 may optionally encode a connection to the device 20.

The present invention is not limited to the expansion of the use of the general DRM agent available on the mobile terminal 10. According to the method of the present invention, the secret used for authentication / identification of the terminal 10 upon access to the device 20 item may be regarded as content distributed by the mechanism of the DRM V2 type (DRM specification, OMA V2). have.

The application of the present invention is diverse. For example, in the DRM application, the terminal 10 cannot transmit a specific user right and session key to the device 20 unless it is first identified through the network N. In addition, the characteristics of the terminal 10 are accurately considered. When the application of the terminal 10 requests access to the device 20, it may contact the authentication system A to identify the terminal 10 and provide the necessary elements with the help of the RI server. Therefore, since the RI server shares the secret with the terminal 10, the user's right to the key can be transmitted in an operational and secure manner through the rights object RO and the CDF data item.

In addition, the DCF content and the rights object RO may be transmitted to the terminal 10 in advance, which minimizes time for establishing a connection / session with the device 20. In addition, the method of the present invention may be performed only for the purpose of allowing authentication of the terminal / client.

The use of the RI server and authentication system A available through network N in accordance with the present invention may allow the provision of preferential rights to items of device 20 in relation to the identification and type of terminal 10. Thus, in the example where the device 20 is a connection box of an internet access provider, the box may authenticate the terminal to access a limited resource (e.g., authentication system A and RI server of the HTTP protocol). After authentication, the box may provide a level of preferential rights adapted to terminal 10, such as allowing terminal 10 to conduct a voice call over network N.

It will be apparent to those skilled in the art that the present invention allows various other specific forms of embodiments without departing from the scope of the claimed invention. Accordingly, the embodiments described herein are to be regarded as examples that may be modified in the scope defined by the scope of the appended claims, and the invention is not limited to the details described above.

1 shows a first example of the sequence flow of the method according to the invention.

2 shows a second example of the sequence flow of the method according to the invention.

3 is a schematic diagram of one embodiment of a method used by a terminal to obtain the secret required to establish a secure session with a network device item.

Claims (24)

A method for establishing a secure session between an item of device 20 and a wireless terminal 10 interconnected via a network N, In the priority registration step 50 of the terminal 10 in the rights issuer server RI distributing user rights to the rights object RO, the RI server can record the identification data D of the terminal 10. And a registration step 50, which provides elements to the terminal to adapt to communication conditions with the RI server, Deploying a secret to be used by the terminal 10 to establish a session, transmitting user rights to the terminal 10, the transmitted user rights including permissions to access the device 20, The method uses a terminal 10 using an authentication system A that is linked with an RI server that distributes user rights before specific communication is established between the terminal 10 and the RI server to allow access to the device 20. ) And generate the secret. The method of claim 1, wherein in order to establish the session, Identification step 540 of the terminal 10 by the authentication system A linked with the RI server, through the use of identification data D and authentication data DA of the terminal 10; If the identification step 540 of the terminal 10 is successful, then the generation step in which the authentication system A generates a session key is followed by the reception steps 550, 57 of the session key by the terminal 10. ; Generating step 560 of the rights object RO protected by means separate from the session key by the RI server, the rights object RO having the characteristics of the terminal 10 identified by the identification data D; Creating step 560, encapsulating the considered user rights; A communication step (57) between the terminal (10) and the RI server, wherein the RI server delivers a rights object (RO) to the terminal (10); An access step to the device 20 by the terminal 10 through the use of a session key generated by the first authentication system A and a user right contained in the rights object RO delivered by the RI server. Method comprising 580. Method according to claim 1 or 2, comprising a storage step for storing identification data (D) of the terminal (10) in a memory means (4) useful for the authentication system (A). 4. A method according to claim 2 or 3, wherein the step of creating (560) a rights object (RO) by the RI server is performed according to the DRM specification of the OMA V2 standard. The method according to any one of claims 2 to 4, wherein the identification step 540 of the terminal 10 is followed by the communication step 55 between the authentication system A and the RI server, and the authentication system A ) Transmits a unique connection identifier attached to the terminal 10 to the RI server. The communication step 57 according to any one of claims 2 to 5, wherein the communication step 57 between the terminal 10 and the RI server acquires a rights object RO protected by encoding a key associated with the terminal 10. Initiated by a request step 56 sent by the terminal 10 to the RI server. The communication step 57 according to any one of claims 2 to 5, wherein the communication step 57 between the terminal 10 and the RI server is performed by an RI server to convey a protection right object (RO) associated with the terminal 10. The method disclosed on one side. The communication step 550 according to any one of claims 2 to 5, wherein the communication step 550 between the terminal 10 and the authentication server A is a request step sent by the terminal 10 to the authentication server A. The method disclosed by (53). The communication step 550 according to any one of claims 2 to 5, wherein the communication step 550 between the terminal 10 and the authentication server A transmits an encoded object DCF to the terminal 10. The method disclosed by one side by (A). The communication step according to any one of claims 2 to 5, wherein the communication step between the terminal 10 and the DRM proxy server P is a request step 53 sent by the terminal 10 to the DRM proxy server P. Initiated by. The communication method according to any one of claims 2 to 5, wherein the step of communicating between the terminal 10 and the DRM proxy server P comprises a DRM proxy server (DRM) to transfer an encoded object (DCF) and a rights object (RO). The method disclosed by one side by P). The rights object (RO) and at the terminal (10) according to any one of claims 1 to 11, by the encryption module (12) of the terminal (10) identified by the RI server during the registration step (50). Decoding 58 of the encoded object (DCF). 12. A method as claimed in any preceding claim, comprising a step 55 of communication between an authentication system A and the RI server, wherein the authentication system A is at least one encoding / decryption key (i) to the RI server. 6) how to transfer. The encoded object (DCF) delivered by the authentication server (A) and the rights object (RO) delivered by the RI server are received by the terminal (10). And processed by the DRM agent, the access step 580 for the device 20 is an object encoded through the use of the rights object (RO) associated with the terminal and the use of the connection module of the terminal 10 to authenticate with the device. Method performed after decoding (DCF). The method according to any one of claims 2 to 11, wherein the authentication server (A) inserts at least one encoding / decoding key (6) into a coded object (DCF) delivered to the terminal (10). The apparatus of claim 15, wherein the authentication system A transmits the URL resource address of the derived server that provides the DCF format object for transmitting the session key to the device 20, so that the connection module of the terminal 10 is connected to the terminal 10. May request from this derived server a DCF format object carrying a session key to allow access to the device 20, the session key being used by the DRM agent of the terminal 10 of the encoding / decryption key 6. Later recovering to the decrypted form in the terminal (10). 17. The authentication system (A) according to any one of claims 1 to 16, wherein the authentication system (A) uses the URL resource address when the connection request to the device (20) is performed by the terminal (10) to perform the registration step (50). Transmitting the URL resource address of the RI server to the device (20). 18. The method according to any one of claims 2 to 17, wherein the terminal (10) receives a rights object (RO) together with data specifying the validity period of the session key and conditions of use of the session key. 19. The method according to any one of claims 2 to 18, wherein the terminal (10) receives a rights object (RO) together with data specifying the conditions of use of the session key and a number limiting the use of the session key. The encoded object (A) according to any one of claims 2 to 14, wherein the authentication server (A) is configured to determine and indicate in the encoded object (DCF) the session type most suitable for the device 20 and the terminal 10. Method of retrieving the characteristics of the terminal 10 during the step (500) of generating (DCF). 21. The method of any of claims 2-20, wherein the recognition step (540) is performed with an authentication system (A) located with an RI server. The method according to any of claims 2 to 20, wherein the recognition step (540) is performed with an authentication system (A) located with the device (20). 23. The method according to any one of claims 1 to 22, wherein the organization step between the terminal 10 and another terminal communicating with the network N to domain match a box or several terminals connecting to the network N, and Sharing the usage conditions contained in the rights object (RO) with the encoded object (DCF) generated by the authentication system (A). A calculation program that can be directly downloaded into an internal memory of a digital processing device located in a wireless communication terminal 10 capable of communicating with a radiotelephone network N, wherein the terminal stores identification data D of the terminal 10. A storage means (11) for storing, the next step when the program is executed by the digital processing apparatus; Transmitting and transmitting identification data D, so that the terminal 10 can identify itself to the authentication system of the network N; Receiving a rights object (RO) issued by the RI server distributing the protected user rights; Receiving a coded object DCF issued by an authentication server A that distributes authentication secrets; Trigger decoding by the DRM agent of the object DCF encoded using the rights object RO; Extract, from the encoded object DCF, a user right comprising permission to access an item of the device 20 of the network N; Extracting at least one secret generated by the authentication system, using a DRM agent, from the data received via the network N; Using the secret and user rights to establish a secure session between the wireless terminal 10 and the device 20 of the network; a computational program comprising portions of software code to perform.

Images