Method of communication between a user station and a network, in particular such as internet, and implementing architecture

• US 6,751,671 B1
• Filed: 04/13/2000
• Issued: 06/15/2004
• Est. Priority Date: 08/13/1998
• Status: Expired due to Fees

• Current Assignee: CP8 Technologies (Thales SA)
• Original Assignee: Bull CP8 (SLB)
• Inventors: Urien, Pascal
• Primary Examiner(s): Najjar, Saleh
• Application Number:
  US09/529,380
• Time in Patent Office: 1,524 Days
• Field of Search: 709/201, 709/203, 709/229, 709/230, 709/225, 709/227
• US Class Current: 709/229
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method and architecture for communication between a terminal (1) and a smart card, said terminal being operatively connected to a smart card reader (3) and a data transmission network (RI). The terminal includes an initial stack of network (RI) access protocol which consists of a specified number of communication software layers (C₁-C₄). The said smart card (3) and said smart card reader comprise second and third protocol stacks, each consisting of at least lower order software communication layers (CC₂-CC₁, CCa₂-CCa₁), in order to allow data exchange between the smart card and said terminal (1). In a first preliminary phase, a first specific software item (23a) smart card (2a) functions as an interface for the lower layers (CCa₂-CCa₁) of the third protocol stack and with at least one application (24a) registered in the smart card (2a). In a second preliminary phase, a second specific software item (13), functions as an interface with said lower layers (CC₂-CC₁), of the second protocol stack and with specified layers of said first protocol stack (C₂, C₃), and is installed in the terminal (1). The first and second specific software items (13, and 23a) in addition comprise at least one pair of primary coupled software entities (132, 232a). Each of the entities (132 and 232a) cooperate with each other in order to allow for the establishment of a bi-directional data exchange session between the terminal (1) and said smart card (2a) and/or said data transmission network (RI), so that all or part of said data travels through said smart card (2a). The smart card may supply the terminal (1) with a predetermined virtual model which transforms the smart card (2a) into a server and/or client.

Claims

1. A method of communication between a terminal and a smart card, said terminal being operatively connected to a smart card reader for communicating with the smart card and a data transmission network (RI), said terminal comprising a first network (RI) access protocol stack, comprising a specified number of communication software layers (C₁-C₄), and said smart card and smart card reader comprising a second protocol stack and a third protocol stack, each comprising at least lower order software communication layers (CC₂-CC₁, CCa₂-CCa₁), to allow data exchange between the smart card and said terminal,

said method comprising establishing a first preliminary phase, an interface by a first specific software item in smart card for said lower order communication layers (CCa₂-CCa₁) of the third protocol stack with at least one application registered in the smart card, establishing a second preliminary phase, which consists of installing, in the terminal, a second specific software item, which functions as an interface with said lower order communication layers (CC₂-CC₁), of the second protocol stack and with specified layers of said first protocol stack (C₂, C₃), wherein said first and second specific software items in addition comprise at least one pair of primary coupled software entities, each of said entities cooperating with each other in order, and establishing a session for a bi-directional data exchange between at least one of said terminal and said smart card, and said data transmission network (RI), so that all or part of said data travels through said smart card.

2. The method of claim 1, wherein said specific software items comprise two additional entities consisting of a data transfer module, which functions as an interface for said lower layers (CC₂-CC₁, CCa₂-CCa₁) of the second and third protocol stacks and a management module, and in which said primary entities of each pair are constituted by intelligent agent software modules, establishing said sessions.

3. The method of claim 2, wherein said intelligent agents are clients, which open said data exchange sessions and servers, which supply said data.

4. The method of claim 2, wherein said intelligent agents are associated with at least one of the following attributes:

an initial attribute termed “

host”

, indicating that the intelligent agent is located in said terminal;

a second attribute termed “

card”

, indicating that the intelligent agent in located in said smart card;

a third attribute termed “

local”

, indicating that the intelligent agent is not communicating with said network (RI);

a fourth attribute termed “

network”

, indicating that the intelligent agent is communicating with said network (RI).

5. The method of claim 2, further comprising establishing a session between a pair of predetermined said agents, so as to send to said terminal data from an application, registered in said smart card, said data consisting of a list (P) of applications, after access is authorized by the user of the terminal.

6. The method of claim 5, wherein said network (RI) is a global network and said terminal comprises a navigator for said network, said data consisting of a page (P) written in hypertext language consisting of hyperlinks (Hl₁-Hl_n), pointing to resources located on various servers outside of terminal, further comprising utilizing said navigator for the selection of said hyperlinks (Hl_i) and generating a particular address, activating predetermined intelligent agents, and launching sessions for the exchange of data between the terminal and smart card and the terminal and said global network (RI), in order to reach a selected server, wherein all or part of said data traveling through said smart card.

7. The method of claim 5, wherein generating of the particular address of the said smart card by the network navigator occurs via a feedback address to said terminal.

8. The method of claim 6, further comprising the step of identifying said user and filtering data received and sent from and to said network (RI) using secret data located in said smart card, wherein said step of identifying and filtering occurs within smart card.

9. The method of claim 2, further comprising a step of establishing a data transfer session between a pair of said predetermined agents, to send to terminal data from an application, registered with said smart card, and configuring the terminal by said data according to a predetermined virtual model, so that said application may be executed from within terminal.

10. The method of claim 1, further including storing a plurality of applications in the smart card.

11. A method of communication between a terminal and a smart card, said terminal being operatively connected to a smart card reader for communicating with the smart cards and a data transmission network (RI), said terminal comprising a first network (RI) access protocol stack comprising a specified number of communication software layers (C1-C4), said smart card and smart card reader comprising a second protocol stack and a third protocol stack, each comprising at least lower order software communication layers (CC2-CC1, CCa2-CCa1), to allow for data exchange between the smart card and said terminal;

said method comprising establishing in a first preliminary phase an interface between a first specific software item and said lower order communication layers (CCa2-CCa1) of the third protocol stack which consists of installing, in the smart card, the first specific software item, which functions as an interface for said lower layers (CCa2-CCa1) of the third protocol stack and at least one application registered in the smart card;

establishing a second preliminary phase, which consists of installing, in the terminal, a second specific software item, which functions as an interface for said lower layers (CC2-CC1) of the second protocol stack and with specified layers of said initial protocol stack (C2, C3), wherein said first and second specific software items in addition comprise at least one pair of primary coupled software entities, each of said entities adapted to cooperate with each other, and;

establishing a bi-directional data exchange session between said terminal and said smart card, so that said smart card supplies said terminal with a pre-determined virtual terminal model, thereby transforming said smart card into at least one of a server and a client.

12. The method of claims 11, wherein at least one of said server and client is mobile and portable.

13. The method of claim 11, wherein said specific software items comprise two additional entities consisting of a data transfer module, which functions as an interface for said lower layers (CC₂-CC₁, CCa₂-CCa₁) of the second and third protocol stacks and a management module and in which said primary entities of each pair are constituted by intelligent agent software modules, establishing said sessions.

14. The method of claim 12, wherein said specific software items comprise two additional entities consisting of a data transfer module, which functions as an interface for said lower layers (CC₂-CC₁, CCa₂-CCa₁) of the second and third protocol stacks and a management module and in which said primary entities of each pair are constituted by intelligent agent software modules, establishing said sessions.

15. The method of claim 13, wherein said intelligent agents are clients, which open said data exchange sessions and servers, which supply said data.

16. The method of claim 14, wherein said intelligent agents are clients, which open said data exchange sessions and servers, which supply said data.

17. The method of claim 13, wherein said intelligent agents are associated with at least one of the following attributes:

an initial attribute termed “

host”

, indicating that the intelligent agent is located in said terminal;

a second attribute termed “

card”

, indicating that the intelligent agent in located in said smart card;

a third attribute termed “

local”

, indicating that the intelligent agent is not communicating with said network (RI);

a fourth attribute termed “

network”

, indicating that the intelligent agent is communicating with said network (RI).

18. The method of claim 14, wherein said intelligent agents are associated with at least one of the following attributes:

an initial attribute termed “

host”

, indicating that the intelligent agent is located in said terminal;

second attribute termed “

card”

, indicating that the intelligent agent in located in said smart card;

a third attribute termed “

local”

, indicating that the intelligent agent is not communicating with said network (RI);

a fourth attribute termed “

network”

, indicating that the intelligent agent is communicating with said network (RI).

19. The method of claim 13, further comprising establishing a session between a pair of predetermined said agents, so as to send to said terminal data from an application, registered in said smart card, said data consisting of a list (P) of applications, after access is authorized by the user of the terminal.

20. The method of claim 14, further comprising establishing a session between a pair of predetermined said agents, so as to send to said terminal data from an application, registered in said smart card, said data consisting of a list (P) of applications, after access is authorized by the user of the terminal.

21. The method of claim 13, further comprising a step of establishing a data transfer session between a pair of said predetermined agents, to send to terminal data from an application, registered with said smart card, and configuring the terminal by said data according to a predetermined virtual model, so that said application may be executed from within terminal.

22. The method of claim 14, further comprising a step of establishing a data transfer session between a pair of said predetermined agents, to send to terminal data from an application, registered with said smart card, and configuring the terminal by said data according to a predetermined virtual model, so that said application may be executed from within terminal.

23. The method of claim 11, further including storing a plurality of applications in the smart card.

24. A system of architecture for communication between a terminal, and a smart card comprising a smart card reader, a smart card communicating with the smart card, a smart card, a data transmission network (RI), said terminal having a first protocol stack for network (RI) access, said first stack comprising a determined number of communication software layers (C₁-C₄), said smart card comprising a second protocol layer and a third protocol layer, each comprising lower order communication software layers (CC₂-CC₁, CCa₁-CCa₂), for data exchange between the smart card and said terminal, and said smart card further comprising a first specific software item, which functions as an interface for said lower layers (CCa₂-CCa₁) of the third protocol stack and with at least one application registered in the smart card, terminal having a second specific software item, which functions as an interface with said lower layers (CC₂-CC₁) of the second protocol stack and with determined layers of the said first protocol stack (C₂, C₃), wherein said first and second specific software items are adapted to cooperate with each other, to allow for the establishment of a bi-directional data exchange session between at least one of said terminal and said smart card, and said network (RI), so that all or part of said data travels through said smart card.

25. The architecture of claim 24 further comprising communication circuits connected to said network (RI), said second specific software item, is located on a side of terminal between lower layers (C₁-C₂), contained in said communication circuits, and higher layers (C₃, C₄) of said first protocol stack, so that said terminal and said smart card can share the same address on network (RI), controlled by the second specific software item, on the side of the terminal.

26. The architecture of claim 25, wherein an additional physical device, is located between said network (RI) and said terminal, said additional physical device comprising first and second communication circuits, each consisting of two lower communication protocol layers (C′

₁-C′

₂, C″

₁-C″

₂), the first circuits being connected to network (RI) and the second circuits being connected to said communication circuits of the terminal, the additional physical device being connected to said reader of smart card, and said specific software item, on the side of the terminal, is located within said additional physical device, and functions as an interface between said lower layers (C′

₁-C′

₂, C″

₁-C″

₂) of said first and second communication circuits and lower layers (CC₁, CC₁) of reader of smart card, so that the terminal and smart card can share the same address on network (RI), while controlled by specific software item, on the side of the terminal.

27. The architecture of claim 26, wherein said communication circuits are connected to said network (RI), said specific software item, on the side of terminal, functions as an interface between said lower layers (CC₁, CC₂) of said second protocol stack and is located between layers at higher levels (C₃, C₄) of said first protocol stack, so that said smart card with an address that is different from terminal on network (RI), terminal functions for smart card as an access bridge to network (RI), while controlled by specific software item of terminal.

28. The architecture of claim 27, wherein said communication circuits are connected to said network (RI), wherein said specific software item on the side of terminal functions as an interface between said lower layers (CC₁, CC₂) of said second protocol stack and is located between one layer of said first protocol stack at a higher level 4 (C₄), and one application layer so that the flow of application-type data is authorized between said smart card and said terminal.

29. A system of architecture for communication between a terminal, and a smart card comprising a smart card reader for communication with the smart card, a data transmission network (RI), said terminal having a first protocol stack for network (RI) access, said first stack comprising a number of communication software layers (C₁-C₄), and said smart card reader, and said smart card having a second protocol stack and a third protocol stack, each comprising lower order software communication layers (CC₂-CC₁, CCa₂-CCa₁), for allowing data exchange between the smart card and said terminal, said smart card having a first specific software item, which functions as an interface with said lower layers (CCa₂-CCa₁) of the third protocol stack and with at least one application registered in the smart card, said terminal having a second specific software item, which functions as an interface with said lower layers (CC₂-CC₁) of the second protocol stack and with determined layers of the first protocol stack (C₂, C₃), wherein said first and second specific software items are adapted to cooperate with each other in order to establish a bi-directional data exchange session between said terminal and said smart card, whereby said smart card supplies said terminal with a predetermined terminal virtual model, which transforms said smart card into at least one of a server and a client.

30. The architecture of claim 29, wherein said server and/or client is both mobile and portable.