• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    The invention relates to a method for authenticating an application, executed on a terminal (103), with a service provider (104), comprising steps of: - Receiving an access request (203) to data, by the service provider (104), - In response to the request (203), the issuance, by the service provider (104), of a request (204) of a valid token, - Reception (209), by service provider (104), of an encrypted token, - Token verification, during which the token is decrypted with a private key, said private key being stored by the service provider (104) , - Opening (210) access to the data.
    公开号:FR3022664A1
    申请号:FR1455686
    申请日:2014-06-20
    公开日:2015-12-25
    发明作者:Mirand Sylvain Patureau；Carmela Troncoso；Dieguez David Chavez
    申请人:Peugeot Citroen Automobiles SA；
    IPC主号:
    专利说明:

    [0001] The invention relates to the authentication and management of rights in the context of exchanges of data between different computer systems such as an electronic box in a vehicle, mobile equipment (smartphones, tablets). , laptop ...) and landed systems (also called cloud in English). Document W02011031272 discloses a method for secure authentication and connection. The method uses a module of the secure platform for authentication and access to data. According to this method, a user registers an identity with an identity provider. When the user connects to a service provider using this identity, the identity provider requests the user to provide appropriate credentials. These credentials include a ticket generated on the secure platform. This allows the user to log in to the identity provider without the need for a password. The disadvantage of such a method is that the user must have access to a secure platform (that is, specific hardware) to register an identity. With such a method, a user can not identify with a mobile phone. The invention therefore aims to overcome the aforementioned drawbacks by providing a method of authenticating an application executed on a connected terminal, the terminal is not necessarily provided with a security device.
    [0002] It proposes more specifically for this purpose a method of authenticating an application, executed on a terminal, with a service provider, comprising steps of: - Receipt of a request for access to data, by the service provider, 30 - In response to the request, the issuance, by the service provider, of a request for a valid token, 3022664 2 - Receipt, by service provider, of an encrypted token, - Checking the validity of the token, during which the token is decrypted with a private key, said private key being stored by the service provider, 5 - Opening, by the service provider of a data access, if the token is validated. The invention makes it possible to receive authentications and authorizations from a terminal that does not include specific security equipment. The transmission of these authentications and these authorizations is ensured by means of authorization tokens which are encrypted and readable only by the service provider. Advantageously, the authentication method according to the invention further comprises steps of: - Redirection, from the application, to an identity provider, - sending, by the application, a request from an token for the identity provider, - Creation, by the identity provider, of a token dedicated to the service provider, said token being signed and encrypted, - Transmission of the token to the application, the application transmitting the token to the service provider. According to one characteristic of the invention, the token verification step further includes verifying the signature of the token, the token being valid if it is signed by the identity provider. Preferably, the token comprises: an identifier of a user of the application, a unique identifier of the service provider, authorizations, and an identifier of the application. Advantageously, the authentication method according to the invention further comprises a step of authenticating the user with the identity provider.
    [0003] The invention also relates to electronic equipment comprising a memory storing data characterized in that it comprises: means for receiving a request for access to the data, means for transmitting a request, a valid token, 5 - means for receiving an encrypted token, - token verification means comprising means for decrypting the token with a private key, said private key being stored in a secure memory of said electronic equipment, means for opening an access to the data.
    [0004] The invention also relates to a vehicle comprising electronic equipment according to the invention. The invention also relates to an authentication system comprising electronic equipment according to the invention and / or a vehicle according to the invention.
    [0005] Other features and advantages of the invention will be apparent from the following detailed description, and the accompanying drawings, in which: - Figure 1 illustrates a schematic view of the system according to the invention; FIG. 2 illustrates a diagram showing steps of the method according to the invention; FIG. 3 illustrates a diagram representing additional steps of the method according to the invention. The attached drawings may not only serve to complete the invention, but also contribute to its definition, if any.
    [0006] With reference to FIG. 1, the authentication system according to the invention comprises at least one terminal 103, a service provider 104 and an authentication authority 101. The invention makes it possible to transmit authentications and authorizations between in-vehicle elements and landed items. The transmission of these authentications and these authorizations is ensured by means of authorization tokens 3022664 4 also called token or "identity credentials" in English. In the following, we consider as a non-limiting example that the terminal 103 is a smart mobile phone (also called smartphone in English). But the invention is not limited to this example. Indeed, the terminal 103 may be a laptop, a touch pad, or any other connected object (i.e. capable of exchanging data via a wireless connection). This mobile equipment (or connected object) belongs, for example, to the driver of a vehicle or to one of the passengers of the vehicle. The service provider 104, 104 '(or SP for "Service Provider") is an IT resource. SP 104 controls access to data or commands to perform an activity. SP 104 protects access to data and applications. It refuses any access without prior authentication. Advantageously, it redirects the unauthenticated user to an identity provider. Access to the service is therefore restricted.
    [0007] Users must be identified before they can access data or start the execution of an order. According to one characteristic of the invention, the tokens used to transmit the authorizations are encrypted (or encrypted) according to an asymmetric cryptography mechanism (also called public key cryptography). In such a system, a pair of keys is used: a public key for encryption and a private key for decryption. When a resource sends a token to another computing resource, it simply encrypts the token to be sent using the recipient's public key. The latter will be able to decipher the message using his private key (which he is alone to know). Tokens are also signed by a trusted authority (Idp 101) to ensure that they are compliant and that they come from an authorized source. The tokens incorporate the authorizations for giving access to functions or data on the services hosted on the infrastructures, in partners or on connected boxes (SPs). Authorizations are checked by the SPs by either polling to a reference directory or to a manifest allowing to make permissions that may be common in the token but do not provide the same services on the different systems. According to a feature of the invention, the SP 104 includes a secure storage space capable of storing a private key used to decrypt the authorization tokens. The secure storage space is for example a Trusted Platform Module (TPM) chip, which is a hardware cryptographic component for storing secrets (such as encryption keys) securely. In what follows, it is considered as a non-limiting example that the SP 104 is an electronic box of a motor vehicle. The electronic box is an onboard device of the vehicle that is the border of the vehicle data to the outside through various means: cable, wireless protocols (wifi, bluetooth, 3G, etc.).
    [0008] But the invention is not limited to this example. Indeed, the SP can be a management information system 104 'or the system that controls a numerically controlled machine or more generally any connected object (ie capable of exchanging data via a wireless connection) and comprising a secure storage space capable of storing a private key. Identity Provider 101 (or IdP for Identity Provider) is responsible for authenticating the user as well as retrieving additional information associated with his identity. According to a feature of the invention, Idp 101 includes means for electronically signing authorization tokens. The electronic signature makes it possible to guarantee the integrity of a token and to authenticate the author. The electronic signature system uses a pair of keys. A private key used to sign a token and a public key to read the signed token.
    [0009] According to one characteristic of the invention, the Idp 101 includes means for encrypting the token. The token is encrypted using a public key associated with the SP 104 for which the token is intended. In this way, the encrypted token is only readable by the SP to which it 3022664 6 is intended. The identity provider allows the users 102 to authenticate and receive tokens on their PC or smartphone 103 allowing them to be recognized and to carry authorizations on landed infrastructures but also to use them on the connected boxes for access specific functions. The system also includes a public key infrastructure 110 (PKI) A PKI is a computer resource for generating, distributing and publishing certificates 10 to the various necessary components (SP, IdP ...) . The IdP 101 and the various SPs 104, 104 'each have a certificate of their own. Recall that a certificate (or electronic certificate) is a set of data containing at least one public key, at least one identification information (for example: a name, usually stored in a data field called CN for "Common" Name ") and at least one private key to sign. The system also includes a client database 111 for identifying a client, authenticating it, and assigning services that are assigned on an SP 104.
    [0010] The system also includes a vehicle database 112 for identifying the SPs and for joining the identification of the SP and its certificate (the vehicle with its VIN for Vehicle Identifier Number a unique identifier associated with the vehicle, its UIN Unique Identifier Number - a unique identifier associated with the box and the link to the associated certificate).
    [0011] The system also includes a service database 113 listing services available on the SPs and assignable to the clients (service catalog). Figure 2 shows a diagram illustrating the different steps of the method according to the invention.
    [0012] The method firstly comprises the connection 201 of the telephone 103 to the electronic box 104 of a vehicle. The connection is a wireless connection (eg wifi, bluetooth or 3G).
    [0013] The next step is startup 202, at the instruction of the user of an application, the application being executed on the telephone 103. It is assumed that the application requires the use of data or commands provided by the user. In this example, it is considered that the application makes it possible to open the vehicle remotely using the telephone 103. The application transmits, via the telephone 103, a request for access to data ( and / or commands) to the electronic box 104. In the example, the application must in particular be authorized to operate the opening and closing commands of the vehicle. In response to this access request, the electronic box 104 requests the application a valid authorization token. If the application has a valid token then it transmits it to the electronic box 104 otherwise the electronic box 104 redirects the application 205 to the Idp 101.
    [0014] The application 206 then requests an authorization token from Idp 101. This request specifies to which SP the token is to be sent as well as the authorizations necessary for the execution of the application. The next step is the authentication 207 of the user with the Idp 101. This authentication can be done according to different means according to the known art, for example, with an identifier and a password. Once the user is authenticated and in response to the token request, Idp 101 creates and issues a token to the application. The token is signed with the private key of Idp 101. Advantageously, the token is encrypted using the public key of the electronic box 104, so that only the electronic box 104 is able to decrypt the token. The token also includes a description of the authorizations granted by the Idp 101. Advantageously, the token is in an OAuth format, a description of which is available on the date of filing of the patent application on the "http" website. : //oauth.net/ ". In response to receiving the token, the application transmits the token to the electronic box 104.
    [0015] Upon receipt of the token, the electronic box 104 performs token verification and if the verification is positive (that is, if the token is valid) then the electronic box 104 opens access to the data in accordance with the permissions indicated in the token.
    [0016] 5 Verification includes verifying the signature of the token. The electronic box 104 uses the public key of Idp 101 for this verification. When checking the signature by the SP, the CN field or "common name" contained in the certificate is also used to check the provenance of the token. CN must match the name of the authorized signing authority. The name of the authorized signing authority is stored in a memory of the SP 104, advantageously, the secure memory of the SP 104. The verification also includes the decryption of the token. The token is decrypted with the private key of the electronic box 104.
    [0017] The electronic box 104 extracts from the token, the user's identifier, the identifier of the electronic box 104 called UIN (for Unique Identifier Number), the identifier of the application as well as the granted permissions. The SP 104 also verifies that the permissions described in the token correspond to the authorizations requested by the application in the access request. If not, access to the data is denied. As previously explained, the authorizations are advantageously grouped together, the token then indicating the sets of permissions granted by the Idp 101. To make the correspondence between these sets and the authorizations, the electronic box 104 uses a correspondence table called manifest. In summary, a token is generated to authenticate. It is encrypted with the public key of the certificate of SP 104 and signed with the private key of the certificate of Idp 101. The token is a kind of container guaranteeing the authenticity of its transmitter. This container can only be opened by the vehicle for which it is intended. Advantageously, the invention also makes it possible to transmit authentications and authorizations from an on-board electronic box 3022 664 9 in a vehicle to landed service providers. The transmission of these authentications and these authorizations are also ensured by means of authorization tokens. These authorization tokens are distributed by a second Idp 101 'dedicated to the identification of vehicles.
    [0018] With reference to FIG. 3, the authentication method further comprises a step 301 for establishing a secure network connection between the electronic box 104 and the second Idp 101 '. The electronic box 104 authenticates with the second Idp 101 '. The authentication is performed with a certificate stored in the secure memory of the electronic box 104. The electronic box 104 302 requires an authorization token second Idp 101 '. This request specifies to which SP is intended the token as well as the necessary authorizations. Once the electronic box 104 has been authenticated and in response to the token request, the second Idp 101 'creates and sends 303 a token to the electronic box 104. As before, the token is signed with the private key of the second Idp 101 . Advantageously, the token is encrypted using the public key of the SP 400, so that only the SP 400 is able to decrypt the token. In response to receipt of the token, the electronic box 104 transmits 304 the token to the SP 400. Upon receipt of the token, the SP 400 performs a token check and if the check is positive (that is, if the token is valid) then the SP 400 opens access to the data according to the permissions indicated in the token.
    [0019] These tokens allow the electronic box 104 to consume services on infrastructures landed from partners or internal (for example navigation or mapping services). These tokens also make it possible to authenticate an electronic box of a vehicle with an electronic box of another vehicle so as to exchange data in a secure manner.
    权利要求:
    Claims (8)
    [0001]
    REVENDICATIONS1. A method of authenticating an application executed on a terminal (103) with a service provider (104), comprising steps of: Receiving a request (203) for access to data by the provider in service (104), In response to the request, the issuance by the service provider (104) of a request (204) of a valid token, Receipt (209), per service provider (104) ), an encrypted token, Checking the validity of the token, during which the token is decrypted with a private key, said private key being stored by the service provider (104), Opening (210), by the service provider (104), access to the data, if the token is valid.
    [0002]
    2. The authentication method according to claim 1, further comprising the steps of: redirecting (205) the application (103) to an identity provider (101), sending, by the application , from a request (206) of a token, to the identity provider (101), Creation (220), by the identity provider (101), of a token dedicated to the service provider ( 104), said token being signed and encrypted, transmission (208) of the token to the application, the application transmitting the token to the service provider (104).
    [0003]
    3. Authentication method according to claim 2, characterized in that the step of verifying the token further comprises verifying the signature of the token, the token being valid if it is signed by the supplier 3022664 11 identity (101).
    [0004]
    4. Authentication method according to one of the preceding claims, characterized in that the token comprises: an identifier of a 'user (102) of the application, a unique identifier of the service provider (104), authorizations , and an identifier of the application.
    [0005]
    5. Authentication method according to one of the preceding claims, characterized in that it further comprises a step of authentication (201) of the user from the identity provider (101).
    [0006]
    6. Electronic equipment (104) comprising a memory storing data, characterized in that it comprises: means for receiving a request (203) for accessing the data, means for transmitting, for a request ( 204) of a valid token, - means for receiving an encrypted token, token verification means comprising means for decrypting the token with a private key, said private key being stored in a secure memory of said electronic equipment ( 104), means for opening an access to the data.
    [0007]
    7. Vehicle comprising electronic equipment according to the preceding claim.
    [0008]
    An authentication system comprising electronic equipment according to claim 6.
    类似技术:
    公开号 | 公开日 | 专利标题
    US10885501B2|2021-01-05|Accredited certificate issuance system based on block chain and accredited certificate issuance method based on block chain using same, and accredited certificate authentication system based on block chain and accredited certificate authentication method based on block chain using same
    CN102546171B|2014-12-10|Secure element authentication method
    US8640261B2|2014-01-28|Method and client agent for monitoring the use of protected content
    WO2015193578A1|2015-12-23|Method and system for authentication by means of tokens
    JP6586446B2|2019-10-02|Method for confirming identification information of user of communication terminal and related system
    EP3602991B1|2022-02-02|Mechanism for achieving mutual identity verification via one-way application-device channels
    US20140013116A1|2014-01-09|Apparatus and method for performing over-the-air identity provisioning
    CN108141444B|2020-12-25|Improved authentication method and authentication device
    CN110838919B|2021-04-13|Communication method, storage method, operation method and device
    CN111884805A|2020-11-03|Data hosting method and system based on block chain and distributed identity
    WO2018078234A1|2018-05-03|Method for installing a certificate in a vehicle computer, associated computer and system
    JP2021536698A|2021-12-27|Method and device for managing user identification authentication data
    KR102053993B1|2019-12-13|Method for Authenticating by using Certificate
    CN107409043B|2021-07-13|Distributed processing of products based on centrally encrypted stored data
    US9281947B2|2016-03-08|Security mechanism within a local area network
    FR3044500A1|2017-06-02|METHOD AND SYSTEM FOR ACCESS BY A SERVER TO CONFIDENTIAL DATA AVAILABLE FROM A SERVICE PROVIDER
    JP6723422B1|2020-07-15|Authentication system
    FR3044501A1|2017-06-02|METHOD FOR THE TRANSMISSION, BY A TERMINAL, OF CONFIDENTIAL DATA FROM A TELEMATIC VEHICLE CALCULATOR TO A SERVER
    KR102375777B1|2022-03-17|Payment authentication method, device and system for on-board terminal
    KR100892941B1|2009-04-09|Method for security-service processing based on mobile device
    FR3041841A1|2017-03-31|METHOD AND DEVICE FOR ACCESSING A RESOURCE USING A NUMBERED TOKEN
    EP3437294B1|2019-12-04|Remote vehicle control system
    US20190215342A1|2019-07-11|Method and Apparatus for Policy-Based Management of Assets
    FR3093887A1|2020-09-18|Process for issuing, to a nomadic device, an access authorization to a connected computer of a vehicle
    EP2842290B1|2020-09-02|Method and computer communication system for the authentication of a client system
    同族专利:
    公开号 | 公开日
    CN106664294A|2017-05-10|
    FR3022664B1|2017-10-27|
    WO2015193578A1|2015-12-23|
    EP3158710A1|2017-04-26|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US20040230831A1|2003-05-12|2004-11-18|Microsoft Corporation|Passive client single sign-on for Web applications|
    US20060021018A1|2004-07-21|2006-01-26|International Business Machines Corporation|Method and system for enabling trust infrastructure support for federated user lifecycle management|
    US20060112422A1|2004-11-19|2006-05-25|Microsoft Corporation|Data transfer using hyper-text transfer protocol query strings|
    US20110213969A1|2010-02-26|2011-09-01|General Instrument Corporation|Dynamic cryptographic subscriber-device identity binding for subscriber mobility|WO2017168073A1|2016-03-31|2017-10-05|Psa Automobiles S.A.|Remote vehicle control system|
    FR3057973A1|2016-10-25|2018-04-27|Peugeot Citroen Automobiles Sa|METHOD FOR INSTALLING A CERTIFICATE IN A VEHICLE COMPUTER, CALCULATOR AND ASSOCIATED SYSTEM|
    FR3093887A1|2019-03-15|2020-09-18|Psa Automobiles Sa|Process for issuing, to a nomadic device, an access authorization to a connected computer of a vehicle|JP5688087B2|2009-09-14|2015-03-25|インターデイジタル パテント ホールディングス インコーポレイテッド|Method and apparatus for reliable authentication and logon|
    US8768565B2|2012-05-23|2014-07-01|Enterprise Holdings, Inc.|Rental/car-share vehicle access and management system and method|CN109729048A|2017-10-30|2019-05-07|中移软件技术有限公司|A kind of joint qualification method, system, related platform and medium|
    CN108667791B|2017-12-18|2021-01-01|中国石油天然气股份有限公司|Identity authentication method|
    法律状态:
    2015-05-26| PLFP| Fee payment|Year of fee payment: 2 |
    2015-12-25| PLSC| Search report ready|Effective date: 20151225 |
    2016-05-26| PLFP| Fee payment|Year of fee payment: 3 |
    2017-05-23| PLFP| Fee payment|Year of fee payment: 4 |
    2018-05-25| PLFP| Fee payment|Year of fee payment: 5 |
    2018-06-29| CD| Change of name or company name|Owner name: PEUGEOT CITROEN AUTOMOBILES SA, FR Effective date: 20180312 |
    2018-06-29| CA| Change of address|Effective date: 20180312 |
    2020-05-20| PLFP| Fee payment|Year of fee payment: 7 |
    2021-05-19| PLFP| Fee payment|Year of fee payment: 8 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1455686A|FR3022664B1|2014-06-20|2014-06-20|AUTHENTICATION METHOD AND SYSTEM|FR1455686A| FR3022664B1|2014-06-20|2014-06-20|AUTHENTICATION METHOD AND SYSTEM|
    EP15733809.6A| EP3158710A1|2014-06-20|2015-06-05|Method and system for authentication by means of tokens|
    CN201580033186.3A| CN106664294A|2014-06-20|2015-06-05|Method and system for authentication by means of tokens|
    PCT/FR2015/051496| WO2015193578A1|2014-06-20|2015-06-05|Method and system for authentication by means of tokens|
    [返回顶部]