Method, system and adapting device enabling a data exchange between a communicating object and a processing unit

p0001The present invention relates to a method and system to enable a data exchange between a communication device and a processing unit. More particularly, the invention relates to a matching device to enable this exchange of data.

p0002The invention finds particular application in the identification market. The identification of market, better known under the acronym "IAM" for "Identity and Access Management," based on several advanced technologies, among others, users authenticate to certain computer equipment from the personal computer type, mobile phone, PDA, etc.

p0003One of these technologies is to use a card with secure chip, attached to one and only one user, containing the information required for authentication of it, such as digital certificates, encryption keys, passwords or biometric information.

p0004To access information or certain applications contained on the computer equipment itself or on the local computer network, the user must present their smart card to the computer system. The computer system is then able to verify that the information contained in the chip card are those of the user requesting access. This is called "weak authentication" user.

p0005In some cases, a password or additional biometric verification is requested by the computer system to verify that the holder of the smart card is properly the user. This operation is called "strong authentication" of the user. The authentication type depends on the security policy in place for a dedicated infrastructure. Reading the information contained in the chip card is performed through a dedicated device called "chip card reader." This device can be in the form of an internal or external device, mostly connected to the computer equipment through a wired connection such as USB or RS232.

p0006In some environments where user mobility is important, the use of this device is highly inappropriate. This is particularly true of hospitals where nursing staff must be able to authenticate on multiple workstations within the precincts of the institution, in order to access certain confidential data such as patient records . In this use case, the recurrent manipulation of the smart card becomes tedious, and can lead to a security risk if the user forgets his smart card in the reader, which would allow an attacker access thereafter the same information.

p0007In some specialized services, handling of the smart card reader and use is simply prohibited to prevent the spread of certain germs that can grow inside the drive itself.

p0008To meet these needs, the inventor has devised solutions for new devices to enable authentication of the user faster, more ergonomic while strengthening the security level.

p0009These solutions equip the user with a smart card reader said "mobile", which is inserted in the smart card of it, to communicate with a remote station through a short or medium radio link range as Bluetooth, WiFi, or Wireless USB.

p0010This device allows the user to move from one workstation to another while keeping the device on itself and without having to manipulate the smart card. To communicate with the mobile device, computer equipment must itself have a radio frequency compatible interface.

p0011Two options were considered in the prior art to communicate with the mobile card reader: either the computer equipment has an internal radio frequency compatible device in which case it can be used to communicate with the mobile player or otherwise, it is necessary to extend the communication interfaces of computer equipment, adding an external device such as a USB key - Bluetooth, USB - WiFi or USB-USB Wireless.

p0012To ensure interoperability between IT systems and solutions based on smart card technology, several application communication interfaces, better known as the API acronym for "Application Programming Interface", are standardized to this day and implemented on most systems.

p0013One such application communication interfaces, known by the acronym CCID "Integrated Circuit (s) Cards Interface Device" to "card interface Dispositiif Integrated Circuit," allows any computer equipment to access the information of a smart card through a reader connected via USB. In this case, the integrator of smart card reader is at no time obliged to install driver software, commonly called "driver" to be recognized by the system, if it implements an interface compatible player with CCID specification.

p0014Most operating systems like Windows, Mac OS or Linux, used by most computer workstations, by default incorporate this CCID interface.

p0015By cons, there is to date no application communication interface standard, or large-scale deployment of IT equipment based on wireless technologies.

p0016smart card reading devices based on wireless communication technologies, such as mobile readers in development described above, therefore pose a real problem of interoperability.

p0017This would require the mobile drive manufacturer to develop and install its own driver software on a given computer equipment. This task becomes even more complex than the driver software will be available in several versions depending on the operating system used, see the model of the physical device on the computer equipment; this greatly complicates the maintenance of the solution on a heterogeneous IT assets.

p0018In some cases, the deployment of this type of solution can be difficult or possibly impossible. This is particularly true of IT infrastructures migration or software updates must be performed on a large scale, involving major costs of intervention, or should be limited under a particular security policy to minimize software incompatibilities caused by this update. In general, the inventor believes that today there is a need for local hardware capable of communicating directly with mobile devices wireless devices. For example, a computer must be able to communicate with a device such as a smart tag if one provides a Bluetooth interface and NFC to this device.

p0019Further, such wireless mobile devices may require efforts to promptly determine and secure the connection with the local computer.

p0020In practice, the inventor believes that the operating principle above has the disadvantage of requiring multiple developments including adaptations software "middleware" on the data processing equipment as the communication drivers without wire medium / long range , controllers, wireless drivers and existing operating system and development of new specific pairing services.

p0021Moreover, it is known in the prior art, communication adapters devices including USB keys or insertable communication cards in a port of a host processing unit such as a computer, printer, modem, or equivalent and transform the data received by a protocol to another protocol compatible with the host processor.

p0022These adapters have in principle a connection or interface with the host device such as a USB, PCMCIA and a connection or communication interface to the outside such as a wireless interface, NFC radio frequency, Bluetooth, optical, infrared, etc.

p0023These adapters generally include data processing means for performing an exchange protocol adaptation and / or adaptation of data formats to be exchanged between the portable device and the processing unit. They also include statement means to inform the processing unit on the technical capabilities of the mobile device in order to select appropriate means of communication such a communication driver. According to the USB standard, these capabilities or identifiers are associated with values ​​called "classes". For example, a USB / Bluetooth declares in a class corresponding to its own characteristics: a device having a Bluetooth communication interface.

p0024The invention aims to solve the above problems.

p0025The invention generally aims to a method and system for communication between components or deported objects and a processing unit.

p0026The invention also aims to develop a mobile device wireless device, including a badge holder, allowing deportees components, such a smart card, a media card, in connection with the mobile device to communicate with a device unit treatment as a local computer via a wireless communications link such as Bluetooth, WiFi, ZigBee, Ultra Wide Band, etc.

p0027The invention consists, in a preferred embodiment, to use an intermediary device (adapter), arranged between the local computer and the mobile device wireless device; The adapter provides during an exchange with the host computer, features "classic", representative of the mobile device wireless and / or related components and generally supported by the computer, including card interface features chip (CCID) and / or mass storage.

p0028To this end, the invention relates to a matching device to enable a data exchange between a communication object and a processing unit, said adjustment device comprising:<ul><li>information reporting means for reporting to the processing unit of the technical capabilities of information enabling it to select a driver / appropriate means of communication,</li><li>data processing means, said means being adapted to perform an exchange protocol adaptation and / or to exchange data formats between the processing unit and the communication object;</li></ul>The adapter device is characterized in that said technical capabilities of information reported by the reporting means are on a separate object of the adapter, said capacity being received by the processing unit to be virtually on the device 'adaptation

p0029According to other characteristics of the invention:<ul><li>Said technical and / or data format are supported by the communication object itself;</li><li>Said technical and / or data format are supported by another object / component in relation to the communication object;</li><li>Such technical and / or data format that declares to the processing unit are on a type of smart card interface (CCID) and / or mass storage capabilities (MS), of so as to be virtually seen and considered by the processing unit as having the capacity and / or these features;</li><li>The adjustment device comprises means pairing the second type of communication (BT).</li></ul>

p0030The invention also relates to a method for adapting to allow an exchange of data between a communication object and a processing unit, said adaptive method comprising the steps of:<ul><li>reporting information to declare to the processing unit of the technical capabilities of information enabling it to select a driver / appropriate means of communication,</li><li>data processing, said means being able to perform an exchange protocol adaptation and / or exchange data formats between the processing unit and the communication object;</li></ul>The method is characterized in that the technical capabilities of information reported by the reporting means is on a separate object of the adapter, said capacity being received by the processing unit to be virtually on the adaptation device.

p0031The invention also relates to a communication system between a communication object and a processing unit, comprising: <ul><li>a communication object with technical and / or being able to implement a type of data format,</li><li>a processing unit adapted to implement or select an appropriate communication in response to information received from the technical and / or data format implemented or supported by the communication object.</li></ul>

p0032Thus, the host computer can directly communicate and interact with the device using the generic drivers of the operating system without requiring a specific driver installation.

p0033Thanks to the invention, no development or driver specific installation is required on the local computer. No specific modification software "middleware" is required in the processing unit.

p0034The solution is used directly for immediate deployment of a hands-free solution to a current smart card infrastructure. If applicable Similarly, the invention can be deployed on computers that are not equipped with wireless communication interface. The integration of this solution is easy, immediate and transparent to the end user.

p0035Other features and advantages of the invention will become apparent from reading the description given by way of example and with reference to the accompanying drawings wherein:<ul><li>The <figref idrefs="f0001">figure 1</figref> illustrates a communication system in accordance with a general embodiment of the invention;</li><li>The <figref idrefs="f0002">2</figref> illustrates an adapter device according to one embodiment of the invention;</li><li>The <figref idrefs="f0001">3</figref> illustrates a communication system according to another embodiment of the invention;</li><li>The <figref idrefs="f0002">4</figref> illustrates a communication system according to a secure mode and complete the invention.</li></ul>

p0036To the <figref idrefs="f0001">figure 1</figref>, A communication system S1 according to a general embodiment of the invention includes a processing unit UT, OC communication object and an adapter device DA. If applicable, (dotted line), the system may include at least one component OC1, OC2 in connection with this communication object. To this end, communication is established between the object or OC OC1, OC2 and the processing unit through the DA adapter via communication channels 6, 5. The channels may be in contact or wireless, etc.

p0037A communication object, in this case in the example, a card reader can be any communicating object with a memory and an interface 6 for communication; For example, it may be a smart card with contact or contactless, an electronic tag, a reader, a smart key, a watch, a digital photo frame, a phone, a camera, a video camera, a reader printer card (s) or not.

p0038These objects or components each have their own technical capabilities and implement specific data exchange protocols; The components are preferably of cards inserted in the communication object, such as an ISO 7816 card or mass memory card, but they can be the same type as the OC communication object.

p0039The processing unit UT or computer equipment is able to implement or select an appropriate communication in response to information about the technical capabilities and received a device; This is particularly true of the procedure declaration of USB communication bus, allowing the processing unit to select a driver "driver" and therefore a control set associated device according to the subject of declaring class.

p0040The processing unit with a communication interface 5 (BT) with the outside, in this case a personal computer or PC computer equipment, can be any processing unit, such as PDA, phone, camera , a video camera, printer, etc.

p0041The adapter device allows computer equipment to communicate with the CA object and / or one or more components OC1, OC2 in relation to this object. DA matching device is described below in connection with<figref idrefs="f0002">2</figref>.

p0042To the <figref idrefs="f0002">2</figref>The adaptation device in the example is a USB stick with a physical interface 8a Bluetooth and USB physical interface 5a wired or not. However, it may include other types of additional interface or instead, such as infrared, NFC, to electrical contact or not identical or not, on either side. Communication with the outside, including the OC object of type and Bluetooth with USB processing unit. The adapter is preferably close to the processing unit while the portable object is further away.

p0043More particularly, the DA adjustment device is adapted to effector operations enabling a comprehensible data exchange between the CB communication object and the processing unit UT and / or vice versa. It comprises for this purpose the data processing means (μC); The μC1 means may include or constitute a microcontroller or wired equivalent means without processor or embedded processor.

p0044According to a preferred embodiment, these means are suitable in particular to make an exchange protocol adaptation and / or adaptation of data formats to be exchanged between the CB communication object and the processing unit UT including under executing at least one program C1, C2, protocol transcription C3..Cn / extraction / encapsulation / transfer of data exchanged.

p0045This device also comprises DA DI information statement means to inform the processing unit of information comprising or representing technical and / or data formats, so as to cause a selection of an appropriate communication driver in the processing unit and communicate more fully with the particular adapter device.

p0046This information DI may be a value stored in the memory of the microcontroller or memory associated with it, representing the technical capacity or belonging to a unit class may be recognized by the processing unit as a standard. In a communication (and standard) USB, information can match the value of the class of an appliance. Where appropriate, the information may be at the interface 5a of the adapter with the processing unit.

p0047Similarly, the operation of the processor system (<figref idrefs="f0001">fig.3</figref>) Including "Windows XP" automatically includes the drivers corresponding to different classes declared.

p0048According to a general feature of a preferred embodiment of the invention (<figref idrefs="f0001">Fig. 1</figref>) Information DI above-informed or declared by the DA matching device to the processing unit UT is on the OC communication object, or at least one component OC1, OC2 in relation to this subject as described below.

p0049Capacity is received by the processing unit to be virtually on the adapter device when they belong to a separate object. The processing unit DA dialogue with the device as if it had the technical capacity or as if it belonged to the declared device category.

p0050The DA matching device is able to analyze the various exchanges between the CB communication object and the processing unit UT to maintain the context of ongoing communication. According to the embodiment, the device DA may or may not intercept and answer some queries sent by the processing unit UT when the connection with the communication object OC is broken. In most cases, a notification is sent by the adaptation device to inform the petition and rejected, and / or that the communication object is temporarily not accessible. This is the case for exchanges of type commands / responses, where the driver of the processing unit is still awaiting a response from the device.

p0051In a first embodiment, the technical capabilities or data format are supported by another device / object / device placed in connection with or constituting the OC communication object. This mode may correspond to a particular preferred embodiment of the invention that is the subject of communication such as a smart card reader ISO 7816 and / or mass memory card eg SD-type as shown in after;

p0052In the preferred example, the DI information relating to the technical and / or data format, declared to the processing unit is specific to a type of smart card interface (CCID) and / or mass storage capabilities (MS). Thus, the adapter, set nearby, can be virtually seen and considered by the processing unit as having the capacity and / or the functionality of a device or object disposed away from the processing unit.

p0053In a second embodiment, the communication object itself supports such technical capabilities or data format. For example, the object may be an apparatus having a chip card type chip to chip welded or permanently fixed in the device, a soldered memory card, hard disk ....

p0054In other embodiments, the CB object can be a card or any remote device or not and communicating itself, including Bluetooth path and / or NFC radio frequency or ISO 14443.

p0055The <figref idrefs="f0001">3</figref> shows another preferred example of implementation of a system S2 according to the invention, using a card reader mobile chip having a radio frequency interface "Bluetooth."

p0056The purpose of this example is to propose a solution for routing data between codes or computer equipment 10 and a card reader for mobile chip 11 via a DA1 adapter device or USB device says " adaptation. "

p0057This adapter DA1 advantageously comprises communication devices compatible with the application standard communication interfaces deployed to date including an interface with the processing unit. It includes as an embodiment, a wireless link short or medium range (BT) and an interface 15a with the computer equipment.

p0058In this example, the DA1 adapter is equipped with a wired USB interface 15a slave to exchange data frames with the master computer equipment, the frames are formatted according to CCID specification. It also includes an RF interface 18a to exchange data frames with mobile remote device 11 or OC3, and formatted according to the Bluetooth specification). It comprises a μC1 microcontroller whose function is to encapsulate / decapsulating and transfer data frames between the wired interface and radio frequency.

p0059According to this embodiment of the invention, the adapter has a DA1 application communication interface 19 compatible with the specification CCID. The adapter is as the computer system to be virtually himself a card reader. It transmits a particular class code corresponding to the smart card reader the setting information of the protocol layer, as well as different software features and / or physical of the device which are interpreted by the processing unit to select the driver and / or necessary physical interface.

p0060The mobile device 11 thus includes a card reader for mobile chip, which is inserted in the smart card of OC3 user. The reader transmits the exchanges between the smart card and remote computer system via a wireless interface "Bluetooth" 16b.

p0061According to an operation of this embodiment, the device adapter DA1 encapsulates the data of CCID protocol for the reader, the protocol used by the short or medium range wireless connection (Bluetooth). This is done here by μC1 microcontroller of the adapter or in an equivalent manner by a protocol transcriptionist or encapsulating medium data format and / or the implementation of an application layer performing this operation. A complete frame conforms here to CCID protocol is then forwarded by radio frequency to the mobile reader 11 to the smart card OC3. This is called "encapsulation" (tunneling) of CCID frames.

p0062In parallel, the DA1 drive mobile smart card has a short and medium-range interface (Bluetooth) and 18b μC2 processing means, C4 program respectively retrieve and uncap the frames received from the adapter to transmit to turn to the chip card OC3. Conversely, frames to CCID protocol OC communication object or in particular the chip card OC3 to the processing unit 10 may be encapsulated by means μC2, C4 to be transmitted or conveyed via Bluetooth interface 18b to the processing unit. These frames are then retrieved by the Bluetooth adapter DA1 18a of the interface, and then extracted or decapsulated by the processing means μC1, C1 program that can be the same type (or equivalent) as UC2, C4 of the object communication.

p0063The frames at CCID protocol or format are then transmitted via the USB interface adapter DA1 by the processing unit 10; The processing unit will be first selected the driver or the standard application capable of interpreting the CCID frames especially during the first connection of the adapter to the processing unit.

p0064The invention can make fully transparent (or no) communication wireless short or medium range between the purpose of communication and the processing unit. This is done without application modification of the processing unit since the invention uses application communication interfaces standards, supported by the processing unit, such as USB and CCID.

p0065In this example, computer equipment 10 consists of standardized software components including applications, services / APIs smart card, generic CCID driver, without any addition of application or driver to the implementation of the communication with the object OC or OC3 communication.

p0066To the <figref idrefs="f0002">4</figref>According to a more secure and comprehensive embodiment of the invention, the system S3 (or method) capable of communication by implementing a security step of a first wireless communication with a remote object and optionally directly or indirectly with objects of different type OC3, OC4 and / or through or not an OC communication object. The safety step may however be implemented even with one object among OC, OC1, OC2, OC3, OC4.

p0067For safety, the invention uses means for initiating and / or establish a second type of communication (BT) between the adapter and the communication device or object associated with it. So rather than provide safety equivalent means at the processing unit 20, which would make the security operation complex (new driver, new application including pairing ...), these security means are provided between the communication object and the adapter.

p0068According to one embodiment of security, the invention comprises means pairing AP1 of the second type of communication (BT). Other secure communication means may be provided such as, for example, entering a secret code by the user if the devices are equipped with a type of user interface display and keyboard, and if necessary encryptions / decryption data exchanged.

p0069In a preferred embodiment, the means pairing implement or use a third type of communication (NFC) short / medium range. A trade secret and / or key occurs between the adapter and the associated item on this short-range communication (NFC) to secure the second BT communication between the adapter and the communication object. Preferably, the third type of communication (NFC) has a range lower than the second type of communication (BT).

p0070The communication object 21 comprises a card reader OC3, OC4, a wireless communication link (Bluetooth) 18b, a communication link (NFC) short-range 16a ,. In the example, the reader is actually a door badge, the badge is in the form of chip card OC3.

p0071The adapter has similar or identical means described in the preceding figure, (the same references indicating the same means) also a wireless communication link (Bluetooth) 18a, a communication link (NFC) short-range 16a and a connection 15a 5 including USB communication with the host computer 20, a microcontroller μC2, card drivers of chip and mass MS memory card.

p0072The adapter also includes one or more AP1 firmware, C1, C2, C3, C4, and is responsible for maintaining a complete sequence of NFC pairing with the card reader 21 (which has its side complementary means AP2), start a secure Bluetooth connection with the reader, to transmit the information to CCID DI statement and / or MS mass storage to the processing unit and exchange data packets or frames between the drive and the host computer C1, C2. These programs allow as previously performing an encapsulation operation of the Bluetooth protocol / decapsulation Bluetooth protocol respectively frames sent / received, the latter are in the chip card format or the SD mass storage format.

p0073During the reporting stage, as previously, the adapter declares to the host computer information on a type of smart card interface (CCID) and this time also the mass storage capabilities (MS) .

p0074The host computer that activated the generic drivers 23, 24 or corresponding applications following the statement, it is able to communicate directly with the remote communication object without adding additional driver. Thus, the host computer can directly communicate and interact with the smart card reader and SD type using generic drivers of the operating system (no installation of special driver software is required).

p0075This principle of operation, the host computer "sees" just a smart card reader and / or a hard disk or mass storage device plugged into the USB port 15b.

p0076The process to enable data exchange between an object of communication and processing unit includes a reporting step in the processing unit, to inform the processing unit on technical and / or manner of data format to implement appropriate communication.

p0077The adapter includes information statement means preset or adjustable DI, including the user, depending on the communication object to associate with the adapter 21. The declaration means can be automated, for example, following an exchange with an associated communication object OC, OC3, OC4, the object can declare its particular characteristics to the adapter with one of the available interfaces.

p0078Alternatively, the user can select the adapter operation and / or representative values ​​of characteristics (class of the object of communication) or load program (safety, pilot ...) related to the subject of partner communication. Reporting Information can also be triggered in particular by detecting the insertion player or presence of any card or other object in relation to the player. In the example, the adapter has been factory programmed with information to declare for the types of ISO 7816 and SD cards intended to be inserted into the badge holder.

p0079Thus, when the adapter is connected with the processing unit, the adapter declares transmission to the processing unit, an ID information on technical capabilities or data format for an interface type smart card (CCID) and / or mass storage capabilities (MS).

p0080Thus, the adapter is virtually seen and considered by the processing unit as having the capacity and / or functionality of an ISO card or SD card mass memory or more precisely as an ISO card reader or card SD. The computer can then implement drivers / software interfaces and / or corresponding physical.

p0081During communication with the processing unit, the adapter performs transparent data processing, of performing as before, an exchange protocol adaptation and / or adapting to exchange data format. The adapter receives, for example, the host unit 20 frames or data packets to the chip card format ISO 7816 or for a smart card ISO 7816.

p0082The adapter then performs a protocol adaptation operation and / or data format. The frames received from the processing unit 3 are encapsulated in the format or as the existing communication protocol between the adapter and the associated object, especially here in the example, the Bluetooth protocol. Another contact-type communication is not excluded.

p0083The frames of data in accordance with ISO 7816 or adapted to CCID interface are encapsulated and transmitted by the adapter via its Bluetooth interface. The encapsulated data is received by the communication object associated here the door badge reader on its Bluetooth interface and processed by him so as to extract the encapsulated data and transmit them to the smart card ISO 7816.

p0084The invention proceeds in a similar manner to the data to the SD card. The host unit implements the appropriate means including the standard pilot MS, mass memory or hard disk. Similarly, the adapter performs the operation encapsulation and encapsulating frames in MS mass storage format.

p0085The badge holder reader performs similarly to an encapsulation / MS mass encapsulating the memory type frames to transmit in Bluetooth adapter to form respectively from the card or form of MS frames to the SD card from of the adapter. The inverse operation of data streams is provided in the badge holder, if any.

p0086Prior to these exchanges, the adapter is preferably provided to perform a pairing communications, including Bluetooth. For this purpose, the adapter initiates a third communication including short-range type here in the NFC for example with the badge holder. The adapter also performs pairing of exchanging secrets or keys for secure communications including Bluetooth. Alternatively, this pairing can be initiated and managed by the badge holder.

p0087The invention avoids any change in the processing unit 20 to perform secure exchanges including Bluetooth channel. In particular, there is no need for software adaptation of the processing unit. II users simply connect the adapter to the processing unit to establish a secure communication with the two cards door-badge reader.