Method for recovery of an authentication code required by a control terminal and corresponding system

0001The present invention relates to the field of communication systems, and more particularly to methods and systems for retrieving an authentication code requested by a control terminal such as an access point to a shared network.

0002In general, the connection of a device or any other peripheral device to a computer network via an access point or gateway, such as the Internet or a shared local network, requires prior authentication or identification procedures for that device by this access point. Thus, such access points typically take the form of, for example, a set-top box or a card built into a router or modem and act as an interface that allows or blocks access of the device to the computer network.

0003Such access points are particularly well known, for example, by the name of IEEE802.11 (well known by the abbreviation Wi-Fi for "Wireless Fidelity"®) or IEEE802.15 (well known by the name of Bluetooth®). Or IEEE802.16 (well known as WiMAX, an abbreviation for "Worldwide Interoperability for Microwave Access"), or RFID (an acronym for "Radio Frequency Identification"), or PLC ("Power-" It can partner with wired or wireless community networks that meet the specifications of standards such as Line Communication (an acronym).

0004For example, in the case of a Wi-Fi access point (also known as a Wi-Fi hotspot or Wi-Fi device), the device authentication procedure specifically sends an authorization code from the device to the Wi-Fi access point. I need. This authorization code can take the form of a security key, such as a WEP key (WEP stands for "Wired Equivalent Privacy") or a WPA key (WPA stands for "Wi-Fi Protected Access") and is followed by a password. It can also take the form of an identifier.

0005In fact, devices such as mobile phones equipped with modules that can communicate with a Wi-Fi access point to connect to a shared network via a Wi-Fi access point are all pre-located near the device. Start the phase of discovering your Wi-Fi access point. In practice, in the context of Wi-Fi wireless communication technology, each access point periodically fires a frame containing a beacon that can identify it among other access points. Once this discovery phase is performed, the device or user selects the access point it wants to connect to from the list of discovered access points. Thereafter the exchange of data begins with the selected access point and the device, the selected access is scan point, the device authentication code, for example, WPA security key by the user corresponding previously acquired from the owner of the access point To request.

0006For example, some service providers generally offer free access to all of their Wi-Fi access points, provided they are pre-registered over the Internet. Authentication codes, which generally take the form of identifiers and passwords, are then valid for all access points belonging to the same provider. However, some users may forget to perform such a registration. Therefore, while traveling, users will notice that they do not have the authorization code required to connect to one of the provider's access points, and thus cannot access the Internet on their device. ..

0007In addition, mobile phone users may find that they are in a geographic area where there is no Wi-Fi access point with their own authorization code. The user may also forget to record or remember these authorization codes, and may also have authorization codes that are no longer valid, for example, in the case of codes that are valid for a limited period of time. .. In this case, the user will notice that they cannot connect to the Internet through these Wi-Fi access points.

<p num="0008"> Therefore, the present invention proposes to improve these situations by providing an alternative solution for retrieving such an authentication code. An object of the present invention is, in particular, to increase the number of methods by which an authentication code corresponding to an access point to the Internet can be retrieved.</p>

<p num="0009"> To this end, the present invention relates to a method of remotely retrieving an authentication code required by a control terminal, such as an access point to a shared network, by a device.</p><p num="0010"> According to the present invention, this method A step of identifying all or some of the control terminals located within a predetermined geographical area by the device. A step of sending a request by the device requesting at least one authentication code corresponding to at least one control terminal selected from the identified control terminals to a remote server using the first communication protocol. When the remote server receives the request, it includes a step of querying a table containing a list of control terminals associated with each authentication code stored in the database. When the selected control terminal and the corresponding authentication code are stored in the table. i) The step of extracting the authentication code associated with the selected control terminal by the server, ii) A step of transmitting the extracted authentication code to the device by the server using the first communication protocol, and iii) The step of transmitting the authentication code corresponding to the selected control terminal by the device in the second communication protocol. To be equipped.</p><p num="0011"> Therefore, this retrieve method corresponds to an exchange mechanism for the purpose of authentication associated with access to the shared network. The peculiarity of this retrieve method is that the communication protocol used between the device and the control terminal is different from the communication protocol used between the device and the remote server. The first and second communication protocols satisfy, for example, very different communication standards. In other words, the device uses two different communication channels, one for exchanging data with the control terminal and the other for exchanging data with the remote server.</p><p num="0012"> Therefore, this retrieve method can be initiated at any time by the device, especially during the process of authentication with the control terminal. The device can retrieve the authentication code required by an already known control terminal or a newly discovered control terminal at any time.</p><p num="0013"> According to the present invention, the authentication code is not limited to the security code or the identifier, and may include any information that enables authentication by the control terminal of the device, in particular, when the device supplies the control terminal.</p><p num="0014"> It should be understood that the term "device" means any piece of equipment coupled to hardware and / or software means that allows communication with a control terminal and a remote server using their respective communication protocols. Such devices may be fixed or mobile and may take the form of, for example, mobile stations, desktop computers, mobile phones, smartphones, tablets, cards and the like.</p><p num="0015"> The hardware and / or software means may be integrated directly into the device or may be, for example, an external module connected to a USB (Universal Serial Bus) device. For example, these hardware and / or software means may take the form of a hardware key (commonly referred to as a "dongle") consisting of integrated circuits coupled to a wireless antenna compatible with wireless communication technology. These hardware and / or software means may be network cards compatible with existing communication technologies.</p><p num="0016"> The device, the remote server and the control terminal may be in different geographic areas, eg, different buildings, different floors, several meters or more apart.</p><p num="0017"> The control terminal can be an access point to a computer network, such as the Internet, a corporate network, or another local network, but it can also be a terminal that verifies and permits access to a building.</p><p num="0018"> In one particular embodiment, the control terminal is an access point to the shared network, and the authentication code is required by the access point to authorize access of the device to the shared network.</p><p num="0019"> Preferably, the network in which the remote server is incorporated is different from the network with which the access point is affiliated, for example, from the viewpoint of infrastructure and / or from the viewpoint of implemented communication technology. In one particular embodiment, the network to which the access point belongs may use medium-range, eg, high data transfer rate communication techniques of about 100 meters, while the network to which the remote server belongs may have low data transfer rates but long distances. For example, a communication technology capable of communicating several tens of kilometers, such as ultra-narrow band (UNB), may be used. Similarly, the server may be affiliated with a private local network and the control terminal may be affiliated with a shared community network.</p><p num="0020"> Advantageously, the second communication protocol is an existing wired or wireless wireless communication standard, such as an Ethernet standard, or IEEE802.11 (Wi-Fi), IEEE802.15 (Bluetooth, ZigBee)), IEEE802.16 ( It is compatible with one of the standard groups such as WiMAX), RFID, PLC, and NFC (near-field communication technology).</p><p num="0021"> In one preferred embodiment, the first communication protocol is compatible with ultra-narrowband radio technology.</p><p num="0022"> Such ultra-narrowband wireless technology is commonly referred to as UNB (an acronym for "Ultra Narrow Band"). In particular, UNB technology uses license-exempt frequency bands (ie, frequency bands that do not require prior permission from the authorized authority) to transmit data to or from a piece of connected equipment in a very narrow spectrum. "Extremely narrow spectrum" means that the width of the spectrum is narrower than 2kHz or 1kHz. UNB technology enables long-distance (especially free space up to 40 km) wireless communication at low data transfer speeds (typically about 10 b / s ~ 1 kb / s), especially machine-to-machine (M2M) or "things". Very suitable for building low data transfer speed communication networks such as the "Internet of Things" network. An exemplary communication system that implements such UNB technology is specifically disclosed in an international patent application published under WO 2013/068559.</p><p num="0023"> In practice, the device's identification step of the control terminal includes a phase of discovering all or some of the control terminals located within the geographical area around the device, and at least one identifier of the discovered control terminal. It has a step to retrieve.</p><p num="0024"> Of course, the extent of the geographical area depends on the means implemented to initiate this discovery phase. For example, the range of communication modules that meet one of the IEEE 802.11 group standards is about 100 meters.</p><p num="0025"> All surrounding control terminals can be obtained by geopositional methods, by mapping, or by listening to beacons transmitted by each of the control terminals according to wireless communication standards.</p><p num="0026"> Therefore, the identification step of the control terminal by the device is A step of geolocating the device with a geolocation module built into the device, A step of searching for at least one control terminal located in the geographical area around the device in the list of control terminals stored in the database attached to the device. including.</p><p num="0027"> In one variant, the method further comprises inspecting the remote server for additional conditions associated with the selected control terminal in order to send the corresponding authentication code to the device.</p><p num="0028"> In practice, each control terminal is characterized by a unique identifier. Therefore, the table stored in the database attached to the remote server preferably contains a list of these identifiers and associated authentication codes. This list does not have to be immutable and can be updated to reflect newly discovered control terminals by the device.</p><p num="0029"> For example, the identifier of the control terminal can be its MAC address (MAC is an abbreviation for "Media Access Control"). This MAC address, attributed by the IEEE, is the unique physical identifier of the controlling terminal, typically a network card or similar network interface. This MAC address is also called an Ethernet address, UAA ("Universally Administered Address"), BIA ("Burned-In Address"), and so on. This MAC address has the advantage of being unique.</p><p num="0030"> As a modification, the identifier of the control terminal may be an SSID ("Service Set for Identifier"). This SSID corresponds to the name of the wireless communication network of the IEEE 802.11 standard with which the control terminal is affiliated.</p><p num="0031"> In another variant, the identifier of a piece of equipment may be defined by its geographic location, which can be obtained, for example, by geopositional means built into the device.</p><p num="0032"> The identifier may be an IP address (IP is an abbreviation for "Internet Protocol"). This IP address is an identification number attributed to each piece of equipment connected to the network. IP addresses have the advantage of being unique at the time of publication.</p><p num="0033"> If the IP address is internal to the network and therefore not unique, such as the SSID, this identifier can be complemented with an additional identifier, such as the geographic location described above.</p><p num="0034"> In practice, each control terminal is at least one of the pieces of information listed in the table: its MAC address, its SSID, its IP address, its geographical location, or all or some of these pieces of information. It can be identified using a combination.</p><p num="0035"> In practice, when the MAC address of the control terminal to which the device wants to connect is unknown, the server can perform a method of identifying various control terminals located within a given geographic area. This identification method can use, for example, an IP address and a piece of information about the geographic location of the control terminal selected by the device.</p><p num="0036"> Another gist of the present invention lies in a system that remotely retrieves at least one authentication code. A remote server attached to a table stored in the database that contains a list of control terminals associated with each authentication code, With at least one control terminal It is coupled to a first communication module that can exchange data with the remote server using the first communication protocol and to a second communication module that can exchange data with the control terminal using the second communication protocol. Device and To be equipped.</p><p num="0037"> In addition, the device Identify all or some of the access terminals within a given geographic area A request is sent to the remote server via the first communication module to request at least one authentication code requested by at least one control terminal selected from the identified control terminals. The requested authentication code can be transmitted to the selected control terminal via the second communication module.</p><p num="0038"> Furthermore, the server Upon receiving the request from the device, the table is queried to extract the authentication code associated with the selected control terminal. The extracted authentication code can be transmitted to the device using the first communication protocol.</p><p num="0039"> Advantageously, at least one of the first and second communication modules is incorporated into the device.</p><p num="0040"> Preferably, the first communication module carries out all or part of the steps of the retrieve method identified above.</p><p num="0041"> Other features and advantages of the present invention will be further apparent from the description described below with reference to the accompanying drawings, but not exclusively for illustration purposes.</p>

0042<figref num="1">It is a partial schematic diagram of the communication system which implements the retrieve method by one Embodiment of this invention.</figref><figref num="2">An example is a flow chart of several steps of the method according to one embodiment of the present invention.</figref>

0043FIG. 1 schematically illustrates an exemplary communication system suitable for implementing one particular embodiment of the invention.

0044This system is particularly equipped with control terminals 30a, 30b, 30c that are affiliated with shared network 3. These control terminals 30a, 30b, and 30c are located apart from each other and form a gateway to the shared network 3. In particular, each of the control terminals 30a, 30b, and 30c acts as an interface that allows or blocks access to the shared network 3. In general, each of the control terminals comprises hardware and / or software communication means 32a, 32b, 32c that communicate with a device using a predetermined communication protocol. Further, in general, access to the shared network 3 requires an authentication code such as a security key, an identifier and a password.

0045The system further includes a remote server 20 attached to the database 22 in which the table 220 is stored. This table 220 specifically contains a list of predetermined control terminals and authentication codes associated with these control terminals. For example, these control terminals are indexed in Table 220 with their unique identifier. These control terminals can also be indexed in Table 220 by a combination of useful information that can distinguish one control terminal from the other control terminals. In general, the remote server 20 also incorporates hardware and / or software communication means 21 that communicate with the device using a different communication protocol.

0046Moreover, the system is also suitable for reliably exchanging data with the remote server 20 on the one hand and with the control terminals 30a, 30b, 30c on the other hand using their respective communication protocols. It comprises a device 10 coupled to modules 11 and 12, such as a mobile phone.

0047In the following, the present invention is specified that the control terminals 30a, 30b, 30c are linked with a wireless community network that meets the specifications of the Wi-Fi standard, and the remote server 20 is compatible with UNB ("Ultra Narrow Band") wireless technology. The case of is described.

0048Therefore, the device is provided with a first wireless communication module 11 compatible with UNB technology, communicates with a remote server using the protocol specified by UNB technology, and is compatible with the Wi-Fi standard. Equipped with 12, communicates with Wi-Fi terminals using the Wi-Fi communication protocol.

0049In a particular connection to such a network, each Wi-Fi control terminal 30a, 30b, 30c (hereafter referred to as a Wi-Fi terminal) is to signal its existence and distinguish it from its radio characteristics and other access points on the network. A signal (or beacon) is periodically emitted to broadcast information such as its unique identifier. Such an identifier is commonly referred to as a MAC address.

0050The device 10 discovers Wi-Fi terminals 30a, 30b, 30c within its range by receiving these beacons via its second communication module 12 to connect to the Wi-Fi network. Start the phase.

0051Of course, this discovery phase is not enforced if the device can be joined to a database containing, for example, Wi-Fi terminals indexed at those locations. In this particular case, the device can very easily determine its geographic location using geolocating tools and query this database to determine all nearby Wi-Fi devices.

0052When the Wi-Fi terminal is identified (step A in FIG. 2), the device or user selects the Wi-Fi terminal to be connected from the identified Wi-Fi terminals 30a, 30b, 30c. The device 10 then performs the steps shown in FIG. 2 to retrieve the authentication code associated with one or more selected Wi-Fi terminals 30a, 30b, 30c from the remote server 20. Specifically, the device 10 sends a request to the remote server 20 via the first communication module 11 (step B). Upon receiving this request, the remote server 20 queries table 220 to determine if one or more Wi-Fi terminals selected on device 10 are stored in table 220 (step C), and if so, responds. Extract the authorization code to be used (step D) and send it to device 10 (step E). When these codes are received, device 10 sends the corresponding authentication code to one of the selected Wi-Fi terminals over the second communication protocol (step F).

0053Of course, the server's transmission of the authorization code to the device may be subject to certain conditions, such as marketing samples, statements of acceptance of payments, etc.

0054In another particular embodiment, the control terminal can also act to open or block doors that allow or block access to the building or block the provision of access codes. In this particular case as well, devices such as badges or smartphones will of course incorporate various means of communicating with remote servers and control terminals using their respective communication protocols. For example, the device can incorporate an RFID antenna for communicating with a control terminal and an antenna using INB technology for communicating with a remote server. Generally, an RFID control terminal can periodically emit a unique identification number defined by, for example, an EPC ("Electronic Product Code") standard. As in the previous example, the device retrieves this identification number and queries the remote server to retrieve the corresponding access code. Upon receiving the request, the remote server can examine its database, inspect the recorded authorization information, and then decide whether or not to send the corresponding access code to the device.

0055Therefore, it will be understood that the solution of the present invention can be implemented regardless of the size of the network. This solution can be applied not only to indoor environments but also to industrial environments. Therefore, the method of the present invention can be implemented to ensure the exchange of information between indoor electrical equipment and maintenance services. For example, indoor electrical equipment such as washing machines, kitchen utensils, etc., as described above, which allows the authentication code to be retrieved from the remote server of the present invention in order to automatically connect to an available Wi-Fi terminal. A communication module can be provided. This connection is particularly useful for exchanging information such as the presence of malfunctions and failures, as the equipment needs to be updated by the remote maintenance service or the owner of the equipment.

0056Of course, all or part of the steps described above are automatically performed by the device.

0057Therefore, from the above description, the alternative solution described above uses two different communication channels for the user of the device and desires the other channel in order to remotely retrieve the required communication authentication code from one channel at any time. It is clear that it makes it possible to use it to connect to the network. For example, the first communication channel can use UNB technology optimized for long-distance low data transfer rate communication, and the second communication channel is a high data transfer rate wireless communication standard such as Wi-Fi standard. Can be satisfied. Therefore, the device may retrieve the authorization code at any time to connect to the Wi-Fi terminal. In addition, UNB technology enables long-distance communications of tens or hundreds of kilometers, so such authorization codes can be retrieved remotely, i.e. from remote servers.