WO2008135692A1

WO2008135692A1 - Access management to resources of an exploitation system

Info

Publication number: WO2008135692A1
Application number: PCT/FR2008/050538
Authority: WO
Inventors: Florence Germain; Etienne Annic; Olivier Lobry
Original assignee: France Telecom
Priority date: 2007-03-30
Filing date: 2008-03-27
Publication date: 2008-11-13

Abstract

According to the invention, in order to manage the access to a terminal resource required by an execution unit (AP) of an application software run on said terminal, the execution unit (AP) being dedicated to a digital service and having outputted a system access (RA) including a resource identifier (IR) to a terminal exploitation system: said request (RA) is intercepted; the execution unit (AP) at the origin of the request is identified; at least one context parameter (CPR) concerning said identified execution unit (AP) is determined; the context parameter (CPR) is associated with the request (RA); the service is identified based on the context parameter (CPR); and identifiers of the resources associated with said identified service are determined. If the resource identifier (IR) contained in the request (RA) is one of the identifiers of the resources associated with the identified service, processing parameters (LPT) associated with this resource identifier (IR) are determined, and descriptive elements (ED) of the resource are processed based on said determined processing parameters (LPT) in order to make the resource accessible for the execution unit (AP).

Description

Management of access to resources of an operating system

The present invention relates to managing access to resources of an operating system of a terminal by an application dedicated to a digital service.

A digital service is provided by a service provider to a user to access a data set in strict compliance with the rules of an economic model. An economic data-model pair defining a service is associated with a list of rights holders, that is to say natural or legal persons who have acquired a license to use and who are therefore authorized to consume the said license. service and associated data as part of the service's economic model. An economic model defines a commercial contract for the consumption of a digital service, characterized for example by a tariff of the service and rules of use of the service. Following the non-fulfillment of a rule stipulated by the contract, the use of the service is deemed unlawful.

The rules of use imposed by an economic model on data are typically implemented in the form of a sequence of instructions, called digital rights management (DRM) process, executed at request from a user who has acquired a license to use the data as part of the business model for that data. The access to the data of a digital service is reserved for specific applications, provided for under the economic model of said digital service.

An "application" is conventionally defined as a unit of execution of a program executable by a terminal. The same program can be run multiple times so that different applications required by the program execution are respectively dedicated to different digital services. For example, a media player may be first run to read a video file once on an on-demand view, and a second time to play another video file with a license granting a predetermined number of views. from this other video file.

An application is said to be "dedicated to a digital service" associated with an economic data-model pair when its execution is intended to be launched on the data of said digital service.

Running an application in a terminal requires access to terminal operating system resources, more simply called system resources. A system resource is a hardware or software element of a terminal that is accessible by the operating system. As non-limiting examples, a system resource may be a device such as a keyboard, a screen, a speaker, or a battery, a memory, a processor, a network interface, or even software, a file manager.

In an operating system, system resources are represented in different ways and each has its own mode of access. In general, we consider that the operating system contains descriptive elements for each system resource, the latter providing instructions or interpretable information by an application to access the system resource. Descriptive elements often have the form of a data file, such as a "pseudo-file" in Unix operating systems for accessing certain system resources such as the keyboard. A descriptive element may simply be a pointer to a memory, for example to designate a range of addresses of a memory to be dedicated to a certain resource such as a graphics memory.

An operating system offers in particular basic functions of a computer terminal, such as memory management, access to different peripherals or the management of the execution of processes on the processor. Current operating systems implement a "user-centric" policy for managing access rights to system resources: to a given user are granted rights giving access to more or less operating system resources. Some operating systems are single-user, that is, only one user can use a computer terminal at a given time. Other operating systems are multiuser, that is to say that several users can use the same computer terminal simultaneously. In the latter case, a user profile grants each user access rights to certain system resources. A single user, often referred to as an "administrator", has access to all system resources while other users have access to only a limited number of resources.

These profile operating systems make it possible to share the work of several users on the same computer terminal while controlling the risks of any interference that may be caused, intentionally or not, by one of the users on the data of the other users.

As with single-user systems, profile-based operating systems implement a "user-centric" policy for managing access rights to system resources.

So far, operating systems have been designed to secure data and access to system resources based on the user. This approach has found its limit with the advent of the internet which has highlighted the inability of operating systems to ensure the security of exchanges with other terminals accessible via a network. Thus, with the development of network data exchanges, a "user-centric" operating system can not handle both a dedicated user and network terminal users. Such management would require a complete redevelopment of existing operating systems. But for economic reasons, operating system developers have limited themselves to slight adaptations. Consequently, it is very common on the internet for a terminal to be "infected" by software downloaded on the initiative of another device of the network and executed on said terminal for the account and without the knowledge of the user. The "user centric" rights management policy is therefore inappropriate current and future uses of a computer terminal accessing at least one communication network.

On the other hand, in "user-centric" operating systems, a service that is run on behalf of a user inherits the user's rights. For example, a service running on behalf of an administrator-type user has all rights, even the right to destroy the operating system itself.

A "user centric" operating system treats all services executed by the same user with the same rights. For example, an internet browsing service and a secure credit card payment service can both be executed on behalf of a given user on a terminal having "contactless" access to a banking network and wireless internet access. The use of the card payment service requires the exclusive use of the banking network, and excludes access to the Internet a priori. The "user-centric" operating system does not control the type of access used by the payment service. It is then possible to use the internet access for the payment service and thus to divulge confidential data without prohibition by the operating system. Similarly, any service on the internet may interfere with the payment service to make confidential banking data available on the Internet or to engage in illegal banking. Indeed, for the operating system, this practice is normal since it is consistent with the rights of the user. But for the supplier of payment service, this practice can lead to economic disasters.

In another example, a malicious service is downloaded into a computer terminal from a network. During the execution of the service on the terminal, the service inherits the rights of the user, and therefore in particular rights of access to the data of the user. Nothing prevents the service from collecting the data of the user and transmitting them on the network without the knowledge of the user. Similarly, for the operating system, this practice appears quite normal since it is in accordance with the rights of the user. E-commerce services using online payment and / or account consultation are implemented on a terminal at the risk of the user. Although some services use powerful tools, such as the HyperText Transfer Protocol Secured (HTTPS) hypertext transfer protocol, to protect their exchanges, it is sufficient for a malicious service running on the terminal to copy information from the screen, the keyboard or even directly from the terminal memory to divert these commercial services and thus make possible malpractices, without the user being aware of the piracy.

It can be seen from the previous examples that "user-centric" operating systems delegate responsibility for the proper operation of the terminal to the services themselves. If the service is properly designed, no malicious action will take place and the terminal will work properly. On the other hand, if the service is poorly designed or malicious, the service will damage the data on the terminal and / or cause malfunctions to the extent that the rights of the user permit. But for the operating system, all these actions took place in accordance with the rights of the user.

From the foregoing, it follows that operating systems "user centered" rely, for their security policy, on the user. If the latter uses two services, for example browsing the internet and a credit card service, the services have access to the rights of the user and can interfere maliciously without the operating system detects a malfunction. There is no mechanism at the operating system level that controls individual access of a service to system resources.

There is therefore a need to define and guarantee a restriction of access to system resources for each service running on an operating system, and more particularly to allow each service to access the only system resources to which the service is entitled.

To overcome the drawbacks mentioned above, the invention proposes a method for managing access to a resource of a terminal required by an execution unit of an application program executed in the terminal, said execution unit being dedicated. to a digital service and having issued a system access request including a resource identifier for an operating system of the terminal. Said method is remarkable in that it comprises the steps of: after interception of said request, identifying the execution unit at the origin of said request, determine at least one context parameter relating to said identified execution unit, and associate the query with said context parameter, identify said service according to the context parameter, determine resource identifiers associated with said identified service, and if said identifier resource included in the request is one of said resource identifiers associated with the identified service, determining processing parameters associated with that resource identifier, and processing, according to said determined processing parameters, descriptive elements of the resource, in order to make the resource accessible to the thread.

The invention authorizes each service executed on a computer terminal "tailored" access to all or part of the resources of the operating system. Services therefore do not have access to system resources that are forbidden to them. By controlling access to the descriptive elements of a system resource, the invention provides access control to the system resource itself. Advantageously, each service has a "profile" of its own and includes all the system resources to which it has the right to access. A "service profile" of an operating system behaves like an autonomous operating system. Seen from the service, the operating system is perceived to provide exactly and only access to the system resources to which the service is entitled to access. The rights management policy according to the invention is therefore "service centric" in order to protect access to system resources according to the service and no longer according to the user.

On the same computer terminal, such a "service-centric" operating system is capable of managing the execution of several services simultaneously, each service individually having its own access rights to the system resources.

The invention has the advantage of offering a containment solution for services by protecting each service against its own malfunctions or the malignancies of other services. For example according to the invention, a payment service has an exclusive right of access to a "contactless network" resource. The operating system protects the service from interactions with pernicious services that attempt to use access to the "contactless network" resource to intercept banking data, while they do not have access rights to this resource. In the same way, the operating system protects the service against the consequences of a possible malfunction of the service by prohibiting the latter access to the Internet and therefore any transmission of banking data through the Internet.

Advantageously, resources can be granted exclusively to a service according to the invention. The service is run on a terminal independently and independent of other services that can run on the same terminal. This service is completely confined to other services and is totally protected from their behavior.

As a corollary, since the invention makes it possible to control the access of the services to the resources system, it is possible to prevent piracy of sensitive system resources, for example by systematically refusing any duplication of a key sequence composed on a keyboard on behalf of an "official" service, ie a service legitimately recorded on the terminal, such as a banking service. Controlled access to system resources according to the invention also ensures the proper functioning of the terminal, for example by simply prohibiting the services access to sensitive system resources such as the "battery" resource.

Moreover, since each service is installed on a terminal being restricted with respect to the use of sensitive system resources, it is for example impossible for a malicious service that does not have access rights to these system resources. to divert confidential banking information from a payment service even in the event of a malfunction of the payment service.

The invention also provides a great deal of rights management flexibility by providing for dynamic updating of the authorized system resources for each service. The modification of the rights of a service on the operating system leads immediately to the taking into account of the new rights of access to the system resources allocated or withdrawn to the service. In particular, it is not necessary to restart the operating system for this consideration to be effective. As explained in detail below in relation to processing parameters and service identifiers, the same flexibility is given to resource protection modalities and modalities. identification and authentication services, providing for their dynamic update.

The context of use of the invention is that of a computer terminal capable of performing at least one service. The prohibition of services to install on the terminal without authorization, or at least by controlling access to resources, considerably reduces the risk of hacking the terminal following the automatic installation of a service, for example when a navigation on a website. Thus, the invention allows terminals to access networks without risk of hacking, consisting for example to install a service without the knowledge of the user. Therefore, if malicious services no longer have the ability to hijack data associated with an economic model, then business models can no longer be diverted from their business objectives.

According to other features of the invention, the descriptive elements of the resource may not be encrypted and thus be interpretable by the execution unit without resorting to the processing parameters, or the descriptive elements of the resource may be encrypted and interpretable by the execution unit after decrypting the encrypted descriptive elements according to the processing parameters.

The processing parameters are specific to a system resource and make it possible to decrypt the descriptive elements of the resource when they are encrypted. In all cases, the processing parameters make clear the descriptive elements to the execution unit so that the latter accesses the resource. According to another characteristic of the invention, service parameters may be associated with the service, and the service is identified if all the service parameters associated with the service and only said service are included in a set of context parameters relating to the service. identified execution unit and associated with the request.

Service settings allow the service to be uniquely and unambiguously distinguished from other digital services. This exact identification further ensures that the thread requesting a resource from the terminal is "official".

The invention also relates to a system for managing access to a resource of a terminal required by an execution unit of an application program executed in the terminal, said execution unit being dedicated to a digital service and having issued a system access request including a resource identifier for an operating system of the terminal. Said system is remarkable in that it comprises: means for intercepting said request and for identifying the execution unit at the origin of said request, means for determining at least one context parameter relating to said unit of identified execution, means for associating said context parameter with the query, means for identifying said service according to the context parameter, means for determining resource identifiers associated with said identified service, means for determining processing parameters associated with that resource identifier if said resource identifier included in the request is one of said resource identifiers associated with the identified service, and means for processing, according to said determined processing parameters, descriptive elements of the resource, in order to make the resource accessible to the execution unit.

Advantageously, the protection system according to the invention systematically intercepts any call to a resource of the terminal by an execution unit to ensure protection of access to the resource. The protection system ensures that access to a resource is obtained in the context of the business model associated with the service, and by a trustee using a thread authorized to access the resource.

Moreover, the operating system is made more reliable by the invention since, even if a user of administrator type having all the rights runs a service, this service has only its own access rights to the resources. Such a service can not therefore damage the operation of the operating system and make the terminal unavailable. An unavailability of the terminal implies a loss of turnover for the service provider since the customer can no longer consume services while the terminal no longer works. For example, if a service run by an administrator user is only allowed to use the memory, the screen and the keyboard of the administrator terminal, the service will not be able to access the system resource "battery" in order to turn off the terminal for example.

The increased reliability of the terminal enhances the service provider's brand and seriousness, thereby enhancing the customer's trust in the supplier, and thus indirectly consolidating the vendor's business capability.

According to another feature of the invention, the means for identifying the service may contain a first table mapping service identifiers to service parameter lists, a second table mapping the same service identifiers to the service identifiers. resource identifiers, and a third table mapping resource identifiers and processing parameter lists, these correspondence tables being updated by at least one server means according to the digital services to which the user of the terminal is subscribed.

The look-up tables allow an exact identification of the digital service relating to the application executed in the terminal, and are updated by a server means external to the terminal to take into account any change relating to the digital services to which the user of the terminal is subscribed . In particular, the correspondence tables overcome the drawback that no official entity in the state of the art manages all existing digital services, services having no specific characteristics to be distinguished from each other . The invention also relates to a computer program adapted to be implemented in a system for managing access to a resource of a terminal required by a thread of an application program executed in the terminal, said an execution unit being dedicated to a digital service and having issued a system access request including a resource identifier to an operating system of the terminal, said program comprising instructions which, when the program is executed in said system, perform the steps according to the method of the invention.

Finally, the invention relates to a system-readable recording medium for managing access to a resource of a terminal required by an execution unit of an application program executed in the terminal, said execution unit being dedicated to a digital service and having issued a system access request including a resource identifier for an operating system of the terminal, said medium containing a computer program including instructions for executing the steps according to the process of the invention.

Other characteristics and advantages of the present invention will emerge more clearly on reading the following description of several embodiments of the invention given by way of non-limiting examples, with reference to the corresponding appended drawings in which: FIG. 1 is a schematic block diagram of a protection system according to the invention for managing access to the resources of a terminal; and

FIG. 2 is the algorithm of a resource access management method of a terminal according to the invention implemented in the protection system.

With reference to FIG. 1, the protection system SP according to the invention is included in a computer terminal capable of managing digital data.

The computer terminal can be of any type and can handle any type of data. For example, the terminal is a personal computer, a mobile radio terminal, a banking terminal, an application server or a surveillance camera. The terminal has at least one system resource and can manage at least one service. The protection system SP comprises a CA access controller, an encryption system SC and at least one parameter server SVP. The encryption system SC comprises a DC encryption controller, a GC key generator, an encryption module MC and a service controller CS. The SVP parameter server communicates directly with the CA access controller and / or the DC encryption controller. The communications between the different entities included in the protection system are secure, so that no exchange of information can be intercepted during a communication between two of these entities.

The CA access controller controls access to system resources that are managed through the terminal operating system by a GR resource manager. As previously described, the system resources are represented in different ways and each have their own access mode. The resource manager GR contains ED descriptive elements for each system resource that can be interpreted by an application to access the system resource. For example, descriptive elements are gathered in a data file in a file manager accessible only by the resource manager GR.

The parameter server SVP notably manages information necessary for the protection system according to the invention, such as values for the parameters required by the service controller CS and the key generator GC.

The service controller CS is able to communicate with at least one SPS service protection server, which is for example located in the network of the service provider providing a service to which the user of the terminal is subscribed. For the sake of simplicity, reference will be made below to only one SPS server, but it is quite possible within the scope of the invention to provide several SPSs each having the functionalities described below, so as to what each service provider hosts at most one SPS server. The SPS service protection server is managed for example by the service provider itself or by a trusted third party.

Communications between the CS service controller and the SPS service protection server are also secure, for example using the SOAP remote object access protocol. ("Simple Object Access Protocol" in English) encapsulated in the HTTPS secure transfer protocol.

The SPS service protection server maintains lists of LPS service parameters associated with digital services so that service identifiers IS are each associated with one and only one list of LPS service parameters. A list of LPS service parameters characterizes and uniquely and unambiguously identifies the corresponding digital service among other services. Each service identifier IS is further associated with one or more IR resource identifiers. Each IR resource identifier is associated with a list of encryption / decryption parameters, called the LPT processing parameter list.

In addition, user identifiers UI can be individually associated with at least one IS service identifier. An UI user identifier is defined from user parameters that unambiguously characterize the digital service user. The user parameters for example include an identifier of a user group and / or a terminal identifier. User settings are tailored to each business need. For example, a subscriber will not have the same services using a TV or a mobile terminal. Thus, depending on the context of use, different system resources will be available for the same service depending on the use of the television or the mobile terminal, since they are two different user identifiers although the latter refer to a single subscriber user. The notion of user is therefore very general and includes, for example, individuals, companies, machines or individuals using a specific machine at a given location.

The service controller CS contains in particular first, second and third correspondence tables TC1, TC2 and TC3. The first table TC1 maps IS service identifiers to LPS service parameter lists, and the second TC2 table matches the same IS service identifiers and respective LIR resource identifier lists. The third table TC3 maps the IR resource identifiers and LPT processing parameter lists.

A list of LPS service parameters contains one or more parameters, while a list of LPT processing parameters may contain no parameters. These correspondence tables TC1, TC2 and TC3 are provided or updated by the SPS service protection server according to the UI of the terminal user.

The computer terminal further comprises memories that include one or more volatile memories and one or more persistent memories whose access through the operating system from the resource manager GR is guaranteed by the access controller CA of the system. protection.

The terminal operating system executes AP applications and manages the sharing of terminal resources between applications via the GR resource manager. An AP application that is executed by the terminal operating system and associated with a digital service may request access to any of the terminal operating system resources.

In particular, the protection system SP can be implemented in an electronic component of the microcontroller type, microprocessor circuit or smart card, so that the system is not pirated, spied on or modified. This embodiment is particularly advantageous when the electronic component includes, in addition to the protection system SP, a volatile memory, a persistent memory, storing for example the application codes allowing the operating system to execute, and a processor in which executes the source code of the protection system. Indeed, a weakness of the protection system is that its execution requires that its source code be written in "clear". If the source code is written in volatile memory, it is possible to copy the source code of the memory, to understand its operation and to divert it from this operation. On the other hand, if the source code of the protection system is executed within the electronic component, it is much more difficult to hack it.

The persistent memory of the electronic component contains critical applications such as, for example, a certified operating system implementing the access controller, or a certified browser.

When a service is to be executed on the terminal, the service is then executed by means of the operating system using the protection system SP. Requests for access to resources system from the services are processed by the protection system which verifies the access rights of the services to the system resources. If the service does not have the right to access the requested system resource, the request fails. If the service has the right of access to the system resource, the protection system loads in the memory of the electronic component, deciphering if they are encrypted, the descriptive elements of the requested system resource. In this way, the descriptive elements of a system resource are not disclosed in the terminal memory, in which a malicious service could have copied them.

Thus, even if a malicious service has hardware means to spy on the memory of the terminal to extract data, the service can not access the descriptive elements of a system resource previously deciphered by the protection system. As a result, it is not possible to extract descriptive elements from a system resource, to hack them, and to use them to illegally access a system resource.

Moreover, the encryption system SC can be realized partly in hardwired logic rather than in the form of software. Only the CS service controller must be realized in whole or in part as software since it stores and manages tables that can be updated. In fact, wired logic optimizes operation by considerably increasing performance. Since the processing time performed by the encryption system SC is the main delay for accessing system resources, if this processing is too long, the execution of the services may also be perceived as too long by the user of the terminal. So that the operation of the terminal is not penalized by the processing time of the encryption system SC, it should preferably be optimized, for example by using a realization in hardwired logic.

When the descriptive elements are contained in encrypted form in the resource manager GR, their maintenance is managed by a maintenance system SM, which is for example located on the user's terminal and updated by the service protection server. SPS. The maintenance system SM modifies descriptive elements of a resource with processing parameters, for example as follows. For each system resource, the maintenance system SM transmits to the encryption controller CC a request for access to the resource containing the identifier of the system resource. The encryption controller CC, via the service controller CS and the encryption module MC, identifies encrypted descriptive elements associated with the identifier of the system resource and decrypts the encrypted descriptive elements using a list of parameters. processing contained in the CS service controller. The encryption controller CC thus gives access to the descriptive elements of the resource to the maintenance system SM. The latter transmits to the encryption controller CC a request for encryption of the descriptive elements of the resource with another list of processing parameters included in the request. The encryption controller CC, via the encryption module MC, encrypts the descriptive elements and provides them to the resource manager before informing the maintenance system SM of the result of the operation. As soon as all the system resources to be modified have been processed, the maintenance system SM informs the service protection server SPS of the result of the maintenance operation and the server SPS updates the third table TC3 of the service controller CS in correspondence the IR resource identifiers and the LPT processing parameter lists.

With reference to FIG. 2, the method according to the invention comprises steps El to ElO automatically executed under the control of the protection system SP included in the terminal and implemented by instructions of a computer program recorded on a terminal. recording medium readable by the SP protection system.

In advance, a user of the terminal has subscribed to one or more service providers offering digital services and thus becomes a subscriber to at least one service.

At an initial step EO, the service controller CS stores or updates correspondence tables TC1, TC2 and TC3 according to the digital service or services to which the user is subscribed with the assistance of the SPS service protection server.

In a first example, the service controller CS interrogates the SPS service protection server by providing the SPS service protection server with an UI user identifier. The controller CS in return obtains at least one service identifier or, more generally, service identifiers IS associated with the user identifier, as well as lists of LPS service parameters and lists of LIR resource identifiers associated with service identifiers, and lists of LPT processing parameters associated with IR resource identifiers, in order to update or store correspondence tables TCl , TC2 and TC3. This interrogation can be carried out each time the terminal is powered on, to check for a possible modification in the correspondence tables.

In a second example, the SPS service protection server interrogates a database to know at least the service or more generally the services accessible by the user, this database being for example a home location register HLR ("Home Location Register "in English) in a cellular network GSM / GPRS (" Global System for Mobile Communications "/" General Packet Radio System "in English) or a nominal service server HSS (" Home Service Server "in English) in a network UMTS cellular ("Universal Mobile Telecommunications System"). The SPS server associates the UI identifier of the user with the IS identifiers of the service or services to which the user is subscribed. Then the SPS server transmits to the service controller CS the service identifiers and the associated service parameter lists, as well as the resource identifiers associated with the services and the processing parameter lists associated with the resource identifiers, for a total update of the service identifiers. correspondence tables TC1, TC2 and TC3 stored in the service controller CS. In a third example, the SPS service protection server performs a partial update of the TCl, TC2 and TC3 correspondence tables only when a change takes place. This change can be of several types, such as the creation, modification or deletion of a service, and can be initiated by an HLR recorder in a GSM / GPRS cellular network or an HSS server in a network. UMTS cellular network. The service protection server SPS then transmits to the service controller CS a file taking into account these changes to update only the correspondence tables concerned by these changes. The service controller CS then contains updated correspondence tables which relate to the IS identifiers of the services to which the user is subscribed and to the exploitation resources that are accessible by these services. In the first correspondence table TC1, each service identifier IS is associated with a list of LPS service parameters that uniquely and unambiguously characterizes and identifies the corresponding digital service among other services. Each service parameter list contains fields that are specific to the digital service and are populated by service parameter values by the digital service provider. The service parameters are, for example, an identifier of an AP application and / or a service provider identifier.

In the second correspondence table TC2, each service identifier IS is associated with a list of LIR resource identifiers. Each service identifier IS can be individually associated with one or more IR resource identifiers. In a particularly simple implementation example, a service identifier is associated either with at least one accessible system resource or with at least one prohibition of use of at least one resource. In other words, the second table TC2 associates with each service rights of access to system resources. In the third correspondence table TC3, each IR resource identifier is further associated with a list of LPT processing parameters. Each list of processing parameters contains fields that are specific to the digital service and are optionally populated by values of processing parameters by the digital service provider. The processing parameters are for example an identifier of an AP application and / or an identifier of the user, and can therefore be partly of the same type as the service parameters. A list of processing parameters may, however, be empty.

In step El, an application AP for a service is executed in the terminal in the context of the service. For example, the terminal user has selected the launch of the application via a human-machine interface of the terminal indicating to the user the services to which the latter is subscribed and the applications available for these services. For example, the application is a media player that is run for an on-demand music listening service.

The executed application AP transmits a system access request RA to the system operating the terminal to access one of the terminal system resources. The system access request RA includes an IR resource identifier indicating the system resource to which the application requires access. For example, the system access request RA requires access to a loudspeaker for listening to music.

In step E2, the request RA for the operating system is intercepted by the access controller CA of the protection system SP which is listening to any request from any application to the operating system of the operating system. terminal. The CA access controller then identifies the AP application that originated the RA request, for example by means of a correspondence between a system process and an identifier of the application.

The access controller CA modifies the intercepted request RA into a modified request RM by supplementing it with one or more context parameter fields CP, and thus associates one or more context parameters that are not informed with the request.

The fields are intended to be filled by the context parameter values that can be associated directly or indirectly with the application. A context parameter directly associated with the application is for example an identifier of the application AP, or an identifier of the user. A context parameter indirectly associated with the application is for example an identifier of a finite set of data associated with the service, or a service provider identifier. Optionally, the AC access controller temporarily stores the modified query RM. In step E3, the access controller CA transmits the modified request RM to the encryption controller CC of the encryption system SC. The encryption controller CC stores the modified request RM, including the resource identifier IR included in the request RM.

In step E4, the encryption controller CC interrogates the parameter server SVP in order to inform the context parameter fields CP in the modified request RM.

The parameter server SVP determines and provides the parameter values relating to the application AP in order to fill in the fields of the query modified by these values. For example, the operating system of the terminal manages a correspondence between the application AP, the execution of which is at the origin of the request RA in the terminal, and an identifier of the application AP. The parameter server SVP transmits the context parameter fields filled CPR to the encryption controller CC which stores them. The context parameters entered are then associated with the request and exploitable by the encryption system SC.

In a variant, steps E3 and E4 are replaced by steps E31 and E41, respectively.

In step E31, the access controller CA interrogates the parameter server SVP in order to inform the context parameter fields CP in the modified request RM. The parameter server SVP determines and transmits the context parameter fields populated CPR to the access controller CA. In step E41, the access controller CA fills the fields of the modified request RM by means of the context parameter fields CPR filled in by the server SVP and transmits the modified request RM to the encryption controller CC of the encryption system. SC that memorizes it.

In step E5, the encryption controller CC transmits the context parameter fields CPR filled to the service controller CS.

The service controller searches the first correspondence table TC1 for the identifier IS of the digital service at the origin of the request.

For example, the controller CS matches one by one the context parameter fields CPR filled with the fields of the various lists of LPS service parameters stored.

If all the fields of one and only one list of LPS service parameters are included in the set of context parameter fields filled with CPR, the service controller CS determines in step E6 said list of LPS service parameters and derives from the TCl table the service identifier IS associated with this list of service parameters. Consequently, the service controller CS identifies the digital service relating to the service identifier IS thus deduced.

If all the fields of several LPS service parameter lists are included in the set of context parameter fields filled with CPR, the service controller CS transmits an error message to the DC encryption controller, as shown in FIG. at a step ER, and the process ends. If no list of LPS service parameters has fields identical to at least a portion of the context parameter fields filled with CPR, the service controller CS transmits an error message to the CC controller as indicated in step ER, and the process ends.

If some fields of one or more lists of LPS service parameters are included in the set of context parameter fields CPR filled, these lists are selected at a step E51 by the service controller CS which identifies all the fields. of the selected service parameter list (s) for which context parameter fields that were filled in could not be mapped. The fields identified are considered as context parameter fields to be filled in. The service controller CS then transmits to the encryption controller CC the identified fields so that they are filled in using the parameter server SVP and then retransmitted to the service controller CS. Step E5 is then repeated once to one-to-one correspondence of the CPR filled context parameter fields completed by the identified fields filled in with the fields of the various LPS service parameter lists stored. Step E51 can not be repeated then since all the fields of context parameters necessary for said mapping have been filled.

As a variant, the service identifier IS is already entered in the context parameter fields CPR. The service identifier IS is for example already provided by the service to which the application AP is dedicated and therefore included in the RA system access request. In this variant, during the identification of the digital service at the origin of the request, the controller CS directly matches the service identifier of the request with each of the service identifiers of the first correspondence table TC1.

The service controller CS then identifies the digital service relating to the service identifier IS of the request when the latter is present in the first table TCl. If the service identifier IS of the request is absent from the first table TC1, the service controller CS transmits an error message to the encryption controller CC, as indicated in a step ER, and the process terminates.

In step E7, after identification of the service at the origin of the request, the service controller CS searches in the second correspondence table TC2 the resource identifiers associated with the service identifier IS deduced in step E6. The service controller CS thus determines the list LIR of the resource identifiers associated with the identified service. The service controller CS then checks whether the resource identifier IR included in the request RA is one of the identifiers of the resources associated with the identified service, that is to say if the resource identifier IR belongs to the list LIR resource identifiers associated with the service identifier IS. If the IR resource identifier included in the request is associated with the service identifier IS, the service is considered to be authorized to access the system resource corresponding to the identifier of the service identifier. resource, and the service controller CS validates the IR resource identifier included in the request. If not, the process terminates, and an error message is sent to the terminal user.

In step E8, the service controller CS determines the list of LPT processing parameters associated with the validated resource identifier IR in the third correspondence table TC3 and transmits the LPT list to the encryption controller CC.

The list of LPT processing parameters determines how to handle the descriptive elements ED of the system resource accessible by the resource manager GR in order to interpret them. The LPT list may have contents of three different types that are processed by the protection system SP in step E9 constituted by one of the steps E91, E92 and E93 described below according to the contents of the LPT list.

In a first case, the list of LPT processing parameters contains no elements, which means that the descriptive elements ED are not encrypted and are directly interpretable by the application AP without resorting to the processing parameters. The LPT list is processed in step E91 by the protection system SP.

In a second case, the LPT processing parameter list contains an encryption key KC and a decryption key KD. The LPT list is processed in step E92 by the protection system SP.

In a third case, the list of LPT processing parameters contains encryption / decryption parameters necessary for the generation an encryption key and a decryption key. The LPT list is processed in step E93 by the protection system SP.

In the second and third cases, the descriptive elements ED are encrypted into EDC-encoded descriptive elements and are interpretable after having been decrypted into descriptive elements decoded EDD. The IR resource identifier must then also be encrypted to access the associated encrypted descriptive elements.

In step E91, the encryption controller CC analyzes a list of empty processing parameters and requests the access controller CA to load the descriptive elements ED associated with the identifier of the resource via the resource manager GR. . For example, the descriptive elements can be stored in a volatile memory whose address is transmitted to the application AP for the latter to interpret the stored descriptive elements.

In step E92, the encryption controller CC transmits the resource identifier IR and the encryption key KC to the encryption module MC. The latter encrypts the IR resource identifier according to the encryption key KC and transmits the encrypted resource identifier IRC to the encryption controller CC. The DC controller requests the access controller CA to provide the EDC encrypted descriptive elements associated with the identifier of the IRC encrypted resource, for example in a volatile memory, through the resource manager GR. The DC encryption controller then loads the EDC encrypted descriptive elements to transmit them with the decryption key KD to the module MC encryption. The latter decrypts the descriptive elements encrypted according to the decryption key and retransmits the descripted elements EDD to the encryption controller CC. As in step E91, the decrypted descriptive elements can be stored in a volatile memory whose address is transmitted to the application AP so that the latter interprets the stored descriptive elements. In step E93, the encryption controller CC transmits the list of LPT processing parameters to the key generator GC so that it generates an encryption key KC and a decryption key KD according to the values of the processing parameters read in the LPT list and retransmits the generated keys to the DC encryption controller. As a variant, if fields of the list of LPT processing parameters transmitted by the service controller CS are not entered in the correspondence table TC3, the latter are filled in using the parameter server SVP. The encryption controller CC then proceeds as in step E92, in order to make clear the descriptive elements to the application AP. As a remark concerning step E93, the encryption module MC has at least two types of algorithm for processing the data, for example an encryption algorithm to which any encryption key and a decryption algorithm to which is applicable is applicable. any decryption key. Therefore, the encryption algorithm used by the encryption module MC is dual of the algorithm for generating the encryption keys used by the key generator GC, and the decryption algorithm used by the module MC encryption is dual of the decryption key generation algorithm used by the GC key generator.

At the end of step E9, the encryption controller CC has optionally decrypted the descriptive elements ED as a function of the list of LPT processing parameters and then makes available to the step ElO the resource to the application AP which can interpret descriptive elements in the clear.

For example, the encryption controller CC stores the descriptive elements in clear in a volatile memory whose address is transmitted to the access controller CA. The latter then transmits to the operating system the identifier of the AP application corresponding to a system process and the descriptive elements ED associated with the resource identifier IR and the memory address of the descriptive elements. The operating system that executes the AP application and manages the terminal resources then makes the resource accessible to the application.

For the sake of synchronization between the operations performed in the protection system

SP, for example executed by the key generator GC and the encryption module MC, the encryption controller CC receives an encryption key generated by the key generator GC and associates the generated key with the data to be processed previously loaded, such as a resource identifier, before transmitting them to the encryption module MC. This association ensures that the key and the data to be processed transmitted to the encryption module MC correspond to the same request. Thus, several Queries can be processed simultaneously and independently of each other by the CC encryption controller.

Alternatively, the functionality of the DC encryption controller is partially or fully integrated in the CA access controller and / or the GC key generator and / or the encryption module MC and / or the service controller CS. In this case, the access controller CA communicates directly with the key generator GC, the encryption module MC and the service controller CS, and the latter three also communicate directly with each other.

The invention described herein relates to a method and a system for managing access to a resource of a terminal required by an application dedicated to a digital service and executed in the terminal. According to one implementation, the steps of the method of the invention are determined by the instructions of a computer program incorporated in the protection system according to the invention. The program comprises program instructions which, when said program is executed in the system whose operation is then controlled by the execution of the program, carry out the steps of the method according to the invention.

Accordingly, the invention also applies to a computer program, in particular a computer program recorded on or in a computer readable recording medium and any data processing device, adapted to implement the computer program. 'invention. This program can use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code such as in a partially compiled form, or in any other form desirable for implementing the method according to the invention. The invention also relates to a recording medium, which can be any entity or device capable of storing the program. For example, the medium may comprise storage means on which the computer program according to the invention is recorded, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a USB key, or magnetic recording means, for example a diskette ("floppy disk") or a hard disk. On the other hand, the recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can in particular be downloaded to an Internet type network.

Alternatively, the recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method according to the invention.

Claims

1 - A method for managing access to a resource of a terminal required by an execution unit (AP) of an application program executed in the terminal, said execution unit (AP) being dedicated to a digital service and having issued a system access request (RA) including a resource identifier (IR) to an operating system of the terminal, said method being characterized in that it comprises the steps of: after interception (E2) of said request (RA), identifying the execution unit (AP) at the origin of said request, determining (E4) at least one context parameter (CPR) relating to said identified execution unit (AP), and associating with the request (RA) said context parameter (CPR), identifying (E6) said service as a function of the context parameter (CPR), determining (E7) identifiers of the resources associated with said identified service, and if said resource identifier (IR) included in the request e (RA) is one of said resource identifiers associated with the identified service, determining (E8) processing parameters (LPT) associated with this resource identifier (IR), and processing (E9), according to said processing parameters determined (LPT), descriptive elements (ED) of the resource, in order to make the resource accessible to the execution unit (AP).

2 - Process according to claim 1, wherein the descriptive elements (ED) of the resource are not encrypted. 3 - Process according to claim 1, wherein the descriptive elements (ED) of the resource are encrypted and can be interpreted by the execution unit after a decryption of the encrypted descriptive elements (EDC) according to the processing parameters.

4 - Method according to any one of claims 1 to 3, wherein service parameters are associated with the service, and the service is identified (E6) if all the service parameters associated with the service and only said service are included in a set of context parameters (CPR) relative to the identified execution unit associated with the request.

5 - System for managing access to a resource of a terminal required by an execution unit (AP) of an application program executed in the terminal, said execution unit (AP) being dedicated to a digital service and having issued a system access request (RA) including a resource identifier (IR) to an operating system of the terminal, said system characterized by comprising: means (CA) for intercepting said request (RA) and to identify the execution unit (AP) at the origin of said request, means (SVP) for determining at least one context parameter (CPR) relating to said identified execution unit (AP) means (CA; CC) for associating with the request (RA) said context parameter (CPR), means (CS) for identifying said service based on the context parameter (CPR), means (CS) for determining resource identifiers associated with said identified service, means (CS) for determining associated processing parameters (LPT) to this resource identifier (IR) if said resource identifier (IR) included in the request (RA) is one of said resource identifiers associated with the identified service, and means (CC) for processing, according to said parameters of determined (LPT), descriptive elements (EDs) of the resource, in order to make the resource accessible to the execution unit

(AP).

The system according to claim 5, wherein the means (CS) for identifying the service contains a first table (TC1) mapping service identifiers (IS) and service parameter lists (LPS), a second table (TC2) mapping service identifiers (IS) and resource identifier lists (LIR), and a third table (TC3) mapping resource identifiers (IRs) and processing parameter lists (LPT), said correspondence tables being updated by at least one server means (SPS) according to the digital services to which the user of the terminal is subscribed.

7 - System according to claim 5 or 6, included in an electronic component. 8 - computer program adapted to be implemented in a system for managing access to a resource of a terminal required by an execution unit (AP) of an application program executed in the terminal, said unit of execution (AP) being dedicated to a digital service and having issued a system access request (RA) including a resource identifier (IR) to an operating system of the terminal, said program being characterized in that it comprises instructions which, when the program is executed in said system, perform the steps of: after interception (E2) of said request (RA), identifying the execution unit (AP) at the origin of said request, determine (E4) at least one context parameter (CPR) relative to said identified execution unit (AP), and associate with the request (RA) said context parameter (CPR), identify (E6) said service as a function of the context parameter (CPR), determined er (E7) identifiers of resources associated with said identified service, and if said resource identifier (IR) included in the request (RA) is one of said resource identifiers associated with the identified service, determining (E8) processing parameters (LPT) associated with this resource identifier (IR), and treat (E9), based on said determined processing parameters (LPT), the descriptive elements (ED) of the resource, in order to make the resource accessible to the unit execution (AP). 9 - System-readable recording medium for managing access to a resource of a terminal required by an execution unit (AP) of an application program executed in the terminal, said execution unit (AP) being dedicated to a digital service and having issued a system access request (RA) including a resource identifier (IR) to an operating system of the terminal, characterized in that it has recorded a computer program comprising instructions for performing the following steps: after interception (E2) of said request (RA), identifying the execution unit (AP) at the origin of said request, determining (E4) at least one parameter of context (CPR) relating to said identified execution unit (AP), and associating with the request (RA) said context parameter (CPR), identifying (E6) said service as a function of the context parameter (CPR), determining ( E7) associative resource identifiers identified in said request, and if said resource identifier (IR) included in the request (RA) is one of said resource identifiers associated with the identified service, determining (E8) processing parameters (LPT) associated with said identifier of resource (IR), and processing (E9), based on said determined processing parameters (LPT), the descriptive elements (ED) of the resource, in order to make the resource accessible to the execution unit (AP).