FR2844936A1 - Telecommunications network secure access reinforcement having transmission first/second station synchronisation information broadcast with prior step encrypting broadcast signal. - Google Patents

Abstract

The secure access technique transmits (E130) to a first station information about the network condition to synchronise with a second station. There is a prior step (E120) encrypting the broadcast signal.

Description

The present invention relates to a method for strengthening the

  secure access to a telecommunications network.

  The invention finds a preferred but non-limiting application for securing wireless telecommunications networks, and in particular

private networks.

  In known manner, in particular in the field of wireless telecommunications networks, the authentication step aimed at ensuring telecommunications security, is carried out after a step called

  synchronization, this step not being secure.

  In known manner, this synchronization step can be constituted by the emission, by a first station, of a predetermined continuous signal, this signal being able to be detected by stations capable of

  to access this telecommunications network.

  Thus, according to the DECT standard (in English "Digital Enchanced Cordless Telecommunications"), the synchronization signal is a broadcast signal (in English "beacon") of information relating to the telecommunications network, this signal comprising, among other information , identity

of the network base station.

  This synchronization signal can be listened to and understood by any terminal compatible with the DECT standard.

  The present invention aims to improve security in telecommunications networks, and for this purpose relates to a method of securing access to a telecommunications network, the method comprising a step of transmission by a first station of a signal of dissemination of information representative of at least one condition for using the network for a step of synchronizing a second station with said first station. The method is characterized in that it includes, prior to the transmitting step, a step of encrypting the signal

broadcast by the first station.

  Correlatively, the invention relates to a method of accessing a radio telecommunications network characterized in that it comprises a step of decryption by a second station of a signal for the dissemination of information representative of at least one condition d use of the network for a

  synchronization of the second station with a first station.

  Thus, only the second stations adapted to decrypt the broadcast signal can synchronize with the first station.

  This security process thus reinforces the level of security in telecommunications networks. It can be combined with a

  subsequent authentication method known to those skilled in the art.

  According to a preferred embodiment, the encryption step of the security method according to the invention includes a shuffling step 15 using a generator polynomial.

  Correlatively, the step of decrypting the access method according to the invention includes a step of cleaning using the aforementioned generator polynomial. These mixing and de-brewing methods use the same generator polynomial. They are particularly advantageous because they

  allow the same algorithms to be used for encryption and decryption.

  According to a first preferred embodiment of this alternative embodiment, the generator polynomial used for stirring and defatting is the polynomial

1 + x-18 + X-23.

  This polynomial used in standard V29, and as described in the document "Modem Quadrature Amplitude Modulation", Principles and applications for fixed and wireless channels, W. T. Webb and L. Hanzo, pp. 266267, IEEE Press and Pentech Press, 1994 has particular advantages

for encryption and decryption.

  In particular, the scattering signal mixed with this polynomial appears highly random regardless of the shape of the scattering signal

original before encryption.

  In a manner known to those skilled in the art, the fact of increasing the length of the shift register for the implementation of a shuffling method using a generator polynomial makes it possible to improve the strength of the encryption. Therefore, in order to improve the encryption strength by

  compared to that obtained with the preceding polynomial, in another preferred embodiment of this variant embodiment, the polynomial 1 + X-1 + X-2 + X-3 + X-5 + X-7 + X-32 is used for mixing and unclogging, these encryption and decryption operations using a 32-bit shift register instead of 23 in the case of the use of the polynomial.

  According to an advantageous characteristic, the security method comprises a step of secure transmission by the first station of at least one piece of information for decrypting the encrypted broadcast signal intended for the second station, this secure transmission being effected by means of of a communication medium other than the medium of

radio communication.

  Correlatively, the access method according to the invention comprises a step of obtaining secure at least one piece of information for decrypting the encrypted broadcast signal, the secure obtaining being effected by means of a communication medium. other than the radio communication medium.

  This secure transmission step further strengthens the security of access to the telecommunications network, by controlling the transmission of the decryption information necessary for the

  decryption of the encrypted broadcast signal.

  This decryption information can for example be

  constituted by the coefficients of the aforementioned generator polynomial.

  According to a preferred embodiment, the secure transmission step uses a transmission method by capacitive effect in the near field. This particularly advantageous embodiment reinforces the security of access to the telecommunications network, because it requires that the equipment which wishes to access the telecommunications network be

  proximity to the transmitting equipment transmitting the decryption information.

  The invention also relates to a device for securing access to a radio telecommunications network, the device being able to be incorporated in a first station and comprising means for transmitting an information broadcast signal representative of at minus a condition of use of the network for the synchronization of a second station with the first station. The device is characterized in that it includes means for

broadcast signal encryption.

  The invention also relates to a device for accessing a network of

  radio telecommunications which can be incorporated into a second network station, the device being characterized in that it comprises means for decrypting a signal for broadcasting information representative of at least one condition for using the network for the purpose of synchronization of the second station with a first station of the network.

  The invention also relates to a base station and a terminal in a telecommunications network respectively comprising a security device and an access device as briefly described above /

  The invention also relates to a telecommunications network 20 comprising a base station and a terminal as briefly described above.

  The advantages and specific characteristics specific to the security device, to the access device, to the base station, to the terminal and to the telecommunications network being the same as those described above concerning the security method and the access method according to

  the invention, they will not be recalled here.

  Other aspects and advantages of the present invention will appear more clearly on reading the description of a particular embodiment which follows, this description being given solely by way of nonlimiting example and made with reference to the appended drawings in which :

  FIG. 1 represents the main steps of a securing method according to the invention in a preferred embodiment; FIG. 2 represents the main steps of an access method according to the invention in a preferred embodiment; FIG. 3 represents a telecommunications network in accordance with the invention in a preferred embodiment; and FIG. 4 represents a brewer used in a mode of

  realization of the present invention.

  FIG. 1 represents the main steps E110 to E130 of a security method in accordance with the present invention.

  In the preferred embodiment described here, the security method comprises a first step E110 of secure transmission of at least

  minus decryption information of the encrypted broadcast signal.

  This secure transmission step E110 is optional. This step is particularly unnecessary in the case where the decryption information necessary for decrypting the encrypted broadcast signal is stored in a non-volatile memory of the mobile terminals authorized to access the network.

  Different solutions can be envisaged for securely transmitting the decryption information.

  In the case of a private wireless telecommunications network 20 comprising, a base station (SB) and different mobile terminals (TM), this decryption information can for example be transmitted by the base station to the mobile terminals authorized to access to this network, by means

a serial cable.

  Thus, only a mobile terminal (TM) physically connected to the base station (SB) can obtain the decryption information of the broadcast signal.

  encrypted, and thus be able to access the network.

  In another embodiment, the decryption information can for example be stored in a smart card, this smart card having to be inserted in a mobile terminal (TM) wishing to access the network.

  Preferably, step E110 of secure transmission uses a method of transmission by capacitive effect in the near field.

  For example in this embodiment, this secure transmission is carried out by positioning the mobile terminal TM and the base station SB relative to each other so as to reconstitute two electrical capacities each comprising two electrically conductive surfaces at 5 opposite one another, the surfaces belonging respectively to the base station SB and to the mobile terminal TM. In this position, the base station SB detects the presence of the mobile terminal TM by measuring the electrical capacity

  between two terminals connected to surfaces of this base station.

  The secure transmission of the decryption information 10 is then carried out by capacitive link including an example known to those skilled in the art.

  profession is described in US Patent 6,211,999.

  In the preferred embodiment, step E10 of secure transmission of the decryption information is followed by a step E120 of encryption of the broadcast signal, this encryption step comprising a step 15 of shuffling using a generator polynomial.

  When the optional step E110 of secure transmission is not implemented, step E120 of the encryption of the broadcast signal is the

  first step of the securing method according to the invention.

  In a first embodiment, the generating polynomial is the polynomial 1 + x-18 + x-23.

  In this first embodiment, the aforementioned decryption information transmitted during the step El 0 previously described can be the exponents of the generator polynomial used to brew

  the broadcast signal, namely the values 18 and 23.

  In a second embodiment, the generator polynomial

  is the polynomial 1 + x-1 + X-2 + X-3 + x + x-7 + x32.

  This mixing method using a generator polynomial is known to a person skilled in the art. It consists in presenting the signal at the input of a shift register defined by the generator polynomial. In the embodiment in which the generating polynomial is the polynomial 1 + x-18 + x-23, the bit stream of the encrypted broadcast signal is the result of the logical operation XOR (exclusive OR) performed on the bits unencrypted broadcast signal and

bits in rows 18 and 23.

  Of course, on reception, the mobile terminal (TM) must receive at least 23 bits to synchronize.

  For more information on this patching technique, see the document "Modem Quadrature Amplitude Modulation", Principles and applications for fixed and wireless channels, W. T. Webb and L. Hanzo, pp.

  266-267, IEEE Press and Pentech Press, 1994.

  The step E120 of encryption of the broadcast signal is followed by a step E1 30 of transmitting the encrypted broadcast signal.

  In the preferred embodiment described here, step E130 of transmitting the encrypted broadcast signal is followed by step E120 of encrypting the broadcast signal already described. These steps thus constitute a loop

  for transmitting the encrypted broadcast signal continuously.

  We will now describe with reference to FIG. 2, the main steps E210 to E230 of an access method in accordance with the present invention.

  In the preferred embodiment described here, the access method comprises a first step E210 of securely obtaining at least one piece of information for decrypting the encrypted broadcast signal.

  This secure obtaining step E210 is optional. This step is in particular useless in the case where the decryption information necessary for the decryption of the encrypted broadcast signal is stored in a non-volatile memory of the mobile terminals authorized to access the network.

  In the preferred embodiment described here, this secure obtaining step uses a reception method by capacitive effect in the near field, as described above with reference to step El 1 0 of

  secure transmission of the security process.

  The secure obtaining step E210 is followed by a step E220

  receiving the encrypted broadcast signal.

  When the optional step E210 of secure transmission is not implemented, step E220 of reception of the encrypted broadcast signal is

  the first step of the access method according to the invention.

  In the preferred embodiment described here, the step E220 of receiving the encrypted broadcast signal is followed by a step E230 of decrypting the encrypted broadcast signal, this decryption step comprising a step of unclogging using the generator polynomial used for brew

the encrypted broadcast signal.

  Preferably and as already described, this generator polynomial 10 is the polynomial 1 + x-18 + x-23 or the polynomial 1 + X-1 + X-2 + X-3 + X-5 + X7 + X-32.

  In the embodiment in which the generating polynomial is the polynomial 1 + x-18 + x-23, the derating of the encrypted broadcast signal is the result of the logic operation XOR (exclusive OR) performed on the bits of the signal of encrypted broadcast received in step E220 and bits of rows 18 and 23 of this same signal.

  In the preferred embodiment described here, step E230 of decrypting the encrypted broadcast signal is followed by step E220 of receiving the encrypted broadcast signal already described. These steps thus constitute a loop making it possible to decrypt the encrypted broadcast signal continuously. 20 Thus, at the end of the decryption step E230, the original broadcast signal used at the input of the step E120 of encryption of the method is obtained.

security.

  Consequently, only the mobile terminals (TM) adapted to implement the access method described above recover the broadcast signal, synchronize with the base station (SB) and can access the

telecommunications network.

  A highly secure access method to the telecommunications network is thus produced, this method possibly being reinforced by an authentication step such as that usually implemented in the DECT standard at the end of the conventional synchronization step. .

  FIG. 3 schematically represents a network 10 in accordance with the present invention.

  The network 10 comprises at least one base station SB and one terminal TM as described below, in a preferred embodiment.

  The base station SB includes a device 100 for securing access to the network 10.

  The terminal TM comprises a device 200 for accessing the network 10. In a preferred embodiment, the security device 100 and the access device 200 respectively comprise: means 110 for secure transmission of decryption information an encrypted broadcast signal; and means 210 for securely obtaining this decryption information.

  These means 110 for secure transmission and 210 for secure obtaining are optional. They are in particular useless when the decryption information of the encrypted broadcast signal is stored in a non-volatile memory ROM 240 of the access device 200.

  In the preferred embodiment described here, the means 110 for secure transmission and 210 for secure obtaining respectively comprise means 150 for transmission by capacitive effect in the near field and

  means 250 of reception by capacitive effect in the near field.

  More particularly, the means 110 for secure transmission

  and, the secure obtaining means 210 each comprise two electrically conductive surfaces, making it possible to reconstitute, in a determined position of the base station SB and the mobile terminal TM, two electrical capacities for carrying out the transmission by capacitive link described previously with reference at step El 10 of secure transmission.

  In this preferred embodiment, the base station SB is adapted to communicate to the terminal TM the information necessary for decrypting the encrypted broadcast signal when these devices are placed at

close to each other.

  This characteristic makes it possible to obtain a very high level of

  secure access to the network 10.

  The security device 100 of the base station SB comprises means 120 for encrypting the broadcast signal.

  In the preferred embodiment described here, the broadcast signal is received by an input port 160 of the security device 100.

  The means 120 for encrypting the broadcast signal comprise shuffling means (or shuffler) 170 using a generator polynomial,

  a preferred example of which will now be described with reference to FIG. 4.

  FIG. 4 schematically represents a brewer 170 using the generator polynomial polynomial 1 + x1 8 + x-23. Such a brewer 170 10 is known to those skilled in the art. It consists of a shift register at 23

  memories of a bit and an XOR circuit (exclusive OR).

  In known manner, it receives as input a train of bits Di, each bit being successively presented at the input of the shift register.

  The output of the cross-connect 170 is constituted by the bit stream Ds, each of these bits being the output of the exclusive OR between the bits of rank 0, 18 and 23. Returning to FIG. 3, the security device 100 of the base station includes means 130 for transmitting the broadcast signal

  encrypted by encryption means 120.

  In the preferred embodiment described here, these transmission means 130 are wireless transmission means. They include in particular, and in a manner known to those skilled in the art, a radio module, comprising a

  transmitter and at least one modulator, filters and an antenna.

  The encrypted broadcast signal transmitted by the transmission means 130 of the base station SB is received by reception means 230 of the device

access 200 from the TM terminal.

  In the preferred embodiment described here, these reception means 230 are wireless reception means. They include in particular, and in a manner known to those skilled in the art, a radio module, comprising a receiver and at least one demodulator, filters and an antenna.

  The encrypted broadcast signal received by the reception means 230 is transmitted to decryption means 220 of the access device 200.

  In the preferred embodiment described here, these decryption means 220 are similar to the encryption means 120 of the device

security 100.

  In the embodiment described here, the signal resulting from the decryption of the broadcast signal encrypted by the decryption means 220 is transmitted to an output port 260 of the access device 200.

  Once this broadcast signal has been decrypted, the mobile terminal synchronizes with the base station and analyzes the information representative of at least one condition of network use included in the broadcast signal. 10 - In the embodiment described here, it determines in particular the available resources of the telecommunications network that can be

  used by the mobile terminal for a specific service.

Claims (27)

  1. Method for securing access to a telecommunications network (10), the method comprising a step of transmitting (E130) by a first station (SB) a signal for broadcasting information representative of at at least one condition for using said network (10) for a step of synchronizing a second station (TM) with said first station (SB), said method being characterized in that it includes, prior to said transmission step (E130), an encryption step (E120)   of said broadcast signal by the first station (SB).   2. Securing method according to claim 1, characterized in that said encryption step (E120) of said broadcast signal comprises a shuffling step using a generator polynomial.   3. Securing method according to claim 2, characterized in that said generator polynomial is the polynomial 1 + x-18 + x-23.   4. Securing method according to claim 2, characterized in that said generator polynomial is the polynomial 1 + x-1 + x-2 + x-3 + X-5 + X-7 + -32 x.   5. Securing method according to any one of claims 1 to 4, characterized in that it further comprises a step of   secure transmission (E110) by the first station (SB), of at least one piece of information for decrypting said encrypted broadcast signal intended for the second station (TM), said secure transmission being effected by means of a medium other than the radio communication medium.   6. A security method according to claim 5, characterized in that said secure transmission step (El 10) uses a method of   near-field capacitive effect transmission.   7. A method of accessing a radio telecommunications network characterized in that it comprises a step of decryption (E230) by a second station (TM) of a signal for broadcasting information representative of at least one condition d use of said network for synchronization of the second station (TM) with a first station (SB). 10 8. access method according to claim 7, characterized in that said decryption step (E230) comprises a step of cleaning using a generator polynomial.   9. Access method according to claim 8, characterized in that   that said generator polynomial is the polynomial 1 + x-18 + x-23.   10. Access method according to claim 8, characterized in that said generating polynomial is the polynomial 1 + X-1 + X-2 + X-3 + X-5 + X-7 + 20 x-32   11. Access method according to any one of claims 7 to 10, characterized in that it further comprises a step of secure obtaining (E210) of at least one piece of information for decrypting said encrypted broadcast signal, secure obtaining carried out through a medium of   communication other than the radio communication medium.   12. Access method according to claim 11 characterized in that said secure obtaining step (E210) uses a reception method 30 by capacitive effect in the near field.   13. Device for securing access to a radio telecommunications network (10), the device (100) being able to be incorporated in a first station (SB) and comprising means for transmitting (130) a broadcast signal information representative of at least one condition 5 of using said network (10) for the synchronization of a second station (TM) with the first station (SB), the device (100) being characterized   in that it includes encryption means (120) of said broadcast signal.   14. Securing device according to claim 13, 10 characterized in that the encryption means (120) comprise means for   stirring (170) using a generator polynomial.   15. Securing device according to claim 14, characterized in that said generator polynomial is the polynomial 1 + x-1 + 15 16. Securing device according to claim 14, characterized in that said generator polynomial is the polynomial 1 + x-1 + x-2 + 3 + -5 + -7 + X32   17. Securing device according to any one of   Claims 13 to 16, characterized in that it further comprises means for secure transmission (110) of at least one piece of information for decrypting said encrypted broadcast signal, the transmission being carried out via   a communication medium other than the radio communication medium. 25 18. Securing device according to claim 17, characterized in that said secure transmission means (110) comprise means (150) of transmission by capacitive effect in the near field. 19. Access device (200) to a radio telecommunications network (10) which can be incorporated into a second station (TM) of the network, characterized in that it includes means for decrypting (220) a broadcast signal information representative of at least one condition for using said network (10) for synchronization of the second station (TM)   with a first station (SB) on the network.   20. Access device according to claim 19, characterized in that said decryption means (220) comprise means for   cleaning using a generator polynomial.   21. Access device according to claim 20, characterized in that   that said generator polynomial is the polynomial 1 + x-18 + x-23.   22. Access device according to claim 20, characterized in that said generating polynomial is the polynomial 1 + X-1 + X-2 + x-3 + X-5 + X-7 + 15 x-32.   23. Access device according to any one of claims 19 to 22, characterized in that it further comprises means for secure obtaining (210) of at least one piece of information for decrypting the encrypted broadcast signal, secure obtaining carried out through a   communication medium other than radio communication medium.   24. Access device according to claim 23 characterized in that said secure obtaining means (210) comprise means (250) for receiving by capacitive effect in the near field.   25. Base station in a telecommunications network characterized in that it comprises a device for securing (100) access to a telecommunications network (10) according to any one of claims 13 to 18.   26. Terminal in a telecommunications network characterized in that it comprises an access device (200) to a network of   telecommunications (10) according to any one of claims 19 to 24.   27. Telecommunications network (10) characterized in that it comprises at least one base station (SB) according to claim 25 and at   at least one terminal (TM) according to claim 26.