Secured private communication network

Abstract

The invention relates to a method and a device for pairing a terminal (PC1, PC2) provided with a near-field communication module over a private network (RP) having an access point (DM) provided with a near-field communication module. The access point is located in the immediate vicinity of a user (U), the access point (DM) being able to communicate with the terminal: - over a first near-field communication (NFC) channel (IBC) using the electromagnetic wave conduction capacities of the user's body; and: - over a second channel (Wi-Fi) that is separate from the first channel (IBC). The method comprises, at the access point, the steps of: - obtaining (E11) a connection request message (MSG1) over the first channel when the user performs a motion to enter the immediate vicinity of the terminal (PC1); - transmitting (E13) a connection message (MSG2) comprising a network password (PW); - pairing (E13) the terminal over the private network (RP).

Description

[0001] DESCRIPTION

[0002] Title of the invention: Secure private communications network.

[0003] 1. Field of the invention

[0004] The invention relates to establishing a private communication network using near field technology.

[0005] 2. Prior Art

[0006] The invention relates in particular to access by a terminal to a wireless network, for example Wi-Fi, administered by an access point, for example a home gateway or a mobile phone of the "mobile hotspot" type, in which a mobile phone is used as a network gateway. Today, to connect to the access point, the user enters the identification parameters of the local network, for example of the Wi-Fi type, into the terminal. In particular, by a prior so-called "pairing" process, well known to those skilled in the art, he enters or selects the name of the home network, such as an SSID (for "Service Set Identifier"), which often takes the form of an alphanumeric string (for example: "MOB666") and, in most cases, a key, or password, for accessing the home network, such as a WEP key (for "Wired Equivalent Privacy") or WPA (for "Wi-Fi Protected Access") or PSK (for Pre-Shared Key).Terminal users must enter at least the network password. This is often tedious, especially since it is difficult to generate a password that is easy to remember and yet has a certain level of security, in other words, guarantees the robustness of the password used, i.e., makes it less vulnerable to hacker attacks aimed at stealing it.

[0007] There is therefore a need to improve the state of the art.

[0008] 3. Statement of the invention

[0009] The invention improves the state of the art. To this end, it relates to a method for pairing a terminal equipped with a near-field module on a private network with an access point equipped with a near-field module, said access point being in the immediate vicinity of a user, said access point being able to communicate with the terminal: - on a first near-field channel using electromagnetic wave conduction capabilities of said user's body, and:

[0010] -on a second channel distinct from the first channel, the method comprising, on the access point positioned near the user, the method comprising, on the access point, the steps of:

[0011] -obtaining a connection request message on the first channel, when said user makes a movement to enter the immediate vicinity of the terminal;

[0012] - transmission of a connection message containing a password for said network;

[0013] - pairing the terminal on said private network.

[0014] The invention thus makes it possible to create a private network, for example of the hotspot type, by authorizing the pairing of terminals with which the user positions himself in the near field.

[0015] Advantageously, the method uses the electromagnetic wave conduction capabilities of the human body. This data transmission channel is also known as IBC for "Intra Body Communication" in English. When the user touches the terminal, a radio carrier wave, or electromagnetic signal, is transmitted by the terminal through the user's body to the access point, positioned in proximity to the user, and adapted to receive such a signal. If the access point is a mobile device such as a smartphone, the IBC makes it possible to receive data on the user's mobile device via their body while allowing the user to keep their device in their pocket, for example. If the access point is a gateway-type device, the IBC makes it possible to receive data on the gateway via the user's body simply by approaching it or touching it.

[0016] Once the terminal has the password and has transmitted it to the access point, a classic pairing can be carried out to establish communication between the terminal and the access point and to connect to the private network administered by the access point.

[0017] By "IBC" or IBC communication, we mean a near-field communication passing through the user's body, compatible with classic NFC communication, in which the terminal containing the NFC device is in physical proximity to its NFC counterpart. Unlike body-based transmission systems that use electrodes, the use of IBC eliminates this by using classic NFC-type chips and relying on NFC standards. In addition, NFC / IBC does not require physical contact with the user, but only proximity (of the order of a few centimeters) between the user's body and the terminal or access point.

[0018] By "access point" we mean any routing element capable of creating a local network, for example Wi-Fi: gateway, mobile terminal positioned as a hotspot, router, etc., and having an NFC module adapted to receive IBC signals, hereinafter called NFC / IBC module.

[0019] A "terminal" means a terminal equipped with an NFC / IBC module. This could be, for example, a mobile phone, a tablet, a connected object, etc.

[0020] By "near field communication module" or "NFC / IBC module" is meant a controller, or NFC component (CLF for Contactless Frontend) constituting a near field communication module in the manner of an electromagnetic transponder and comprising software components (firmware, etc.) necessary for implementing NFC communications. Such a component is associated with an antenna, which transmits the received NF signals to the NFC component.

[0021] By "private network" we mean a local network, for example Wi-Fi, which allows terminals to communicate with each other and possibly with a broadband network, for example the Internet, via an access point. This private network may or may not overlap the local or corporate network traditionally administered by the access point. Indeed, some access points (for example a service gateway) can create and manage several networks, for example a first network (said private network) for the user's sensitive data, a guest network for temporary connections, a local network for home / company devices, etc.

[0022] According to another functional aspect, the invention also relates to a method for requesting pairing of a terminal equipped with a near-field module on a private network of an access point equipped with a near-field module, said access point being in the immediate vicinity of a user, said access point being able to communicate with the terminal: - on a first near-field channel using electromagnetic wave conduction capabilities of the body of said user, and:

[0023] - on a second channel distinct from the first channel, the method comprising, on the terminal, the steps of:

[0024] - transmission on the first channel of a connection request message when said user makes a movement to enter the immediate vicinity of the terminal;

[0025] - Receipt of a connection message containing a password from said network;

[0026] - Pairing the terminal on said private network.

[0027] According to particular embodiments of the invention, the above methods are characterized in that:

[0028] The said connection message is transmitted or received on the near field channel.

[0029] Advantageously, in this mode, the connection message containing the password is transmitted over the IBC channel. It is only transmitted if the user is in physical proximity to the two devices (access point and terminal), which provides an additional degree of security.

[0030] Said connection request message includes at least one terminal identification data.

[0031] Advantageously, according to this mode, the request message contains a terminal identifier, such as an address, a serial number, etc. This identifier facilitates the successive pairing of the terminal by the access point. If the terminal transmits, for example, its IP or MAC address to a gateway, it will be possible to simply authorize or refuse the pairing, to save it in the list of terminals authorized to access the private network for a subsequent connection, etc.

[0032] The said connection message includes the network name.

[0033] Advantageously, in this mode, the connection message contains the network name, so the terminal is not required to carry out a discovery phase beforehand. In addition, the name remains secret if it is transmitted over the IBC channel, which has a security advantage.

[0034] Said request and / or connection message is sent or received during an ISO 14443 type communication. Advantageously, in this mode, an existing standard is reused and complied with by all NFC equipment on the market. During an ISO 14443-3 type communication, messages imposed by the standard are exchanged between two devices (one generally being in reader mode and the other in card emulation mode). If the new request and / or connection message complies with the message format of the NFC standard (in terms of frequency, coding modes, frame types, frame content, etc.), compatibility with the existing fleet of terminals and access points can be ensured as best as possible.

[0035] - The request to connect to the private network is indicated in a field of the message left free by the NFC standard for future use or for a proprietary application.

[0036] - The password is indicated in a field of the message left free by the NFC standard for future use or for a proprietary application.

[0037] Advantageously, according to these modes, the protocol and frame format of an existing NFC standard are reused by using a field left free, or a field already defined for proprietary applications, in a frame, which therefore does not disrupt the operation of a receiver which would be solely of the NFC type.

[0038] The connection message transmission step is preceded by positioning the module in the near field of the access point in reader mode.

[0039] The step of obtaining the request message is preceded by positioning the module in the near field of the access point in card emulation mode.

[0040] The step of sending the request message is preceded by positioning the module in the near field of the terminal in reader mode.

[0041] The connection message reception step is preceded by positioning the module in the near field of the terminal in card emulation mode.

[0042] The invention also relates to a device for pairing a terminal equipped with a near-field module on a private network of an access point equipped with a near-field module, said access point being in the immediate vicinity of a user, said device being characterized in that it is configured to implement at the access point: communicate with the access point on a first near-field channel using electromagnetic wave conduction capabilities of the body of said user, and on a second channel distinct from the first channel; obtain a connection request message on the first channel when said user makes a movement to enter the immediate vicinity of the terminal;

[0043] - transmit a connection message containing a password to said network; pair the terminal on said network administered by the access point.

[0044] The invention also relates to a device for requesting pairing of a terminal equipped with a near-field module on a private network of an access point equipped with a near-field module, said access point being in the immediate vicinity of a user, characterized in that it is configured to implement at the terminal:

[0045] - communicating with the access point on a first near-field channel using electromagnetic wave conduction capabilities of the body of said user, and on a second channel distinct from the first channel;

[0046] - send a connection request message on the first channel when said user makes a movement to enter the immediate vicinity of the terminal;

[0047] - receive a connection message containing a password from said network;

[0048] - pair the terminal on said private network.

[0049] The invention also relates to a computer program comprising instructions for implementing one of the methods according to any of the particular embodiments described above, when said programs are executed by a processor. The methods can be implemented in various ways, in particular in wired form or in software form.

[0050] These programs may use any programming language, and may be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form. The invention also provides a recording medium or information medium readable by a computer, and comprising instructions of a computer program as mentioned above. The recording media mentioned above may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a hard disk.On the other hand, the recording media may correspond to a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The programs according to the invention may in particular be downloaded over a network such as the Internet.

[0051] Alternatively, the recording media may correspond to an integrated circuit in which the program is incorporated, the circuit being adapted to carry out or to be used in carrying out the method in question.

[0052] 4. List of figures

[0053] Other characteristics and advantages of the invention will appear more clearly on reading the following description of particular embodiments, given as simple illustrative and non-limiting examples, and the appended drawings, among which:

[0054] [FIG. 1] Figure 1 illustrates an example of an environment for implementing the invention according to a particular embodiment of the invention.

[0055] [FIG. 2] Figure 2 illustrates an example of an environment for implementing the invention according to another particular embodiment of the invention.

[0056] [FIG. 3] Figure 3 represents steps of the peering method on a private network according to a particular embodiment of the invention.

[0057] [FIG. 4] Figure 4 represents the architecture of an access point according to a particular embodiment of the invention.

[0058] [FIG. 5] Figure 5 represents the architecture of a terminal according to a particular embodiment of the invention. [FIG. 6] Figure 6 illustrates an NFC / IBC request frame according to a particular embodiment of the invention.

[0059] 5. Description of an embodiment of the invention

[0060] The general principle of the invention is to create a secure private communication network between at least two terminals. This private network can be a subset of an already existing local network (for example, that of the home, administered by the service gateway) or a new private network (for example, a guest network of such a gateway).

[0061] Figure 1 illustrates an example of an environment for implementing the invention according to a particular embodiment.

[0062] According to this embodiment, the mobile device DM positions itself as an access point (technique also called connection sharing mode, or "tethering" or hotspot) and authorizes the connection of one or more terminals (PCI and / or PC2) to the access point via a near-field initialization of the Intra Body Communication (IBC) type. Subsequently, the terminals of the private network thus created can communicate and possibly with other terminals on another network (Internet, etc.) via the access point,

[0063] The mobile device (DM) according to the invention is a portable device naturally capable of receiving radio carrier waves, via an antenna, through the body of the user (U). For this purpose, the mobile device (DM) is located in the immediate vicinity of the user (U), without necessarily being in direct contact with the latter. For example, the mobile device (DM) is placed inside a pocket or bag carried against the user. In these configurations, it is estimated that the mobile device (DM) is not more than a few centimeters from the user's body. The distance is for example less than 5 cm. According to this example, it is a mobile device equipped with an NFC antenna (not shown) adapted in IBC mode to receive the modulated electrical signals in the form of an electromagnetic wave through the user's body when the latter is in the immediate vicinity of the PC terminal (PCI).A terminal is a device with a Wi-Fi connection and an NFC / IBC module, such as a laptop, a tablet, a connected object (printer, hard drive, decoder, smartphone, etc.).

[0064] According to the particular embodiment illustrated in Figure 1, data is transmitted between the PCI terminal and the user's mobile device (DM) via the IBC channel. This data corresponds to connection data allowing the mobile device (DM) to authorize the PCI terminal on a private local network administered by the access point of the mobile device.

[0065] When the user touches the PCI with, for example, their hand, the NFC signal emitted by the terminal (PCI) is transmitted via the user's body to their mobile device (MD).

[0066] To this end, according to one example, the PCI terminal positions itself in reader mode within the meaning of the NFC standard and then encodes an NFC near field communication protocol frame, for example a type B frame according to the ISO / IEC 14443-3 protocol. Figure 6 illustrates an example of a part of such a frame. For this, the PCI generates an NFC frame comprising a connection request indicating the request to connect to the private network, for example, as will be detailed later, in an “AFI” (application family identifier) ​​field of the NFC frame. Optionally, the NFC frame includes an identifier of the PCI (ID PC1) allowing the mobile device (MD) to recognize it and / or register it before establishing Wi-Fi communication with the PCI to transmit the access codes to its private network.

[0067] The DM mobile device receives the NFC / IBC signal emitted by the PCI (transmitted via the user's body), decodes the received NFC / IBC frame, extracts the connection request and optionally data relating to the PCI, for example the MAC address or the IP address of the PCI.

[0068] The DM mobile device then pairs the PCI with its Wi-Fi Hotspot network, i.e., it transmits the password for the Wi-Fi hotspot network. Optionally, it also transmits a network name. As is known, in a "hotspot" type Wi-Fi network, the access point and a terminal share a secret. According to the IEEE 802.11 standard, this is a shared security key PSK (for "Pre-Shared Key"), which is human-readable and comprises between 8 and 63 characters in ASCII format. The PSK key is generally chosen by the mobile device's application, and any terminal that wants to connect to it must know this key. According to the prior art, the user of the PCI terminal must enter it via an interface of the terminal so that the latter can establish a connection with the DM access equipment. The method according to the invention makes it possible to do away with this: the pairing, initiated via IBC, avoids the user having to enter the network identifiers.It also allows the mobile device's hotspot network to be secured: only terminals approached (in the sense of NFC proximity) by the user are authorized to connect to the hotspot.

[0069] According to one embodiment, the network identifiers are transmitted via Wi-Fi to the terminal.

[0070] According to another embodiment, the network identifiers are transmitted via Bluetooth.

[0071] According to another embodiment, the network identifiers are transmitted in an NFC / IBC frame emitted by the mobile device DM. It is positioned in reader mode within the meaning of the NFC standard then: according to a first variant, the user brings his mobile device (DM) close to the PCI in order to conventionally transmit to it an NFC frame comprising the network identifiers; according to a second variant, the user keeps his mobile device in his pocket and the frame is emitted in IBC format. In this case, the PC must be positioned in “card emulation” mode within the meaning of the NFC standard and be capable of receiving IBC frames, which assumes that its reception power is adapted to the NFC-IBC waves.

[0072] Once the PCI has the hotspot network credentials, it connects to it in the usual way via Wi-Fi. The PC2 can pair with the DM terminal's hotspot in the same way.

[0073] Figure 2 illustrates an example of an environment for implementing the invention according to a particular embodiment of the invention.

[0074] According to this embodiment, the user's local network gateway (GW) authorizes the connection of the terminal (PCI) to a private network via a near-field initialization of the Intra Body Communication (IBC) type. This private network may be the local network conventionally administered by the gateway, or a subset of this local network, or another local network that the gateway may for example define as a private "guest network", only concerning terminals "touched" by the user (in the sense of NFC proximity) and intended for example to share sensitive information.

[0075] The user stands near or touches the gateway equipped with an NFC / IBC module according to the invention. He then simply needs to also touch a terminal equipped with a corresponding module (for example, by picking up a laptop or tablet) for the terminal to be paired on a local network of the gateway's access point.

[0076] According to the state of the art, to access a local network, a user must connect to the service gateway from the terminal. To connect to the gateway, the user enters the identification parameters of the local network, for example of the Wi-Fi type, into the terminal. In particular, by a prior so-called "pairing" process, well known to those skilled in the art, he enters or selects the name of the local network, known by the abbreviation SSID (for "Service Set Identifier"), which often takes the form of an alphanumeric string (for example: "Livebox_666") and, in most cases, a key, or password, for accessing the home network, such as a WEP (for "Wired Equivalent Privacy") or WPA (for "Wi-Fi Protected Access") key.Defining a security key for a Wi-Fi network requires generating relatively long alphanumeric security keys, due to the compromise to be made between network security and ease of memorization and / or sharing of the key. The WEP key generated to protect access to the user's local network may be in the known form of a sequence of 26 hexadecimal characters (for example, "32F34DA4CFE9EAD355A49EAE17"). Users are often reluctant to use such long and complex keys. According to this embodiment of the invention, data is transmitted between the PCI terminal and the service gateway via the IBC channel. This data allows the gateway to authorize the PCI terminal on its private network (main or "guest").

[0077] When the user touches the PCI with, for example, their hand, the NFC signal emitted by the PCI is transmitted via the user's body to the gateway. For this purpose, the PCI encodes, for example, as described above, an NFC near-field communication protocol frame, after positioning itself in reader mode within the meaning of the NFC standard. This message may include a connection request and / or an identifier of the PCI (IP address or MAC address).

[0078] The gateway receives the NFC signal emitted by the PCI (transmitted via the user's body), decodes the received NFC frame, extracts the connection request and optionally a PCI identifier. In this case, the gateway must be capable of receiving IBC frames, which requires an adequacy of its reception power for NFC-IBC waves.

[0079] The gateway transmits the password and optionally the name of the local network.

[0080] According to one embodiment, the network identifiers are transmitted via Wi-Fi to the terminal.

[0081] According to another embodiment, the network identifiers are transmitted via Bluetooth.

[0082] According to another embodiment, the network identifiers are transmitted in an NFC / IBC frame emitted by the gateway. It is positioned in reader mode within the meaning of the NFC standard then: according to a first variant, the user brings his terminal close to the gateway in order to conventionally transmit to it an NFC frame comprising the network identifiers; according to a second variant, the user keeps his terminal away from the gateway and the frame is emitted in IBC format. In this case, the PC must be capable of receiving IBC frames, which assumes that its reception power is adapted to the NFC-IBC waves.

[0083] Once the PC has the local network identifiers (SSID and WEP key), it connects to it in the usual way.

[0084] The gateway then pairs the PCI on its private network, i.e. it authorizes it on the private network defined by the name and password (main or guest network).

[0085] Figure 3 represents steps of the method for creating a private network according to a particular embodiment of the invention as described in support of Figure 1 or 2. In the following, the mobile device DM and / or the gateway GW are called “access point” PA. At the end of the method, at least one terminal (PC) is paired on the private network of the access point. The pairing, carried out via IBC, makes it possible to secure the network in question: the fact that the user “touches” the terminal is in fact a guarantee of security.

[0086] During an EO step, the PC terminal prepares for connection. It turns on (or the user does it for it) a Wi-Fi radio channel and, if applicable, the NFC / IBC module, if it is not activated by default. It preferably positions itself in card reader mode in order to be able to transmit frames compliant with NFC standards.

[0087] During step El 0, the access point prepares for connection. It turns on a Wi-Fi radio channel if necessary (or the user does it for it), and positions itself in Wi-Fi "hotspot" mode. It activates the NFC / IBC module if necessary, if it is not activated by default. It preferably positions itself in "card emulation" mode in order to be able to receive frames compliant with NFC standards.

[0088] During a step E1, the terminal prepares and then emits an NFC signal suitable for transmission via the human body, advantageously of the NFC type (i.e. at the NFC-13.56 MHz frequency and with the characteristics of the NFC standard). This signal includes an NFC type request message, with the aim of initiating a dialogue between the terminal and the access point, in NFC / IBC mode, in accordance with the NFC standards.

[0089] The user's body receives Fonde and transforms into an antenna, meaning that it re-emits electromagnetic Fonde which is then diffused throughout the body.

[0090] A data item (DCX) requesting connection to the service is inserted into the signal. This may, for example, be a service code corresponding to a request to connect to the access point's private network. The new MSG1 message preferably complies with the standard's message format. According to an example, detailed later in support of Figure 6, this is an NFC-B type message, so the fields are reused to indicate the type of communication required (request for connection to the local network via IBC) and optionally terminal data and / or, non-exhaustively, any data useful for pairing, such as the private network name if the terminal already knows it.

[0091] According to one embodiment, a personal data DID relating to the terminal (address, unique identifier, etc.) is inserted into the signal. This may be, for example, a number, a reference, a key, etc., or more generally any identification sign which subsequently allows the access point to accept and optionally memorize this device. This may be, for example, a number, a reference, a key, etc., or more generally any identification sign which subsequently allows the access point to accept this terminal (for example, the MAC address of the terminal).

[0092] According to one embodiment, the network name (e.g. SSID) is inserted into the signal. This assumes that the terminal is aware of the name, either because the mobile device is positioned as a hotspot and therefore broadcasts its name on a WiFi channel, or because the terminal has memorized the name during a previous connection.

[0093] Alternatively, a set of names known to the terminal is inserted into the signal (eg a list of SSIDs).

[0094] In a step E11, the access point receives the signal from the user's body; for this purpose the access point is positioned (for example by the application) in an electromagnetic wave reception mode. The access point receives and demodulates the received signal. If the signal includes connection request data (DCX), the method continues with a step E12.

[0095] In the optional step E12, a personal DID data relating to the terminal (address, unique identifier, etc.) is read from the signal. The access point stores this identifier, for example in a table in memory (M), for later use. It also reads, optionally, the name of the network if transmitted in the signal.

[0096] In a step E1 3, the mobile device DM prepares a message MSG2 comprising the password PW of the network and optionally the name of the network (if not received in the previous step). According to this embodiment, this message MSG2 is transmitted in a signal through the user's body; for this purpose the access point is positioned in a reader mode. According to another embodiment, this message is transmitted on a Wi-Fi, Bluetooth, etc. channel.

[0097] During a step E2, the terminal receives the message, broadcast according to this embodiment through the user's body. It extracts the password and optionally the name of the network (if not known and transmitted in the previous step).

[0098] A communication channel can then be established conventionally between the terminal and the access point, during steps E3 and E13: the terminal transmits, for example, the name and password to the access point, and the access point accepts the connection if the name and password are correct. From this moment on, the terminal is connected to the private network of the access point.

[0099] Figure 4 represents the architecture of an access point (AP) according to particular embodiments of the invention. It is recalled that the access point PA can be a mobile device (MD) positioned as a hotspot (Fig. 1), or a service gateway (GW) of a local network (Fig. 2).

[0100] According to a particular embodiment of the invention, the access point (AP) has the conventional architecture of a computer and notably comprises a memory MEM, a processing unit UT, equipped for example with a processor PROC, and controlled by the computer program PG stored in memory MEM. The computer program PG comprises instructions for implementing the steps of the pairing method as described previously, according to any of its embodiments, when the program is executed by the processor.

[0101] During initialization, the code instructions of the computer program PG are, for example, loaded into a memory before being executed by the processor.

[0102] A mobile device (MD) further includes an access point or tethering mode (TETH), which allows it to transform into a gateway.

[0103] The PA access point also includes a set of COM modules (routing modules, etc.) which traditionally allow it to communicate with one or more terminals on its local network and give them access to a LAN or a WAN (mobile network, Internet, etc.)

[0104] The AP access point also includes a number of modules that allow it to communicate with local and wide area networks, via different protocols on different physical links; in Figure 4, a Wi-Fi (WIF) module is shown diagrammatically, allowing wireless communications with the Internet network, the mobile network, and / or the local network. It can also be a Bluetooth, Li-Fi, Ethernet module, etc.

[0105] The access point, mobile device or gateway, also includes an application module (CONT) responsible for controlling the IBC / Wi-Fi communication according to embodiments of the invention. The CONT module, which may be software and / or hardware, is in particular capable of performing the actions that have been described in support of the preceding figures: positioning the access point in the IBC mode in transmission and / or reception, in reader mode or NFC card emulation, retrieval and storage of the message (MSG1) comprising the connection request and the identification of the terminal, preparation and transmission of the connection identifiers (MSG2), effective connection with the terminal, etc.

[0106] Part of the MEM memory stores, among other things, the parameters for identifying and associating home terminals with the access point (identifier table including the unique identifiers of home terminals that have already been authorized to access the home network via the access point, routing elements, etc.).

[0107] The PA device also comprises an NFC / IBC communication module configured to establish contactless communications, and in particular to emit a signal intended to be transmitted by the user's body, and to receive in return an electromagnetic signal that has passed through and been re-emitted by the body. This module conventionally comprises an NFC antenna (ANT) adapted to receive signals on the radio channel and via the user's body, so that a modulated electrical signal carried by the user's body is able to be received by the NFC antenna when it is in proximity to the human body. By adapted, it is meant that the antenna can be amplified, or that the antenna has a sufficiently high gain. Acquiring such an antenna or amplifying it is within the scope of those skilled in the art.The NFC / IBC module also includes a demodulator (not shown), intended to receive a modulated electrical signal via the antenna and to transform it into a digital signal intended to be transmitted to the processing unit, a modulator, a controller and software components (firmware, etc.) necessary for implementing NFC / IBC communications.

[0108] It also optionally includes a Bluetooth communication module. It also optionally includes a UMTS or equivalent communication module for access to the mobile network.

[0109] All modules communicate with each other conventionally via a data bus (not shown). Figure 5 represents the architecture of a terminal according to particular embodiments of the invention.

[0110] The terminal (PC) has the classic architecture of a computer and notably comprises a memory MEM', a processing unit UT', equipped for example with a processor PROC', and controlled by the computer program PG' stored in memory MEM'. The computer program PG' comprises instructions for implementing the steps of the pairing request method as described previously, according to any one of its embodiments, when the program is executed by the processor.

[0111] During initialization, the code instructions of the computer program PG' are, for example, loaded into a memory before being executed by the processor.

[0112] It also includes a COM' module for communicating with an access point as well as a number of modules that allow it to communicate via different protocols on different physical links; in Figure 5, a Wi-Fi (WIF') module is shown diagrammatically, allowing wireless communications with the access point. It can also be a Bluetooth, Li-Fi, Ethernet, etc. module.

[0113] The terminal also includes an application module (CONT') responsible for controlling the IBC / Wi-Fi communication according to embodiments of the invention. The CONT' module, which may be software and / or hardware, is in particular capable of performing the actions that have been described in support of the preceding figures: positioning the terminal in the IBC mode in transmission and / or reception, in reader mode or NFC card emulation, preparation and transmission of the message (MSG1) comprising the connection request and the identification of the terminal, reception of the connection identifiers (MSG2), effective connection with the access point, etc.

[0114] The PC terminal also includes an NFC / IBC' communication module configured to establish contactless communications, and in particular to emit a signal intended to be transmitted by the user's body, and to receive in return an electromagnetic signal that has passed through and been re-emitted by the body. This module conventionally includes an NFC antenna (ANT') adapted to receive signals on the radio channel and via the human body, so that a modulated electrical signal transported by the body is able to be received by the NFC antenna when it is in proximity to the user's body. By adapted, it is meant that the antenna can be amplified, or that the antenna has a sufficiently high gain. Acquiring such an antenna or amplifying it is within the scope of those skilled in the art.The NFC / IBC module also includes a demodulator (not shown) intended to receive a modulated electrical signal via the antenna and to transform it into a digital signal intended to be transmitted to the processing unit, a modulator, a controller and software components (firmware, etc.) necessary for implementing NFC / IBC communications.

[0115] All modules communicate with each other conventionally via a data bus (not shown)

[0116] Figure 6 illustrates an NFC / IBC request frame according to a particular embodiment of the invention.

[0117] It should be remembered that NFC communications can cover two types of applications linked to two different operating modes on an NFC device:

[0118] - The first mode, called reader mode, relates to reading data on transponder-type devices, or NFC cards. The device in this mode is active. It transmits commands as it would send them to a contactless card according to the ISO 14443 (or Felica) standard. It generates a magnetic field which, when in contact with the passive card antenna, induces an electric current which powers the card.

[0119] - The second mode, called emulation mode, implements an emulation of a near-field communication module, typically to secure electronic transactions between an application stored on the device and an external reading terminal, or reader terminal; in this mode, the NFC equipment of the device is used passively. It simulates the behavior that a passive contactless card would have. It is capable of receiving an initialization message from the reader.

[0120] The main steps for initializing NFC communication between an issuer and a card are defined in part 3 of the ISO 14443-3 standard. For a type B card, the reader terminal sends an identification request (called “REQB” or “WUPB”) and waits for a response (called “ATQB”) from the mobile terminal. This embodiment proposes to reuse such a protocol message, so as to insert a network connection request indication (DCX) in the request message (MSG1) and optionally a certain amount of data for the subsequent communication (terminal DID identifier, SSID, etc.).

[0121] As illustrated in Figure 6, and detailed in the aforementioned 14443-3 standard, the standardized REQB / WUPB message contains:

[0122] - a start of frame byte, S OF;

[0123] - an APf anti-collision prefix byte (fixed value, in hexadecimal 0x5);

[0124] - a so-called "AFI" byte indicating the application family representing the type of application targeted by the NFC reader (all applications - code 00, transport, finance, telecommunication, etc.) Only proximity cards with applications of the type indicated by the AFI are authorized to respond to a REQB / WUPB command with an AFI other than "00". When AFI is equal to "00", all proximity cards must process REQB / WUPB. These coding rules are specified in Table 12 of the aforementioned 14443 standard, reproduced below;

[0125] - a “param” byte indicating in particular the type of request (REQB or WUPB);

[0126] - a two-byte “CRC B” byte containing a code for detecting and correcting errors.

[0127] [Table 1]

[0128] Table 12 — AFI Coding

[0129] Wl

[0130] Figure 6 illustrates a possible reuse of these fields, concerning a particular implementation mode.

[0131] The connection request message MSG1 contains, according to this example (MSG1_1), the start of frame (SOF) message immediately followed by the data bytes required for the IBC request. Since the AFI field is overwritten, the NFC module of the access point will not respond to this request. The data fields may include, among other things, a terminal identifier (DID, for example the MAC address of the terminal), the network name (distributed over two bytes according to the example), etc. The message also contains a two-byte "CRC IBC" byte containing a code for detecting and correcting errors.

[0132] The connection request message MSG1 contains, according to a second example (MSG1_2), a first APf anti-collision prefix byte, unmodified, then the “AFI” byte adapted for the IBC while maintaining compatibility with the standard. With reference to table 12 of the aforementioned 14443 standard, reproduced above, the value 0x0 of the first half-byte corresponds to a private subfamily of the type specified in the second half-byte. This second half-byte can therefore be used to specify a type of IBC request (here, DCX, the request for connection to the local network, for example DCX = '1'). It should be noted that it is possible, in this way, to provide several types of requests, varying in particular according to the type of network: connection to a Wi-Fi type network, Bluetooth type network, Ethernet type network, mobile network, etc.

[0133] Naturally, these two examples are in no way limiting and the person skilled in the art could imagine any adaptation of this message or another NFC initialization message. For example:

[0134] - the hexadecimal values ​​0x9 to OxF of the first half-byte of the AFI field are reserved; one of these reserved values ​​can therefore be used without encroaching on the standard, for example 0x9 for IBC applications, generally the second half-byte of the field containing the IBC application type;

[0135] - a change in the value of the SOF field would allow the mobile terminal to immediately detect a non-NFC message; etc.

[0136] The connection message (MSG2) can use a similar type of format for transporting data transmitted from the access point to the terminal (password, SSID, etc.). To do this, the access point must be positioned in reader mode and the terminal in card emulation mode.

Claims

Demands 1. Method for pairing a terminal (PCI, PC2) equipped with a near-field module on a private network (RP) with an access point (DM, GW, PA) equipped with a near-field module, said access point being in the immediate vicinity of a user (U), said access point being capable of communicating with the terminal (DM): - on a first channel (IBC) in near field (NF) using electromagnetic wave conduction capabilities of the user's body, the method comprising, at the access point, the steps of: - obtaining (El 1) a private network connection request message (MSG1) on the first channel, when said user makes a movement to enter the immediate vicinity of the terminal (PCI); - transmission (E13) of a connection message (MSG2) containing a password (PW) for said network; - pairing (El 3) of the terminal on said private network (RP).

2. Method for requesting pairing of a terminal (PCI, PC2) equipped with a near-field module on a private network (RP) of an access point (DM) equipped with a near-field module, said access point being in the immediate vicinity of a user (U), said access point being capable of communicating with the terminal (DM): - on a first channel (IBC) in near field (NF) using electromagnetic wave conduction capabilities of the user's body, the method comprising, on the terminal, the steps of: - transmission on the first channel (El) of a message (MSG1) requesting connection to the private network when said user makes a movement to enter the immediate vicinity of the terminal (PCI); - receipt (E2) of a connection message (MSG2) containing a password (PW) for said network; - pairing of the terminal on said private network (PR).

3. Method according to claim 1 or 2, characterized in that said connection message (MSG2) is transmitted or received on the near field channel (IBC). A method according to claim 1 or 2, characterized in that said connection request message (MSG1) includes at least one terminal identification data (DID, MAC address). A method according to claim 1 or 2, characterized in that said connection message (MSG2) includes the network name (SSID). A method according to claim 1 or 2, wherein said request message (MSG1) is obtained or transmitted during an ISO 14443 type communication. A method according to the preceding claim, wherein the private network connection request is indicated in a message field left free by the NFC standard for future use or for a proprietary application (AFI, PARAM). A method according to claim 3, wherein said connection message (MSG2) is transmitted or received during an ISO 14443 type communication.A method according to the preceding claim, wherein the password (PW) is indicated in a field of the message left free by the NFC standard for future use or for a proprietary application (AFI, PARAM). A device for pairing a terminal (PCI, PC2) equipped with a near field module (NFC / IBC') on a private network (RP) of an access point (DM, GW, AP) equipped with a near field module (NFC / IBC), said access point being located in the immediate vicinity of a user (U), said device being characterized in that it is configured to implement at the level of the access point: - communicate with the access point (DM, GW, AP) on a first channel (IBC) in near field (NFC) using electromagnetic wave conduction capabilities of the user's body; - obtain (El) a connection request message (MSG1) on the first channel when said user makes a movement to enter the immediate vicinity of the terminal (PCI); - transmit a connection message (MSG2) containing a password (PW) for said network; - pair the terminal on said private network (PR). Pairing request device for a terminal (PCI, PC2) equipped with a near field module (NFC / IBC) on a private network (PR) of an access point (AP) equipped with a near field module (NFC / IBC), said access point being located in the immediate vicinity of a user (U), characterized in that it is configured to implement at the terminal level: - communicate with the access point (AP) on a first channel (IBC) in near field (NFC) using electromagnetic wave conduction capabilities of said user's body; - to send (El) a connection request message (MSG1) on the first channel when said user makes a movement to enter the immediate vicinity of the terminal (PCI, PC2); - receive a connection message (MSG2) containing a password (PW) for said network; - pair the terminal on said private network (PR) Program comprising instructions for implementing the pairing or pairing request method according to any one of claims 1 to 9, when said program is executed by a processor.

Images