A method of encrypting information transmitted within a communication network

Abstract

The invention relates in particular to an encryption method (100) and a decryption method used within a communication network in which two encryption systems coexist. The invention thus makes it possible to guarantee that, for information transmitted within this communication network, the decryption method applied by the receiving entity is indeed the inverse of the encryption method used by the sending entity. In order to determine whether the transmitted information was encrypted using the first or the second encryption system, the invention uses a set of information comprising different disjoint subsets of information, the number of which is finite and known. Figure to be published with the abstract: Fig. 1

Description

Title of the invention: Method for encrypting information transmitted within a communications network TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of methods for encrypting and decrypting information transmitted within a telecommunications network.

[0002] The present invention relates to a method for encrypting information transmitted within a communication network and to a method for decrypting the encrypted information. The present invention also relates to a communication network, a computer program product and a computer-readable medium enabling the implementation of such methods. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0003] Currently, some communication networks offer solutions for encrypting data and / or media transmissions such as voice. Some so-called "encrypted" networks require the encryption of terminal addresses to withstand analysis of network traffic and ensure the confidentiality of information transmitted within these networks.

[0004] Typically, this is generally the case for a professional radiocommunication network infrastructure of the PMR type, an acronym commonly used for the Anglo-Saxon term “Professional Mobile Radio” meaning in French “Radio Mobile Professionnelle”.

[0005] Professional PMR communication networks of the TETRA® type, for "TErrestrial Trunked RAdio" in English, or TETRAPOL®, or P25® type, defined by the "Telecommunications Industry Association (TIA)", are independent mobile communication networks dedicated to the use of businesses or administrations, in particular to ensure public safety, industrial safety or transport activities. Professional PMR communication networks are thus widely used by public safety and emergency services, and also by many other categories of users, for example in public transport, airports, etc. These are private networks which offer a high level of security. These private networks can in certain cases constitute direct mode communication networks between terminals, that is to say that communication takes place between the terminals without an intermediary entity.

[0006] Professional PMR communication networks have a cellular architecture common to all types of communication networks comprising a set of communication terminals and one or more access points. The communication terminals Communication terminals are mobile or fixed terminals. Mobile terminals connect to the communication network via a wireless access point or can operate directly in direct mode with other mobile terminals without an access point. Fixed terminals connect to the communication network via infrastructure access points. Mobile communication terminals and fixed communication terminals will be referred to interchangeably as "terminals" in the remainder of this application. Wireless access points and infrastructure access points will be referred to interchangeably as "access points" and noted PA in the remainder of this application.

[0007] The terminals of encrypted professional communication networks implement one or more encryption and decryption methods. These encryption and decryption methods are applied to different services such as the protection of addresses, data, voice, media. The addresses can be either individual terminal addresses or collective addresses designating a group of at least two terminals.

[0008] An encryption method is a cryptographic method that makes it impossible for anyone without the decryption key to understand information. In order to make encrypted information understandable, the decryption method must be applied to the encrypted information. It is common to divide encryption methods into two categories: symmetric encryption methods and asymmetric encryption methods. Symmetric encryption methods are based on a key for decrypting the ciphertext that is the same as the key used to encrypt the plaintext. Asymmetric encryption methods use a set of two keys: a public key for encryption and a private key for decryption. An encryption method uses one or two keys.Generally, common keys and individual keys are distributed allowing the management of different qualities of communication services for the terminals of the network. Professional encrypted communication networks require in particular a communication network architecture including a key management server. For the sake of simplicity, these elements are not mentioned in the remainder of the application, but it is obvious that all types of keys can be used by the encryption and decryption methods as described in the present application. Similarly, the communication network allowing the implementation of the encryption and decryption methods according to the invention can comprise a key management server.

[0009] It is generally accepted that the level of security within a communications network depends in particular on the encryption and decryption processes applied to the information transmitted within the networks. In addition, the level of security of a communication network is challenged by new attacks. For example, quantum attacks will lead to replacing or modifying a large part of the encryption and decryption processes commonly used within communication networks. Thus, it is sometimes necessary to increase the security level of the communication network by fully or partially migrating all terminals from one encryption capability to a second encryption capability. An encryption capability is the ability of an entity in a communication network to implement an encryption process. The encryption capability may be dependent on the hardware and / or software characteristics of each entity in a communication network. Thus, this encryption capability can be deduced, for example, from the hardware version of the entity, or notified, for example, by the access point to all terminals.Additionally, this encryption capability can be changed, for example, by a software update.

[0010] In the case of an existing operational communications network, all terminals accessing the communications network must simultaneously have the same encryption capability. In order to implement the new encryption method, it is then necessary to recall all terminals to modify the hardware or software of said terminals. This therefore requires an interruption in the operation of the terminals. In addition, it is sometimes necessary to replace terminals that cannot migrate to the new encryption capability.

[0011] Another solution is to allow the coexistence of two types of encryption within a communication network. Thus, the communication network comprises two sets of terminals: • A first set of terminals already deployed, having the first encryption capacity, operates with the old encryption process, • A second set of terminals in migration or deployment, having the second encryption capability, operates with the new encryption process.

[0012] The coexistence of two types of encryption as implemented by current methods, however, has many drawbacks. For example, standardized protocols do not allow modification without breaking interoperability between old terminals and a modified infrastructure, a fortiori in an operational network. In addition, sending communications from the infrastructure to a plurality of terminals via an access point is no longer possible by using a single common encryption method. Another drawback is that interoperability between the terminals of the two sets is not ensured and that this management of two encryption methods complicates operations and network maintenance. Finally, when the encryption method is applied to the addresses of the terminals, it is no longer possible for the terminal or access point to know with which encryption process the terminal address was encrypted during a communication between a terminal and an access point. Thus, it is no longer possible to discriminate between terminals using their encrypted address. Indeed, an encrypted address of a first terminal and that of a second terminal can be equal even though their clear addresses are different.

[0013] There is therefore a need to develop an encryption method allowing the coexistence of two types of encryption which do not have the aforementioned drawbacks. Summary of the invention

[0014] The invention provides a solution to the problems mentioned above, by proposing a symmetric encryption allowing the coexistence of two different types of encryption within a communication network. The invention uses in particular the fact that the information transmitted is included in a finite and known set of information to identify the information as being encrypted according to one or other of the types of encryption. In addition, the second type of encryption judiciously uses an encryption function denoted F2 in the remainder of the application which is a function composed with F2 = Fl o F3 and with the function Fl the encryption function of the first type of encryption.Thus, during decryption, it is possible to identify, by applying the inverse function denoted P L1 of the encryption function Fl to the received encrypted information, whether the received encrypted information is clear information that has been encrypted by the first type of encryption or by the second type of encryption. When during decryption, it is not possible to identify by applying the function FL1 to the received encrypted information; that the received encrypted information is clear information that has been encrypted by the first type of encryption or by also applying F3'1 by the second type of encryption, this means that the received encrypted information must not be considered valid and an adequate treatment of this event can be implemented.

[0015] One aspect of the invention thus relates to a method for symmetric encryption of information transmitted within a communication network comprising a set of entities, in which: • Information is sent by a sending entity to a receiving entity, with the sending entity and the receiving entity belonging to the entity set, • Each entity in the entity set having a predetermined encryption capability among: • A first encryption capability allowing encryption based on a first encryption function Fl, or • A second encryption capability allowing encryption based on a second encryption function F2, the second encryption function F2 being obtained from the first encryption function Fl and a third encryption function F3 with F2= FloF3, • The information is a clear information included in a set of clear information ENS_P, each clear information of the set of clear information ENS_P being obtainable by the set of entities, the set of clear information ENS_P being a union of three disjoint subsets ENS_L, ENS_M and ENS_N of clear information with: • Each subset ENS_L, ENS_M and ENS_N comprising a finite and known number of clear information, • A first subset (ENS_M) having a number of clear information less than or equal to the number of clear information included in a second subset (ENS_N) and an image by the third encryption function F3 of the first subset (ENS_M) being included in the second subset (ENS_N), • Each clear information of the third subset ENS_L being information that can be sent by the sending entity having the first encryption capability, • Each clear information of the first subset ENS_M being information that can be sent by the sending entity having the second encryption capability, • Each clear information of the second subset ENS_N being clear information that cannot be sent by the sending entity, • The method comprising: • Encrypt, at the level of the issuing entity, the information: • By the first encryption function Fl when the sending entity has the first encryption capability, or • By the second encryption function F2 when the sending entity has the second encryption capability, and • Send, by the sending entity, the encrypted information to the receiving entity.

[0016] Thanks to the invention, two different types of encryption can coexist within of a communication network. Indeed, the invention guarantees that the overall decryption mechanism used at the level of a receiving entity is indeed the inverse of the encryption mechanism applied to the information sent by the sending entity. In addition, the invention makes it possible to increase the overall degree of security of the identification of network terminals while ensuring interoperability between different categories of operational terminals.

[0017] Another aspect of the invention relates to a method for decrypting encrypted information according to the invention comprising: • Receive, by the receiving entity, the encrypted information sent by the sending entity, • Decryption, by the receiving entity, of the encrypted information received, the decryption comprising: • Obtain a first piece of information by applying a first decryption function FL1 to the encrypted information, the first decryption function F being the inverse function of the first encryption function Fl, and • When the first information obtained is equal to a clear information included in the third subset of clear information, identify the first information obtained as being a clear information sent by the sending entity with the first encryption capability, • When the first information obtained is equal to clear information included in the second subset of clear information • Obtain a second piece of information by applying to the first piece of information obtained, the third decryption function F3'1 which is the inverse function of the third encryption function F3, and • Identify the second information obtained as the information sent by the sending entity with the second encryption capability, • When the first information obtained is equal to clear information included in the first subset of clear information, identify the first information obtained as not being the clear information sent by the sending entity.

[0018] In addition to the characteristics which have just been mentioned in the preceding paragraphs, the encryption and decryption methods according to one aspect of the invention may have one or more complementary characteristics among the following, considered individually or according to all technically possible combinations: • The information sent by the sending entity is a network address of the sending entity or a network address of the receiving entity, and / or • The issuing entity having the first encryption capability is migrated to acquire the second encryption capability, and / or • A new entity is added into the communication network, each new entity added having the first encryption capability or the second encryption capability, and / or • The receiving entity having the first decryption capability is migrated to acquire the second decryption capability, and / or • A new entity is added into the communication network, each new entity added having the first decryption capability or the second decryption capability, and / or • the communication network is of the TETRA® or TETRAPOL® type, and / or • the first encryption capacity of the communication network is of the MAC THEN ENCRYPT type and the first decryption capacity of the communication network is of the DECRYPT THEN MAC type, • The set of entities is a set of terminals and a set of at least one access point, each terminal in the set of terminals connecting to the communication network via an access point included in the set of at least one access point, in which: • Information is sent by a sending entity to a receiving entity, with: • The transmitting entity being a first terminal included in the set of terminals or an access point included in the set of at least one access point, and • The receiving entity being the access point or a second terminal included in the set of terminals and different from the first terminal when the transmitting entity is the first terminal, or • The receiving entity being the first terminal when the transmitting entity is the access point. • The entity set is a set of mobile terminals communicating in direct mode, in which: • Information is sent by a sending entity to a receiving entity, with: • The issuing entity being a first mobile terminal included in the set of mobile terminals, and • The receiving entity being a second mobile terminal included in the set of mobile terminals and different from the first terminal.

[0019] A second aspect of the invention relates to a communication network comprising a set of entities, in which: • Information is sent by a sending entity to a receiving entity, with the sending entity and the receiving entity belonging to the entity set, Each entity in the entity set having a predetermined encryption capability among: • A first encryption capability allowing encryption based on a first encryption function Fl, or • A second encryption capability enabling encryption based on a second encryption function F2, the second encryption function F2 being obtained from the first encryption function Fl and a third encryption function F3 with F2 = Fl o F3, A piece of information is sent by the sending entity, the information is a piece of clear information included in a set of clear information, each piece of clear information in the set of clear information being obtainable by all entities, the set of clear information being a union of three disjoint subsets of clear information with: • Each subset ENS_L, ENS_M and ENS_N comprising a finite and known number of clear information, • A first subset ENS_M having a number of clear information items less than or equal to the number of clear information items included in a second subset ENS_N and an image by the third encryption function F3 of the first subset ENS_M being included in the second subset ENS_N, • Each clear information of the third subset ENS_L being information that can be sent by the sending entity having the first encryption capability, • Each clear information of the first subset ENS_M being information that can be sent by the sending entity having the second encryption capability, • Each clear information of the second subset ENS_N being clear information that cannot be sent by the sending entity, the sending entity is configured to execute the following steps: • Encrypt the information: By the first encryption function Fl when the sending entity has the first encryption capability, or By the second encryption function F2 when the sending entity has the second encryption capability, and Send the encrypted information to the receiving entity. The receiving entity being configured to perform the following steps: • Receive the encrypted information sent by the sending entity, • Decrypt, the received encrypted information, the decryption including • Obtaining a first piece of information by applying a first decryption function Fl1 to the encrypted information, the first decryption function FF1 being the inverse function of the first encryption function Fl, and • When the first information obtained is equal to a first clear information included in the third subset ENS_L of clear information, identify the first information as being the first clear information sent by the sending entity with the first encryption capability, • When the first information obtained is equal to clear information included in the second subset ENS_N of clear information: • Obtain information by applying to the first information obtained, the third decryption function F3T1 which is the inverse function of the third encryption function F3, and • Identify the information obtained as the clear information sent by the sending entity with the second encryption capability, and • When the first information obtained is equal to clear information included in the first subset ENS_M, identify the first information obtained as not being clear information sent by the sending entity.

[0020] In addition to the characteristics which have just been mentioned in the preceding paragraphs, the communication network according to one aspect of the invention may have the additional characteristic: • The set of entities is a set of terminals and a set of at least one access point, each terminal in the set of terminals connecting to the communication network via an access point included in the set of at least one access point, in which: • Information is sent by a sending entity to a receiving entity, with: • The transmitting entity being a first terminal included in the set of terminals or an access point included in the set of at least one access point, and • The receiving entity being the access point or a second terminal included in the set of terminals and different from the first terminal when the transmitting entity is the first terminal, or • The receiving entity being the first terminal when the transmitting entity is the access point, • The entity set is a set of mobile terminals communicating in direct mode, in which: • Information is sent by a sending entity to a receiving entity, with: • The issuing entity being a first mobile terminal included in the set of mobile terminals, and • The receiving entity being a second mobile terminal included in the set of mobile terminals and different from the first mobile terminal.

[0021] A third aspect of the invention relates to a computer program product comprising instructions which, when the program is executed by a computer, lead the latter to implement the method according to the invention.

[0022] A fourth aspect of the invention relates to a computer-readable recording medium comprising instructions which, when executed by a computer, cause the latter to implement the method according to the invention.

[0023] The invention and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0024] The figures are presented for information purposes only and in no way limit the invention. • [Fig.l] shows a block diagram of an example of an encryption method according to the invention. • [Fig.2] shows a block diagram of an example of a decryption method according to the invention. • [Fig.3] shows a schematic representation of an example of a partition of clear information that can be used by an encryption and decryption method according to the invention. • [Fig.4] shows an example of a communication network capable of implementing the encryption method and / or the decryption method according to the invention. • [Fig.5] shows a block diagram of an example of a step of the decryption method according to the invention. DETAILED DESCRIPTION

[0025] The figures are presented for information purposes only and in no way limit the invention.

[0026] Figures 1 and 2 respectively show a block diagram of an example of an encryption method 100 according to the invention and of a decryption method 200 according to the invention.

[0027] These methods can be implemented by a communication network. An example of a communication network that can implement these encryption methods 100 and decryption methods 200 is illustrated in [Fig. 4]. Each terminal connects to the network via an access point or communicates in direct mode with another terminal. The communication network includes in particular mobile or fixed terminals denoted TL1, TL2, TL3, TL21, TL22, TL31, TM1, TM2 and TM21 in [Fig. 4]. The communication network also includes access points denoted PA1, PA2 and PA3 in [Fig. 4]. These access points are optional for implementing the encryption methods 100 and decryption methods 200 when the terminals communicate in direct mode. For example, terminal TL1 connects to the network via access point PA1 while terminal TL21 connects to the network via access point PA2.The encryption methods 100 and decryption methods 200 allow information to be sent securely within the network. Thus, these methods are, for example, particularly useful in PMR communication networks, for "Professional Mobile Radiocommunications", of the TETRA® type, for "Terrestrial Trunked Radio" in English, or of the TETRAPOL® type, defined by the TETRAPOL industrial forum (http: / / www.tetrapol.com). Professional PMR communication networks of the TETRA® or TETRAPOL® type are independent mobile communication networks dedicated to the use of businesses or administrations, in particular to ensure public safety, industrial safety or in transport activities. Professional PMR communication networks of the TETRA® type, for "TErrestrial Trunked RAdio" in English, or TETRAPOL® adapted to implement the invention can operate with an infrastructure, iewith at least one access point, or only with terminals, i.e. in direct mode between terminals. PMR networks are widely used by public security services (gendarmerie and national police for example) and emergency services, and also by many other categories of users (public transport, airports, etc.). These are private networks which offer a high level of security.

[0028] Each entity of the communication network has an encryption and / or decryption capability. This encryption and / or decryption capability may vary depending on the entity, i.e. terminal or access point considered. This encryption and / or decryption capability is predetermined, i.e. it is determined for each entity of the communication network before implementing the encryption method 100 or decryption method 200. The encryption capability of each entity of the communication network is selected from a first or a second encryption capability. The first encryption capability allows encryption based on a first encryption function F1. The second encryption capability allows encryption based on a second encryption function F2. The second function encryption function F2 is obtained from the first encryption function Fl and a third encryption function F3. More precisely, the encryption function F2 is a composite function with: F2 = Fl o F3. Obviously, the third encryption function F3 is different from the inverse function noted pr1 of the first encryption function Fl. The encryption capacity of each entity in the communication network is determined by its hardware and / or software characteristics. For example, a first terminal, due to its limited hardware characteristics, may only be compatible with encryption based on the first encryption function Fl. Thus, this first terminal will have the first encryption capacity. This first terminal will therefore be able to change its encryption capacity only if a hardware upgrade is carried out.In another example, a second terminal, due to its hardware characteristics, is compatible with encryption based on the first encryption function F1 or on the second encryption function F2. In this example, the second terminal will use encryption based on the first encryption function F1 or on the second encryption function F2 depending on its software characteristics. This second terminal will therefore be able to change its encryption capacity with a software migration, i.e. a software update. Each new entity added to the communication network must also have the first encryption capacity or the second encryption capacity. An entity generally has an encryption capacity and a decryption capacity. In this case, an entity having a first encryption capacity must also have a first decryption capacity.Similarly, if an entity has a second encryption capability, it must also have a second decryption capability. Thus, if a terminal, following a hardware upgrade or a software update for example, is migrated from one encryption capability to another, its possible decryption capability must also be migrated.

[0029] In a first example, the first encryption capability used by at least one entity of the communication network is of the Bluetooth E0 type and the second encryption capability used by at least one other entity of the communication network is of the Bluetooth AES-CCM type.

[0030] In a second example, the first encryption capability used by at least one entity of the communication network is of the MAC THEN ENCRYPT type and the first decryption capability used by at least one entity of the communication network is of the DECRYPT THEN MAC type. For example, if the first encryption capability of an entity is the MAC THEN ENCRYPT then its possible decryption capability will be the DECRYPT THEN MAC. MAC THEN ENCRYPT encryption consists of producing a MAC, for "message authentication code" in English, on the basis of the clear information to be transmitted, then the information The clear text and the MAC are encrypted to produce a ciphertext. The ciphertext, containing the encrypted MAC, can then be sent, for example. DECRYPT THEN MAC decryption consists of decrypting the ciphertext to obtain the MAC and the clear text. Then the MAC is used to verify that the clear text is not corrupted. In this example, a second encryption capability used by at least one other entity in the communication network is also of the MAC THEN ENCRYPT type with a different MAC.

[0031] For the sake of simplicity, the description of the encryption method 100 and decryption method 200 of the invention does not mention the keys or the initialization parameters used during the encryption and decryption operations. Nevertheless, these parameters do exist and the replacement of the function F1 by the function F2 is carried out without any protocol impact. The protocol elements associated with the function F2 are the same as those associated with the function F1. Thus, any mode of operation of a symmetric block or stream cipher, used in a protocol, whether deterministic or non-deterministic, is applicable to the present invention. Finally, it should be noted that the invention relates to symmetric encryption. Thus, the encryption method 100 and the decryption method 200 use the same key to encrypt and decrypt information.

[0032] Within the communication network, a terminal can therefore send information to another terminal via one or more access points. A terminal can also send information directly to another terminal, i.e. without the information being transmitted via an access point. In the remainder of the description, we will refer to the terminal or access point sending the information to be transmitted to a receiving entity as the "sending entity". Similarly, we will refer to the terminal or access point receiving the information to be transmitted as the "receiving entity". Thus, in a first example, the set of entities may comprise only a set of terminals, whereas in a second example, the set of entities may comprise a set of terminals and a set of at least one access point.

[0033] Information is transmitted within the communication network using the methods 100 and 200. This information is clear information, i.e. information that has not been previously encrypted according to the first encryption capability or the second encryption capability. Encrypted information is information that has been modified using an encryption method in order to make it impossible for anyone who does not have the key used for decryption to understand this information. For example, information transmitted using the methods according to the invention may be a network address of the sending entity or a network address of the receiving entity. In another example, the information transmitted using the methods according to the invention may also be a multi-user identity or still redundant data.

[0034] The information transmitted in the methods 100 and 200 is clear information included in a set ENS_P of clear information. The set of clear information ENS_P can be obtained by each terminal of the set of terminals and each access point of the set of access points. The term "obtain" means in the present application that this information can for example be stored, received or calculated. For example, the set of clear information ENS_P can be stored in the form of a list by all the terminals and access points of the communication network or on a server accessible by all the terminals and access points of the communication network. Alternatively or additionally, each terminal and each access point of the communication network can calculate the set of clear information ENS_P by following a rule or a standard shared by all the terminals and access points of the communication network. [Fig.3] illustrates an example of partitioning this set ENS_P of clear information. Thus the set ENS-P is divided into 3 disjoint subsets ENS_L, ENS_M and ENS_N. The set ENS_P includes a finite and known number of clear information. Similarly, each subset ENS_L, ENS_M and ENS_N includes a finite and known number of clear information. The first and second subsets ENS_M and ENS_N include the same number of clear information. The information of the first subset ENS_M can be sent by a sending entity having the second encryption capability while the information of the third subset ENS_L can be sent by a sending entity having the first encryption capability. The information of the second subset ENS_N cannot be sent by the sending entity.For example, the information in the second subset ENS_N is the network addresses not yet assigned within the communication network in the example where the information transmitted is a network address.

[0035] The encryption method 100 comprises two steps which are carried out at the sending entity. The first step 110 consists of encrypting the information. If the sending entity has the first encryption capability function, the encryption will be carried out using the first encryption function F1. If the sending entity has the second encryption capability function, the encryption will be carried out using the second encryption function F2. The second step 120 consists of sending the encrypted information to the receiving entity.

[0036] The method 200 is then necessary to enable the receiving entity to decrypt the encrypted information. The decryption method 200 comprises two steps 210 and 220 which are carried out at the receiving entity. The first step 210 consists of receiving the encrypted information sent, for example in step 120 of the encryption method 100, by the issuing entity. The second step 220 consists of decrypting the encrypted information. This second step comprises four sub-steps 221 to 224. [Fig.5] shows a block diagram of an example of this second step.

[0037] The first sub-step 221 of step 220 consists of applying a first decryption function FL1 to the encrypted information. The function Fl-1 is the inverse function of the encryption function Fl. This sub-step makes it possible to obtain a first piece of information. Then a first test is carried out to verify whether this first piece of information obtained is equal to a first piece of clear information included in the third subset ENS_L of clear information. Thus, when the first piece of information obtained is equal to information from the third subset ENS_L of clear information, this first piece of information obtained is identified as being the first piece of clear information sent by the sending entity with the first encryption capability.In other words, when the first information obtained is equal to an information of the third subset ENS_L of clear information, the receiving entity knows that the first information corresponds to the clear information sent and encrypted by a sending entity having the first encryption capability. A second test is then performed to verify whether this first information obtained is equal to a clear information included in the second subset ENS_N of clear information. In one example, this second test can be performed only when the first information obtained is identified as being the first clear information sent by the sending entity with the first encryption capability.When the first information obtained is equal to a clear information included in the second subset (ENS_N) of clear information, the third decryption function F3'1 which is the inverse function of the third encryption function F3 is applied to the first information obtained in step 221. Thus a second information is obtained during this second sub-step 222. This second information obtained is identified, in sub-step 223, as being the clear information sent by the sending entity with the second encryption capability. Finally, when the first information obtained in step 221 is equal to a clear information included in the first subset ENS_M, the first information obtained in step 221 is identified in sub-step 224 as not being a clear information sent by the sending entity.In this case, the receiving entity may, for example, consider this information to be fraudulent and not process it or even warn other entities in the communications network of a possible intrusion attempt.

[0038] The invention therefore makes it possible, for a communication network in which two encryption systems coexist, to guarantee that, for information transmitted within this communication network, the decryption method applied by the receiving entity is indeed the inverse of the encryption method used by the transmitting entity. The invention therefore makes it possible to increase the overall degree of security of the transmission of information within the communication network while ensuring interoperability between different categories of operational entities, i.e. terminals and access points. The invention makes it possible, for example, to keep a fleet of terminals and / or access points already in service unchanged and to gradually update another fleet of terminals and / or access points or even to add new terminals and / or new access points. The invention therefore makes it possible to ensure the maintenance of the network entities while preserving operational services as much as possible.

[0039] Unless otherwise specified, the same element appearing in different figures presents a unique reference.

Claims

Claims

1. Method (100) for symmetric encryption of information transmitted within a communication network comprising a set of entities, in which: - Information is sent by a sending entity to a receiving entity, with the sending entity and the receiving entity belonging to the set of entities, - Each issuing entity of the set of entities having a predetermined encryption capacity among: • A first encryption capability allowing encryption based on a first encryption function Fl, or • A second encryption capability enabling encryption based on a second encryption function F2, the second encryption function F2 being obtained from the first encryption function Fl and a third encryption function F3 with F2 = Fl o F3, - Information is a clear information included in a set of clear information (ENS_P), each clear information of the set of clear information (ENS_P) being obtainable by the set of entities, the set of clear information (ENS_P) being a union of three disjoint subsets (ENS_L, ENS_M and ENS_N) of clear information with: • Each subset (ENS_L, ENS_M and ENS_N) comprising a finite and known number of clear information, • A first subset (ENS_M) having a number of clear information less than or equal to the number of clear information included in a second subset (ENS_N) and an image by the third encryption function F3 of the first subset (ENS_M) is included in the second subset (ENS_N), • Each clear information of the third subset (ENS_L) being information which can

2. be sent by the sending entity with the first encryption capability, • Each clear information of the first subset (ENS_M) being information that can be sent by the sending entity having the second encryption capability, • Each clear information of the second subset (ENS_N) being clear information that cannot be sent by the sending entity, - The method (100) comprising: • encrypt (110), at the level of the issuing entity, information: - by the first encryption function Fl when the issuing entity has the first encryption capability, or - by the second encryption function F2 when the issuing entity has the second encryption capability, and • Send (120), by the sending entity, the encrypted information to the receiving entity. Method (200) for decrypting encrypted information according to the preceding claim comprising: - Receive (210), by the receiving entity, the encrypted information sent (120) by the sending entity, - Decrypting (220), by the receiving entity, the received encrypted information (210), the decryption comprising: • Obtain (221) a first piece of information by applying a first decryption function FE1 to the encrypted information, the first decryption function FF1 being the inverse function of the first encryption function Fl, and • When the first information obtained (221) is equal to clear information included in the third subset (ENS_L) of information clear, identify the first information obtained as being clear information sent by the sending entity with the first encryption capability, • When the first information obtained is equal to clear information included in the second subset (ENS_N) of clear information: - Obtain (222) a second information by applying to the first information obtained (221), the third decryption function F3-1 which is the inverse function of the third encryption function F3, and - Identify (223) the second information obtained (222) as being the clear information sent by the sending entity with the second encryption capability, and - When the first information obtained (221) is equal to clear information included in the first subset (ENS_M), identify (224) the first information obtained (221) as not being clear information sent by the sending entity.

3. A method (100, 200) according to any preceding claim wherein the information sent by the sending entity is a network address of the sending entity or a network address of the receiving entity.

4. A method (100, 200) according to any preceding claim wherein: - The issuing entity having the first encryption capability is migrated to acquire the second encryption capability, and / or - A new entity is added into the communication network, each added entity having the first encryption capability or the second encryption capability, and / or - The receiving entity having the first decryption capability is migrated to acquire the second decryption capability, and / or - A new entity is added in the communication network, each new entity added having the first decryption capacity or the second decryption capacity.

5. Method (100, 200) according to any one of the preceding claims in which the first encryption capability of the communication network is of the MAC THEN ENCRYPT type and the first decryption capability of the communication network is of the DECRYPT THEN MAC type.

6. Method (100, 200) according to any one of the preceding claims wherein the set of entities is a set of terminals and a set of at least one access point, each terminal of the set of terminals connecting to the communication network via an access point included in the set of at least one access point, wherein: - The information is sent by a transmitting entity to a receiving entity, with: • The transmitting entity being a first terminal included in the set of terminals or an access point included in the set of at least one access point, and • The receiving entity being the access point or a second terminal included in the set of terminals and different from the first terminal when the transmitting entity is the first terminal, or • The receiving entity being the first terminal when the transmitting entity is the access point.

7. Method (100, 200) according to any one of claims 1 to 6 in which the set of entities is a set of mobile terminals communicating in direct mode, in which: - The information is sent by a transmitting entity to a receiving entity, with: • The transmitting entity being a first mobile terminal included in the set of mobile terminals, and • The receiving entity being a second mobile terminal included in the set of mobile terminals and

8. different from the first terminal. Communication network comprising a set of entities, in which: - Information is sent by a sending entity to a receiving entity, with the sending entity and the receiving entity belonging to the set of entities, - Each entity in the entity set having a predetermined encryption capability among: • A first encryption capability allowing encryption based on a first encryption function Fl, or • A second encryption capability enabling encryption based on a second encryption function F2, the second encryption function F2 being obtained from the first encryption function Fl and a third encryption function F3 with F2 = Fl o F3, - Information is sent by the sending entity, the information is clear information included in a set of clear information (ENS_P), each clear information of the set of clear information (ENS_P) can be obtained by all the entities, the set of clear information (ENS_P) being a union of three disjoint subsets (ENS_L, ENS_M and ENS_N) of clear information with: • Each subset (ENS_L, ENS_M and ENS_N) comprising a finite and known number of clear information, • A first subset (ENS_M) having a number of clear information less than or equal to the number of clear information included in a second subset (ENS_N) and an image by the third encryption function F3 of the first subset (ENS_M) being included in the second subset (ENS_N), • Each clear information of the third sub- set (ENS_L) being information that can be sent by the sending entity having the first encryption capability, • Each clear information of the first subset (ENS_M) being information that can be sent by the sending entity having the second encryption capability, • Each clear information of the second subset (ENS_N) being clear information that cannot be sent by the sending entity, The issuing entity is configured to perform the following steps: • Encrypt (110) the information: - By the first encryption function Fl when the issuing entity has the first encryption capability, or - By the second encryption function F2 when the issuing entity has the second encryption capability, and • Send (120) the encrypted information to the receiving entity. The receiving entity being configured to perform the following steps: • Receive (210), the encrypted information sent by the sending entity, • Decrypt (220), the received encrypted information (210), the decryption comprising: - Obtain (221) a first piece of information by applying a first decryption function FL1 to the encrypted information, the first decryption function FL1 being the inverse function of the first encryption function Fl, and - When the first information obtained (221) is equal to a first clear information included in the third subset (ENS_L) of clear information, identify the first information as being the first clear information sent by the sending entity with the first encryption capability, When the first information obtained (222) is equal to a clear information included in the second subset (ENS_N) of clear information: - Obtain (222) a second information by applying to the first information obtained (221), the third decryption function (F3~!) which is the inverse function of the third encryption function F3, and - Identify (223) the second information obtained (222) as being the clear information sent by the sending entity with the second encryption capability, and When the first information obtained (221) is equal to a clear information included in the first subset (ENS_M), identify (224) the first information obtained (221) as not being a clear information sent by the sending entity.

9. Communication network according to the preceding claim in which the set of entities is a set of terminals and a set of at least one access point, each terminal of the set of terminals connecting to the communication network via an access point included in the set of at least one access point, in which: - The information is sent by a sending entity to a receiving entity, with: • The transmitting entity being a first terminal included in the set of terminals or an access point included in the set of at least one point access, and The receiving entity being the access point or a second terminal included in the set of terminals and different from the first terminal when the transmitting entity is the first terminal, or The receiving entity being the first terminal when the transmitting entity is the access point.

10. Communication network according to claim 9 in which the set of entities is a set of mobile terminals communicating in direct mode, in which: - The information is sent by a transmitting entity to a receiving entity, with: • The transmitting entity being a first mobile terminal included in the set of mobile terminals, and • The receiving entity being a second mobile terminal included in the set of mobile terminals and different from the first mobile terminal.

11. A computer program product comprising instructions which cause the network according to any one of claims 9 to 11 to execute the steps of the method according to one of claims 1 to 8.

12. A computer-readable recording medium on which the computer program according to claim 12 is recorded.

Images