Method for communicating with a remote computer from a local computer

Abstract

The invention relates to a method for communicating with a remote computer (3000) from a local computer (1000) which comprises a local processor (1600) by means of an enclosure (2000). The method comprises storing a mobile operating system comprising a public encryption key in a memory (2500) of the enclosure and connecting the enclosure to the local computer. The enclosure comprises a mobile communication module (2100) configured to receive and decrypt encrypted data by means of the public encryption key and to send encrypted data after having encrypted them by means of the public encryption key. The method comprises running the mobile operating system on the local computer, sending synchronised roaming files from the local computer to the remote computer, and receiving synchronised remote files from the remote computer.

Description

[0001] "Method of communicating with a remote computer from a local computer"

[0002] TECHNICAL FIELD

[0003] The present invention relates to the field of communications, and more particularly to the field of remote connection. It finds a particularly advantageous application in remote working.

[0004] STATE OF THE ART

[0005] Remote working is an increasingly popular way of working. One of the main challenges of this practice is its technological implementation.

[0006] Several remote working solutions exist. One of the most popular is TeamViewer®, a software initially developed for remote assistance that allows users to connect to a remote computer. Specifically, TeamViewer® allows a user working on a local computer to temporarily take control of a remote machine. The user has access to the remote machine's programs, software, and files.

[0007] This solution has the disadvantage of not being transparent to the local computer: in fact, its resources (processor, RAM, storage space, etc.) are used throughout the duration of the remote connection. Two problems arise from this: first, remote work is not neutral for the local computer, which sees its components being heavily used throughout the duration of the work session. This is not optimal, especially when an employee uses a personal computer as a local computer. Furthermore, the fact that the remote connection requires the use of the local computer's components constitutes a major security flaw. Company data could indeed be intercepted by malware present on the local computer. There is therefore a need for a simple and secure solution for remote work.

[0008] SUMMARY

[0009] To achieve this objective, a first object of the invention relates to a method of communicating with a remote computer from a local computer using a box, the local computer comprising a local processor, the method comprising the following steps:

[0010] - storage in a memory of the case of a so-called nomadic operating system comprising a public encryption key,

[0011] - a connection from the box to the local computer.

[0012] The case includes:

[0013] - a nomadic communication module configured to receive encrypted data and decrypt it using the public encryption key and to send encrypted data after having encrypted it using the public encryption key,

[0014] - a portable synchronization program.

[0015] Furthermore, the method further comprises:

[0016] - a step of executing the local computer under the mobile operating system by accessing the local processor to the memory of the box, then

[0017] - during execution, sending synchronized nomadic files from the local computer or, according to a preferred embodiment, from the box, to the remote computer via the nomadic communication module and a communication network, including encryption of the data with the public encryption key,

[0018] - during execution, reception and decryption of synchronized remote files from the remote computer via the communication network and the mobile communication module.

[0019] Another subject of the invention relates to a method of communicating with a remote computer from a local computer using a box, the local computer comprising a local processor, the method comprising the following steps:

[0020] - storage in a memory of the case of a so-called nomadic operating system comprising a so-called remote public encryption key and a so-called nomadic private encryption key,

[0021] - a connection of the box to the local computer, the box comprising:

[0022] - a nomadic communication module configured to receive encrypted data and decrypt it using the nomadic private encryption key and to send encrypted data after having encrypted it using the remote public encryption key,

[0023] - a nomadic synchronization program, the method further comprising:

[0024] - a step of executing the local computer under the mobile operating system by accessing the local processor to the memory of the box, then

[0025] - during execution, at least one sending of synchronized nomadic files from the local computer or, according to a preferred embodiment, from the box, to the remote computer via the nomadic communication module and a communication network, including a generation at the level of the nomadic communication module of a so-called temporal encryption key and an encryption of the synchronized nomadic files with the temporal encryption key, each sending of synchronized nomadic files being the subject of the generation of a distinct temporal encryption key, said temporal encryption key being deleted after the sending of the synchronized nomadic files,

[0026] - during execution, reception and decryption of synchronized remote files from the remote computer via the communication network and the mobile communication module.

[0027] The process thus allows a secure exchange of data between the local computer and the remote computer. Furthermore, due to the execution of the mobile operating system on the local computer, it is the resources of the box that are used for remote communication with the remote computer. Only the peripherals of the local computer (screen, keyboard, mouse, etc.) are used during remote communication. Resources such as the processor and RAM of the local computer are mainly used during an initialization phase and when starting the local computer, but the resources of the box then take over during periods of remote communication with the remote computer. This greatly limits the involvement of the resources of the local computer and makes the process completely transparent for the local computer.The method therefore presents a higher level of security than that of prior art solutions.

[0028] Furthermore, another advantage of the invention is that the synchronized files can be stored on the box and edited by the user on the box. The synchronized files are therefore not saved on the local computer. The solution is therefore all the more transparent for the local computer, whose resources are used extremely little. Furthermore, this increases the level of security for remote working: this prevents sometimes sensitive synchronized files from being saved on a personal computer. The local computer does not have access to the synchronized files. There is no porosity between the user data contained in the local computer and the user data contained in the box.

[0029] Another object of the invention relates to a system comprising a housing and a computer program product, the housing being connectable to a local computer, the housing comprising:

[0030] - a memory containing a so-called nomadic operating system including a public encryption key,

[0031] - a nomadic communication module configured to receive encrypted data and decrypt it using the public encryption key and to send encrypted data after having encrypted it using the public encryption key,

[0032] - a portable synchronization program.

[0033] The computer program product comprising instructions configured to:

[0034] - provide the local processor of the local computer with access to the memory of the box and cause the local computer to execute under the mobile operating system, then - cause, during execution, a sending of synchronized mobile files from the local computer or, according to a preferred embodiment, from the box, to the remote computer via the mobile communication module and a communication network, including encryption of the data with the public encryption key,

[0035] - cause, during execution, reception and decryption of synchronized remote files from the remote computer via the communication network and the mobile communication module.

[0036] Another object of the invention relates to a system comprising a housing and a computer program product, the housing being connectable to a local computer, the housing comprising:

[0037] - a memory containing a so-called nomadic operating system comprising a so-called remote public encryption key and a so-called nomadic private encryption key,

[0038] - a nomadic communication module configured to receive encrypted data and decrypt it using the nomadic private encryption key and to send encrypted data after having encrypted it using the remote public encryption key,

[0039] - a mobile synchronization program, the computer program product comprising instructions configured to:

[0040] - provide the local processor of the local computer with access to the memory of the box and cause the local computer to run under the mobile operating system, then

[0041] - causing, during execution, at least one sending of synchronized nomadic files from the local computer or, according to a preferred embodiment, from the box, to the remote computer via the nomadic communication module and a communication network, including a generation at the level of the nomadic communication module of a so-called temporal encryption key and an encryption of the synchronized nomadic files with the temporal encryption key, each sending of synchronized nomadic files being the subject of the generation of a distinct temporal encryption key, and causing the deletion of said temporal encryption key after sending the synchronized nomadic files,

[0042] - cause, during execution, reception and decryption of synchronized remote files from the remote computer via the communication network and the mobile communication module.

[0043] BRIEF DESCRIPTION OF THE FIGURES

[0044] The aims, objects, as well as the characteristics and advantages of the invention will emerge more clearly from the detailed description of an embodiment thereof which is illustrated by the following accompanying drawings in which:

[0045] Figure 1 represents an overview of the different entities that can be involved in the method according to the invention, and in particular shows the exchanges between the box and the remote computer.

[0046] Figure 2 shows the architecture of the case.

[0047] Figure 3 illustrates a sequence of steps for associating the box with a user and the remote computer. Figure 4A illustrates a protocol for securing exchanges between the programs on the remote computer and the main program.

[0048] Figure 4B illustrates a secure protocol for exchanges between the programs on the remote computer and the main program.

[0049] Figure 5 illustrates a sequence of steps for running the local computer under the mobile operating system.

[0050] Figure 6 illustrates a sequence of steps enabling secure data exchange between the mobile communication module and the remote communication module.

[0051] The drawings are given as examples and are not limiting of the invention. They constitute schematic representations of principle intended to facilitate the understanding of the invention and are not necessarily on the scale of practical applications. In particular, the appearance of the computers and boxes as well as the various programs they contain is not representative of reality.

[0052] DETAILED DESCRIPTION

[0053] Before commencing a detailed review of embodiments of the invention, optional features which may possibly be used in combination or alternatively are set out below:

[0054] In one example, the housing contains a module for connecting to the communication network.

[0055] According to an advantageous embodiment, the method further comprises, prior to the step of executing the local computer under the mobile operating system:

[0056] - an execution step on the local computer of a script configured to modify the execution order of the operating systems accessible from the local computer and place the mobile operating system in first position, then

[0057] - a step of shutting down the local computer.

[0058] According to an advantageous embodiment, the method further comprises, prior to the step of executing the local computer under the mobile operating system, a step of executing on the remote computer a program for associating the box with the remote computer, this step comprising:

[0059] - a recording of a box identifier in a memory of the remote computer,

[0060] - sending the public encryption key from the remote computer to the box.

[0061] In one example, the connection of the box to the local computer is made by a wired connection between a port on the box and a port on the local computer.

[0062] According to a preferred example, the remote computer includes a remote communication module configured to receive encrypted data and decrypt it using the private encryption key and to send encrypted data using the private encryption key.

[0063] According to a preferred example, the remote computer comprises a memory containing:

[0064] - information about users,

[0065] - information on the sharing permissions of files stored in the remote computer. According to a preferred example, the remote computer comprises a sharing program configured to receive sharing requests and, in response to these sharing requests, to modify the information on the sharing permissions of the files stored in the remote computer. According to a preferred example, the remote computer is shared between several boxes, the remote computer supporting a plurality of directories, each directory being assigned to at least one box, the information on the sharing permissions determining the contents of which directory(ies) can be accessed by which boxes.

[0066] According to a preferred example, the remote computer comprises a remote synchronization program configured to receive from the box, via the communication network and the remote communication module, synchronized mobile files, and to send to the box, via the remote communication module and the communication network, synchronized remote files.

[0067] According to a preferred example, the sending of the remote files synchronized by the remote synchronization program is done following the reception by the remote communication module of a synchronization request from the mobile synchronization program.

[0068] In a preferred example, the mobile synchronization program sends synchronization requests periodically.

[0069] According to one example, the method further comprises, prior to the step of executing the local computer under the mobile operating system, a step of executing on the remote computer a program for associating the box with the remote computer, this step comprising:

[0070] - a recording of a box identifier in a memory of the remote computer,

[0071] - sending the remote public encryption key from the remote computer to the box. According to one example, the remote computer contains a memory containing a so-called remote private encryption key and a so-called nomadic public encryption key, the remote computer comprising a remote communication module configured to receive encrypted data and decrypt it using the remote private encryption key and to send encrypted data using the nomadic public encryption key.

[0072] In one example, the remote computer includes a remote communication module and the step of receiving and decrypting synchronized remote files from the remote computer is preceded by the following step:

[0073] - at least one sending of the synchronized remote files from the remote computer to the local computer via the remote communication module and the communication network, including a generation at the level of the remote communication module of a so-called secondary temporal encryption key and an encryption of the synchronized remote files with the secondary temporal encryption key, each sending of synchronized remote files being the subject of the generation of a separate secondary temporal encryption key, said secondary temporal encryption key being deleted after the sending of the synchronized remote files.

[0074] The term "memory" is understood in the present invention as "computer-readable memory medium". This term here designates any storage means for storing files and programs and includes all types of memory such as random access memory (RAM) or read-only memory (ROM). It is understood that, in the present invention, the memory of a computer may in reality comprise several types of memory.

[0075] The term "database" refers in the present invention to any data repository suitable for storing and retrieving a large volume of data.

[0076] The encryption keys referred to further are advantageously asymmetric encryption keys, i.e. comprising a private encryption key and a public encryption key. These are preferably RSA type keys.

[0077] The various embodiments of the method according to the present invention may be implemented in digital electronic circuits, or in computer hardware, firmware, software or combinations thereof. They may be implemented in the form of a computer program product, i.e. a computer program embodied by an information medium, for example a machine-readable storage device or a propagated signal, intended to be executed by a data processing apparatus, for example a programmable processor, a computer or several computers, or to control the operation thereof.A computer program, such as the computer program(s) described above, may be written in any programming language, including compiled or interpreted languages, and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may be deployed for execution on one computer or on multiple computers located at a single site or distributed across multiple sites and interconnected by a communications network.

[0078] Processors suitable for executing a computer program include, by way of example, general and special-purpose microprocessors, as well as one or more processors of any type of digital computer. Generally, a processor receives instructions and data from read-only memory or random access memory, or both. The elements of a computer may include at least one processor for executing the instructions and one or more memory devices for storing the instructions and data. Generally, a computer may also include, or be operably coupled to receive data from or transfer data to, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical, or optical disks.

[0079] The various embodiments of the invention may be implemented in a computer system that includes a back-end component, for example a data server, or that includes an intermediate component, for example an application server, or that includes a front-end component, for example a client computer with a graphical user interface or a web browser through which a user can interact with an implementation, or any combination of these back-end, intermediate or front-end components. The components may be interconnected by any form or medium of digital data communication, for example a communications network. Examples of communications networks include a local area network (LAN) and a wide area network (WAN), for example the Internet.

[0080] The method according to the invention will now be described with reference to Figures 1 to 6.

[0081] The method according to the invention involves a local computer 1000 and a box 2000 used to communicate with a remote computer 3000 from the local computer 1000.

[0082] The remote computer 3000 is typically a computer located on a company's premises. It is typically part, along with other company computers, of an intranet, or private computer network, of that company. The company's intranet is typically a secure network within which data exchanges are possible between the various computers connected to this intranet.

[0083] The local computer 1000 is typically used by the user to work remotely from the company. It may be a computer provided by the company, or a computer owned by the user. The local computer 1000 may in particular be used by the user for private use when it is not connected to the box 2000.

[0084] Subsequently, reference will be made to a communication network 4000 enabling in particular exchanges between the box 2000 and the remote computer 3000. This communication network 4000 may in particular be a Wi-Fi network or an Ethernet network.

[0085] For reasons of simplicity, the method will be described below in its implementation for a single local computer 1000, associated with a single box 2000. Naturally, as illustrated in FIG. 1, the method can be implemented for a plurality of local computers 1000a, 1000b, 1000c, each connected to a box 2000a, 2000b, 2000c. This is particularly the case when several employees of the same company work remotely and all must be connected to the company's intranet network. It is understood that the characteristics described below for a local computer and a box apply mutatis mutandis to each of these different local computers 1000a, 1000b, 1000c and boxes 2000a, 2000b, 2000c, respectively.

[0086] Local Computer Architecture 1000

[0087] The local computer 1000 notably comprises a local processor 1600 and advantageously a local memory 1500.

[0088] Advantageously, the local computer 1000 is connected to peripherals such as a display system, a keyboard, a mouse, speakers, a microphone or even a printer. These various resources can be used when running the mobile operating system on the local computer 1000. It is therefore not necessary for the box 2000 to include these same resources, which makes the box 2000 easily movable and easy to use. This also saves the need for a second set of peripherals.

[0089] 2000 Case Architecture

[0090] Figure 2 is a schematic representation of the architecture of the enclosure 2000. As illustrated, the enclosure 2000 includes an internal operating system 2010 and an external operating system 2020. The internal operating system 2010 includes, in particular:

[0091] - A memory 2500 which may in particular contain, depending on the steps of the process: a. Various files such as synchronized nomadic files and synchronized remote files which will be discussed further. b. A remote public encryption key, c. A nomadic private encryption key.

[0092] - A mobile communication module 2100, configured to allow the sending and receiving of data. More particularly, the mobile communication module 2100 makes it possible to encrypt data using the remote public encryption key before sending it. It is also configured to decrypt, after its reception, data encrypted by the mobile public encryption key (see below) using the remote private encryption key. The mobile communication module 2100 is in particular configured to send requests to the remote communication module 3100 and receive requests issued by the remote communication module 3100, these requests generally being from and to other programs of the box 2000 and of the remote computer 3000.

[0093] - A mobile synchronization program 2200, configured to receive synchronized remote files from the remote computer 3000, via the communication network 4000 and the mobile communication module 2100, and to send synchronized mobile files to the remote computer 3000, via the mobile communication module 2100 and the communication network 4000. This program thus allows the user of the box 2000 to work on files having the most recent modifications possible. For example, if other users of the company's intranet have recently worked on the files of interest accessible via the company's intranet, it is important that the user of the box 2000 has a recent version of these files of interest at his disposal.By regularly receiving synchronized remote files, the 2000 box therefore allows the user to work in optimal conditions. In the same way, it can be very important that the work carried out by the user of the 2000 box is accessible to other users of the company's intranet. Sending synchronized mobile files from the 2000 box to the remote computer 3000 connected to the intranet thus allows the latest progress of the user of the 2000 box to be available to his colleagues. In addition, this synchronization is important so that the user of the 2000 box can work on a recent version - preferably the most recent version - of his files when he moves from a remote working situation, on the local computer 1000, to a working situation in the company, on the remote computer 3000, and vice versa.

[0094] - The heart of the box 2300, configured in particular to execute certain actions on the other programs of the box 2000. For example, it can be configured to determine the state of other programs of the box 2000 and possibly carry out actions depending on this state. - A control program 2400 including in particular a user interface supported by a website. This interface allows the user of the box 2000 to administer it. It allows the box 2000 to be connected to an internet network such as a Wi-Fi network, or to have an overview of the state of the box 2000 (connected or not to the remote computer, connected or not to Wi-Fi, etc.).

[0095] The external operating system 2020 is dedicated to user data, which may include the software the user uses and the data related to it. This 2020 system may therefore include:

[0096] - A file access system

[0097] - User programs / software

[0098] - A program to access the 2400 control program

[0099] The external 2020 operating system can be delivered empty and software and data can then be added according to the user's needs.

[0100] The internal 2010 and external 2020 operating systems are contained in a fast storage system, for example SSD (Solid-state drive), for example 256 GB.

[0101] The 2000 case also includes a so-called nomadic 2600 processor, a RAM (more commonly referred to by the English acronym "RAM", for "Random Access Memory") and a storage space. The nomadic 2600 processor can, for example, have 4 cores and have a frequency of 1.9 GHz. The RAM can, for example, be 2 GB and the storage space 16 GB.

[0102] The 2000 enclosure also includes a rechargeable battery on which it can operate without being connected by wired connection to the local computer 1000 or to the electrical network.

[0103] The housing advantageously comprises a connection module 2002 to the communication network 4000.

[0104] It is also possible to integrate into the 2000 box a communication key via a wireless network of the standard type, for example 4G and / or 5G (for example a 4G / 5G GSM module) so that the 2000 box can connect to the internet without going through a public network. This is particularly advantageous when the user is traveling. He then does not need to connect to networks whose security level is unknown (e.g.: public Wi-Fi network in an airport or train station).

[0105] The remote computer 3000 with which the box 2000 allows the local computer 1000 to communicate may notably comprise:

[0106] - A main program 3300 including a database. This database includes: a. Information on the users of the box(es) 2000a, 2000b, 2000c enabling communication with the remote computer 3000. b. Information on the authorizations for sharing files stored in the remote computer 3000. c. Information on the authorizations for accessing the administration and management of the solution. d. Any information relating to the proper functioning of the method according to the invention.

[0107] - A remote communication module 3100, configured to allow the sending and receiving of data. More particularly, the remote communication module 3100 makes it possible to encrypt data using the nomadic encryption public key before sending it. It is also configured to decrypt, after its reception, data encrypted at the level of the nomadic communication module 2100 by the remote encryption public key using the remote encryption private key. The remote communication module 3100 is in particular configured to send requests to the nomadic communication module 2100 and receive requests issued by the nomadic communication module 2100, these requests generally being from and to other programs of the remote computer 3000 and the box 2000.

[0108] - A remote synchronization program 3200, configured to receive synchronized nomadic files from the box 2000, via the communication network 4000 and the remote communication module 3100, and to send synchronized remote files to the box 2000, via the remote communication module 3100 and the communication network 4000.

[0109] - A sharing program 3400 configured to manage the sharing permissions of the files stored on the remote computer 3000. In particular, the sharing program 3400 is configured to receive sharing requests and, depending on the content of these sharing requests, modify the information on the sharing permissions of the files stored on the remote computer 3000. These sharing requests can cause a user (i.e. a box 2000a, 2000b, 2000c) to gain access to certain files, or on the contrary to lose it. The sharing requests generally come from the main program 3300 of the remote computer 3000.

[0110] - A control program 3500 including in particular a manager interface supported by a website accessible from the company's intranet network. This interface allows the manager to administer the solution by triggering the sending of requests, for example sharing requests. It also allows him to access information on the boxes 2000a, 2000b, 2000c in communication with the remote computer 3000. The control program 3500 communicates among other things with the main program 3300.

[0111] - A memory 3700 which may in particular contain a nomadic public encryption key (one for each local computer 1000 associated with the remote computer 3000) and a remote private encryption key.

[0112] It is understood that the local computer 1000, the box 2000 and the remote computer 3000 may include other programs, modules and interfaces.

[0113] Initialization phase

[0114] During an initialization phase, a mobile operating system is stored in a memory 2500 of the box 2000. This mobile operating system includes, among other things, a remote public encryption key and a mobile private encryption key used for the secure exchange of data between the box 2000 and the remote computer 3000.

[0115] During this same initialization phase, the box 2000 is connected to the local computer 1000. The connection between the box 2000 and the local computer 1000 is preferably made by wired connection, between a port 2001 of the box 2000 and a port 1001 of the local computer 1000. However, it is also possible for this connection to be made wirelessly, for example by Bluetooth®.

[0116] Advantageously, provision is made for the box 2000 to be assigned to the remote computer 3000 during the installation phase. This assignment or association is typically done using a program executed on the remote computer 3000, called the program for associating the box 2000 with the remote computer 3000. The association program makes it possible in particular to cause the remote public encryption key to be sent from the remote computer 3000 to the box 2000 and to be stored in the operating system of the box 2000.

[0117] The assignment of the box 2000 to the remote computer 3000 can be carried out according to the protocol described below with reference to Figure 3.

[0118] Block 301 illustrates the initial situation at the beginning of this protocol: the box 2000 is not yet associated with the remote computer 3000. As illustrated by block 302, a user or manager checks whether the association program is installed on the remote computer 3000. If not, he downloads and installs it (block 303). If it is installed, the manager executes the program (block 304) on the remote computer 3000.

[0119] Execution of the association program causes the steps illustrated by blocks 305 to 317. An association request is sent by the association program to the remote computer 3000 (block 305). At this step, an identifier of the user of the box 2000 is recorded in the memory 3700 of the remote computer 3000.

[0120] The association program then sends a request to the core of the box 2300 so that it returns a serial number of the box 2000 (block 306). Upon receipt of this request, the core of the box 2300 executes a command to obtain this serial number (block 307). The serial number is then sent to the association program (blocks 308 and 309). This same program then assigns the box 2000 and its user via the user identifier and the serial number of the box 2000 just obtained (block 310). Typically, the serial number of the box 2000 is saved in the memory 3700 of the remote computer 3000 by associating it with the user identifier (block 311).

[0121] The main program 3300 then creates an asymmetric encryption key dedicated to the communication between the remote computer 3000 and the box 2000 for which the protocol is implemented (block 312). This asymmetric encryption key comprises a nomadic private encryption key, stored in the memory 3700 of the remote computer 3000, and a nomadic public encryption key. The latter is sent to the association program (blocks 313 and 314).

[0122] As illustrated in blocks 315 and 316, the nomadic public key is then sent to the core of the box 2300 where it is recorded. The box 2000 is then functional and the execution of the association program can cease (block 317). As a security measure, the sending of the nomadic public key from the remote computer 3000 to the box 2000 is conditioned on the execution of the association program. This guarantees that the nomadic public key will not be disclosed to an entity other than the box 2000, in particular a malicious entity seeking to hack the system. The exchange of information between the box 2000 and the remote computer 3000 can thus be done securely.

[0123] The above paragraphs give an example of how data exchanges between the mobile communication module 2100 and the remote communication module 3100 operate by encryption using an asymmetric key. It is understood, however, that it is entirely possible to use a symmetric encryption key.

[0124] It is understood that the manager implementing the protocol for assigning the box 2000 to the remote computer 3000 is not necessarily the user using the local computer 1000 to work remotely using the box. The assignment of the box 2000 can, for example, be carried out upstream by a dedicated department within the company to which the manager belongs. The manager typically has special rights to be able to administer the solution, for example to be able to send requests to the various programs and modules of the remote computer 3000.

[0125] It is also advantageous to implement a security protocol during the initialization phase. Such a protocol allows communication from each of the different programs of the remote computer 3000 to the main program 3300 to be done securely. An example of a protocol is illustrated in Figure 4A.

[0126] Once the programs on the remote computer 3000 are installed (block 401), groups are created (block 402). These groups are used to manage the rights of each program before assigning them an asymmetric key. The creation of these groups allows the identification of programs and the control of their permissions. The purpose of these groups is to prevent a program from originating a request that should be issued from another program.

[0127] An identifier and a pair of encryption keys (private and public) are then created for each of the programs (block 403). The identifier and the pair of encryption keys are, for each program, recorded in a secure file called an identification file. The files relating to each of the programs are recorded in the program concerned (block 405). The programs are thus able to exchange with the main program 3300 in a secure manner (block 406).

[0128] An example of a secure communication protocol between a program of the remote computer 3000 and the main program 3300 is illustrated in Figure 4B.

[0129] When a request is to be sent from a program on the remote computer 3000 to the main program 3300 (block 451), this program reads the stored identification file associated with it (block 452) to know the identifier and the encryption key, adds the identifier to the head of the request (block 453), uses the encryption key to encrypt the request (block 454) and then sends the encrypted request to the main program 3300 (blocks 455 and 456). Box use phase 2000

[0130] Once the 2000 box is associated with a remote 3000 computer, it can be used by connecting it to a local 1000 computer.

[0131] For the mobile operating system to be executed on the local computer 1000, it must take priority over the usual operating system(s) of the local computer 1000. For this, it is advantageously provided that the method comprises a step of executing a script configured in particular to modify the order of execution of the operating systems accessible from the local computer 1000.

[0132] Process of launching the 2000 box on local computer 1000

[0133] Figure 5 illustrates a sequence of steps that allow the local computer 1000 to run under the operating system of the local computer 1000 using this script.

[0134] Block 501 illustrates the initial situation: the local computer 1000 is not configured to boot under the mobile operating system, and by default runs under another operating system.

[0135] The script for modifying the operating systems available from the local computer 1000 and their execution order can then be downloaded and executed by the user (blocks 502 and 503).

[0136] If the mobile operating system is not yet listed as a possible operating system for local computer 1000, the script can add it (block 504).

[0137] The script then changes the execution order of the operating systems available from local computer 1000 and places the mobile operating system first so that it is executed by default when local computer 1000 starts (block 505). Local computer 1000 is then configured for use with enclosure 2000.

[0138] A step is then planned for shutting down and then starting up the local computer 1000. The latter is then launched under the mobile operating system.

[0139] The box 2000 can then allow communication with the remote computer 3000 from the local computer 1000. An example of a communication protocol between the local computer 1000 and the remote computer 3000 will now be described. This protocol is preferably used to exchange synchronized files between the box 2000 and the remote computer 3000. It is understood, however, that this protocol can allow the exchange of any type of data.

[0140] Secure data exchange process between the 2100 mobile communication module and the 3100 remote communication module

[0141] The data between the mobile communication module 2100 and the remote communication module 3100 may be of different types. In particular, it may be information allowing the configuration of the server, requests, information on file sharing or access authorizations, or even mobile or remote synchronized files. Information relating to mobile or remote synchronized files is differentiated from all other types of information. Preferably, the other types of information are encrypted by the mobile communication module 2100 and the remote communication module 3100 via the encryption asymmetry key comprising the remote public key, the remote private key, the mobile public key and the mobile private key.

[0142] Preferably, the mobile and remote files are encrypted by a symmetric key, for example an AES key (from the English "Advanced Encryption Standard"). Advantageously, a new symmetric key is generated at the mobile communication module 2100 or remote 3100, depending on the origin of the file, each time a file(s) is sent. This improves the level of security of the data exchange between the box 2000 and the remote computer 3000. Such a symmetric key is called a temporal symmetric key.

[0143] When the file comes from the box 2000 (mobile file), the temporal symmetric key is generated by the mobile communication module 2100, stored in the memory of the box 2500, sent to the remote communication module 3100 and, once the encryption is carried out and the file(s) sent to the remote communication module 3100, the temporal symmetric key is deleted from the memory of the box 2500. When the file comes from the remote computer 3000 (remote file), the temporal symmetric key is generated by the remote communication module 3100, stored in the memory 3700 of the remote computer 3000 and, once the encryption is carried out and the file(s) sent to the mobile communication module 2100, the temporal symmetric key is deleted from the memory 3700 of the remote computer 3000.

[0144] Figure 6 illustrates an example of a communication protocol between the box 2000 and the remote computer 3000 via their respective communication modules 2100, 3100. More precisely, the example given here is the sending of a request from the box 2000 to the remote computer 3000 and the sending of a response to this request from the remote computer 3000 to the box 2000. In this example, the encryption is carried out by the asymmetric key.

[0145] As illustrated in block 601, the protocol may begin with the reception by the mobile communication module 2100 of a request to send data. This may, for example, be a request of the “TCP” (“Transmission Control Protocol”) type in JSON (“JavaScript Object Notation”) format. The reception by the mobile communication module 2100 of this request to send data causes the steps illustrated by blocks 602 to 610.

[0146] As illustrated in block 602, the request is encrypted by the mobile communication module 2100 using the remote public encryption key. Once encrypted, it is sent to the remote communication module 3100 via the communication network 400 (block 603). The remote communication module 3100 then decrypts the request using the remote private encryption key (block 604).

[0147] Typically, the request transferred from the mobile communication module 2100 to the remote communication module 3100 contains information about the program(s) of the remote computer 3000 to which the data must be transferred. Based on this information, the remote communication module 3100 sends the request to the appropriate program(s) (block 605). As illustrated in block 606, the program(s) to which the request was transmitted process the request. Once this processing is completed, a response is sent from the program(s) to the remote communication module 3100.

[0148] After receiving the response by the remote communication module 3100, it encrypts the response using the nomadic public encryption key (block 607). The response is then sent to the nomadic communication module via the communication network 4000 (block 608). Following receipt of the encrypted response by the nomadic communication module 2100, it decrypts it using the nomadic private encryption key (block 609). Finally, the nomadic communication module 2100 transmits the decrypted response to the appropriate program (block 610), typically the one from which the request was initially sent.

[0149] The same type of protocol can be used for the exchange of nomadic and remote files, this time using the symmetric key described above.

[0150] The invention is not limited to the embodiments previously described and extends to all embodiments covered by the invention.

Claims

Claims 1. A method of communicating with a remote computer (3000) from a local computer (1000) using a box (2000), the local computer (1000) comprising a local processor (1600), the method comprising the following steps: • storage in a memory (2500) of the box (2000) of a so-called nomadic operating system comprising a so-called remote public encryption key and a so-called nomadic private encryption key, • a connection of the box (2000) to the local computer (1000), the box (2000) comprising: • a nomadic communication module (2100) configured to receive encrypted data and decrypt it using the nomadic private encryption key and to send encrypted data after having encrypted it using the remote public encryption key, • a nomadic synchronization program (2200), the method further comprising: • a step of executing the local computer (1000) under the mobile operating system by access of the local processor (1600) to the memory (2500) of the box (2000), then • during execution, at least one sending of synchronized nomadic files from the box (2000) to the remote computer (3000) via the nomadic communication module (2100) and a communication network (4000), including a generation at the level of the nomadic communication module (2100) of a so-called temporal encryption key and an encryption of the synchronized nomadic files with the temporal encryption key, each sending of synchronized nomadic files being the subject of the generation of a distinct temporal encryption key, said temporal encryption key being deleted after the sending of the synchronized nomadic files, • during execution, reception and decryption of synchronized remote files from the remote computer (3000) via the communication network (4000) and the mobile communication module (2100).

2. Method according to the preceding claim in which the housing (2000) contains a connection module (2002) to the communication network (4000).

3. Method according to any one of the preceding claims further comprising, prior to the step of executing the local computer (1000) under the mobile operating system: • a step of executing on the local computer (1000) a script configured to modify the order of execution of the operating systems accessible from the local computer (1000) and place the mobile operating system in first position, then • a step of shutting down the local computer (1000).

4. Method according to any one of the preceding claims further comprising, prior to the step of executing the local computer (1000) under the mobile operating system, a step of executing on the remote computer (3000) a program for associating the box (2000) with the remote computer (3000), this step comprising: • a recording of an identifier of the box (2000) in a memory (3700) of the remote computer (3000), • sending the remote public encryption key from the remote computer (3000) to the box (2000).

5. Method according to any one of the preceding claims in which the connection of the box (2000) to the local computer (1000) is made by a wired connection between a port (2001) of the box (2000) and a port (1001) of the local computer (1000).

6. Method according to any one of the preceding claims in which the remote computer (3000) contains a memory (3700) containing a so-called remote private encryption key and a so-called nomadic public encryption key, the remote computer (3000) comprising a remote communication module (3100) configured to receive encrypted data and decrypt them using the remote private encryption key and to send encrypted data using the nomadic public encryption key.

7. Method according to any one of the preceding claims in which the remote computer (3000) comprises a remote communication module (3100) and in which the step of receiving and decrypting synchronized remote files from the remote computer (3000) is preceded by the following step: • at least one sending of the synchronized remote files from the remote computer (3000) to the local computer (1000) via the remote communication module (3100) and the communication network (4000), including a generation at the level of the remote communication module (3100) of a so-called secondary time encryption key and an encryption of the synchronized remote files with the secondary time encryption key, each sending of synchronized remote files being the subject of the generation of a distinct secondary time encryption key, said secondary time encryption key being deleted after the sending of the synchronized remote files.

8. Method according to any one of the preceding claims in which the remote computer (3000) comprises a memory (3700) containing: • information about users, • information about file sharing permissions stored on the remote computer (3000).

9. A method according to any preceding claim wherein the remote computer (3000) comprises a sharing program (3400) configured to receive sharing requests and, in response to these sharing requests, to modify the information about sharing permissions for files stored on the remote computer (3000).

10. A method according to any preceding claim wherein the remote computer (3000) is shared between a plurality of boxes (2000a, 2000b, 2000c), the remote computer (3000) supporting a plurality of directories, each directory being assigned to at least one box (2000a, 2000b, 2000c), the sharing permission information determining the contents of which directory(ies) may be accessible to which box(es) (2000a, 2000b, 2000c).

11. Method according to any one of the preceding claims in which the remote computer (3000) comprises a remote synchronization program (3200) configured to receive from the box (2000), via the communication network (4000) and the remote communication module (3100), synchronized nomadic files, and to send to the box (2000), via the remote communication module (3100) and the communication network (4000), synchronized remote files.

12. Method according to the preceding claim in which the sending of the remote files synchronized by the remote synchronization program (3200) is done following the reception by the remote communication module (3100) of a synchronization request from the nomadic synchronization program (2200).

13. Method according to the preceding claim in which the nomadic synchronization program (2200) sends synchronization requests periodically.

14. System comprising a housing (2000) and a computer program product, the housing (2000) being connectable to a local computer (1000), the housing (2000) comprising: • a memory (2500) containing a so-called nomadic operating system comprising a so-called remote public encryption key and a so-called nomadic private encryption key, • a nomadic communication module (2100) configured to receive encrypted data and decrypt it using the nomadic private encryption key and to send encrypted data after having encrypted it using the remote public encryption key, • a mobile synchronization program (2200), the computer program product comprising instructions configured to: • provide the local processor (1600) of the local computer (100) with access to the memory (2500) of the box (2000) and cause the local computer (1000) to execute under the mobile operating system, then • cause, during execution, at least one sending of synchronized nomadic files from the box (2000) to the remote computer (3000) via the nomadic communication module (2100) and a communication network (4000), including a generation at the level of the nomadic communication module (2100) of a so-called temporal encryption key and a encryption of synchronized mobile files with the time-based encryption key, each sending of synchronized mobile files being subject to the generation of a separate time-based encryption key, and causing the deletion of said time-based encryption key after sending the synchronized mobile files, • cause, during execution, reception and decryption of synchronized remote files from the remote computer (3000) via the communication network (4000) and the mobile communication module (2100).

Images