Abstract:
The access method comprises the following steps:  
     i) receiving a request coming from a user for accessing at least one digital document, said request comprising an identifier ( 303 ) designating the digital document and an identifier ( 304 ) designating said user;  
     ii) searching locally for at least one collection (C 1 ) containing the identifier ( 303 ) of the document and the identifier ( 304 ) of the user, each collection (C 1,  C 2 ) being stored locally in response to a positive verification with regard to at least one condition agreeing to supply the document according to at least one access right linked to the collection; and  
     iii) in the case of a positive search, supplying said corresponding document ( 303 ) to said user ( 304 ) thus designated.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     The present invention relates to controlling access to a shared document in a communication network of the “station-to-station” or distributed type, commonly referred to as having “peer to peer” topology.  
         [0002]     Over the last few years, station-to-station networks have become an alternative to client/server networks, widespread until now. This is because, through their distributed architecture, station-to-station networks make it possible to share a large number of digital data items between a large number of users, without also requiring an expensive infrastructure.  
         [0003]     In practice, in a station-to-station network, each station acts as client and server. Thus, each station can request a digital data item or document from any other station whatsoever on the network and the data exchange can take place directly from one station to another.  
         [0004]     Subsequently, the term “digital document or data item” applies to both digital images or videos, or also to digital texts or the like.  
         [0005]     Thus, in a station-to-station file exchange, each station can be both client and server.  
         [0006]     This means that the digital data received by a client can be supplied to other users by the server of this client.  
         [0007]     Digital data accessed by many people can therefore be replicated on a number of machines and supplied by more servers.  
         [0008]     The system therefore adapts on its own to demand and the communication and storage costs are distributed between all the servers.  
         [0009]     On the contrary, in a conventional client/server system, the data are supplied by a single server or by a set of machines fixed in advance.  
         [0010]     The capacity of these conventional servers must be proportioned in advance which leads either to over-proportioning (the cost of the server is then too high), or to under-proportioning (the data are not supplied sufficiently quickly).  
         [0011]     Another advantage of the station-to-station system is that the digital data are supplied directly from the machines of the users.  
         [0012]     The storage space can therefore be considered in practice as unlimited.  
         [0013]     However, station-to-station networks are unstable. This is because client devices (and consequently server devices) periodically connect to or disconnect from the network, thus making the presence of data highly uncertain. Moreover, the addresses of the client and/or server devices are unpredictable and liable to be different at each connection.  
         [0014]     The result of this is that accessing the contents in a station-to-station type communication network also constitutes a great difficulty since the latency time for obtaining the data item is no longer due simply to the time necessary for retrieving the data as in the conventional client/server topology, but also the time for searching for a server device having this data item available. Depending on the topology of the station-to-station network concerned, this search phase can be non-negligible.  
         [0015]     In order to remedy these drawbacks, a known solution consists of using a central server that guarantees a minimum quality of service. Such a solution is referred to as using Hybrid station-to-station networks.  
         [0016]     In a known manner, sharing a digital data item through a hybrid station-to-station communication network consists of the sequence of the following steps: 
        selecting the document to be shared;     associating a unique identifier making it possible to find the location of the document in the network;     calculating a thumbnail image from the original data item;     updating an index table at the central server by associating an identifier of the shared document with one (or more) station(s), each of these stations being a server for this document.        
 
         [0021]     This series of known steps is used in the majority of station-to-station networks for sharing a document with a community of users, that is to say that anyone can access this shared document from the moment this person knows the identifier. This is referred to as public sharing.  
         [0022]     On the other hand, a document can be shared with a group of friends and the accessing of this document restricted to this group of friends. This is referred to as restricted access sharing (private sharing).  
         [0023]     In this case, the private sharing of a document requires two additional steps: 
        selecting the addressees; and     sending notification to each of these addressees so as to inform them that a new document is capable of being shared.        
 
         [0026]     In practice, the present invention finds a preferred, but non-limiting, application in a hybrid distributed communication network with restricted sharing.  
         [0027]     Unlike conventional client/server systems, the shared data item in a station-to-station network is available on a number of servers, which increases the risk of malevolent operations with regard to the access to this data item thus shared.  
         [0028]     It is therefore necessary to put in place an access control adapted to the sharing of this data item on each server.  
         [0029]     In practice, each server is a machine belonging to a user who must be able to totally control what takes place on his machine. For example, a user must be able to verify what is stored locally. He must also be able to restrict the access to a data item on his machine or alternatively share it with other users.  
         [0030]     The putting in place of such an access control mechanism restricts the number of users who agree to supply a data item to a user, which is contrary to the main advantage of the station-to-station system where a data item in great demand can be supplied by many servers.  
         [0031]     The Applicant was faced with the problem of providing an access control adapted to the sharing of a document in a station-to-station network which does not reduce too greatly the number of servers available for a user while being relatively efficient, not very expensive and simple to put in place.  
       SUMMARY OF THE INVENTION  
       [0032]     The present invention provides precisely a solution to this problem.  
         [0033]     It concerns a method of accessing a digital document in a communication network, in particular of the station-to-station type, capable of exchanging data in the form of collections, a collection comprising at least one identifier designating a digital document and at least one identifier designating a user having the right to access the documents in this collection, said method being implemented in a station.  
         [0034]     According to a general definition of the invention, the method comprises the following steps: 
        i) receiving a request coming from a user for accessing at least one digital document, said request comprising an identifier designating the digital document and an identifier designating said user;     ii) searching locally for at least one collection containing the identifier of the document and the identifier of the user, each collection being stored locally in response to a positive verification with regard to at least one condition agreeing to supply the document according to at least one access right linked to the collection; and     iii) in the case of a positive search, supplying said corresponding document to said user thus designated.        
 
         [0038]     Such an access control method has the advantage of being relatively efficient, not very expensive, and simple to put in place, compared with solutions consisting for example of storing on the central server all the rights of access to each document.  
         [0039]     Moreover, the method according to the invention gives the user the possibility of controlling the access to his machine.  
         [0040]     According to one embodiment, the method comprises, in the case of a negative search at the end of the step ii), the following step: 
        ii1) obtaining at least one collection containing said identifier of the document and the identifier of the user and locally storing said collection thus obtained if the supply agreement condition is validated.        
 
         [0042]     In practice, the method also comprises a step i1) of verifying the identity of the sender of the access request, established by means of a chosen authentication function.  
         [0043]     Moreover, it is also practical to associate with the request for accessing a digital document a collection identifier comprising the identifier of the requested document. This will make it possible to speed up the local verification of the supply agreement.  
         [0044]     According to another embodiment, the step i) is preceded by the following steps: 
        a) creating each collection by designating each digital document to be shared by an identifier and assigning to each addressee user an access right formed by an identifier of said addressee user;     b) forming a notification containing said collection thus created; and     c) sending said notification thus formed to at least one addressee user.        
 
         [0048]     In practice, the receipt of a notification is followed by a step of authenticating each collection thus received according to a chosen authentication function.  
         [0049]     In the case of negative authentication of the collection, provision is made to destroy the collection thus received.  
         [0050]     In the case of positive authentication of the collection, provision is made to verify the access right associated with the condition agreeing to supply the document and in the case of positive verification to locally store said collection thus received.  
         [0051]     According to another embodiment, in the case of an invalid access right, the method also comprises the following steps for each document in the collection: 
        1) searching locally for the presence of another collection containing at least the identifier of a document belonging to the collection thus received;     2) in the presence of another collection containing at least the identifier of a document belonging to the collection thus received, verifying the validity of the access right associated with the condition agreeing to supply the document of said other collection; and     3) in the case of validity of said access right, locally storing the collection thus received.        
 
         [0055]     In practice, in the case of failure of the step 3), the method also comprises viewing of the collection and, in the case of manual validation of the collection, local storing of said collection.  
         [0056]     According to another aspect of the invention, the digital document belongs to the group formed by fixed images or photographs, video sequences, computer files for office automation application or the like.  
         [0057]     For example, the access right linked to the collection relates to the author of the collection and the belonging of said author to a chosen list of users referred to as friends, the access right being valid when the author of the collection belongs to such a list of friends.  
         [0058]     Another object of the present invention is a device for accessing a digital document in a communication network, in particular of the station-to-station type, capable of exchanging data in the form of collections, a collection comprising at least one identifier designating a digital document and at least one identifier designating a user having the right to access the documents in this collection, said device being incorporated in a station.  
         [0059]     According to another important characteristic of the invention, the access device comprises: 
        means for receiving a request coming from a user for accessing at least one digital document, said request comprising an identifier designating the digital document and an identifier designating said user;     means for searching locally for at least one collection containing the identifier of the document and the identifier of the user, each collection being stored locally in response to a positive verification with regard to at least one condition agreeing to supply the document according to at least one access right linked to the collection; and     means for supplying, in the case of a positive search, said corresponding document to said user thus designated.        
 
         [0063]     Another object of the present invention is a system for accessing a digital document in a communication network, in particular of station-to-station type, characterized in that it comprises an access device incorporating the device mentioned above.  
         [0064]     Another object of the present invention is an information carrier readable by a computer system, possibly totally or partially removable, in particular a CD-ROM or magnetic medium, such as a hard disk or a floppy disk, or a transmittable carrier, such as an electrical or optical signal, characterized in that it comprises instructions of a computer program allowing the implementation of a processing method mentioned above, when this program is loaded and executed by a computer system.  
         [0065]     Finally, an object of the present invention is a computer program stored on an information carrier, said program comprising instructions allowing the implementation of a processing method mentioned above, when this program is loaded and executed by a computer system. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0066]     Other characteristics and advantages of the invention will emerge in the light of the following detailed description of the drawings in which:  
         [0067]      FIG. 1  depicts schematically a station-to-station distributed data exchange network;  
         [0068]      FIG. 2  depicts schematically an apparatus implementing the access method according to the invention;  
         [0069]      FIG. 3  depicts schematically a collection;  
         [0070]      FIG. 4  illustrates the viewing of a collection in a graphics interface;  
         [0071]      FIG. 5  depicts schematically the data stored at a client station according to the invention;  
         [0072]      FIG. 6  illustrates schematically the steps in the creation of a collection according to the invention;  
         [0073]      FIG. 7  illustrates schematically the steps in the receiving and acceptance of a collection according to the invention;  
         [0074]      FIG. 8  illustrates schematically the steps in a request for accessing an image according to the invention;  
         [0075]      FIG. 9  illustrates simple sharing according to the invention;  
         [0076]      FIG. 10  illustrates sending to a number of addressees according to the invention;  
         [0077]      FIG. 11  illustrates sending of a number of collections according to the invention;  
         [0078]      FIG. 12  illustrates a scenario of re-sending of received images to other addressees according to the invention; and  
         [0079]      FIG. 13  illustrates a “friends of friends” type access authorization scenario according to the invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0080]     With reference to  FIG. 1 , a distributed data exchange network  1  of the “peer to peer” type has been depicted schematically. Such a network  1  comprises a set of terminals  2 , each terminal  2  being connected to the network  3  (the Internet) and having communication means. Each terminal  2  can be for example a device as described in  FIG. 2 , and comprises in particular: a volatile storage memory (cache)  4 , a file server  5  and a man/machine interface  6  which allows communication of the requests  7  of the user and the responses  8  to said requests  7 . The terminals  2  can communicate directly by means of the global network  3 . Optionally, there can be a central server  10 , to which there are connected all the terminals  2  of the distribution network, which is permanently connected and which stores a set of data on the terminal-to-terminal exchange system: information on the presence of each of the terminals identified as forming part of the network, and possibly information on the contents (e.g. the images) that are stored locally on each station. The central server  10  can also be used to authenticate the users who connect up.  
         [0081]     With reference to  FIG. 2 , an access device  200  capable of implementing the invention has been depicted. Such an apparatus  200  is for example a microcomputer, a workstation, a digital assistant, a photographic apparatus or a portable telephone. The apparatus  200  is connected to various peripherals such as, for example, a digital camera  201  (or a scanner or any image acquisition or storage means) connected to a graphics card and providing the apparatus with multimedia data.  
         [0082]     The apparatus  200  comprises a communication bus  202  to which there are connected: 
        a central processing unit  203  (microprocessor);     a read-only memory  204 , possibly comprising the programs “Prog”, “Prog1” and “Prog2”;     a random access memory  206  (cache memory), comprising registers adapted to record variables and parameters created and modified during execution of the aforementioned programs;     a screen  208  making it possible to view data and/or be used as a graphical interface with the user who can interact with the programs according to the invention, using a keyboard  210  or any other means such as a pointing device, like for example a mouse  211  or a light pen; and     a communication interface  218  connected to a distributed communication network  220 , for example the Internet, the interface being capable of transmitting and receiving data.        
 
         [0088]     In the case of audio data, the apparatus also comprises an input/output card (not depicted) connected to a microphone  222 .  
         [0089]     The apparatus can optionally have: 
        a hard disk  212  possibly comprising the aforementioned programs “Prog”, “Prog1” and “Prog2”;     a floppy disk drive  214  adapted to receive a floppy disk  216  and read therefrom or write thereto data processed or to be processed according to the invention.        
 
         [0092]     The communication bus allows communication and interoperability between the different elements included in the microcomputer  200  or connected thereto. The depiction of the bus is not limiting and, in particular, the central unit is able to communicate instructions to any element of the microcomputer  200  directly or by means of another element of the microcomputer  200 .  
         [0093]     The executable code of each program allowing the programmable apparatus to implement the processes according to the invention can be stored, for example, on the hard disk  212  or in read only memory  204 .  
         [0094]     According to a variant, the floppy disk  216  can contain data and the executable code of the aforementioned programs which, once read by the apparatus  200 , will be stored on the hard disk  212 .  
         [0095]     In a second variant, the executable code of the programs can be received by means of the communication network  220 , via the interface  218 , in order to be stored in a manner identical to that described previously.  
         [0096]     The floppy disks can be replaced by any information medium such as, for example, a compact disk (CD-ROM) or a memory card. In general terms, an information storage means, readable by a computer or by a microprocessor, integrated or not with the apparatus, and possibly removable, is adapted to store one or more programs whose execution allows the implementation of the method according to the invention.  
         [0097]     In more general terms, the program or programs can be loaded into one of the storage means of the apparatus  200  before being executed.  
         [0098]     The central unit  203  will control and direct the execution of the instructions or portions of software code of the program or programs according to the invention, instructions which are stored on the hard disk  212  or in the read only memory  204  or else in the other aforementioned storage elements. During power-up, the program or programs that are stored in a non-volatile memory, for example the hard disk  212  or the read only memory  204 , are transferred into the random access memory (RAM)  206  which will then contain the executable code of the program or programs according to the invention, as well as registers for storing the variables and parameters necessary for implementation of the invention.  
         [0099]     It should be noted that the communication apparatus comprising the device according to the invention can also be a programmed apparatus. This apparatus then contains the code of the computer program or programs fixed in an application specific integrated circuit (ASIC), for example.  
         [0100]     With reference to  FIG. 3 , a collection  300  comprising a set of contents of media (image, video, sound) with metadata has been depicted. By extension, a collection can contain collections (referred to as sub-collections). In the preferred embodiment, the medium used consists of digital images.  
         [0101]     By way of example, a collection  300  comprises: 
        on the one hand, a header  300 H comprising a title  301 , an identifier  302  of the collection, an identifier of the author of the collection  305  and a signature  306 ; and     on the other hand, a body  300 B comprising a list of identifiers  303  of the digital images in this collection and a list of user identifiers  304 .        
 
         [0104]     Each object corresponding to a digital image or to a collection is identified by a unique identifier  302 , created on the machine of the user. This identifier is assigned by the client application, even if not connected to the network.  
         [0105]     A known solution consists of locally producing random unique numbers. Tools well known to persons skilled in the art make it possible to generate identifiers with a minute probability of duplication.  
         [0106]     Similarly, images are defined by a unique identifier  303  by the application of the client as soon as a new image is added to a collection (if the image is copied from an existing collection, it retains the original identifier).  
         [0107]     In practice, a thumbnail image has the same identifier as an image. In order to uniquely determine an object (image or thumbnail image), the identifier  303  must be associated with a “typing” or data version: most of the time, this typing is implicit according to the requests sent on the network (in the case of downloading, the image is required, whereas the thumbnail image is useful for simple viewing).  
         [0108]     Each user also has a unique identifier  304  provided by the central server  10  during the user registration method. This property is useful for reducing to a minimum the risk of multiple registrations for the same user.  
         [0109]     In the preferred embodiment, on purchasing applications software for station-to-station sharing, the purchasing user registers his software and sets up with the central server  10  an account that identifies this user. This account, identified by the identifier ID  304 , is used for connection of the client both by the standard software or by an Internet browser.  
         [0110]     The creation of a collection by a user is not the subject of the present invention. There exist well-known methods of the prior art which relate to images and their association with image containers. For example, the user can copy an image from the graphics interface of the operating system of his computer and deposit it in the graphics interface of the computer software implementing the invention. The user can structure his images, collections and sub-collections so as to finally record each created collection  300  in the form of a list of identifiers of images, sub-collections and users. In practice, the XML data description format can for example be used. Each collection can possibly comprise one or more items of metadata of small memory size, for example a thumbnail image representing the whole of the collection.  
         [0111]     A collection also contains the identifier  305  of the author of the collection and a signature  306  making it possible to verify that the collection was indeed created by the author  305 . This signature  306  can be created in a number of ways according to the type of system.  
         [0112]     For example, if each user possesses a public key and a private key, the signature  306  can be produced conventionally on the machine of the author with his private key. For example, a summary of the collection can be calculated with a conventional signature algorithm of the “hash” type, for example the “MD5” algorithm, and an encryption of it carried out with the private key.  
         [0113]     According to another example, the central server  10  can be used for signing the collection: in this case only the central server  10  needs to have a key. The signature is produced on the central server  10  with its key.  
         [0114]     In practice, for validating a signature  306 , a client can have the public key corresponding to the key that was used to sign the collection. In this case, he can decrypt the signature  306  and compare the value obtained with his own calculation of the hash of the collection. In a variant, he can call upon the central server  10  for validating the signature.  
         [0115]     With reference to  FIG. 4 , the viewing of a collection file  300  by a user in a graphical interface has been depicted. By analogy with electronic mail, the author  305  is displayed in a “from” field P 1  and the addressees are displayed in “to” fields P 2 . The name displayed is not necessarily the unique identifier  305 ; it can be a display name associated with registration. A display name can be for example an e-mail address of the user. The title  301  of the collection is also displayed in correspondence at the field P 3 . For each image included in the collection  300 , a thumbnail image T is displayed. By clicking on the thumbnail image T, the user can display the complete image.  
         [0116]     Not all the elements making up the collection file are displayed: certain elements are used only for ensuring the coherence of the collection: the signature of the collection, or the collection identifier.  
         [0117]     With reference to  FIG. 5 , the set of data stored in the storage memory (hard disk  212 ) of a client station has been depicted.  
         [0118]     A client or user stores images and collections in the file system. It must be possible for the image and collection files to be found again from the corresponding identifier  302  or  303 ; a table  212 A is therefore provided associating the unique identifier  302  or  303  in the network with the local file name NF. A record in the file table  212 A is created when a file is received from the network and saved locally. The table  212 A also contains information V relating to the version of the file.  
         [0119]     A second table  212 B is provided for containing an address book. Such an address book makes it possible to store all the people in the system known by the client. A record in the table  212 B contains an indicator I 2  corresponding to the unique identifier  304  of the known person, an indicator I 1  corresponding to the display name, an indicator I 4  corresponding to the public key (if it exists), and an indicator I 3  for indicating whether this contact is a friend. Within the context of this invention, a friend is a user of the system who has a privileged role in the definition of the rights of access to the data, as explained later with reference to  FIGS. 7 and 8 .  
         [0120]     A third table  212 C makes it possible to store for each image designated by an identifier  303  a list of the collections designated by an identifier  302  containing said image.  
         [0121]     With reference to  FIG. 6 , the steps illustrating the creation of a collection (E 600 ) have been depicted.  
         [0122]     During the step E 601 , the headers  300 H of the collection are created; the user enters a title  301 , the identifier of the author  305 , and the creation date. A new collection identifier  302  is created.  
         [0123]     The user next selects an image list (step E 602 ). This can relate to images situated in collections or new images of the user.  
         [0124]     For each image, the client obtains an identifier  303  (step E 603 ). This can be the identifier of the image in the collection where it was selected or a new identifier if it concerns a new image. A new identifier can be created by taking for example a random number with a size sufficient to have a very low probability of obtaining the same identifier a number of times.  
         [0125]     The identifier of each image is added to the new collection (step E 604 ).  
         [0126]     The user next gives addressees (step E 605 ). He can select people from the address book  212 B (step E 606 ) or enter new names (step E 608 ). If he has selected a name from the address book  212 B, the identifier of the user is known and is added to the addressee list of the collection.  
         [0127]     If the user enters a new name, the system then interrogates the central server  10  in order to obtain information on the addressee (step E 607 ). If the addressee is a person registered in the system, the central server  10  has assigned him an identifier  304  which can then be sent back to the client with all the associated information: name I 1 , public key I 4 . The client can then add the name into the address book  212 B. The system asks the user whether the addressee is a friend. The new user identifier  304  can then be added to the addressee list of the collection.  
         [0128]     If the name is not known on the central server  10 , he cannot be chosen as an addressee.  
         [0129]     After creating the image list and the addressee list, it is possible to calculate a signature (step E 610 ). The signature can be calculated using a conventional public key signature system in which a footprint of the data to be signed (the author, the image list and the addressee list) is calculated using an algorithm such as MD5, and in which this footprint is then encrypted with the private key of the author using an authentication function of RSA type for example. In a variant, the signature can be calculated by the central server. The collection is then sent to the central server which authenticates the person who sent the collection and calculates a signature. The signature is then sent back to the author of the collection.  
         [0130]     The collection file can then be stored (step E 611 ). This step E 611  consists of saving the new collection in a file. The identifier and the file name are saved in the file table  212 A. The image table  212 C is updated for each image included in the collection: the identifier  302  of the collection is associated with the identifier  303  of each image. For new images, the file table  212 A is updated with the path of the original image, the identifier  303  of the image and the version V.  
         [0131]     Finally a message is sent to each addressee to inform him of the new collection (step E 612 ).  
         [0132]     With reference to  FIG. 7 , the steps in the receipt of a new collection C 1  (step E 700 ) by a user  304  have been depicted.  
         [0133]     First, during the step E 701 , provision is made to establish an authentication function with regard to the collection thus received.  
         [0134]     For example, the signature ( 306 ) associated with the collection is verified. For this, the system reads the identity  305  of the author of the collection. If this author is in the address book  212 B, his public key  14  can be obtained therefrom. If not, the central server  10  is asked for the public key. This key is used for validating the signature ( 306 ) associated with the collection as follows: the signature is decrypted and compared with the footprint of the received collection; if these two data items are identical, the signature associated with the collection is validated. In a variant, the collection C 1  can be sent to the central server  10  for it to validate the signature. Another variant consists of using the public key of the central server  10  for validating the signature.  
         [0135]     If the signature ( 306 ) associated with the collection is invalid, the collection C 1  is rejected and is not stored (step E 702 ).  
         [0136]     If the signature ( 306 ) associated with the collection is valid, the system checks whether the author of the collection designated by his identifier  305  is a friend (step E 703 ). In other words, the system checks whether the author designated by his identifier  305  belongs to the address book  212 B with an indicator I 3  corresponding to the valid “friend” criterion. In the case of a valid criterion I 3 , the collection C 1  can be accepted and the collection file stored (step E 704 ).  
         [0137]     If the author designated by the identifier  305  is not a friend (criterion I 3  not valid), the method can continue the access control mechanism by checking whether the author of the collection C 1  designated by the identifier  305  is authorized to access all the images in the collection C 1  according to at least one collection C 2  already accepted locally (step E 705 ).  
         [0138]     For this, the method checks, for each image designated by its identifier  303  in the collection C 1 , whether there exists at least one local collection C 2  that contains the corresponding image and that authorizes the author designated by the identifier  305  (step E 706 ), that is to say either the author  305  is the author of the collection C 2 , or the author  305  forms part of the addressee list of the collection C 2  (step E 707 ).  
         [0139]     If the result of the step E 707  is positive for each image in the collection C 1 , then the collection C 1  can be accepted and stored (step E 704 ).  
         [0140]     If the collection C 1  is still not accepted, the system checks (step E 708 ) whether the local user  304  is in the addressee list of the collection C 2 . If this is not the case, the collection C 1  is rejected (step E 702 ). Such a test is in particular useful for checking whether the user is able to obtain a graphical representation so that the user can validate the collection C 1 .  
         [0141]     If the user forms part of the addressee list, the system then asks (step E 709 ) the user to manually validate the collection C 1 . The collection C 1  is presented graphically to the user who can accept or reject it.  
         [0142]     If he rejects it, the collection is destroyed. If he accepts it, the system can ask (step E 710 ) whether the author designated by his identifier  305  must be added to the address book  212 B and whether he is a friend (indicator I 3  in the valid state), and then the collection is stored.  
         [0143]     The saving of the collection C 1  updates the associated tables  212 A,  212 B and  212 C in the same way as in the case of the creation of a new collection as described with reference to  FIG. 6 .  
         [0144]     The user can at any time ask to view a stored collection. In this case a graphical representation of the collection is presented to him. A thumbnail image is presented for each image in the collection. If the thumbnail image is not available locally, the system searches for it in the network. For example, the client can send requests for accessing the image to the known clients. If one of the clients agrees to supply the data item as described with reference to  FIG. 8 , the new data item is stored in a local file, the tables  212 A,  212 B and  212 C are then updated: the new file is put in the file table  212 A with the image identifier  303  and the version V.  
         [0145]     If then the user asks to view the original version of a data item in the collection, if this data item is not available locally then the data item is searched for in the network and if it is found it is downloaded and stored: the tables  212 A to  212 C are updated which will make it possible to supply this data item if another client requests it.  
         [0146]     With reference to  FIG. 8 , the steps in the receiving of a request to supply an image designated according to its identifier  303  (step E 800 ) have been described.  
         [0147]     During the step E 801 , the method tests the validity of the identity of the sender of the request. The identity of the sender can be put in the request but it is preferable to verify the validity of this identity. One solution consists of using the public key of the sender (which can be obtained from the central server) for encoding a request sent to the sender. If the latter is capable of decoding it, this shows that he possesses the private key and that he therefore indeed has the correct identity.  
         [0148]     Another variant consists of the sender requesting a token from the central server  10 . The latter verifies his identity by asking him for a password. It can then give him a token created with the private key of the central server  10  which encodes the identity of the sender. The receiver of the request can thus validate the identity by decoding the token which requires only the public key of the central server.  
         [0149]     During the step E 802 , it is checked whether the image designated by its identifier  303  is known by using the file table  212 A. If the image is not known, the request is rejected (step E 803 ).  
         [0150]     Next the system uses the image table  212 C to obtain the list of collections containing the requested image (step E 804 ). For each collection containing the designated image, it is checked whether the sender of the request is in the addressee list of the collection (step E 805 ). If this is the case, the image is sent to the requester (step E 806 ).  
         [0151]     In a variant, a collection identifier  302  can be included in the image request in order to speed up the search for a collection containing both the image and the identity of the requester. This collection would be tested first before all the other collections containing the image.  
         [0152]     If no locally known collection authorizes the requester to obtain the image, he is then asked to send the collection C 1  that allowed him to find the image designated by the identifier  303  (step E 807 ). When this new collection C 1  is received, the collection C 1  is validated using part of the algorithm described with reference to  FIG. 7 . First, the signature of the collection C 1  is checked. If the signature is not valid, the request is rejected (step E 803 ).  
         [0153]     Then it is checked whether the image designated by the identifier  303  forms part of the list of images in the collection C 1  and whether the requester forms part of the addressee list (step E 809 ).  
         [0154]     Finally, the identity of the author (identifier  305 ) of the collection C 1  is extracted (step E 810 ). If the author (identifier  305 ) is a friend (step E 811 ), the collection C 1  is accepted (step E 812 ), stored and the image can be supplied (step E 806 ).  
         [0155]     If the author is not a friend (indicator I 3  in the non-valid state), it is checked (step E 813 ) whether there exists a collection C 2 , known locally and already accepted, containing the image designated by the identifier  303  and authorizing obtaining of the image thus designated. In practice, the authorization is granted if the user designated by the identifier  305  is an addressee of the collection C 2  or else the author of the collection C 2  (step E 814 ).  
         [0156]     If such a collection C 2  exists (authorization granted according to the step E 814 ), the method authorizes the sending of the image thus designated  303 , but the collection C 2  is not stored since it could contain authorizations for images other than the image which could be invalid.  
         [0157]     In a variant it could be verified that the author of C 2  is authorized to access all the images of C 2  according to the collections accepted locally and not only the image designated by the identifier  303 . In this case the collection C 1  can be accepted locally.  
         [0158]     If no local collection C 2  authorizes the author of the collection C 1  to obtain the image  303 , the request is rejected (step E 803 ).  
         [0159]     With reference to  FIG. 9 , the normal scenario for sharing a collection C 1  has been depicted.  
         [0160]     A user A (identifier  304 ) creates a collection C 1  (identifier  302 ) and puts the user B as addressee. Following the steps described with reference to  FIG. 6 , the collection file C 1  is created, stored locally in the tables  212 A to  212 C and sent to the user B.  
         [0161]     The user B can then ask to view an image in the collection C 1 . For this, the user B sends a request for the image designated according to an identifier  303  to the user A. Following the steps described with reference to  FIG. 8 , the user A will agree to supply the image since the user B forms part of a known collection which gives him the right to receive the image thus designated by the identifier  303 .  
         [0162]     The image  303  is therefore sent to the user B.  
         [0163]     With reference to  FIG. 10 , the scenario for sending a collection with a number of addressees has been depicted.  
         [0164]     A user A creates a collection C 1  and puts the users B and C as addressees. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally in the tables  212 A to  212 C and sent to the users B and C.  
         [0165]     In this scenario, the user B validates the collection C 1  and views an image designated by an identifier  303 . The image  303  is therefore downloaded and stored on the station of the user B. Then the user A disconnects from the network.  
         [0166]     The user C then asks to access the image  303 . If he sends the request to the user B, the user B will note that he possesses a collection authorizing the user C to access the image  303 . He will therefore supply the image  303  in the place of the author of the collection C 1 .  
         [0167]     With reference to  FIG. 11 , the scenario for sending a number of collections has been depicted.  
         [0168]     A user A creates a collection C 1  and puts the user B as addressee. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally in the tables  212 A to  212 C and sent to the user B.  
         [0169]     In this scenario, the user B validates the collection C 1  and views an image designated by an identifier  303 . The image thus designated is therefore downloaded and stored on the station of the user B.  
         [0170]     The user A next creates a collection C 2  containing the same image (same identifier  303 ) as the collection C 1  and puts the user C as addressee. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally (in the tables  212 A to  212 C) and sent to the user C.  
         [0171]     Next the user A disconnects from the network.  
         [0172]     The user C then asks to access the image having the identifier  303 . If he sends the request to the user B, the user B will note that he does not possess a collection authorizing the user C to access the image  303 . He therefore asks him for the collection that authorizes him to obtain the image  303 . The user C therefore sends the collection C 2 .  
         [0173]     The user B then applies the steps described with reference to  FIG. 8  for validating the collection C 2 . The collection C 2  is validated since the author of C 2  (the user A) is also the author of the collection C 1  which has already been accepted and which contains the same images.  
         [0174]     The user B will note that he possesses a collection authorizing the user C to access the image  303 . He will therefore supply the image  303  in the place of the author A of the collection C 1 .  
         [0175]     With reference to  FIG. 12 , the scenario for re-sending received images to other addressees has been depicted.  
         [0176]     A user A creates a collection C 1  and puts the user B as addressee. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally (in the tables  212 A to  212 C) and sent to the user B.  
         [0177]     In this scenario, the user B validates the collection and views an image designated by its identifier  303 . The image thus designated is therefore downloaded and stored on the station of the user B.  
         [0178]     The user B then decides to share the image  303  again with another addressee. He creates a collection C 2  containing the same image (same identifier  303 ) as the collection C 1  and puts the user C as addressee. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally (in the tables  212 A to  212 C) and sent to the user C.  
         [0179]     The user B next disconnects.  
         [0180]     The user C then asks to access the image  303 . If he sends the request to the user A, the user A will note that he does not possess a collection authorizing the user C to access the image  303 . He therefore asks him for the collection that authorizes him to obtain the image  303 . The user C therefore sends the collection C 2 .  
         [0181]     The user A then applies the steps described with reference to  FIG. 8  for validating the collection C 2 . It is assumed that the user B is not a friend of the user A; the collection C 2  is not validated.  
         [0182]     However the user A can verify that the user B (the author of the collection C 2 ) is authorized to access the image  303 , since he possesses a stored collection C 1  that gives the user B the right to access the image  303 . He therefore agrees to supply the image  303  in the place of the user B, even though the collection C 2  is not stored.  
         [0183]     With reference to  FIG. 13 , the scenario for authorizing access to friends of friends has been depicted.  
         [0184]     A user A creates a collection C 1  and puts the user C as addressee. Following the steps described with reference to  FIG. 6 , the collection file is created, stored locally (in the tables  212 A to  212 C) and sent to the user C.  
         [0185]     The user A next disconnects.  
         [0186]     In this scenario, a user B is connected and possesses the image  303  and the user B has the user A as a friend.  
         [0187]     The user C validates the collection and then asks to access the image  303 . If he sends the request to the user B, the user B will note that he does not possess a collection authorizing the user C to access the image  303 . He therefore asks him for the collection that authorizes him to obtain the image  303 . The user C therefore sends the collection C 1 .  
         [0188]     This collection is then accepted since the author of the collection C 1  is the user A who is a friend of the user B.  
         [0189]     The user B will note that he possesses a collection authorizing the user C to access the image  303 . He will therefore supply the image  303  in the place of the author of the collection.