Abstract:
The invention is a method of managing communication between an electronic token and a remote web server. The token and the server are connected to a same host machine. The token comprises first and second token servers and a memory comprising HTML data. The host machine has an Internet web browser. Said method comprises the steps of:
       sending a first request from the Internet web browser to the first token server,   returning a first answer to the Internet browser, said first answer comprising HTML data including a connection information associated to a script,   on the Internet web browser, executing the script associated to the connection information. Script execution establishes a connection to the remote server allowing a two-way communication between the second token server and the remote server through the Internet browser acting as a gateway.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to methods of managing communication between an electronic token and a remote server. It relates particularly to methods of managing communication between an electronic token comprising a server and a remote web server. 
       PRIOR ART 
       [0002]    Electronic tokens are portable electronic objects like smart cards, portable audio devices, mobile handsets, personal digital assistants or USB tokens. The word “Internet” means “interconnected networks”. Electronic tokens may embed a local network comprising a hypertext transfer protocol HTTP server, a local Domain name system DNS server, or a dynamic host configuration protocol DHCP server. Alternatively, the local network can be a combination of these servers. The local network may comprise a unique or several local servers combining the functions of a HTTP and/or DNS and/or DHCP and/or the function of any server or service according to the World Wide Web consortium rules (W3C), said servers having a unique IP address. 
         [0003]    An electronic token may be connected to a host machine. A host machine may be connected to a remote server through Internet. A remote server is a distant server placed on a machine reachable through Internet. When both a remote server and an electronic token are connected to the same host machine, the remote server and the electronic token may communicate through the host machine. Existing host machines connected to Internet have an Internet web browser like Microsoft Internet Explorer® or Mozilla Firefox®. 
         [0004]    At present for establishing a communication between an electronic token and a remote server the host machine must be customized using the Internet connection sharing mechanism or by installing dedicated software ensuring the same function. However customization of a host machine may be limited or forbidden by administration rights. 
       SUMMARY OF THE INVENTION 
       [0005]    The invention aims at allowing communication between an electronic token and a remote server through a host machine without customization of said host machine. The invention aims at allowing the communication connection and the automatic routing of data between the electronic token and the remote server in both directions. 
         [0006]    The object of the present invention is a method of managing communication between an electronic token and a remote web server. The electronic token is connected to a host machine and comprises a microprocessor, a communication interface and a memory. Said memory comprises an operating system and at least a first HTML data. Said electronic token comprises at least first and second token servers. The remote web server is connected to the same host machine. The host machine has an Internet web browser. Said method comprises the steps of:
       sending a first request from the Internet web browser to the first token server,   returning a first answer from the first token server to the Internet web browser, said first answer comprising a first HTML data, said first HTML data comprising connection information associated to a script,   on the Internet web browser, executing the script associated to the connection information,       
 
         [0010]    characterized in that execution of said script establishes a connection to the remote web server allowing a two-way communication between the second token server and the remote web server through the Internet web browser acting as a gateway. 
         [0011]    The first HTML data may comprise second data and said method may comprise the further steps of:
       sending a second request from the Internet web browser to the remote web server, wherein said second request comprises the second data,   on the remote web server, computing a specific URL based on the second data, said specific URL allowing connecting to the second token server,   returning a second answer from the remote web server to the Internet web browser, said second answer including a third data comprising the specific URL,   on the Internet web browser, routing said second answer received from the remote web server with a third request to the second token server.       
 
         [0016]    The step of returning the second answer may be performed by a HTTP redirect function or by an HTML automatic submission function. 
         [0017]    The electronic token may comprise a virtual local network comprising a local domain name server. The method may comprise the further steps of:
       sending a DNS request from the Internet web browser to the local domain name system DNS server, said DNS request comprising the specific URL,   receiving a DNS answer comprising an IP address corresponding to the specific URL sent to the Internet web browser by the local domain name system DNS server.       
 
         [0020]    The second answer may comprise a fourth data and the third request may comprise the fourth data. 
         [0021]    The method may comprise the further steps of:
       in response to the third request, sending a third answer from the second token server to the Internet web browser, said third answer comprising a fifth data,   routing said fifth data from the Internet web browser to the remote web server.       
 
         [0024]    The second data may comprise a variable part which may be randomly set or computed according to a predefined sequence. 
         [0025]    Each of said first and second token servers may be a HTTP server or a HTTPS server. 
         [0026]    Said first and second token servers may be merged in a unique token server. 
         [0027]    The connection information may comprise the script, or a script URL from where the script may be downloaded. 
         [0028]    The script may be a javascript. 
         [0029]    Another object of the invention is an electronic token which is intended to be connected to a host machine. The token contains a microprocessor, a communication interface and a memory. The memory comprises an operating system and at least a first HTML data. The token contains at least first and second token servers. The host machine has an Internet web browser and is connected a remote web server. The token is characterized in that the first HTML data comprises connection information associated to a script, said connection information being intended to be sent by the first token server. Execution of said script by the Internet web browser of the host machine establishes a connection to the remote web server allowing a two-way communication between the second token server and the remote web server through the Internet web browser acting as a gateway. 
         [0030]    The token may be a smart card, a portable audio device, a mobile handset, a personal digital assistant or a USB token. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0031]    Other characteristics and advantages of the present invention will emerge more clearly from a reading of the following description of a number of preferred embodiments of the invention with reference to the corresponding accompanying drawings in which: 
           [0032]      FIG. 1  depicts schematically the architecture of an electronic token of smart card type according to the invention; 
           [0033]      FIG. 2  depicts schematically the interaction between an electronic token, a host machine and a remote web server, according to the invention; 
           [0034]      FIG. 3  is an example of sequence of steps for managing communication between an electronic token and a remote web server, according to the invention; and 
           [0035]      FIG. 4  is an example of data exchanges between an electronic token, a host machine and a remote web server, according to the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0036]    The invention may apply to any types of electronic token connected to a host machine. In this specification, the electronic token is a smart card but it could be any other kind of electronic token or portable device embedding a server. 
         [0037]    An advantage of the invention is to allow an automatic treatment of data exchanged between an electronic token and a remote web server thanks to a gateway managed by the Internet web browser of a connected host machine. 
         [0038]      FIG. 1  shows the architecture of a smart card as an example of an electronic token according to a preferred embodiment of the invention. The smart card ET contains a microprocessor MP, a communication interface INT and a memory MEM. The memory MEM contains an operating system OS and a first HTML data D 1 . The first HTML data D 1  may corresponds to an HTML page content. The first HTML data D 1  contains a connection information CI and a second data D 2 . The memory MEM may consist of a unique circuit or several circuits that may be of different types. 
         [0039]    As shown in  FIG. 2 , the smart card ET contains a first server CS 1 , a second server CS 2  and a local domain name system DNS server DNS 1 . A host machine HM contains an Internet web browser WB. The Internet web browser WB has a script engine EN. A script engine is able to execute a script. In the below part of this document, when a script is executed by the Internet web browser WB, the script is executed by the script engine of the Internet web browser WB. 
         [0040]    The smart card ET is connected to the host machine HM such as a personal computer by a card reader or a dedicated interface. The electronic token may be connected to the host machine by a contact link or a wireless link. 
         [0041]    A remote web server RS is connected to the host machine HM by Internet only or by a combination of several communication channels like Internet and an Over The Air (OTA) Telecom communication. A second domain name system DNS server DNS 2  may be available on the Internet. DNS 2  may returns IP address of server related names such as “***.MyCompany.com”. 
         [0042]      FIG. 3  shows an example of a step sequence for managing the connection and data exchanges between an electronic token and a remote web server. First a user launches the Internet web browser WB on the host machine HM. In step S 1 , the user selects the first token server CS 1  by typing the corresponding address in the Internet web browser WB. For example, the address to be reached may be http://john.smith.secure or https://john.smith.secure. A first request R 1  is then sent to the server CS 1  of the connected electronic token ET at step S 2 . Then a first answer A 1  is returned to the Internet web browser WB of the host machine HM at step S 3 . This first answer A 1  contains a first HTML data D 1  corresponding to a first HTML page. The first HTML data D 1  contains a connection information CI and a second data D 2 . The second data D 2  is related to the second token server CS 2 . The first HTML page is displayed by the Internet web browser WB. This first HTML page offers to connect the remote server RS. Then the user chooses connecting the remote server RS. This connection may be automatic through HTTP redirect or HTML automatic submission function. During step S 4 , the Internet web browser WB extracts a script SC 1  from the previously received connection information CI. Then the Internet web browser WB executes the script SC 1 . The script execution sends a second request R 2  to the remote server RS at step S 6 . This second request R 2  contains the previously received second data D 2 . This second data D 2  includes information identifying the server to be reached in the electronic token ET. At the step S 7 , the remote server RS computes a specific URL URL 2  thanks to the second data D 2 . For example the second data D 2  may contain the first part of the URL 2  and the remote server RS may complete the computed specific URL by adding a complementary data specific to the token ET. Thus if the second data D 2  provides “smartcard192 — 168 — 1 — 1” and the remote server RS adds “MyCompany.com” then the computed URL 2  refers to “smartcard192 — 168 — 1 — 1.MyCompany.com”. Then the computed URL 2  may be resolved by DNS 1  to the real IP address of the server CS 2  in the token ET. For example, the real IP address of the server CS 2  may be equal to 192.168.1.1. 
         [0043]    Alternatively the computed URL 2  may be resolved by the remote DNS 2 . 
         [0044]    Then at step S 8 , the remote web server RS send a second answer A 2  to the Internet web browser WB of the connected host machine HM. The second answer A 2  contains third data D 3  including the computed specific URL URL 2 . 
         [0045]    The sending of the second answer A 2  may be performed with a HTTP redirect function or with an HTML automatic submission function. 
         [0046]    Alternatively, other functions of the Internet web browser may be embezzled as long as their use allows the automatic connection functions. 
         [0047]    A remote URL URL 1  is used for the second request R 2 . In a preferred embodiment, the remote URL URL 1  belongs to the same domain as the computed specific URL URL 2 . 
         [0048]    After receiving the second answer A 2 , the Internet web browser WB may send a request DNSRq to the domain name system DNS server DNS 1  of the electronic token ET at step S 9 . This request DNSRq allows getting the IP address corresponding to the received URL 2 . Then, at step S 10 , the DNS 1  server send back the IP address corresponding to URL 2 . This IP address corresponds to the second token server CS 2 . 
         [0049]    Then the Internet web browser WB routes the second answer A 2  to the second token server CS 2  by sending a third request R 3  to the token ET at step S 11 . 
         [0050]    Additionally and as shown in  FIG. 4 , the second answer A 2  may contain a fourth data D 4  intended to be used by the second token server CS 2 . In this case, the third request R 3  contains the fourth data D 4 . For example, the fourth data D 4  may be related to a new service available for the user. After reception of the third request R 3 , the first HTML data D 1  may be updated in order to declare a new service according to the fourth data D 4  content. 
         [0051]    Alternately, a third answer A 3  containing fifth data D 5  may be sent to the Internet web browser WB by the second token server CS 2  during step S 12 . This third answer A 3  may be routed to the remote web server RS by the Internet web browser WB of the host machine HM. 
         [0052]    Thus two connections are established on the Internet web browser WB: one to the remote web server RS and another to the second token server CS 2  using URL 2 . 
         [0053]    Advantageously, the first token server CS 1  may be a HTTP server or a HTTPS server. The second token server CS 2  may be a HTTP server or a HTTPS server 
         [0054]    Advantageously, first and second token servers CS 1  and CS 2  may be merged in a unique token server. 
         [0055]    In the above example, the token ET comprises a virtual local network comprising a local domain name system DNS server DNS 1 . The invention also applies to electronic tokens ET not embedding a virtual local network. 
         [0056]    Alternately, the Internet web browser WB may extracts a script URL URL 3  from the received connection information CI during step S 4 . URL 3  corresponds to an address where the script SC 1  may be found. The script SC 1  is then downloaded from URL 3  and executed by the Internet web browser WB. 
         [0057]    In a preferred embodiment the script SC 1  is a javascript. The script SC 1  may use the XMLHttpRequest API. 
         [0058]    Advantageously, the second data D 2  may comprise a variable part. The variable part may be randomly set or computed according to a predefined sequence. The variable part is made available for the DNS 1 . 
         [0059]    An additional advantage of the invention is to secure the specific URL URL 2  used for reaching the second token server CS 2 . The URL 2  may change each time a connection to a remote web server RS is engaged. In all cases, both the remote web server RS and the DNS 1  dynamically calculates URL 2  from the same information. 
         [0060]    Alternately a second domain name system DNS server DNS 2  may be reachable from the host machine HM. When the sending of the second answer A 2  is performed with a HTTP redirect function, DNS 2  may be used if the electronic token has no DNS 1 . Moreover, DNS 2  may be used if the electronic token is not an IP token and is accessed via a software proxy localized on the connected host machine HM. In such a case, the first request R 1  may be addressed to the host machine address such as http://127.0.0.1:4116 instead of http://john.smith.secure and URL 2  refers to name like “smartcard.MyCompagny.com” that is resolved to “127.0.0.1” by remote DNS 2 .