Patent Publication Number: US-8977235-B2

Title: Establishment of secure communication

Description:
TECHNICAL FIELD 
     The present invention relates to establishing secure calls. 
     BACKGROUND 
     Currently, there are solutions for making communications between communication terminals secure, particularly involving servers and algorithms that use certificates to establish communications. These solutions are complex and require a costly client-server architecture as well as bandwidth. 
     One goal of the invention is to remedy the aforementioned drawbacks by making a communication between two communication terminals secure in a simple and efficient manner. 
     SUMMARY 
     In order to achieve this objective, a method for establishing a communication between a first communication terminal and a second communication terminal over a telecommunications network is characterized in that it comprises the following steps: 
     during a request to establish a call from the first communication terminal to the second communication terminal, dynamically generate a first single-use key and a second single-use key respectively associated with the first and second communication terminals as a function of time data related to at least one previous communication between the first communication terminal and the second communication terminal, 
     compare the generated first and second keys, and 
     allow the establishment of the communication if the compared keys are identical. 
     Advantageously, the invention provides a simple way to make a communication secure, while using a network architecture that is not very complex and expensive. The dynamic generation of single-use keys requires few exchanges of messages, and offers reliable communication security between the first and second mutation terminals. 
     The invention also pertains to a communication terminal for establishing a communication between the communication terminal and another communication terminal over a telecommunications network, characterized in that it comprises: 
     means for dynamically generating a first single-use key associated with the communication terminal as a function of time data related to at least one previous communication between the communication terminal and said other communication terminal, during a request to establish a call from the communication terminal to said other communication terminal, and 
     means for transmitting the generated key to said other communication terminal, which is capable of dynamically generating a second single-use key associated with said other communication terminal as a function of time data related to said at least one previous communication between the communication terminal and said other communication terminal, of comparing the generated first and second keys, and of authorizing the establishment of the communication if the compared keys are identical. 
     The invention also pertains to a communication terminal for establishing a communication between the communication terminal and another communication terminal over a telecommunications network, characterized in that it comprises 
     means for receiving a single-use first key associated with said other communication terminal dynamically generated by said other communication terminal as a function of time and data related to at least one previous communication between the communication terminal and said other communication terminal during a request to establish a call from said other communication terminal to the communication terminal, 
     means for dynamically generating a second key as a function of time data related to said at least one previous communication between the communication terminal and said other communication terminal, 
     means for comparing the generated first and second keys, 
     means for authorizing the establishment of the communication if the compared keys are identical. 
     The invention also relates to a server for establishing a communication between a first communication terminal and a second communication terminal over a telecommunications network, characterized in that it comprises: 
     means for dynamically generating a first single-use key and a second single-use key respectively associated with the first and second communication terminals as a function of time data related to at least one previous communication between the first communication terminal and the second communication terminal, during a request to establish a call from the first communication terminal to the second communication terminal, 
     means for comparing the generated first and second keys, and 
     means for authorizing the establishment of the communication if the compared keys are identical. 
     The invention also pertains to a computer program capable of being implemented within a server, said program comprising instructions which, whenever the program is executed within said server, carry out the steps according to the inventive method. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
       The present invention and the benefits thereof shall be better understood upon examining the description below, which makes reference to the attached figures, in which: 
         FIG. 1  is a schematic block diagram of a communication system according to one embodiment of the invention, 
         FIG. 2  is an algorithm of a method for establishing secure communication according to a first embodiment of the invention, and 
         FIG. 3  is an algorithm of a method for establishing secure communication according to a second embodiment of the invention, and 
     
    
    
     DETAILED DESCRIPTION 
     With reference to  FIG. 1 , a communication system comprises at least one first communication terminal TC 1 , a second communication terminal TC 2  and at least one communication server SC, capable of communicating with one another over a telecommunications network RT. 
     The telecommunications network RT may be a wired or wireless network, or a combination of wired and wireless networks. 
     In one example, the telecommunications network RT is a high-speed IP (“Internet Protocol”) packet network, such as the Internet or an intranet. 
     In another example, the telecommunications network RT is a TDM (“Time Division Multiplexing”) network or a private network specific to a company supporting a proprietary protocol. 
     The communication terminals TC 1  and TC 2  are connected to the communication server SC over the telecommunications network RT. 
     For example, the communication terminal TC 1  or RC 2  is a TDM landline telephone or a voice-over-IP landline telephone. 
     According to another example, the communication terminals TC 1  and TC 2  are located at different sites and are respectively connected to different communication servers. 
     For example, the communication server SC is a PABX switch (“Private Automatic Branch eXchange”). The communication server SC comprises means, such as a software program or a combination of computing hardware and software, configured particularly to command a call routing. 
     It is assumed that the communication terminals connected to the communication server SC are synchronized with one another, for example by means of the communication server or an NTP (“Network Time Protocol”) server. 
     Each communication terminal TC 1 , TC 2  is associated with a known identifier IdT 1 , IdT 2  of the communication server and of other communication terminals within the telecommunications network RT. 
     Each communication terminal is additionally associated with a log database, which may be included within the communication terminal or connected to it, or connected to the communication server SC. In this way, the first and second communication terminals TC 1  and TC 2  are respectively associated with first and second databases BDH 1  and BDH 2 , which are, for example, respectively connected to or included within the terminals TC 1  and TC 2  as depicted in  FIG. 1 . In the event that the log database is external and connected to the communication terminal, the database is, for example, implemented within an electronic device, such as a USB key. 
     The log database associated with the communication terminal particularly saves information related to communications established with the communication terminal. More particularly, the information contains time databases DonT associated with each communication established between the communication terminal and another communication terminal, such as the date and duration of the communication. 
     The date and duration of the communication may have different degrees of precision. 
     For example, the precision of the date may be “Year, Month, Day, Hour” or with greater precision “Year, Month, Day, Hour, Minute, Second”. The date may also contain an indication of the time zone. 
     Furthermore, the time data may be in different formats, for example binary or hexadecimal, in a given order. 
     The precision and format of the time data are for example defined by a system administrator who manages the communication server. 
     For example, it is assumed that a communication between the first communication terminal TC 1  located in France and the second communication terminal TC 2  located in China was established on Jun. 30, 2009 at 10:51 AM in France and lasted 5 minutes and 32 seconds. 
     The first log database BDH 1  contains time data DonT for example, in the following format: 
     “IdT 1 -IdT 2   
     Date: 30/06/2009 
     Time: 10:51 AM 
     Time zone: GMT+1 
     Duration: 5 nm 32 s” 
     The second log database BDH 2  contains time data DonT for example, in the following format: 
     “IdT 2 -IdT 1   
     Date: 30/06/2009 
     Time: 17:51 AM 
     Time zone: GMT+8 
     Duration: 5 nm 32 s” 
     According to one embodiment of the invention, an application AP is implemented in at least one of the communication terminals TC 1  and TC 2  and/or in the communication server SC, said application being dedicated to at least one of the communication terminals TC 1  and TC 2 . 
     For example, an application is implemented only within the communication server SC, or is implemented within each of the communication terminals TC 1  and TC 2 , or is implemented within one of the communication terminals TC 1  and TC 2  and within the communication server SC. By way of example, the application AP is depicted in  FIG. 1  within each of the communication terminals TC 1  and TC 2  and within the communication server SC. 
     It is assumed that an application dedicated to a communication terminal TC 1  or TC 2  is implemented within the same device in which the log database associated with the communication terminal is implemented. For example, an application and a log database are implemented within each communication terminal, or within a device connected to the communication terminal, or within the communication server, or in both the communication server and in one of the communication terminals TC 1  and TC 2 . In the latter case, an application and the first database BDH 1  may be implemented in the first communication terminal TC 1  and another application and the second database BDH 2  may be implemented in the communication server SC. 
     It is a feature of the application to generate a single-use key associated with the communication terminal as a function of time data DonT related to at least one communication established with the communication terminal. The key is dynamically and uniquely generated when a communication is established with the communication terminal. The application is, for example, implemented in the form of a computer program. 
     With reference to  FIG. 2 , a method for establishing a communication in a secure manner according to a first embodiment of the invention comprises steps E 1  to E 4  executed within the communication system. 
     Initially, it is assumed that multiple communications had already been previously established between the communication terminals TC 1  and TC 2 , the communications being telephone calls. 
     For each communication established between the communication terminals TC 1  and TC 2 , it is assumed that an application dedicated to at least one of the communication terminals TC 1  and TC 2  is implemented within the communication server SC, and saves time data DonT associated with the communication in log databases, containing in particular the date and duration of the call. 
     In step E 1 , the user of the first communication terminal TC 1  wishes to call the user of the second communication terminal TC 2  and triggers a procedure to request the establishment of a call. 
     The first communication terminal TC 1  transmits a message to the communication server SC, the message containing at least the identifiers IdT 1  and IdT 2  of the communication terminals TC 1  and TC 2  in order to establish a communication with the second communication terminal TC 2 . 
     In step E 2 , the application within the communication server SC determines time data DonT related to at least one of the previous communications between the communication terminals TC 1  and TC 2  within the first database BDH 1 , using the identifiers IdT 1  and IdT 2 , and generates a first single-use authentication key K 1  as a function of the determined time data DonT. 
     By way of example, the time data DonT relate to a given communication that had previously been established between the communication terminals TC 1  and TC 2 , said given communication potentially having been the last communication established. According to another example, the time data relates to a combination of multiple given communications that had previously been established between the communication terminals TC 1  and TC 2 . 
     Furthermore, the time data that relates to a communication particularly contains the date and duration of the communication, and optionally an indication of the time zone associated with the first communication terminal TC 1 . Furthermore, the precision of the date may be of different degrees, such as “Year, Month, Day, Hour” or might be “Year, Month, Day, Hour, Minute, Second”. 
     The first authentication key K 1  is thereby associated with a set of communications previously established between the terminals TC 1  and TC 2 , said set potentially being restricted to a single communication. 
     In step E 3 , the application within the communication server SC determines time data DonT related to the same set of communications previously established between the communication terminals TC 1  and TC 2  in the second database BDH 2  and dynamically generates a second single-use authentication key K 2  as a function of the determined time data DonT. 
     In step E 4 , the application compares the keys K 1  and K 2 , and the application authorizes the establishment of the communication between the communication terminals TC 1  and TC 2 , if the compared keys K 1  and K 2  are identical. 
     If the keys K 1  and K 2  are not identical, the application refuses to establish the communication between the communication terminals TC 1  and TC 2 . 
     With reference to  FIG. 3 , a method for establishing a communication in a secure manner according to a second embodiment of the invention comprises steps F 1  to F 7  executed within the communication system. 
     Initially, it is assumed that multiple communications had already been previously established between the communication terminals TC 1  and TC 2 , the communications being telephone calls. 
     For each communication established between the communication terminals TC 1  and TC 2 , it is assumed that an application and a log database are implemented within each communication terminal TC 1  and TC 2  and saves time data DonT associated with the communication in the database, particularly containing the date and the duration of the communication. 
     In step F 1 , the user of the first communication terminal TC 1  wishes to call the user of the second communication terminal TC 2  and triggers a procedure to request the establishment of a call. 
     The application within the communication server SC determines time data DonT related to at least one of the preceding communications between the communication terminals TC 1  and TC 2  within the database BDH 1 , using the identifiers IdT 1  and IdT 2  and dynamically generates a first single-use authentication key K 1  as a function of the determined time data DonT. 
     By way of example, the time data DonT relate to a given communication that had previously been established between the communication terminals TC 1  and TC 2 , said given communication potentially having been the last communication established. According to another example, the time data relates to a combination of multiple given communications that had previously been established between the communication terminals TC 1  and TC 2 . 
     Furthermore, the time data that relates to a communication particularly contains the date and duration of the communication, and optionally an indication of the time zone associated with the first communication terminal TC 1 . Furthermore, the precision of the date may be of different degrees, such as “Year, Month, Day, Hour” or might be “Year, Month, Day, Hour, Minute, Second”. 
     The first authentication key K 1  is thereby associated with a set of communications previously established between the terminals TC 1  and TC 2 , said set potentially being restricted to a single communication. 
     In step F 2 , the first communication terminal TC 1  transmits a message to the communication server SC, the message containing at least the identifiers IdT 1  and IdT 2  of the communication terminals TC 1  and TC 2  and the first authentication key K 1  in order to establish a communication with the second communication terminal TC 2 . 
     In step F 3 , the server retransmits the message containing the identifiers IdT 1  and IdT 2  and the key K 1  to the second communication terminal TC 2 . 
     In step F 4 , the application within the second communication server TC 2  determines time data DonT related to the same set of communications previously established between the communication terminals TC 1  and TC 2  in the second database BDH 2  and dynamically generates a second single-use authentication key K 2  as a function of the determined time data DonT. 
     In step F 5 , the application within the second communication server TC 2  compares the keys K 1  and K 2 , and the application authorizes the establishment of the communication between the communication terminals TC 1  and TC 2 , if the compared keys K 1  and K 2  are identical. 
     If the keys K 1  and K 2  are not identical, the application refuses to establish the communication between the communication terminals TC 1  and TC 2 . 
     Optionally, a system administrator defines an initial key for each user beforehand, which can be used for a first communication between two users. 
     Optionally, the messages that include keys are encrypted. 
     The invention described here relates to a method and a server for establishing a communication between a first communication terminal and a second communication terminal. According to one embodiment of the invention, the steps of the inventive method are determined by the instructions of a computer program incorporated into a server, such as the communication server SC. The program comprises program instructions, which when said program is loaded and executed within the server, carry out the steps of the inventive method. 
     Consequently, the invention also applies to a computer program, particularly a computer program on or within an information medium, suitable to implement the invention. This program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable for implementing the inventive method.