WO2005034009A2 - Method and system for securing user access to a communication network - Google Patents

Abstract

The invention relates to a security housing (6) which can be connected to a computer (4), a mobile telephone and, more generally, a device for the treatment and transmission of information, i.e. a self-supplied port (5), securing access of said device (4) to a network (3). The exchanged data (1) is intercepted and travels via the housing (6). The housing assumes all or part of the basic security functions, including authentication of the user, filtering and/or encryption/decryption of data and the storage of secret cryptographic keys (19,22). Interception occurs via a logic module (9) which is remotely loadable from the security housing (6). The data to be treated, the data already treated and data used to control the housing (6) is identified by tagging (11). The invention can also be used to encrypt/decrypt information to be sent to/obtained from a data storage medium.

Description

 METHOD AND SYSTEM FOR SECURING USER ACCESS TO A COMMUNICATION NETWORK

The growing use of large computer networks like the Internet requires a deep approach to security issues. The communications and personal data of a user must be protected against any entity which is not authorized to take cognizance of it. However, the user must have easy access to the information to which he is authorized to access. On the other hand, the user's hardware and software must be protected against any attempt at intrusion and against any type of computer attack. The user himself must be protected against transfers of unsolicited information, often offensive content (pornography, ...) and sometimes illegal (pedophilia,), that this information comes from WEB sites with names sometimes appearing harmless, or that they are transmitted by unsolicited mail (Spam). Controlling children's access to this offensive content (hereinafter called parental control) is increasingly essential. Access to networks is not only through a computer, but also, and increasingly, through a mobile phone that allows transmit data (transmission / reception of data, access to the Internet ...). The problem is no longer only to protect a computer, but also to protect a mobile phone and more generally what we will call hereinafter a device for processing and / or transmitting information, or more briefly a host device, or simply a device, when no ambiguity is to be feared. This expression will include computers and mobile phones, but its meaning will not be limited to these two types of equipment. In the following, when we talk about data transmission network or simply network, when no ambiguity is to be feared, this term will include computer and / or telephone networks, but will not be limited to these two types of networks . As a non-limiting example, it should be recalled that parental control functionalities are more and more necessary with the deployment of mobile telephones allowing access to the Internet and which may allow a young adolescent to access pornographic sites. Each particular aspect of security requires the implementation of a specific functionality (antivirus, parental control, firewall, encryption or authentication tools,). Many products, hardware or software, make it possible to carry out each of these functionalities. However, securing a network is a complex problem which is not always resolved in a way that is best suited to the needs and wishes of users, in particular when we are content to juxtapose software or hardware of various origins and sometimes incompatible with each other. Currently, network security is often provided centrally, and / or by purely software solutions. Purely software solutions are sometimes easily bypassed. Let us cite, for example, the case of control parental set up on a family computer, and disabled by the young adolescent who wants to access WEB sites not authorized by his parents. User authentication is typically done by a password. This protection is quite illusory insofar as it is possible to create software capable of spying on this password and communicating it to malicious entities. To reinforce security, we can require that the user authenticate himself by the possession of an object (smart card, ...) or by biometric characteristics (fingerprints, fundus, ...), which requires a specific device (smart card reader, fingerprint reader, ... connected to the workstation. We must also take into account the case of the mobile user who wants to access confidential information via a network, and which is likely to connect from various workstations or terminals, for example when it is visiting a site, or when it accesses the network by a public terminal (hotel, internet cafe, ...). One of the difficulties that this user will face is the installation of security products on the computer or more generally on the processing and transmission device that he uses. Besides the problems of compatibility between different software, there are the pr hardware connection problems for various peripherals (connection equipment, wired or wireless) and their power supply, and the user's workstation quickly finds itself surrounded by a quantity of connection and supply wires. As far as the mobile user likely to borrow a workstation is concerned, a complex installation is, of course, unthinkable. The invention which is the subject of this patent aims to provide personal security at the level of the user. end, including of the nomadic user, and this without complex hardware or software installation. The invention is made possible by developments in technology. On the one hand, new standards have gradually imposed themselves in order to allow easy connection of the most varied peripherals. A peripheral can be directly powered by the host device, and therefore does not require an external source of electrical power, nor a power cable. In the world of PCs equipped with Intel processors, the USB standard (Universal Serial Bus) is used, and the connection is made to a socket located on the host computer and called the USB port. The correspondent of this technology on Apple machines is FireWire® technology (IEEE 1394 standard). In the following, we will designate this type of socket under the general name of self-powered port. On the other hand, developments in technology have made it possible to miniaturize the components, and in particular to produce products grouping together in a single silicon component of reduced size all the functionalities necessary for securing network access. Examples are the Po erQuicc family processors manufactured by Motorola, or the IXP family processors manufactured by Intel or the xNSP processor by Everbee Networks. In addition, various devices and peripherals can communicate with each other by wireless communications (in particular by radio or by infrared communication). The present invention relates to a security box, connectable to a device for processing and / or transmitting information, in particular via a self-powered port or via a wireless connection. This safety box is small enough to fit in a pocket and can therefore be very easily carried by the user. It includes all the functionalities allowing a user, in particular a mobile user, to perform the basic functions of the security, such as user authentication, encryption and decryption of certain information flows, as well as functions for analyzing, filtering and blocking or modifying certain information flows. The user takes with him, in a small box, his personal security, which allows him to connect securely to a data transmission network from any processing and / or transmission device. information, this device can be connected to the network by a different channel than that by which the security box is connected. The security box can be configured by the user according to their security needs. We give here, by way of illustrative and nonlimiting example of the functionalities of the present invention, a certain number of functionalities which it makes it possible to provide. The configuration of the enclosure specifies which functionalities are effectively ensured, and specifies the manner in which these are implemented. The present invention makes it possible to ensure a conventional firewall functionality (in English Firewall) authorizing or prohibiting certain data transfers according to one or more rules defining a security policy. The present invention provides parental control functionality, allowing only communications with authorized sites to pass and blocking all data from prohibited sites or any request to prohibited sites. The present invention makes it possible to provide a functionality, known as Antispam, making it possible to block unwanted mail (such as advertising mail). The present invention makes it possible to set up and use secure communications tunnels (in English VPN, for Virtual Private Network) with one or more interlocutors, in particular through the implementation of protocols respecting IPSEC / IKE standards. The present invention makes it possible to provide antivirus functionality by blocking the transmission of the data exchanged when the presence of a virus has been detected in this data. The present invention makes it possible to provide content filtering functionality by performing an analysis of the data exchanged between the user and the network and blocking or not blocking the passage of this data according to the result of this analysis. The present invention makes it possible to encrypt and / or decrypt all or part of the data exchanged between the user and the network, in particular electronic mail. To ensure the security features that we have just described, the security box must control all communications between the network and the device for processing and / or transmitting information. To do this, it is therefore necessary that all these communications are intercepted and that they pass through the security box. This is done using interception software installed in the host device, this software redirecting all the exchanged data, both incoming and outgoing data, to pass them through the security box in order to '' possible processing before these data are transmitted to their final destination. Schematically, the processing carried out by the safety box includes a first analysis phase. In

| depending on the result of this analysis, the data can be blocked or transmitted, with or without modifications. In the example of a parental control application, an attempt to access a site will be blocked or transmitted depending on whether the site is considered to be authorized or prohibited. In the case of secure communication, all or part of the data will be encrypted or decrypted, therefore modified. In the case of an e-mail containing an attachment infected with a virus, the text of the e-mail itself will be transmitted without modification (unless it must be encrypted or decrypted) on the other hand the attached attachment will be blocked and replaced by a message informing the user that transmission has been blocked due to the detection of a virus. In addition to the data exchanged between the user and the communication network, it is also necessary to provide for internal data transfers between the host device and the communication box, if only to control the security box, and read, specify or modify some of its operating parameters. Various types of packets circulate in the system, inter alia relating to data sent by the user to the external network and vice versa, or containing control data to or from the security box. In order to simplify rerouting, these packages can be labeled. In the case where the data transfers are made according to the Ethernet protocol (according to the IEEE 802.3 standard), the data is presented in the form of packets, each of these packets comprising a header consisting of various fields therefore each has a well specified meaning . In particular two bytes called "Length / Type field" in the 802.3 standard can store, among other information, information making it possible to label these packets. In order for the security box, object of the present invention, to be able to fulfill its mission, the interception software must reside in the host device. This is apparently in contradiction with the concept of a security box transportable by a mobile user and allowing him to connect from any host device. A solution that can be implemented in the invention which is the subject of this patent is then the following. When the user plugs the security box into a device host, this security box is seen by the host device as a network card. In addition, the security box contains a server, which is seen by the host device like conventional WEB servers accessible via the Internet. The server located in the security box contains downloadable software and in particular the interception software. The interception software is then downloaded from this server, and installed on the host device. At the moment when the safety box is disconnected, several variants are possible. In one of them, the interception software is uninstalled, and a mobile user can thus leave the host device in the state in which it will have found it. In another variant, the software remains permanently resident and blocks communications when the box is disconnected. This variant is more particularly intended for domestic and family computers or mobile phones, in particular in the case where the security box provides a parental control functionality. Without this box, children do not have access to the network, and with the box, they only access authorized sites. In a third variant, the software remains permanently resident, but, when the security box is absent, the software lets all the data pass, transparently without intercepting or modifying them. If the nomadic user (the same or another) subsequently reuses the same host device, he will no longer have to download the interception software, which will resume the functions described above as soon as the presence of a security box is detected. In some applications, strong user authentication may be required. When this is the case, the invention which is the subject of this patent further comprises one or more means of strong authentication, in particular a keyboard for entering an authentication code, and / or a memory card reader, and / or a feature reader biometric, in particular a fingerprint reader or a fundus reader, intended to authenticate the user. In the case where the invention comprises a keyboard intended to enter an authentication code, this keyboard may comprise only a small number of keys and be integrated into the security box, in a similar manner to a mobile telephone keyboard. Note that the authentication codes usually used, and considered to provide sufficient security, in particular for bank cards or mobile phones, are 4-digit codes, offering 10,000 possibilities, on a 10-key keyboard. If we limit the number of keys on the keyboard to 6 keys (thus making it possible to miniaturize the invention), a 5-character code offers almost equivalent security (7776 possibilities), and a 6-character code offers much better security ( 46,656 possibilities). Similarly on a 4-key keyboard, a 7-character code (16,384 possibilities) offers better security than the current security of bank cards with 4-digit decimal code.

More specifically, the invention relates to a system intended to secure a data exchange via a device for processing and / or transmitting information, this device comprising a communication port. The system comprises a removable, ergonomically transportable security box connectable to the device for processing and / or transmitting information via this communication port. The security box comprises: processing means processing in particular the data exchanged with a view to carrying out the analysis thereof, and, depending on the result of this analysis, blocking or not their passage and / or modifying them or not, - Data transfer means between the device for processing and / or transmitting information and the security box. The information processing and / or transmission device further comprises a software module for intercepting the data exchanged, this software interception module transferring all of this data to the security box. The system comprises transmission means making it possible to transmit, after processing, this data from the security box to the device for processing and / or transmitting information with a view to use or transmission. It results from the combination of the technical features of the invention that all the data exchanged are thus transferred, in their entirety, to the security box for analysis, and, depending on the result of this analysis, are blocked or no and / or modified or not. In a particular embodiment of the invention, the device for processing and / or transmitting information is a computer. In a particular embodiment of the invention, the device for processing and / or transmitting information is a telephone system, fixed or mobile, making it possible to transmit data. Preferably according to the invention, the interception software module comprises detection means making it possible to detect whether the security box is connected to the communication port of the device for processing and / or transmitting information and the software module d interception prevents the exchange of data exchanged when the security box is not connected to the communication port. In another variant embodiment of the invention, the interception software module includes detection means making it possible to detect whether the security box is connected to the communication port of the device for processing and / or transmitting information and the interception software module lets the exchanged data circulate, without intercept or modify them, when the security box is not connected to the communication port. Preferably according to the invention, the communication port is a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard. In another alternative embodiment of the invention, the communication port is a communication port. wireless communication (usually called "Wireless"), in particular a "Wi-Fi®" port conforming to the IEEE 802.11 b standard or a "Bluetooth" port, so that communication between the security box and the processing device and / or transmission of information is done in "Wireless" mode. Preferably according to the invention, the safety box comprises a battery intended for its electrical supply. This battery can then be recharged using an external energy source, in particular an AC adapter, and / or by connecting the security box to a self-powered port, in particular a USB port or a FireWire® port conforming to IEEE 1394 standard, of a device for processing and / or transmitting information Preferably according to the invention, the device for processing and / or transmitting information comprises an operating system which recognizes the security like a network card. Preferably according to the invention, the security box comprises on-board storage means making it possible to store the interception software module. The system which is the subject of the present invention then comprises downloading means making it possible to download the interception software module from the security box and intended for the device for processing and / or transmitting information. Preferably according to the invention, the security box comprises at least one coprocessor for accelerating arithmetic calculations. Preferably according to the invention, the security box has control and / or filtering the data flow and / or has encryption / decryption and / or random number generation functionalities for cryptographic applications. Preferably according to the invention, the security box includes processing means making it possible to carry out at least one of the following functionalities: firewall (firewall), parental control, Antispam, setting up and / or use of communication tunnels secure (VPN), antivirus, content filtering, encryption and / or decryption of all or part of the data exchanged, especially when they are used to transmit electronic mail. Preferably according to the invention, the system comprises first labeling means making it possible to mark by a first labeling the data exchanged by distinguishing those which have been processed by the processing means of the security box from those which have not been processed by these processing means. Preferably according to the invention, the data exchange is done according to the Ethernet protocol and the first labeling is carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the standard IEEE 802.3. Preferably according to the invention, the security box comprises configuration parameters and the information processing and / or transmission device uses control data and exchanges them with the security box. The control data used in particular to read, specify or modify the configuration parameters of the safety box. The system then comprises second labeling means making it possible to mark, by a second labeling, the control data by distinguishing those which come from the security box from those which are transmitted to the security box. Preferably according to the invention, the exchange of control data is done according to the Ethernet protocol, the second labeling being carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the IEEE 802.3 standard Preferably according to the invention, the system is intended for use by a user and comprises furthermore a keyboard, in particular a keyboard having a small number of keys, thus allowing the user to authenticate himself by entering an authentication code on this keyboard. Preferably according to the invention, the system is intended for use by a user and further comprises a memory card reader device thus allowing the user to authenticate himself using a memory card. . Preferably according to the invention, the system is intended to be used by a user and further comprises a reader of biometric characteristics, in particular a reader of fingerprints or a fundus reader, intended for authenticating the user. Preferably according to the invention, the system comprises protocols implementing first cryptographic secret keys, in particular IPSEC / IKE protocols, making it possible to set up at least one secure communication tunnel

(VPN). Preferably according to the invention, the security box comprises a non-volatile memory in which these first cryptographic secret keys are stored. Preferably according to the invention, the system further comprises means intended to encrypt and / or decrypt, by means of second secret cryptographic keys, information stored on a computer storage means. Preferably according to the invention, the security box comprises a non-volatile memory in which these second secret cryptographic keys are stored. The invention also relates to a method having the object of securing a data exchange via a communication device. processing and / or transmission of information comprising a communication port and being connected via this communication port to a safety box, removable and ergonomically transportable. This process includes the following steps: - the step, for the device for processing and / or transmitting information, implementing an interception software module which intercepts all the data exchanged and transfers them to the security box, - the step, for the security box, to carry out a processing on this data, this processing consisting notably in carrying out the analysis of the data and, according to the result of this analysis, blocking or not their passage and / or to modify them or not, - the step, for the security unit to transfer, after processing, this data exchanged to the device for processing and / or transmitting information with a view to use or transmission . It results from the combination of the technical features of the invention that all the data exchanged are thus transferred, in their entirety, to the safety box for the purpose of undergoing this analysis, and, depending on the result of the analysis, they are blocked or not and / or modified or not. In a particular embodiment of the invention, the device for processing and / or transmitting information is a computer. In a particular embodiment of the invention, the device for processing and / or transmitting information is a telephone system, fixed or mobile, making it possible to transmit data. Preferably, according to the invention, the method further comprises the step, for the interception software module, of detecting whether the security box is connected to the communication port of the device for processing and / or transmitting the information and prevent data flow exchanged, when the security box is not connected to the communication port. In another alternative embodiment of the invention, the method further comprises the step, for the interception software module, of detecting whether the security box is connected to the communication port of the processing and / or transmission device information and allow the exchanged data to circulate, without intercepting or modifying it, when the security box is not connected to the communication port. Preferably, according to the invention, the method is such that the communication port is a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard. In another alternative embodiment of the invention, the method being such that the communication port is a wireless communication port (usually called "Wireless"), in particular a "Wi-Fi®" port conforming to the IEEE 802.11 b standard or a "Bluetooth" port. Communication between the security box and the information processing and / or transmission device then takes place in "Wireless" mode. Preferably, according to the invention, the security box comprises a battery intended for its electrical supply and the method further comprises the step of recharging this battery by connecting the security box to an external energy source, in particular an adapter. sector, or by connecting it to a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard, of a device for processing and / or transmitting information. Preferably, according to the invention, the device for processing and / or transmitting information comprises an operating system and the method which is the subject of the present invention comprises the prior step, for this operating system, of recognize the security box as a network card. Preferably, according to the invention, the method further comprises an initialization step consisting in storing the interception software module in the security box and the preliminary step, before implementation of this interception software module, download it to the information processing and / or transmission device from the security box. Preferably, according to the invention, the processing carried out by the security box on the data exchanged comprises at least one of the following steps: the step of filtering the data exchanged by implementing a Firewall (firewall), the step, when the device for processing and / or transmitting the information is connected to a communication network, to filter the data exchanged by prohibiting communications with one or more sites accessible via this communication network, '' step of filtering the data exchanged in order to block all or part of incoming e-mails, - the step of generating random numbers for cryptographic and / or data flow control applications, - the step of setting up and / or use secure communication tunnels (VPN), - the step of detecting whether the data exchanged contains a computer virus, - the step of analyzing the data changed and, depending on the result of this analysis, to prevent the passage of all or part of this data, - the step of encrypting and / or deciphering all or part of the data exchanged, in particular when they are used to transmit email. Preferably, according to the invention, the method further comprises the step of marking by a first labeling the data exchanged in order to distinguish those which underwent the treatment from those which did not undergo it. In a particular embodiment of the invention, the data is exchanged according to the Ethernet protocol, and the first labeling is carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field "in the IEEE 802.3 standard. Preferably, according to the invention, the security box comprises configuration parameters and the device for processing and / or transmitting the information comprises control data which it exchanges with the security box. This control data used in particular to read, specify or modify all or part of the configuration parameters of the security box. The method then further comprises the step of marking the control data by a second labeling, distinguishing those which come from the security box from those which are transmitted to the security box. In a particular embodiment of the invention, the data is exchanged according to the Ethernet protocol, and the second labeling is carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field "in the IEEE 802.3 standard. Preferably, according to the invention, the method is further intended to take into account a user and further comprises the prior step, for this user, to authenticate by entering an authentication code on a keyboard, in particular on a keyboard with a small number of keys. Preferably, according to the invention, the method is further intended to take into account a user and further comprises the prior step, for this user, to authenticate himself by presenting a memory card to a card reading device. with memory, in particular associated with the security box. Preferably, according to the invention, the method is further intended to take into account a user and further comprises the prior step, for this user, to authenticate using a reader of biometric characteristics associated with the security box, in particular a fingerprint reader or a background reader. Preferably, according to the invention, the method further comprises the step of setting up at least one secure communication tunnel (VPN) using protocols implementing first cryptographic secret keys, in particular the IPSEC / IKE. In a particular embodiment of the invention, the security box comprises a non-volatile memory and the method further comprises an initialization step consisting in storing the first cryptographic secret keys in this memory and a prior step consisting in reading these first cryptographic secret keys thus stored. In a particular embodiment of the invention, the method, object of the present invention, further comprises a step of encryption and / or decryption, by means of second secret cryptographic keys, of information stored on a storage means computer science ; In a particular embodiment of the invention, the security box comprises a non-volatile memory and the method further comprises an initialization step consisting in storing the second cryptographic secret keys in this memory and a preliminary step consisting in reading these second cryptographic secret keys thus stored. We will now describe alternative embodiments of the invention, by way of non-limiting example, with reference to the figures: - Figure 1 which represents a schematic view of the system according to the invention, - Figure 2 which illustrates the case where the security box also includes configuration parameters, - Figure 3 which illustrates the particular case where the security box comprises a coprocessor for acceleration of arithmetic calculations, - Figure 4 which illustrates the case where the security box comprises on-board storage means, - Figure 5 which illustrates the case where the security box further comprises means for encrypting and / or decrypting. FIG. 1 illustrates the system which is the subject of this patent. In the embodiment proposed below, data is exchanged between a user and a communication network. User 2 uses a computer 4, a device for processing and / or transmitting information, which is connected on the one hand to a computer communication network 3 and on the other hand, via a communication port 5 to a security box 6 comprising processing means 7 and data transfer means 8. An interception software module 9, located in the computer 4 transfers the data exchanged 1 between the user 2 and the computer communication network 3 and redirects them to the safety box 6 for processing. After processing, the data exchanged 1 is retransmitted from the security box 6 to the computer 4 for use by the user 2 or for transfer to the computer communication network 3. In this figure, the security box 6 further comprises a non-volatile memory 21 in which are stored the first cryptographic secret keys 19 and the second cryptographic secret keys 22 and a random access memory 24 for storing the encryption keys used to encrypt and decrypt communications between the user 2 and a correspondent 20 The data exchanged 1 is marked by a first labeling 11 Figure 2 illustrates the case where the safety box

6 further comprises configuration parameters 12 and the computer 4 comprises control data 13 and exchanges them with the security box 6. The control data 13 are marked by a second labeling 14. FIG. 3 illustrates the particular case where the security box 6 includes a coprocessor for accelerating arithmetic calculations 10, as well as a keyboard 15 having a small number of keys, allowing user 2 to authenticate by entering an authentication code on the keyboard 15 and a memory card reader 17 allowing user 2 to authenticate using a memory card. In this FIG. 3, the system further comprises a reader of biometric characteristics 18, in particular a fingerprint reader or a fundus reader, intended to authenticate the user 2. FIG. 4 illustrates the case where the box security 6 includes on-board storage means 25 for storing the interception software module 9 and the system comprises download means 27 for downloading this interception software module 9 from the security box 6 to the computer 4. FIG. 5 illustrates the case where the security box 6 further comprises means 26 intended to encrypt and / or decrypt, by means of the second cryptographic secret keys 22, information stored on a computer storage means 23. Let us give here, by way of illustration and without limitation of the possibilities of the present invention, an example of use of a particular case of embodiment of this i nvention. A user 2 uses a computer 4 which has been provisionally made available to him, this computer 4 being connected to a computer communication network 3. The user 2 wishes to connect to this computer communication network 3 in order to exchange, confidential, data 1, files and / or electronic mail, with at least one correspondent 20, this correspondent 20 being a server or another user connected on his side to the computer communication network 3. The user 2 carried in his pocket the security box 6 object of the present invention, which allows him to ensure his personal safety. In a preliminary step, the user 2 connects his security box 6 to the communication port 5 of the host computer 4. The security box 6 is then recognized by the computer 4 as a network card, giving access to a server. This server is, in fact, located in the security box 6. The user 2 connects via the computer 4 to this server and downloads from the security box 6 an interception software module 9 which is installed in the computer 4. The purpose of the interception software module 9 is to redirect all the data 1 exchanged between the computer 4 and the computer communication network 3, so that they pass through the security box 6, in which they will be processed. This processing consists in particular of filtering and / or encryption / decryption of the data 1 coming from or going to the communication network 3. The data going to the communication network 3 are intercepted by the interception software module 9 which sends to security box 6 for processing. After this processing, the security box 6 sends them back to the computer 4 which redirects them to the computer communication network 3. With regard to reception, things happen in a similar fashion. Data from the communication network

3, are intercepted by the interception software module 9 which sends them to the security box 6 for processing. After this processing, the security box 6 sends them back to the computer 4 which retransmits them to the user 2. In order to facilitate their routing, the exchanged data 1 are marked by a first labeling 11, in order, in particular, to distinguish those which are sent to the safety box 6 for processing and those which have already been processed by this box 6. Advantageously, the communications are made according to the Ethernet protocol. The data exchanged 1 is then encapsulated in data packets, comprising, in addition to the data themselves, a header containing information on this data, the first labeling being carried out on the two bytes of the Ethernet header called "Length / Type field "in the IEEE 802.3 standard. In a particular embodiment of the invention, communications between user 2 and a correspondent 20 are secured using the IPSEC / IKE protocol. This protocol sets up and uses a secure communication tunnel (in English VPN for Virtual Private Network) between the security box 6 and the correspondent 20. The implementation of the IPSEC / IKE protocol uses first cryptographic secret keys 19 which, in the case of one invention, had previously been stored in the non-volatile memory 21 of the security box 6. The establishment of the secure communication tunnel includes the definition of the encryption keys which will be used to encrypt and decrypt the communications between the two interlocutors, these encryption keys then advantageously being stored in a random access memory 24 located in the security box 6. Once this secure communication tunnel has been set up, the communications between the user 2 and his correspondent 20 are encrypted before being sent over the computer communication network 3 and decrypted on arrival. On the side of the user 2, this encryption and this decryption are provided by the security box 6, object of the present invention, and this in a completely transparent manner for the user 2. When user 2 wants to communicate securely with several correspondents, there will have to be set up as many different secure communication tunnels as there will be different correspondents. Generally, when the user 2 communicates with one or more correspondents and / or computer servers, all the data 1 exchanged passes through the security box 6. The latter then implements various security functionalities, including a possible encryption and decryption of the data exchanged 1, but also, in particular embodiments, if desired, virus detection and / or data filtering in order to eliminate unwanted data, in particular non-e-mail solicited or unsolicited advertising information. In an alternative embodiment, a data content control is performed within the security box, in particular for parental control purposes, to prevent a user from accessing data or information which is not desired. access. In a particular embodiment, the security box 6 is configurable and its operation depends on configuration parameters 12 stored in this security box 6. The user has the possibility of modifying the configuration of this security box 6 by exchanging with him control data 13 serving in particular to read, specify or modify all or part of the configuration parameters 12 of the security box 6. In order to locate the control data 13, these are marked by a second labeling 14, which makes it possible, in particular, to distinguish those which are sent to the security box 6 from those which come from this box 6. Advantageously, communications are carried out according to the Ethernet protocol. The control data 13 are then encapsulated in data packets, comprising, in addition to the data themselves, a header containing information on this data, the second labeling being carried out on the two bytes of the Ethernet header called "Length / Type field" in the IEEE 802.3 standard. In a particular embodiment, presented here as an illustration and not limiting of the possibilities of the present invention, it allows the user 2 to encrypt data intended to be stored on a computer storage means 23, in particular a medium magnetic or optical (CDRom, ...), or to decrypt data stored in encrypted mode on this computer storage means 23. This storage means can be integrated in the host device, or be located near the host device to which it is connected by wire or wireless mode. In another alternative embodiment, the storage means is accessible via a communication network. The operation of the invention is then very similar to that which has been described in the previous examples detailing the case of communications with a computer communication network, the computer storage means 23 playing here a role similar to that of the computer communication network examples detailed previously. The interception software module 9 intercepts the data exchanged between the user 2 and the computer storage means 23, to make them pass through the security box 6. The security box 6 then encrypts or decrypts the data by means of seconds secret cryptographic keys 22 previously stored in the non-volatile memory 21 of the security box 6. After encryption or decryption, the data are then retransmitted to the computer 4 which then redirects them to the computer storage means 23 or to the user 2 In a particular embodiment cited here as an illustration and not limiting of the possibilities of the invention, the safety box is equipped with an autonomous electric power supply by battery, these batteries being able to be recharged from an external source (network electric, cigarette lighter socket in a car ...), and / or by connection with a self-powered port of a host device. In this particular embodiment, the box has on the one hand a connection in wireless mode and on the other hand a possibility of connection to a self-powered port. In this particular embodiment, the same safety box, ergonomically transportable by the user, then has two operating modes. In one of these modes, it is connected by wireless communication to a host device such as a mobile telephone whose data exchanges it protects with the network, and it then operates on battery. In the other mode, it is connected by a self-powered port, in particular a USB port, to a host computer, and, while protecting data exchanges, it recharges its batteries via this self-powered port. In the event that the security box would not be able to connect to a USB port or would not connect long enough to this port to ensure sufficient charge of its batteries, this charge could then be carried out via the external power supply. The invention is not limited to the embodiments described and those skilled in the art will recognize the existence of various variant embodiments.

Claims

1. System intended to secure an exchange of data (1) via a device for processing and / or transmitting information (4); said information processing and / or transmission device (4) comprising a communication port (5); said system comprising a security box (6), removable, ergonomically transportable, connectable to said device for processing and / or transmitting information (4) via said communication port (5); said security unit (6) comprising: - processing means (7) processing in particular said data exchanged with a view to carrying out the analysis thereof, and, depending on the result of said analysis, blocking or not their passage and / or to modify them or not, - data transfer means (8) between said information processing and / or transmission device (4) and said security unit (6); said data processing and / or transmission device (4) further comprising a software interception module (9) of said exchanged data (1); said interception software module (9) transferring all said exchanged data (1) to said security box (6); said system comprising transmission means making it possible to transmit, after said processing, said exchanged data (1) from said security box (6) to said device for processing and / or transmitting information (4) with a view to use or transmission; so that all the exchanged data (1) are thus transferred, in their entirety, to said security box in order to undergo said analysis, and, depending on the result of said analysis, are blocked or not and / or modified or no. 2. System according to claim 1; said device for processing and / or transmitting information (4) being a computer. 3. System according to claim 1; said device for processing and / or transmitting information (4) being a telephone system, fixed or mobile, making it possible to transmit data. 4. System according to any one of the preceding claims; said interception software module (9) comprising detection means making it possible to detect whether said security box (6) is connected to said communication port (5) of said information processing and / or transmission device (4) and preventing the circulation of said exchanged data (1) when said security box (6) is not connected to said communication port (5). 5. System according to any one of claims 1 to 3; said interception software module (9) comprising detection means making it possible to detect whether said security box (6) is connected to said communication port (5) of said information processing and / or transmission device (4) ; said interception software module (9) allowing said exchanged data (1) to circulate, without intercepting or modifying said exchanged data (1), when said security box (6) is not connected to said communication port (5). 6. System according to any one of the preceding claims; said system being such that said communication port (5) is a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard. 7. System according to any one of the preceding claims; said system being such that said communication port (5) is a wireless communication port (usually called "Wireless"), in particular a "Wi-Fi®" port conforming to the IEEE 802.11 b standard or a "Bluetooth" port, so that the communication between said security box (6) and said device for processing and / or transmitting information (4) is in "Wireless" mode. 8. System according to any one of the preceding claims; said security box (6) comprising a battery intended for its electrical supply, said battery being able to be recharged by connecting said security box to an external power source, in particular an AC adapter, and / or by connecting said security to a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard, of a device for processing and / or transmitting information. 9. System according to any one of the preceding claims; said information processing and / or transmission device (4) comprising an operating system; said security box (6) being recognized by said operating system as a network card. 10. System according to any one of the preceding claims; said security box (6) comprising on-board storage means (25) making it possible to store said interception software module (9); said system comprising downloading means (27) making it possible to download said interception software module (9) from said security box (6) intended for said information processing and / or transmission device (4). 11. System according to any one of the preceding claims; said safety box (6) comprising at least one coprocessor for accelerating arithmetic calculations (10). 12. System according to any one of the preceding claims; said security box (6) having functionalities for controlling and / or filtering the data flow and / or having functionalities for encryption / decryption and / or generation of random numbers for cryptographic applications. 13. System according to any one of the preceding claims; said processing means (7) making it possible to perform at least one of the following functions: firewall (firewall), parental control, Antispam, establishment and / or use of secure communication tunnels (VPN), antivirus, content filtering, encryption and / or decryption of everything or part of said exchanged data (1) especially when said exchanged data (1) are used to transmit electronic mail. 14. System according to any one of the preceding claims; said system comprising first labeling means making it possible to mark by a first labeling (11) said exchanged data (1) by distinguishing said exchanged data having been processed by said processing means (7) from those not having been processed by said processing means (7). 15. The system of claim 14; the exchange of said exchanged data (1) taking place according to the Ethernet protocol, said first labeling (11) being carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the standard IEEE 802.3. 16. System according to any one of the preceding claims; said security box (6) comprising configuration parameters (12); said data processing and / or transmission device (4) using control data (13) and exchanging said control data (13) with said security box (6); said control data (13) being used in particular to read, specify or modify all or part of said configuration parameters (12) of said security box (6); said system comprising second labeling means making it possible to mark said control data (13) with a second labeling (14) by distinguishing those which come from said security box (6) from those which are transmitted to said security box (6) . 17. The system of claim 16; the exchange of said control data (13) taking place according to the protocol Ethernet, said second labeling (14) being carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the IEEE 802.3 standard. 18. System according to any one of the preceding claims; said system being intended to be used by a user (2); said system, in particular said security box (6), further comprising a keyboard (15), in particular a keyboard having a small number of keys, said system allowing said user (2) to authenticate by entering an authentication code (16) on said keyboard (15). 19. System according to any one of the preceding claims; said system being intended to be used by a user (2); said system, in particular said security box (6), further comprising a memory card reader device (17) allowing said user (2) to authenticate himself using a memory card. 20. System according to any one of the preceding claims; said system being intended to be used by a user (2); said system, in particular said security box (6), further comprising a reader of biometric characteristics (18), in particular a fingerprint reader or a fundus reader, intended for authenticating said user (2). 21. System according to any one of the preceding claims; said system comprising protocols implementing first cryptographic secret keys (19), in particular IPSEC / IKE protocols, making it possible to set up at least one secure communication tunnel (VPN). 22. The system of claim 21; said security box (6) comprising a non-volatile memory (21); said first cryptographic secret keys (19) being stored in said non-volatile memory (21). 23. System according to any one of the preceding claims; said system further comprising means intended to encrypt and / or decrypt (26), by means of second secret cryptographic keys (22), information stored on a computer storage means (23). 24. The system of claim 23; said security box (6) comprising a non-volatile memory (21); said second secret cryptographic keys (22) being stored in said non-volatile memory (21). 25. Method for securing an exchange of data (1) via a device for processing and / or transmitting information (4); said data processing and / or transmission device (4) comprising a communication port (5) and being connected via said communication port (5) to a safety box (6), removable and ergonomically transportable ; said method comprising the following steps: - the step, for said device for processing and / or transmitting information (4), of implementing an interception software module (9), said interception software module (9) intercepting all of said exchanged data (1) and transferring all of said exchanged data (1) to said security box (6), the step, for said security box (6), of performing a processing on said exchanged data (1); said processing consisting in particular of carrying out the analysis of said exchanged data (1), and, depending on the result of said analysis, blocking or not their passage and / or modifying them or not, - the step, for said security (6) to transfer, after said processing, said exchanged data (1) from said security box (6) to said device for processing and / or transmitting information (4) for use or transmission ; so that all the exchanged data (1) are thus transferred, in their entirety, to the said control unit. security in order to undergo said analysis there, and, depending on the result of said analysis, are blocked or not and / or modified or not. 26. The method of claim 25; said device for processing and / or transmitting information (4) being a computer. 27. The method of claim 25; said device for processing and / or transmitting information (4) being a telephone system, fixed or mobile, making it possible to transmit data. 28. Method according to any one of claims 25 to 27; said method further comprising the step, for said interception software module (9), of detecting whether said security box (6) is connected to said communication port (5) of said processing and / or transmission device of the information (4) and prevent the flow of said exchanged data (1), when said security box (6) is not thus connected to said communication port (5). 29. Method according to any one of claims 25 to 27; said method further comprising the step, for said interception software module (9), of detecting whether said security box (6) is connected to said communication port (5) of said processing and / or transmission device of the information (4) and allowing said exchanged data (1) to flow, without intercepting or modifying said exchanged data (1), when said security box (6) is not thus connected to said communication port (5). 30. Method according to any one of claims 25 to 29; said method being such that said communication port (5) is a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard. 31. Method according to any one of claims 25 to 30; said method being such that said communication port (5) is a wireless communication port (usually called "Wireless"), in particular a "Wi-Fi®" port conforming to the IEEE 802.11 b standard or a "Bluetooth" port, so that the communication between said security box (6) and said information processing and / or transmission device (4) takes place in "Wireless" mode. 32. Method according to any one of claims 25 to 31 / said security box (6) comprising a battery intended for its electrical supply, said method further comprising the step of recharging said battery by connecting said security box to a external energy source, in particular an AC adapter, or by connecting it to a self-powered port, in particular a USB port or a FireWire® port conforming to the IEEE 1394 standard, of a device for processing and / or transmitting information . 33. Method according to any one of claims 25 to 32; said information processing and / or transmission device (4) comprising an operating system; said method comprising the preliminary step, for said operating system, of recognizing said security box (6) as a network card. 34. Method according to any one of claims 25 to 33; said method further comprising an initialization step consisting in storing said interception software module (9) in said security box (6) and the preliminary step, before implementation of said interception software module (9), downloading said interception software module (9) into said information processing and / or transmission device (4) from said security box (6). 35. Method according to any one of claims 25 to 34; said processing carried out by said security box (6) on said exchanged data (1) comprising at least one of the following steps: - the step of filtering said exchanged data (1) by implementing a Firewall , - the step, when said device for processing and / or transmitting information (4) is connected to a communication network (3), to filter said exchanged data (1) by prohibiting communications with one or more sites accessible via said communication network, - the step of filtering said exchanged data (1) with a view to blocking all or part of the incoming electronic mails, - the step of generating random numbers for cryptographic and / or control applications data flow, - the step of setting up and / or using secure communication tunnels (VPN), - the step of detecting whether said exchanged data (1) contains a computer virus, - step d '' analyzing said exchanged data (1) and, depending on the result of this analysis, preventing the passage of all or part of the exchanged data (1) thus analyzed, - the step of encrypting and / or deciphering all or part desd ites exchanged data (1), in particular when said exchanged data (1) are used to transmit electronic mail. 36. Method according to any one of claims 25 to 35; said method further comprising the step of marking by a first labeling (11) said exchanged data (1) by distinguishing said exchanged data having undergone said processing from those which have not undergone said processing. 37. The method of claim 36; the exchange of said data (1) taking place according to the Ethernet protocol, said first labeling (11) being carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the IEEE standard 802.3. 38. Method according to any one of claims 25 to 37; said security box (6) comprising configuration parameters (12); said information processing and / or transmission device (4) comprising control data (13) and exchanging said control data (13) with said security box (6); said control data (13) being used in particular to read, specify or modify all or part of said configuration parameters (12) of said security box (6); said method further comprising the step of marking by a second labeling (14) said control data (13) by distinguishing those which come from said security box (6) from those which are transmitted to said security box (6). 39. The method of claim 38; the exchange of said control data (13) taking place according to the Ethernet protocol, said second labeling (14) being carried out by assigning values to all or part of the two bytes of the Ethernet header called "Length / Type field" in the IEEE 802.3 standard. 40. Method according to any one of claims 25 to 39; said method being further intended to take into account a user (2), said method further comprising the preliminary step, for said user (2), of authenticating by entering an authentication code (16) on a keyboard (15), in particular on a keyboard having a small number of keys. 41. Method according to any one of claims 25 to 40; said method being further intended to take into account a user (2), said method further comprising the preliminary step, for said user (2), of authenticating himself by presenting a memory card to a card reading device with memory (17), in particular associated with said security box (6). 42. Method according to any one of claims 25 to 41; said method being further intended to take into account a user (2), said method further comprising the preliminary step, for said user (2), of authenticating himself using a reader of biometric characteristics (18 ) associated with said security box (6), in particular a fingerprint reader or a fundus reader. 43. Method according to any one of claims 25 to 42; said method further comprising the step of setting up at least one secure communication tunnel (VPN) using protocols implementing first cryptographic secret keys (19), in particular IPSEC / IKE protocols. 44. The method of claim 43; said security box (6) comprising a non-volatile memory (21); said method further comprising an initialization step consisting in storing said first cryptographic secret keys (19) in said non-volatile memory (21) of said security box (6) and a preliminary step consisting in reading said first cryptographic secret keys (19 ) stored in said non-volatile memory (21). 45. Method according to any one of claims 25 to 44; said method further comprising a step of encryption and / or decryption, by means of second secret cryptographic keys (22), of information stored on a computer storage means (23). 46. The method of claim 45; said security box (6) comprising a non-volatile memory (21); said method further comprising an initialization step consisting in storing said second cryptographic secret keys (22) in said non-volatile memory (21) of said security box (6) and a preliminary step consisting in reading said second cryptographic secret keys (22 ) stored in said non-volatile memory (21).