A process to restrict, to a benefit of authorized users, access to at least one resource belonging to at least one interactive service of at least one cluster of services, each said authorized user having a client machine capable of executing a client program adapted to exchange, using a transmission network, data with a server program associated to each said interactive service, each said interactive service being identified by a service identifier and said interactive service being provided by requests sent by said client program to said server program which processes each of said reguests and returns to said client program a response for each said requests, characterized in that the process includes the following steps:
- (a) for each said cluster, putting at a disposal of each of said authorized users, a processing and memorizing unit designed to be linked up to said client machine of said authorized user when requesting to access at least one said restricted access resource, said processing and memorizing unit including:
- (1) a cluster identifier determining the cluster to which said processing and memorizing unit belongs,
- (2) a processing and memorizing unit identifier characterizing said processing and memorizing unit put at a disposal of said authorized user, and
- (3) a decryption key allowing to decrypt the information coming from any of said services of said determined cluster,
- (b) enabling each said client program, to read inside said processing and memorizing unit which is linked up to it:
- (1) said cluster identifier,
- (2) and said processing and memorizing unit identifier,
- (c) sending inside a first response, by said server program for said service, at least once to any said client program which has submitted a first request for said service, a list of clusters identifiers determining to which cluster(s) the service to which said first request was submitted belongs,
- (d) memorizing by each said client program which receives said list of clusters identifiers in response to said first request for said service having a service identifier, a relation between each said cluster identifier and said service identifier,
- (e) determining, prior to the sending of a second request to said service having said service identifier, if said client program has memorized at least one relation between any cluster identifier and said service identifier and in the case where:
- (1) any cluster identifier is found, comparing it with said cluster identifier coming from said processing and memorizing unit and if they are equal, adding to said second request to be sent by said client program, said processing and memorizing unit identifier,
- (f) when said server program receives said second request for said service, containing said processing and memorizing unit identifier and which requests to access said restricted access resource, determining by using at least said service identifier and said processing and memorizing unit identifier, if said user who owns said processing and memorizing unit is entitled to access said resource, and if said user:
- (1) is not entitled to access said resource, returning to said client program by said server program, a second response corresponding to a refused access,
- (2) is entitled to access said resource:
- (i) determining using at least said processing and memorizing unit identifier, an encryption key corresponding to said decryption key contained in said processing and memorizing unit linked up to said client machine of said user who has sent said second request,
- (ii) encrypting by said server program, at least in part, a second response to said second request of access to said restricted access resource using said encryption key, so as to obtain an encrypted second response,
- (iii) and returning to said client program by said server program, said encrypted second response,
- (g) and when said client program receives said encrypted second response:
- (1) decrypting said encrypted second response received by said client program using said decryption key contained in said processing and memorizing unit linked up to it,
- (2) and presenting said user with the response to his request, as if said second response had reached him non encrypted.