Method for authenticating a user, corresponding server, communications terminal and programs

• US 10,693,854 B2
• Filed: 12/14/2015
• Issued: 06/23/2020
• Est. Priority Date: 12/12/2014
• Status: Active Grant

• Current Assignee: Banks And Acquirers International Holding
• Original Assignee: Ingenico Group
• Inventors: Naccache, David
• Primary Examiner(s): Nguyen, Trong H
• Assistant Examiner(s): Lin, Amie C.
• Application Number:
  US14/968,231
• Publication Number:
  US 20160173473A1
• Time in Patent Office: 1,653 Days
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method is provided for authenticating a user'"'"'s communications terminal with an authentication server connected to a gateway terminal by using a communications network. The method includes: obtaining a piece of data representing an identity of the user from the gateway terminal; configuring, by the authentication server, a data transmission link between the authentication server and the terminal, using a predefined data transmission interface of the gateway terminal and as a function of the piece of data representing the identity of the user; transmitting, by the authentication server, to the terminal, a piece of encrypted data for checking authentication, using the data transmission link; receiving, by the authentication user, coming from the terminal, a piece of encrypted data for counter-checking authentication; issuing an assertion of authentication of the user when the piece of data for the counter-checking of authentication corresponds to the piece of data for checking authentication.

Claims

1. A method comprising:

authenticating a communications terminal belonging to a user with an authentication server connected to a gateway terminal by using a communications network, wherein the method comprises the following acts performed by the authentication server;

obtaining a piece of data representing an identity of the user from said gateway terminal;

carrying out a checking operation, directly or through a gateway application installed on said gateway terminal, to determine whether or not said gateway terminal comprises a Bluetooth physical interface;

and in response to determining that said gateway terminal comprises a Bluetooth physical interface;

configuring, by said authentication server, a data transmission link between said authentication server and said user'"'"'s communications terminal, by using said Bluetooth physical interface of said gateway terminal and as a function of said piece of data representing an identity of the user, said data transmission link being a virtual Bluetooth link set up by transmitting a Bluetooth pairing code of the authentication server to the user'"'"'s communications terminal, enabling pairing the user'"'"'s communications terminal directly with the authentication server;

transmitting, by the authentication server, to the user'"'"'s communications terminal, a piece of encrypted data for checking authentication, by using the data transmission link;

receiving, by the authentication server, coming from the user'"'"'s communications terminal, a piece of encrypted data for counter-checking of authentication; and

issuing an assertion of authentication of the user in response to the piece of encrypted data for counter-checking of authentication corresponding to said piece of encrypted data for checking authentication.

2. The method according to claim 1, wherein, prior to the act of obtaining a piece of data representing an identity of the user, said method comprises:

receiving a request for connection from said gateway terminal or from a server connected to said authentication server; and

transmitting, to said gateway terminal, a request for identification as a function of said request for connection.

3. The method according to claim 1, wherein the act of configuration by said authentication server of a data transmission link between said authentication server and said user'"'"'s communications terminal comprises:

obtaining at least one piece of data representing at least one parameter of connection to the communications terminal by using said piece of data representing said identity of the user;

transmitting said at least one piece of data representing a parameter of connection to said gateway terminal.

4. The method according to claim 3, wherein said at least one parameter of connection comprises at least one piece of data necessary for building the link between the communications terminal of the user and the gateway terminal.

5. The method according to claim 3, wherein said at least one parameter of connection comprises at least one piece of data belonging to a group consisting of:

a physical address of the user'"'"'s communications terminal ;

a pairing code type piece of data;

a password type piece of data.

6. A server for authenticating a communications terminal belonging to a user with an authentication server connected to a gateway terminal by using a communications network wherein the server comprises:

a data processor; and

a non-transitory computer-readable medium comprising instructions stored thereon, which when executed by the processor configure the server to;

obtain a piece of data, from said gateway terminal, representing an identity of the user;

carrying out a checking operation, directly or through a gateway application installed on said gateway terminal, to determine whether or not said gateway terminal comprises a Bluetooth physical interface;

and in response to determining that said gateway terminal comprises a Bluetooth physical interface;

configure a data transmission link between said authentication server and said user'"'"'s communications terminal, by using said Bluetooth physical interface of said gateway terminal and as a function of said piece of data representing an identity of the user, said data transmission link being a virtual Bluetooth link set up by transmitting a Bluetooth pairing code of the authentication server to the user'"'"'s communications terminal, enabling pairing the user'"'"'s communications terminal directly with the authentication server;

transmit, to the user'"'"'s communications terminal, a piece of encrypted data for checking authentication by using the data transmission link;

receive a piece of encrypted data for counter-checking of authentication from the user'"'"'s communications terminal; and

issue an assertion of authentication of the user in response to the piece of encrypted data for counter-checking of authentication corresponding to said piece of encrypted data for checking authentication.

7. A non-transitory computer-readable medium comprising program code instructions stored thereon to execute an operation for authenticating when the instructions are executed by a processor of an authentication server, wherein the operation comprises:

authenticating a communications terminal belonging to a user with the authentication server connected to a gateway terminal by using a communications network, wherein the authenticating the communications terminal comprises the following acts performed by the authentication server;

obtaining a piece of data representing an identity of the user from said gateway terminal;

carrying out a checking operation, directly or through a gateway application installed on said gateway terminal, to determine whether or not said gateway terminal comprises a Bluetooth physical interface;

and in response to determining that said gateway terminal comprises a Bluetooth physical interface;

configuring, by said authentication server, a data transmission link between said authentication server and said user'"'"'s communications terminal, by using said Bluetooth physical interface of said gateway terminal and as a function of said piece of data representing an identity of the user, said data transmission link being a virtual Bluetooth link set up by transmitting a Bluetooth pairing code of the authentication server to the user'"'"'s communications terminal, enabling pairing the user'"'"'s communications terminal directly with the authentication server;

transmitting, by the authentication server, to the user'"'"'s communications terminal, a piece of encrypted data for checking authentication, by using the data transmission link;

receiving, by the authentication server, coming from the user'"'"'s communications terminal, a piece of encrypted data for counter-checking of authentication; and

issuing an assertion of authentication of the user in response to the piece of encrypted data for counter-checking of authentication corresponding to said piece of encrypted data for checking authentication.