METHOD FOR AUTHENTICATING A USER AND CORRESPONDING USER DEVICE, SERVER AND SYSTEM

• US 20190028891A1
• Filed: 07/21/2017
• Published: 01/24/2019
• Est. Priority Date: 07/21/2017
• Status: Active Grant

• Current Assignee: Thales DIS France SAS (Thales SA)
• Original Assignee: Gemalto, Inc. (Thales SA)
• Inventors: SUWIRYA, Darmawan, ALI, Asad Mahboob
• Granted Patent: US 11,184,765 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Abstract

A method for authenticating a user includes connecting to a server from a user device, loading from the server to the user device data including executable data, detecting by the user device, while executing the executable data, whether an identifier relating to a short range communication device exists in a vicinity of the user device, sending from the user device to the server a user identifier accompanied with the detected short range communication device identifier, verifying by the server for the identified user whether a detected short range communication device identifier matches a predetermined part of a reference short range communication device identifier. Access is granted from the server only if the detected short range communication device identifier matches the predetermined part of the reference short range communication device identifier.

Claims

1. A method for authenticating a user,

wherein, a server registering at least one user identifier associated with at least one identifier relating to at least one reference short range communication device to be detected in a vicinity of at least one user device, the method comprises the following steps:

connecting to the server from a user device;

loading from the server to the user device data including executable data;

detecting by the user device, while executing the executable data, whether at least one identifier relating to at least one short range communication device does or does not exist in a vicinity of the user device;

sending from the user device to the server at least one user identifier accompanied with the at least one detected short range communication device identifier only if the at least one identifier relating to at least one detected short range communication device exists in the vicinity of the user device;

verifying by the server for the identified user whether the at least one detected short range communication device identifier or no detected short range communication device identifier does or does not match at least a predetermined part of the at least one reference short range communication device identifier; and

granting access from the server only if the at least one detected short range communication device identifier matches the at least predetermined part of the at least one reference short range communication device identifier;

or

denying access while requesting user authentication data by sending from the server to the user device a corresponding message only if the at least one detected short range communication device identifier or no detected short range communication device identifier does not match the at least predetermined part of the at least one reference short range communication device identifier.

2. The method according to claim 1, wherein, prior to detecting by the user device whether at least one identifier relating to at least one short range communication device does or does not exist, the at least one short range communication device is paired with the user device.

3. The method according to claim 1, wherein, prior to sending to the server from the user device at least one user identifier accompanied with the at least one detected short range communication device identifier, the user device involves the user to select the at least one detected short range communication device identifier.

4. The method according to claim 1, wherein the server creates or updates, based on at least one previous successful authentication, in association with at least one registered user identifier, a set of at least one identifier relating to at least one short range communication device, as the at least one identifier relating to at least one reference short range communication device to be detected in the vicinity of the user device.

5. The method according to claim 1, wherein, when the user is authenticated without having submitted user authentication data, the user device continues to detect, while executing the executable data, whether the at least one detected short range communication device identifier does or does not still exist in the vicinity of the user device;

and

still granting access from the server only if the at least one detected short range communication device identifier still matches the at least predetermined part of the at least one reference short range communication device identifier;

or

denying access only if the at least one detected short range communication device identifier does no longer match the at least predetermined part of the at least one reference short range communication device identifier.

6. The method according to claim 1, wherein the user device supports a Web type application or a Web type browser which executes the executable data.

7. The method according to claim 1, wherein an administrator of the server defines, as a security rule, a required number of the at least one reference short range communication devices to be detected in the vicinity of the user device while possibly letting the user to select actually the at least one reference short range communication device to be detected in the vicinity of the user device.

8. A user device for authenticating a user,

wherein the user device is configured to:

connect to a server;

load data including executable data;

detect, while executing the executable data, whether at least one identifier relating to at least one short range communication device does or does not exist in a vicinity of the user device; and

send to the server at least one user identifier accompanied with the at least one detected short range communication device identifier only if the at least one identifier relating to at least one detected short range communication device exists in the vicinity of the user device.

9. A server for authenticating a user,

wherein, the server registering at least one user identifier associated with at least one identifier relating to at least one reference short range communication device to be detected in a vicinity of at least one user device, the server is configured to:

be connected from a user device;

load into the user device data including executable data;

receive from the user device at least one user identifier accompanied with the at least one detected short range communication device identifier only if the at least one identifier relating to at least one detected short range communication device exists in a vicinity of the user device;

verify for the identified user whether the at least one detected short range communication device identifier or no detected short range communication device identifier does or does not match at least a predetermined part of the at least one reference short range communication device identifier; and

grant access only if the at least one detected short range communication device identifier matches the at least predetermined part of the at least one reference short range communication device identifier;

or

deny access while requesting user authentication data by sending from the server to the user device a corresponding message only if the at least one detected short range communication device identifier or no detected short range communication device identifier does not match the at least predetermined part of the at least one reference short range communication device identifier.

10. A system for authenticating a user,

wherein, the system including a server and at least one user device, the server registering at least one user identifier associated with at least one identifier relating to at least one reference short range communication device to be detected in a vicinity of at least one user device, a user device is configured to connect to the server;

the server is configured to load into the user device data including executable data;

the user device is configured to;

detect, while executing the executable data, whether at least one identifier relating to at least one short range communication device does or does not exist in a vicinity of the user device;

send to the server at least one user identifier accompanied with the at least one detected short range communication device identifier only if the at least one identifier relating to at least one detected short range communication device exists in the vicinity of the user device;

the server is configured to;

verify for the identified user whether the at least one detected short range communication device identifier or no detected short range communication device identifier does or does not match at least a predetermined part of the at least one reference short range communication device identifier; and

grant access only if the at least one detected short range communication device identifier matches the at least predetermined part of the at least one reference short range communication device identifier;

or

deny access while requesting user authentication data by sending from the server to the user device a corresponding message only if the at least one detected short range communication device identifier or no detected short range communication device identifier does not match the at least predetermined part of the at least one reference short range communication device identifier.