PROCEDE ET DISPOSITIFS D'AUTHENTIFICATION POUR ACCEDER A UN COMPTE UTILISATEUR D'UN SERVICE SUR UN RESEAU DE DONNEES

• US 20150143474A1
• Filed: 11/18/2014
• Published: 05/21/2015
• Est. Priority Date: 11/19/2013
• Status: Active Grant

• Current Assignee: IDEMIA France (Advent International Corporation)
• Original Assignee: Oberthur Technologies SA
• Inventors: VALLEE, Florian, GUERIN, Vincent
• Granted Patent: US 9,633,221 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/065 Continuous authentication

Abstract

An authentication method for accessing a user account of a service (28) on a data network (26), includes the following steps:

• • reception (E20) by the service (28) of a request from a consulting device (10) for the service (28), the request including a first authentication information element,
  • reception (E60) by the service (28) of an information element sent by an authentication security device manager (34), the information received by the service (28) being based on a second authentication information element originating from a security device (16; 18) associated with the user account, and
  • authentication by the service (28), based on the first authentication information element and the information received from the authentication security device manager (34).

Claims

1. An authentication method for accessing a user account of a service (28) on a data network (26), the method including the following steps:

reception (E20) by the service (28) of a request from a consulting device (10) for said service (28), said request including a first authentication information element,

reception (E60) by the service (28) of an information element sent by an authentication security device manager (34), the information element received by the service (28) being based on a second authentication information element originating from a security device (16;

18) associated with the user account, and

authentication by the service (28), based on the first authentication information element and the information received from the authentication security device manager (34).

2. The authentication method according to claim 1, characterized in that the second authentication information element is sent spontaneously by the security device (16;

18) to the manager (34) when the latter is connected.

3. The authentication method according to claim 1, characterized in that said information element received by the service (28) corresponds to the second authentication information element sent by the security device (16;

18).

4. The authentication method according to claim 1, characterized in that the manager (34) checks the second authentication information element received from the security device (16;

18) and in that the information sent to the service (28) by the manager (34) corresponds to the result of this check.

5. The authentication method according to claim 1, characterized in that the second authentication information element includes information localizing the security device (16;

18).

6. The authentication method according to claim 5, characterized in that the localization information includes the address of a gateway between a local network and the data network (26) hosting the service (28), said local network connecting the security device (16;

18) and the consulting device (10).

7. The authentication method according to claim 1, characterized in that the second authentication information element includes a single-use code based on a secret stored in the security device (16;

18).

8. The authentication method according to claim 1, characterized in that the security device (16;

18) is connected to the manager (34) by means of a persistent connection initiated by the security device (16;

18).

9. The authentication method according to claim 1, characterized in that the association of the security device (16;

18) and the user account includes the following steps;

input on the consulting device (10) of a code presented by the security device (16;

18),

transmission by the consulting device (10) of the entered code to the service (28), and

activation of the association by the service (28).

10. The authentication method according to claim 1, characterized in that the reception of the second authentication information element by the manager (34) requires the confirmation of a user of the consulting device (10).

13. A computer program including instructions for carrying out an authentication method according to claim 1, when it is loaded and executed by a microprocessor.

14. A microprocessor-readable information medium, including the instructions of a computer program to carry out a method according to claim 1.

15. The authentication method according to claim 2, characterized in that said information element received by the service (28) corresponds to the second authentication information element sent by the security device (16;

18).

16. The authentication method according to claim 2, characterized in that the manager (34) checks the second authentication information element received from the security device (16;

18) and in that the information sent to the service (28) by the manager (34) corresponds to the result of this check.

11. A device implementing a service (28) on a data network (26), including:

means for receiving a request from a consulting device (10) of said service (28), said request including a first authentication information element,

means for receiving information sent by an authentication security device manager (34), the information received by the service (28) being based on a second authentication information element originating from a security device (16;

18) associated with the user account, and

authentication means, based on the first authentication information element and the information received from the authentication security device manager (34).

12. An authentication security device manager (34) for accessing a user account of a service (28) on a data network (26), including:

means for receiving authentication information originating from a security device (16;

18), and

means for transmitting an information element to the service (28), based on the second authentication information element.