Secure authentication of a user of a device during a session with a connected server

A computer-implemented method for secure authentication of a user to a service for executing a transaction, the method being implemented in a system including:

• a user device operated by the user, the user device including a FIDO (Fast IDentity Online)-client using a FIDO interface for encrypted communication of FIDO UAF (Universal Authentical Framework) messages, and a user-agent;
• a FIDO-server of a relying party providing the service;
• a behaviometric server in communication with the user-agent of the user device and with the FIDO-server using a FIDO-identifier;
• and
• a web server associated with the relying party, the web server being in communication with the FIDO server, the FIDO client, and the behaviometric server,
• the method comprising:
• a. in a preparation stage
• i. upon user initiation of a session by establishing a TLS-connection between the user device and the web-server, generating a unique session ID;
• ii. using a background process running during said session and using said session ID, collecting behavioral input data from at least one user input component of the user device, and storing said behavioral input data in a non-transitory storage medium housed within the user device;
• iii. transmitting, from the user agent to the behaviometric server, via said TLS-connection and the web server, a transaction initiation message including the FIDO-identifier and at least a portion of said behavioral input data stored in said non-transitory storage medium;
• and
• b. in an authentication stage:
• i. at the behaviometric server comparing said received FIDO-identifier and said received portion of said behavioral input data to a second FIDO-identifier and a second set of behavioral input data collected during prior us of the service by the user;
• ii. at the behaviometric server, determining whether said received FIDO identifier matches said second FIDO identifier and whether said portion of said behavioral input data matches said second set of behavioral input data, whereby a match results in an authentication, and a lack of a match results in a rejection of privileged access sought by the user;
• iii. if said determining results in said match:
• 1. transmitting said transaction initiation message from the behaviometric server to the FIDO-server;
• 2. at the FIDO-server, generating an authentication request including the FIDO-identifier, a transaction message, and a related hash of said transaction message, and transmitting said authentication request to the FIDO-client;
• 3. at the FIDO client, prompting the user to sign the hash of said transaction message using a private key of an asymmetric key-pair associated with the user;
• 4. at the FIDO client, in response to the user providing said signed hash of said transaction message, generating an authentication response including said signed hash;
• 5. transmitting said authentication response from the FIDO client to the FIDO server;
• 6. at the FIDO server, validating said signed hash of said transaction message included in said authentication response using a public key of said asymmetric key pair associated with the user;
• and
• 7. upon validation of said signed hash of said transaction message, executing the transaction of the service.