# US 10,133,861 B2 · Method for controlling access to a production system of a computer system not connected to an information system of said computer system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,133,861 B2 - Document ID: US10133861B2 - Status: Granted - Kind: B2 - Application number: 15/119,038 - Filed: 2015-11-18 - Published: 2016-12-08 - Granted: 2018-11-20 - Earliest claimed: 2014-11-21 - Assignees: Evidian - Applicants: Evidian - Inventors: Christophe Guionneau; David Cossard; Gerard Dedieu - Web page: https://patentgrep.com/patent/US10133861B2 ## CPC - G06F 21/45: Structures or tools for the administration of authentication - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/77: Graphical identity - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method (M) for controlling access to a production system (SIP) of a computer system not connected to an information system (SIC), includes: A) an initial phase of enrolling a user via a terminal (1) in the production system (SIP), which includes: a) providing a private encrypted key (Cph) associated with each account of the user in the production system (SIP); b) the terminal transmitting the encrypted private key (Cph) to the information system and the system (SIC) registering the encrypted private key; B) for each request to access the production system, a phase of authentication by the production system, which includes: the terminal of the user recovering a challenge (QRCb) generated by the production system, that only the encrypted key stored in the information system makes it possible to solve, the key only being capable of being obtained after the terminal has been authenticated by the information system. ## Claims ### Claim 1 A method for controlling access to a production system of a computer system by a user identified with said production system, the production system not being connected to an information system of said computer system, the information system comprising an authentication system, the method comprising the following steps: A) an initial phase of enrolling a user in the production system by a terminal comprising: a) receiving, at the user terminal from the information system, an encrypted private key associated with each account of the user in the production system, and b) transmitting, by the terminal, the encrypted private key containing a private key and storing by the information system said encrypted private key; and B) then, for each request for access to the production system by the user, by a station linked to the production system, a phase for authentication by the production system comprising: recovering, by the terminal of the user, an image encryption code displayed on said station, the image encryption code comprising a piece of encrypted data associated with the account of the user, the piece of encrypted data configured to be decrypted by the associated private key and stored in encrypted form in the information computer system, linking the terminal to the information computer system and authenticating the user by said information computer system, transmitting, by said information computer system to the user terminal, the stored encrypted private key for the user account, and decrypting, by the terminal, the encrypted private key with a secret key to obtain the private key that decrypts the image encryption code recovered by the terminal and to obtain a password authorizing access to the user account of the production system. ### Claim 2 (depends on 1) The method for controlling access to the production system according to claim 1, wherein: the receiving at the user terminal of the encrypted private key associated with each account of the user in the production system comprises: authenticating the user by the production system, generating, by said production system, a first image encryption code containing a piece of encrypted data with a public key and a second image encryption code containing the private key, recovering said code by the terminal, decoding the encryption code to obtain the private key, and decrypting the piece of encrypted data with the private key. ### Claim 3 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the phase A) further comprises the steps of: encrypting, by the terminal, said private key by a secret key, and linking to the information system and authenticating by the information system from said terminal. ### Claim 4 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the secret encryption key is stored in the terminal and is obtained from a unique identifier of the terminal or during the phase A), generated randomly by the terminal, or generated by the terminal from a secret phrase communicated by the user. ### Claim 5 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the phase B) comprises the initial step of entering a piece of identification data of the user at the station connected to the production system. ### Claim 6 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the enrolling from the terminal of the user in the production computer system comprises an initial step of authenticating the user by an identifier stored in the production system. ### Claim 7 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the linking to the information system and the authenticating by the information system from said terminal comprises: during the enrollment step: storing identification of the user of the terminal by an identifier in the information system, and then, during the subsequent links: receiving, by the information system, verification of the identifier and the stored identifier for the user. ### Claim 8 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the linking to the information system by the terminal of the user and the authenticating by said information system are performed by a secure protocol used by an application stored on the terminal. ### Claim 9 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the terminal is equipped with an image-capturing optical system and/or a link for wireless short-range and high-frequency communication. ### Claim 10 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the encrypted private keys associated with each account of the user in the production system are image encryption codes composed of: a QR code, a datamatrix, and a bar code. ### Claim 11 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the linking of the user to the station comprises: providing a link via said station to the production system or to a WEB application or to a WEB portal of the production system, receiving an entry by the user of the identifier in the station, and generating and displaying the encryption code on a screen of said station or in an authentication banner of the WEB application or the application portal. ### Claim 12 (depends on 1) The method for controlling access to the production system according to claim 1, wherein the linking to the information system comprises providing a link of the WEB Service or REST type on an HTTPS protocol. ### Claim 13 (depends on 8) The method for controlling access to the production system according to claim 8, wherein said link is made secure by a certificate from an authentication server of the information system, the terminal of the user having said certificate or having a certificate from the certification authority of the certificate. ### Claim 14 A terminal of a user used for implementing a method for controlling access to a production system of a computer system by a user identified with said production system, said user terminal comprising: at least one processor configured to enroll the user in the production system by: receiving an encrypted private key associated with each account of the user in the production system, and transmitting the encrypted private key containing a private key for storing by the information system of said encrypted private key, then, during a phase for authentication by the production system, for each request for access to the production system by the user by a station connected to the production system, recovering an image encryption code displayed on said station, the image encryption code comprising a piece of encrypted data associated with the account of the user, the piece of encrypted data configured to be decrypted by the associated private key and stored in encrypted form in the information system, linking to the information computer system for authentication of the user by said information system, receiving the stored encrypted private key for the user account, transmitted by said information system, and decrypting the encrypted private key with a secret key to obtain the private key that decrypts the recovered image encryption code and to obtain a password authorizing access to the user account of the production system. ### Claim 15 (depends on 14) The terminal according to claim 14, wherein an application is provided at the terminal and controlled by the at least one processor, using a mode for authentication with the information system via a secure link, identifications of the users and an authentication mode being stored in the information system. ### Claim 16 (depends on 15) The terminal according to claim 15, wherein the application is configured to decrypt the encrypted private key furnished by the information system, when the encrypted private key corresponds to the key encrypted with the secret key associated with the user account that it possesses. ### Claim 17 A system for controlling access to the production system that is not connected to the information system of a computer system, the system comprising: a terminal of a user used for implementing a method for controlling access to a production system of a computer system by a user identified with the production system, the terminal comprising: at least one processor configured to enroll the user in the production system by: receiving an encrypted private key associated with each account of the user in the production system, and transmitting the encrypted private key containing a private key for storing by the information system of said encrypted private key, then, during a phase for authentication by the production system, for each request for access to the production system by the user by a station connected to the production system, recovering an image encryption code displayed on said station, the image encryption code comprising a piece of encrypted data associated with the account of the user, the piece of encrypted data configured to be decrypted by the associated private key and stored in encrypted form in the information system, linking to the information computer system for authentication of the user by said information system, receiving the stored encrypted private key for the user account, transmitted by said information system, and decrypting the encrypted private key with a secret key to obtain the private key that decrypts the recovered image encryption code and to obtain a password authorizing access to the user account of the production system, wherein the production system has, in a memory, identifiers of the user accounts, and the public keys and the private keys associated with each user, the production system being configured to encrypt one of the private keys the associated public key and to generate an image encryption code comprising said private key, and wherein the information system has a server that has an authentication base or is connected to an authentication server. ### Claim 18 (depends on 14) The terminal according to claim 14, wherein the application is configured to decrypt the encrypted private key furnished by the information system, when the encrypted private key corresponds to the key encrypted with the secret key associated with the user account that it possesses. ### Claim 19 (depends on 9) The method for controlling access to the production system according to claim 9, wherein when the terminal is equipped with a link for wireless short-range and high-frequency communication, the short-range wireless communication is achieved by Bluetooth or Near Field Communication (NFC) (Near Field Communication). ### Claim 20 (depends on 19) The method for controlling access to the production system according to claim 19, wherein the short-range wireless communication is achieved by Bluetooth or Near Field Communication (NFC) (Near Field Communication) using a mobile telephone or a portable tablet.