Method for authenticating a user by user identifier and associated graphical password

Method for authenticating a user (17) by user identifier and associated graphical password (6), where the graphical password (6) comprises a first part obtained by a first selection of a group of images (1-5) from several groups of images (1-5), and a second part obtained by a second selection of a sequence of several images (A-Y) in the selected group of images (1-5), the method comprising:

• requesting the user (17) give a user identifier to an application (12), and graphically select:
• a first selection of a group of images (1-5) in a set of several groups of images (1-5), the order of the groups of images (1-5) in this set of groups of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17),
• a second selection of a sequence of several images (A-Y) in this group of images (1-5), the order of the images (A-Y) in this group of images (1-5) being randomly displayed by the application (12) with each new authentication of said user (17),
• identifying the position of the selected group of images (1-5) in said set of groups of images (1-5) and identifying the position of each selected image (A-Y) in said sequence,
• establishing (14) the correspondence between the position of the selected group of images (1-5) and the identifier of the selected group of images (1-5), and between the sequence of the positions of the selected images (A-Y) and the sequence of the identifiers of the selected images (A-Y),
• comparing (15-16) the identifier of the group of selected images (1-5) with the identifier of the group of images (1-5) of the password (6) registered for said user (17) identifier, and comparing the sequence of the identifiers of the selected images (A-Y) with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, the application (12) being the only entity able to establish this correspondence and/or the application (12) being the only entity able to make this comparison;
• and
• authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative, further comprising:
• sending the number of the selected group (1-5) and/or the coordinates of each selected image (A-Y) in said sequence to an authentication function (8) which establishes the correspondence between said number and the identifier of the selected group (1-5) and/or between the sequence of said coordinates and the sequence of the identifiers of the selected images (A-Y), the authentication function (8) being the only entity able to establish this correspondence,
• comparing (15-16), in a database, the identifier of the selected group (1-5) and the sequence of the identifiers of the selected images (A-Y) respectively with the identifier of the group (1-5) of the password (6) registered for said user (17) identifier and with the sequence of the identifiers of the images (A-Y) of the password (6) registered for said user (17) identifier, a database (9) being the only entity able to make this comparison;
• and
• authenticating (15) said user (17) if said comparison is positive but refusing (16) to authenticate said user (17) if said comparison is negative,
• wherein said graphical interface (7), said authentication function (8), and said database (9) are under the control of at least two independent actors.