Method for opening a secure session on a computer terminal
AssigneeEvidian
InventorsGérard DEDIEU, David COSSARD, Boksic RODRIGO
Life of this patent
Estimating the term…
Abstract
A method for initiating a secure session using a smartphone as a physical token to provide strong authentication. The phone is used through a public and independent real-time notification service. The notifications are exchanged in an encrypted manner so that their content is only accessible to the mobile phone and the authentication server.
Claims9
A method for initiating a secure session on a computer terminal (101) connected to an authentication server (401), characterized in that the initiating of the session is carried out by implementing at least one of the following steps:
- Transmission (2000), by the authentication server, of a downward notification to a mobile terminal, through a real-time notification server (601), the downward notification comprising a set of authentication data including at least one session key, the authentication data being encrypted using asymmetric encryption, a public key being known to the authentication server, a private key being known only to the mobile terminal, the private key being associated with the public key;
- Transmission (2020), by the mobile terminal, of an upward notification to the authentication server, through the real-time notification server, the upward notification comprising a sub-set of the authentication data, at least this sub-set of the authentication data being encrypted using symmetric encryption using at least the session key as the key;
- Verification (2030), by the authentication server, of the conformity of the authentication data included in the upward notification compared to the transmitted authentication data included in the downward notification;
- Authorization (2040) of the initiating of the session in the event of successful verification.
The method for initiating a secure session according to one of the preceding claims, characterized in that the real-time notification server is public.
The method for initiating a secure session according to any of the preceding claims, characterized in that the authentication data comprise a user identifier and a one-time password.
The method for initiating a secure session according to any of the preceding claims, characterized in that the public key and the private key are produced by the mobile terminal during an enrollment phase of the mobile device on the authentication server.
The method for initiating a secure session according to the preceding claim, characterized in that the enrollment phase is carried out by implementing at least one of the following steps:
- Acquisition (4000), by the mobile terminal, of:
- An enrollment key;
- An authentication server identifier;
- A user identifier, and;
- Configuration data for communication with the real-time notification server;
- Transmission (4010), by an enrollment tool, of a message to the authentication server, this message comprising:
- The user identifier;
- The enrollment key;
- Production (4030), by the mobile terminal, of the public key and the private key;
- Transmission, by the mobile terminal, of an upward notification to the authentication server, the upward notification comprising at least:
- The user identifier and the public key encrypted using the enrollment key, as well as;
- The user identifier;
- The authentication server identifier.
- Enrollment by the authentication server.
Dependencies are inferred from the claim text.