# US 2020/0220867 A1 · Method for opening a secure session on a computer terminal

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0220867 A1
- Document ID: US20200220867A1
- Status: Published application
- Kind: A1
- Application number: 16/712,064
- Filed: 2019-12-12
- Published: 2020-07-09
- Earliest claimed: 2018-12-12
- Assignees: Evidian
- Applicants: Evidian
- Inventors: Gérard DEDIEU; David COSSARD; Boksic RODRIGO
- Web page: https://patentgrep.com/patent/US20200220867A1

## CPC

- G06F 21/31: User authentication
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 9/3271: {using challenge-response}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/102: {Entity profiles}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/069: using certificates or pre-shared keys
- H04L 2463/062: applying encryption of the keys
- H04L 2463/081: applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method for initiating a secure session using a smartphone as a physical token to provide strong authentication. The phone is used through a public and independent real-time notification service. The notifications are exchanged in an encrypted manner so that their content is only accessible to the mobile phone and the authentication server.

## Claims

### Claim 1

A method for initiating a secure session on a computer terminal (101) connected to an authentication server (401), characterized in that the initiating of the session is carried out by implementing at least one of the following steps:
Transmission (2000), by the authentication server, of a downward notification to a mobile terminal, through a real-time notification server (601), the downward notification comprising a set of authentication data including at least one session key, the authentication data being encrypted using asymmetric encryption, a public key being known to the authentication server, a private key being known only to the mobile terminal, the private key being associated with the public key;
Transmission (2020), by the mobile terminal, of an upward notification to the authentication server, through the real-time notification server, the upward notification comprising a sub-set of the authentication data, at least this sub-set of the authentication data being encrypted using symmetric encryption using at least the session key as the key;
Verification (2030), by the authentication server, of the conformity of the authentication data included in the upward notification compared to the transmitted authentication data included in the downward notification;
Authorization (2040) of the initiating of the session in the event of successful verification.

### Claim 2 (depends on 1)

The method for initiating a secure session according to claim 1, characterized in that the notifications transmitted to the authentication server are routed through an intermediate server (501).

### Claim 3 (depends on 2)

The method for initiating a secure session according to claim 2, characterized in that the intermediate server is an XMPP server.

### Claim 4

The method for initiating a secure session according to one of the preceding claims, characterized in that the real-time notification server is public.

### Claim 5

The method for initiating a secure session according to any of the preceding claims, characterized in that the authentication data comprise a user identifier and a one-time password.

### Claim 6

The method for initiating a secure session according to any of the preceding claims, characterized in that the public key and the private key are produced by the mobile terminal during an enrollment phase of the mobile device on the authentication server.

### Claim 7

The method for initiating a secure session according to the preceding claim, characterized in that the enrollment phase is carried out by implementing at least one of the following steps:
Acquisition (4000), by the mobile terminal, of:
An enrollment key;
An authentication server identifier;
A user identifier, and;
Configuration data for communication with the real-time notification server;
Transmission (4010), by an enrollment tool, of a message to the authentication server, this message comprising:
The user identifier;
The enrollment key;
Production (4030), by the mobile terminal, of the public key and the private key;
Transmission, by the mobile terminal, of an upward notification to the authentication server, the upward notification comprising at least:
The user identifier and the public key encrypted using the enrollment key, as well as;
The user identifier;
The authentication server identifier.
Enrollment by the authentication server.

### Claim 8 (depends on 7)

The method for initiating a secure session according to claim 7, characterized in that the user identifier is a temporary identifier associated with a permanent identifier.

### Claim 9 (depends on 7)

The method for initiating a secure session according to claim 7, characterized in that the acquisition step is carried out by reading a QR code.