A method for granting a user access through a user access device hosting a client application to a service coming from a set of services of a server application hosted by a distant server

Distant server for granting a user access through a user access device to a service coming from a set of services of a server application, wherein said distant server hosts said server application and is configured by means of said sever application to:

• during a user session, receive a service access request from the user access device,
• send to said user access device a user authentication request, a primary challenge, an URL of said service and a unique user identifier, to be forwarded by said user access device to a secure peripheral device to which it is logically connected to, said user access device acting as a gateway between said secure peripheral device and said distant server,
• receive a primary response forwarded by said user access device and coming from said secure peripheral device, said primary response being based on a flag, on said primary challenge, and on a secret device key associated to said URL and which has been stored within said secure peripheral device during a user-device binding process, said flag being set up according to a checking of the user identity by said device application through said secure peripheral device using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during a user-device binding process, or relying on a last user authentication validity if a period of time is not exceeded,
• verify the validity of said primary response,
• according to said primary response, grant or deny the user access to said service through said user access device.

Secure peripheral device for checking a user identity for accessing a service through a user access device, said service coming from a set of services of a server application hosted by a distant server, wherein said secure peripheral device hosts a device application and is configured by means of said device application to:

• receive from said user access device a user authentication request, a primary challenge, an URL of said service, and a unique user identifier, coming from said distant server, said user access device acting as a gateway between said distant server and said secure peripheral device to which it is logically connected to,
• upon receiving said user authentication request, check the user identity,
• build a flag according to said checking, using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during the user-device binding process, or relying on a last user authentication if a period of time is not exceeded,
• generate a primary response based on said flag, on said primary challenge and on a secret device key associated to a unique user identifier and to said URL and which has been stored within said secure peripheral device during a user-device binding process,
• send back to said distant server through said user access device said primary response for verification of its validity by said distant server.

User access device for accessing a service coming from a set of services of a server application hosted by a distant server, wherein said user access device is acting as a gateway between said distant server and a secure peripheral device to which it is logically connected to, and hosts a client application and is configured by means of said client application to:

• receive a service access request,
• forward to said distant server said service access request,
• forward to said secure peripheral device, a user authentication request, a primary challenge, an URL of said service, and a unique user identifier, coming from said distant server,
• forward to said distant server a primary response coming from said secure peripheral device, said primary response being based on a flag, on said primary challenge, and on a secret device key associated to a unique user identifier and to said URL and which has been stored within said secure peripheral device during a user-device binding process, said flag being set up according to a checking of the user identity by said device application through said secure peripheral device using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during a user-device binding process, or relying on a last user authentication validity if a period of time is not exceeded.

System for granting a user access through a user access device hosting a client application to a service coming from a set of services of a server application hosted by a distant server, wherein said system comprises said user access device, said distant server and a secure peripheral device to which said user access device is logically connected to, said secure peripheral device hosting a device application, and wherein:

• said distant server is configured by means of said server application to:
• during a user session, receive service access request from the user access device,
• send a user authentication request, a primary challenge, an URL of said service, and a unique user identifier to said user access device to be forwarded to said secure peripheral device,
• receive a primary response forwarded by said user access device and coming from said secure peripheral device, said primary response being based on a flag, on said primary challenge, and on a secret device key associated to said URL and which has been stored within said secure peripheral device during a user-device binding process, said flag being set up according to a checking by said device application through said secure peripheral device of the user identity using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during a user-device binding process, or relying on a last user authentication validity if a period of time is not exceeded,
• verify the validity of said primary response,
• according to said primary response, grant or deny the user access to said service through said user access device,
• said user access device is acting as a gateway between said secure peripheral device and said distant server, said user access device is configured by means of said client application to:
• receive a service access request,
• forward to said distant server said service access request,
• forward to said secure peripheral device said user authentication request, said primary challenge, said URL, and said unique user identifier, coming from said distant server,
• forward to said distant server said primary response coming from said secure peripheral device,
• said secure peripheral device is configured by means of said device application to:
• receive from said user access device said user authentication request, said primary challenge, said URL of said service, and said unique user identifier, coming from said distant server, said user access device acting as a gateway between said distant server and said secure peripheral device to which it is logically connected to,
• upon receiving said user authentication request, check the user identity,
• build a flag according to said checking using the result of a comparison between user data signals and the ones that have been stored within said secure peripheral device during the user-device binding process, or relying on a previous user authentication if a period of time is not exceeded,
• generate said primary response based on said flag, on said primary challenge and on a secret device key associated to said unique user identifier and to said URL and which has been stored within said secure peripheral device during the user-device binding process,
• send back to said user access device said primary response to be forwarded to said distant server.