WO2015044590A1

WO2015044590A1 - Method for authenticating a user provided with a first device by a second device

Info

Publication number: WO2015044590A1
Application number: PCT/FR2014/052394
Authority: WO
Inventors: Jean-Philippe Wary; Christophe Mathias; Guirec LORANT
Original assignee: Orange
Priority date: 2013-09-27
Filing date: 2014-09-24
Publication date: 2015-04-02
Also published as: FR3011360A1

Abstract

The invention concerns a method for authenticating a user (10) provided with a first device (11) by a second device (12), an association of said user with a list of authentication elements being known by the second device and by the user, comprising the following steps: - sending (E1) an item of multimedia content to the first device, - receiving (E4), from the first device, location information relating to areas of the multimedia content selected by the user on the first device, said areas representing the authentication elements, - determining (E5), from the multimedia content and the received location information, lists of current descriptive elements associated respectively with a selected area, - comparing (E6) the list of authentication elements associated with the user with the lists of current descriptive elements, the authentication being successful when each authentication element in the list of authentication elements is included in at least one of the lists of current descriptive elements.

Description

A method of authenticating a user with a first device to a second device

The invention relates to security in the computer field and, more specifically, authentication of a user equipped with a first device with a second computing device.

The authentication of a user consists in validating the authenticity of this user and making sure that he is the person he claims to be.

Many methods for authenticating a user exist. For example, there are password authentication methods. With such a method, the user is asked to enter a password that he has previously chosen. However, such an authentication method may be unsafe if the user is located in a hostile environment, where all the actions he or she does can be scanned and analyzed. Known for example software keys recorder (we usually speak of "keylogger"), responsible for recording keystrokes of the keyboard without the knowledge of the user and can thus be used by malicious people to recover a password of the user during an authentication. The malicious person can then access an account of the user by using the authentication data retrieved during an authentication replay. With the proliferation of smart devices, such as smartphones, who access the Internet and who can be infected in the same way as a computer, frauds of this kind multiply. It is understood that a method of password authentication may be insufficient.

One of the aims of the invention is to remedy the shortcomings / disadvantages of the state of the art and / or to make improvements thereto.

To this end, the invention proposes a method of authentication of a user equipped with a first device by a second device, an association of said user with a list of authentication elements being known on the one hand at the second device and secondly at the user level, the method comprising the following steps, implemented by the second device:

sending the first device a multimedia content,

reception from the first location information device relating to zones of the multimedia content selected by the user on the first device, said zones representing for the user the authentication elements, determination, from the multimedia content and the location information received, of lists of current descriptive elements associated respectively with a selected zone,

- Comparing the list of authentication elements associated with the user with lists of common descriptive elements, the authentication being successful when each authentication element of the list of authentication elements is included in at least one of the lists. common descriptive elements.

The authentication method described here can be implemented in a so-called hostile environment, that is to say an environment whose user is not sure of the security level. For example, in such an environment, the actions of the user can be watched. The authentication implemented here is based on the sharing, between the user and the second device, of authentication elements based on concepts that can be represented differently on two multimedia contents used during two successive authentications. Thus, if a spyware installed on the first device spies the actions of the user, it can not deduce selections made by the user on a multimedia content authentication elements necessary for authentication. This authentication is therefore different from an authentication during which the user enters a password such as a PIN. Indeed, in this case, the spyware can recover the password after a single authentication. Thus, with the method described here, authentication is more robust than conventional password authentication.

The invention also relates to a method for authenticating a user equipped with a first device with a second device, an association of said user with a list of authentication elements being known on the one hand at the the user and secondly at the second device, the method comprising the following steps, implemented by the first device:

reception by the first device of a multimedia content,

identification by the user by means of a user interface of the first device, zones respectively comprising an authentication element of the list, and selection of said zones in the multimedia content,

sending to the second device location information relating to the selected location areas,

receiving an authentication result on the first device.

The authentication method implemented at the second device, or user terminal, requires the user to select at the user interface areas to which he associates respectively the authentication elements of the list of elements. authentication. However, with respect to a conventional authentication method, the user selects zones which are respectively associated with a list of descriptive elements which, in addition to an authentication element, may also contain several other descriptive elements. Thus, the selection of a zone in the content does not return a single element but a list of descriptive elements among which the user has identified an authentication element. An authentication of the user may therefore require an interpretation of what may be associated with a zone. Such an interpretation process is difficult to reproduce automatically.

In an exemplary embodiment, a selected zone comprises at least two descriptive elements.

The level of security of the authentication method increases all the more as the number of descriptive elements associated with an area of a multimedia content selected by the user increases. Indeed, in this case, a tool that would look for the actions of the user and would have access to the content transmitted on the user interface, would have difficulty in associating to a selected area an authentication element.

In an exemplary embodiment, the multimedia content varies randomly from one authentication to another.

The multimedia content that is presented to the user during authentication is randomly selected from a content base adapted for the user-specific authentication element list. Thus, it is difficult for a person or a tool that observes the actions of the user to quickly deduce information on the authentication elements that he has selected. This enhances the security of the authentication process.

According to an exemplary embodiment of the invention, the multimedia content is an image.

When the multimedia content is a photograph, the areas that can be selected by the user are identified by geographical coordinates, for example an abscissa and an ordinate.

According to a second embodiment of the invention, the multimedia content is a video film.

According to a third embodiment of the invention, the multimedia content is a soundtrack.

When the multimedia content is a video film or a soundtrack, the areas that can be selected by the user are identified by temporal coordinates and, where appropriate, geographic coordinates.

According to an exemplary embodiment, the authentication method comprises a prior phase of processing a multimedia content during which: the multimedia content is divided into location zones,

a zone of the content is associated with a list of at least one descriptive element, the content being adapted to the authentication list associated with the user, when an authentication element of the list is included in at least one list of common descriptive elements.

Multimedia content is previously processed so that it can be proposed during an authentication. The multimedia content is adapted to an authentication list when all the authentication elements of the list can be selected by the user in the content.

Advantageously, the number of areas of the multimedia content where there is a descriptive element of one of the lists of the descriptive elements is greater than a minimum value and less than a maximum value.

For a descriptive element to be retained in association with an area of multimedia content, the total area on which it is represented in the multimedia content must not be too large or too small. Indeed, if the descriptive element is represented on a too small surface of the contents, there are risks that the user has difficulties in finding the zone to be selected, associated with the descriptive element which is part of its list of contents. authentication elements. If the descriptive element is represented on a too large surface of the image, a malicious person can, by selecting a zone at random, find the right descriptive element. In practice, the surface of a descriptive element is between two and fifteen percent of the total area of the multimedia content.

The invention also relates to a server device for authenticating a user equipped with a user device, an association of said user with a list of authentication elements being known on the one hand at the server and on the other hand at the level of the server. of the user, the server device comprising:

means for sending, arranged to send to the user device a multimedia content,

reception means, arranged to receive from the user device location information relating to areas of the multimedia content selected by the user on the user device, said zones representing for the user the authentication elements,

determination means, arranged to determine, from the multimedia content and the location information received, lists of current descriptive elements associated respectively with a selected area, comparison means, arranged to compare the list of authentication elements with the lists of current descriptive elements, the authentication being successful when each authentication element of the list of authentication elements is included in at least one lists of common descriptive elements.

The invention also relates to a user device for authenticating a user to a server device, an association of said user with a list of authentication elements being known on the one hand at the server device and on the other hand at the user level, the user device comprising:

first receiving means, arranged to receive multimedia content from the server device,

identification and selection means, arranged for the user to identify, by means of a user interface, zones respectively comprising an authentication element of the list, and for the user to select said zones in the content; multimedia,

means for sending, arranged to send the server device location information relating to the selected zones,

second reception means, arranged to receive an authentication result from the server device.

The invention also relates to a computer program intended to be installed in a memory of a user device, comprising instructions for implementing the steps of the authentication method of a user according to the invention, when the program is executed by a processor of the user device.

The invention also relates to a computer program intended to be installed in a memory of a server device, comprising instructions for implementing the steps of the authentication method of a user according to the invention when the program is executed by a processor of the server device.

The invention also relates to a system for authenticating a user, comprising a server device according to the invention and at least one user device according to the invention. Other features and advantages of the present invention will be better understood from the description and the appended drawings in which:

FIG. 1 presents the steps of a method for authenticating a user equipped with a first device with a second device, according to a first exemplary embodiment; FIG. 2 shows an example of multimedia content used by the authentication method and prepared for use by a method of prior processing of the multimedia contents, according to an exemplary embodiment of the invention;

FIG. 3 presents the steps of the method of pre-processing a multimedia content, according to an exemplary embodiment of the invention;

FIG. 4 is a schematic representation of a server device implementing the authentication method, according to an exemplary embodiment of the invention;

- Figure 5 is a schematic representation of a user device implementing the authentication method, according to an exemplary embodiment of the invention.

The steps of a method for authenticating a user equipped with a first device with a second device, according to a first exemplary embodiment, will now be described in relation with FIG.

A user 10 is equipped with a first device 11, or user device 11. The first device is for example a smart mobile terminal smartphone type comprising at least one user interface. The user interface includes for example a touch screen. The user wishes to authenticate with a second device 12, or server device, remote, to access a service delivered by the second device 12.

It is assumed that in a prior registration phase of the user 10 with the second device 12, the user has chosen, or has been assigned a set of authentication elements. The set of authentication elements comprises a list of words each constituting an authentication element, each associated with a concept that the user can identify in a multimedia content. In a case where the multimedia content is an image, the concept covers, for example, the notion of color, such as red, blue, etc., of material, such as metal, wood, etc., of an object, such as a fruit, a tool, etc., texture, such as rough, smooth, etc. In this embodiment, at the end of this pre-registration phase, the user has an _auth list L including orange, wood, animal, hot, smooth authentication elements. In other words, L _auth = {orange, wood, animal, warm, smooth}. At the end of the registration phase, the user and the second device 12 share the knowledge of all the authentication elements of the list L _auth - This list of authentication elements is associated with the second device 12 to an identifier of the user 10 in a memory not shown in FIG. 1, and constitutes authentication data specific to the user 10.

The registration phase can be implemented offline, the user can go to a server operator 12 to choose or be assigned the elements authentication. In another exemplary embodiment, the recording phase can be implemented online, for example by means of the first device 11 by means of which the user 10 selects the authentication elements of the list L _aut11 .

In an initial identification step E0, the user 10 wishes to access a service (not shown in Figure 1) by means of the first device 11. The service provided by the second device 12 is subject to identification and authentication. The user identifies himself by sending the identifier associated with him.

In a next step El sending a challenge, the second device 12 sends the first device 11 a challenge in order to verify that the user 10 is the person it claims to be. The challenge is in the form of a multimedia content intended to be transmitted on a user interface of the first device 11. In a preliminary processing phase, described with reference to FIGS. 2 and 3, the multimedia content has been divided into zones whose position in the content can be determined, and to each zone has been associated zero, one or more descriptive elements. These zones are called location zones. A descriptive element associated with a location area is a term that describes what the multimedia content contains in this area. The multimedia content is randomly selected by the second device 12 from a challenge database adapted for the list L _autll of authentication elements of the user. More specifically, multimedia content adapted for the list of authentication elements L _aut11 is arranged in such a way that the user can identify in the content all the authentication elements that are part of the list of elements of authentication. authentication the _autll he owns. In the first embodiment of the invention, the multimedia content is an image intended to be displayed on the screen of the first device 11. An example of such an image is given in FIG.

In a display step E2, the multimedia content received from the second device 12 as a challenge is displayed on the user interface of the first device 11.

In a selection step E3, the user 10 selects in the multimedia content corresponding to the challenge location zones in which he identifies the different authentication elements of the list L _auth . With the list presented above L _auth = {orange, wood, animal, warm, smooth}, the user can select in the image shown in figure 2:

- Orange: the orange as a fruit, or the fox whose coat is orange,

Wood: the handle of the hammer, or tree to the left of the DVD sleeve, Animal: the mouse, or the fox,

Hot: the cup of coffee,

Smooth: the nectarine, or the dvd sleeve, or a scissors blade, or the photo book sleeve, etc. We note that several authentication elements are generally associated with a location area. For example, a location area that covers the coffee cup can be associated with the following authentication elements: black, hot, liquid, and so on.

In this exemplary embodiment, the user therefore selects as many location areas as there are authentication elements in the list of authentication elements.

Lauth-

It is understood that the identification of the authentication elements of the list L _auth in the multimedia content involves knowledge of the user that go beyond the identification of a word as such. For example, the choice of nectarine for the "smooth" authentication element induces the user to associate this texture qualifier with the fruit. This knowledge goes beyond simply identifying symbols on an image. They are difficult to reproduce or analyze by a computer, unless you acquire a sample of several images and location areas selected by the user in each image, and implement an analysis to cross the various information collected . In any case, a software, like a keylogger, which would look for the areas selected by the user on a single image could not deduce directly and unambiguously the authentication elements of the list. The authentication method according to the invention is therefore more robust than known methods of password authentication, in particular when the method is executed in a hostile environment where the actions of the user can be analyzed and analyzed.

In a sending step E4, location information of the areas selected by the user and representative for the user of the authentication elements are sent from the first device 10 to the second device 11. In the case where the multimedia content is a image, the location information of the selected areas are coordinates of the areas in the image, for example as abscissa x and ordinate y.

In a next step E5 of determination, the location information of the areas selected by the user 10 are received and analyzed by the second device 12. The analysis consists in determining, from the location information received, current descriptive elements associated with . More precisely, each location information is associated in the multimedia content with a list containing zero, one or more descriptive elements. At the end of this determination step E5, the second device 12 has, for each zone selected by the user 10 and coordinates (x, y), a list of current descriptive elements, L _deSc (x, y). , (x, y) corresponding to the coordinates of the selected area in the multimedia content. The multimedia content has been previously analyzed so as to associate each of the zero content localization areas with one or more descriptive elements. The second device 12 has thus stored, in association with the multimedia content, lists of descriptive elements and their associated location area. A list of descriptive elements is associated with a location area in the multimedia content. In other words, a coordinate area (x, y) is associated with a list of descriptive elements. This preliminary analysis is detailed in relation to FIG.

It will be understood that a list L _desc (x, y) of current descriptive elements, associated with a zone selected by the user 10 and therefore with an authentication element may comprise more than one element. Indeed, an area of a multimedia content may be associated with several descriptive elements. For example, in the image shown in Figure 2, localization areas that cover the nectarine can be associated with several descriptive elements: the fruit, the red color, the smooth texture, the round shape, etc.

In a next step E6 of comparison, the lists of current descriptive elements L _desc (x _> y) obtained from the selections made by the user during the selection step E3 are compared to the list L _autll elements shared authentication between the user 10 and the second device 12.

In a first case ("ok" case in FIG. 1) where each authentication element of the list of authentication elements L _aut11 is included in at least one list of current descriptive elements L _ofSc (x, y), this means that all the authentication elements previously associated with the user during the pre-registration phase were found by the user and selected in the multimedia content. In other words, the user 10 has correctly authenticated with the second device 12. In this case, in a service access step E7, the first device 11 accesses the service.

In a second case ("nok" case in FIG. 1), corresponding to the case where at least one authentication element of the list of authentication elements L _auth does not appear in any list of current descriptive elements L _desc ( x, j), this means that the authentication has failed since the user 10 has not identified in the multimedia content all the authentication elements included in the list L _auth . In this case, the process stops.

In the embodiment described here, it is assumed that when the user has selected as many zones in the multimedia content as there are authentication elements in the list L _auth , the authentication step E6 is implemented automatically. In another embodiment, the screen includes a banner through which the user can validate his entry, replay authentication, or request the sending of an e-mail notification to itself, or to another entity . For example, an e-mail notification allows the user to obtain more information about the multimedia content. He can thus receive by e-mail an internet link which allows access to more information relating to this multimedia content. For example, when the multimedia content is associated with a sign, a link provides access to a catalog of the sign. In another embodiment, the user may send a notification to a remote site to indicate that he liked the multimedia content.

In the exemplary embodiment described here, the order in which the user selects the authentication elements in the multimedia content does not matter. The invention is not limited to this embodiment. In another embodiment, constraints are applied between authentication elements. For example, for authentication to succeed, the user must select two or more authentication element location areas in a particular order. For example, the user 10 must select an area associated with the authentication element "orange" before the authentication element associated with the texture "smooth". In an exemplary embodiment, a constraint, such as the order in which the fields are to be selected, constitutes an authentication element in its own right and is part of the _auth list L _auth of the authentication elements. In another exemplary embodiment, the authentication element is related to entering two or more other authentication elements with respect to their relative positions in the multimedia content.

In the exemplary embodiment described here, the first device 11 is a smart mobile terminal and the user interface is a touch screen. The invention is not limited to this type of terminal or to this type of user interface. Thus, in a second exemplary embodiment, the first device 11 is a PC type terminal. In another exemplary embodiment, the user interface comprises a keyboard and a screen, a speaker and a microphone, a screen and a mouse, etc. In another exemplary embodiment, the first device 11 and its user interface are adapted to pointing and pointing control techniques, such as voice control, eye movement, hand movements, signal encephalograms, etc. .

In the embodiment described here, the multimedia content corresponding to the challenge is an image displayed on the screen of the first device 11. The invention is not limited to this type of multimedia content. Thus, in a second exemplary embodiment, the multimedia content is a soundtrack intended to be played on a loudspeaker of the first device 11. In an example where the soundtrack is a piece of music, authentication elements can then correspond to particular sounds, for example the sound of musical instruments. The user must then select a passage during which he identifies the characteristic sound of a musical instrument that is part of the list of authentication elements. In this case, the location areas are time zones from a reference time which may be the beginning of the multimedia content or the occurrence of an item previously agreed with the user. As for an image, a soundtrack is pre-processed to associate with each of the time zones of the soundtrack one or more audible musical instruments in these time zones. User selection of a time zone during an authentication can be done in different ways: using a specific key, by touching the screen, or with a specific gesture .

In another exemplary embodiment, the challenge is a video film intended to be played on the screen and, where appropriate, on the loudspeaker of the first device 11. The authentication elements may then correspond to particular descriptive elements, or to particular sounds. The location areas in this case may be areas in the image, as abscissa x and ordinate y and / or time zones. A video film is pre-processed in order to associate a sound or / and an image with each of the time zones of the film. During an authentication, the user selection of a zone associated with an authentication element can be done with a specific key, by touching the screen, or with a particular gesture. The same type of constraint when entering the zones associated with the authentication elements, in this case the order in which the user must select the zones associated with the authentication elements, can be used. In another exemplary embodiment, specific to multimedia content of video or soundtrack type, a constraint imposed when entering zones associated with the authentication elements may be a duration before which the user must not select anything. Another constraint when entering zones relating to the authentication elements in a movie or soundtrack may be to start the entry of the authentication elements from a reference time or after the occurrence of a particular event. , a particular image, or sound, previously agreed with the user. This initiating event of the beginning of authentication is an authentication element in its own right. It is understood that such constraints complicate the analysis by a malicious person authentication of a user.

The prior processing of a multimedia content, according to an exemplary embodiment, will now be described in relation with FIGS. 2 and 3.

It is understood from the authentication method described above that a multimedia content, used in the context of an authentication of a user equipped with a first device with a second device, undergoes prior processing, in order to associating with each zone of the content a list L of _S c of descriptive elements. In this exemplary embodiment, the multimedia content is the image presented in relation with FIG. 2 and an area of the content is identified by coordinates (x, y) in the image. The image is zoned during an initial preparation step E10 to define location areas. For example, the image, of size 800x633 pixels, is cut into squares of 16 pixels, as illustrated by the grid superimposed on the image shown in Figure 2. The content is thus divided into lines that include 50 squares and columns which include 39 squares. The square represents the smallest unit of representation of the image. It corresponds to an area that can be localized in the content by a pair of coordinates (x = abscissa, y = ordinate). This zone can also be selected by the user.

In a step following El i of processing, each of the squares that make up the image is processed so as to associate with a square a list L _desc (x, y) of one or more descriptive elements. For example, with the square of coordinates (42, 21), is associated the list of descriptive elements L _desc (42, 21) = {"hammer", "tool""wood","brown","smooth"}. In an exemplary embodiment, this treatment is done manually.

At the end of the processing step El i, all the coordinate squares (x, y) of the image have been processed and respectively associated with a list of at least one descriptive element L of _S c (x, y) - The image is thus represented by a set of squares each corresponding to a zone to which is associated a list of at least one descriptive element and each having coordinates in the image.

For a descriptive element to be retained in association with a square of the image, it is necessary that the total surface on which it is represented in the image is neither too large nor too small. Indeed, if the descriptive element is represented on a too small surface of the image, there are risks that the user has difficulties in finding the zone to be selected, associated with the descriptive element which is part of his list of authentication elements. If the descriptive element is represented on a too large surface of the image, a malicious person can, by selecting a zone at random, find the right descriptive element. In practice, the surface of a descriptive element is between a minimum percentage Vmin and a maximum percentage Vmax of the total surface of the image. In other words: number of squares where the descriptpif element appears

Vmin <<Vmax

total number of squares

In an exemplary embodiment, the minimum values Vmin and maximum Vmax are respectively equal to two and fifteen percent. In other words, Vmin = 2% and Vmax = 15%.

This pre-treatment makes it possible to populate a database of multimedia contents. It is understood that the multimedia contents are organized according to the descriptive elements that characterize them. So, when a list of authentication elements is distributed to a user 10, the multimedia contents used by the server 12 as challenges are selected from a content base whose descriptive elements comprise the list of authentication elements.

In the example described here, each location area is associated with a list of at least one descriptive element. In another exemplary embodiment, only the squares judged significant are processed during the processing step El i, the other squares, considered insignificant and belonging for example to a wallpaper are initialized to a default value. Thus in this case, each zone of the content is associated with a list comprising zero, one or more descriptive elements. It is understood that in this case the initial content processing phase is facilitated since it is not necessary to define a list of descriptive elements for each area of the content.

The processing of multimedia content is described here for image content. In an exemplary embodiment where the multimedia content is a soundtrack or a film, and the zones that can be selected by the user from the time zones, a preliminary processing of this type of content associates with each time zone content one or more descriptive elements adapted to this type of content. Similarly, for a descriptive element to be retained in such content, the number of time zones in which the descriptive element appears must be between two and fifteen percent. A server device 12, according to an exemplary embodiment, will now be described in relation to FIG. 4.

A server device 12 is a computer equipment, such as a server adapted to authenticate a user 10 equipped with a user device 11 (not shown in Figure 4). The server device 12 and the user device 11 communicate by means of a network, for example the Internet network or a 3G or more type of mobile telecommunications network.

The server device 12 comprises:

a microprocessor 12-1 capable of loading instructions into memory, executing them, performing operations;

a set of memories, including a volatile memory 12-2 of RAM type, used to execute code instructions, store variables, etc., a first storage memory

12-3 of the ROM or EEPROM type, and a second storage memory 12-4, adapted for storing a database of multimedia contents and lists of authentication elements associated with user identifiers. The storage memory 12-3 is arranged to store an application that includes code instructions for implementing the steps of the authentication method described above which are performed by the server device 12. The server device 12 also comprises:

sending means 12-5, arranged to send to the user device 11 a multimedia content. Multimedia content is a challenge to send to authenticate user 10;

reception means 12-6, arranged to receive from the user device 11 location information relating to areas of the multimedia content selected by the user on his device, said areas representing for the user the authentication elements of the list L _auth it shares with the server device 12,

determination means 12-7, arranged to determine, from the multimedia content and the location information received, lists of current descriptive elements associated respectively with a selected area,

comparison means 12-8, arranged to compare the list of authentication elements with the lists of current descriptive elements, the authentication being successful when each authentication element of the list L _auth of the authentication elements is included in at least one list the list of common descriptive elements. In an exemplary embodiment where an authentication element of the list consists of a constraint between several authentication elements, this authentication element is implicitly included in the list of current descriptive elements as soon as the constraint that it defines is respected when selecting the zones associated with the authentication elements.

The sending means 12-5, the receiving means 12-6, the determining means 12-7 and the comparing means 12-8 are preferably software modules comprising software instructions for executing the steps of the method of previously described authentication.

The invention therefore also relates to:

a computer program comprising instructions for implementing the authentication method as described above when this program is executed by a processor of the server device 12;

a readable recording medium on which is recorded the computer program described above.

The software modules can be stored in, or transmitted by, a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmission medium such as a signal or a telecommunications network.

A user device 11, according to an exemplary embodiment, will now be described in relation to FIG. The user device 11 is for example a mobile terminal adapted to communicate with the server device 12 as described above. The user device 11 comprises:

a microprocessor 11-1, able to implement the conventional functions of a mobile terminal and to load instructions in memory, to execute them, to perform operations;

a set of memories, including a volatile memory 11-2, or RAM, used to execute code instructions, store variables, etc., and a storage memory 11-3 of the ROM or EEPROM type. The storage memory 11-3 stores an operating system, as well as an application that includes code instructions for implementing the steps of the authentication method described above which are performed by the user device 11. In another exemplary embodiment, the application is stored in a security module (not shown) of the user device 1;

an 11-4 user interface, arranged to communicate with the user. In an exemplary embodiment, the user interface comprises a touch screen through which the user can select areas associated with authentication elements in the multimedia content. In another exemplary embodiment, the user interface 11-4 may also include a conventional screen, a keyboard, a mouse, a speaker, a microphone, and so on.

The user device 11 also comprises:

first reception means 11-5, arranged to receive multimedia content from the server device,

identification and selection means 11-6, arranged so that the user identifies, by means of the user interface 11-4, localization zones respectively comprising an authentication element of the list of elements d authentication _auth , and for the user to select said zones in the multimedia content,

sending means 11-7, arranged to send to the server device location information relating to the selected location areas,

second receiving means 11-8, arranged to receive an authentication result.

The first reception means 11-5, the identification and selection means 11-6, the sending means 11-7 and the second receiving means 11-8 are preferably software modules which comprise software instructions for perform the steps of the authentication method described above which are implemented by the user device 11. The invention also relates to an authentication system that comprises a server device 12 as described above and at least one user device 11 as described above.

Claims

A method of authenticating a user (10) equipped with a first device (11) with a second device (12), an association of said user with a list of authentication elements (L _auth ) being known firstly at the second device and secondly at the user level, the method comprising the following steps implemented by the second device:

sending (El) to the first device a multimedia content,

reception (E4) from the first location information device relating to areas of the multimedia content selected by the user on the first device, said zones representing for the user the authentication elements,

determination (E5), from the multimedia content and the location information received, of lists of current descriptive elements, a list of current descriptive elements being associated with location information,

- comparing (E6) the list of authentication elements associated with the user with lists of current descriptive elements, authentication being successful when each authentication element of the list of authentication elements is included in at least one of the lists of common descriptive elements.

2. A method of authenticating a user (10) equipped with a first device (11) with a second device (12), an association of said user with a list of authentication elements (L _aut11 ) being known on the one hand at the level of the user and secondly at the second device, the method comprising the following steps, implemented by the first device:

reception by the first device of a multimedia content,

- receiving an authentication result on the first device.

3. Method according to one of the preceding claims, wherein a selected area comprises at least two descriptive elements.

4. Method according to one of the preceding claims, wherein the multimedia content varies randomly from one authentication to another.

5. Method according to one of the preceding claims, wherein the multimedia content is an image.

6. Method according to one of claims 1 to 5, wherein the multimedia content is a video film.

7. Method according to one of claims 1 to 5, wherein the multimedia content is a soundtrack.

8. Method according to one of the preceding claims, comprising a prior phase of processing a multimedia content during which:

the multimedia content is cut (E10) into localization zones,

an area of the content is associated (El i) with a list of at least one descriptive element, the content being adapted to the authentication list (L _autll ) associated with the user, when an authentication element of the list is included in at least one list of common descriptive elements.

9. The method according to the preceding claim, wherein the number of areas of the multimedia content where there is a descriptive element of one of the lists of descriptive elements is greater than a minimum value and less than a maximum value.

10. A server device (12) for authenticating a user (10) equipped with a user device (11), an association of said user with a list of authentication elements (L _auth ) being known on the one hand on the one hand of the server and secondly at the user level, the server device comprising:

sending means (12-5), arranged to send to the user device a multimedia content,

reception means (12-6) arranged to receive from the user device location information relating to zones of the multimedia content selected by the user on the user device, said zones representing for the user the elements of the authentication, determination means (12-7), arranged to determine, from the multimedia content and the location information received, lists of current descriptive elements, a list of current descriptive elements being associated with a location information received ,

comparison means (12-8), arranged to compare the list of authentication elements with the lists of current descriptive elements, authentication being successful when each authentication element of the list of authentication elements is included in the list of authentication elements. at least one of the lists of common descriptive elements.

11. A user device (11) for authenticating a user (10) to a server device (12), an association of said user with a list of authentication elements (L _auth ) being known on the one hand on the one hand of the server device and secondly at the user level, the user device comprising:

first receiving means (11-5), arranged to receive multimedia content from the server device,

identification and selection means (11-6), arranged so that the user identifies, by means of a user interface, zones in the multimedia content, said zones representing for the user the authentication elements, and for the user to select said areas in the multimedia content,

sending means (11-7), arranged to send to the server device location information relating to the selected zones,

second reception means (11-8), arranged to receive an authentication result from the server device.

A computer program for installation in a memory of a user device, comprising instructions for implementing the steps of the user authentication method according to claim 2, when the program is executed by a user. processor of the user device.

13. Computer program for installation in a memory of a server device, comprising instructions for implementing the steps of the user authentication method according to one of claims 1, 3, 4, 5, 6, 7, 8, 9, when the program is executed by a processor of the server device.

14. A user authentication system, comprising a server device (12) according to claim 10 and at least one user device (11) according to claim 11.