WO2017162995A1

WO2017162995A1 - Authentication method for authorising access to a website

Info

Publication number: WO2017162995A1
Application number: PCT/FR2017/050694
Authority: WO
Inventors: Florian PRADINES
Original assignee: Arcansecurity
Priority date: 2016-03-25
Filing date: 2017-03-24
Publication date: 2017-09-28
Also published as: FR3051091B1; FR3051091A1

Abstract

The invention relates to an authentication method for authorising access to an Internet site from the computing device of a user or access to encrypted data stored in said computer device, wherein a prior phase of parameter setting comprises the following steps : o creating a list of authentication parameters, which parameters are divided: into a first group consisting of at least one item of geolocation data of the computer device and/or a time range of operation of said device, and a second group consisting of at least one other item of data other than a password, a login, an item of geolocation data of the computing device and a time range of the operation of said device; selecting, from a graphic interface of the electronic device, at least one authentication parameter of the first group and at least one authentication parameter of the second group; defining, from the graphic interface, at least one authentication condition by selecting one or more logic operators belonging to the following list: logical AND, logical OR and logical NOT; and combining the logical operator or operators selected with the chosen authentication parameters.

Description

AUTHENTICATION METHOD FOR AUTHORIZING ACCESS TO A WEB SITE

Description Technical Field of the Invention

The subject of the invention is an authentication method for authorizing access to a website.

It concerns the field of digital data processing and more particularly that of security techniques for protecting such data against unauthorized activity.

State of the art

It is common practice to allow access to a website or encrypted data through login and password authentication. This authentication allows a user to prove his identity when he wishes to access a resource (particularly computer) or a service offered on a website (eg online bank accounts) whose access is limited and protected.

Authentication techniques that are not based on traditional username and password exist.

Document EP 2,804,136 (ORANGE) concerns for example the management of access to a social network. The request for access to this social network is managed by a remote server. The latter authorizes access according to a geographical position and a period of time associated with the access request. The geographical position corresponds for example to a conference center and the time period to a time slot of a given day (which typically coincides with a conference that takes place in the conference center). Thus, only those who ask to join the social network and who are located in the conference center during the predefined period of time, will be registered on the social network dedicated to the conference taking place that same day, at the conference center. People wishing to register to the social network can not however choose the authentication parameters, the latter being imposed on them.

The document US Patent 2014/0230022 (YUASA) relates to an information processing device for accessing content. This feature allows a person (owner) who is leading a group to grant access to this group to participants. Group access conditions are defined by the owner and consist of a combination of a location, a time slot and a theme. Participants can not choose authentication settings to access the group. These parameters are imposed by the owner.

WO2012 / 000107 (ABSOLUTE SOFTWARE CORPORATION) discloses a device for automatically setting the setting of a geo-location of a computer device such as computer, telephone, etc. The user first defines a geo-tracking zone around a point of geolocation of the apparatus. If the device is located in the geo-location area, the device works (the user can access the data contained in his device). If the device is not located in the area of geo-tracking, the device no longer works (the user no longer has access to the data contained in his device). The position of the device can be checked to see if it is located in the geo-tracking area. If the apparatus is outside the geo-location area, the device prompts the user to enter a password to adjust said geo-location area to include the new location of said location. The interest of this authentication method is limited insofar as the user can only choose one authentication parameter (other than the password) which is the extent of the geo-registration area.

US2013 / 0036462 (QUALCOMM) discloses an authentication method for authorizing a computing device to gain access to sensitive information. In addition to the fact that this document does not deal with access to a website, authentication management is devolved to the computing device so that the level of security is not optimal. A similar situation appears in the patent documents US2013 / 262873 (READ) and US2015 / 0281279 (SMITH).

The invention aims to remedy this state of affairs. In particular, an object of the invention is to improve the authentication technique other than by identifier and password.

Another object of the invention is to allow a user to access more securely to a website whose access is reserved for him.

Another objective of the invention is to propose an authentication technical solution that is inexpensive, easy to install, and easy to use.

Disclosure of the invention.

The solution proposed by the invention is an authentication method for authorizing the connection to a website from a computer device of a user. A prior parameterization phase comprises the following steps:

creating a list of authentication parameters, which parameters are distributed: o in a first group consisting of at least one geolocation data item of the computing device and / or a running time slot of said apparatus,

o and in a second group consisting of at least one other data other than a password, a login, a geo-location data of the computing device and a time slot of operation of said device,

select at least one authentication parameter of the first group and at least one authentication parameter of the second group,

define at least one authentication condition by selecting one or more logical operators belonging to the following list: logical AND, logical OR, logical NOT, and combining the selected logical operator (s) with the selected authentication parameters,

record, in a computer server, this authentication condition, which computer server is adapted to manage the connection to the website or access to the encrypted data.

A subsequent phase of access to the website includes the following steps: the computer device connects to the website whose access is protected, the connection of the computer device to the website triggers the implementation of a process that causes the automatic connection of said device to the computer server,

the computer apparatus transmits to the computer server authentication parameters,

the computer server analyzes the authentication parameters transmitted by the computer device and confronts them with the authentication condition,

the computer server generates an access authorization instruction to the website, this instruction being generated only if the transmitted authentication parameters respect the authentication condition,

the computer server transfers the authorization instruction to the website, in response to the receipt of the authorization instruction, the website authorizes access to the computer device. It is now the user who himself sets his own authentication condition. The latter is not imposed by a third party contrary to the aforementioned techniques known from the prior art. In addition, the authentication condition being now constituted by the combination of at least two parameters (other than a password or an identifier) which are associated logical operators, the security level is improved. And the fact of delegating to a computer server saying (independent of the computer device of the user or the website) the management of the authentication, and thus the management of the access to the website, makes it possible to increase further the level of security.

Other advantageous features of the invention are listed below.

Each of these features may be considered alone or in combination with the outstanding characteristics defined above, and may be subject, where applicable, to one or more divisional patent applications:

Preferably, during the prior parameterization phase, the authentication parameters are selected so that during the subsequent phase of access to the website, the computer device can automatically detect all these authentication parameters without voluntary action on said apparatus.

The authentication condition is a static condition, the selection of a parameter does not influence the other selected parameters.

preferably, the second group consists of at least one item selected from the following list: identifier integrated in a SIM card of the computer apparatus; identifier associated with the computer apparatus; SSID of a wifi network; detecting a Bluetooth connection between the computing device and another electronic device; identifier registered in an NFC or RFID tag; digital print ; retinal scan; iris recognition; detecting a connection between the computer apparatus and a proxy server; detecting a connection between the computing device and a VPN server; IP address assigned to the computing device when connected to a telecommunication network; detecting a connection of the computer apparatus to a social network; detecting a connection of the computer device to the page of a specific friend or a specific person followed on a social network; MAC address of a network gateway.

The geo-location data of the computing device can be selected by the user from an interactive map displayed on a graphical interface of said apparatus. The operating time range of the computing device may consist of one or more days of the week and a period of time.

Advantageously, the prior parameterization phase further comprises the following steps: displaying, from a menu accessible from a graphical interface of the computing device, all the authentication parameters; - select, from the menu, authentication parameters among the set of authentication parameters displayed. Logical operators can also be displayed in this menu with all the authentication parameters.

The method advantageously comprises a step of encrypting the authentication condition with a cryptographic algorithm.

In this case, it preferentially encrypts the authentication condition with an AES key generated by the computer device.

This AES key can be encrypted with a public RSA key generated by the computer server.

This public RSA key can be generated by the computer server in response to a request transmitted by the website.

Another aspect of the invention not covered by the claims relates to an authentication method for authorizing the decryption of encrypted data stored in a computer apparatus of a user,

wherein, a prior parameterization phase comprises the following steps: creating a list of authentication parameters, which parameters are distributed:

^■ in a first group consisting of at least one geo-location of the computing device data and / or a time slot of said apparatus,

^■ and in a second group consisting of at least one data other than a password, a login, a geo-location data of the computing device and a time slot of said device,

o selecting, from a graphical interface of the electronic device, at least one authentication parameter of the first group and at least one authentication parameter of the second group, o defining, from the graphical interface, at least one authentication condition by selecting one or more logical operators belonging to the following list: logical AND, logical OR, logical NOT, and combining the selected logical operator (s) with the parameters of selected authentication,

recording, in a computer server, this authentication condition, which computer server is adapted to manage access to the encrypted data, and wherein, a subsequent phase of decryption of the encrypted data comprises the following steps:

o the selection of the encrypted data triggers the implementation of a process which causes the connection of the computer apparatus to the computer server, where the computer apparatus transmits authentication parameters to the computer server,

o the computer server analyzes the authentication parameters transmitted by the computer device and confronts them with the authentication condition, where the computer server generates an access authorization instruction for the encrypted data, this instruction being generated only if the transmitted authentication parameters comply with the authentication condition, o the computer server transmits to the computer apparatus: the authorization instruction and a key for decrypting the encrypted data, or in response to the reception of the authorization instruction and the decryption key, the computer device decrypts the encrypted data.

This method advantageously comprises a step of encrypting the data with a cryptographic algorithm.

In this case, the data is preferentially encrypted with an AES key generated by the computer server.

Encrypted data may be stored in a memory of the electronic apparatus or in a memory of a second electronic apparatus separate from said apparatus

In the latter case, the method advantageously comprises a step of transmitting a decryption key data to the second electronic device, the decryption key being automatically transmitted by the computer server if the authentication parameters transmitted by the electronic device comply with the authentication condition. Description of the figures.

Other advantages and characteristics of the invention will appear better on reading the description of a preferred embodiment which will follow, with reference to the accompanying drawings, carried out as indicative and non-limiting examples and in which:

FIG. 1 schematizes an example of a system in which the method according to the invention can be implemented,

FIG. 2 schematizes another example of a system in which the method according to the invention can be implemented,

FIG. 3 schematizes yet another example of a system in which the method according to the invention can be implemented,

FIG. 4 schematically illustrates the structure of a computing device used in the invention,

FIG. 5 schematically illustrates the structure of a remote computer server used in the invention,

FIG. 6 is a simplified illustration of an example of a graphical interface allowing a user to define an authentication condition,

FIG. 7 is a flow diagram illustrating various steps implemented in the method that is the subject of the invention, during the prior parameterization phase, for access to a website,

FIG. 8 is a flowchart illustrating various steps implemented in the method that is the subject of the invention during the subsequent phase of accessing a website,

FIG. 9 is a flowchart illustrating various steps implemented in the method that is the subject of the invention, during the prior parameterization phase, for access to encrypted data,

FIG. 10 is a flowchart illustrating various steps implemented in the method that is the subject of the invention, during the subsequent phase of access to the encrypted data,

FIG. 11 is a flowchart illustrating various steps implemented in the method that is the subject of the invention, during the prior parameterization phase, for access to encrypted data, in a variant embodiment,

FIG. 12 is a flowchart illustrating various steps implemented in the method that is the subject of the invention, during the subsequent phase of access to the encrypted data, in a variant embodiment. Preferred embodiments of the invention

The method which is the subject of the invention consists of a coherent sequence of steps making it possible to achieve a desired result. These steps generate manipulations of physical elements, including signals (electrical or magnetic) capable of being stored, transferred, combined, compared, and so on.

The method is implemented via computer applications executed respectively by one or more computing devices or by one or more computer servers. For the sake of clarity, it should be understood within the meaning of the invention that "the device / server does something" means "the computer application running on the device / server is doing something". Just like "the computer application does something" means "the computer application run by the device / server is doing something".

The implementation of the method that is the subject of the invention requires the use of one or more electronic devices 1 a, 1 b (FIGS. 1, 2 and 3), for example in the form of a fixed or portable computer, a tablet, preferably in the form of a smartphone iPhone®, Samsung Galaxy®, iPad®, Samsung Tab®, or in the form of another electronic device, operating with a Windows-like operating system , Mac, iOS, Android, etc. The device 1 a, 1 b is adapted to be operated by a user, who, in practice, is a natural person.

With reference to FIG. 4, each electronic device 1 a, 1 b notably comprises one or more processors or microprocessors 10, one or more memories 11, a network interface 12, a graphical interface 13, a position determination module 14 , an infrared signal transmitter / receiver 16, which are mutually connected via a bus 15. One or more computer applications - or computer programs - are recorded in the memory or memories 1 1 and whose instructions (or codes), when they are executed by the processor or processors 10 allow to achieve the features described further in the description.

The memory or memories 1 1 must be considered as a storage device also suitable for storing data and / or data files. It can be a native memory or a reported memory such as a Secure Digital (SD) card.

The network interface 12 is adapted to establish a communication with the remote server S described further in the description, via a wireless or wired link, so as to receive and transmit signals. The network interface 12 may for example comprise a Bluetooth module, a GSM module, or a module providing a network connectivity to the device 1 a, 1 b. In general, the purpose of the network interface 12 is to manage the connections between the device 1a, 1b and a telecommunication network R (Internet, mobile telephony, etc.), and possibly between the devices between them via network technologies such as, but not limited to, GSM, 3G, 4G Wifi, Bluetooth, etc.

The graphical interface 13 offers the user the possibility of entering, selecting and / or entering data to define at least one authentication condition. It is for example in the form of a touch screen, a screen connected to a keyboard and / or mouse, etc.

The position determination module 14 is preferably a satellite geolocation module of the GPS type or based on a technique of triangulation of signals acquired by cell phone relay terminals.

The infrared signal transmitter / receiver 16 allows a device 1a to communicate wirelessly with another device 1b.

The user must install a computer application in at least one of his apparatus 1a (preferably each apparatus 1a, 1b) to implement all or part of the invention from said apparatus. Advantageously, the computer application can be preinstalled on the device 1a, for example by a network operator. However, the user can search for the computer application on an online store such as Google Play®, Itunes® or on a dedicated website, and then download it to their device 1 a. The information to download and install the computer application on the device can for example be retrieved using a QR code or an NFC tag. In any case, the computer application can be installed in any memory 1 1 of the device 1 a.

The implementation of the method of the invention also requires the use of a remote server S. The latter may consist of a physical server or, in some cases, be composed of several separate computers that communicate and interact on a network to perform the functions described above.

With reference to FIG. 5, the remote server S notably comprises one or more processors or microprocessors 20, one or more memories 21, a network interface 22, which are mutually connected via a bus 25. One or more computer applications - or programs information - are recorded in the memory (s) 21 and whose instructions, when executed by the processors 20 make it possible to realize the functionalities described further in the description.

The network interface 22 is a wired or wireless communication interface adapted to establish communication with the devices 1 a, 1 b, an internet site S ', and possibly a database 23, via a telecommunication network R (Internet , mobile telephony, etc.) and by using network technologies such as, but not limited to, GSM, 3G, 4G Wifi, Bluetooth, etc. The network interface 22 notably allows the remote server S to receive and transmit signals.

The database 23 can be hosted directly in the remote server S, or in another server or in a server network type Cloud Computing, or in a computer.

A computer application is installed in the remote server S to implement all or part of the invention from said server as explained further in the description. This computer application can be preinstalled on the remote server S or be downloaded later.

According to the invention, a list of authentication parameters is created which is used to authorize the connection to a website or access to encrypted data. These authentication parameters are advantageously divided into at least two groups.

A first group consists of at least one geo-location data of the apparatus 1a and / or a time slot of operation of said apparatus.

The geolocation data can be generated from the position determination module 14. To generate this data, the user can for example activate this module to determine an exact position and define a perimeter or radius around this position. It can also be a place (eg the Eiffel Tower) and / or a geographical area (eg Paris) selected by the user from an interactive map, for example GoogleMap®, displayed on a graphical interface 13.

The operating time range of the device may consist of one or more days of the week and / or a period of time. For example, this time slot can be: Monday, between 8am and 10am. This time slot can be defined by the user in the same way that an alarm is set on a smartphone.

The second group consists of at least one other data other than a password, a login, a geo-location data of the computing device and a operating time range of said apparatus. It is preferentially, but not exclusively, of:

The identifier integrated in the SIM card (for Subscriber Identity Module, / a Smartphone in the case where the device 1 is a Smartphone;

- An identifier associated with the device 1 a. This identifier can be generated randomly during the installation of the computer application, or automatically generated from the IP address (for Internet Protocol) assigned to the device when connected to a telecommunication network to download the computer application. The identifier can still be entered manually by the user during the installation process, or retrieved from a file stored locally or on a remote server.

The SSID (for Service Set Identifier) of a wifi network. This SSID can be set automatically by default, or entered manually by the user, when setting up the wireless network.

Detection of a Bluetooth connection between the device 1 a and another electronic device.

An identifier stored in an NFC or RFID tag. The acquisition of this identifier may in particular be carried out by scanning the tag from the device 1a, by means of a reader adapted for this purpose.

A fingerprint, a retinal scan, an iris recognition, or other. The acquisition of this identifier may in particular be carried out by an acquisition means adapted to the nature of this identifier, which means equips the apparatus 1 a.

Detection of a connection between the device 1a and a proxy server.

Detection of a connection between the device 1a and a VPN server (for Virtual Private Network).

- The IP address (for Internet Protocol) assigned to the device 1 when connected to a telecommunication network.

Detecting a connection from the device 1 to a social network such as Facebook®, Twitter®, Viadeo®, Instagram®, Snapchat®, Linkedln®, etc.

Detecting a connection from the device 1 to the page of a specific friend or a specific person followed on a social network such as Facebook®, Twitter®, Viadeo®, Instagram®, Snapchat®, Linkedln®, etc.

The MAC (for Media Access Control) address of a network gateway. This is typically an identifier stored in a network adapter or similar network interface. Referring to Figure 6, the graphical interface 13 of the apparatus 1 has the user to choose the authentication parameters. The graphical interface 13 displays in a window, for example in the form of a menu 130, for example a drop-down menu, the set of available authentication parameters A, B, C, D, ...., Z. This window can appear automatically when selecting a dedicated key 131. The user can then select in the menu 130 the authentication parameters he has chosen and define them precisely, including geolocation data and time slot.

In practice, the user selects at least one authentication parameter of the first group and at least one authentication parameter of the second group.

It then defines, from the graphical interface 13, at least one authentication condition by selecting one or more logical operators belonging to the following list: logical AND, logical OR, logical NOT, and combining the selected logical operator (s) with selected authentication settings. In FIG. 6, the logical operators are also displayed in the menu 130, with the available authentication parameters A, B, C, D, ...., Z, in the same window. Logical operators can however be displayed in another window and / or in another menu.

In Figure 6, the authentication condition is: 'A' AND 'B' ('C OR' D ') AND NOT Έ'. For example, A may be chosen in the first group of authentication parameters. B, C and D may be selected from the second group of authentication parameters. E can be chosen in the first or second group of authentication parameters.

For example, the authentication condition may be:

'Monday from 8h to 10h' (A)

AND 'connected to Facebook®' (B)

'On Paul's page' (C)

OR

'On the page of Peter' (D)

AND NOT 'located in PARIS' (E)

In other words, in order for the authentication condition to be fulfilled, the device 1 must be in working order on a Monday from 8am to 10am, whether the device 1 is connected to the facebook.com website. and that he should consult Paul's Facebook® page or Pierre's Facebook® page, since the device 1 should not be located in Paris (France). Yes one of these parameters is not respected, the authentication condition is not fulfilled.

In another example, the authentication condition may be as follows:

'fingerprint' (A)

AND 'connection to a wifi network' (B)

'Paul's wifi network' (C)

OR

'Pierre's wifi network' (D)

AND NOT 'Monday from 8h to 10h' (E)

In order for this authentication condition to be fulfilled, the user must scan his fingerprint, whether the device 1 is connected to a wireless network, this wireless network must be that of Paul or Pierre, every day of the year. the week, except Monday from 8h to 10h. If any of these parameters are violated, the authentication condition is not met.

The user-defined authentication condition is a static condition. That is, the selection of a parameter does not influence the other selected parameters. In particular, the selection of an operating time slot has no effect on the other parameters, unlike the process described in the document US2013 / 0036462 (QUALCOMM) where a time slot is determined for dynamically varying one or more other parameters of the authentication condition.

It is easy to understand that the large number of possible combinations of authentication parameters and logical operators makes the authentication condition unique, thereby conferring an optimum degree of security. It is unlikely that a malicious user can discover the authentication condition.

Obviously, the authentication conditions can be more or less complex depending on the type of website for which the connection is requested or the type of encrypted data to be consulted. If the website is a social network or the encrypted data a simple text, the authentication condition can be relatively simple, and for example consisting of the combination of a parameter of the first group and a parameter of the second group with a only logical operator. The condition will, however, be more complex, of the type described above with reference to Figure 6, when the website is an online bank account or the encrypted data are highly confidential files. Having said this, the implementations of the method that is the subject of the invention, on the one hand to authorize access to a website and, on the other hand, to authorize access to encrypted data, will now be described in more detail. . Access to a website (Figures 1, 7 and 8)

In this case, the objective is to secure access to a website S ', this access being restricted to the user and protected, that is to say that his access is blocked. This website S 'can for example be an online bank account of the user, a social network, a discussion group, etc.

In practice, the website S 'is managed by a computer server of the type described above with reference to FIG. 5. A computer application is advantageously installed in the server managing the website S' to implement all or part of the invention from said server. This computer application can be preinstalled on this server or downloaded later.

Prior parameterization phase (Figures 1 and 7)

In a step 101, the device 1 has connects to the website S '. This connection is made via a telecommunication network R and is shown schematically by a double arrow in FIG. The user may have to follow a usual procedure to register on the website S 'in question. To make this registration, the user may be asked to identify himself by filling in one or more identification data, for example: last name, first name, age, address, telephone number, email address, etc.

In a step 102, the internal site S 'connects to the server S. This connection is made via a telecommunication network R and is shown schematically by an arrow in FIG. 1. This connection is accompanied by a request by which the site S asks the server S to generate a unique identifier.

In a step 103, the server S generates a unique identifier and an RSA key pair. This identifier is preferably generated randomly. RSA encryption is well known to those skilled in the art. It uses a pair of keys (integers) consisting of a public key to encrypt and a private key to decrypt confidential data. The skilled person can refer to the document US4405829 (MASSACHUSETTS INST TECHNOLOGY) if necessary.

The unique identifier is stored in the memory 21 of the server S. In a step 104, the server S transfers the unique identifier to the site S '. This transmission is carried out via a telecommunications network R.

In a step 105, the site S 'creates a new unique identifier by associating the identifier returned by the server S with the data that the user has entered during the registration procedure (step 101). This new unique identifier is stored in the memory of the site S '.

In a step 106, the site S 'transfers this new unique identifier to the apparatus 1a, via a telecommunication network R. This identifier can be displayed on the graphical interface of said site, for example in the form of a QR code, a barcode, or in any other form suitable to the skilled person.

In a step 107, the device 1 acquires this new identifier, for example by scanning the QR code on the graphical interface of the website S '.

In a step 108, the device 1 a connects to the server S, via a telecommunications network R. This connection is accompanied by a request containing the acquired identifier and by which the device 1 has asked the server S of him send the public RSA key associated with said identifier.

In a step 109, the server S transfers to the device 1 a, via a telecommunications network R, the public RSA key associated with the identifier.

In a step 1 10, the user defines, from the device 1 a, an authentication condition, by selecting authentication parameters and combining them with the logical operators.

In a step 1 1 1, the device 1 a generates an AES key (for Advanced Encryption Standard). AES encryption is well known to those skilled in the art. If necessary, the latter may refer to the publication: "Federal Information Processing Standards Publication 197, November 26, 2001, Announcing the ADVANCED ENCRYPTION STANDARD (AES)". The apparatus 1 digit, with this key AES, the authentication condition defined in step 1 10.

In a step 1 12, the device 1 has encrypted the AES key with the public RSA key previously retrieved from the server S.

In a step 1 13, the apparatus 1 a connects to the server S, via a telecommunications network R, to transfer to it the identifier acquired in step 107, the encrypted authentication condition and the encrypted AES key.

In a step 1 14, the server S decrypts the key AES with its private RSA key. The server S then decrypts the authentication condition, verifies it and associates it with the identifier. In a step 1 15, the server connects to the site S ', via a telecommunications network R, and notifies the smooth running of operations.

Later phase of access to the website (Figures 1 and 8)

In a step 201, the apparatus 1 a connects to the site S 'whose access is protected, via a telecommunication network R. The user may be led to follow a usual procedure to authenticate on the site S' for example by entering only his username or email address. The connection of the device 1 to the site S 'then triggers the implementation of a process described below, which process causes the automatic connection of said device to the server S.

In a step 202, the site S 'transfers the identifier created in step 105 to the device

1 a, via a telecommunications network R. This identifier is displayed on the graphical interface of the website S ', for example in the form of a QR code, a bar code, or in any other form suitable for the skilled person.

In a step 203, the device 1 acquires this identifier, for example by scanning the QR code.

In a step 204, the device 1 a connects automatically to the server S, via a telecommunications network R. This connection is accompanied by a request containing the acquired identifier and by which the device 1 has requested the server S to send him the public RSA key associated with the identifier.

In a step 205, the server S generates a new pair of RSA keys that it associates with the identifier.

In a step 206, the server S transfers the public RSA key to the device 1a.

This transmission is carried out via a telecommunications network R.

In a step 207, the user may be required to generate an authentication parameter, for example: connection to a wireless network; Bluetooth connection digital print ; retinal scan; iris recognition, scan of an NFC or RFID tag; etc.

This only occurs if the generation of one of the authentication parameters requires voluntary action by the user on the device 1 a. In all other cases, the device 1 has automatically detected all the authentication parameters determined in step 1 10.

In a step 208, the device 1a generates an AES key and encrypts, with this key, the authentication parameters of the step 207 and the public RSA key previously retrieved from the server S. In a step 209, the device 1 a connects to the server S, via a telecommunications network R, to transfer the identifier, the encrypted authentication parameters and the encrypted AES key.

In a step 210, the server S decrypts the AES key with its private RSA key. The server S then decrypts the authentication parameters. It confronts them with the authentication condition defined in step 1 and received in step 1 14.

In a step 21 1, the server S generates an instruction to authorize access to the site S '. This authorization instruction is generated only if the authentication parameters transmitted in step 209 respect the authentication condition defined in step 1 10.

In a step 212, the server S connects to the site S ', via a telecommunications network R, and notifies the success or failure of the connection. In the event of success, the server S transfers to the site S 'authorization instruction, and in response to the receipt of this instruction, said site S' authorizes access to the device 1 a. In case of failure, the site S 'denies access to the device 1a and possibly notify the prohibition of this access.

Access to figures (Figures 2, 9 and 10) - Case 1

The objective here is to secure access to encrypted data, this access being limited to the user and protected. This encrypted data is for example documents or files (containing text, audio data, video data, photo, ...) stored in the memory 1 1 of the device 1 a.

Prior parameterization phase (Figures 2 and 9)

In a step 301, the user defines, from the apparatus 1 a, an authentication condition, by selecting authentication parameters and combining them with the logical operators.

In a step 302, the apparatus 1a generates a pair of RSA keys and a key

AES. The apparatus 1 digit, with this key AES, the authentication condition defined in step 301.

In a step 303, the apparatus 1 a connects to the server S, via a telecommunications network R, to transfer to it the encrypted authentication condition in step 302 and the public RSA key. These elements are stored in the memory 21 of the server S. In a step 304, the server S generates a unique identifier and saves it in its memory 21.

In a step 305, the server S generates a pair of RSA keys and an AES key. The server S encrypts this AES key with the public RSA key received in step 303. The encrypted AES key and the private RSA key are stored in the memory 21 of the server S.

In a step 306, the server S transfers to the apparatus 1 a: the unique identifier generated in step 304, the AES key encrypted in step 305 and the public RSA key generated in step 305. This transmission is performed via a telecommunications network R.

In a step 307, the apparatus 1 decrypts the AES key received at step 306 with its private RSA key.

In a step 308, the device 1 has created and encrypts its data whose access must be limited and protected. This data encryption is performed with the AES key decrypted in step 307.

In a step 309, the apparatus 1 has encrypted its AES key generated in step 302, with the public RSA key of the server S received at step 306.

In a step 310, the apparatus 1 has recorded in its encrypted data in step 308: the unique identifier received in step 306, its RSA key pair generated in step 302, the AES key encrypted at step 309, the public RSA key of the server S received in step 306.

Subsequent phase of access to the encrypted data (Figures 2 and 10)

In a step 401, the user may be required to generate an authentication parameter, for example: connection to a wireless network; Bluetooth connection digital print ; retinal scan; iris recognition, scan of an NFC or RFID tag; etc. This only occurs if the generation of one of the authentication parameters requires voluntary action by the user. In all other cases, the device 1 has automatically detected all the authentication parameters determined in step 301.

In a step 402, the user selects his encrypted data and the apparatus 1 extracted from these encrypted data: the unique identifier received in step 306, the RSA key pair generated in step 302, the AES key encrypted at step 309, the public server RSA key S received at step 306.

In a step 403, the apparatus 1a generates a new AES key. The device 1 digit, with this new key AES, the authentication parameters found in step 401. In a step 404, the apparatus 1 encrypts the new AES key generated in step 403, with the public RSA key of the server S extracted in step 402.

In a step 405, the apparatus 1 a connects to the server S, via a telecommunications network R, to transfer to it: the encrypted authentication parameters in step 403, the new AES key encrypted in step 404, the key AES extracted in step 402, the identifier extracted in step 402.

In a step 406, the server S decrypts the AES keys received in step 405 with its private RSA key.

In a step 407, the server S decrypts the authentication parameters received in step 405, with the new AES key decrypted in step 406.

In a step 408, the server S decrypts the authentication condition received in step 303, with the key AES extracted in step 402 and decrypted in step 406.

In a step 409, the server S confronts the decrypted authentication parameters in step 407 to the decrypted authentication condition in step 408.

In a step 410, the server S generates an instruction to allow access to the encrypted data. This instruction is generated only if the authentication parameters decrypted in step 407 respect the authentication condition decrypted in step 408. This instruction is advantageously materialized in the form of the key AES encrypted in step 305. .

In a step 41 1, the server S transfers to the device 1 a: the key AES encrypted in step 305. This transmission is performed via a telecommunications network R.

In a step 412, the apparatus 1 decrypts the AES key received in step 41 1, with its private RSA key generated in step 302.

In a step 413, the apparatus 1 decrypts the encrypted data. This decryption is performed with the AES key decrypted in step 412.

Access to figures (Figures 3, 11 and 12) - Case 2

The objective here is to secure access to encrypted data, this access being limited to the user and protected. This encrypted data is for example documents or files (containing text, audio data, video data, photo, ...) stored in the memory of another electronic device 1 b. For example, this electronic device 1b is a laptop while the electronic device 1 is a smartphone.

Prior parameterization phase (figures 3 and 11) In a step 501, the apparatus 1b generates a pair of RSA keys.

In a step 502, the device 1b connects to the server S, via a telecommunications network R, to transfer the public RSA key.

In a step 503, the server S generates a unique identifier and saves it in its memory 21.

In a step 504, the server S generates an RSA key pair. The private RSA key is stored in the memory 21 of the server S.

In a step 505, the server S generates an authentication token (token in English) and associates therewith: the public RSA key received in step 502 and the public RSA key generated in step 504 and the unique identifier generated at step 503.

In a step 506, the server S connects to the device 1b, via a telecommunications network R, to transfer the authentication token of step 505.

In a step 507, the token received in step 506 is displayed on the graphical interface 13 of the apparatus 1b, for example in the form of a QR code, a bar code, or under any other form suitable for the skilled person.

In a step 508, the device 1 acquires the token displayed on the graphical interface 13 of the device 1b, for example by scanning the QR code.

In a step 509, the apparatus 1 a connects to the server S via a telecommunication network R. This connection occurs automatically in response to the acquisition of step 508.

In a step 510, the server S transfers to the apparatus 1 a: the authentication token of step 505, the public RSA key generated in step 504 and the unique identifier generated in step 503.

In a step 51 1, the user defines, from the device 1 a, an authentication condition, by selecting authentication parameters and combining them with the logical operators.

In a step 512, the apparatus 1a generates an AES key. The device 1 digit, with this key AES, the authentication condition defined in step 51 1.

In a step 513, the apparatus 1 has encrypted its AES key generated in step 512, with the public RSA key of the server S received at step 510.

In a step 514, the apparatus 1 a connects to the server S, via a telecommunication network R, to transfer it to it: the encrypted authentication condition in step 512, the encrypted AES key in step 513, the token received at step 510, the identifier received at step 510. In a step 515, the server stores in its memory 21, the encrypted authentication condition received in step 514.

In a step 516, the server S generates an AES key and the digit with the public RSA key received in step 502. This encrypted AES key is stored in the memory 21 of the server S.

In a step 517, the server S connects to the apparatus 1b, via a telecommunication network R, to transfer to it: the unique identifier received at step 514, the encrypted AES key of step 513 received at step 514, the AES key encrypted in step 516, the public RSA key generated in step 504.

In a step 518, the apparatus 1b decrypts the AES key of step 516 with its key

Private RSA.

In a step 519, the device 1b creates and encrypts its data whose access must be limited and protected. This data encryption is performed with the AES key decrypted in step 518.

In a step 520, the device 1b records in its encrypted data at the step

519: the unique identifier received in step 517, its RSA key pair generated in step 501, the encrypted AES key of step 513, the public RSA key of the server S received at step 517.

Subsequent phase of access to the figures (Figures 3 and 12)

In a step 601, the user selects his encrypted data and the apparatus 1 b extracted from these encrypted data: the unique identifier, the encrypted AES key of step 513, its RSA key pair generated in step 501 the public RSA key of the server S received in step 517.

In a step 602, the apparatus 1b connects to the server S, via a telecommunications network R, to transfer to it: the unique identifier, the encrypted AES key of step 513, the public RSA key of the server S.

In a step 603, the server S generates an authentication token and associates with it the data received in step 602, that is to say: the unique identifier, the encrypted AES key of step 513, the Public RSA key from the S server.

In a step 604, the server S connects to the device 1b, via a telecommunications network R, to transfer the authentication token of step 603.

In a step 605, the token received in step 604 is displayed on the graphical interface 13 of the apparatus 1b, for example in the form of a QR code, a barcode, or under any other form suitable for the skilled person. In a step 606, the device 1 acquires the token displayed on the graphical interface 13 of the device 1b, for example by scanning the QR code.

In a step 607, the device 1 a connects to the server S, via a telecommunications network R. This connection occurs automatically in response to the acquisition of step 606.

In a step 608, the server S transfers to the apparatus 1 a: the authentication token of step 603, the public RSA key of the server S and the unique identifier received in step 602.

In a step 609, the user may be required to generate an authentication parameter, for example: connection to a wireless network; Bluetooth connection digital print ; retinal scan; iris recognition, scan of an NFC or RFID tag; etc. This only occurs if the generation of one of the authentication parameters requires voluntary action by the user. In all other cases, the device 1 has automatically detected all the authentication parameters determined in step 51 1.

In a step 610, the apparatus 1a generates a new AES key. The device 1 digit, with this new AES key, the authentication parameters found in step 609.

In a step 61 1, the apparatus 1 has encrypted the new AES key generated in step 610, with the public RSA key of the server S received in step 608.

In a step 612, the apparatus 1 a connects to the server S, via a telecommunication network R, to transfer to it: the encrypted authentication parameters in step 610, the new AES key of step 610 encrypted in FIG. step 61 1, the key AES extracted in step 601, the authentication token received in step 608, the unique identifier received in step 608.

In a step 613, the server S decrypts the AES keys received in step 612 with its private RSA key.

In a step 614, the server S decrypts the authentication parameters received in step 612, with the new AES key of step 610 decrypted at step 613.

In a step 615, the server S decrypts the authentication condition received in step 514, with the key AES extracted in step 601 and decrypted in step 613.

In a step 616, the server S confronts the decrypted authentication parameters in step 614 to the decrypted authentication condition in step 615.

In a step 617, the server S generates an instruction to allow access to the encrypted data. This statement is generated only if the parameters authentication decrypted in step 614 respect the authentication condition decrypted in step 615. This instruction materializes advantageously in the form of the key AES encrypted in step 516.

In a step 618, the server S transfers to the device 1 b: the encrypted AES key in step 516. This transmission is performed via a telecommunications network R.

In a step 619, the apparatus 1b decrypts the AES key received in step 618, with its private RSA key generated in step 501.

In a step 620, the apparatus 1b decrypts the encrypted data. This decryption is performed with the AES key decrypted in step 619.

The arrangement of the various elements and / or means and / or steps of the invention, in the embodiments described above, should not be understood as requiring such an arrangement in all implementations. It is obvious that other embodiments that depart from these details could still be understood as falling within the scope of the appended claims. In any case, it will be understood that various modifications may be made to these elements and / or means and / or steps, without departing from the spirit and scope of the invention. In particular :

The RSA and AES encryption steps are not essential although they further enhance security.

RSA encryption can be replaced by any other asymmetric or symmetric cryptographic algorithm.

AES encryption can be replaced by any other symmetric or asymmetric cryptographic algorithm.

Claims

claims

An authentication method for authorizing access to a website (S ') from a computer device (1 a) of a user,

wherein, a prior parameterization phase comprises the following steps: creating a list of authentication parameters (A, B, C, D, Z), which parameters are distributed:

In a first group consisting of at least one geo-location datum of the computing device (1 a) and / or a time slot of operation of said apparatus,

And in a second group consisting of at least one data other than a password, a login, a geo-location data of the computing device (1 a) and a working time slot. said apparatus,

o select at least one authentication parameter of the first group and at least one authentication parameter of the second group,

o define an authentication condition by selecting one or more logical operators belonging to the following list: logical AND, logical OR,

NO logical, and combine the selected logical operator (s) with the selected authentication parameters,

o register, in a computer server (S) which is remote from the computer apparatus (1 a), this authentication condition, which computer server is adapted to manage the connection to the website (S '),

and wherein, a subsequent phase of accessing the website (S ') comprises the following steps:

o the computer device (1 a) connects to the website (S ') whose access is protected,

o the connection of the computer device (1 a) to the website (S ') triggers the implementation of a process which causes the automatic connection of said device to the computer server (S),

o the computer device (1 a) transmits to the computer server (S) authentication parameters, o the computer server (S) analyzes the authentication parameters transmitted by the computing device (1 a) and confronts them with the authentication condition, o the computer server (S) generates an access authorization instruction website (S '), this instruction being generated only if the transmitted authentication parameters comply with the authentication condition, o the computer server (S) transfers the authorization instruction to the website (S'),

o in response to the receipt of the authorization instruction, the website (S ') authorizes its access to the computer device (1 a).

2. Method according to claim 1, wherein, during the prior parameterization phase, the authentication parameters are selected so that during the subsequent phase of accessing the website (S '), the computer device ( 1 a) can automatically detect all these authentication parameters without voluntary action on said device.

3. Method according to one of the preceding claims, wherein the authentication condition is a static condition, the selection of a parameter does not influence the other selected parameters.

4. Method according to one of the preceding claims, wherein the second group consists of at least one data selected from the following list: detecting a connection of the computer device (1 a) to a social network; detecting a connection of the computer device (1a) to the page of a specific friend or a specific person followed on a social network.

5. Method according to one of the preceding claims, wherein the second group consists of at least one data selected from the following list: integrated identifier in a SIM card of the computing device (1 a); identifier associated with the computer apparatus (1 a); SSID of a wifi network; detecting a Bluetooth connection between the computer apparatus (1a) and another electronic apparatus; identifier registered in an NFC or RFID tag; digital print ; retinal scan; iris recognition; detecting a connection between the computer apparatus (1a) and a proxy server; detecting a connection between the computer apparatus (1a) and a VPN server; IP address assigned to the computing device (1 a) when connected to a telecommunication network; MAC address of a network gateway.

6. Method according to one of the preceding claims, wherein the geo-location data of the computer apparatus (1 a) is selected by the user from an interactive map displayed on a graphical interface (13) of said apparatus.

7. Method according to one of the preceding claims, wherein the operating time range of the computer apparatus (1a) consists of one or more days of the week and a period of time.

8. Method according to one of the preceding claims, wherein the prior parameterization phase further comprises the following steps:

displaying, from a menu (130) accessible from a graphic interface (13) of the computing device (1 a), all the authentication parameters (A, B, C, D, ...., Z) ,

selecting, in the menu (130), authentication parameters from the set of authentication parameters displayed.

The method according to claim 8, wherein the logical operators are displayed in the menu (130) with all the authentication parameters (A, B, C,

D ...... Z).

10. Method according to one of the preceding claims, comprising a step of encrypting the authentication condition with a cryptographic algorithm.

A method according to claim 10, comprising encrypting the authentication condition with an AES key generated by the computing device (1a).

12. The method of claim 1 1, comprising a step of encrypting the AES key with a public RSA key generated by the computer server (S).

13. The method of claim 12, wherein the public RSA key is generated by the computer server (S) in response to a request transmitted by the website (S ').