WO2022135952A1

WO2022135952A1 - Method and device for generating authentication information for a secure entity and associated identity checking method and device

Info

Publication number: WO2022135952A1
Application number: PCT/EP2021/084945
Authority: WO
Inventors: Stéphane CAUCHIE; David Cossard
Original assignee: Idakto
Priority date: 2020-12-22
Filing date: 2021-12-09
Publication date: 2022-06-30
Also published as: FR3118225B1; FR3118225A1

Abstract

The invention relates to a trustworthy and reliable way of generating authentication information for a given secure entity having a given identifier on an authentication server that later allows an identity check, i.e. makes it possible to verify that the bearer of the secure entity is indeed the owner. The invention further relates to a trustworthy and reliable way of carrying out the identity check on an authentication server for a given secure entity having a given identifier by means of authentication information previously generated for said secure entity having said identifier.

Description

Method and device for generating authentication information for a secure entity and associated identity verification method and device

The invention relates to a method and a device for generating authentication information for a given secure entity having a given identifier and the associated identity control method and device.

[0002] The authentication of a user, in other words the verification of the identity of the user, makes it possible to ensure the legitimacy of a request and to confirm the identity of the user. Traditionally, authentication is performed by entering a password or a code such as a PIN code, also called "authentication code", on a particular authentication device. The use of such an authentication device requires that the user has a secure device storing the authentication code thereof and that this secure device verifies that the authentication code entered on the authentication conforms to the authentication code stored in the user's secure device.

[0003] The authentication code known to the user and stored in the secure device makes it possible first of all to create a link between the user and the secure device and secondly to ensure that the use of the secure device is made by its holder. This is particularly the case for smart cards, payment cards and building access badges.

[0004] However, some secure entities do not include means for storing confidential information of the holder of the secure entity such as an authentication code and/or do not include an authentication function for the bearer of the trusted entity. This is particularly the case for electronic passports or electronic residence permits, even if the latter comply with security standards such as the ICAO (International Civil Aviation Organization) standard, in particular the part relating to the security mechanisms of the ICAO standard (Doc 9303, Part 11).

[0005] Thus, the use of such secure entities does not make it possible to verify that the bearer of the secure entity is actually the holder of the secure entity.

The object of the invention is to remedy this drawback and to allow, on the one hand, the generation of authentication information for a given secure entity having a given identifier and, on the other hand, the identity check for a given secure entity having a given identifier by means of authentication information.

[0007] Thus, the subject of the invention is a method for generating authentication information for a given secure entity having a given identifier, implemented in an authentication server. The process includes the following steps: - Obtaining an authentication code for said given identifier;

- Obtaining security information from the secure entity having the given identifier comprising a generator element and a public key;

- generation of a session key from the authentication code, random data and the public key of the secure entity;

- generation of a secret key associated with said given identifier of the secure entity from the session key;

- generation of a public key associated with said identifier of the secure entity from said secret key and a generator element of the authentication server;

- generation of authentication information for the secure entity having said given identifier comprising said public key and a partial key generated from the random data and the generator element of the secure entity.

[0008] The session key can be obtained according to the static Diffie-Hellman cryptographic key exchange protocol.

[0009]According to a variant embodiment, the generating element of the secure entity and the generating element of the authentication server may respectively be generating points of an elliptical curve.

[0010]According to another variant embodiment, the generation of said secret key can be carried out from a derived key, the authentication code, random data and the generating element of said secure entity, the key derivative being calculated from a derivation function of the session key.

The invention also relates to an identity control method implemented in an authentication server for a given secure entity having a given identifier by means of authentication information previously generated for said secure entity having said given identifier,

- the authentication information comprising a public key associated with said identifier of said secure entity and a partial key,

- the partial key having been generated from random data generated by the authentication server and from a generator element of the secure entity,

- said public key being generated from a secret key associated with said given identifier of the secure entity and a generator element of the authentication server,

- said secret key being generated from a session key,

- the session key being generated from an authentication code for said given identifier, random data and a public key of the secure entity.

The process includes the following steps:

- Obtaining a new authentication code for said given identifier from an electronic device capable of communicating with the secure entity; - generation of a challenge from the new authentication code and the partial key stored in the authentication information;

- transmission of the challenge to the secure entity via the electronic device so that the secure entity generates a new secret key associated with said given identifier of the secure entity, said new secret key being used to sign an authentication message;

- Authentication of the signed authentication message by means of said public key stored in the authentication information.

[0012] The method may further comprise:

- a step of transmitting the authentication message to the electronic device and

- A step of receiving the signed authentication message, the authentication message having been signed by means of said new secret key generated by the secure entity.

[0013] Alternatively, the method may further comprise, after the challenge transmission step, the following steps:

- a step of receiving said new secret key generated by the secure entity;

- a step of signing the authentication message using said new secret key.

[0014] The session key can be obtained according to the static Diffie-Hellman cryptographic key exchange protocol.

[0015]According to a variant embodiment, the generating element of the secure entity and the generating element of the authentication server may respectively be generating points of an elliptical curve.

The invention also relates to a device configured to implement at least one of the methods described above.

We will now describe exemplary embodiments of the present invention with reference to the appended figures where the same references designate from one figure to another identical or functionally similar elements:

[0018] [Fig.l] illustrates an authentication system according to the invention.

[0019] [Fig 2] illustrates an embodiment of the method for generating authentication information for a given secure entity having a given identifier in accordance with the invention.

[0020] [Fig 3] illustrates a first embodiment of the identity check method according to the invention.

[0021] [Fig 4] illustrates a second embodiment of the identity check method according to the invention.

The present invention relates, according to a first aspect, to a safe and reliable way, the generation of authentication information for a given secure entity having a given identifier on an authentication server allowing subsequently an identity check, that is to say to verify that the bearer of the secure entity is actually the holder. The generation of authentication information is carried out in particular from an authentication code which will be associated with the given identifier and from security information of the given secure entity. Thus, the authentication information is generated so as to create a link between the given identifier and the given secure entity by means in particular of an authentication code. In particular, the invention relates to a procedure for generating authentication information for a given secure entity having a given identifier, implemented in an authentication server. A secure entity is for example an electronic passport or an electronic residence permit.

The present invention relates, according to a second aspect, to a safe and reliable way of carrying out the identity check on an authentication server for a given secure entity having a given identifier by means of authentication information previously generated for said secure entity having said identifier. Such an identity check makes it possible to verify that the bearer of the secure entity is indeed the holder. The identity check is carried out in particular on the basis of an authentication code which has been associated with the given identifier and security information of the given secure entity and by means of the authentication information previously generated for said trusted entity with the given identifier. Thus, it is made possible to verify the ownership of the secure entity by the bearer of the secure entity and in the presence of the latter, by means of an authentication code. In particular, the invention relates to an identity control method implemented in an authentication server for a given secure entity having a given identifier by means of authentication information previously generated for said secure entity having the identifier given.

Referring to Figure 1, there is described an authentication system comprising an authentication server capable of implementing all or part of the method of generating authentication information and / or the control method of identity in accordance with the invention.

The authentication system further comprises a secure entity ES and an electronic device DE. It may further comprise a server SERV-ES storing security information of a set of secure entities.

[0026] A secure entity ES is a secure space comprising an electronic chip, an ES-MEM storage space storing security information and means for executing an algorithm for calculating and exchanging cryptographic keys, such as the Diffie-Hellman algorithm. The secure entity is identified by means of an identifier ID.

[0027] The security information of the secure entity ES comprises in particular a generator element G and a public key sG, the latter being generated at the means of a transformation function f from the generator element G and a secret key s stored in the secure entity ES. The ES-MEM storage space is a secure space.

According to a first exemplary embodiment, the generator element G of the secure entity ES is a generator point of an elliptical curve CURVE 1, and the private key s of the secure entity ES is a key generated randomly at within an interval [1, n-1], n being an integer order of the generating point G. In addition, the public key sG is a public key calculated by elliptic curve according to the transformation function f. For example, the transformation function f executed to generate the public key sG is a function of multiplication of points of an elliptic curve, this multiplication being denoted by x. Thus, the public key sG can be generated by the multiplication function of the generator point G with the private key s: sG = s x G.

According to a second exemplary embodiment, the generator element G of the secure entity ES is a generator point, and the private key s of the secure entity ES is a key generated randomly within an interval [1 , n-1], n being an integer order of the generating point G. In addition, the public key sG is a public key calculated by discrete logarithm according to the transformation function f. For example, the transformation function f executed to generate the public key sG is a modular exponentiation function, this exponentiation being denoted ^A . Thus, the public key sG can be generated from the generating point G and the private key s in the following manner: sG= ^GA s modulo n.

[0030] The secure entity ES further comprises ES-DE connectivity means, in particular wireless communication means (for example, conforming to the Bluetooth standard, the NFC standard or the PC/SC standard) in order to be able to communicate with an electronic device DE.

[0031] The secure entity ES may further comprise a function for establishing a secure communication channel allowing the creation of a secure communication channel between the secure entity ES and the electronic device DE or the server. authentication SERV-AUTH. The establishment of a secure communication channel is based on the use of security protocols and allows the generation of a secret key shared between the two ends of the communication channel. The shared secret key is used by symmetric encryption mechanisms for the encryption and for the decryption of the data exchanged between the secure entity ES and the other end of the secure channel. In fact, this key must remain secret and shared only between the two ends of the communication channel, namely the secure entity ES and the electronic device DE or the authentication server SERV-AUTH. The function of establishing a secure communication channel is for example compliant with the PACE protocol.

[0032] According to a particular embodiment, the secret key shared between the two ends of the secure communication channel is made up of a plurality of keys, in particular a confidentiality key for encrypting the data and thus allowing communication of unencrypted data and an integrity key making it possible to verify the integrity of the encrypted data, in other words the integrity key will be used to demonstrate that the encrypted data has not been altered and that the data has not been encrypted by a malicious third party.

[0033] A secure entity ES is for example an electronic passport or an electronic residence permit.

According to a particular embodiment, the secure entity ES complies with the ICAO standard and in particular with the part relating to the security mechanisms of this standard (Doc 9303, Part 11) and integrates secure data into a specific memory of the ES secure entity chip. This secure data is write-protected and is organized in groups. In particular, the group labeled DG 14 in the ICAO specification contains at least one public key. Furthermore, the secure entity ES comprises a secure section in the memory of the chip used to store private keys which cannot be read or copied from the outside. In this particular embodiment, the generator element G and the public key sG are stored in the group entitled DG14 during the initialization of the secure entity.

The system may include a SERV-ES server storing security information from a set of secure entities. According to a particular embodiment, during the initialization of a secure entity ES having an identifier ID, at least part of the security information stored in the secure entity ES is also stored in the server SERV-ES, namely at least the generator element G and a public key sG, in order to make this public data accessible to particular entities, in particular to the authentication server SERV-AUTH. The security information is stored for example in a database MEM-ES.

The SERV-ES server storing security information from a set of secure entities further comprises SE-SERV connectivity means. The SE-SERV connectivity means of the SERV-ES server can comprise network communication means conforming to any one of the Ethernet standards, and/or conforming to any one of the IEEE 802.11 (Wifi) standards, and/or conforming to one or more mobile telephony standards (2G, 3G, 4G, etc.).

According to a particular embodiment, the server SERV-ES storing security information of a set of secure entities and the authentication server SERV-AUTH form the same server.

The electronic device DE can be any type of device, such as a mobile phone, a tablet, a computer, etc., comprising a hardware and software platform on which software runs, this software being either directly executable or interpreted on a virtual machine.

The electronic device DE comprises in particular a man-machine communication interface ITF-COM making it possible to display data and to receive data coming from the user. This man-machine communication interface ITF-COM comprises for example a screen and a keyboard, or a touch screen.

[0040] The electronic device DE may further comprise a function for establishing a secure communication channel allowing the creation of a secure channel between the electronic device DE and the secure entity ES and/or with the server. authentication SERV-AUTH. The establishment of a secure communication channel is based on the use of security protocols and allows the generation of a secret key shared between the two ends of the communication channel. The shared secret key is used by symmetric encryption mechanisms for the encryption and for the decryption of the data exchanged between the two ends of the communication channel. In fact, this key must remain secret and shared only between the two ends of the communication channel. The function of establishing a secure communication channel is for example compliant with the PACE protocol.

The electronic device DE is thus able to communicate with the secure entity ES by means of first DE-ES connectivity means with which the electronic device DE is provided. The first connectivity means DE-ES of the electronic device DE can allow network-type connectivity, either via a wired connection or via a wireless connection (for example, compliant with the Bluetooth standard, the NFC standard, the WIFI standard or the PC/SC standard).

The electronic device DE is also capable of communicating with an authentication server SERV-AUTH by means of second connectivity means DE-SERV with which the electronic device DE is provided. The second DE-SERV connectivity means of the electronic device DE can comprise network communication means conforming to any one of the Ethernet standards, and/or conforming to any one of the IEEE 802.11 (Wifi) standards, and/or conforming to one or more mobile telephony standards (2G, 3G, 4G, etc.).

According to one embodiment, the first connectivity means and the second connectivity means are implemented within the same connectivity device.

The authentication server SERV-AUTH comprising a hardware and software platform on which software runs, this software being either directly executable or interpreted on a virtual machine.

The authentication server SERV-AUTH may further comprise a function for establishing a secure communication channel allowing the creation of a secure channel between the authentication server SERV-AUTH and the secure entity ES and/or the electronic device DE. The establishment of a secure communication channel is based on the use of security protocols and allows the generation of a secret key shared between the two ends of the communication channel. The shared secret key is used by symmetric encryption mechanisms for the encryption and for the decryption of the data exchanged. The function of establishing a secure communication channel is for example compliant with the PACE protocol.

The authentication server SERV-AUTH is capable of generating authentication information INFO-AUTH for a given secure entity ES having a given identifier ID in accordance with the invention and capable of checking the identity of the bearer of the secure entity ES in accordance with the invention.

Thus, the authentication server SERV-AUTH is able to implement all or part of the process for generating authentication information INFO-AUTH and/or all or part of the identity check process having previously is the subject of an enrollment in accordance with the invention.

All or part of the INFO-AUTH authentication information generation process and/or all or part of the identity verification process can be implemented in software form and/or in the form of device(s) .

The embodiments of the authentication server SERV-AUTH described below are such that the authentication server SERV-AUTH is able to implement all or part of the procedure for generating authentication information and of the identity verification process. However, according to other embodiments, the authentication information generation method and the identity verification method can be implemented in separate servers.

The authentication server SERV-AUTH is able to communicate with an electronic device DE and if necessary a server SERV-ES storing security information from a set of secure entities, using connectivity means SERV- DE with which the authentication server SERV-AUTH is provided. The connectivity means SERV-DE of the authentication server SERV-AUTH may comprise network communication means conforming to any one of the Ethernet standards, and/or conforming to any one of the IEEE 802.11 (Wifi) standards, and /or compliant with one or more mobile telephony standards (2G, 3G, 4G, etc.).

The authentication server SERV-AUTH further comprises means for storing authentication information INFO-AUTH, for example a memory or a database MEM-AUTH.

The authentication server SERV-AUTH further comprises means for executing an algorithm for calculating and exchanging cryptographic keys, such as the static Diffie-Hellman algorithm. FIG. 2 illustrates an embodiment of the method for generating authentication information for a given secure entity ES having a given identifier ID in accordance with the first aspect of the invention. This process can also be called the enrollment process.

The identifier ID of the secure entity ES is for example a personal identifier of an individual, a group identifier to which the individual belongs or the identifier of the secure entity ES. Thus, the identifier ID can be an identification number or personal data such as a name, a telephone number, a date of birth.

The method begins for example with the acquisition on the electronic device DE by means for example of the human-machine communication interface ITF-COM, of an authentication code CODE-AUTH for the identifier ID ( step 210). This step is performed by entering the authentication code CODE-AUTH by the bearer of the secure entity ES having the identifier ID.

The authentication code CODE-AUTH for the identifier ID is then transmitted to the authentication server SERV-AUTH (step 215). The identifier ID can also be transmitted during this step.

Step 215 is followed by a step 220 of obtaining by the authentication server SERV-AUTH the authentication code CODE-AUTH associated with the given identifier ID. This step 220 of obtaining the authentication code CODE-AUTH for the identifier ID is performed, according to this embodiment, by receiving the authentication code CODE-AUTH.

According to another embodiment, the step of acquiring an authentication code CODE-AUTH for the identifier ID is performed directly on the authentication server SERV-AUTH. In this embodiment, the step 220 of obtaining the authentication code CODE-AUTH for the identifier ID is carried out by acquiring the authentication code CODE-AUTH for the given identifier ID on the server authentication SERV-AUTH.

According to yet another embodiment, step 220 for obtaining the authentication code CODE-AUTH for the identifier ID consists of the generation by the authentication server SERV-AUTH of an authentication code. authentication CODE-AUTH.

Step 220 is followed by a step 225 of requesting security information belonging to the secure entity ES having the identifier ID, performed by the authentication server SERV-AUTH. This step is, for example, carried out by sending this request to the server SERV-ES storing security information of a set of secure entities.

In response, the server SERV-ES storing security information from a set of secure entities will transmit security information, namely the generator element G and the public key sG of the secure entity ES having the identifier ID, to the authentication server SERV-AUTH (step 230). Step 230 is followed by a step 235 of obtaining by the authentication server SERV-AUTH the generator element G and the public key sG of the secure entity ES having the identifier ID. This step is carried out in particular by receiving a message from the server SERV-ES storing security information for a set of secure entities, containing the generator element G and the public key sG of the secure entity ES having the identifier ID.

Step 235 is followed by a step 240 of generating random data r by the authentication server SERV-AUTH, random data r being formed of a string of bits.

Step 240 is followed by a step of generation by the authentication server SERV-AUTH of a session key KS from the authentication code CODE-AUTH, the random datum r and the public key sG of the secret entity ES (step 245).

The step of generating a session key KS is for example carried out according to the static Diffie-Hellman cryptographic key exchange protocol.

According to one embodiment, the step of generating the session key KS comprises a first step of generating a temporary key CAr generated from the authentication code CODE-AUTH and from the random datum r at the means of a calculation function h. The calculation function h is for example a scalar multiplication function. Thus, for example, the temporary key CAr is generated as follows: CAr = CODE-AUTH x r.

The session key generation step then includes a second step enabling the generation of the session key by applying the transformation function f from the temporary key CAr and the public key sG of the entity secure ES.

According to the first embodiment in which the public key sG is a public key calculated by elliptic curve, the transformation function f is the multiplication function of elliptic curve points. For example, the session key KS is generated as follows: KS = CAr x sG.

According to the second embodiment in which the public key sG is a public key calculated by discrete logarithm, the transformation function f is the modular exponentiation function. For example, the session key KS is generated as follows KS = sG ^A CAr modulo n.

Step 245 is followed by a step 250 of generating a secret key LKs associated with said given identifier ID of the secure entity ES in the authentication server SERV-AUTH, from the session key KS.

According to a particular embodiment, the secret key LKs is also generated from the temporary key CAr and from the generator element G of the secure entity ES.

According to an exemplary embodiment of this embodiment, the generation of the secret key LKs associated with said given identifier ID of the secure entity ES includes a prior step of generating a derived key KMAC from at least the session key KS. Such a step of generating a derived key KMAC can be performed from a key derivation function KDF which derives the session key KS using a pseudo-random function. The key derivation function is used in particular to strengthen the session key KS. In particular, when the session key KS is a point of an elliptic curve, the key derivation function KDF can be applied only on the abscissa value of the session key KS, or on a value obtained by the concatenation the abscissa value and the ordinate value of the session key KS.

According to this example embodiment, the secret key LKs associated with the given identifier ID of the secure entity ES is generated by applying a MAC cryptographic function, on the one hand from the derived key KMAC, and from the other part of the result of the transformation function f applied to the temporary key CAr and the generator element G received from the secure entity ES. The transformation function f is for example an elliptic curve point multiplication function or a modular exponentiation function. According to a particular embodiment, the cryptographic function MAC can be a hash function. A hash function is a non-injective function which, starting from data of arbitrary size and often of large size, will return a value of limited or fixed size. Such a function is in particular the SHA-384 function.

Step 250 is followed by a step 255 of generating a public key LKp associated with the given identifier ID of the secure entity ES from the secret key LKs associated with the given identifier ID of the secure entity ES and a generating element G' of the authentication server SERV-AUTH.

In particular, the public key LKp associated with the given identifier ID of the secure entity ES is generated by applying the transformation function f from the secret key LKs associated with the given identifier ID of the entity secure ES and the generating element G' of the authentication server SERV-AUTH.

According to an exemplary embodiment, the generating element G′ is a generating point of an elliptical curve COURBE2 chosen by the authentication server SERV-AUTH. The elliptical curve COURBE2 of the generating point G' of the authentication server SERV-AUTH can be the same elliptical curve or can be different from the elliptical curve CURVE 1 of the generating point G of the secure entity ES. According to this embodiment, the public key LKp associated with the given identifier ID of the secure entity ES is a public key calculated by elliptic curve. The transformation function f executed to generate the public key LKp associated with the given identifier ID of the secure entity ES is then a multiplication function of elliptical curve points. For example, the public key LKp is generated as follows: LKp = LKs x G'. According to another embodiment, the generating element G′ is a generating point defined for the authentication server SERV-AUTH. According to this embodiment, the public key LKp associated with the given identifier ID of the secure entity ES is a public key calculated by discrete logarithm. The transformation function f executed to generate the public key LKp associated with the given identifier ID of the secure entity ES is then a modular exponentiation function. For example, the public key LKp is generated as follows: LKp = G' ^A LKs modulo n.

The various steps executed by the authentication server SERV-AUTH therefore make it possible to generate a pair of asymmetric keys, namely the private key LKs and the public key LKp associated with the given identifier ID of the secure entity ES .

The private key LKs and the public key LKp associated with the given identifier ID of the secure entity ES are generated from security information of the secure entity ES and an authentication code CODE- AUTH associated with a given identifier ID so that a link is created between the authentication code CODE-AUTH and the secure entity ES without the latter memorizing the authentication code CODE-AUTH. In other words, a link is created between the bearer and holder of the secure entity ES and the secure entity ES, thus making it possible later to verify that the bearer of the secure entity ES is indeed the holder of the secure entity ES .

Step 255 is followed by a step of generation by the authentication server SERV-AUTH of a partial key rG from the random datum r and the generator element G of the secure entity ( step 260).

In particular, the partial key rG is generated by applying the transformation function f from the random datum r and from the generator element G of the secure entity. For example, the transformation function f executed to generate the partial key rG is an elliptic curve point multiplication function. For example, the partial key rG is generated as follows: rG=rx G. According to another example, the transformation function f executed to generate the partial key rG is a modular exponentiation function. For example, the partial key rG is generated as follows: rG = G ^A r modulo n.

Step 260 is followed by a step 265 of generating authentication information INFO-AUTH for the secure entity ES having the given identifier ID comprising the public key LKp associated with the given identifier ID of the secure entity ES and partial key rG.

The INFO-AUTH authentication information for the secure entity ES having the identifier ID is then stored in a memory or in a database, for example in the memory or the MEM-AUTH database of the server d authentication SERV-AUTH (step 270).

[0084] Thus, the INFO-AUTH authentication information does not store the private key LKs associated with the given identifier ID of the secure entity ES so that even if the INFO-AUTH authentication information is stolen by a malicious person, this person cannot pretend to be the person holding the secure entity ES.

Certain steps of the method for generating authentication information described on the basis of FIG. 2 can be carried out in a different order.

FIG. 3 illustrates an embodiment of the identity check method implemented in an authentication server SERV-AUTH for a given secure entity ES having a given identifier ID by means of authentication information INFO -AUTH previously generated for said secure entity ES having said given identifier ID, in accordance with the second aspect of the invention.

The INFO-AUTH authentication information has been generated, for example, by means of the method for generating authentication information described previously with regard to Figure 2. For the given identifier ID, it comprises a public key LKp associated with the given identifier ID of a given secure entity ES, and a partial key rG.

The INFO-AUTH authentication information is stored in a memory or a database, for example on the authentication server.

According to a particular embodiment, the method begins with an optional step of creating a secure communication channel between the secure entity ES and the authentication server SERV-AUTH (step 310). This communication channel is created using a protocol for creating a secure communication channel such as the PACE protocol. Furthermore, this step includes the creation of a secret key K shared between the authentication server SERV-AUTH and the secure entity ES. The creation of a secret key K can be carried out by means of the Diffie-Hellman protocol.

According to another embodiment, the creation of the secure communication channel between the secure entity ES and the authentication server SERV-AUTH and the creation of a secret key K are carried out prior to the implementation of the identity control method implemented by the authentication server SERV-AUTH.

At the end of step 310, the electronic device DE obtains from the bearer of the secure entity ES having the identifier ID, a new authentication code CODE-AUTH' for the identifier ID (step 315 ). The new authentication code CODE-AUTH' is entered on the electronic device DE for example by means of its man-machine communication interface ITF-COM.

The new authentication code entered CODE-AUTH' for the identifier ID is then transmitted to the authentication server SERV-AUTH (step 320). The identifier ID can also be transmitted during this step.

[0093] According to a particular embodiment, the new authentication code CODE-AUTH' is encrypted before being transmitted to the authentication server SERV-AUTH.

Step 320 is followed by a step 325 of obtaining by the authentication server SERV-AUTH the new authentication code CODE-AUTH' for the given identifier ID coming from the electronic device DE. This step is carried out in particular by receiving the new authentication code CODE-AUTH' for the given identifier ID transmitted by the electronic device DE.

After obtaining the new authentication code CODE-AUTH', the authentication server SERV-AUTH obtains the authentication information INFO-AUTH associated with the secure entity ES having the identifier ID (step 330). This step is notably carried out by obtaining authentication information stored in the memory of the authentication server SERV-AUTH or in a database storing authentication information.

Step 330 is followed by a step 335 of generation by the authentication server SERV-AUTH, of a challenge CHA from the new authentication code CODE-AUTH' and the partial key rG stored in INFO-AUTH obtained authentication information.

According to one embodiment, the challenge CHA is generated by applying the transformation function f from the new authentication code CODE-AUTH' and from the partial key rG stored in the authentication information INFO-AUTH.

According to the first exemplary embodiment in which the partial key rG is a partial key calculated by elliptic curve, the transformation function f is a multiplication function of elliptic curve points. For example, the challenge CHA is generated as follows: CHA = CODE-AUTH' x rG.

According to the second embodiment in which the partial key rG is a partial key calculated by discrete logarithm, the transformation function f is the modular exponentiation function. For example, the challenge CHA is generated as follows: CHA = rG ^A CODE-AUTH' modulo n.

The following steps consist of the transmission of the challenge CHA to the secure entity ES via the electronic device DE so that the secure entity ES generates a new secret key LKs' associated with the given identifier ID of the secure entity ES, the new secret key LKs' associated with the given identifier ID of the secure entity ES being used to sign an authentication message MSG-AUTH.

Thus, step 340 is a step for transmitting the challenge CHA from the authentication server SERV-AUTH to the secure entity ES via the electronic device DE. This step is carried out by sending a first message transmitting the challenge CHA from the authentication server to the electronic device DE and by sending a second message transmitting the challenge CHA from the electronic device DE to the secure entity ES.

[0102] The CHA challenge can be used for the generation of a secure communication channel, using a protocol for creating a secure communication channel such as the chip authentication protocol.

Step 340 is followed by a step 345 of generation of a new session key KS′ by the secure entity ES, from the challenge CHA and the secret key s of the secure entity ES.

The step of generating a new session key KS′ is for example carried out according to the static Diffie-Hellman cryptographic key exchange protocol.

According to one embodiment, the new session key KS′ is generated by applying the transformation function f from the challenge CHA and the secret key s of the secure entity ES.

According to the first exemplary embodiment in which the challenge CHA was calculated by elliptic curve, the transformation function f is a multiplication function of elliptic curve points. For example, the new session key KS' is generated as follows: KS' = s x CHA.

According to the second exemplary embodiment in which the challenge CHA was calculated by discrete logarithm, the transformation function f is a modular exponentiation function. For example, the new session key KS' is generated as follows: KS' = CHA ^A s modulo n.

Step 345 is followed by a step 350 of generation in the secure entity ES, of a new secret key LKs' associated with the given identifier ID of the secure entity ES, from the new session key KS'.

According to a particular embodiment, the new secret key LKs′ is also generated from the challenge CHA received.

According to an exemplary embodiment of this embodiment, the generation of the new secret key LKs' associated with said given identifier ID of the secure entity ES follows a step of generating a new derived key KMAC from at least of the new session key KS'. Such a step of generating a derived key KMAC is for example generated from a key derivation function KDF which derives the new session key KS′ using a pseudo-random function. In particular, when the new session key KS' is a point of an elliptic curve, the key derivation function KDF can be applied only on the abscissa value of the new session key KS', or on a value obtained by the concatenation of the abscissa value and the ordinate value of the new session key KS'.

According to this embodiment, the new secret key LKs' associated with the given identifier ID of the secure entity ES is generated by applying a cryptographic function MAC, on the one hand from the new derived key KMAC, and on the other hand the CHA challenge. The transformation function f is for example an elliptic curve point multiplication function or a modular exponentiation function. According to a particular embodiment, the cryptographic function MAC can be a hash function. Such a function is in particular the SHA-384 function.

Step 350 is followed by a step 355 of transmission by the secure entity ES to the electronic device DE, of the new secret key LKs' associated with the given identifier ID of the secure entity ES.

Step 355 is followed by a step 360 of generation of an authentication message MSG-AUTH by the authentication server SERV-AUTH. The authentication message MSG-AUTH is in particular a message to be signed or data to be signed.

Step 360 is followed by a step 365 of sending the authentication message MSG-AUTH by the authentication server SERV-AUTH to the electronic device DE.

Step 365 is followed by a step 370 of signing the MSG-AUTH authentication message by the electronic device DE, from the new secret key LKs' associated with the given identifier ID of the entity secure ES.

The signature of the authentication message MSG-AUTH is for example carried out using a public key digital signature algorithm such as the ECDSA algorithm.

Step 370 is followed by a step 375 of transmission by the electronic device DE to the authentication server SERV-AUTH, of the signed authentication message MSG-AUTH.

Following receipt of the signed MSG-AUTH authentication message from the electronic device DE by the authentication server SERV-AUTH (step 380), the latter performs the authentication of the identifier ID by means of the message sign MSG-AUTH and the public key LKp linking the given identifier ID and the secure entity ES stored in the authentication information INFO-AUTH (step 385).

This authentication makes it possible to determine that the new authentication code entered by the bearer of the secure entity ES corresponds to the authentication code CODE-AUTH used for the generation of the authentication information INFO-AUTH and therefore that the holder of the secure entity ES is actually its holder.

In other words, the authentication server storing authentication information INFO-AUTH is able to verify that the bearer of a secure entity ES is actually the holder of the secure entity ES by means of the code authentication code CODE-AUTH held by the bearer of the secure entity ES and of the secure entity ES.

The invention also has the advantage that even if a malicious third party obtains the INFO-AUTH authentication information, without the secure entity ES, this authentication information cannot be exploited.

[0122] The steps of the identity check method described on the basis of FIG. 3 can be carried out in a different order.

FIG. 4 illustrates an alternative embodiment of the identity check method implemented in an authentication server SERV-AUTH for a secure entity having a given identifier ID by means of authentication information INFO-AUTH previously generated for said secure entity having said given identifier ID, in accordance with the second aspect of the invention.

We will describe in detail below only the steps which differ from those of the embodiment described in the support of Figure 3. For the rest, reference is made to the embodiment described in the support of Figure 3.

In this variant embodiment, the steps 365 to 380 previously described on the support of figure 3 are replaced by the steps 455 to 470 which will now be described on the support of figure 4.

The step 350 of generation in the secure entity ES, of a new secret key LKs' associated with the given identifier ID of the secure entity ES, described previously in support of FIG. 3, is followed by 'a step 455 of transmission of the new secret key LKs', from the secure entity ES to the authentication server SERV-AUTH via the electronic device DE. This step is performed by sending a first message transmitting the new secret key LKs' of the secure entity ES to the electronic device DE and by sending a second message transmitting the new secret key LKs' of the electronic device FROM to authentication server SERV-AUTH.

Step 455 is followed by a step 460 of receipt by the authentication server of the new secret key LKs' generated by the secure entity.

Step 460 is followed by a step 465 of generation of an authentication message MSG-AUTH by the authentication server SERV-AUTH. The authentication message MSG-AUTH is in particular a message to be signed or data to be signed.

[0129] Step 465 is followed by a step 470 of signing the authentication message MSG-AUTH by the authentication server SERV-AUTH, from the new secret key LKs' associated with the given identifier ID of the secure entity ES.

[0131] Step 440 is followed by step 385 of authentication of the identifier ID by means of the signed MSG-AUTH authentication message and the public key LKp linking the given identifier ID and the secure entity ES stored in the INFO-AUTH authentication information previously described in Figure 3.

Claims

[Claim 1] Method for generating authentication information (INFO-AUTH) for a given secure entity (ES) having a given identifier (ID), implemented in an authentication server (SERV-AUTH), the process is characterized in that it comprises the following steps:

- obtaining an authentication code (CODE-AUTH) for said given identifier (ID) (step 220);

- Obtaining security information from the secure entity (ES) having the given identifier (ID) comprising a generator element (G) and a public key (sG) (step 235);

- generation of a session key (KS) from the authentication code (CODE-AUTH), random data (r) and the public key (sG) of the secure entity (step 245);

- generation of a secret key (LKs) associated with said given identifier (ID) of the secure entity (ES) from the session key (KS) (step 250);

- generation of a public key (LKp) associated with said identifier (ID) of the secure entity (ES) from said secret key (LKs) and a generator element (G') of the authentication server (SERV -AUTH) (step 255);

- generation of authentication information (INFO-AUTH) for the secure entity (ES) having said given identifier (ID) comprising said public key (LKp) and a partial key (rG) generated from the random data (r ) and the generator element (G) of the secure entity (ES) (step 270).

[Claim 2] Method according to the preceding claim, characterized in that the session key (KS) is obtained according to the static Diffie-Hellman cryptographic key exchange protocol.

[Claim 3] Method according to one of the preceding claims, characterized in that the generating element (G) of the secure entity (ES) and the generating element (G') of the authentication server (SERV-AUTH ) are respectively generating points of an elliptic curve.

[Claim 4] Method according to one of the preceding claims, characterized in that the generation of the said secret key (LKs) is carried out from a derived key (KMAC), the authentication code (CODE-AUTH), of the random datum (r) and of the generating element (G) of said entity (ES), the derived key (KMAC) being calculated from a session key (KS) derivation function.

[Claim 5] Identity control method implemented in an authentication server (SERV-AUTH) for a given secure entity (ES) having a given identifier (ID) by means of authentication information (INFO- AUTH) previously generated for said secure entity having said given identifier (ID),

- the authentication information (INFO-AUTH) comprising a public key (LKp) associated with said identifier (ID) of said secure entity (ES) and a partial key (rG),

- the partial key (rG) having been generated from random data (r) generated by the authentication server (SERV-AUTH) and from a generator element (G) of the secure entity (ES),

- said public key (LKp) being generated from a secret key (LKs) associated with said given identifier (ID) of the secure entity (ES) and a generator element (G') of the authentication server ( SERV-AUTH),

- said secret key (LKs) being generated from a session key (KS),

- the session key (KS) being generated from an authentication code (CODE-AUTH) for said given identifier (ID), random data (r) and a public key of the secure entity (sG), the method comprises the following steps:

- Obtaining a new authentication code (CODE-AUTH') for said given identifier (ID) originating from an electronic device (DE) able to communicate with the secure entity (ES) (step 325);

- Generation of a challenge (CHA) from the new authentication code (CODE-AUTH') and the partial key (rG) stored in the authentication information (INFO-AUTH) (step 335);

- transmission of the challenge (CHA) to the secure entity (ES) via the electronic device (DE) so that the secure entity (ES) generates a new secret key (LKs') associated with said given identifier (ID) of the secure entity (ES), said new secret key (LKs') being used to sign an authentication message (MSG-AUTH) (step 340); - authentication of the authentication message (MSG-AUTH) signed by means of said public key (LKp) stored in the authentication information (INFO-AUTH).

[Claim 6] Method according to the preceding claim, characterized in that the method further comprises:

- a step of transmitting the authentication message (MSG-AUTH) to the electronic device (DE) (step 365) and

- a step of receiving the signed authentication message (MSG-AUTH), the authentication message (MSG-AUTH) having been signed by means of said new secret key (LKs') generated by the secure entity (ES) (step 380).

[Claim 7] Method according to claim 5, characterized in that the method further comprises, after the challenge transmission step (CHA), the following steps:

- a step of receiving said new secret key (LKs') generated by the secure entity (ES) (step 460);

- a step of signing the authentication message (MSG-AUTH) using said new secret key (LKs') (step 470).

[Claim 8] Method according to any one of Claims 5 to 7, characterized in that the session key (KS) is obtained according to the static Diffie-Hellman cryptographic key exchange protocol.

[Claim 9] Method according to any one of Claims 5 to 8, characterized in that the generating element (G) of the secure entity (ES) and the generating element (G') of the authentication server ( SERV-AUTH) are respectively generating points of an elliptical curve.

[Claim 10] Apparatus configured to implement the method according to any one of claims 1 to 4 or the method according to any one of claims 5 to 9.