EP2213038A1

EP2213038A1 - Information system and method of identifying a user by an application server

Info

Publication number: EP2213038A1
Application number: EP08786974A
Authority: EP
Inventors: Dominique Bourret; Jérémie NOWAK
Original assignee: FIDALIS
Current assignee: FIDALIS
Priority date: 2007-08-08
Filing date: 2008-08-07
Publication date: 2010-08-04
Also published as: WO2009019298A1; US20120005474A1; FR2919974B1; FR2919974A1

Abstract

The present invention relates to an information system and a method for the identification, by an application server (2), of a user in possession of a terminal (6) having the use of communication means for effecting a connection between the server (2) and the terminal (6) and of a hardware element (8), connected to the terminal (6), comprising data storage means on which is stored an encrypton key (K1) and an identification number (num_ID), in which the server (2) generates a unique session number (num_Sess) in the course of a connection session between the terminal (6) and the server (2), the terminal communicates the session number (num_Sess) to the hardware element (6), the hardware element (6) effects an encryption (E) with the aid of an encryption key (K1) of a data set combining: the password (num_MDP) and the session number (num_Sess), and communicates the result (C) of the encryption to the terminal (6), the hardware element (8) also transmits the identification number (num_ID) to the terminal (6), the terminal (6) transmits the result of the encryption (C) and the identification number (num_ID) to the server (2) with a view to carrying out the identification of the user.

Description

Information system and method of identification by an application server of a user

The present invention relates to an information system and a method of identifying a user accessing an information system.

When a user uses a computer to access a service on a communication network, for example the Internet, hosted by a computer server, it is desirable that the server can identify that user. In particular, it is desirable for the server to know if it is not an automatic program that attempts to impersonate a user.

This problem arises, for example, in the case of e-mail consultation on the Internet and in the registration of an order on a commercial site.

It is known for this identification to use passwords. Thus, the user must enter a password and the server confirms in response if this password is correct. The user and the server both know this secret information and the server requests it each time a user wishes to access a service.

However, if a third party has access to the server information and gets the list of passwords, the security of the system is called into question.

In addition, access to the password may be possible by a third party on the user's computer. Indeed, the passwords that must be retained by the user are often stored on his computer, for example in an internet browser. In addition some passwords are transmitted in clear. It should be noted that it is possible to dispense with the storage of passwords on the server. Indeed, the server does not need to memorize the passwords: it must just be able to distinguish a correct password. For example, the server uses a one-way function that is applied to the password. The result of the function on a particular password is stored. At each identification:

- the password is presented to the server,

the server applies the one-way function of the password, and

- The server compares the result of this calculation to that it has in memory to identify the user. The list of results of the application of the one-way function on the passwords is unusable because this function has the property of being very difficult to reverse.

This protocol is known to have significant security vulnerabilities. Indeed, when the password is presented to the system that transmits it to the server, anyone who has access to data on the link between the point of entry and the server can read it.

Known software means, such as HTTPS and SLL / SSH or virtual private networks, make it possible to secure the transfer of data from the user's computer to the server. However, these means do not allow authentication of the user.

It is also known to use public / private or secret key cryptography mechanisms.

In the secret key mechanism, an exchange of secret keys is performed using public and private key pairs. The secret key has a limited duration of use for the session and is used to encrypt data. The main disadvantage of secret key mechanisms is that the same key is manipulated by both parties. If one of them is broadcast, the security of the system is questioned. Public key / private key cryptography solves this problem. The server manages a file containing the public keys of each user. Each user has a private key. The logon protocol proceeds as follows:

1. The server sends a randomly generated session number or pseudo randomly

2. The user encrypts this number with his private key and sends the result with his identification number to the server.

3. The server uses the public key of the user who is in the database and decrypts the message. 4. If the result obtained is the same as the one the server sent, the server knows that it is the user identified by the identification number.

If the private key of the user remains confidential, no one can impersonate him. The user never transmits his private key when connecting to the server. Nobody can obtain information that allows them to determine the private key of the user. This technique uses a private key that can be long and difficult to memorize by the user. This will be manipulated by the user's software and hardware.

Under these conditions, neither the server nor the communication channel between the user's computer need to be secure. However, it appears that the personal computer or the terminal that allows the user to connect to the communication network must be secure because this computer manipulates the private key.

In addition, there are opportunities for discovery of the private key by a third party implementing an algorithm based on the use of random numbers.

The present invention aims to solve all or part of the disadvantages mentioned above by providing a system for enhancing security in the identification of a user without requiring securing the user's terminal. For this purpose, the present invention relates to an information system comprising:

a computer server comprising network communication means,

at least one terminal comprising network communication means, the terminal being intended to be used by a user to make a connection to the server, characterized in that the system further comprises a hardware element arranged to be connected to the terminal, the hardware element comprising data storage means arranged to store an encryption key and an identification number, in that the server is arranged to generate a unique session number during a connection session between the terminal and the server, and for communicating the session number to the terminal, the terminal being arranged to communicate the session number to the hardware element and in that the hardware element comprises processing means arranged to perform encryption with the aid of the encryption key of a set of data combining:

- a password of the user, and the session number, and arranged to transmit the result of the encryption constituting an encrypted password and the identification number to the terminal, the terminal being arranged to transmit the encrypted password and the identification number to the server in order to to proceed to the identification of the user.

Thanks to the arrangements according to the invention, a hardware element external to the terminal is used to present the password of the user in a different form to each communication session, using the uniqueness of the session numbers. The hardware element assigned to the user identifies it with the information system.

Messages containing transmitted passwords will never be twice the same if the session numbers are different each time.

Thus, the information circulating on the information network is difficult to interpret because their content is different with each communication. Moreover, no secret information is stored on the user's terminal. As a result, the security of the entire system is improved.

According to one embodiment, the password is stored on the data storage means of the hardware element.

The hardware element is used to store a password outside the terminal, which increases the security of the system.

According to another embodiment, the terminal comprises means for entering the password by the user and is arranged to communicate the password to the hardware element.

Advantageously, the server is arranged to communicate a unique session number in response to the provision of an identification number by the hardware element.

According to one embodiment, the server is arranged to perform encryption by a session number encryption key into an encrypted session number and to communicate the encrypted session number to the terminal, the terminal being arranged to communicate the session number. encrypted to the hardware element, the processing means of the hardware element being arranged to perform a decryption of the session number encrypted into a session number by the encryption key stored in the storage means. Advantageously, the server is arranged to perform a decryption of the encrypted password by means of a decryption key corresponding to the encryption key stored in the storage means of the hardware element, to obtain the values of the password and the number session.

According to one embodiment, the server is arranged to compare the session number from the encrypted password with the one it has generated, and then to compare the result of the application of a hash function on a combination of data. including the password with a predetermined value.

Advantageously, the password and the identification number form a unique pair of information in the system.

Advantageously, the hardware element comprises means for generating a random sequence, the processing means being arranged to perform a first encryption of a set of data combining:

- the random sequence, and

the identification number of the user, and arranged to transmit a first data frame comprising the result of the first encryption to the terminal, the terminal being arranged to transmit this first data frame to the server, the server being arranged to perform the decrypting the first data frame and then a second encryption of a data set combining:

- the random sequence, and - a session number, and

a server identification number and for transmitting a second data frame comprising the result of this second encryption to the terminal, the terminal being arranged to transmit this second data frame to the hardware element. These provisions make it possible to perform mutual authentication of the server and the user before transmitting critical data. Thus the hardware element has the ability to determine to which recipient server the password is sent. For this, it launches a "challenge" to the server, to determine if it is connected to a specific server. Preferentially, two pairs of private keys and public keys are used respectively for the encryption and the decryption of a first and a second data exchange between the server and the hardware element

Advantageously, several random sequences and / or several session numbers are generated by the hardware element or the server for successive data exchanges for the identification of a user.

Preferably, the means for generating a random sequence of the hardware element are arranged to take into account the occurrence of a random event. The random events taken into account by the random sequence generation means include interruptions signaling the arrival of new information to the hardware element from the terminal.

These provisions make it possible to generate random sequences from a simple hardware element, in particular of the USB key type, whose behavior, and in particular that of its microprocessor, is deterministic. The present invention also relates to a method of identification by a computer server of a user in possession of a terminal having communication means for making a connection between the server and the terminal and a hardware element, connected to the terminal, comprising data storage means on which is stored an encryption key and an identification number, in which

the server generates a unique session number during a connection session between the terminal and the server,

the terminal communicates the session number to the hardware element; the hardware element performs an encryption using an encryption key of a data set combining: the password and the session number; and communicates the result of the encryption to the terminal,

the hardware element also transmits the identification number to the terminal, the terminal transmits the result of the encryption and the identification number to the server in order to proceed to the identification of the user.

According to one embodiment of the method, the password is stored on the data storage means of the hardware element.

According to another mode of implementation of the method, the password is entered by the user on the terminal and communicated to the hardware element by the terminal. Advantageously, the server communicates a unique session number in response to the provision of an identification number by the hardware element.

According to one embodiment of the method, the server encrypts the session number with an encrypted session number and communicates the encrypted session number to the terminal, the terminal communicating the encrypted session number to the encrypted session number. the hardware element, the means for processing the hardware element performing a decryption of the session number encrypted into a session number by the encryption key stored in the storage means.

Advantageously, the server performs a decryption of the encrypted password by means of a decryption key corresponding to the encryption key stored in the storage means of the hardware element, to obtain the values of the password and the session number. In one embodiment, the server compares the session number from the encrypted password with the one it generated, and compares the result of applying a hash function to a combination of data including the password with a predetermined value. Advantageously, the password and the identification number form a unique pair of information.

Advantageously, the hardware element generates a random sequence, performs a first encryption of a set of data combining: the random sequence, and

the identification number of the user, and transmits a first data frame corresponding to the result of the encryption to the terminal which transmits this first data frame to the server, the server realizing a decryption of the first data frame and then a second encryption a dataset combining:

- the random sequence, and

- a session number, and

- a server identification number and transmitting a second data frame corresponding to the result of this second encryption to the terminal, the terminal transmitting this second data frame to the hardware element.

Preferably, two pairs of private keys and public keys are used respectively for the encryption and decryption of a first and a second data exchange between the server and the hardware element.

Advantageously, several random sequences and / or several session numbers are generated for successive data exchanges for the identification of a user.

Preferentially, the generation of a random sequence takes into account the occurrence of a random event.

Advantageously, the random events taken into account during the generation of random sequences include interrupts signaling the arrival of new information to the hardware element from the terminal.

Preferably, at least one data frame exchanged between the hardware element and the terminal comprises both a random sequence generated by the hardware element and a session number generated by the server. In any case, the invention will be better understood with the aid of the description which follows, with reference to the appended schematic drawing showing, by way of non-limiting example, an embodiment of the system according to the invention.

Figure 1 is a schematic representation of a system according to the invention.

Figure 2 is a schematic representation of a first embodiment of a method according to the invention.

Figure 3 is a schematic representation of a second embodiment of a method according to the invention. Figure 4 is a schematic representation of a third embodiment of a method according to the invention.

Figure 5 is a schematic representation of a fourth embodiment of a method according to the invention.

FIG. 6 is an explanatory diagram of the operation of the means for generating a random sequence by a hardware element included according to a variant of the system according to the invention. As represented in FIG. 1, an information system according to the invention comprises:

an application server 2 comprising network communication means 3 enabling it to connect to a network 4, and data storage means, for example constituted by a database 5,

at least one terminal 6 comprising network communication means 7 enabling it to be connected to the network 4 intended to be used by a user. The system further comprises a hardware element 8 arranged to be connected to the terminal, this element 8 being in the possession of the user.

The hardware element 8 may take the form of a USB key, a smart card or a processor that can be used in the production of a barcode reader or electronic tags, for example. This hardware element 8 comprises data storage means 9, and processing means 10 arranged in particular for performing data encryption operations from a secret private key K1. The terminal 6 may for example be constituted by a personal computer of the user who has an Internet connection allowing him to connect to the application server. A client software 12 is installed on this computer which controls the exchanges between the hardware element, the computer and the server.

Before supplying the hardware element 8 to the user, or during an initialization operation of the hardware element 8, a private key K1, a password num_MDP and an identification number numJD are generated and registered. in the storage means of the hardware element.

The identification number numJD is a number that will be visible in clear during different operations. The password num_MDP is intended to remain secret. The equipment performing this operation ensures that the public key K2 corresponding to the private key K1 of the user is stored by the server 2.

The password MOP_num and the identification number must be able to be recognized by the server 2. For this, by using a one-way hash function H, a fingerprint numJHID, or hash value of fixed length is calculated from the concatenated identification number with the password: numJHID = H (num_ID; num_MDP).

The hash function H has the property of making it difficult to calculate numJD and num_MDP from the fingerprint. Moreover, it is difficult to find another set of data M 'such that num_HID = H (M'). The hash function is used to check the validity of the password without having to memorize it.

The server 2 stores the pair num_HID and numJD in the database 5.

The hardware element 8 is provided to the user who can then connect it to a terminal 6 of his choice, equipped with the client software 12, to connect to the server 2.

When connected to the server, the information system uses a password presentation protocol that follows the following steps:

In a first step E1, the hardware element 8 transmits its identification number numJD to the client software 12 installed on the computer 6 of the user. In a second step E2, the identification number numJD is transmitted to the server 2 in a request for a session number.

In a third step E3, a session number num_Sess is generated by the server 2. The server 2 transmits this session number num_Sess to the computer 6 of the user. The server can also store the identification number numJD of the user for whom the session number num_Sess was generated.

In a fourth step E4, the user's computer transmits the session number num_Sess to the hardware element 8.

In a fifth step E5, the processing means 10 of the hardware element 8 concatenate the password num_MDP and the session number num_Sess, then perform an encryption E using the private key K1, to obtain a result C :

E _K i (num_MDP; num_Sess) = C and sends the result C which we will call a password C signed to the client software 12. In a sixth step E6, the client software 12 will transmit the signed password C in turn to the server 2.

Once the password presentation protocol has been realized, the server 2 realizes a decryption D of the signed password C by means of the public key K2 corresponding to the user's private key K1, which enables him to obtain the Password values num_MDP and session number num_Sess:

Dκ ₂ (C) = num_MDP; num_Sess

The server 2 then compares the session number num_Sess with that which it has transmitted, then it calculates and compares the imprint H (num_ID, num_MDP) of the concatenation of the user identifier numJD and the password num_MDP with the imprint num_HID stored in the database 5 corresponding to the identifier numJD to accept or refuse the identification of the user. The method according to the invention therefore uses the session number num_Sess to hide the password num_MDP.

The hardware element 8 uses a private key cryptography algorithm K1 to authenticate with the application server the password num_MDP which corresponds with the identification number numJD assigned to a user.

According to a second embodiment of a method according to the invention shown in FIG. 3, it is also possible to carry out a method in which the server authenticates itself with the hardware element in order to obtain the word of past. The server encrypts the session number that the hardware element will use to hide the password.

Thus, in a first step E1, a connection request is initiated by the user on the terminal which transmits this request to the server.

In a second step E2, the server encrypts this session number num_Sess by the public key K2 of the user in an encrypted session number num_Sess_Sign: num_Sess_Sign = E _K 2 (num_Sess).

The server transmits this encrypted session number num_Sess_Sign to the user's computer.

In a third step E3, the user's computer transmits the encrypted session number num_Sess_Sign to the hardware element. In a fourth step E4, the hardware element performs a decryption D of the encrypted session number num_Sess_Sign to obtain the session number num_Sess thanks to its private key K1: num_Sess = D _K i (num_Sess_Sign) Then, the processing means of the the hardware element sign the password from the session number num_Sess, then perform an encryption E using its private key K1, to obtain a result C:

E _K i (num_MDP; num_Sess) = C and sends the result C which corresponds to a signed password to the client software, accompanied by the identification number numJD.

In a fifth step E5, the client software 12 transmits the signed password C and the identification number numJD to the server 2.

The server then performs the decryption and comparison operations with the stored fingerprint as in the first embodiment. These latter operations are not shown in FIG.

It should be noted that the public key K2 remains secret. The private key K1 is used to transmit the response to the server.

Compared to the first embodiment, it should be noted that the order of transmission of the identification number and the session number is reversed.

According to an alternative embodiment of the system shown in FIG. 1, the hardware element 8 comprises means for generating a random sequence or a random number Num_Alea.

The hardware element also stores two separate private keys Ks1 and Ks2.

The operation of the generating means 13 is illustrated in FIG. 6.

The random sequence Num_Alea is generated taking into account the occurrence of a random event. In particular, such random events may consist of interrupts Int signaling the arrival of new information to the hardware element 8 from the terminal 6.

By way of example, in the case of producing the hardware element in the form of a USB key, such an interruption is an interruption in the USB protocol used between the terminal and the key. The sequence of these events over time depends on the exchanges between two hardware entities, namely the hardware element 8 and the terminal 6 via a communication medium governed by a software protocol subject to physical constraints directly related to the components that make up these entities. .

The interaction between these elements constitutes a context that is difficult to reproduce, which makes it impossible to deduce the sequence of events Int.

An example of determining the Num_Alea random sequence from the Int events is now described. The hardware element 8 is programmed to increment a counter Ctr at the rate of the frequency of its microprocessor from the moment this element is powered up.

This counter Ctr is stored on a finite number of bits, for example 16 bits, which implies that it is cyclic and that it will return to its initial state. At each reception of an interrupt Int, the processing means 9 of the hardware element 8 are arranged to consult the current value of the counter Ctr.

An operation, for example of the type Xor, is then performed between the value of the counter Ctr and a value extracted from a table of value Tab containing a data set of size greater than that of the counter.

An Int event is used to change the value of the pointer indicating where the value is extracted from the Tab array.

The data initially recorded in the Tab Table are kept secret. From the result of the operation between the value of the counter and the value extracted from the table is deduced a value on a bit, for example by an extraction or the application of a specific function.

The sequence of bits thus obtained rS constitutes a random sequence of which is conserved a definite number of elements in a sliding way and to constitute a random number or random sequence Num_Alea.

Alternatively, the occurrence of a random event is combined with a measured value of a complex physical phenomenon to enhance the security of the system.

According to a third embodiment of the method according to the invention, represented in FIG. 4, which corresponds to an improvement of the first mode of implementation, the variant embodiment of the system including means for generating a random sequence Num_Alea is used. It should be noted that we will note here the identification number of the user Numjdllser and no longer numJD to differentiate it from an identifier of the server 2 also used in this mode of implementation of the method. In a preliminary step EO, an initialization of a data exchange is requested by the user via the terminal 6, by sending a frame of data Trame_0.

In a first step E1, a first generation phase of a random sequence Gen_1 is performed by the hardware element 8 which allows the determination of a random sequence Num_Alea.

Then, the processing means of the hardware element 8 sign the identifier of the user Numjdllser from the random sequence Num_Alea, concatenate the result of this signature with the random sequence Num_Alea then perform a C encryption with the help of its first private key Ks1, to obtain a frame of data Trame_1, which can be represented by the formula below, in which the sign + represents a concatenation and the sign ^Λ an operation of type Xor:

Trame_1 = Cκ _s i (Num_Alea + Num_Alea ^Λ Num_ldllser)

The frame Trame_1 is sent to the client software. In a second step E2, the frame Trame_1 is transmitted to the server 2 in a request for a session number.

In a third step E3, the server 2 realizes a decryption D of the frame Trame_1 thanks to a first public key Ks2 corresponding to the private key Ks1 of the user, which enables him to obtain the values of the identifier of the user. Numjdllser user and random sequence

Num_Alea.

A test can then be performed on the user's identifier.

The server 2 also generates a Gen_2 generation of a Num_Sess session number. The server 2 then realizes a signature of the random sequence Num_Alea and an identifier of the NumJdServer server by the Session Number Num_Sess, then an encryption of these two signature results concatenated by a second public key Ku2, to obtain a data frame. Trame_2: Trame_2 = Cκ _u2 (Num_Alea ^Λ Num_Sess + Num_Sess ^Λ Num_ldServer)

The frame Trame_2 is then sent to the client software 12. In a fourth step E4, the user's computer transmits the frame Trame_2 to the hardware element 8.

In a fifth step E5, the processing means 10 of the hardware element 8 perform a decryption D of the frame Trame_2 by means of a second private key Ku1 corresponding to the public key Ku2 of the server, which enables it to obtain the values the NumJdServer server identifier and the Num_Sess session number and a value returned by the server of the Num_Alea random sequence.

A test can then be performed on the identifier of the server 2 while also verifying that the random sequence Num_Alea returned by the server corresponds to that sent.

The processing means of the hardware element 8 then perform a signature of the identifier of the user Numjdllser and the password Num_MDP by the Session Number Num_Sess, then an encryption of these two signature results concatenated by the second key. private Ku1, to obtain a frame of data Trame_3:

Trame_3 = C _Ku i (Num_Sess ^Λ Num_ldUser + Num_Sess ^Λ Num_MdP)

The frame Trame_3 is then sent to the client software 12.

In a sixth step E6, the client software 12 transmits the frame Trame_3 in turn to the server 2.

Once the password presentation protocol has been realized, the server 2 realizes a decryption D of the frame Trame_3 thanks to the public key Ku2 corresponding to the private key Ku1 of the user, which enables him to obtain the values of the password Num_MDP and session number num_Sess, as well as the user ID NumJdUser.

The server 2 then compares the session number num_Sess with that which it has transmitted, then it carries out tests on the identifier NumJdUser and the password Num_MDP to accept or refuse the identification of the user. If the identification is accepted, the requested service can then be provided by the server in a seventh step E7.

The system thus performs mutual authentication of the server and the user before transmitting the critical data. This system has been designed to address the current problems facing Internet users. Thus the hardware element 8 has the ability to determine to which recipient the password is sent. For this, the hardware element 8 challenges the server to determine if it is connected to a specific server. The hardware element 8 can subsequently warn the user, for example by means of a diode, if it is connected to a server that has impersonated the site. These arrangements are improved by the use of means for generating numbers or random sequences in the hardware element 8.

Without random generation in the hardware element 8, it is possible to send messages to the key in order to obtain information that could compromise the security of the secret or private keys recorded in this hardware element 8.

A "hacker" element attempting to replay a frame_1, will have to be able to answer the challenge of the server without being able to use the material element 8.

The frame Trame_2 includes the use of the random number generated by the hardware element 8 which makes it possible to verify the identity of the server and thus to accept to answer it.

The method can be implemented so as to take place entirely before informing the user of his authentication or not. In case of reception of an erroneous frame, the system will respond with a false frame which will be the subject of the same treatment until the protocol is finished. This in order to give the minimum elements to a "hacker" element to compromise the security of the system.

The link between the number that identifies the NumJdUser user and its identity is made at the server level. Thus it is not necessary to transmit a critical element such as the blue card number of the user to use the system.

According to a fourth mode of implementation of the method according to the invention, represented in FIG. 5, which corresponds to an improvement of the second mode of implementation, the variant embodiment of the system comprising the means of generating a random sequence Num_Alea is used.

In a preliminary step EO, an initialization of a data exchange is requested by the user via the terminal 6, by sending a frame of data Trame_0 to the server 2. In a first step E1, the server 2 realizes a Gen_2 generation of a first session number Num_Sess1. The server 2 then realizes a signature of the identifier of the NumJdServer server by the first Session Number Num_Sess1, then a concatenation of the identifier of the server with the result of the signature, and an encryption of these data concatenated by a first public key Ks2, to obtain a frame of data Trame_1:

Trame_1 = CK _S2 (Num_Sess1 + Num_Sess1 ^Λ Num_ldServer)

The frame Trame_1 is then sent to the client software 12.

In a second step E2, the user's computer transmits the frame Trame_1 to the hardware element 8. In a third step E3, the processing means 10 of the hardware element 8 perform a decryption D of the frame Trame_1 through to a first private key Ks1 corresponding to the public key Ks2 of the server, which allows it to obtain the values of the identifier of the NumJdServer server and the first session number Num_Sess1. A test can then be performed on the identifier of the server 2.

The processing means 10 of the hardware element 8 perform a generation phase of a random sequence Gen_1 which allows the determination of a random sequence Num_Alea.

Then, the processing means of the hardware element 8 sign the first session number Num_Sess1 by the random sequence Num_Alea and the identifier of the user NumJdUser by the random sequence Num_Alea, then concatenate the result of these two signatures, then realize an encryption C with the aid of its first private key Ks1, to obtain a frame of data Trame_2: Trame_2 = C _K if (Num_Sess1 ^Λ Num_Alea + Num_Alea ^Λ Num_ldUser)

The frame Trame_2 is sent to the client software.

In a fourth step E4, the frame Trame_2 is transmitted to the server 2.

In a fifth step E5, the server 2 realizes a decryption D of the frame Trame_2 thanks to the first public key Ks2 corresponding to the private key Ks1 of the user, which enables him to obtain the values of the identifier of the user. NumJdUser user and random sequence

Num_Alea.

A test can then be performed on the user's identifier. The server 2 also carries out a Gen_2 generation of a second Num Sess2 session number. The server 2 then realizes a signature of the random sequence Num_Alea and an identifier of the NumJdServer server by the second Session Number Num_Sess2, then an encryption of these two signature results concatenated by a second public key Ku2, to obtain a frame of data Trame_3:

Trame_3 = Cκ _u2 (Num_Alea ^Λ Num_Sess2 + Num_Sess2 ^Λ Num_ldServe)

The frame Trame_3 is then sent to the client software 12.

In a sixth step E6, the user's computer transmits the frame Trame_3 to the hardware element 8.

In a seventh step E7, the processing means 10 of the hardware element 8 perform a decryption D of the frame Trame_3 by virtue of a second private key Ku1 corresponding to the public key Ku2 of the server, which enables it to obtain the values the identifier of the NumJdServer server and the second session number Num_Sess2 and a value returned by the server of the random sequence Num_Alea.

A test can then be performed on the identifier of the server 2 while also verifying that the random sequence Num_Alea returned by the server corresponds to that sent. The processing means of the hardware element 8 then perform a signature of the identifier of the user Num_ldUser by the first Session Number Num_Sess1 and the password Num_MDP by the second Session Number Num_Sess2, then an encryption of these two. concatenated signature results by the second private key Ku1, to obtain a frame of data Trame_4:

Trame_4 = Cκui (Num_Sess1 ^Λ Num_ldUser + Num_Sess2 ^Λ Num_MdP)

The frame Trame_4 is then sent to the client software 12.

In an eighth step E8, the client software 12 transmits the frame Trame_4 in turn to the server 2. Once the password presentation protocol has been realized, the server 2 realizes a decryption D of the frame Trame_4 by means of the public key Ku2 corresponding to the user's private key Ku1, which enables him to obtain the values of the password Num_MDP and session numbers Num_Sess1 and Num_Sess2, as well as the identifier of the user Num IdUser. The server 2 then compares the session numbers Num_Sess1 and Num_Sess2 with those it has transmitted, then it performs tests on the identifier Numjdllser and the password Num_MDP to accept or refuse the identification of the user. If the identification is accepted, the requested service can then be provided by the server in a ninth step not shown.

It should be noted that it is possible to carry out exchanges comprising multiple generations of random sequences or session number in order to further secure the system. Under these conditions, the definition of the frames could be carried out as follows:

Trame_1 = Cκ _s i [Num_Alea_1 + Num_Alea_1 ^Λ Num_ldllser] Trame_2 = C _Ku2 [Num_Alea_1 ^Λ Num_Sess_1 + Num_Sess_1 ^Λ Num_ldServer] Trame_3 = C _Ku i [Num_Sess_1 ^Λ Num_Alea_2 + Num_Alea_2 ^Λ Num_ldUser]

Trame_2n = Cκ _u2 "[Num_Alea_n ^Λ Num_Sess_n + Num_Sess_n ^Λ Num_ldServer] Trame_2n + 1 = Cκ _u i" [Num_Sess_n ^Λ Num_Alea_n + 1 + Num_Alea_n + 1 ^Λ Num_ IdUser]

Trame_2f = C _KU2 - [Num_Alea_f ^Λ Num_Sess_f + Num_Sess_f ^Λ Num_IDServer]

Final_frame (2f + 1) = C _Ku r [Num_Sess_f ^Λ Num_ldUser ^* + Num_Sess_f ^Λ Num_MdP]

The definition of the frames could also be done in this other way:

Scale_1 = C _Ks2 [Scs_Sess_1 + Scs_Sess_1 ^Λ Sc_ldServer] Scale_2 = C _Ks i [Scs_Sess_1 ^Λ Num_Alea_1 + Sc_Alea_1 ^Λ NumJdUser] Scale_3 = C _Ku2 '[Num_Alea_1 ^Λ Num_Sess_2 + Num_Sess_2 ^Λ NumJdServer] Scale_4 = C _Ku i [Num_Sess_2 ^Λ Num_Alea_2 + Num_alea_2 ^Λ Num_ldUser] ...

Trame_2n-1 = Cκ _U2 "[Num_Alea_n-1 ^Λ Num_Sess_n + Num_Sess_n ^Λ Num_ldServer] Trame_2n = Cκ _u i" [Num_Sess_n ^Λ Num_Alea_n + 1 + Num_alea_n + 1 ^Λ Num_ldUser]

Trame_2f-1 = C _KU2 - [Num_Alea_f-1 ^Λ Num_Sess_f + Num_Sess_f ^Λ Num_IDServer] Final_frame (2f) = C _K ur "[Num_Sess_f ^Λ NumDdUser ^* + Num_Sess_f ^Λ Num_MdP] According to variants, the session number num_Sess can be the result of a function, a date or a combination of both. This combination can be verified by the hardware element before the presentation of a password. The hardware element can ask the application server to prove its identity in the same way.

According to another variant, the password num_MDP can be requested by the client software 12 to the user to be signed and transmitted to the server 2.

According to another variant, a random number can be added in the calculation of the signed password in order to counter the exhaustive attacks (by salting). This random number can be calculated by operating a one-way function on a number. The result of this operation being subsequently used for calculating the next random number, the one-way function is thus used recursively. According to another variant, the combination of the password and the session number in the hardware element can be achieved not by concatenation, but for example by bitwise addition. The server, which also knows the session number, can subtract the one from the combination to deduce the password. According to another variant, the password of the user is not stored in the hardware element, but entered by the user via input means of the terminal.

The system and the method according to the invention may in particular be applied to avoid impersonation of a website or a service, the purpose of this usurpation is to obtain confidential identification data of a user. These usurpations correspond in particular to practices known as phishing or pharming.

Another application is the fight against validations of fraudulent purchases by credit card identification numbers without entering the PIN, by a person other than the card holder.

It goes without saying that the invention is not limited to the sole embodiment of the system, described above as an example, but embraces all variants.

Claims

1. Information system comprising:

a computer server (2) comprising network communication means (3),

- At least one terminal (6) comprising network communication means (7), the terminal (6) being intended to be used by a user to make a connection to the server (2) characterized in that the system further comprises a hardware element (8) arranged to be connected to the terminal (6), the hardware element comprising data storage means (9) arranged to store an encryption key (K1) and an identification number (numJD), in that the server (2) is arranged to generate a unique session number (num_Sess) during a connection session between the terminal (6) and the server (2), and to communicate the session number (num_Sess ) at the terminal (6), the terminal (6) being arranged to communicate the session number (num_Sess) to the hardware element (8) and in that the hardware element (8) comprises processing means (10) arranged to perform an encryption (E) using the encryption key (K1) d 'a set of data combining:

- a password (num_MDP) of the user, and - the session number (num_Sess), and arranged to transmit the result of the encryption constituting an encrypted password (C) and the identification number (numJD) to terminal (6), the terminal (6) being arranged to transmit the encrypted password (C) and the identification number (numJD) to the server (6) to proceed to the identification of the user.

2. System according to claim 1, wherein the password (num_MDP) is stored on the data storage means (9) of the hardware element (8).

3. System according to claim 1, wherein the terminal (6) comprises means for entering the password (num_MDP) by the user and is arranged to communicate the password to the hardware element (8).

4. System according to one of the preceding claims, wherein the server (2) is arranged to communicate a unique session number (num_Sess) in response to the provision of an identification number (numJD) by the hardware element (8).

5. System according to one of claims 1 to 3, wherein the server (2) is arranged to perform an encryption (E) by an encryption key (K2) of the session number (num_Sess) in an encrypted session number. (num_Sess_Sign) and to communicate the encrypted session number (num_Sess_Sign) to the terminal, the terminal being arranged to communicate the encrypted session number to the hardware element (8), the processing means of the hardware element being arranged to realize a decryption (D) of the encrypted session number (num_Sess_Sign) to a session number (num_Sess) by the encryption key (K1) stored in the storage means (9).

6. System according to one of the preceding claims, wherein the server (2) is arranged to perform a decryption (D) of the encrypted password (C) with a decryption key (K2) corresponding to the encryption key (K1) stored in the storage means (9) of the hardware element (8), to obtain the values of the password (num_MDP) and the session number (num_Sess).

7. System according to claim 6, wherein the server (2) is arranged to compare the session number (num_Sess) from the encrypted password with that it has generated, then to compare the result of the application of a hash function (H) on a combination of data including the password (num_MDP) with a predetermined value (num_HID).

8. System according to one of the preceding claims, wherein the password (num_MDP) and the identification number (numJD) form a unique pair of information in the system.

9. System according to one of the preceding claims, wherein the hardware element comprises means for generating a random sequence (Num_Alea), the processing means (10) being arranged to perform a first encryption of a set of data combining: - the random sequence (Num_Alea), and - the identification number of the user (Numjdllser), and arranged to transmit a first data frame comprising the result of the first encryption to the terminal (6), the terminal (6) being arranged to transmit this first data frame to the server (6), the server (2) being arranged to realize decrypting the first data frame and then a second encryption of a data set combining:

- the random sequence (Num_Alea), and

a session number (num_Sess, num_Sess2), and

a server identification number (NumJdServer) and for transmitting a second data frame comprising the result of this second encryption (Frame 2, Frame 3) to the terminal (6), the terminal (6) being arranged to transmit this second data frame (Frame 2, Frame 3) to the hardware element (8).

10. The system of claim 9, wherein two pairs of private keys and public keys (Ks1, Ks2, Ku1, Ku2) are used respectively for the encryption and decryption of a first and a second data exchange between the server (2) and the hardware element (8)

1 1. System according to one of claims 9 and 10 wherein several random sequences (Num_Alea) and / or several session numbers are generated (Num_Sess) by the hardware element (8) or the server (2) for successive data exchanges for the identification of a user.

12. The system of claim 8, wherein the means for generating a random sequence (Num_Alea) of the hardware element (8) are arranged to take into account the occurrence of a random event.

13. The system of claim 12 wherein the random events taken into account by the random sequence generating means comprise interrupts (Int) signaling the arrival of new information to the hardware element (8) from the terminal. (6).

14. Method of identification by a computer server (2) of a user in possession of a terminal (6) having communication means (7) for making a connection between the server (2) and the terminal (6) and a hardware element (8), connected to the terminal (6), comprising data storage means (9) on which is stored an encryption key (K1) and an identification number (numJD), in which the server (2) generates a unique session number (num_Sess) during a connection session between the terminal (6) and the server (2), the terminal communicates the session number (num_Sess) to the hardware element (8),

the hardware element (8) performs an encryption (E) using an encryption key (K1) of a set of data combining: the password (num_MDP) and the session number (num_Sess) , and communicates the result (C) of the encryption to the terminal (6), the material element (8) also transmits the identification number (numJD) to the terminal (6),

the terminal (6) transmits the result of the encryption (C) and the identification number (numJD) to the server (2) in order to proceed to the identification of the user.

15. The method of claim 14, wherein the password (num_MDP) is stored on the data storage means (9) of the hardware element (8).

16. The method of claim 14, the password (num_MDP) is entered by the user on the terminal (6) and communicated to the hardware element (8) by the terminal (6).

17. Method according to one of claims 14 to 16, wherein the server (2) communicates a unique session number (num_Sess) in response to the supply of an identification number (numJD) by the hardware element ( 8).

18. Method according to one of claims 14 to 17, wherein the server (2) performs an encryption (E) by an encryption key (K2) of the session number (num_Sess) in an encrypted session number (num_Sess_Sign) and communicates the encrypted session number (num_Sess_Sign) to the terminal, the terminal communicating the encrypted session number to the hardware element (8), the means for processing the hardware element performing a decryption (D) of the encrypted session number (num_Sess_Sign) in a session number (num_Sess) by the encryption key (K1) stored in the storage means (9).

19. Method according to one of claims 14 to 18, wherein the server (2) performs a decryption (D) of the encrypted password (C) with a decryption key (K2) corresponding to the encryption key ( K1) stored in the storage means (9) of the hardware element (8), to obtain the values of the password (num_MDP) and the session number (num_Sess).

The method of claim 19, wherein the server (2) compares the session number (num_Sess) from the encrypted password with the one it has generated, and compares the result of the application of a function of hashing (H) on a combination of data including the password (num_MDP) with a predetermined value (numJHID).

21. Method according to one of claims 14 to 20, wherein the password (num_MDP) and the identification number (numJD) form a single pair of information.

22. Method according to one of claims 14 to 21, wherein the hardware element generates a random sequence (Num_Alea), performs a first encryption of a set of data combining:

- the random sequence (Num_Alea), and

the user identification number (Numjdllser), and transmits a first data frame corresponding to the result of the encryption to the terminal (6) which transmits this first data frame to the server (6), the server (2) realizing a decryption of the first data frame and a second encryption of a data set combining:

- the random sequence (Num_Alea), and - a number of session (num_Sess, num_Sess2), and

a server identification number (NumJdServer) and transmitting a second data frame corresponding to the result of this second encryption (Frame 2, Frame 3) to the terminal (6), the terminal (6) transmitting this second data frame ( Frame 2, Frame 3) to the hardware element (8).

23. The method of claim 22, wherein two pairs of private keys and public keys (Ks1, Ks2, Ku1, Ku2) are respectively used for the encryption and decryption of a first and a second data exchange between the server (2) and the hardware element (8)

24. Method according to one of claims 22 and 23 wherein a plurality of random sequences (Num_Alea) and / or several session numbers are generated (Num_Sess) for successive data exchanges for the identification of a user.

25. The method according to one of claims 22 to 24, wherein the generation of a random sequence (Num_Alea) takes into account the occurrence of a random event.

The method of claim 25 wherein the random events considered in the generation of random sequences include interrupts (Int) signaling the arrival of new information to the hardware element (8) from the terminal ( 6).

27. Method according to one of claims 22 to 26 wherein at least one data frame exchanged between the hardware element (8) and the terminal (6) comprises both a random sequence generated by the hardware element (8). ) and a session number generated by the server (2).