EP2692122A1

EP2692122A1 - Strong authentication by presentation of the number

Info

Publication number: EP2692122A1
Application number: EP12717417.5A
Authority: EP
Inventors: Benoit Ferlin
Original assignee: BANQUE ACCORD
Current assignee: Oney Bank
Priority date: 2011-03-30
Filing date: 2012-03-29
Publication date: 2014-02-05
Also published as: RU2013148028A; CN107423975A; US9602504B2; FR2973618B1; RU2570838C2; CN103597806A; FR2973618A1; WO2012131268A1; US20140075525A1

Abstract

Method of authentication by single-use password of a user (10) provided with a computer terminal (11) and with a telephone terminal (12) and wishing to access an on-line resource from an information system (20), this method including a step of triggering a call to said telephone terminal with an identifier of the calling party comprising the single-use password.

Description

AUTHENTI STRONG FI CATION BY PRESENTATION OF THE NUMBER

The present invention relates to the technical field of securing access to online resources, and more particularly to the authentication of a user wishing to access an online service from a public computer network such as the Internet.

By "authentication" in computer systems is meant, here, the verification of the identity of an entity (a person, a computer, a computer process for example) to allow access of this entity to resources (services, networks, systems, applications for example). These entities are referred to below as the "user".

The putting on line of resources on public computer networks of the Internet type has enormous advantages, whether for the users or the companies, in particular those with a commercial nature (e-banking, e-commerce for example). The growing number and increasing use of online services testify to this.

This has naturally aroused the interest of cybercriminals ("hackers"), and the number of programs designed to steal data to fraudulently access online resources has increased sharply. In this respect, robust authentication techniques are more than ever necessary for both users and companies. On the one hand, a user must be able to be certain that he / she is accessing the server of the service he / she is requesting (and to which he / she may be transmitting personal data such as bank details) and on the other hand server must be as certain that this user corresponds well to the one who has previously registered with him and that it is therefore not a fraudster. A malicious third party posing as a legitimate user to perform, for example, an online banking transaction certainly can please neither the legitimate user nor the bank offering this online service.

In the state of the art, there are different methods for verifying the authenticity of a user working in a working environment. client / server and requesting access to an online resource. Authentication can be done on several factors:

a data item known to the user, such as a password;

an object possessed by the user, for example a magnetic card or a smart card;

an action that only the user can do, for example a handwritten signature on a touch screen;

a specific physical characteristic of the user, such as a fingerprint. Currently, the most widely used method to perform a user authentication to a remote server is based on a static password combined with an identifier (login). The advantage of such a method is that it can be implemented entirely by software, thus avoiding an additional hardware cost. However, spying on network connections in order to collect legitimate user identities handicaps this method. Identities thus usurped can be used later. Hashing or encrypting passwords can not completely solve this problem because they only deport the threat from the network link to the user terminal, where it is now not uncommon to find many malicious applications (malware).

Authentication techniques based on means provided to users, such as an authentication token, a smart card, a smart card, or a USB key have the disadvantage of requiring an additional hardware cost.

Moreover, the biometric authentication methods are generally complex and require a fastidious preliminary characterization step. To overcome the limitations of single-factor authentication methods, including the use of static passwords, authentication solutions have emerged that combine two factors: known data by the user (for example a password) and an item that the user owns (such as a phone number or an email address). In this case we speak of strong authentication. Among these methods exist the authentication solution based on one-time password (also called OTP for One-Time Password).

As the name suggests, the one-time password (OTP) can only be used as a means of authentication for a single session. Thus, a new OTP is generated, generally in a random or pseudo-random manner, and then communicated to the user with each new access request issued by the user to the remote server. The user submits this OTP to the remote server as a proof of the authenticity of his identity, which he has declared using his login / password for example. Consequently, the usurpation of the static logins / passwords, whether from the user terminal or from the network link connecting the user terminal to the server, becomes superfluous since an OTP becomes obsolete once it has been used. .

To guarantee real security, an OTP is generally communicated to the user via a channel other than that established between the user terminal and the server. Indeed, an OTP is generally sent to the user by SMS (Short Service Message), by MMS (Multimedia Messaging Service) or by voice message using the second authentication factor, namely the telephone number that the user owns and has previously provided to the remote server.

However, sending an OTP (by SMS, MMS or voice message for example) to a phone certainly generates an additional financial cost for the providers of online services (this is not free to date). It will be understood that the sending of OTPs by SMS to a thousand customers using a monthly online service offered by an SME represents a significant financial burden for this company.

An object of the present invention is to overcome the aforementioned drawbacks. Another object of the present invention is to deploy a strong authentication solution at lower cost.

Another object of the present invention is to reduce the financial cost necessary to guarantee the security of the merchant sites. Another object of the invention is to allow a user, typically a user, to access online services in a simple and secure manner.

Another object of the present invention is to provide a strong authentication method for securing access to online resources from an insecure network.

To this end, the invention relates, according to a first aspect, to a single-use password authentication method of a user provided with a computer terminal and a telephone terminal and wishing to access a resource. online to an information system, the method including a step of initiating a call to said telephone terminal with a caller ID including the one-time password.

According to a second aspect, the invention relates to a one-time password authentication system of a user provided with a computer terminal and a telephone terminal and wishing to access an online resource from a user. an information system, this system including a private branch exchange arranged to trigger a call to said telephone terminal with a caller ID including the one-time password. According to a third aspect, the invention relates to a computer program product implemented on a memory medium that can be implemented within a computer processing unit and includes instructions for implementing the process summarized above.

Other features and advantages of the invention will appear more clearly and concretely on reading the following description of preferred embodiments, which is made with reference to FIG. attached which schematically illustrates a functional representation of an embodiment.

FIG. 1 shows a user 10 wishing to remotely access, via a computer terminal 11, to an online resource made available by an information system 20.

The computer terminal 11 may be any user equipment allowing a user 10 to connect to a computer network, including the Internet, from which the online resource proposed by the information system 20 is accessible. A personal computer / portable / public computer, a PDA (Personal Digital Assistant), or a smartphone (a smart phone) are examples of computer terminals 10.

The information system 20 may be any hardware and / or software computer means making available to the user 10 an on-line resource, in particular an online service, accessible from a computer terminal 11. An application server, a Web server hosting an e-commerce website, or a plurality of cooperative servers are examples of information system 20.

The user 10 also has a telephone terminal 12 associated with at least one telephone number (telephone number). This telephone terminal 12 is, for example, a mobile phone, a smartphone or a PDA comprising a SIM (Subscriber Identity Module) or USIM (Universal Subscriber Identity Module);

an analog or digital fixed telephone;

- a Softphone with a phone number (eg Skype ™ In).

In an advantageous implementation, the telephone terminal 12 is a mobile phone or a smartphone. This case is of course not limiting. The telephone terminal 12 allows the presentation to the called party of the caller's number (in English, Calle D for Caller Identification or CLIP for Calling Line Identification Presentation). In other words, the telephone terminal 12 provides the call number, or more generally the identifier of the caller. The identifier of the caller may be displayed on the screen of the telephone terminal 12, if it has one, or on a separate device. Alternatively or in combination, the identifier of an incoming call to the telephone terminal 12 may be

- displayed from a directory included in this terminal (call log, missed calls, missed calls for example), and / or

- obtained by dialing a certain number (for example, for a France Telecom ™ subscriber, dial 3131 to get the number of the last caller).

In particular, the computer terminal 11 and the telephone terminal 12 may be included in a single user equipment such as: a fixed / mobile computer comprising a softphone; or

- a smartphone or PDA allowing a data service (DATA) in addition to its function as a telephone.

In an implementation of an embodiment illustrated in FIG. 1, the user 10 wishes to access a resource put online by the information system 20 and requiring strong authentication (step 1 in FIG. 1). For example, the user 10 wishes to perform a transaction (transfer, purchase, sale for example) online on a website (bank, or e-commerce for example) hosted by the information system 20. To To connect to the remote information system 20 of the Web site to which it wishes to access, the user 10 uses the computer terminal 11 in a conventional manner by entering the web address of the site.

Being an online resource requiring strong authentication, the information system 20 is arranged to verify the authenticity of the identity of the user 10 that the latter said, for example, with the help of 'a login / password. For this, the information system 20 (step 2 in Figure 1) stores the request of the user 10; searches for the telephone number (ie the second authentication factor) that the user 10 previously provided during a previous session. Of course, this assumes that the user 10 has previously entered his profile (at least a login, a password and a telephone number) with the information system 20 by indicating the telephone number of his telephone terminal. 12;

generates an OTP that the user can not know in advance. This OTP is usually generated in a random or pseudo-random manner.

Then the information system 20

- communicates (step 31 in Figure 1) ΙΌΤΡ generated and the telephone number of the user 10 to the private branch exchange 30, also called PBX or PABX for Private Automatic Branch eXchange, and

informs (step 32 in FIG. 1) the user 10

o that he will instantly receive a call on the telephone number that he has previously provided (ie the telephone number of the telephone terminal 12 in his possession); and o that he must submit (return) the caller ID

(CallerJD).

The PABX 30 can also be an IP PBX, which is an evolution towards ΙΊΡ (Internet Protocol) of the traditional BAPX.

Advantageously, one of the native features of PABX 30 is to be able to change the number of the caller (Calle®) on demand.

Therefore, using the telephone number and the OTP which are transmitted to it from the information system 20, the PABX 30 is arranged for (step 4 in FIG. 1) to trigger a call on the telephone terminal 12 of the 10 while presenting the OTP in the caller ID (i.e., in CalleMD). As a result, the OTP is transported directly on the display of the telephone terminal 12, in place of the presentation of the caller's number. It should be noted that the call triggered by PABX 30 to the telephone terminal 12 aims to provide ΙΌΤΡ and not to establish a conversation. This call therefore takes only the necessary and sufficient time to provide ΙΌΤΡ to the telephone terminal 12, in other words, before the user 10 picks up. Therefore, the PABX 30 is programmed to interrupt the call made at the first or second ring for example.

The user 10 enters (step 5 in FIG. 1) the identifier of the caller (Caller_ID) which is displayed on his telephone terminal 12 in accordance with what has been requested by the information system 20. for example, the user 10 enters the identifier of the caller in a dedicated zone (a certain field in an electronic form for example), and submits it to the information system 20.

In a variant, the information system 20 requests the user 10 to return only a specific portion of the caller ID of an incoming call that he will instantly receive on his telephone terminal 12.

The information system 20 checks (step 6 in FIG. 1) the validity of the message that is submitted to it by the user 10 and, consequently, authorizes or refuses the access requested by the user 10. For that the information system 20 includes means for checking the correspondence between the message submitted by the user 10 and the OTP that has been generated and communicated to the PABX 30. In case of matching the content submitted by the user 10 (step 5 in FIG. 1) with that generated by the information system 20, the user 10 is certainly authenticated by the information system 20. The information system 20 directs, in this case, the user 10 to the requested resource.

The user 10 is informed of the result of his authentication (step 7 in FIG. 1).

In an illustrative implementation of the method described above, the user 10 transmits an access request message from his computer 11, to an application server 20 hosting a banking site in order to perform a certain transaction (step 1 in Figure 1); the application server 20 stores the request of the user 10, finds the phone number of the latter (second authentication factor of the user 10), and generates a one-time password (OTP) (step 2 of Figure 1);

the application server 20 communicates the one-time password generated and the telephone number of the user 10 to the PABX 30 (step 31 of FIG. 1);

the application server 20 informs the user 10 that he will receive, in a moment, a call - on the phone number that he previously filled - whose caller ID (Calle D) is the the one-time password he must submit (step 32 in Figure 1);

the PABX 30 sends a call to the telephone number of the user 10 by displaying in the caller ID the one-time password generated by the application server 20;

the user 10 submits the identifier of the caller which is displayed on his phone 11 (step 5 in Figure 1);

the application server 20 checks the match between the one-time password it has generated and that submitted to it by the user 10 (step 6 in FIG. 1);

the application server 20 informs the user 10 success / failure of its authentication (step 7 in Figure 1).

In another illustrative implementation of an embodiment, the user 20 is provided with a user equipment combining a telephone terminal and a computer terminal such as a smartphone, or a computer / laptop for example. In this case, the user 10

- Connects to the remote server 20 from its Smartphone (for example, opens the web page of an online service offered by the remote server 20);

- identifies itself with the remote server 20 using at least one identifier of its own (a login and password for example);

requires the connection to the online service with the remote server 20 (requires the completion of an online transaction, for example); the remote server 20 searches for the telephone number associated with the identity declared by the user 10, this information being communicated to him during a prior phase (a registration phase for the online service, for example);

the remote server 20 generates an OTP;

the remote server 20 transmits the telephone number of the user 20 and the OTP generated to the PABX 30;

the remote server 20 asks the user to submit the caller ID (CalleMD) of the call that he will receive in a moment;

the PABX 30 initiates a call to the telephone number transmitted to it by presenting the OTP in the caller ID (CallerJD);

the user 10 enters the caller ID (CalleMD) of the call he has just received and submits it to the remote server 20 (the user enters the caller ID (CalleMD) in a form it submits to the remote server for example);

the remote server 20 checks the correspondence between the message submitted by the user and the generated OTP, and informs the user of the result (that is to say, the success or failure of its authentication).

In a preferred embodiment, when the computer terminal 11 and the telephone 12 are included in a single user equipment (in particular a computer or a smartphone), a software application is arranged to recover the caller ID of the last incoming call. in order to submit it to the remote server. In a particular implementation, this software application is launched by the user from the electronic form giving access to the online service. Alternatively, this application is launched automatically as soon as the user has requested access to the online service.

In one embodiment, the software application is attached to the electronic form for accessing the online service. Advantageously, this software application makes it possible to reduce the interventions of the user in the authentication method. In another embodiment, when the telephone terminal 12 and the computer terminal 11 are not included in a single user equipment (that is to say two independent user terminals), the software application, distributed between the two terminals 11 and 12, makes it possible to send to the computer terminal 11 the caller ID of the last incoming call to the telephone terminal 11. For this, the software application can use, for example, a short-range radio communication interface ( Bluetooth ™ for example) shared by the computer terminal 11 and the telephone terminal 12. It should be noted that an OTP, according to the present invention, can be generated according to any method known in the state of the art (software, hardware random / pseudo-random, dependent / independent of authentication factors for example).

In one embodiment, the identifier of the caller (Calle D) displayed to the user 10 makes it possible to extract or deduce the OTP (using a selection or decryption function). for example) generated by the information system 20. This function is provided to the user 10 on his computer terminal 11 and / or his telephone terminal 12.

In particular, the single-use password authentication method described above can be deployed in combination with other security methods (secure exchange protocols such as SSH, or SSL for example).

The process just described has a number of advantages. It allows - to ensure mutual authentication between the user 10 and the information system 20;

- reduce the cost of authentication by OTP: against an SMS / MMS, a call is usually free;

- To ensure the security of the authentication process: the identity of the user (login / password for example) and the OTP are transmitted on two different communication channels.

Claims

A one-time password authentication method of a user (10) provided with a computer terminal (11) and a telephone terminal (12) and wishing to access an online resource from a information system (20), said method including a step of initiating a call to said telephone terminal with a caller ID including the one-time password.

2. Method according to claim 1, characterized in that it further comprises a step of declaring the identity of the user to the information system (20), and a step of requesting access from of the information system.

3. Method according to any one of the preceding claims, characterized in that it further comprises a step of generating a one-time password.

4. Method according to any one of the preceding claims, characterized in that it further comprises a step of communicating a telephone number associated with the declared identity and the one-time password generated to a user. private telephone exchange (30), said telephone number being previously informed with said information system (20).

5. Method according to any one of the preceding claims, characterized in that it further comprises a step of submitting, to the information server (20), the identifier of the caller of a call. received on the telephone terminal (12).

6. Method according to any one of the preceding claims, characterized in that it further comprises a step of checking the concordance between a message submitted to the information system (20) and a password for use. unique generated by the information system (20).

7. Method according to any one of the preceding claims, characterized in that the identity of the user comprises at least one identifier of the user.

A one-time password authentication system of a user (10) provided with a computer terminal (11) and a telephone terminal (12) and wishing to access an online resource from a information system (20), which system includes a private branch exchange (30) arranged to initiate a call to said telephone terminal with a caller ID including the one-time password.

9. System according to the preceding claim, characterized in that the information system (20) comprises - means for generating one-time passwords;

a means of communication, to a private branch exchange (30), a one-time password and a telephone number;

means for verifying the match between a generated one-time password and a message submitted to the information system (20).

10. System according to any one of claims 8 or 9, characterized in that the computer terminal (11) and the telephone terminal (12) are included in a single user equipment.

11. Computer program product implemented on a memory medium, capable of being implemented within a computer processing unit and comprising instructions for the implementation of a method according to one of claims 1 to 7.

12. Computer program product according to the preceding claim characterized in that it comprises a software application arranged to send, to a computer terminal (11), the caller ID of the last incoming call to a telephone terminal ( 12).