FR3003059A1 - SYSTEM AND METHOD FOR MANAGING AT LEAST ONE ONLINE APPLICATION, USER PORTABLE OBJECT COMMUNICATING WITH A RADIO PROTOCOL AND DEVICE REMOTE FROM THE SYSTEM - Google Patents

Abstract

The invention relates to a system for managing at least one on-line application, characterized in that it comprises at least two devices acting as host (H) or client (C1), including at least the client device ( Cl) is portable communicating by a radio protocol, a terminal (2) communicating with a network (22) via connection or communication means of the terminal (2), the client device (C1) connecting to the terminal (2) by an interface of the terminal as a keyboard device, each device (H, Cl) comprising at least one programmable nonvolatile permanent memory zone and data processing means, the terminal comprising a memory zone and data processing means, the data transmission system; management comprising an authentication algorithm, the memory area of the client device (C1) comprising a unique identifier and messages recorded in keyboard code and treated as such by the terminal (2), the memory area of the d host device (H) comprising at least one user identification algorithm, a client device validity checking algorithm (Cl) and an application execution algorithm, the memory area of the host device (H) comprising in addition, a database comprising at least a first file or table associating the user identifiers with the passwords of each user, a second file or table associating at least one state of use of the client device (C1) with the unique identifier of a client device (Cl), a third file or table associating the URL address of the host device (H) with an identifier of the application, a fourth file or table associating the user identifiers with at least an identifier of the application, the memory area of the host device further comprising an application, the host device (H) being identified by a URL address, the memory area of the client device (C1) further comprising at least the URL of the host device (H) and an indication of the identification of the application.

Description

FIELD OF THE INVENTION The present invention relates to the field of securing data exchanges between a host and a system for managing at least one online application, a portable user object communicating via a radio protocol and a remote device of the system. and a client, for example between a server and a portable and connectable electronic object. More specifically, the invention relates to a system comprising a portable device communicating via a radio protocol that can manage online applications.

One possible application is in the context of online games, for example, an online football game, handball, basketball, Formula 1, etc. to allow users to play by selecting, using an interface displayed on a terminal, a known player or sportsman memorized on the server in the application and by being represented in the game by this player. TECHNOLOGICAL BACKGROUND OF THE INVENTION The exchange of digital data made between different devices connected via a local or wide area network poses a real security problem by fraudulent use of the portable device, for example. Indeed, several problems can arise. For example, there is the problem of how to be sure that the portable device is physically used by the user to connect and allow a connection of a terminal to the remote server. Indeed, a user could use a terminal in which he enters the URL address of the server to connect to the remote server and thus fraudulently use applications dedicated to the owner of the physical portable device without being in possession of this portable device. On the other hand, a portable device comprising a marker such as a bar code read by a server-specific reader makes it possible to authenticate a user, but does not make it possible to ensure that the terminal also connected to the server is used by the user who authenticated. Finally even if the reader is integrated in the terminal this requires the addition of hardware and software.

There is also the problem of knowing how to control the number of times for which the portable device is used to obtain the applications to which the portable device entitles. GENERAL DESCRIPTION OF THE INVENTION The present invention therefore aims to overcome one or more of the disadvantages of the prior art by providing a simple system for controlling the physical possession of the portable device by a user, while allowing control of the use of the portable device on a terminal for the installation of objects on an Internet page. To this end, the invention relates to a system for managing at least one online application characterized in that it comprises at least two devices acting as host or client, at least the client device is portable, a terminal communicating with a network via means of connection or communication of the terminal, the client device connecting to the terminal via an interface of the terminal as a keyboard device, each device comprising at least one programmable non-volatile permanent memory zone and means of data processing, the terminal comprising a memory area and data processing means, the management system comprising an authentication algorithm, the memory area of the client device comprising a unique identifier and messages recorded in keyboard code and processed as such by the terminal, the memory area of the host device comprising at least one user identification algorithm a client device validity verification algorithm and an application execution algorithm, the memory area of the host device further comprising a database comprising at least a first file or table associating the user identifiers with the passwords of each user, a second file or table associating at least one state of use of the client device with the unique identifier of a client device, a third file or table associating the URL of the host device with a identifier of the application, a fourth file or table associating the user identifiers with at least one identifier of the application, the memory area of the host device further comprising an application, the host device being identified by a URL address, the memory area of the client device further comprising at least the URL of the host device and an indication of the identification of the pplication.

In another feature, the terminal interface uses a radio type protocol. In another feature, the memory area of the terminal includes a read application for sending an interrogation signal to the client device placed nearby and receiving messages from the client device following the interrogation signal, the read application converting the messages from the client device into code interpreted by the terminal in keyboard code. According to another feature, the memory area of the client device comprises a first counter incremented by the generation of a password and a shared secret key used by a module of the authentication algorithm in the client device, the memory area of the client device. client device (Cl) further comprising at least the unique identifier of the client device, the memory area of the host device further comprising the secret key shared with the client device associated with a user and a fifth file or table associating a second counter with the unique identifier of each client device. According to another particularity, the authentication algorithm comprises: a first module implemented by the processing means of the client device generating a first password from the shared secret key and the first counter to a rank n, the first module incrementing the first counter to a rank n + 1 when the first password is generated, the first module being stored in the memory area of the client device, a second module implemented by the processing means of the host device generating a second password from the shared secret key and the second counter to a rank p, the second counter being that associated with the identifier of the client device from fifth file or table, the second module being stored in the memory area of the host device, a third module implemented by the processing means of the host device comparing the first password generated by the means ns of processing of the client device and the second password generated by the processing means of the host device, the first password having been sent to the host device by the client device, the third module incrementing the second counter to a rank p + 1 when the second password is generated, the third module being stored in the memory area of the host device. In another feature, the client device includes a usage file stored in a secret memory area of the client device (C1), the usage file including a usage state information of the client device: a state corresponding to a "used" state of use of the client device and a state corresponding to an "unused" usage state, the secret memory zone being accessible to the host device by a secure channel between the client device and the host device, the secure channel being opened by an algorithm for opening a secure channel.

In another feature, the memory area of the host device includes an algorithm for opening a secure channel, an application for installing an algorithm for opening a secure channel between the client device and the host device and a set of three secret keys, the installation application being intended to be sent to the client device to install the opening algorithm on the terminal to control, by messages sent to the client device via the interface, the modification of the information of the usage file stored in the secret memory area of the client device, the memory area of the host device also comprising an algorithm for changing the information contained in the usage file. According to another particularity, the memory zone of the client device comprises a set of three secret keys identical to the set of three secret keys of the host device, the terminal comprising the algorithm for opening a secure channel.

In another feature, the application sends commands or messages to the terminal for displaying an image stored in the memory area of the host device by the display means of the terminal according to image placement coordinates in the device. display of an Internet page. According to another feature, the application sends commands or messages to the terminal for displaying an animation stored in the memory area of the host device by the display means of the terminal according to placement coordinates of the animation in the device. display of an Internet page. The invention also relates to a method for managing at least one application implemented by the system according to the invention, the terminal comprising at least one connection to an Internet network, an input means and a display means characterized in that method comprises at least: a step of connecting to the URL of the host device provided by a client device read by the terminal, a step of authentication of the client device implemented by the authentication algorithm, if the client device is authenticated, the method further comprising a user identification step implemented by the user identification algorithm, if the user is identified, the method further comprising a step of verification of validity of the client device, if the client device is validated, the method further comprising a step of executing the application.

In another feature, the step of connecting to the URL of the host device comprises: a step of connecting the client device to the URL of the host device provided by the information stored in the memory area of the client device by via a connection to the terminal, - a step of sending by the client device to the host device of the unique identifier of the client device. According to another feature, the authentication step implemented by the authentication algorithm comprises: a step of generating, by the first module implemented by the client device processing means, a first word; pass from the shared secret key and the first counter to a rank n, - a step of incrementing the first counter to a rank n + 1, - a generation step, by the second module implemented by the means for processing the host device, a second password from the shared secret key and the second counter at a rank p, the second counter being that associated with the unique identifier of the client device from the fifth file or table, a step of sending by the client device to the host device the first password via the terminal; a step of comparison, by the third module, of the first password and the second password; if the first password is identical to the second password, the second counter being incremented to a rank p + 1 and the client device being authenticated. According to another feature, the identification step implemented by the user identification algorithm comprises the following substeps: a display step by the display means of the terminal of at least 10 two input areas, the display being controlled by the identification algorithm, - a step of entering an identifier of the user by the terminal input means in the first input area, - a step of entering a password associated with the identifier by the means for inputting the terminal into the second input area; an encryption step by the terminal processing means and sending the identifier and the word; to the host device; - a decryption step by the host device processing means and verification of the identifier and the password by the identification algorithm from the first file or table of the base of the host device; data stored in the memory area of the device customer itif; if the first file or table of the database includes the identifier of the user associated with the password entered by the user, the user being identified. According to another feature, the client device validity verification step implemented by the validity verification algorithm comprises: a step of checking, in the second table, the state of use of the client device from the unique identifier of the client device; if the usage state corresponds to a "used" state, the method comprising: - a step of verifying one or more applications associated with another or other client devices from the user's identifier according to the fourth table, - an execution step by the terminal processing means or the host device processing means of the other application or applications associated with another or other client devices without the execution of the application associated with the client device; if the usage state corresponds to an "unused" state, the client device being validated. According to another particularity, the step of verifying the validity of the client device implemented by the validity verification algorithm comprises: a verification step, in the utilization file stored in the secret memory zone of the client device, information on the state of use of the client device after a step of opening a secure channel by an algorithm for opening a secure channel; if the usage state corresponds to a "used" state, the method comprising: - a step of checking one or more applications associated with another or other client devices from the identifier of the user according to the fourth table, - an execution step by the terminal processing means or the host device processing means of the other application or applications associated with another or other client devices without the execution. the application associated with the client device; if the usage state corresponds to an "unused" state, the client device being validated.

According to another particularity, the execution step of the application implemented by the application execution algorithm comprises: a step of verifying the application to be executed from the indication included in or associated with the URL address stored in the memory area of the client device according to the third table, - a command sending step by the host device for displaying on the display means of the terminal of a window presenting a choice of execution or not of the application to be executed, the window representing at least one hardware or virtual key allowing the execution of the application and a hardware or virtual key allowing the refusal of execution of the application, a step of choice by the means for inputting the terminal by the user; if the user actuates the input means in such a way that the hardware or virtual key allowing the refusal of execution is validated, the method comprises an execution step by the processing means of the terminal or the processing means of the host device the application or applications associated with another or other client devices without running the application associated with the client device; if the user actuates the input means in such a way that the hardware or virtual key enabling execution is validated, the method comprising: an execution step by the processing means of the terminal or the processing means of the host device the application or applications associated with another or other client devices without executing the application associated with the client device, a step of executing the application by the terminal processing means or the processing means the host device of the application associated with the client device; - a step of modifying the usage information from the "unused" state to pass the usage information to the "used" state.

According to another particularity, the authentication step is followed by an installation step by the terminal processing means of an algorithm for opening a secure channel, an installation application of the algorithm of opening a secure channel that has been sent by the host device.

According to another particularity, during the selection step, if the user actuates the input means in such a way that the key allowing the execution is validated, the step of modifying the information of use of the state "not used" in "used" state corresponds to the modification of the information of the usage file stored in the secret memory zone of the client device after a step of opening a secure channel by an opening algorithm of a secure channel implemented by the processing means of the host device and the terminal. According to another particularity, the algorithm for opening a secure channel is performed via a triple DES algorithm and a set of three secret keys according to a specified security protocol of the GlobalPlatform type, the triple DES algorithm and the set of three secret keys being stored in the memory zone of the host device and the client device, the algorithm for opening a secure channel comprises: a) a step of logging by the processing means of the host device, followed by the generation of a session counter by the client device sent to the host device, the session counter being incremented each time a new session is opened, b) a step of derivation of the secret keys stored in the memory of the client device, realized by the processing means of said device via the triple DES algorithm using the session counter and a random host number generated and sent to the client device p ar the processing means of the host device, c) a step of generating five derived keys S-ENC, R-ENC, CMAC, R-MAC and S-DEK which used with the triple DES algorithm, respectively allow to encrypt the commands sent to a device, to encrypt the responses of the device, to generate a signature for each command, to generate a signature for each response, and to encrypt confidential data, d) a generation step by the processing means of the client device a client cryptogram, via the triple DES algorithm using the derived key S-ENC, the random host number and a client random number generated by the client device processing means, e) a sending step by the means of processing of the client device to the host device, the session counter, the client random number and the client cryptogram calculated in the previous step, followed by the calculation and generation of the five keys derived by the processing means of the host device, f) a step of generating, by the processing means of the host device, the client cryptogram via the triple DES algorithm using the derived key S-ENC, the random host number and the number random client generated by the processing means of the client device, g) a comparison step by the processing means of the host device client cryptograms respectively calculated by the client device and the host device, followed by the authentication of the client device if the two calculations of the client cryptogram are identical, h) a step of generation by the processing means of the host device of a host cryptogram, via the triple DES algorithm using the derived key S-ENC, the random host number and the random number client, i) a step of sending by the processing means of the host device to the client device, the host cryptogram calculated in step preceding, j) a step of generating, by the means of processing the client device, the host cryptogram via the triple DES algorithm using the derived key S-ENC, the random host number and the client random number, k) a step of comparing by the client device processing means the host cryptograms respectively calculated by the host device and the client device, followed by the authentication of the host device if the two host cryptogram calculations are identical, I) a confirmation step of the logon and secure channel through which the next commands and / or response generated by the host and client devices will be realized. According to another particularity, during the selection step, if the user actuates the input means in such a way that the key allowing the execution is validated, the step of modifying the information of use of the "unused" state in use state "used" is the state change associated with the unique identifier of the client device on the second file or table. The invention also relates to a portable user device forming a client device of the system according to the invention and comprising a non-volatile secure memory area, connection means to a terminal interface and data processing means, the memory area comprising at least a unique identifier and messages recorded in keyboard code and treated as such by the terminal. According to another particularity, the connection means use a radio type protocol.

In another feature, the memory area of the client device comprises a read application for sending an interrogation signal to the client device placed nearby and the reception of messages from the client device following the interrogation signal. reading application converting the messages from the client device into code interpreted by the terminal in keyboard code. In another feature, the memory area of the portable device comprises a first counter incremented by the generation of a password and a shared secret key, the memory area of the portable device further comprising at least the URL of the host device as well as an indication of the identification of the application and the unique identifier of the portable device in code interpreted by the terminal as a keyboard code.

According to another particularity, the memory zone of the portable device comprises a first module implemented by the processing means of the portable device generating a first password from the shared secret key and the first counter to a rank n, the first module incrementing the first counter to a rank n + 1 when the first password is generated.

According to another particularity, the portable device comprises a usage file stored in a secret memory zone of the portable device, the usage file comprising a state of use of the portable device: a state corresponding to a state of "used" use of the portable device and a state corresponding to an "unused" usage state, the secret memory area comprising the utilization file being accessible to the server by a secure channel between the portable device and the remote device, the secure channel being opened by an algorithm for opening a secure channel. According to another particularity, the memory zone of the portable device comprises an algorithm for opening a secure channel and a set of three secret keys identical to the set of three secret keys of the remote device. The invention also relates to a remote device forming a host device of the system according to the invention, comprising a non-volatile secure memory area, communication means and data processing means, the remote device being characterized in that the remote device is identified by a URL address, the memory area of the remote device comprising at least one user identification algorithm, a portable device validity verification algorithm, an application execution algorithm, the memory area of the device remote server further comprising a database comprising at least a first file or table associating the user identifiers with the passwords of each user of the client devices, a second file or table associating at least one state of use of the portable device with the unique identifier of a portable device, a third file or table associating the URL address of the remote device with an identifier of the application, a fourth file or table associating the user identifiers with at least one identifier of the application, the memory area of the remote device further comprising at least one application. According to another particularity, the memory zone of the remote device comprises: a fifth file or table associating a second counter with the unique identifier of each client device, a second module implemented by the processing means of the remote device generating a second word pass from the shared secret key and the second counter at a rank p, a third module comparing the first password generated by the processing means of the portable device and the second password generated by the device processing means remote, the first password having been sent to the remote device by the portable device, the third module incrementing the second counter to a rank p + 1 when the second password is generated.

According to another particularity, the memory zone of the host device comprises an algorithm for opening a secure channel, an application for installing an algorithm for opening a secure channel between the secret memory zone of the client device and the client. host device and a set of three secret keys, the installation application being intended to be sent to the client device to install the opening algorithm on the terminal to control, by messages sent to the client device via the interface, modifying the usage file information stored in the secret memory area of the client device. The invention, with its features and advantages, will emerge more clearly on reading the description given with reference to the accompanying drawings in which: FIG. 1 illustrates the portable device in one embodiment. Figure 2 illustrates the management system in one embodiment. Figure 3 shows a flowchart illustrating the first part of the process. Figure 4 shows the continuation of the flowchart of Figure 3 illustrating the method. Figure 5 illustrates an example of an internet page representing a football field on which no player image has been installed.

Figure 6 illustrates the example of Figure 5 in which a player image has been installed. Figure 7 illustrates the steps of opening a secure channel with GlobalPlatform specifications.

DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION The invention will be described with reference to the figures listed above. The management system of at least one online application comprises at least two devices acting as host (H) or client (Cl), at least the client device (C1) of which is portable The management system can comprise a terminal (2) which communicates with a network (22) via means of connection or communication of the terminal (2) It will be understood that the terminal (2) is a personal computer means which can be a laptop PC or desktop computer, a tablet, smartphone or other equivalent means. This computer means is connectable to a network (22) such as the Internet by means of connection or communication and comprising at least one interface for connecting a device or any other device connectable to the Internet, a display means (21) and input means (23). The input means (23) is connected by a bus to the processing means of the computer means and to a connector or connection means according to the same standard. The processing means, such as a processor, allow the execution of command lines sent to the computer means. It will be understood that the input means (23) can be for example a computer keyboard. The display means may be a touch screen or non-touch screen. In the case of a touch screen, the input means may be displayed on the screen. The terminal (2) may also include a memory zone comprising at least one operating system and programs such as an Internet browser.

The interface may be a contactless reader using a radio-type protocol such as "Bluetooth®" technology or RFID (Radio Frequency IDentification) technology, in particular NFC (Near Field Communication) or near-field communication. The memory zone of the terminal (2) may comprise a read application for sending an interrogation signal, for example in the form of waves, to the client device (C1) placed near the interface and the reception messages from the client device as a result of the interrogation signal. The read application converts messages from the client device (C1) into codes interpreted by the terminal (2) in keyboard code.

The client device (Cl) may further include a USB connection means. Each system device, client (C1) and host (H), comprises at least one programmable nonvolatile permanent memory zone and data processing means. The system includes an authentication algorithm that, for example, ensures that the user physically uses the client device (C1). The memory area of the client device (C1) comprises a unique identifier. The unique identifier may be the serial number of the client device. The memory area of the client device (Cl) furthermore comprises messages stored in keyboard type HID code and processed as such by the terminal (2). The memory area of the host device (H) comprises at least one user identification algorithm, a client device validity checking algorithm (C1) and an application execution algorithm. The memory area of the host device (H) furthermore comprises a database comprising at least a first file or table associating the user identifiers with the passwords of each user, a second file or table associating at least one state of the client device (Cl) with the unique identifier of a client device (Cl), a third file or table associating the URL address of the host device (H) with an identifier of the application, a fourth file or table associating the 25 user identifiers with at least one identifier of the application.

In the rest of the description, the word table is to be understood as being a file or a table. The host device (H) may be identified by a code-interpreted URL address interpreted by the terminal as a keyboard code.

This address can be associated with an indication identifying the application to be executed. For example, the URL may include the indication identifying the application to be executed on the web page. For example, the URL may be in the form "http://server.directory.com/ADFR" where "server.address.com" is a line of characters representing the address of the host device (H ) and "ADFR" is a line of characters giving an indication of the object to be installed on the Internet page. The set including the url address and the identification of the application may be, for example, in code interpreted by the terminal (é) as a keyboard code or other equivalent method.

The memory area of the host device (H) further comprises at least one application to be executed. The application may be the sending of command lines or messages to the terminal (2) for displaying an image stored in the memory zone of the host device (H) by the display means of the terminal (2) according to placement coordinates of the image in the display of an Internet page. The application may be sending command lines or messages to the terminal (2) for displaying an animation stored in the memory zone of the host device (H) by the display means of the terminal (2) according to placement coordinates of the animation in the display of an Internet page. Other types of applications may be stored in the memory area of the host device.

The client device (Cl) or otherwise called portable device may be connectable to the terminal (2), for example a personal computer connected to the local or wide area network. By portable device is meant a device that can be put for example in a pocket of clothing. The portable client device (Cl) is for example included in a chip card (1) comprising a body made of conventional synthetic material, for example ABS (Acrylonitrile Butadiene Styrene) or PVC (Polyvinyl Chloride). According to an alternative embodiment, the body of the card (1) can be made of biodegradable material. In one embodiment, the client device (C1) may be a paper tag or a sticker. In one embodiment, the card (1) comprises a pre-cut detachable portion intended to form a portable user object. The detachable portion of the card (1) is delimited by a linear recess (D), and is attached to the rest of the body of the card (1) by means of frangible connection means thus interrupting the linear recess.

The client device (C1) communicates with the host device (H) via the terminal (2). The portable user object may be connected to a computer host via an interface using the radio type protocol, or any other equivalent interface. The computer host is in a non-limiting manner the terminal (2) of a user. According to one embodiment, the portable device (Cl) user comprises in particular an electronic device secured to the body of the object for example with a conventional adhesive during a step of integration of the electronic device. The electronic device comprises serial transmission computer bus type connection means. In some embodiments, the electronic device is an electronic chip electrically connected to an antenna. According to one embodiment, the electronic chip may comprise, for example and without limitation, at least one microcontroller, such as for example and without limitation a microprocessor comprising a volatile memory, one or more memory spaces, for example memories secure permanent non-volatile programmable integrated or not in the microcontroller.

The application management system according to the invention therefore comprises at least two devices acting as host or client, at least the client device (C1) of which is portable, communicating via a terminal (2) with a network ( 22) via means of connection or communication of the terminal (2).

The memory area of the client device (C1) may comprise at least one URL address of the host device (H) and an indication identifying the application to be executed. As seen above, the URL may include the indication identifying the application to be executed. The memory area of the client device (C1) also comprises a first counter incremented by the generation of a password, a key shared between the client device and the host device and a unique identifier of the client device (C1). The first counter and the shared key are used by the authentication algorithm. The memory zone of the host device (H) may also comprise a fifth file or table associating a second counter with the unique identifier of each client device to implement the authentication algorithm and the secret key shared between the client device ( Cl) and the host device (H). Thus, the fifth file comprises a plurality of second counters each of which is associated with a client device (Cl). According to one embodiment, the fifth file or table can associate each client device with a second counter and a secret key shared between the host device (H) and a client device (C1).

The system authentication algorithm may be of the one-time password or one-time password type. This algorithm can be based, for the generation of the passwords, on the algorithm HOTP (HMACbased One-Time Password) published by the IETF (Internet Engineering Task Force) in conformity with the RFC 4226 specification. The algorithm HOTP is him - even based on the Hashed Message Authentication Code (HMAC) function and the SHA-1 (Secure Hash Algorithm) algorithm. The authentication algorithm may comprise a first module implemented by the client device processing means (Cl) generating a first password from the shared secret key and the first counter to a rank n. The first module increments the first counter to a rank n + 1 when the first password is generated. This first module is stored in the memory area of the client device (Cl). The authentication algorithm may furthermore comprise a second module implemented by the processing means of the host device (H) generating a second password to from the shared secret key and the second counter to a rank p. The second counter is the one associated with the unique identifier of the client device (Cl) from the fifth file or table. According to one embodiment, the shared secret key can also be associated with the unique identifier of the client device (Cl). The second module is stored in the memory area of the host device (H). The authentication algorithm may furthermore comprise a third module comparing the first password generated by the processing means of the client device (C1) and the second password generated by the processing means of the host device (H). In order to be compared, the first password is sent to the host device (H) by the client device (C1). The third module increments the second counter to a rank p + 1 when the second password is generated. The third module is stored in the memory area of the host device (H).

Passwords are created from the HOTP algorithm.

In a particular embodiment, the client device (C1) comprises a usage file stored in a secret memory zone of the client device (C1). This secret memory zone may be included in the memory area of the client device or may be a memory area that is independent of the client device (C1). This secret memory zone is only accessible via a secure channel. The usage file includes a usage state information of the client device (C1): a state corresponding to a usage state "used" of the client device (C1) and a state corresponding to a usage state " Not used ". The file is accessible to the host device (H) through a secure channel between the client device (C1) and the host device (H). This secure channel is opened by an algorithm for opening a secure channel. In this particular embodiment, the memory zone of the host device (H) comprises the algorithm for opening a secure channel. Its memory area also includes an application for installing this algorithm for opening a secure channel between the client device (C1) and the host device (H) and a set of three secret keys. The installation application is intended to be sent to the client device (Cl) to install the opening algorithm on the terminal (2) in order to control, by messages sent to the client device (Cl) via the interface, modifying the information of the usage file stored in the memory area of the client device (Cl). In this particular embodiment, the memory area of the client device (C1) may already comprise a set of three secret keys identical to the set of three secret keys of the host device (H). Similarly, the memory area of the terminal may already include an algorithm for opening a secure channel.

This case can be encountered when, for example, the client device (Cl) has already been connected to the host device (H) via the same terminal (2). The invention also relates to a method for managing at least one application. This method is implemented by the system according to the invention.

The method includes a step of connecting to the URL address of the host device (H) provided by a client device (C1) read by the terminal. According to one embodiment, after insertion of the client device (C1) in the interface of the terminal, a program of the client device (C1) commands the sending of a message including codes by the client device processing means so that the client device behaves as a keyboard-type human / machine interface and the memory area of the terminal (2) comprises at least one identifier for identifying the client device (C1) connected as a human-machine interface keyboard. The program also orders the sending of a message including codes (NID generic) by the processing means of the client device so that the client device behaves as a man / machine control interface managing the information coming from the terminal .

According to one embodiment, after the client device (C1) is connected to the terminal (2), the operating system of the terminal (2) can automatically execute a connection of the client device (C1) to the URL stored in the memory area of the client device (Cl). For example, in an operating system such as Windows, an autoruninf file is included in the root of the memory area of the client device (Cl). This program makes it possible, for example, to open an Internet browser program included, for example, in the memory area of the terminal (2) on the page corresponding to the URL address stored in the memory area of the client device (Cl). According to one embodiment, after the client device (C1) is connected to the terminal (2), the user searches in the memory area of the client device (C1) for a file allowing the opening of an Internet browser program included in the memory area of the terminal (2) on the page corresponding to the URL address stored in the memory area of the client device (Cl).

Other embodiments are possible. The method also comprises a step of authentication of the client device (C1) implemented by the authentication algorithm. If the client device (C1) is authenticated, the method also comprises a user identification step. implemented by the user identification algorithm. If the user is identified, the method further comprises a step of verifying the validity of the client device (Cl).

If the client device (C1) is validated, the method further comprises a step of executing the application. During the connection step (100), the client device (C1) is connected to the URL (100a) of the host device (H) stored in the memory area of the client device (Cl) via a connection to the terminal (2). Thus, when the client device (C1) is connected to the terminal (2), the operating system of the terminal (2) can identify (100b) the client device (C1) which sends a unique identifier of the client device (C1) to host device (H). The following step is a step (101) of authentication of the client device (Cl) by the authentication algorithm. This step can be triggered by the host device (H) when the client device (C1) is connected to the host device (H). This algorithm comprises at least one step (1011) for generating, by the first module which is implemented by the client device processing means (C1), a first password from the shared secret key and the first counter at a rank n.

When the first password has been generated, the algorithm executes a step (1012) of incrementing the first counter to a rank n + 1. In parallel, a step (1013) for generating, by the second module which is implemented by the processing means of the host device (H), a second password from the shared secret key and the second counter to a rank p. The second counter is the one associated with the unique identifier of the client device (C1) connected from the fifth file or table. When the first password has been generated, the algorithm executes a step (1016) of sending by the client device (C1) to the host device (H) of the first password. In a step (1015) of comparison, by the third module implemented by the processing means of the host device (H), the first password is compared with the second password.

If the first password is identical to the second password (1019), the second counter is incremented (1020) to a rank p + 1. The processing means of the host device then modify the fifth file by modifying the rank of the second counter of rank p at rank p + 1. The client device (Cl) is then authenticated (1021).

On the other hand, if the first password is different from the second password (1017) or if no password is provided by the client device (Cl), the process is stopped and the connection to the host device (H) is rejected (1018). This authentication step (101) thus makes it possible to control that a client device (C1) is physically connected to the terminal (2). Indeed, for the client device (Cl) to connect to the host device (H), the URL of the host device (H) is not sufficient. The first password is required for the connection to be effective. For example, if a user enters the URL of the host device (H) in an internet browser program without a client device (Cl) being connected, no password is sent to the host device (H), the connection is rejected. As already described above, the generation of passwords may be based on the HOTP (HMAC-based One-Time Password) algorithm published by the Internet Engineering Task Force (IETF) in accordance with RFC Specification 4226 If the client device (C1) is authenticated (1021), the method further comprises a step of identifying (1022) the user by the user identification algorithm. The algorithm sends commands to the terminal to perform the following steps by the terminal processing means. A step of displaying by the display means (21) of the terminal (2) at least two input areas, the display being controlled by the identification algorithm.

A cursor displayed on the first input area makes it possible to perform the step (1023) of inputting an identifier of the user by the input means of the terminal (2) in the first input area. After the identifier is entered in the first input area, the cursor is displayed in the second input area to perform the step of entering (1023) a password associated with the user's identifier by the input means of the terminal (2) in the second input area. After the identifier is entered in the first input area and the password associated with the identifier is entered in the second input box, the user validates the identifier and the password using the input means (23) by pressing for example a validation key input means (23). Before being sent to the host device (H), the password and / or the identifier can be encrypted (1024) by the processing means of the client device (C1). After the encryption (1024), the encrypted identifier and / or password are sent (1025) to the host device (H). If the identifier and / or the password are encrypted, a decryption step (1026) is performed by the processing means of the host device (H).

The identifier and the password are then verified by the identification algorithm from the first table of the database stored in the memory area of the client device (C1). If the database includes the identifier of the user associated with the password entered by the user, the user is identified (1029).

Otherwise, the user is not identified (1027) and the connection is rejected (1028). The identification algorithm can also provide the ability to add a user account by commands sent to the terminal to perform the following steps. When the display means (21) of the terminal (2) display at least two input zones, the display may also include the possibility of adding an account. The display may, for example, present a link that leads to an Internet page displaying a registration form requesting at least one user identifier and the password of the user. After completing the registration form by the terminal entry means (2) and after validation of the registration form by the terminal entry means (2), the information entered by the user is stored in the area memory of the client device (Cl). The username and password of the user are stored in the first table of the host device database (H).

The identification algorithm can also give the possibility of not identifying. In this case, the user is not identified and the connection is rejected. If the user is identified (1029), the method further comprises a step of verifying the validity of the client device (Cl).

This verification step is performed by the client device validity checking algorithm (C1) implemented by the processing means of the host device (H). The verification step (1030) of validity of the client device (C1) makes it possible to know whether the application has already been executed or not. Thus, the same client device (Cl) does not allow the application associated with the client device (Cl) to be executed from other user identifiers. The verification step may comprise at least one step of sending by the client device (C1) to the host device (H) the unique identifier of the client device (C1). This sending step can also be performed before the authentication step (101) or before the identification step (1022) of the user. The processing means of the host device (H) then perform a check, from the second table, of the state of use of the client device (C1) from the unique identifier of the client device (C1). This second table associates the unique identifiers of the client devices with their state of use or usage information. The usage state corresponds to the fact that the application associated with the client device (C1) has already been executed or not. If the application associated with the client device (C1) has already been executed, the state associated with the unique identifier of the client device (C1) indicated in the second table is the "used" state, for example "0". On the other hand, if the application has never been executed, the state associated with the unique identifier of the client device (C1) indicated in the second table is the "unused" state, for example "1".

If the usage state corresponds to a "used" state (1031), a verification step (1032) to verify that the user's identifier is associated in the fourth array with the identifier or the identifiers of another or other applications associated with one or other client devices. This step may be followed by a step (1033) of possible execution of the eventual or possible other applications by the processing means of the host device or the terminal. Thus, the application associated with a client device can not be executed to another user account if it has already been executed once. The number of executions can be greater than once by adding in the fourth table information indicating the number of times the application can be executed. If the usage state corresponds to an "unused" state (1034), the client device (C1) is validated. According to the particular embodiment, the verification step (1030a) consists in verifying, in the utilization file stored in the secret memory zone of the client device (C1), the information of the state of use of the client device (C1) after a step of opening (1030b) a secure channel by an algorithm for opening a secure channel. The opening of a secure channel is described below.

After verifying that the client device (C1) is validated, the application is executed by the application execution algorithm according to the following steps. a step of verifying the application to be executed from the indication in the URL address of the host device (H) stored in the memory zone of the client device (C1) according to the third table, - a step ( 1036) of display on the display means (21) of the terminal (2) of a window having a choice of execution or not of the application to be executed, the window representing at least one hardware or virtual key allowing the execution of the application and a hardware or virtual key allowing the refusal of execution of the application, - a step (1035) of choice by the means of entering the terminal (2) by the user. If the user actuates the input means (23) such that the hardware or virtual key allowing the refusal of execution is validated (1036b), the method comprises a step of execution by the terminal processing means or the means for processing the host device of the one or more applications associated with another or other client devices without executing the application associated with the client device (C1).

If the user actuates the input means (23) such that the hardware or virtual key enabling the execution is validated (1036a), the method comprises: a step (1037a) of execution by the processing means of the terminal or means for processing the host device of the one or more applications associated with another or other client devices without executing the application associated with the client device (C1), - a step (1037b) of execution by the processing means of the terminal or the processing means of the host device of the application associated with the client device (C1) - a step (1038, 1039) of modifying the usage information of the "unused" state to pass the usage information to the "used" state. This step can also precede the display step. The method may also include the following steps.

During the selection step during the execution step of the application, if the user actuates the input means (23) so that the key allowing the execution is validated (1036a), the step (1038) Change of the "unused" usage state in the "used" usage state corresponds to the change of the usage information of the "unused" state is changed to the use state "Used" corresponding to the modification of the state in association with the unique identifier of the client device (C1) on the second file or table.

According to the particular embodiment represented by the dashed blocks of FIGS. 2 and 3, the authentication step may be followed by an installation step (100d) by the processing means of the terminal (2) of a algorithm for opening a secure channel in the memory area of the terminal (2), the opening algorithm having been sent (100c) by the host device (H). This algorithm can be an applet programmed in Java or a plugin-type application or software installed directly on the memory area of the terminal (2) and read by the processing means of the terminal (2). According to the particular embodiment, during the selection step during the execution step of the application, if the user actuates the input means (23) so that the key allowing the execution is validated , the step of modifying the usage information from the "unused" state to the "used" state corresponds to the modification (1039) of the usage file information stored in the memory area of the client device (Cl) by an algorithm for changing the information contained in the utilization file after a step of opening (1039) a secure channel by an algorithm for opening a secure channel implemented by the means processing of the host device (H) and the terminal (2). This is done to know if the application associated with the client device (Cl) has already been executed or not.

In this particular embodiment, to allow the opening of this secure channel, the host (H) and client (Cl) devices comprise at least one encryption / decryption algorithm and at least one set of encryption keys stored in the secret memory area of the client device (Cl), this area being inaccessible from the outside. For example and without limitation, the keys of each game are symmetrical. For example, the encryption / decryption algorithm used is a so-called triple DES algorithm (3-DES, 20 DES coming from the English "Data Encryption stantard"). Each set of secret keys includes for example three secret keys 3-DES, denoted ENC, MAC and DEK. The ENC key is a secret encryption key for data, ensuring the confidentiality of the data exchanged. The secret key MAC is a key to integrity. The 3-DES algorithm using the secret key MAC on a data generates a digital signature accompanying each data encrypted by the algorithm and the key MAC. This digital signature ensures that data transferred from one device to another is not corrupted. Finally, the DEK key is a secret key for encrypting confidential data, and provides additional protection for sensitive data, for example and without limitation, containing information concerning user data. In this particular embodiment, the host (H) and client (Cl) devices may comprise an operating system, implemented by the processing means, comprising the algorithms and commands necessary for opening a channel. secure having the GlobalPlatform specifications allowing the secure exchange of data between the client, for example a portable user object (Cl), and the host (H), for example a server.

In this particular embodiment and with reference to FIG. 7, the method of opening a secure channel having GlobalPlatform specifications between the client device (C1) and the host device (H) will now be described. The opening of this channel is performed via a 3-DES algorithm stored in a non-volatile secure memory area of the host device and the client device, and a set of three secret keys ENC, MAC and DEK stored in a secret memory area of each device (H, Cl), not accessible from the outside. During the first step, the processing means of the host device (H) control the opening of a new session. Information indicating the opening of the session is sent to the client device (C1) by the processing means of the host device (H). Upon receipt of this information, the processing means of the client device generates (60) a session counter (SC) incremented each time a new session is opened. This session counter is stored in a memory area of the client device (Cl).

During the second step, the processing means of the client device (C1) perform a derivation operation (501) of the three secret keys ENC, MAC and DEK, via the 3-DES algorithm using the session counter (SC) and a host random number (HC) generated by the processing means of the host device (H), said random number (HC) being sent (61) to the client device (C1) and stored in the memory of the client device. Following this derivation step, five secret derived keys are generated (90) by the processing means of the client device (C1), and stored in a memory area of the device (C1). The first key, named S-ENC, makes it possible to encrypt the commands sent to one device (H, Cl) by the other device (H, Cl). The second key, named R-ENC, is used to encrypt the responses sent to one device by the other device. The two keys named C-MAC and R-MAC respectively allow to generate a signature for each command and for each answer sent, thus ensuring the integrity of the transferred data. Finally, the fifth key, named S-DEK, is used to encrypt confidential data, whether commands or responses. During the fourth step, the client device processing means (C1) generates (504) a client cryptogram (Ccryptoc), via the algorithm 3- DES using the derived key S-ENC and the host random number (HC ) and a client random number (CC) generated by the processing means of the client device (C1). During the fifth step, this client cryptogram (Ccryptoc), the session counter (SC) and the client random number (CC) are sent to the host device (H) by the processing means of the client device (Cl). The client cryptogram (Ccryptoc), the session counter (SC) and the client random number (CC) are stored in a memory area of the host device (H). In parallel, the processing means of the host device (H) calculate (500, 80) the five derived keys S-ENC, R-ENC, C-MAC, R-MAK and S-DEK via the triple DES algorithm using the counter session (SC) and the host random number (HC). With the data received in the fifth step, the processing means of the host device (H) compute (503) the client cryptogram (CcryptoH) via the triple DES algorithm using the derived key S-ENC, the host random number (HC ) and the client random number (CC). During the seventh step, the processing means of the host device (H) compare the client cryptograms (Ccryptoc, CcryptoH) respectively calculated by the client device (Cl) and the host device (H). If the two client cryptograms (Ccryptoc, CcryptoH) are identical, then the client device (C1) is authenticated by the processing means of the host device (H). During the eighth step, the processing means of the host device (H) calculates (502) a host cryptogram (HcryptoH), via the algorithm 3- DES using the derived key S-ENC, the random host number (HC) and the client random number (CC). This host cryptogram (HcryptoH) is stored in a memory area of the host device (H). During the ninth step, this host cryptogram (HcryptoH) is sent (62) to the client device (C1) by the processing means of the host device (H). The host cryptogram (HcryptoH) is stored in a memory area of the client device (Cl). With the data received in the ninth step, the processing means of the client device (C1) compute (505) the host cryptogram (Hcryptoc) via the 3-DES algorithm using the derived key S-ENC, the random host number ( HC) and the client random number (CC). During the eleventh step, the processing means of the client device (C1) compare the host cryptograms (HcryptoH, Hcryptoc) respectively calculated by the client device (C1) and the host device (H). If the two host cryptograms (HcryptoH, Hcryptoc) are identical, then the host device (H) is authenticated by the client device processing means (Cl). This process concludes with the confirmation of the opening of a secure channel (OSCS), through which the next commands and / or response generated by the host (H) and client (Cl) devices can be realized. This security channel makes it possible, for example, for the processing means of the host device (H) to modify the usage file stored in the memory of the client device (C1). Thus, it is possible to know the state of use of the client device 10 of at least two different modes that can be implemented together or alone. According to one embodiment, the unique identifier of the client device is associated with the state of use of the client device in the second file or table stored in the memory area of the host device. According to the particular embodiment, a usage file stored in the memory area of the client device (C1). The usage file includes client device usage status information (C1): a state corresponding to a "used" state of use of the client device (C1) and a state corresponding to a usage state " Not used ". The usage status information is modified by the algorithm for changing the information contained in the usage file installed in the memory area of the terminal (2). Figures 5 and 6 show embodiments of the method. The application is an application for installing an object such as an image on an Internet page (2000, 2001). Figure 4 shows a football field on which player images can be installed. On the Internet page (2000) of Figure 4, no player has been installed. Only the locations (2003) of the images of the players are represented.

When a user connects a client device to his device and this client device has never been used to install a player image, he has the option or not to install a player image associated with his client device. For example, the client device may be in the form or represented an image of the player whose image can be installed on the football field represented on the web page. Figure 5 shows the web page (2001) with an image (2002) of a player installed thanks to his client device. Subsequently, if this user reconnects his client device on his terminal, it will no longer have the ability to install another image of the player already installed through this client device, or the image of another player. But, the connection of his already used client device will allow him to go directly to the Internet page with his player images already installed with the use of eg password. According to another embodiment, the application may give the possibility of choosing the player to add on the web page. Thus, the application sends to the terminal processing means commands for displaying a window representing several selectable player choices with information to designate the position of the selected player on the field displayed by the display means of the terminal. The player may be selected by selection means. These selection means may be at least one virtual key corresponding to the player of the terminal input means or at least one virtual key corresponding to the player of the display means of the terminal if the display means is, for example, a touch screen. A file or a table can associate the name of the player with the user's name, last name or first name. The present application describes various technical features and advantages with reference to the figures and / or various embodiments. Those skilled in the art will appreciate that the technical features of a given embodiment may in fact be combined with features of another embodiment unless the reverse is explicitly mentioned or it is evident that these features are incompatible. In addition, the technical features described in a given embodiment can be isolated from the other features of this mode unless the opposite is explicitly mentioned. It should be obvious to those skilled in the art that the present invention allows embodiments in many other specific forms without departing from the scope of the invention as claimed. Therefore, the present embodiments should be considered by way of illustration, but may be modified within the scope defined by the scope of the appended claims, and the invention should not be limited to the details given above.

Claims (5)

REVENDICATIONS1. Management system for at least one online application characterized in that it comprises at least two devices acting as host (H) or client (Cl), at least the client device (CI) is portable, a terminal (2) communicating with a network (22) via means of connection or communication of the terminal (2), the client device (C1) connecting to the terminal (2) through an interface of the terminal as a keyboard device, each device (H, Cl) comprising at least one non-volatile permanent memory zone to programmable and data processing means, the terminal comprising a memory zone and data processing means, the management system comprising an authentication algorithm, the memory area of the client device (C1) comprising a unique identifier and messages stored in code code and processed as such by the terminal (2), the memory area of the host device (H) comprising at least one identification algorithm a user verification algorithm, a client device validity verification algorithm (C1) and an application execution algorithm, the memory area of the host device (H) further comprising a database comprising at least a first file or table associating the user identifiers with passwords of each user, a second file or table associating at least one state of use of the client device (Cl) with the unique identifier of a client device (CI) a third file 25 or table associating the URL address of the host device (H) with an identifier of the application, a fourth file or table associating the user identifiers with at least one identifier of the application, the memory zone the host device further comprising an application, the host device (H) being identified by a URL, the memory area of the client device (C1) further comprising at least the URL of the host device te (H) and an indication of the identification of the application. 2. System according to claim 1, characterized in that the interface of the terminal uses a radio type protocol. 3. System according to claims 1 and 2, characterized in that the memory area of the terminal (2) comprises a read application for sending an interrogation signal to the client device (Cl) placed nearby and the reception of messages from the client device following the interrogation signal, the read application converting the messages from the client device (C1) into code interpreted by the terminal in keypad code. 4. System according to claim 1, characterized in that the memory area of the client device (Cl) comprises a first counter incremented by a generation of a password and a shared secret key used by a module of the algorithm of authentication in the client device (C1), the memory area of the client device (C1) further comprising at least the unique identifier of the client device (C1), the memory area of the host device (H) further comprising the shared secret key with the client device (C1) associated with a user and a fifth file or table associating a second counter with the unique identifier of each client device (Cl). 5. System according to claims I to 4, characterized in that the authentication algorithm comprises: a first module implemented by the client device processing means (Cl) generating a first password from the key shared secret and the first counter at a rank n, the first module incrementing the first counter to a rank n + 1 when the first password is generated, the first module being stored in the memory area of the client device (C1), a second module implemented by the processing means of the host device (H) generating a second password from the shared secret key and the second counter at a rank p, the second counter being that associated with the identifier of the device client (Cl) to rtir fifth file or table, the second module being stored in the memory area of the host device (H), a third module implemented by the processing means of the host device (H) comparing the first password generated by the processing means of the client device (C1) and the second password generated by Io the processing means of the host device (H), the first password having been sent to the host device (H) by the client device (C1), the third module incrementing the second counter to rank pi-1 when the second password is generated, the third module being stored in the memory area of the host device (H) . A system according to claim 1, characterized in that the client device (C1) comprises a usage file stored in a secret memory area of the client device (C1), the usage file including a status information of use of the client device (C1): a state corresponding to a "used" state of use of the client device (C1) and a state corresponding to an "unused" usage state, the secret memory zone being accessible to the device host (H) by a secure channel between the client device (C1) and the host device (H), the secure channel being opened by an algorithm for opening a secure channel. 7. System according to claims 1 and 6, characterized in that the memory zone of the host device (H) comprises an algorithm for opening a secure channel, an installation application of an opening algorithm of a secure channel between the client device (C1) and the host device (H) and a set of three secret keys, the installation application being intended to be sent to the client device (C1) to install the opening algorithm on the terminal (2) for controlling, by messages sent to the client device (C1) via the interface, a modification of the information of the usage file stored in the secret memory zone of the client device (C1), the memory zone the host device (H) also comprising an algorithm for changing the information contained in the usage file. 8. System according to claims 1, 6 and 7, characterized in that the memory area of the client device (Cl) comprises a set of three secret keys identical to the set of three secret keys of the host device (H), the terminal (2). ) comprising the algorithm for opening a secure channel. 9. System according to claim 1, characterized in that the application sends commands or messages to the terminal for an Io display of an image stored in the memory area of the host device (H) by display means of the terminal ( 2) according to the placement coordinates of the image in the display of an Internet page. 10. System according to claim 1, characterized in that the application sends commands or messages to the terminal allowing a display of an animation stored in the memory zone of the host device (H) by means of display of the terminal ( 2) according to placement coordinates of the animation in the display of an Internet page. 11. Method for managing at least one application implemented by the system according to at least one of claims 1 to 10, the terminal (2) comprising at least one connection to an Internet network (22), an input means (23) and display means (21) characterized in that the method comprises at least one step (100) of connection to the URL of the host device (H), the URL address of the host device (H) being provided by a client device (C1) read by the terminal (2), a step (101) of authentication of the client device (C1) implemented by the authentication algorithm, if the client device (CI) is authenticated (1021), the method further comprising a user identification step (1022, 1023, 1024, 1025, 1026, 1027, 1028, 1029) implemented by the identification algorithm of if user is identified (1029), the method further comprising a step (1030) of verifying the validity of the client device (Cl), if the client client (C1) is validated (1034), the method further comprising a step (1037b) of executing the application. 12. Method according to claim 11, characterized in that the step (100) of connection to the URL address of the host device (H) comprises: a step (100a) of connection of the client device (C1) to the URL address 10 of the host device provided by the information stored in the memory area of the client device (C1) via a connection to the terminal (2), - a step (100b) of sending by the client device ( Cl) to the host device (H) of the unique identifier of the client device (Cl). 13. Method according to claim 11, characterized in that the authentication step (101) implemented by the authentication algorithm comprises: a generation step (1011), by the first module implemented by the means for processing the client device (C1), a first password from the shared secret key and the first counter at a rank n, - a step (1012) of incrementing the first counter with one rank n + 1, - a step (1013) for generating, by the second module implemented by the processing means of the host device (H), a second password from the shared secret key and the second counter with a rank p the second counter being that associated with the unique identifier of the client device (C1) from the fifth file or table, - a step (1016) of sending by the client device (C1) to the host device (H) the first password via the terminal (2), - a step (1015) of c comparing, by the third module, the first password and the second password, if the first password is identical to the second password (1019), the second counter being incremented to a rank p + 1 (1020) and the client device (C1) being authenticated (1021). Method according to claim 11, characterized in that the identification step (1022) implemented by the user identification algorithm comprises the following substeps: a display step by the means display (21) of the terminal of at least two input areas, the display being controlled by the identification algorithm, - a step (1023) of entering an identifier of the user by the means of entering the terminal (2) in the first input area, - a step (1023) for entering a password associated with the identifier by the inputting means of the terminal (2) in the second input area, - a step (1024) of encryption by the processing means of the terminal (2) and sending (1025) of the identifier and the password to the host device (H), - a step (1026) of decryption by the means for processing the host device (H) and verifying the identifier and the password by the identification algorithm from the prem ier file or table of the database stored in the memory area of the host device (Cl); if the first file or table of the database includes the identifier of the user associated with the password entered by the user, the user being identified (1029). 15. Method according to claim 11, characterized in that the step (1030) for verifying the validity of the client device (C1) implemented by the validity verification algorithm comprises: a verification step, in the second table the state of use of the client device (C1) from the unique identifier of the client device (C1); if the usage state corresponds to a "used" state (1031), the method comprising: - a step (1032) of checking one or more applications associated with another or other client devices from the identifier of the user according to the fourth table, - a step (1033) of execution by the processing means of the terminal or the processing means of the host device (H) of the other applications associated with another or other client devices without running the application associated with the client device (Cl); if the usage state corresponds to an "unused" state (1034), client device (C1) being validated. 16. The method as claimed in claim 11, characterized in that the step (1030) of verifying the validity of the client device (C1) implemented by the validity verification algorithm comprises: a verification step (1030a), in the utilization file stored in the secret memory area of the client device (C1), information of the state of use of the client device (C1) after a step (1030b) of opening a secure channel by an algorithm for opening a secure channel; if the usage state corresponds to a "used" state, the method comprising: a step (1032) of checking one or more applications associated with another or other client devices from the identifier of the user according to the fourth table, - a step (1033) of execution by the processing means of the terminal or the processing means of the host device (H) of the other application or associated with another or other client devices without running the application associated with the client device (Cl); if the usage state corresponds to an "unused" state (1034), client device (C1) being validated. 17. The method as claimed in claim 11, characterized in that the step of executing the application implemented by the application execution algorithm comprises: a step of verifying the application to be executed at from the indication included in or asociated with the URL stored in the memory area of the client device (C1) according to the third table, - a step of sending command by the host device (H) to enable the displaying on the display means (21) of the terminal (2) a window presenting a choice of execution or not of the application to be executed, the window representing at least one hardware or virtual key allowing the execution of the application and a hardware or virtual key allowing the refusal of execution of the application, io - a step (1036) of choice by means of inputting the terminal (2) by the user, if the user activates the input means (23) so that the hardware key or virtual allowing the refusal of execution is validated (1036b), the method comprises an execution step by the processing means of the terminal (2) or the processing means of the host device (H) of the associated application or applications to another or other client devices without running the application associated with the client device (Cl); if the user actuates the input means (23) such that the hardware or virtual key enabling execution is enabled (1036a), the method comprising: - a step (1037a) of execution by the processing means of the terminal or the means for processing the host device (H) of the application or applications associated with another or other client devices without the execution of the application associated with the client device (C1), 25 - a step (1037b ) execution of the application by the processing means of the terminal or the processing means of the host device of the application associated with the client device (C1) - a step (1038) of modifying the usage information of the the "unused" state to pass the usage information to the "used" state. 18. The method according to claims 11 and 13 characterized in that the authentication step is followed by an installation step (100d) by the terminal processing means (2) of an opening algorithm of a secure channel an application for installing the algorithm for opening a secure channel that has been sent (100c) by the host device (H). Method according to claim 16 and 17, characterized in that, in the step (1036) of choice, if the user actuates the input means (23) in such a way that the key enabling execution is validated , the step (1039) of modifying the usage information from the "unused" state to the "used" state corresponds to the modification of the information of the usage file stored in the secret memory zone of the device client (C1) after a step (1040) of opening a secure channel by an algorithm for opening a secure channel implemented by the processing means of the host device (H) and the terminal (2). 20. Method according to claims 16 and 19, characterized in that the algorithm for opening a secure channel is performed via a triple DES algorithm and a set of three secret keys (ENC, MAC, DEC) according to a protocol of specified security of the GlobalPlatform type, the triple DES algorithm and the set of three secret keys (ENC, MAC, DEC) being stored in the memory zone of the host device and the client device (Cl), the opening algorithm of a secure channel comprises: a) a logon step by the host device processing means (H), followed by (60) the generation of a session counter (SC) by the client device (C1) sent (70) to the host device (H), the session counter being incremented at each opening of a new session, b) a step of derivation (501) secret keys (ENC, MAC, DEK) stored in the device memory client (Cl), produced by the processing means of said device v the triple DES algorithm using the session counter (SC) and a random host number (HO) generated and sent (61) to the client device (C1) by the processing means of the host device (H), c) a step generating (90) five derived keys S-ENC, R-ENC, C-MAC, R-MAC and S-DEK used with the triple DES algorithm, respectively allow to encrypt (S-ENC) the commands sent to a device, to encrypt (R-ENC) the responses of the device, to generate a signature (CMAC) for each command, to generate a signature (R-MAC) for each response, and to encrypt (S-DEK) data confidential, d) a generation step (504) by the client device processing means (C1) of a client cryptogram (Ccryptoc), via the triple DES algorithm using the derived key S-ENC, the host random number ( HC) and a client random number (CC) generated by the client device processing means (Cl), e) a sending step ( 70, 71, 72) by the client device processing means (C1) to the host device (H), the session counter (SC), the client random number (CC) and the client cryptogram (Ccryptoc) calculated at the preceding step, followed by calculation (500) and generation (80) of the five derived keys (S-ENC, R-ENC, C-MAC, R-MAC, S-DEK) by the device processing means host (H), f) a step of generating (503), by the host device processing means (H), the client cryptogram (CcryptoH) via the triple DES algorithm using the derived key S-ENC, the number random host (FIC) and the client random number (CC) generated by the processing means of the client device (C1), g) a step of comparison by the processing means of the host device (H) of the client cryptograms (Ccryptoc, CcryptoH) respectively calculated by the client device (Cl) and the host device (H), followed by the authentication of the client device (Cl). they calculate the client cryptogram (Ccryptoc, CcryptoH) are identical, 25 h) a generation step (502) by the processing means of the host device (H) of a host cryptogram (HcryptoH), via the triple DES algorithm using the derived key S-ENC, the host random number (HO) and the client random number (CC), i) a sending step (62) by the processing means of the host device (H) to the client device ( Cl), the host cryptogram (HcryptoH) calculated in the previous step, j) a generating step (505), by the client device processing means (Cl), the host cryptogram (Hcryptoc) via the triple DES algorithm using the derived key S-ENC, the host random number (HC) and the client random number (CC), k) a comparison step by the processing means of the client device (C1) of the host cryptograms (HcryptoH, Hcryptoc) respectively calculated by the host device (H) and the client device (Cl), followed by the authentication of the host device (H) if the two host cryptogram calculations (HcryptoH, Hcryptoc) are identical, I) a step of confirmation of the opening of a session and the secure channel (OSCS) through which the next commands and / or response generated by the host and client devices will be realized. Method according to Claim 17, characterized in that, in the selection step, if the user actuates the input means (23) in such a way that the key enabling the execution is enabled, the step of to change the usage information from the "unused" state to the "used" state of use corresponds to the state change associated with the unique identifier of the client device (C1) on the second file or board. 22. A user device (Cl) forming a client device (C1) of the system according to at least one of claims 1 to 10 and comprising a non-volatile secure memory area, means for connection to a terminal interface and means for processing data, the memory area comprising at least a unique identifier and messages recorded in keyboard code and treated as such by the terminal. 23. User portable device (Cl) according to claim 22, characterized in that the connection means use a radio type protocol. 24. Portable device (Cl) user according to claims 22 and 23, characterized in that the memory area of the client device (C1) comprises a read application for sending an interrogation signal to the deviceclient (Cl) placed near and reception of messages from the client device following the interrogation signal, the reading application converting the messages from the client device (C1) into code interpreted by the terminal in keyboard code. 25. Portable device (Cl) user according to claims 22 to; 24, characterized in that the memory zone of the portable device (CI) 'comprises a first counter incremented by the generation of a password and a shared secret key, Io the memory zone of the portable device (C1) further comprising the minus the URL of the host device (H) and an indication of the identification of the application and the unique identifier of the portable device (C1) in code interpreted by the terminal as a keyboard code. 26. Portable device (Cl) according to claims 22 to 25, characterized in that the memory zone of the portable device (Cl) comprises a first module implemented by the processing means of the portable device (Cl) generating a first word The first module increments the first counter to a rank n + 1 when the first password is generated. 27. User portable device (Cl) according to claim 22, characterized in that the portable device (Cl) comprises a utilization file stored in a secret memory zone of the portable device (Cl), the utilization file comprising a portable device state of use information (Cl): a state corresponding to a "used" state of use of the portable device (C1) and a state corresponding to an "unused" usage state, the zone secret memory comprising the use file being accessible to the remote device (H) by a secure channel between the portable device (C1) and the remote device (H), the secure channel being opened by an algorithm for opening a channel sécurisé.28. User portable device (Cl) according to claims 22 and 27, characterized in that the memory zone of the portable device (Cl) comprises an algorithm for opening a secure channel and a set of three secret keys identical to the set of three keys secret of the remote device (H). 29. A remote device (H) forming a host device (H) of the system according to at least one of claims 1 to 10, comprising a non-volatile secure memory area, communication means and data processing means, the remote device ( H) being characterized in that the remote device (H) is identified by a URL address, the memory zone of the remote device (H) comprising at least one user identification algorithm, an algorithm for verifying the validity of the device portable computer (Cl), an application execution algorithm, the memory zone of the remote device (H) further comprising a database 15 comprising at least a first file or table associating the user identifiers with the passwords each user of the client devices, a second file or table associating at least one state of use of the portable device (Cl) with the unique identifier of a portable device (Cl), a tr third file or table associating the URL address of the remote device (H) with an identifier of the application, a fourth file or table associating the user identifiers with at least one identifier of the application, the memory area of the device remote (H) further comprising at least one application. 30. Remote device (H) according to claim 29, characterized in that the memory zone of the remote device (H) comprises a fifth file or table associating a second counter with the unique identifier of each client device (C1), a second module implemented by the processing means of the remote device (H) generating a second password from the shared secret key and the second counter to a rank p, a third module comparing the first password generated by the processing means of the portable device (C1) and the second password generated by the processing means of the remote device (H), the first password having been sent to the remote device (H) by the portable device (C1). ), the third module incrementing the second counter to a rank p + 1 when the second password is generated. 31. Remote device (H) according to claims 29 and 30, characterized in that the memory zone of the host device (H) comprises an algorithm for opening a secure channel, an installation application of an algorithm of opening a secure channel between the secret memory area of the client device (C1) and the host device (H) and a set of three secret keys, the installation application being intended to be sent to the client device (C1) for install the opening algorithm on the terminal (2) to control, by messages sent to the client device (Cl) via the interface, modifying the information of the usage file stored in the secret memory area of the device customer (Cl).