WO2015033061A1

WO2015033061A1 - Method for authenticating a transaction

Info

Publication number: WO2015033061A1
Application number: PCT/FR2014/052176
Authority: WO
Inventors: Emmanuel Ruiz
Original assignee: Emmanuel Ruiz
Priority date: 2013-09-03
Filing date: 2014-09-03
Publication date: 2015-03-12

Abstract

The invention relates to a method for authenticating a transaction between two users of said method, comprising the following steps: a one-time password is generated by an authentication server (13) at the request of one of the two users; the one-time password is split into at least two segments sent to at least one (12) of the mobile terminals; the sonic and/or ultrasonic messages corresponding to the one-time password segments are exchanged sonically and/or ultrasonically between the mobile terminals (12, 15); and the authentication server (13) receives the sonic and/or ultrasonic messages, decodes same in order to extract the segments therefrom, and compares the message once reconstituted with said one-time password for validation.

Description

TRANSACTION AUTHENTICATION METHOD

The present invention aims at a method of authentication between two users for data transfer method. It aims more precisely a so-called strong authentication method, without contact in the near field, in particular for remote payment method.

It falls within the field of secure data transmission methods.

Throughout the text, the term "server" generally refers to the computer function of making data and / or computer resources available to humans and / or machines, these resources being accessible via least one communication network (telecommunication network and / or computer network). Thus, a server may be physically constituted of any computer system, including a single computer or a plurality of computers connected in a network or grid. The term "mobile" and its derivatives applied to a terminal designates the fact that the latter is portable and adapted to be able to operate wirelessly with an external environment, in particular to communicate with a network. The term "user" denotes a human using at least a part of a process according to the invention.

In addition, the term "transaction" generally refers to any operation that may occur between users subject at least to an authentication by at least one secure server. It can in particular be a financial transaction (including bank transaction such as a transfer); a commercial transaction (including a payment transaction during a purchase); a legal or contractual transaction (proof of an agreement given on an agreement, for example when accessing a network or when downloading or using software); a technical transaction (for example configuration of access to a network (for example telecommunications and / or computer) for an identified user).

Moreover, the terms "audio" and "acoustics" generally refer to sounds and sound waves, that is to say both to sounds audible to the human ear, and to ultrasound. The expression "sonic and / or ultrasonic message" refers to any continuous transmission of signal uninterrupted acoustics in a time interval at the beginning of which the acoustic signal begins and at the end of which the acoustic signal stops. The terms "sonic" and "sound" are supposed to be synonymous. The terms "ultrasound" and "ultrasound" are supposed to be synonymous.

The term "coded" and its derivatives applied to a message refer to the fact that this message contains a code that can not be detected by a human by the mere knowledge of the message. A coded acoustic message is therefore unintelligible. The term "decode" and its derivatives, applied to an encoded message, refer to the fact of extracting the code transmitted by the coded message. The term "encrypted" and its derivatives refer to the fact that a signal, a set of data, a message or a code has been encrypted so that it is not understandable man or by a machine not having a decryption method for recovering the signal, the data set, the message or the code.

Preamble and prior art

Various methods of authenticating a user are already known during a credit card type transaction, for example during a purchase on an e-commerce site.

Among these methods, one of the most commonly used to date is the method in which, once a transaction is performed and the payment required online by the user on an e-commerce site, said user receives from his bank a code in the form of SMS on his mobile phone, and must enter this code on the payment user interface of his transaction to authenticate it. The fact that the person carrying out the transaction has the mobile phone of the holder of the bank account is considered as sufficient proof of the identity of this holder.

Similarly, when paying in a store by credit card, it is common for the user to enter his PIN on a payment terminal to validate his transaction. This signature by entering the secret code has however the disadvantage of the lack of security generated by the typing of the code in front of other people.

Other methods have been considered to overcome this disadvantage, in particular by use of e-credit card, that is to say a credit card single-use, whose data (called OTP for "One Time Password") is generated at the request of the user for use in a single purchase.

There is still known technology of telephone payments equipped for the near field communication process (in English "Near Field Communication", hence the acronym NFC). In this technology, a terminal transmits at a very short distance (typically 1 to 10 cm) an electromagnetic high frequency message to a receiving terminal for transmitting electronic signature information.

But, to date, only 3 to 5% of mobile phones are compatible with NFC technology, which limits the use of authentication by this means, and restricted, for cost reasons, its chances of generalization with merchants or customers.

US 201 1/258121 (D1) discloses a method and apparatus for enabling an automatic payment in which the equipment of the user wishing to make the payment generates and issues an audio token, the merchant's equipment picks up that audio token, the decodes and transmits a payment authorization request to a remote host center. The audio token generated by the user equipment may incorporate a password that has been previously transmitted to it by the remote server center.

These different processes are complex or lack security for the user.

Presentation of the invention

The invention therefore relates to a method of transaction authentication between two users of said method, a first user being provided with a first mobile terminal, a second user being provided with a second mobile terminal, at least one of these mobile terminals comprising means for transmitting an audio band signal, and at least the other mobile terminal having means for receiving an audio signal, said method comprising steps in which:

a one-time password is generated by an authentication server at the request of one of the two users, said one-time password is transmitted, via a communication network, to a mobile terminal associated with one of the users,

said one-time password is coded in the form of at least one sonic and / or ultrasonic message comprising at least part of the single-use password coded in the form of sounds and / or ultrasound in a band of frequencies compatible with reception by a mobile phone,

each sonic and / or ultrasonic message is transmitted by a mobile terminal and listened to by the other mobile terminal,

each sonic and / or ultrasonic message received by a mobile terminal is retransmitted by the mobile terminal to the authentication server for comparison with an expected message and for validation,

characterized in that

the one-time password is cut into at least two segments sent to at least one of the mobile terminals,

the sonic and / or ultrasonic messages corresponding to the one-time password segments are exchanged sonically and / or ultrasonically between the mobile terminals,

the authentication server receives the sonic and / or ultrasonic messages corresponding to the one-time password segments from the mobile terminals, decodes them to extract the segments thereof, and compares the message once reconstituted with said word of passes for single use for validation.

Advantageously and according to the invention, the authentication server cuts the one-time password in at least two segments (generally more than two segments) and sends these segments to at least one of the mobile terminals. Alternatively or in combination, in some embodiments according to the invention, at least part of the one-time password is cut into at least two segments (usually more than two segments) by at least one of the terminals. (transmitter of sonic messages and / or ultrasonics corresponding at least to these segments). In addition, each segment may or may not be encrypted.

Furthermore, in some embodiments of the invention, at least a portion of the segments of the one-time password is encoded into sonic and / or ultrasonic messages at the authentication server before transmission to the mobile terminals. Alternatively or in combination, in some embodiments of the invention, at least a portion of the one-time password segments are encoded into sonic and / or ultrasonic messages at at least one mobile terminal.

In addition, in certain embodiments of the invention, the two mobile terminals being capable of transmitting and receiving sonic and / or ultrasonic messages, the authentication server sends at least one segment (generally several segments) of the word one-way password to one of the mobile terminals, and at least one other segment (generally multiple segments) of the one-time password to the other of the mobile terminals:

the mobile terminals transmit sonic and / or ultrasonic messages corresponding to each password segment that they have received from the authentication server,

the mobile terminals listen to said sonic and / or ultrasonic messages and transmit them to the authentication server,

the authentication server receives the sonic and / or ultrasonic messages from the mobile terminals, decodes them to extract the segments and reconstruct a message with these segments, and compares the reconstituted message with the said one-time password for validation.

In some embodiments, a method according to the invention comprises a step of verifying and validating the sonic and / or ultrasonic communication channels between the two mobile terminals before sending said segments to the mobile terminals.

The invention thus relates in particular to a method of transaction authentication between two users of said method (said client and merchant), a first user being provided with a first mobile terminal, a second user having a second mobile terminal, at least one of these mobile terminals having means for transmitting an audio band signal, and at least the other mobile terminal having means for receiving an audio band signal. Acoustic waves are therefore used to exchange information between the two devices in a secure manner.

The method comprises steps in which:

an authentication message is generated by an authentication server at the request of one of the two users,

said authentication message is transmitted, via a communication network, to a mobile terminal associated with one of the users,

said authentication message is encoded in the form of a sonic and / or ultrasonic message comprising at least part of the message coded in the form of sounds or ultrasound in the frequency band compatible with reception by a conventional mobile telephone,

said sonic and / or ultrasonic message is transmitted by said mobile terminal and listened to by the other mobile terminal, associated with the other user,

the received sonic and / or ultrasonic message is retransmitted by the second mobile terminal to the authentication server for comparison with the expected message and for validation.

The authentication process includes two security factors: the first is the user name and PIN code, which guarantees the identity of the user, and the second is a sonic and / or ultrasonic code that guarantees the user's identity. proximity and possession of the devices involved in the transaction. This is a near field authentication.

In a particular implementation, the transformation of the authentication message into sonic and / or ultrasonic message is performed at the authentication server before transmission to the mobile terminal,

In a particular implementation, the authentication server is then for example IVR type ("Interactive Voice Response server").

In an alternative implementation, the transformation (coding and possibly scrambling) of the message authentication message sonic and / or ultrasonic is performed at the mobile terminal. In a particular implementation, the authentication message is of the one-time-only (OTP) type, specific to each transaction to be signed. This provision ensures increased security of the transaction.

In a particular implementation, the method includes a step of verifying and validating the sonic and / or ultrasonic communication channels between the two mobile terminals. In this way, the method adapts to existing conditions at the merchant and customer level, and optimizes the strength of authentication based on these available communication channels. In particular, it is able to use the ultrasonic capabilities of the terminals, if they have them.

In a first implementation, a first mobile terminal, said "payment terminal of the merchant" is assumed to have means for listening to a sonic and / or ultrasonic message and retransmit it to a server called "server of authentication ", and a second mobile terminal, mobile phone type, called" mobile phone of the client ", is supposed to have a software application adapted to transform (coding and possibly scrambling) a message received from the authentication server, the method includes the following steps:

step 301: the merchant's payment terminal issues a transaction authorization request to the authentication server,

step 302: the authentication server checks the sonic and / or ultrasonic communication means existing between the merchant's payment terminal and the customer's mobile phone,

step 303: in the case where the two terminals are capable of sending and receiving sonic and / or ultrasonic messages, the authentication server obtains or generates a one-time password, and then cuts this password. in at least two segments (generally more than two segments), and sends at least one segment (including some of these segments) to the payment terminal, and at least one other segment (including the other segments) to the customer's mobile phone, at least a part of these segments of the one-time password being transformed (coded and possibly scrambled and / or encrypted) by the payment terminal or the mobile telephone into sonic and / or ultrasonic messages in a band frequency compatible with the means of transmission of said payment terminal and with the receiving means of a mobile phone,

the payment terminal and the mobile telephone transmit the sonic and / or ultrasonic messages corresponding to the password segments that they have received from the authentication server,

step 304: the customer's mobile telephone and the payment terminal listen to said sonic and / or ultrasonic messages and record them, then transmit these records to the authentication server,

step 305: the authentication server receives the records of the sonic and / or ultrasonic messages from the mobile phone of the customer and the payment terminal, decodes these sonic and / or ultrasonic messages to extract the segments, and compares this message restored with the original password for validation.

In another implementation, the second mobile terminal, of the mobile phone type, called "mobile phone of the client", is supposed to have a software application adapted to transform a message received from a server associated with the authentication generator, said "authentication server", sonic message and / or ultrasonic optionally having undergone a deliberate distortion (jamming), the first mobile terminal, said "merchant payment terminal" being provided with means to listen to a sonic message and / or ultrasonic and retransmit to the authentication server and provided with means to generate a one-time password, the method comprises in particular the following steps:

step 401: the merchant's payment terminal issues a transaction authorization request to the authentication server and initiates the transaction,

step 402: the payment terminal checks the sonic and / or ultrasonic communication means existing between the merchant's payment terminal and the customer's mobile phone,

step 403: in the favorable case, the payment terminal cuts the password generated by the authentication server in at least two segments, sends at least one segment (including some of these segments) to the mobile phone of the client by the intermediary of the authentication server, and at least one other segment (especially the other segments) by sonic and / or ultrasonic means,

step 404: the customer's mobile telephone listens for the sonic and / or ultrasonic message received from the payment terminal and saves it, then transmits this registration to the payment terminal via said authentication server,

step 405: the payment terminal receives the information from the mobile phone of the customer, extracts the original message, and compares this message once reconstituted with the original password.

More particularly in this case, in step 404, the transmission of the record and the received message segment is performed through the authentication server.

Alternatively, in step 404, at least part of the record and each received message segment is sent in sonic and / or ultrasonic form by the customer's mobile phone to the payment terminal.

In one variant, the single-use authentication message provided by the authentication server is encoded by the authentication server itself in the form of a sonic and / or ultrasonic message, the authentication server being in contact with the authentication server. a VoIP (Voice over IP) type of server, that is to say capable of generating telephone calls and signals in a sonic and / or ultrasonic frequency band.

The invention aims in a second aspect a payment terminal, a mobile phone or an authentication server, implementing a method according to the invention.

Presentation of figures

The characteristics and advantages of the invention will be better appreciated thanks to the description which follows, description which sets out the characteristics of the invention through a non-limiting example of application.

The description is based on the appended figures which represent:

Figure 1: a diagram of the elements implemented in the process,

FIG. 2: a diagram of the steps of the method in a first mode of implementation, FIG. 3: a diagram of the process steps in a variant of this first mode of implementation,

FIG. 4: a diagram of the process steps in a second mode of implementation,

Figure 5: a diagram of the process steps in a third mode of implementation.

DETAILED DESCRIPTION OF ONE EMBODIMENT OF THE INVENTION As seen in FIG. 1, the invention finds its place in the context of a transaction between a first user 10 called a merchant in the rest of the description, and a second user 1 1 called client in the following description.

The merchant 10 is assumed to have a payment terminal 12 comprising communication means, via a network 14, for example of the GSM type, with an authentication server 13 capable of providing transaction authorizations. In the present embodiment, the payment terminal 12 of the merchant 10 is also assumed to have a loudspeaker adapted to emit a sonic and / or ultrasonic message in a band compatible with the transmission and / or transmission frequency band. receiving a mobile phone.

The client 1 1 is assumed to have a mobile terminal 15 of the mobile phone or tablet or TPE or cash register type, equipped with communication means via a communications network 14, for example GSM, with various remote services. This mobile phone 15 naturally includes a microphone capable of receiving an audio signal and a loudspeaker for transmitting an audio signal, in a frequency band comprising the frequency band audible by the human ear and possibly the ultrasonic band.

The invention is intended to be implemented in software form. In some embodiments at least one software is installed in the authentication server 13, and at least one software is installed in the payment terminal 12 of the merchant 10. In some embodiments, at least one software is also installed in the mobile phone 15 of the client 1 1, in the form for example of smartphone application (ordiphone) type "apps".

Operating mode

In a first mode of implementation, illustrated by FIG. 2, the transaction authentication method comprises five main steps, to validate a payment made by the customer 1 1 at the merchant 10.

In this implementation, the mobile phone 15 of the client 1 1 is assumed to have a software application adapted to transform (encode and possibly scramble) all or part of ΓΟΤΡ sent by the authentication server 13, in sonic message and / or ultrasonic. The authentication server 13 is the one that generates the one-time password (OTP).

Similarly, in this first implementation, the payment terminal 12 is assumed to have means for listening to a sonic and / or ultrasonic message and retransmitting it to the authentication server 13.

In a first step 301, the payment terminal 12 of the merchant 10 issues a transaction authorization request to the authentication server 13.

In a second step 302, the authentication server 13 verifies and validates the sonic and / or ultrasonic communication channels between the two mobile terminals 12, 15 before sending the said segments to the mobile terminals. The authentication server 13 checks the existing communication means between the payment terminal 12 of the merchant 10 and the mobile phone 15 of the client 11. This step consists in verifying which of the two terminals 12, 15 are capable of transmitting and / or receiving sonic and / or ultrasonic messages.

For this purpose, in the present example, which is in no way limiting, the authentication server, here associated with a VoIP-type server, transmits sounds and / or ultrasounds via the TCP / IP communication network to the payment terminal 12 of the merchant. and via the mobile telephone network, here GSM, to the mobile phone 15 of the customer 1 1, to recognize the channels communication audio available between the payment terminal 12 and the mobile phone 15. The sonic and / or ultrasonic acoustic messages received by the speaker of the payment terminal are retransmitted to the authentication server via the same network. The same is true of sonic and / or ultrasonic acoustic messages received by the speaker of the mobile terminal. The server analyzes these messages and thus determines the possible audio communication paths between the payment terminal 12 and the mobile phone 15, that is to say, concretely between the speaker of the payment terminal 12 and the microphone of the mobile phone 15, and / or between the speaker of the mobile phone 15 and the microphone of the payment terminal 12.

When determining the possible communication paths, the authentication server 13 also tests the capacity of each of the mobile terminals for sending and receiving messages in the sound and / or ultrasound domain. In this way, the system can best utilize the capabilities of each group of two terminals, including adapting to older mobile phones, which do not have ultrasonic capability.

The test can be performed during each transaction, the method can also be adapted to variations in the time of the capabilities of mobile terminals, or to difficult sound environment conditions (external noise, etc.). In these cases, the coding of the message is advantageously carried out in the frequencies best received by the mobile terminals and / or the less noisy.

In the case where the payment terminal 12 is not able to listen to acoustic signals, the method is detailed below (steps 303 'to 306').

In the case where the two terminals 12, 15 are capable of transmitting and receiving sonic and / or ultrasonic messages, in a step 303, the authentication server 13 generates a one-time password. Alternatively, the authentication server 13 does not itself generate this one-time password, but receives it from a password management service, possibly remote. This password management service is then adapted to generate a one-time password, and to authenticate such a password when it is received.

The authentication server 13 then cuts this password into segments randomly, and sends some of these segments to the payment terminal 12, and the other segments to the mobile phone 15 of the customer. In the present example of implementation, the password is cut into two segments of possibly different lengths. In a variant, it is split into multiple segments.

Still in this step 303, each of these segments of the one-time password is transformed by the payment terminal 12 and the mobile telephone 15 into sonic and / or ultrasonic messages in the frequency band compatible with the transmission means of said payment terminal 12 and with the means of receiving a mobile phone. The payment terminal 12 and the mobile telephone 15 transmit the sonic and / or ultrasonic messages corresponding to the password segments that they have received from the authentication server 13.

In a step 304, the mobile phone 15 of the client 11, and the payment terminal 12 listen to said sonic and / or ultrasonic messages and record them, then transmit these records to the authentication server 13.

Finally, in a step 305, the authentication server 13 receives the records of the sonic and / or ultrasonic messages from the mobile phone 15 of the customer 12 and the payment terminal 12 of the merchant 10.

The authentication server 13 transforms these sonic and / or ultrasonic messages in a reverse manner to extract the segments of the original message, and compares this message once reconstituted with the original password.

The authentication server 13 then notifies the customer 1 1 via his mobile phone 15 and the merchant 10 via his payment terminal 12 the success or failure of the signature of the transaction.

In a variant of this implementation, in the case where the payment terminal is capable of receiving sonic and / or ultrasonic messages, and where the mobile phone has a specific software application, the entire password is sent to the mobile phone 15 of the customer 1 1. 11 is then sent in sonic and / or ultrasonic form and received by the payment terminal 12, which sends it to the authentication server 13 via the TCP / IP network for validation. This is then an implementation mode similar to the first implementation of the method, as described above, by reversing the roles of the payment terminal 12 and the mobile phone 15.

After step 302 of determination by the authentication server, possible audio communication channels between the payment terminal 12 and the mobile phone 15, when the payment terminal is only able to issue sonic and / or ultrasonic messages , but not to receive them, the method comprises, in a nonlimiting example of implementation, the following steps (see Figure 3).

In a step 303 ', the authentication server 13 generates such a one-time password. Alternatively, the authentication server 13 does not itself generate this one-time password, but receives it from a password management service, possibly remote. This password management service is then adapted to generate a one-time password, and to authenticate such a password when it is received.

The one-time password, usually a sequence of characters or digits, is sent to the payment terminal 12 of the merchant 10, and transformed by said payment terminal sonic and / or ultrasonic message in the frequency band compatible with the transmission means of said payment terminal 12 and with the receiving means of a mobile phone. This is a message comprising at least a coded part in the form of sounds and / or ultrasound, not audible or audible by the man but entering the frequency band received correctly by a mobile phone. Simultaneously, the authentication server calls the mobile phone 15 of the client 1 1, which picks up, so as to be ready to receive the sonic message.

In a step 304 ', the payment terminal 12 transmits the sonic message via its speaker. In a step 305 ', the mobile phone 15 of the client 1 1 listens to said sonic message by its microphone, and records it, then transmits it to the authentication server 13.

Finally, in a step 306 ', the authentication server 13 receives the recording of the sonic message from the mobile phone 15 of the client 12, transforms it in a reverse manner to extract the original message, and compares this message with the message sent to the payment terminal 12 at the merchant 1 1. The authentication server 13 then notifies the customer 1 1 via his mobile phone 15 and the merchant 10 via his payment terminal 12 the success or failure of the signature of the transaction.

In a second mode of implementation, illustrated by FIG. 4, the transaction authentication method also comprises five main steps, to validate a payment made by the customer 11 at the merchant 10.

In this second implementation, the mobile phone 15 of the client 1 1 is still assumed to have a software application adapted to transform or scramble an OTP received from the authentication server 13 in sonic and / or ultrasonic message.

Similarly, in this second implementation, the payment terminal 12 is still assumed to have means to listen to a sonic and / or ultrasonic message and retransmit it to the authentication server 13. It is also assumed here endowed means to transform (encode and possibly scramble) a one-time password.

In a first step 401, the payment terminal 12 of the merchant 10 issues a transaction authorization request to the authentication server 13 and initiates the transaction.

In a second step 402, the payment terminal 12 checks and validates the communication means existing between the payment terminal 12 of the merchant 10 and the mobile phone 15 of the customer 11. This step consists in verifying whether the two terminals 12, 15 are capable of transmitting and receiving sonic and / or ultrasonic messages, and to specify in which acoustic frequency bands they are able to communicate in transmission and reception, and possibly which are the most effective bands. In the favorable case, in a step 403, the payment terminal 12 generates a one-time password. The payment terminal 12 then cuts this password in segments randomly, and sends to the mobile phone 15 of the client 11 some of these segments via the authentication server 13, and the other segments by sonic and / or ultrasonic to the client 1 1. In the present example of implementation, the password is cut into two segments of possibly different lengths. In a variant, it is split into multiple segments.

In a step 404, the mobile phone 15 of the client 11 listens to the sonic and / or ultrasonic message received from the payment terminal and records it, then transmits this record and the message segment received via the authentication server. 13 to the payment terminal 12 via said authentication server 13.

Alternatively, some or all of this information is transmitted in sonic and / or ultrasonic form by the mobile phone 15 of the customer 1 1 to the payment terminal 12.

Finally, in a step 405, the payment terminal 12 receives the information from the mobile phone 15 of the customer 1 1, extracts the original message, and compares this message once reconstituted with the original password.

The payment terminal 12 then notifies the mobile phone 15 of the client 1 1 via the authentication server 13 the success or failure of the signature of the transaction.

In a third mode of implementation, illustrated in FIG. 5, the transaction authentication method relates to a case where neither the mobile phone 15 of the client 1 1 nor the payment terminal 12 have specific applications for implement the process. In this way, the method is very easily usable, including by persons wishing to carry out a transaction and not equipped with specific applications.

The authentication server 13 is, for its part, associated with an IVR server server ("Interactive Voice Response"), able to generate and receive sound messages. Similarly, in this third implementation, the payment terminal 12 is still assumed to have means for listening to a sonic message and retransmitting it to the authentication server 13. It may be a mobile phone .

In a first step 501, the payment terminal 12 of the merchant 10 calls the authentication server 13.

In a step 502, it issues a transaction authorization request by sending its payment terminal identifier, the customer's telephone number and the amount of the transaction to be made.

In a step 503, the authentication server 13 checks the received data, and calls the customer's mobile phone number. The authentication server 13 generates a one-time password splits it into segments, and encodes these segments into sonic messages.

In a step 504, the customer enters a validation code (of the credit card pin code type) on his mobile phone 15 which sends this data to the authentication server 13.

In a step 505, the payment terminal 12 and the mobile telephone 15 are brought together and the ground word coded in the form of sonic messages by the authentication server of type IVR is transmitted to these terminals, which exchange these sonic messages with each other. by sonic voice. The authentication server 13 then receives each sonic message as audio received by each terminal and retransmitted to the authentication server 13.

The authentication server 13 then notifies in a step 506 to the client 1 1 via its mobile phone 15 and the payment terminal 12 the success or failure of the signature of the transaction.

In a variant of this third implementation, the server verifies and validates the communication means, in a manner similar to that described for the first implementation,

In another variant, the server splits the sonic password into multiple segments and sends them on the various validated communication channels, in a manner similar to that described for the second implementation of the method. Throughout the foregoing description, reference has been made to a purchase payment type transaction. It is clear that the method according to the invention applies more broadly to any type of near-field authentication, allowing two terminals to communicate in a secure manner.

The invention may be subject to numerous variants and embodiments with respect to the only embodiments described above and shown in the drawings. In particular, the invention can be applied with a very large number of different categories of terminals. In particular, advantageously and according to the invention each mobile terminal is chosen from the group consisting of mobile telephones (portable or portable satellite phones), smartphones (portable computer cellular phones, so-called "smartphones" in English), computer touch tablets. portable computers, laptops, electronic payment terminals (EPTs). It should be noted in particular that the invention makes it possible to secure and authenticate communication between extremely simple mobile terminals, in particular when at least one of them is a simple GSM-type portable mobile telephone (and not an ordiphone (mobile phone (cell phone) computer (equipped with digital data processing means)), or when all the terminals are simple mobile cellular mobile phones type GSM, the invention thus makes it possible to secure and to authenticate communications in regions of the world that are not (or little) equipped with computers and networks (UMTS, LTE, 3G, 4G ...) allowing the exploitation of these devices.

Claims

M - a transaction authentication method between two users of said method, a first user being provided with a first mobile terminal, a second user being provided with a second mobile terminal, at least one of these mobile terminals (1 2, 1 5) comprising means for transmitting an audio band signal, and at least the other mobile terminal having means for receiving an audio signal, said method comprising steps in which:

a one-time password is generated by an authentication server (1 3) at the request of one of the two users,

said one-time password is transmitted, via a communication network, to a mobile terminal associated with one of the users,

each sonic and / or ultrasonic message received by a mobile terminal is retransmitted by the mobile terminal to the authentication server (1 3) for comparison with an expected message and for validation,

characterized in that

- the one-time password is cut into at least two segments sent to at least one (1 2) of the mobile terminals,

the sonic and / or ultrasonic messages corresponding to the one-time password segments are exchanged sonically and / or ultrasonically between the mobile terminals (1 2, 1 5),

the authentication server (1 3) receives the sonic and / or ultrasonic messages corresponding to the single-use password segments from the mobile terminals, decodes them to extract the same segments, and compares the message once reconstituted with said one-time password for validation.

21 - Method according to claim 1, characterized in that the authentication server (1 3) cuts the one-time password in at least two segments and sends these segments to one (1 2) at least the terminals mobile.

3 / - Method according to one of claims 1 or 2, characterized in that at least a portion of the segments of the one-time password is encoded in sonic and / or ultrasonic messages at the authentication server (1 3) before transmission to mobile terminals.

4 / - Method according to one of claims 1 to 3, characterized in that at least a portion of the segments of the one-time password is encoded in sonic and / or ultrasonic messages at at least one mobile terminal .

5 / - Method according to one of claims 1 to 4, characterized in that the two mobile terminals (1 2, 1 5) being capable of transmitting and receiving sonic and / or ultrasonic messages, the authentication server (1 3) sends at least one segment of the one-time password to one (1 2) of the mobile terminals, and at least one other segment of the one-time password to the other (1 5) of the mobile terminals,

the mobile terminals (1 2, 15) transmit sonic and / or ultrasonic messages corresponding to each password segment that they have received from the authentication server (1 3),

the mobile terminals (1 2, 15) listen to said sonic and / or ultrasonic messages and transmit them to the authentication server (1 3),

the authentication server (1 3) receives the sonic and / or ultrasonic messages from the mobile terminals, decodes them to extract the segments and reconstruct a message with these segments, and compares the reconstituted message with said password single use for validation.

6 / - Method according to claim 5, characterized in that it comprises a step of verification and validation of the channels of sonic and / or ultrasonic communication between the two mobile terminals (12, 15) before sending said segments to the mobile terminals.

71 - A method according to any one of claims 1 to 6, the second mobile terminal (15) of the mobile phone type, called "mobile phone of the client", is supposed to have a software application adapted to transform a message received d a server said authentication server (13) sonic message, and the first mobile terminal (12), said "merchant payment terminal" being assumed to have means to listen to a sonic message and / or ultrasonic and the retransmit to the authentication server (13),

characterized in that it comprises in particular the following steps:

step 301: the payment terminal (12) sends a transaction authorization request to the authentication server (13),

step 302: the authentication server (13) checks the sonic and / or ultrasonic communication means existing between the payment terminal (12) and the mobile telephone (15) of the client (1 1),

step 303: in the case where the two mobile terminals (12, 15) are capable of transmitting and receiving sonic and / or ultrasonic messages, the authentication server (13) obtains a one-time password, then cuts this password into at least two segments, and sends at least one segment to the payment terminal (12), and at least one other segment to the mobile phone (15) of the customer,

the payment terminal (12) and the mobile telephone (15) transmit sonic and / or ultrasonic messages corresponding to each password segment that they have received from the authentication server (13),

step 304: the mobile telephone (15) of the client and the payment terminal (12) listen to said sonic and / or ultrasonic messages and record them, then transmit these records to the authentication server (13),

step 305: the authentication server (13) receives the recordings of the sonic and / or ultrasonic messages from the mobile phone (15) of the customer and the payment terminal (12), decodes these sonic and / or ultrasonic messages to extract the segments and reconstruct a message with these segments, and compares this reconstituted message with the original password for validation .

8 / - Method according to any one of claims 1 to 6, the second mobile terminal, mobile phone type, said "mobile phone customer", being provided with a software application adapted to transform a message received from a server authentication device (13) associated with the authentication generator, called "authentication server", in sonic and / or ultrasonic message, the first mobile terminal (12), called "payment terminal of the merchant" being provided with means of authentication. listening to a sonic and / or ultrasonic message and retransmitting it to the authentication server (13), said authentication server being provided with means for generating a one-time password,

characterized in that it comprises in particular the following steps:

step 401: a first mobile terminal, called a "payment terminal" (12), issues a transaction authorization request to the authentication server (13) and initiates the transaction,

step 402: the payment terminal (12) checks the existing sonic and / or ultrasonic communication means between the payment terminal (12) of the merchant and the mobile telephone (15) of the customer,

step 403: in the favorable case, the payment terminal (12) cuts the one-time password generated by the authentication server (13) into at least two segments, sends at least one segment to the mobile telephone (15). ) of the client via the authentication server (13), and at least one other segment by sonic and / or ultrasonic means,

step 404: the mobile telephone (15) of the client listens to the sonic and / or ultrasonic message received from the payment terminal and saves it, then transmits this recording to the payment terminal (12) via said authentication server (13) ,

step 405: the payment terminal (12) receives the information from the mobile phone (15) of the customer, extracts each segment, and compares the message once reconstituted with the one-time password.

9 / - Method according to claim 8, characterized in that, in step 404, at least part of the record and each segment received from the authentication server (13) is sent in sonic and / or ultrasonic form by the mobile phone (15) from the customer to the payment terminal (12)

10 / - Method according to any one of claims 1 to 9, characterized in that it comprises steps in which:

an authentication message is generated by an authentication server (13) at the request of one of the two users,

said authentication message is encoded in the form of a sonic and / or ultrasonic message comprising at least part of the message encoded in the form of sounds and / or ultrasound in the frequency band compatible with reception by a conventional mobile telephone,

said sonic message is sent by said mobile terminal and listened to by the other mobile terminal, associated with the other user,

the received sonic and / or ultrasonic message is retransmitted by the second mobile terminal to the authentication server (13) for comparison with the expected message and for validation.