Patent Application
20240428246
The present disclosure relates to the field of authentication methods and devices, and in particular for dematerialized payment.
It is known to use a strong authentication method, i.e. an authentication which combines at least two factors of different type among three types of possible factors, knowledge, possession and inherence, for the dematerialized payment via a mobile terminal, for example the mobile telephone of a user, configured to communicate with a payment terminal via a communication technology of the NFC type for example. To secure the communication between the two terminals, it is known, for example, to use, on the one hand, a knowledge factor that only the user knows, for example a PIN code known only by the user and entered by the latter on the mobile telephone, and a possession factor on the other hand, only the user has, in this case a mobile phone to which is associated a combination of keys stored on the mobile telephone, and transmitted with the PIN code to the payment terminal, which is configured to verify, in particular via a server, both the possession factor and the knowledge factor at once. It is also known to use, instead of a possession factor, a specific biometric characteristic of the user, based on a recognition of a vocal, facial, or fingerprint characteristic. Thus, it is known to use a two-factor authentication method, from among the aforementioned three types of factors.
Authentication methods with two known factors use the same mobile terminal to simultaneously communicate the authentication factors. The use of this mobile terminal may be a constraint for the user (time to find it, take it out, turn it on, have it on hand, etc.). It is desirable to simplify and fluidize as much as possible the user experience, while guaranteeing the security of the transaction.
On the other hand, when the second factor is a biometric factor, the private nature of the personal data specific to the user should be taken into account in order to remain in accordance with the regulation on personal data.
Finally, it is desirable that the first authentication factor and the second authentication factor could be used to secure several successive transactions.
Hence, the disclosure aims to provide a solution to all or part of these problems.
To this end, the present disclosure relates to an asynchronous authentication method using a first authentication factor and a second biometric authentication factor to validate a transaction on a transaction site, between a user and an authentication device of the transaction site, the user being provided with a user terminal,
According to these arrangements, the transaction is carried out in a secure manner and without any effort, for the user, other than allowing the acquisition of the user biometric information.
According to one implementation, the disclosure comprises one or more of the following features, alone or in a technically-feasible combination.
According to one implementation, the method comprises a step of enrolling the user, the enrolment step comprising recording on the user terminal the reference biometric template and the identification information of the user. This enrolment step may be carried out by the user directly on the user terminal, or at the site of the transaction on an enrolment terminal, with a transfer of the enrolment data, in particular the reference biometric template, on the terminal of the user.
According to one implementation, the method comprises a step of receiving a validation message of the transaction when the transaction has been validated by the server based on a signed biometric result transmitted to the server by the au at least one authentication terminal.
According to one implementation, the transaction is a payment.
According to one implementation, the authentication device comprises an identification terminal located on the transaction site, said identification terminal being configured to be detected by the user terminal when the user arrives at the transaction site.
According to one implementation, the first communication condition is determined by a detection of the identification terminal by the user terminal.
According to one implementation, the first communication condition is determined by a geolocated detection by the user terminal of a position of the user terminal relative to a position of the transaction site recorded on the user terminal.
According to one implementation, the identification terminal and the at least one authentication terminal are located on the transaction site but are not necessarily collocated.
According to one implementation, the user terminal is a mobile terminal, for example a laptop computer, or a tablet, or a smartphone, of the smartphone type, that the user could in particular carry in his/her pocket, or a smartwatch or a connected bracelet, that the user could carry on his/her hand.
According to one implementation, the transaction site is a store, for example a shopping mall, or an amusement park, a hotel, a camping, or a vacation resort.
According to one implementation, the transmission step comprises transmitting an identifier of the transaction site.
According to one implementation, the user terminal is configured to communicate wirelessly with the identification terminal and with the at least one authentication terminal, for example according to an NFC, BLE or WIFI type protocol.
According to one implementation, the method comprises the use of a third authentication factor.
According to one implementation, the user biometric information is one amongst a fingerprint of a finger, a fingerprint of several fingers, a palm print, a photograph of the face, a voice recording, a photograph of an iris of an eye, a photograph of an iris of each eye.
According to one implementation, the step of receiving by the user terminal comprises receiving a public key of the server and a public key of the at least one authentication terminal, the signature step being carried out with the public key of the server, and the step of encrypting the reference biometric template being carried out with the public key of the at least one authentication terminal.
According to one implementation, the step of transmitting to the at least one authentication terminal comprises transmitting the identification information of the user.
According to one implementation, the step of transmitting to the at least one authentication terminal the signed challenge and the cipher of the reference biometric template is repeated at least once.
According to these arrangements, the first authentication factor and the second biometric authentication factor are used to secure several successive transactions, without any effort for the user.
According to one aspect, the disclosure also relates to an asynchronous authentication method using a first authentication factor and a second biometric authentication factor to validate a transaction on a transaction site between a user and an authentication device of the transaction site, the user being provided with a user terminal,
According to one implementation, the method implemented by the authentication terminal comprises one or more of the following features, alone or in combination.
According to one implementation, the asynchronism of the steps of the method allows a variable delay to elapse between, on the one hand, the steps of transmitting to, or receiving by, the authentication terminal the cipher of the reference biometric template, and, on the other hand, the step of acquiring the user biometric information with the acquisition device of the at least one authentication terminal.
According to one implementation, the delay that could elapse may be equal to or longer than 1 second, or equal to or longer than one minute, and even equal to or longer than one hour.
According to these arrangements, the user thus has the time to determine the items that will be the object of the transaction.
According to one implementation, the recognition score is selected from a set of comparison scores obtained by comparing the test biometric template with the reference biometric template and with each other reference biometric template of the plurality of other reference biometric templates, the score being selected according to a determined criterion.
According to one implementation, the criterion is determined so as to select the highest or lowest score.
According to one implementation, the binary information depends on a comparison between the selected recognition score, a predetermined threshold, thereby indicating whether a positive authentication decision is made. Thus, for example, the binary information is equal to 1, if the selected recognition score is higher than the predetermined threshold.
According to one implementation, the method further comprises a step of receiving a validation message from the server when the transaction is confirmed by the server based on the result of the second biometric authentication factor.
According to one implementation, the method further comprises a step of receiving by the user terminal another validation message from the server when the transaction is confirmed by the server based on the result of the second biometric authentication factor.
According to one implementation, the validation message and the other validation message depend on the recognition score.
According to one implementation, the transmitted message comprises an encrypted concatenation of the signed result of the second biometric authentication factor and the signed challenge.
According to one implementation, the method further comprises a step of destroying the reference biometric template, and the test biometric template, and the acquired user biometric information and the biometric result and the signed biometric result.
According to these arrangements, the transaction is carried out in accordance with the regulation on the privacy of personal data.
According to one implementation, the destruction step is triggered according to another condition determined by a geolocated detection by the user terminal of a position of the user terminal relative to a position of the transaction site recorded on the user terminal.
According to one implementation, the decryption step is carried out with a private key of the at least one authentication terminal, and the step of signing the result of the second biometric authentication factor is carried out with the private key of the at least one authentication terminal, and the step of transmitting to the server comprises transmitting a public key of the at least one authentication terminal.
According to another aspect, the disclosure also relates to an asynchronous authentication method using a first authentication factor and a second biometric authentication factor for validating a transaction on a transaction site between a user and an authentication device of the transaction site, the user being provided with a user terminal,
According to one implementation, the method implemented by the server comprises one or more of the following features, alone or in combination.
According to one implementation, the method further comprises an asynchronous step of transmitting a validation message to the authentication terminal according to the result of the second biometric authentication factor.
According to one implementation, the method further comprises a step of transmitting a validation message to the user terminal according to the result of the second biometric authentication factor.
According to one implementation, the result of the second biometric authentication factor comprises a recognition score, and the validation message depends on the recognition score.
According to one implementation, the reception step also comprises the reception of an identification of the transaction site.
According to one implementation, the message received in the reception step comprises an encrypted concatenation of the signed result of the second biometric authentication factor and the signed challenge.
According to one implementation, the method further comprises a step of destroying the reference biometric template, and the test biometric template, and the acquired user biometric information and the biometric result and the signed biometric result.
According to these arrangements, the transaction is carried out in accordance with the regulation on the privacy of personal data.
According to one implementation, the destruction step is triggered according to another condition determined by a geolocated detection by the user terminal of a position of the user terminal relative to a position of the transaction site recorded on the user terminal.
According to another aspect, the disclosure also relates to an authentication terminal using a first authentication factor and a second biometric authentication factor to validate a transaction with a user terminal,
According to another aspect, the disclosure also relates to a computer program product downloadable from a communication network and/or stored on a computer-readable medium and/or executable by a microprocessor, comprising program code instructions for the execution of the asynchronous steps of the method implemented by the user terminal, or of the method implemented by the authentication terminal; or of the method implemented by the server, according to one of the previously-described implementations, when it is executed on a computer.
According to still another aspect, the disclosure also relates to a user terminal comprising a processor configured to implement the asynchronous steps of the method implemented by the user terminal according to one of the previously-described implementations.
According to still another aspect, the disclosure also relates to an authentication terminal, the authentication terminal being configured to implement the asynchronous steps of the method implemented by the authentication terminal according to one of the previously-described implementations.
According to one embodiment, the authentication terminal uses a first authentication factor and a second biometric authentication factor to validate a transaction with a user terminal,
According to one aspect, the disclosure relates to an asynchronous authentication method implemented by an authentication system comprising a user terminal, and an identification device comprising at least one authentication terminal and a server, the method using a first authentication factor and a second biometric authentication factor to validate a transaction on a transaction site, between a user and the authentication device of the transaction site, the user being provided with the user terminal,
For good understanding thereof, an embodiment and/or implementation of the disclosure is described with reference to the appended drawings representing, as a non-limiting example, an embodiment or implementation respectively of a device and/or of a method according to the disclosure. The same references in the drawings designate similar elements or elements whose functions are similar.
In order to successfully simplify the user experience and to fluidize the validation of a transaction while guaranteeing the security of this validation, the main technical problem relates to the fact that the authentication factors are not present at the same time (asynchronous) or used in the same place during the transaction.
In a complementary manner, when the second authentication factor is a biometric factor, the need to comply with the private nature of this factor is essential, that is to say to leave the biometric data (the template(s) of the biometric factor) stored in a personal device under the control of the user, as long as they are not essential.
Additionally, the first authentication factor should also be used to successively carry out several secure transactions on the same transaction site, in particular when the considered sites are of the “amusement park” type, “hotel”, “camping”, or “vacation resort”, type.
Thus, the disclosure relates to an asynchronous authentication method 100 using a first authentication factor and a second biometric authentication factor to validate a transaction on a transaction site, between a user and an authentication device DA of the transaction site.
In particular, the transaction site is a store, for example a shopping mall, or an amusement park, a hotel, a camping, or a vacation resort.
More particularly, the transaction is a payment.
The user is provided with a user terminal TU, which stores a reference biometric template GBR; the user terminal TU is configured to communicate with the server S and with the at least one authentication terminal TA; in particular, the user terminal TU is configured to wirelessly communicate with the identification terminal and with the at least one authentication terminal, for example according to an NFC, BLE or WIFI type protocol.
In particular, the user terminal is a mobile terminal, for example a laptop computer, or a tablet, or a smartphone, that the user could carry in particular in his pocket, or a smartwatch or a connected bracelet, that the user could carry on his/her hand.
The authentication device DA comprises a server S and at least one authentication terminal TA; the server S and the at least one authentication terminal TA are two entities distinct from the transaction site.
The at least one authentication terminal TA comprises a device for acquiring user biometric information IBU.
In particular, the user biometric information IBU is one amongst the following biometric information: a fingerprint of a finger, a fingerprint of several fingers, a palm print, a photograph of the face, a voice recording, a photograph of an iris of an eye, a photograph of an iris of each eye.
The method according to the disclosure comprises a method 100, according to a first aspect of the disclosure represented schematically in
Optionally, the method 100 comprises a step 101b is of enrolling the user; the enrolment step 101b is comprises recording by the user, on the user terminal TU, the reference biometric template GBR and the identification information of the user IDU. The enrolment step 101b is further comprises, for example, recording the position(s) of the preferred transaction site(s) of the user. This enrolment step 101b is may be carried out by the user directly on the user terminal TU, or at the site of the transaction on an enrolment terminal, with a transfer of the enrolment data, in particular the reference biometric template GBR, on the terminal of the user TU.
More particularly, the transmission step 101 also comprises transmitting an identifier IDM of the transaction site, which possibly has also been recorded on the user terminal TU, for example during the enrolment step 101b is.
The method 100, according to the first aspect of the disclosure schematically represented in
According to an exemplary implementation, the reception step 102 comprises receiving by the user terminal TU a public key of the server S and a public key of the at least one authentication terminal TA, the signature step 103 being carried out with the public key of the server, and the step 104 of encrypting the reference biometric template GBR being carried out with the public key of the at least one authentication terminal TA.
The method 100, according to the first aspect of the disclosure schematically represented in
According to these arrangements, the transaction is carried out in a secure manner and without any effort, for the user, other than allowing the acquisition of the user biometric information.
Optionally, the step 105 of transmitting to the at least one authentication terminal the signed challenge CHS, the cipher of the reference biometric template CGBR and the identifier IDU is repeated at least once.
According to these arrangements, the first authentication factor and the second biometric authentication factor are used to secure several successive transactions, without any effort for the user.
It should be noted that the identification terminal and the at least one authentication terminal are located on the transaction site but are not necessarily collocated.
Optionally, the method 100 comprises the use of a third authentication factor.
The method according to the disclosure further comprises a method 200, according to a second aspect of the disclosure schematically represented in
The asynchronous nature of the steps of the methods 100, 200 is reflected in particular by the fact that a variable delay could elapse between, on the one hand, the steps of transmitting 105 to, or of receiving 205 by, the authentication terminal the cipher of the reference biometric template CGBR, and, on the other hand, the step 206 a of acquiring the user biometric information IBU with the acquisition device of the at least one authentication terminal TA. Thus, the delay that could elapse may be equal to or longer than 1 second, or equal to or longer than one minute, and even equal to or longer than one hour. During this period of time, the user thus has the time to determine the items that will be the object of the transaction.
The recognition score is selected from a set of comparison scores obtained by comparing the test biometric template with the reference biometric template and with each other reference biometric template of the plurality of other reference biometric templates, the score being selected according to a determined criterion.
Thus, for example, the highest score, or the lowest score, depending on the comparison function used, will be selected, so as to thus identify the user corresponding to the reference biometric template GBR which best corresponds to the test biometric template GBT.
Furthermore, by comparing the selected recognition score with a predetermined threshold, the comparison step 208 will determine whether a positive authentication decision is acceptable and will determine a binary value of the binary information accordingly; thus, for example, a piece of binary information equal to 1, respectively to 0, will indicate a positive, respectively negative, authentication decision.
The method 200, according to the second aspect of the disclosure schematically represented in
According to an exemplary implementation, the decryption step 207 is carried out with a private key of the at least one authentication terminal TA, and the step 209 of signing the result of the second biometric authentication factor RFAB is also carried out with the private key of the at least one authentication terminal; the step 210 of transmitting to the server comprises transmitting the public key, corresponding to said private key, of the at least one authentication terminal TA.
Optionally, the transmitted message 210 comprises an encrypted concatenation of the signed result of the second biometric authentication factor RSFAB and the signed challenge CHS. According to these arrangements, the security of the transaction is enhanced.
Also optionally, the method 200, according to the second aspect of the disclosure, further comprises a step 211 of receiving a validation message VAL1 from the server S when the transaction is confirmed by the server S based on the result of the second biometric authentication factor RFAB, in particular based on the recognition score.
Optionally, the method 100, according to the first aspect of the disclosure, further comprises a step 107 of receiving another validation message VAL2 from the server S when the transaction is confirmed by the server S based on the result of the second biometric authentication factor RFAB, in particular based on the recognition score.
According to an exemplary implementation, the method 200, according to the second aspect of the disclosure, further comprises a step of destroying the reference biometric template, and the test biometric template, and the acquired user biometric information and the biometric result and the signed biometric result.
In particular, the destruction step is triggered according to another condition determined by a geolocated detection by the user terminal of a position of the user terminal relative to a position of the transaction site recorded on the user terminal.
According to these arrangements, the transaction is carried out in accordance with the regulation on the privacy of personal data.
The method according to the disclosure further comprises a method 300, according to a third aspect of the disclosure schematically shown in
Optionally, the method 300 further comprises the following asynchronous steps implemented by the server S:
As indicated hereinbefore, optionally the method according to the disclosure comprises using a third authentication factor, for example a second biometric factor, such as a print of the palm of the hand of the user. According to an exemplary implementation of this particular mode, the enrolment step 101b is comprises recording on the user terminal TU a second reference biometric template from the palm of the user, and the method further comprises a step of validating the payment, after the step of detecting and recognizing the second authentication factor; during this validation step, the third authentication factor, i.e. the second biometric factor, is recognized by the authentication terminal according to a process similar to that implemented for the recognition of the first biometric factor, following the presentation by the user of the palm of his/her hand to a second device for acquiring the second biometric factor.
According to another aspect, the disclosure also relates to a computer program product downloadable from a communication network and/or stored on a computer-readable medium and/or executable by a microprocessor, comprising program code instructions for the execution of the asynchronous steps of the method 100, 200, or 300 according to one of the previously-described implementation modes, when it is executed on a computer.
According to still another aspect, the disclosure also relates to a user terminal TU comprising a processor configured to implement the asynchronous steps of the method 100 according to the previously-described first aspect of the disclosure.
According to still another aspect, the disclosure also relates to an authentication terminal TA using a first authentication factor and a second biometric authentication factor to validate a transaction with a terminal user TU, the authentication terminal TA being configured to implement the asynchronous steps of the method 200 according to the previously-described second aspect of the disclosure.
According to another aspect, the disclosure relates to an asynchronous authentication method implemented by an authentication system comprising a user terminal TU, and an identification device DA comprising at least one authentication terminal TA and a server S, the method using a first authentication factor and a second biometric authentication factor to validate one transaction on a transaction site, between a user and the authentication device DA of the transaction site, the user being provided with the user terminal TU,
| Number | Date | Country | Kind |
|---|---|---|---|
| FR21/08902 | Aug 2021 | FR | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/FR2022/051513 | 7/27/2022 | WO |
