FR3026875A1 - METHODS FOR CONFIGURING A TERMINAL DEVICE CONNECTED TO A NETWORK TO ENABLE STRONG AUTHENTICATION OF A USER - Google Patents

Abstract

The present invention relates to a method for configuring a terminal-type device (1a, 1b) connected to a network (10) to enable strong authentication of a user by means of a server (3) via said peripheral (1a, 1b), said server (3) being also connected to the network (10), characterized in that it comprises the following steps: - Secure connection of a client station (2) to the server (3); - On a user interface of the client station (2), entry of device identification information (1a, 1b); - Generation by the server (3) of a secret authentication key associated with the device (1a, 1b) for the algorithmic generation of single-use password (OTP); - Generation by the server (3) and display on said user interface of the client station (2) an activation code; - Loading on said device (1a, 1b) an application via the network (10), and entered by the user of the activation code in the application; - Verification by the device (1a, 1b) of the activation code with the server (3), and loading at least said secret authentication key via the network (10), so as to allow generation by the device (1a, 1b) of said one-time passwords (OTP).

Description

Field of the Invention The present invention relates to the field of secure authentication. More particularly, it relates to a method of configuring a mobile terminal type device for such authentication. State of the art Companies today generally have an architecture based on user accounts. Each employee of the company connects to his account via a login / password entry. When the collaborator is on the move, the mechanisms allow the collaborator to connect from a remote workstation, for example, activating a virtual private network (VPN). 15 Insofar as the login / password couples are sometimes easy to discover, in the current context of an upsurge in cyber-piracy and intrusion into the information systems of business information systems by malicious people. it has been proposed advanced security methods. In particular, so-called strong authentication methods rely on the combination of two identification factors, generally one being what the user knows (a code, a passphrase, etc.) and the other is that the user holds (a smart card, a physical key, a device, etc.) or what it is (biometrics, etc.). For example, it is common during an internet transaction to request a bank identifier and a code received by SMS (what the user owns: a mobile phone). Thus, stealing a credit card is no longer sufficient to make fraudulent use. In the context of a business, strong authentication uses the concept of the one-time password, or OTP ("OneTime Password"), most often based on the use of a small personal terminal, called " security token ", which is capable of generating OTPs. The collaborator who wishes to connect to his account must, in addition to his login / password pair, enter the OTP that appears on the token to connect. Thus, a third party who has intercepted the couple login / password of a collaborator could not connect unless to have physically stolen the token. Alternatively to the token, the OTP can be generated through a special smart card, an application running on a smartphone, or sent via SMS. Each of these technologies is satisfactory, but most of the strong authentication systems have the rigid constraint of holding a specific object (in particular token or smartphone). And this object can be lost or unloaded. In addition, the current changes in use induce the modification of the devices specific to the user (smartphone, touch pad, portable PC, etc.). It is necessary to allow a user to authenticate from any of its devices, either directly through the device (WebNPN site), or by using the device to access another environment (OTP generated on the phone to open the VPN on the PC). It would thus be desirable to have an advanced authentication management solution via OTP taking into account these new uses and to make it possible to manage a plurality of peripherals for a user while reinforcing the security of the primary authentication. SUMMARY OF THE INVENTION According to a first aspect, the invention relates to a method of configuring a terminal-type device connected to a network to enable strong authentication of a user through a server via said device, said server being also connected to the network, characterized in that it comprises the following steps: - Secure connection of a client station to the server; - On a user interface of the client computer, entry of device identification information; - Generation by the server of a secret authentication key associated with the device for the algorithmic generation of one-time passwords (OTP); - Generation by the server and display on said user interface of the client computer an activation code; - Loading on said device an application via the network, and entered by the user of the activation code in the application; - Verification by the device of the activation code with the server, and loading at least said secret authentication key via the network, so as to allow the generation by the device of said one-time password (OTP).

According to other advantageous and nonlimiting features of the method according to the first aspect: the method also comprises following the verification of the activation code by the device the loading of an OTP counter, said OTP counter being incremented with each new generation of a one-time password (OTP) by the device, the secret authentication key associated with the device being revoked if the OTP counter reaches a given threshold; the method also comprises following the verification of the activation code by the device the loading of management parameters of a personal identification code (PIN), the method then comprising the definition by the user of a password code; personal identification (PIN) according to said parameters, the input of said defined personal identification code (PIN) being requested from the user for authentication at each new generation of a one-time password (OTP) by the device.

According to a second aspect, the invention relates to a method of configuring a terminal device connected to a network in order to allow strong authentication of a user to a server via said device, said server also being connected to the network, characterized in that it comprises the following steps: - Secure connection of a client station to the server; - On a user interface of the client computer, entry of device identification information and definition of a personal identification code (PIN); - Generation by the server of a secret authentication key associated with the device for the algorithmic generation of one-time passwords (OTP); Storing said secret authentication key on storage means of the server, so as to enable the generation and sending by the server of said one-time passwords (OTP) in a message via the network in the event of sending the personal identification code (PIN) to the server from the device. According to other advantageous and nonlimiting features of the method according to the first aspect or the second aspect: the method comprises the generation by the server of an error counter associated with the terminal, said error counter being incremented at each erroneous authentication attempt via the device, the user being blocked if the error counter reaches a given threshold; - the generation of the one-time password (OTP) is a response to a challenge transmitted by the server and displayed by the device; The method also comprises the configuration of an autonomous portable device or smart card device, in order to enable strong authentication of a user by means of a server via said peripheral, the peripheral being directly connected to the server via a link secure, said configuration comprising the following steps: - Secure connection of a client station to the server; - On a user interface of the client computer, entry of device identification information; - Generation by the server of a secret authentication key associated with the device for the algorithmic generation of one-time passwords (OTP), and loading of said secret key on the device; The method is implemented several times so as to configure a plurality of peripherals to allow strong authentication of a user through a server via each of said peripheral; The method also includes following the verification of the activation code by the device the loading of one-time password size parameters (OTP), the server defining this one-time password size (OTP). depending on the number of devices configured for the user. Brief Description of the Drawings Other features, objects and advantages of the present invention will become more apparent upon reading the following description of a preferred embodiment. This description will be given with reference to the accompanying drawings, in which: - Figure 1 is a diagram of an architecture for carrying out the methods according to the invention; FIGS. 2 to 6 are interface views used in some embodiments of the invention. DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS Architecture Referring to FIG. 1, the present methods are methods of configuring a terminal type device 1a, 1b to enable strong authentication of a user. The device 1a, lb is a terminal (in particular a mobile terminal), that is to say a device connected to a network 10 (in particular the internet network) having its own means of data processing, storage data, and an interface. It is adapted to connect to the network 10 via a wired link (Ethernet) or wireless (for example via a mobile communication network). It is typically a smartphone, a touch pad, or any other personal device of the user. By "configuration" is meant the secure preparation of the device 1a, lb so that the latter can be used later for the purposes of strong authentication of its user. In other words, it is an initialization. Such configuration of a device 1a, 1b is referred to as the "enrollment" of the device 1a, 1b. A device la, lb enlisted is able to be used in a strong authentication. Strong authentication means a certification (at two levels: a level via login / password, and a level via the possession of the device 1a, 1b). the identity of a user of the device 1a, lb attempting to connect to a secure server 4 (the latter is for example the data server of a company, a mail server, etc.). By server 4, we will designate any information system of an enterprise for which access must be controlled. The equipment via which the user can be a workstation 2 (for example a PC) or the device itself (case of terminal 1b in FIG. 1). Both cases will be described later. An authentication server 3 is also present and connected to the network 10. It will be understood that the server 4 can be confused with the latter. This is typically a back-end Radius server. The server 3 is the equipment that validates or not the authentication of a device 2, lb and therefore its authorization or not access to the server 4 and its contents. This server 3 can also manage with other network preferences (VPN, firewall, etc.). The present invention provides methods for enabling a user to authenticate in a plurality of ways through one or other of its peripherals 1a, 1b, and this in a very flexible manner without security is affected.

More precisely, the present methods make it easy to "enlist" one or more peripherals, including temporarily, via a centralized mechanism around the server 3, as well as, where appropriate, the revocation of these enrollments. This enrollment mechanism can be done automatically and in bulk, which is convenient in a case of a large company that can have many employees equipped with a personal mobile phone. Indeed, in the prior art, a device could be used for strong authentication, but in a fixed manner (for example a smartphone had to be configured in the shop).

Case 1 - Application on Terminal In this first embodiment, the method of configuring the device 1a, lb (which is here preferably smartphone type, friends which can also be a PC for example) to enable strong authentication of a user through the server 3 via said device 1a, lb begins with a step of secure connection of a client station 2 to the server 3. This step is essential to ensure that the user who attempts to perform an enrollment (and therefore attempting to modify access rights) is an authorized user. The client station 2 is for example a computer physically present in the local network of the company. This station 2 can also serve as an interface for controlling the server 3 and the peripherals (see below). In the present method, on a user interface of the client station 2, identification information of the device 1a, 1b is then entered. Figure 2 shows an interface that can be used. The information to identify the device 1a, lb can be many forms and consist for example of a telephone number, an IMEI code, a MAC address, etc. Preferably, the server 3 can store a device database 1 a, 1 b, each associated with a name where a unique identifier to select it easily (acas of Figure 2). The server 3 then generates (for example by means of a certificate) a secret authentication key associated with the device 1a, 1b enabling the algorithmic generation of OTP single-use passwords. Secret key means secret data on which the OTP can be obtained (for example an algorithm, codes, or even a list of pre-computed OTPs). By "associated with the device" is meant that it is specific to the latter and unique. The server 3 also generates and displays on said user interface of the client station 2 an activation code. In the example of Figure 2, this code is XA5T QCH7 6K2U. In parallel, the user loads (i.e. downloads and installs) on said device 1a, 1b a dedicated application (via the network 10), and enters the activation code in the application (as well as other data allowing for example to select the server 3). Obtaining the application may be free (via a blind), or triggered specifically by means of the data enabling the identification of the device 1a, 1b, for greater security. It should be noted that the application may have already been downloaded and used (for example in the case of re-enrollment, see below), and in this case the data that may be present (an old secret key, etc.). ) are erased. Then, the device 1a, 1b verifies the activation code with the server 3 (the latter receives the code entered, and compares with the code expected for this device 1a, lb). The check also includes comparing data from the device 1a, 1b with the information identifying the device 1a, 1b: in other words, the server 3 must receive the correct activation code from the device. good device 1 a, lb, to avoid any possibility of usurpation. Figure 3 shows an example of the application interface. In the case of a positive verification, the server 3 authorizes the transfer to a memory of the device 1a, 1b (via the application) of sensitive data 5 for authentication: at least the secret key, but where appropriate also; - an OTP counter; the management parameters of a personal identification code (PIN), and even, the unique identifier of the peripheral device 1a, 1b in the server 3, the size of the OTP (we shall speak again of this parameter further). The presence of the secret authentication key enables generation by the device 1a, 1b of said OTP single use passwords, and thus its use in strong authentication. If an OTP counter is also loaded, the latter is incremented with each new generation of a OTP single-use password by the device 1a, 1b, the secret authentication key associated with the device 1a, 1b being revoked if the OTP counter 20 reaches a given threshold. Device 1a, lb can then be re-enrolled and receive a new secret key and a (OTP counter reset). Re-enrollment includes all the steps previously described except for loading the application. If management parameters of a personal identification code (PIN), in other words a "PIN policy", are loaded, the method then comprises the definition by the user of a PIN code conforming to said parameters, the input of said personal identification PIN defined being requested from the user for authentication at each new generation of a OTP single-use password by the device 1 a, 1b, for greater security.

At this point, the user can use his device 1a, lb for strong authentication. As soon as he presses "generate" (provided that he has, for example, entered his PIN), an OTP is displayed (see figure 4). This OTP allows him in addition to his login / password pair to authenticate directly on the device (case of the terminal lb), for example via a copy and paste (advantageously a button in the interface allows to make the "copy "), Or on other equipment (for example the client station 2 if it is a laptop on the move) via an OTP entry (case of the terminal la).

The present method is very advantageous here in that it makes it easy to transform any mobile terminal into an authentication device quickly, efficiently and with total security. It should also be noted that this embodiment has the advantage of not requiring a connection of the device 1a, 1b to the server 3 to generate OTPs. This can be done in an environment where a mobile terminal would not pick up. Case 2 e-mail / SMS 20 In this second embodiment, it does without the need for an application, using an e-mail or SMS (or other means of messaging). An old phone or a third-party PC can then be used as a device 1a, 1b. Such an embodiment is well suited for temporary enrollment, or for backup access, but requires a connection of the device 1a, 1b to the network 10 during authentication, as will be seen. It can be provided that a user is allowed to enroll only one device in e-mail / SMS mode. It should be noted that the two embodiments are in no way exclusive: a user can enroll multiple devices with different mechanisms, the present method allows such flexibility. The method then begins as in the first embodiment: a secure connection of a client station 2 to the server 3 is established, and on a user interface of the client station 2, the user enters the device identification information I a , I b. In addition, it defines a PIN. Similarly to what has been described before, the server 3 generates a secret secret key 5 associated with the device 1a, 1b for the algorithmic generation of OTP single-use password. But this time, the secret key is not transferred via the network 10, but kept on storage means of the server 3, so as to allow the generation and sending by the server 3 said single-use passwords OTP in a message via the network 10 in the event of sending the personal identification code PIN to the server 3 from the device I a, I b. More specifically, the user who wants to authenticate sends to the server 3 a message from the device 1a, 1b, message containing the PIN. The server 3 extracts from the message data identifying the device (for example the telephone number if it is an SMS) and the PIN code and compares it with the expected one. As in the previous embodiment, the server 3 must receive the correct PIN code from the right device, lb, to avoid any possibility of spoofing. If this is the case, the server 3 itself generates the OTP and transfers it by message return. The user can then authenticate. Case 3- Card-type device, USB stick, etc. As explained, the present method allows the enlistment of several terminal type Ia, lb devices. But in addition, it also allows the enrollment of "traditional" peripherals 1 c such as smart cards (for example CPS, health professional card), autonomous portable devices (devices with the appearance of a calculator 30 with an output interface capable of displaying an OTP), USB tokens, etc. It can also be expected that a user is allowed to enroll only one such device.

This enrollment of a device 1 c "hard" is more conventional. It must be directly connected to the server 3 via a secure link. As in the two previous cases, a secure connection 5 of a client station 2 to the server 3 is established, and on a user interface of the client station 2, the user enters the identification information of the device 1 c (for example a number of the CPS card). The server 3 generates a secret authentication key associated with the device 1a, 1b (which is often a pre-calculated list of OTPs) allowing the algorithmic generation of OTP single-use passwords, and the load on the peripheral device lc. In general, it will be remembered that the method may be implemented several times so as to configure a plurality of peripherals 1a, 1b, 1c (if necessary of different types) in order to allow strong authentication of a user. thanks to a server 3 via each of said devices 1a, 1b, 1c. Complementary Mechanisms According to a preferred embodiment, the enrollment of a device 1a, 1b can comprise the generation by the server 3 of an error counter associated with the terminal 1a, 1b, said error counter being incremented with each erroneous authentication attempt via the device 1 a, 1 b, the user being blocked if the error counter reaches a given threshold. This helps prevent a third party from attempting to fraudulently use a device that has been stolen. According to another preferred embodiment, the authentication uses a challenge / response mechanism. In this particular case, the OTP is not an independent code but the answer to a question. More specifically, the user can not only press a generate button to obtain the OTP, but must enter a challenge provided by the server 3 (via the workstation on which he attempts to authenticate) . 3026 8 75 13 The challenge / response mode can be selected when enrolling a device. The secret key generated is then an algorithm capable of generating a response according to a challenge. As can be seen in FIG. 5, the interface of the application is then slightly changed (in the example shown in FIGS. 3 to 5, there are two tabs) and then makes it possible to enter the challenge. Similar to what has been explained before that the secret key is loaded on the device 1a, 1b and is manipulated via the application, the challenge / response mechanism can be implemented even in the absence of 10 connection of the device 1a, lb to the network 10. According to another preferred embodiment, the size of the OTP (optional parameter supplied to the application, see before) is a function of the number of devices 1a, 1b, 1c enlisted for the user. Indeed, when calculating the risk of a brute force attack, it is also necessary to take into account the margin, the number of peripherals and the number of attempts (i.e. the threshold of the possible error counter). An 8-character OTP (hexa) represents an entropy of 24 * 8 = 232, a 12-character OTP (hexa) represents an entropy of 24 * 12 = 248, and a 16-character OTP (hexa) represents an entropy The secret used in the creation of the OTP typically has sufficient entropy to generate a 112-bit key. Assuming that the algorithm used (for example MD5) makes it possible to distribute the results equitably, in the three cases of length above we are below the limit of the key of 112 bits but we can see that the level of Security is much higher for a 16-character OTP than for an 8-character OTP. But if the OTP has to be manually entered on a device different from the one that generated the OTP (which implies a manual entry, not a copy-and-paste), the 8-character one will be easier to use. For example, for a user with ten devices, a margin of twenty-five attempts, a brute-force attack with an 8-character OTP represents a chance on 232 / (10 * 20 * 5) or a chance on more than 4 million but a chance on 264 / (10 * 20 * 5) is a chance on more than 18 million with a 16 character OTP. Depending on the number of terminals (and other parameters such as the error threshold), the smallest size of OTP will be selected allowing protection such that the probability of success of a brute force attack is less than a threshold. given (for example, 1 in 1 billion). Device Management Preferably, the user (or an administrator) can manage the device 1a, 1b, 1c on a user interface of the client station 2 securely connected to the server 3. Figure 6 shows a fictitious profile and the peripherals la, lb, lc associated with it.

In the example, the user has enlisted four devices la, lb, lc: - a card on which 189 pre-computed OTPs remain; a first device with authentication by application, the size of the associated OTP is 16 characters; a first device with authentication by application, the size of the associated OTP is 8 characters; - an authentication device by e-mail. This interface makes it possible to list the devices 1a, 1b, 1c and to manage them: they can be easily revoked, re-enrolled, their modified preferences, etc. The duration of temporary enlistments can be managed. For each device can be accessed data such as the associated device credentials, where statistics such as the date of the last successful / failed connection, the status of the associated OTP / error counters, the name 30 of the certificate etc. The global access of the account to the server 3 can also be controlled.

Claims (9)

REVENDICATIONS1. A method of configuring a terminal-type device (1a, 1b) connected to a network (10) to enable strong authentication of a user by a server (3) via said peripheral (1a, 1b), said server (3) being also connected to the network (10), characterized in that it comprises the following steps: - Secure connection of a client station (2) to the server (3); - On a user interface of the client station (2), entering device identification information (1a, 1b); - Generation by the server (3) of a secret authentication key associated with the device (1a, 1b) for the algorithmic generation of one-time passwords (OTP); - Generation by the server (3) and display on said user interface 15 of the client station (2) of an activation code; - Loading on said device (1a, 1b) an application via the network (10), and entered by the user of the activation code in the application; - Verification by the device (1a, 1b) of the activation code from the server (3), and loading at least said secret authentication key via the network (10), so as to allow the generation by the device (1a, 1b) of said one-time passwords (OTP). 25 2. Method according to claim 1, also comprising following the verification of the activation code by the device (1a, 1b) the loading of an OTP counter, said OTP counter being incremented with each new generation of a one-time password (OTP) by the peripheral (1a, 1b), the secret authentication key associated with the peripheral (1a, 1b) being revoked if the OTP counter reaches a given threshold. 3. Method according to one of claims 1 and 2, also comprising following the verification of the activation code by the device (1a, 1b) the loading of management parameters of a personal identification code (PIN). , the method then comprising the definition by the user of a personal identification code (PIN) conforming to said parameters, the input of said defined personal identification code (PIN) being requested from the user for authentication at each new generation a one-time password (OTP) by the device (1a, 1b). 4. A method of configuring a terminal-type device (1a, 1b) connected to a network (10) to enable strong authentication of a user to a server (3) via said peripheral, said server (3) also being connected to the network (10), characterized in that it comprises the following steps: - Secure connection of a client station (2) to the server (3); - On a user interface of the client station (2), entry of device identification information (1a, 1b) and definition of a personal identification code (PIN); - Generation by the server (3) of a secret authentication key associated with the device (1a, 1b) for the algorithmic generation of one-time passwords (OTP); Storing said secret authentication key on storage means of the server (3), so as to enable the generation and sending by the server (3) of said one-time passwords (OTP) in a message via the network (10) when sending the personal identification code (PIN) to the server (3) from the device (1a, 1b). 5. Method according to one of claims 1 to 4, comprising the generation by the server (3) of an error counter associated with the terminal 30 (1a, 1b), said error counter being incremented with each attempt of erroneous authentication via the device (1a, 1b), the user being blocked if the error counter reaches a given threshold. 6. Method according to one of claims 1 to 5, wherein the generation of the one-time password (OTP) is a response to a challenge transmitted by the server (3) and displayed by the device (1a, 1b). . 5 7. Method according to one of claims 1 to 6, also comprising the configuration of a device (1c) of portable type autonomous device or smart card, to enable strong authentication of a user through a server (3). ) via said device (1c), the device 10 (1c) being directly connected to the server (3) via a secure link, said configuration comprising the following steps: - Secure connection of a client station (2) to the server (3) ; - On a user interface of the client station (2), entry of device identification information (1c); 15 - Generation by the server (3) of a secret authentication key associated with the peripheral device (1c) enabling the algorithmic generation of one-time passwords (OTP), and loading of said secret key on the peripheral device (1c) . 20 8. Method according to one of claims 1 to 7, implemented several times so as to configure a plurality of devices (1a, 1b, 1c) to enable strong authentication of a user through a server (3). ) via each of said peripheral (1a, 1b). 25 9. The method of claim 8, further comprising following the verification of the activation code by the device (1a, 1b) the loading of password size parameters for one-time use (OTP), the server (3). setting this one-time password size (OTP) according to the number of devices (1a, 1b, 1c) configured for the user.