Enrollment and verification of secret information

Abstract

The invention relates to a method for enrolling secret information, such as a secret code, implemented in a client device; a method for enrolling secret information, such as a secret code, implemented in a server device; a method for acquiring and verifying secret information, such as a secret code, implemented in a client device; a method for acquiring and verifying secret information, such as a secret code, implemented in a server device; and a device configured to implement one of these methods. Figure to be published with the abstract: Fig. 1

Description

Title of the invention: Enrollment and verification of secret information

[0001] The present invention relates to a method for enrolling secret information such as a secret code implemented in a client device, a method for enrolling secret information such as a secret code implemented in a server device, a method for acquiring and verifying secret information, such as a secret code, implemented in a client device, a method for acquiring and verifying secret information, such as a secret code, implemented in a server device and a device configured to implement one of these methods.

[0002] The acquisition and verification of secret information concerns, for example, the acquisition of an authentication code of a user in order to verify his identity. The verification of the identity of a user can be carried out, for example, in the case of access control, prior to carrying out transactions such as payment transactions, or in any other context requiring verification of the identity of a user.

[0003] Traditionally, user authentication, i.e., verification of the user's identity, is performed by entering a password or code, also called "secret information" or "authentication code", such as a PIN code, on a particular device specifically designed to protect the entered authentication code. Use of such a device requires that the user has a smart card storing the user's authentication code and that this smart card is inserted into the device prior to the user entering the authentication code. This device is capable of verifying that the entered authentication code is consistent with the authentication code stored in the user's smart card. An example of such a device is a PIN entry device (PED).PIN entry devices (PEDs) are particularly used in banking and healthcare.

[0004] These PIN entry devices (PEDs) must be approved in accordance with required standards to ensure that they provide adequate security. This translates into a number of security requirements that must be met in order to ensure the confidentiality, integrity and availability of user authentication data.

[0005] In order to meet these requirements, PIN entry devices are equipped with hardware security features to ensure the security of the authentication data and encryption keys used. These PIN entry devices include a PIN keypad for entering numeric values.

[0006] According to these PIN entry devices, the protection of the authentication code is mainly achieved by hardware mechanisms supplemented by software specific to these devices. These mechanisms can also use remote servers to supplement the security of these PIN entry devices. However, the PIN entry devices are most often complete and autonomous, ensuring by themselves the protection of the authentication codes entered. In the event of detection of an operating anomaly of the PIN entry device, the latter is put in a state such that it is rendered unusable and all sensitive data on the device is immediately erased or access to it is blocked.

[0007] These autonomous devices therefore present a high level of protection of the authentication codes entered and of the secret data.

[0008] Electronic devices, other than PIN entry devices, are today faced with securing a user's identity data and authenticating the latter. These include mobile phones, tablets, computers, etc. Indeed, it is increasingly often required to prove one's identity on these electronic devices, particularly when using services on the Internet.

[0009] In such electronic devices, identity data security solutions are based on authentication code entry software solutions for processing user authentication. These software security solutions include data security mechanisms and security control mechanisms to ensure the security of identity data.

[0010] These security and control mechanisms must be able to ensure that the security mechanisms of the electronic device are intact and operational. In addition, they must be able to detect the presence of anomalies, notify anomalies, alert and take appropriate measures in the event of an attempt to intercept the user's authentication code.

[0011] These mechanisms are however implemented by specific software on the hardware and software platforms of electronic devices which are often unreliable, this specific software being able to be directly executable or being sets of instructions executable by a virtual machine. Given the unreliability of these platforms, a malicious third party can access the software which runs on the platforms of the electronic devices and have access to the secret authentication data entered.

[0012] The aim of the invention is to remedy the drawbacks of prior techniques and to allow on the one hand the enrollment and on the other hand the acquisition and verification on a client device of secret information of a user or a third-party system, and allow on the one hand the enrollment and on the other hand the acquisition and verification of this secret information on a server device, while preventing the interception of this secret information by a malicious third party having control of the server device and the means of communication of this device.

[0013] This aim is achieved by a method for enrolling secret information (p) comprising N symbols from a plurality b of symbols that can be acquired, implemented in a client device, the client device having a plurality N of client secret keys (sO. The method comprises the following steps: • generation of a random customer number (a); • generation of N customer data (TO from at least the random number client (a) and the plurality N of client secret keys (sO; • sending N client data (TO to a server device; • reception of a table of coded elementary data (V, VP) from of said server device, each elementary data (Vij, VPij) encoding an acquireable symbol (j) among the plurality b of acquireable symbols, at a position i in an acquireable secret information; • display of a virtual keyboard for acquiring secret information to be enrolled, the virtual keyboard comprising the plurality b of symbols which can be acquired, the symbols being displayed in an order established in the table of coded elementary data; • acquisition on the virtual keyboard of N symbols (p;), the N acquired symbols (pi) forming secret information to be enrolled (p); • generation of coded secret information to be enrolled (W) from the coded elementary data (Vi,pi) determined in the table of coded elementary data for each acquired symbol (p;) forming the secret information to be enrolled, as a function of the acquired symbol and the position (i) of this symbol in the secret information to be enrolled (p); • generation of a partial coded secret information to be enrolled (Cl) from the coded secret information to be enrolled (W) using the client random number (a) and • sending the partial coded secret information to be enrolled (Cl) to the server device to be enrolled.

[0014] The method which is the subject of the invention allows the use of a virtual keyboard for the acquisition of secret information to be enrolled. The table of coded elementary data used for the display of the virtual keyboard, comprises, for each symbol which can be acquired on the keyboard, an elementary data item encoding the symbol, the encoding also being dependent on the position of the symbol when the secret information is entered by the user. The coded secret information to be enrolled is decoded completed by the acquired symbols and the elementary data table. The step of generating a partially coded secret information allows adding randomness to the coded secret information. Thus, if a malicious third party obtains the partially coded secret information (for example, during its transmission to the server device), he will not be able to determine the different symbols forming the secret information.

[0015] The array of coded elementary data may be an array whose elementary elements have been permuted so that the elementary data encoding the symbols that can be acquired j are not ordered.

[0016] The method may further comprise: • a step of receiving a user identifier, a fingerprint of protected secret information to be enrolled and a signature from the server device; and • a step of memorizing the user identifier, the fingerprint of the secret information to be protected and the signature in order to enroll the secret information.

[0017] The method may further comprise, • a step of receiving a masking table (¢) from the server device, each data item of the masking table being a masking of an acquireable symbol j and of the position of the acquireable symbol i; • a step of generating partial masking data (C2) from the masking table (¢), the acquired symbol j and the position i of the acquired symbol; • a step of sending the partial masking data (C2) to the server device.

[0018] The method may in this case further comprise, • a step of receiving a server data parameter (F) from the server device; • a step of generating a random customer masking number (ô); • a step of generating a first customer masking data (A) to from a generator (g) of a finite group and the random number of client masking (ô); • a step of generating a second client masking data (D) from the server data parameter (F) and the random client masking number (ô); • the step of generating partial coded secret information to be enrolled (Cl) is further carried out from the first client masking data (A); and • the step of generating partial masking data (C2) is further carried out from the second client masking data (D).

[0019] The coded secret information to be enrolled (W) can be generated by means of a multiplication function of the coded elementary data determined in the coded elementary data table (V, VP) for each acquired symbol (p;) forming the secret information to be enrolled.

[0020] The invention also relates to a method for enrolling secret information (p) comprising N symbols from a plurality b of symbols that can be acquired, implemented in a server device, the server device comprising a pair of keys comprising a private key (h) and a public key (H). The method comprises the following steps: • reception of N client data (TO) from said client device; • generation of N random server numbers (q); • generation of a table of coded elementary data (V, VP), each coded elementary data (Vi,j, VPij) being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information, the coded elementary data (Vi,j, VPij) being further dependent at least on the client data (T;) at position i, the public key (H) and the i-th server random number (q) generated; • sending the coded elementary data table (V, VP) to the client device; • receipt of partial coded secret information to be enrolled (Cl) from the client device; • generation of partial verification data (C0) based on at least the N server random numbers (q); • generation of protected secret information to be enrolled (M) from the partial coded secret information to be enrolled (Cl), the partial verification data (C0) and the private key (h); • processing of secret information to be protected (M) in order to enroll the secret information.

[0021] The method may further comprise a step of permuting the coded elementary data of the coded elementary data table to obtain a permuted coded elementary data table.

[0022] Processing the protected secret information to be enrolled (M) may include storing the protected secret information to be enrolled (M) in order to enroll the secret information.

[0023] The server device may further comprise a private hash key (Ks) and a private signature key (SKs). In this case, the processing of the secret information to protected enrollment (M) may include: • a step of generating a fingerprint of the protected secret information to be enrolled (M) from a cryptographic hash function, the private hash key (Ks) and the protected secret information to be enrolled (M); • a step of generating a signature from the private signature key (SKs), a user identifier and the generated fingerprint; • a step of sending to the client device, the user identifier, the generated fingerprint and the generated signature, in order to enroll the secret information.

[0024] The method may further comprise: • a step of generating a masking table (¢), each data item of the masking table being determined from an acquireable symbol j, the position of the acquireable symbol i, a first random masking number (y) for masking the acquireable symbol j and a second random masking number ([>) and a third random masking number (f) for masking the position of the acquireable symbol j; • a step of sending the masking table (¢) to the client device; • a step of receiving partial masking data (C2) from the client device; • a step of generating an unmasking data item (C) from the partial masking data item (C2), the second random masking number ([3), the third random masking number (f) and the number b of symbols that can be acquired; • the step of generating protected secret information to be enrolled (M) is further carried out from the unmasking data (C) and the first random masking data (y).

[0025] The invention also relates to a method for acquiring and verifying secret information (p') comprising N symbols from a plurality b of symbols that can be acquired, implemented in a client device, the client device having a plurality N of client secret keys (sO. The method comprises the following steps: • generation of a client random number (a'); • generation of N client data (T'O from at least the client random number (a') and the plurality N of client secret keys (sO; • sending the N client data (T'i) to a server device; • reception of a table of coded elementary data (V', VP') coming from of said server device, each elementary data (V'ij, VP'ij) coding a symbol which can be acquired (j) among the plurality b of symbols which can be acquired, at position i in secret information that can be acquired; • display of a virtual keyboard for acquiring secret information to be verified, the virtual keyboard comprising the plurality b of symbols which can be acquired, the symbols being displayed in an order established in the table of coded elementary data; • acquisition on the virtual keyboard of N symbols (p';), the N acquired symbols (p'i) forming the secret information to be verified (p'); • generation of coded secret information to be verified (W') from the coded elementary data (V'i,pi, VP'i,pi) determined in the table of coded elementary data for each acquired symbol (p';) forming the secret information to be verified, as a function of the acquired symbol and the position (i) of this symbol in the secret information to be verified (p'); • generation of a partial coded secret information to be verified (CT) from the coded secret information to be verified (W') using the client random number (a'); • sending the partial coded secret information to be verified (CT) to the server device to be verified and • receiving an indication including a result of the verification from the server device.

[0026] The array of coded elementary data may be an array whose elementary elements have been permuted so that the elementary data encoding the symbols that can be acquired j are not ordered.

[0027] The client device may further comprise a user identifier, a fingerprint of protected enrolled secret information and a signature. In this case, the method may further comprise a step of sending the user identifier, the fingerprint of protected enrolled secret information and the signature to the server device.

[0028] The method may further comprise, • a step of receiving a masking table (O') from the server device, each data item of the masking table being a masking of an acquireable symbol j and of the position of the acquireable symbol i; • a step of generating partial masking data (C2') from the masking table (O'), the acquired symbol j and the position i of the acquired symbol; • a step of sending the partial masking data (C2') to the server device.

[0029] In this case, the method may further comprise: • a step of receiving a server data parameter (F') from the server device; • a step of generating a random customer masking number (ô'); • a step of generating a first customer masking data (A') to from a generator (g) of a finite group and the random number of client masking (ô'); • a step of generating a second client masking data (D') from the server data parameter (F') and the random client masking number (ô'); • the step of generating a partial coded secret information to be verified (Cl') is further carried out from the first client masking data (A'); and • the step of generating partial masking data (C2') is further carried out from the second client masking data (D').

[0030] The coded secret information to be verified (W') can be generated by means of a multiplication function of the elementary data determined in the coded elementary data table (V', VP') for each acquired symbol (p';) forming the secret information to be verified.

[0031] The invention also relates to a method for acquiring and verifying secret information (p') comprising N symbols from a plurality b of symbols that can be acquired, implemented in a server device, the server device comprising a pair of keys comprising a private key (h) and a public key (H). The method comprises the following steps: • reception of N client data (T'O from said client device; • generation of N random server numbers (r'O; • generation of a table of coded elementary data (V', VP'), each coded elementary data (V'ij, VP'ij) being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information, the coded elementary data (V'ij, VP'ij) being further dependent at least on the client data (T'O at position i, the public key (H) and the i-th server random number (r'O generated; • sending the coded elementary data table (V', VP') to the client device; • reception of partial coded secret information to be verified (Cl') from the client device; • generation of partial verification data (C0') based on at least the N server random numbers (r'i); • generation of protected secret information to be verified (M1) from the partial coded secret information to be verified (CT), the partial verification data (CO') and the private key (h); • verification of the correspondence between the protected secret information to be verified (M1) and a protected enrolled secret information (M), without having access to the protected secret information to be verified (M'); and • sending an indication including a result of the verification to the client device.

[0032] According to this method, the verification of the correspondence between the protected secret information to be verified and the protected enrolled secret information can be carried out without having access to the secret information to be verified in clear or the secret information enrolled in clear.

[0033] The method may further comprise a step of permuting the coded elementary data of the coded elementary data table to obtain a permuted coded elementary data table.

[0034] The server device may further comprise a private hash key (Ks) and a public signature key (PKs), and in that the method further comprises: • a step of receiving a user identifier, a fingerprint of protected enrolled secret information and a signature from the client device; • a step of verifying the signature from the public signature key (PKs) and • the step of verifying the correspondence between the protected secret information to be verified (M1) and the protected enrolled secret information (M) comprises a step of generating a fingerprint of the protected secret information to be verified (M') from a cryptographic hash function, the private hash key (Ks) and the protected secret information to be verified (M') and a step of comparing the correspondence between the fingerprint of the protected secret information to be verified and the fingerprint of the protected enrolled secret information.

[0035] The method may further comprise: • a step of generating a masking table (O'), each data item of the masking table being determined from an acquireable symbol j, the position of the acquireable symbol i, a first random masking number (y') for masking the acquireable symbol j and a second random masking number ([3') and a third random masking number (f') for masking the position of the acquireable symbol j; • a step of sending the masking table (O') to the client device; • a step of receiving partial masking data (C2') from the client device; • a step of generating an unmasking data item (C') from the partial masking data item (C2'), the second random masking number ([3'), the third random masking number (f') and the number b of symbols that can be acquired; • the step of generating protected secret information to be verified (M') is further carried out from the unmasking data (C') and the first random masking data (y').

[0036] The invention also relates to a device configured to implement one of the methods described above.

[0037] We will now describe examples of embodiments of the present invention with reference to the appended figures where the same references designate from one figure to another identical or functionally similar elements:

[0038] [Fig-1] illustrates a first embodiment of a method for enrolling secret information implemented in a client device and a first embodiment of a method for enrolling secret information implemented in a server device in accordance with the invention.

[0039] [Fig.2] illustrates a first embodiment of a method for acquiring and verifying secret information implemented in a client device and a first embodiment of a method for acquiring and verifying secret information implemented in a server device, in accordance with the invention.

[0040] [Fig.3] illustrates a second embodiment of a method for enrolling secret information implemented in a client device and a second embodiment of a method for enrolling secret information implemented in a server device in accordance with the invention.

[0041] [Fig.4] illustrates a second embodiment of a method for acquiring and verifying secret information implemented in a client device and a second embodiment of a method for acquiring and verifying secret information implemented in a server device, in accordance with the invention.

[0042] [Fig.5] illustrates a third embodiment of a method for enrolling secret information implemented in a client device and a third embodiment of a method for enrolling secret information implemented in a server device in accordance with the invention.

[0043] [Fig.6] illustrates a third embodiment of a method for acquiring and verifying secret information implemented in a client device and a third embodiment of a method for acquiring and verifying secret information implemented in a server device, in accordance with the invention.

[0044] [Fig.7], the structure of a client device and a server device is described. configured to implement the methods according to the invention.

[0045] The present invention relates to a secure and reliable way of performing, on the one hand, an enrollment of a user's secret information, and on the other hand, an acquisition and verification of a secret information entered by a user, implemented in a client device and a server device. In particular, the invention relates to an enrollment method and a method for acquiring and verifying a secret information, implemented in a client device, such as a mobile phone, a computer or a tablet, so as to protect the secret information to be verified and prevent its interception. The invention also relates to an enrollment method and a method for acquiring and verifying a secret information, implemented in a server device so as to protect the secret information and prevent its interception.

[0046] The client device may be any type of device, such as a mobile phone, a tablet, a computer, etc., which comprises a hardware and software platform on which software is executed, this software being either directly executable or interpreted on a virtual machine.

[0047] Referring to [Fig. 1], there is illustrated a first embodiment of a method for enrolling secret information implemented in a client device and a first embodiment of a method for enrolling secret information implemented in a server device. The secret information to be enrolled comprises N symbols.

[0048] The symbols may be numeric characters or alphanumeric characters with or without punctuation characters. The symbols may also be images, icons, signs to make a pattern, a video sequence including selectable visual objects, or words that can form a sentence.

[0049] The client device may comprise at least one client secret key S. From the client secret key S, a plurality N of client secret keys s; may be generated, N being the length of the secret information to be enrolled. Furthermore, the client device may comprise a generator of a finite group g, for example of at least 2L, L being a security parameter.

[0050] The generator g is shared public data, in particular with the server device.

[0051] The server device comprises a key pair comprising a private key h and a public key H. The server device may also comprise the generator of a finite group g. According to a particular embodiment, the public key H may be generated from the generator g and the private key h, in particular by means of the mathematical function gh.

[0052] As illustrated, the method begins with a step of generating a client random number a (step 105). The random number is generated at each execution of the method of enrolling secret information.

[0053] At the end of step 105, the method continues on the client device with a step of generating a plurality N of client data T; (step 110). The generation of the client data T; is carried out from at least the client random number a and the plurality N of client secret keys Sj. This step makes it possible to create a parameter allowing a first level of masking of the symbols which will be acquired to form secret information to be enrolled.

[0054] According to a particular embodiment, each client data T; can be generated from the finite number generator g, the client random number a and the client secret key S;. According to one embodiment, each client data T; can be generated by means of a mathematical function fctl having as parameters, the finite number generator g, the client random number a and the client secret key S;. In particular, each client data T; can be determined according to the following mathematical formula: Ti = gsig“.

[0055] Step 110 is followed by a step 115 of sending the N client data T; from the client device to the server device. In particular, the N client data T; are sent in particular in an ordered manner.

[0056] After receiving by the server device the client data T; from the client device, the server device can generate N server random numbers q (step 120).

[0057] At the end of step 120, the server device can generate a table of coded elementary data V, each coded elementary data Vij, being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information. The elementary data is further dependent on the client data T; at position i, the public key H and the i-th server random number q generated (step 125).

[0058] A new table of coded elementary data is generated each time the secret information enrollment process is executed.

[0059] The coded elementary data table V is of dimension N by b, N being the number of symbols of the secret information and b being the number of symbols that can be acquired.

[0060] For each elementary data item in table V, a mathematical function fct2 can be applied to determine the value of the elementary data item. In particular, each elementary data item Vi,j (with i between 0 and Nl and j between 0 and b-1) can be determined by a mathematical function fct2 having as parameters the generator g, the client data item T;, the server random number q and the symbol that can to be acquired j. According to a particular embodiment, = TjH'1 | z E [;V], j E [b] with Ti which is the random component of the client device, Hri which is the random component for enrollment for the elementary data table and gjxh' which is a calculation based on the symbol that can be acquired j and b which is the number of symbols that can be acquired. Thus, the symbol of the secret information is masked by the client data T; and by Hri.

[0061] Step 125 may be followed by a step of permutation of the coded elementary data table V in order to obtain a permuted coded elementary data table VP (step 130). Thus, the elementary data coding the symbols that can be acquired j are not ordered according to the symbols j but disordered.

[0062] The method continues by sending the table of coded elementary data V or VP from the server device to the client device (step 135).

[0063] The client device then obtains a table of coded elementary data V, VP from said server device, each elementary data Vi,j, VPij coding an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information.

[0064] The client device then displays a virtual keyboard for acquiring secret information to be enrolled (step 140). The display of the virtual keyboard can be achieved by means of a graphical interface comprising a virtual keyboard capable of being displayed on a display means of the client device, the graphical interface comprising all of the symbols that can be combined in order to form secret information to be enrolled. The virtual keyboard comprises the plurality b of symbols that can be acquired. The symbols of the virtual keyboard are determined from the coded elementary data table V or the permuted coded elementary data table VP.

[0065] According to a particular embodiment, the virtual keyboard for acquiring secret information comprises the display of the plurality b of symbols that can be acquired according to the ordering determined in the coded elementary data table V or in the permuted coded elementary data table VP.

[0066] The method continues on the client device with a step of acquiring on the virtual keyboard, N symbols p,, the N acquired symbols p; together forming a secret information to be enrolled p (step 145). According to one embodiment, the user of the client device selects N symbols p; forming the secret information to be enrolled according to the selected keys of the virtual keyboard). The information *'«=[#] secret to enroll p is notably determined in the following manner: _ y^-l;

[0067] Step 145 is followed by a step of generating on the client device secret information to be enrolled coded W from the coded elementary data VijPi or VPijPi determined in the table of elementary data coded for each acquired symbol p; forming the secret information to be enrolled, as a function of the acquired symbol and the position i of this symbol in the secret information to be enrolled p (step 150).

[0068] According to one embodiment, the secret information to be enlisted coded W is generated by means of a multiplication function of the coded elementary data determined in the coded elementary data table V, VP for each acquired symbol p; forming the secret information to be enlisted. Thus, the secret information to be enlisted coded W can be generated by means of the following mathematical function: _ rrv y - A -1,=1 »

[0069] Step 150 is followed by a step of generating on the client device a partial coded secret information to be enrolled C1 from the coded secret information to be enrolled W and the client random number a (step 155). The step of generating a partial coded secret information to be enrolled makes it possible to add a random element to the coded secret information to be enrolled W. Thus, if a malicious third party obtains the partial coded secret information to be enrolled (for example, during its transmission to the server device), he will not be able to determine the different symbols forming the secret information.

[0070] According to a particular embodiment, the partial coded secret information to be enrolled C1 can be generated by means of a mathematical function fct3, for example, the following mathematical function: = The secret information to be enrolled Partial coded Cl is one of the components of the El Gamal cipher.

[0071] Step 155 is followed by a step 160 of sending from the client device to the server device the partial coded secret information to be enrolled CL.

[0072] The server device then receives partial coded secret information to be enrolled Cl from the client device.

[0073] The server device then generates a partial verification data item C0 as a function of the N server random numbers p (step 165). In particular, the partial verification data item C0 can further be generated from a generator g of a finite group. The partial verification data item C0 can then be generated by means of the following mathematical function fct4: Co = gr\ r being derived from the N server random numbers q. The partial verification data item C0 is another of the components of the El Gamal encryption.

[0074] Step 165 is followed by a step of generating protected secret information to be enrolled M on the server device, from the partial coded secret information to be enrolled C1, the partial verification data C0 and the private key h (step 170). This operation makes it possible to obtain the protected secret information to be enrolled without having access to the secret information to be enrolled in clear. The protected secret information to be enrolled M can be generated by means of the following mathematical function fct5: M = (^ / (%

[0075] Step 170 is followed by a step of processing the protected secret information to be enrolled M on the server device in order to enroll the secret information (step 175).

[0076] According to a first embodiment, the processing of the protected secret information to be enrolled M comprises the storage of the protected secret information to be enrolled M.

[0077] According to another particular embodiment, the processing of the protected secret information to be enrolled M comprises the application of a hash function on the coded secret information to be enrolled M (H(M)) and the result of the hash function is stored in the server device instead of the protected secret information to be enrolled M.

[0078] According to yet another embodiment, the processing of the protected secret information to be enrolled M comprises the application of a cryptographic hash function using a private hash key Ks, on the protected secret information to be enrolled M (HMAC[Ks](M)) and the result of the cryptographic hash function is stored in the server device instead of the protected secret information to be enrolled.

[0079] According to yet another embodiment, the server device further comprises a private hash key Ks and a private signature key SKs. In this embodiment, the processing of the protected secret information to be enrolled M comprises a step of generating a fingerprint of the protected secret information to be enrolled M from a cryptographic hash function, the private hash key Ks and the protected secret information to be enrolled M, a step of generating a signature from the private signature key of the server device SKs, an identifier of a user and the generated fingerprint and a step of sending to the client device, the identifier of the user, the generated fingerprint and the generated signature.

[0080] In this embodiment, the client device receives a user identifier, a fingerprint of protected secret information to be enrolled and a signature from the server device and a step of storing the user identifier, the fingerprint of the protected secret information to be enrolled and the signature in order to enroll the secret information.

[0081] Referring to [Fig.2], there is illustrated a first embodiment of a method for acquiring and verifying secret information implemented in a client device and a first embodiment of a method for acquiring and verifying secret information implemented in a server device. The secret information to be acquired and verified comprises N symbols.

[0082] The symbols may be numeric characters or alphanumeric characters with or without punctuation characters. The symbols may also be images, icons, signs to create a pattern, a video sequence comprising visual objects, or words that may form a sentence.

[0083] These methods may follow the enrollment procedures previously described with regard to [Fig. 1]. The purpose of these methods is to verify the correspondence between the secret information acquired by a user and previously enrolled protected secret information in order, for example, to authorize access or to authorize an operation if the correspondence is validated.

[0084] The client device may comprise at least one client secret key S. From the client secret key S, a plurality N of client secret keys s; may be generated, N being the length of the secret information to be verified. Furthermore, the client device may comprise a generator of a finite group g, for example of at least 2L, L being a security parameter. The client device having executed the method of [Fig.l] prior to the execution of the method for acquiring and verifying secret information has the client secret key S and / or the plurality of client secret keys.

[0085] The generator g is shared public data, in particular with the server device.

[0086] The server device may comprise a key pair including a private key h and a public key H. The server device may also comprise the generator of a finite group g. According to a particular embodiment, the public key H may be generated from the generator g and the private key h, in particular by means of the mathematical function gh. The key pair corresponds to the key pair of the enrollment method described with regard to [Fig.l].

[0087] As illustrated, the method begins with a step of generating a client random number a' (step 205). The random number is generated at each execution of the method of acquiring and verifying secret information.

[0088] At the end of step 205, the method continues on the client device with a step of generating a plurality N of client data T'; (step 210). The generation of the client data T'; is carried out using the client random number a' and the plurality N of client secret keys Sj. This step makes it possible to create a parameter allowing a first level of masking of the symbols which will be acquired to form the secret information to be verified.

[0089] According to a particular embodiment, each client data item T'; can be generated from the finite number generator g, the client random number a' and the client secret key S;. According to one embodiment, each client data item T'; is generated by means of a mathematical function fctl having as parameters, the finite number generator g, the client random number a' and the client secret key S;. In particular, each client data item T'i can be determined according to the following mathematical formula: Ti = gsig“'.

[0090] Step 210 is followed by a step 215 of sending the N client data T'i from the device client to the server device. In particular, the N client data T'i are sent, for example in an ordered manner.

[0091] After receiving by the server device the client data T'i from the client device, the server device generates N server random numbers r'; (step 220).

[0092] At the end of step 220, the server device generates a table of coded elementary data V', each coded elementary data V'^, being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information. The elementary data V'ij is further dependent on the client data T'; at position i, the public key H and the i-th server random number q generated (step 225).

[0093] A new table of coded elementary data is generated each time the method of acquiring and verifying secret information is executed.

[0094] The coded elementary data table V' is of dimension N by b, N being the number of symbols of the secret information and b being the number of symbols that can be acquired.

[0095] For each elementary data item of the table V', a mathematical function fct2, previously described, can be applied to determine the value of the elementary data item. In particular, each elementary data item V'i,j (with i between 0 and Nl and j between 0 and b-1) can be determined by a mathematical function fct2 having as parameters the generator g, the client data item T';, the server random number r'; and the symbol that can be acquired j. According to a particular embodiment, | ie [TV], je[b] with T'i 9ui is the random component of the client device, Hr i which is the random component for this table of coded elementary data and gj*b' which is a calculation based on the symbol that can be acquired j and b which is the number of symbols that can be acquired. Thus, the symbol of the secret information is masked by the client data item T'i and by Hr i.

[0096] Step 225 may be followed by a step of permutation of the coded elementary data table V' in order to obtain a permuted coded elementary data table VP' (step 230). Thus, the elementary data coding the symbols that can be acquired j are not ordered according to the symbols j but disordered.

[0097] The method continues by sending the coded elementary data table V', VP' from the server device to the client device (step 235).

[0098] The client device then obtains a table of coded elementary data V', VP' from said server device, each elementary data V'ij, VP'ij encoding an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information.

[0099] The client device then displays a virtual keyboard for acquiring secret information to be verified (step 240). The display of the virtual keyboard can be achieved by means of a graphical interface comprising a virtual keyboard capable of being displayed on a display means of the client device, the graphical interface comprising all of the symbols that can be combined in order to form secret information to be verified. The virtual keyboard comprises the plurality b of symbols that can be acquired. The symbols of the virtual keyboard are determined from the coded elementary data table V' or the permuted coded elementary data table VP'.

[0100] According to a particular embodiment, the virtual keyboard for acquiring secret information comprises the display of the plurality b of symbols that can be acquired according to the ordering determined in the coded elementary data table V' or in the permuted coded elementary data table VP'.

[0101] The method continues on the client device with a step of acquiring on the virtual keyboard, N symbols p';, the N acquired symbols p'; together forming a secret information to be verified p' (step 245). According to one embodiment, the user of the client device selects N symbols p'; forming the secret information to be verified according to the selected keys of the virtual keyboard j. The information " Cfe[7V] secret to be verified p' is notably determined in the following manner: , r'N-ï ; p P = L^P b

[0102] Step 245 is followed by a step of generating on the client device a secret information to be verified coded W' from the coded elementary data V'ijPi or VP'ipi determined in the table of coded elementary data for each acquired symbol p'; forming the secret information to be verified, as a function of the acquired symbol and the position i of this symbol in the secret information to be verified p' (step 250).

[0103] According to one embodiment, the coded secret information to be verified W' is generated by means of a multiplication function of the coded elementary data determined in the coded elementary data table V', VP' for each acquired symbol p'i forming the secret information to be verified. Thus, the coded secret information to be verified W' can be generated by means of the following mathematical function: itXw

[0104] Step 250 is followed by a step of generating on the client device a partial coded secret information to be verified Cl' from the coded secret information to be verified W' and the client random number a' (step 255). According to a particular embodiment, the partial coded secret information to be verified Cl' can be generated by means of the mathematical function fct3 previously described: C / = 77-- The partial coded secret information to be verified Cl' is one of the components of the El Gamal cipher.

[0105] Step 255 is followed by a step 260 of sending from the client device to the server device the partial coded secret information to be verified Cl'.

[0106] The server device then receives a partial coded secret information to be verified Cl' from the client device.

[0107] The server device then generates a partial verification data item C0' as a function of the N server random numbers r'; (step 265). In particular, the partial verification data item C0' can further be generated from a generator g of a finite group. The partial verification data item C0' can then be generated by means of the following mathematical function fct4, previously described: Co' = gr\ r' being derived from the N server random numbers r';. The partial verification data item C0' is another of the components of El Gamal encryption.

[0108] Step 265 is followed by a step of generating protected secret information to be verified M' on the server device, from the partial coded secret information to be verified Cl' by means of the partial verification data C0' and the private key h (step 270). This operation makes it possible to obtain the protected secret information to be verified without having access to the clear secret information. The protected secret information to be verified M' can be generated by means of the following mathematical function fct5, previously described: ' — C^' / Cq-

[0109] Step 270 is followed by a step of verifying the correspondence between the protected secret information to be verified M' with the previously enrolled protected secret information M, without having access to the secret information to be verified (step 275). Thus, the verification of the correspondence can be carried out without having access to the secret information to be verified in clear text or the secret information enrolled in clear text.

[0110] Step 275 is followed by a step of sending an indication of the result of the verification to the client device (step 280).

[0111] The client device then receives an indication of the result of the correspondence between the secret information to be verified and the enrolled secret information. If there is a correspondence between the protected secret information to be verified M' and the previously enrolled protected secret information M then the authentication of the user is validated and the indication of the result indicates for example that the authentication is correct. Otherwise, the authentication of the user could not be validated and the indication of the result may include a verification error message.

[0112] According to a particular embodiment, the server device comprises the result of a hash function applied to the protected enrolled secret information M (H(M)). In this case, prior to the correspondence verification step, it the hash function is applied to the protected secret information to be verified M' and the correspondence verification is carried out from the result of the hash function carried out on the protected secret information to be verified and the protected enrolled secret information.

[0113] According to another embodiment, the server device comprises the result of a cryptographic hash function using a private hash key Ks and the protected secret information to be enrolled M (HMAC[Ks](M)) performed during the enrollment of the secret information. In this case, prior to the correspondence verification step, the cryptographic hash function using the private hash key Ks is applied to the protected secret information to be verified M' and the correspondence verification is performed from the result of the cryptographic hash function performed on the protected secret information to be verified and the protected enrolled secret information.

[0114] According to yet another embodiment in which the client device has stored a user identifier, a fingerprint of protected enrolled secret information and a signature, the method implemented on the client device comprises a step of sending the user identifier, the fingerprint of protected enrolled secret information and the signature. The server device then receives a user identifier, a fingerprint of protected enrolled secret information and a signature from the client device.The method on the server device then continues with a step of verifying the signature from a public signature key PKs and the step of verifying the correspondence between the protected secret information to be verified M' and the protected enrolled secret information M comprises a step of generating a fingerprint of the protected secret information to be verified M' from a cryptographic hash function, a private hash key Ks and the protected secret information to be verified M' and a step of comparing the correspondence between the fingerprint of the protected secret information to be verified and the fingerprint of protected enrolled secret information.

[0115] The number of failed attempts to enter and verify secret information is set to ensure authentication security. Thus, if the number of failed attempts to enter and verify reaches a given threshold, then the user can no longer enter their secret information and an unlocking procedure is often implemented to unlock the secret information. In the last embodiment, the server device can check whether the number of failed attempts to enter and verify secret information has reached a given threshold. For this, the signature can or can be generated by the server device from a revocation list. Thus, when it receives a signature from the client, the server device can check that the number of failed attempts to enter and verify has not reached a given threshold and put update the revocation list.

[0116] According to yet another embodiment, the client device may comprise a pair of processing keys, namely a private processing key SK and a public processing key PK. This pair of processing keys may for example be used only if the verification of the secret information has shown that it corresponds to the enrolled secret information. To do this, the step of sending an indication of the result of the verification to the client device may comprise a certificate indicating that the secret information has been verified. The certificate may be generated on the server device from proof of possession of the pair of processing keys (SK, PK) by the client device. The proof of possession may be generated for example by means of a mathematical function and the following parameters: the private processing key SK, the public processing key PK and the indication that the secret information has been verified.The certificate generated by the server device may include information relating to the lifetime of the certificate.

[0117] [Fig.3] illustrates a second embodiment of a method for enrolling secret information implemented in a client device and a second embodiment of a method for enrolling secret information implemented in a server device in accordance with the invention.

[0118] Only the steps which differ from those of the first embodiment will be described in detail below. For the rest, reference is made to the first embodiment described in the support of [Fig.l].

[0119] In this embodiment, the enrollment method executing on the server device further comprises a step of generating a masking table <e>of the position i of the plurality of acquireable symbols, each data of the masking table being determined from an acquireable symbol j, the position of the acquireable symbol i, a first masking random number y for masking the acquireable symbol j and a second and a third masking random number [3, f for masking the position of the acquireable symbol j (305).

[0120] The masking table aims to hide the acquisition order of the symbols forming the secret information and introduce errors in order to mask the acquired symbols.

[0121] The masking table <e>is of dimension N by b, N being the length of the secret information and b being the number of symbols that can be acquired.

[0122] According to a particular embodiment, the masking table is determined in the following manner: _ TT I je [b], with F = gf and U being a group of order of at least 2L, L being a safety parameter.

[0123] Step 305 is followed by a step of sending the coded elementary data table V, VP and the masking table <e>from the server device to the client device (step 310).

[0124] The client device receives a masking table <e>from the server device, each data in the masking table being a masking of an acquireable symbol j and the position of the acquireable symbol i.

[0125] Following steps 140 to 155 described previously with regard to [Fig.l], a step of generating a partial masking data item C2 from the masking table ¢, the acquired symbol j and the position i of the acquired symbol (step 315) is carried out. According to a particular embodiment, the partial masking data item C2 can be generated by means of a mathematical function fct6, for example, the following mathematical function: _ | TV » 2 1

[0126]

[0127]

[0128]

[0129] Step 315 is followed by a step of sending the partial coded secret information to be enrolled C1 and the partial masking data C2 generated from the client device to the server device (step 320). The server device then receives a partial coded secret information to be enrolled Cl and a partial masking data C2. The method continues on the server device with a step of generating an unmasking data C from the partial masking data C2, the second random masking number [3, the third random masking number f and the number b of symbols that can be acquired (step 325). This step makes it possible in particular to eliminate the errors introduced at the time of the acquisition of the symbols. According to a particular embodiment, the unmasking data C can be generated by means of a mathematical function fct7, for example, by means of the following mathematical function: / J. C

[0130] The step of generating a protected secret information to be enrolled M from the partial coded secret information to be enrolled C1, the partial verification data C0 and the private key h is further carried out from the unmasking data C and the first random masking data y (step 330). According to a particular embodiment, the protected secret information to be enrolled M can be generated by means of a mathematical function fct8, for example, by means of the following mathematical function: .

[0131] [Fig-4] illustrates a second embodiment of an acquisition and verification method verification of secret information implemented in a client device and a second embodiment of a method for acquiring and verifying information secret training implemented in a server device, in accordance with the invention.

[0132] Only the steps which differ from those of the first embodiment will be described in detail below. For the rest, reference is made to the first embodiment described in the support of [Fig.2].

[0133] In this embodiment, the acquisition and verification method running on the server device comprises a step of generating a masking table <h’ de la position i de la pluralité de symboles pouvant être acquis, chaque donnée du tableau de masquage étant déterminée à partir d’un symbole pouvant être acquis j, de la position du symbole pouvant être acquis i, d’un premier nombre aléatoire de masquage y’ pour masquer le symbole pouvant être acquis j et d’un deuxième et d’un troisième nombres aléatoires de masquage |3’, F pour masquer la position du symbole pouvant être acquis j (405).

[0134] The masking table aims to hide the acquisition order of the symbols forming the secret information and introduce errors in order to mask the acquired symbols.

[0135] The masking table<!----> ' is of dimension N by b, N being the length of the secret information and b being the number of symbols that can be acquired.

[0136] According to a particular embodiment, the masking table is determined in the following manner: jp _ TJ p 'v' I j ], with F' = gf and U being a order group of at least 2L, L being a safety parameter.

[0137] Step 405 is followed by a step of sending the coded elementary data table V', VP' and the masking table <b’ du dispositif serveur au client (étape 410).

[0138] The client device receives a masking table <b’ provenant du dispositif serveur, chaque donnée tableau de masquage étant un d’un symbole pouvant être acquis j et la position i.

[0139] Following steps 240 to 255 described previously with regard to [Fig.2], a step of generating partial masking data C2' from the masking table <d’, du symbole acquis j et de la position i (étape 415) est réalisée. selon un mode réalisation particulier, donnée masquage partielle c2’ peut être générée au moyen d’une fonction mathématique fct6, par exemple, suivante, précédemment décrite regard [fig.3] : i—rTV n #'. / v ZA p J

[0140] Step 415 is followed by a step of sending the partial coded secret information to be verified C1 and the partial masking data C2' generated from the client device to the server device (step 420).

[0141] The server device then receives a partial coded secret information to be verified Cl' and a partial masking data C2'.

[0142] The method continues on the server device with a step of generating an unmasking data item C' from the partial masking data item C2', the second random masking number |3', the third random masking number F and the number b of symbols that can be acquired (step 425). This step makes it possible in particular to eliminate the errors introduced at the time of symbol acquisition.

[0143] According to a particular embodiment, the unmasking data C' can be generated by means of a mathematical function fct7, for example, by means of the following mathematical function, previously described with regard to [Fig.3]:

[0144] The step of generating a protected secret information to be verified M' from the partial coded secret information to be verified Cl', the partial verification data CO' and the private key h is further carried out from the unmasking data C' and the first random masking data y' (step 430). According to a particular embodiment, the protected secret information to be verified M' can be generated by means of a mathematical function fct8, for example, by means of the following mathematical function, previously described with regard to [Fig.2]:

[0145] [Fig.5] illustrates a third embodiment of a method for enrolling secret information implemented in a client device and a third embodiment of a method for enrolling secret information implemented in a server device in accordance with the invention.

[0146] Only the steps which differ from those of the first embodiment and the second embodiment will be described in detail below. For the rest, reference is made to the first embodiment described in the support of [Fig. 1] and to the second embodiment described in the support of [Fig. 3].

[0147] In this embodiment, the enrollment method running on the client device comprises a step of receiving a server data parameter F (in addition to the coded elementary data table V, VP and the masking table ¢) from the server device which follows the sending of the server data parameter F by the server device (step 505). The parameter F is for example generated from the generator g and can be calculated according to the mathematical formula gf.

[0148] The method continues on the client device with a step of generating a random client masking number ô and with a step of generating a first customer masking data A from a generator g of a finite group and the random customer masking number ô (step 510). The first customer masking data A can be generated by means of a mathematical function fct9, for example according to the mathematical formula gô.

[0149] Step 510 is followed by a step of generating a second client masking data D from the server data parameter F and the client masking random number ô (step 515). The second client masking data D can be generated by means of a mathematical function fctlO, for example according to the mathematical formula Fô.

[0150] The step of generating a partial coded secret information to be enrolled C1 from the coded secret information to be enrolled W using the client random number a, previously described with regard to [Fig. 1] is further carried out from the first client masking data A (step 520). The first client masking data A makes it possible to introduce a random number on the client side into the partial coded secret information to be enrolled C1.

[0151] According to a particular embodiment, the partial coded secret information to be enrolled C1 can be generated by means of a mathematical function fctl 1, for example, according to the mathematical formula: C1 = -777 A- ■ê»

[0152] The step of generating a partial masking data item C2 from the masking table ¢, the acquired symbol j and the position i of the acquired symbol, previously described with regard to [Fig.3] is also carried out from the second client masking data item D (step 525). The second client masking data item D makes it possible to introduce an additional random element into the partial masking data item C2 on the client side.

[0153] The first client masking data A and the second client masking data D will be deleted in the server device, in particular during step 330. Indeed, according to a particular embodiment in which the protected secret information to be enrolled M will be obtained in particular by means of a mathematical function comprising in particular the multiplication of C1 and C2, this has the effect of removing the random variables introduced by the client masking data.

[0154] According to a particular embodiment, the partial masking data C2 can be generated by means of a mathematical function fctl2, for example, according to the mathematical formula ■ q — q FTv ù 2 * L=0 p)

[0155] [Fig.6] illustrates a third embodiment of a method for acquiring and verifying secret information implemented in a client device and a third embodiment of a method for acquiring and verifying secret information implemented in a server device, in accordance with the invention.

[0156] Only the steps which differ from those of the first embodiment and the second embodiment will be described in detail below. For the rest, reference is made to the first embodiment described in the support of [Fig.2] and to the second embodiment described in the support of [Fig.4].

[0157] In this embodiment, the method for acquiring and verifying secret information running on the client device comprises a step of receiving a server data parameter F' (in addition to the coded elementary data table V', VP' and the masking table <b') provenant du dispositif serveur qui fait suite à l’envoi paramètre de données f’ par le (étape 605). le f est exemple généré partir générateur g et peut être calculé selon la formule mathématique gf.

[0158] The method continues on the client device with a step of generating a random client masking number ô' and with a step of generating a first client masking data item A' from a generator g of a finite group and the random client masking number ô' (step 610). The first client masking data item A' can be generated by means of a mathematical function fct9 previously described with regard to [Fig.5], for example according to the mathematical formula g6'.

[0159] Step 610 is followed by a step of generating a second client masking data D' from the server data parameter F' and the client masking random number ô' (step 615). The second client masking data D' can be generated by means of a mathematical function fctlO previously described with regard to [Fig. 5], for example according to the mathematical formula F'6'.

[0160] The step of generating a partial coded secret information to be enrolled Cl' from the coded secret information to be enrolled W' using the client random number a', previously described with regard to [Fig.2] is further carried out from the first client masking data A' (step 620). The first client masking data A' makes it possible to introduce an additional random element on the client side into the partial coded secret information to be enrolled Cl'.

[0161] According to a particular embodiment, the partial coded secret information to be enrolled Cl' can be generated by means of a mathematical function fctl 1 previously described with regard to [Fig.5], for example, according to the mathematical formula: fy = Jy A'-

[0162] The step of generating a partial masking data C2' from the masking table <b’, du symbole acquis j et de la position i acquis, précédemment décrite au regard [fig.5] est réalisée en outre à partir seconde donnée masquage client d’ (étape 625). la permet d’introduire côté un aléa supplémentaire dans partial.

[0163] The first client masking data A' and the second client masking data D' will be deleted in the server device, in particular during step 330. Indeed, according to a particular embodiment in which the protected secret information to be enrolled M will be obtained in particular by means of a mathematical function comprising in particular the multiplication of Cl' and C2', this has the effect of removing the random variables introduced by the client masking data.

[0164] According to a particular embodiment, the partial masking data C2' can be generated by means of a mathematical function fctl2 previously described with regard to [Fig.5], for example, according to the mathematical formula: Z *7=0 ' p „)

[0165] With reference to [Fig.7], the structure of a client device CLIENT and a server device SERVER configured to implement the methods that are the subject of the invention is described.

[0166] The client device CLIENT may be any type of device, such as a mobile phone, a tablet, a computer, etc., which comprises a hardware and software platform on which software is executed, this software being either directly executable or interpreted on a virtual machine. It notably comprises PROCESSOR-CL processing means which are configured to implement the methods of enrollment and acquisition and verification of secret information in accordance with the invention.

[0167] The server device SERVER is a device remote from the client device. It comprises in particular processing means PROCESSOR-SERV which are configured to implement the methods of enrolling and acquiring and verifying secret information in accordance with the invention and the storage memory MEM. The storage memory makes it possible in particular to store one or more enrolled secret information M.

[0168] The client device CLIENT also comprises interaction means composed for example of a display means ECR such as a screen and an input device CLA such as a keyboard, the display device ECR and the input device CLA being able to be the same device such as an interactive touch screen. The display device ECR comprises in particular display means, in particular a virtual keyboard in accordance with the invention.

[0169] Finally, the electronic device CLIENT and the server device SERVER may comprise network communication means, for example, conforming to any one of the Ethernet standards, and / or conforming to any one of the IEEE 802.11 (Wifi) standards, and / or conforming to one or more mobile telephony standards. (2G, 3G, 4G, etc.). < / e> < / e> < / e> < / e>

Claims

Claims

1. A method of enrolling secret information (p) comprising N symbols from a plurality b of symbols that can be acquired, implemented in a client device, the client device having a plurality N of client secret keys (s;), the method comprises the following steps: - generation of a random customer number (a) (105); - generation of N client data (T;) from at least the client random number (a) and the plurality N of client secret keys (sO (110); - sending the N client data (TO to a server device (115); - reception of a table of coded elementary data (V, VP) from said server device, each elementary data (Vij, VPij) encoding an acquireable symbol (j) among the plurality b of acquireable symbols, at a position i in an acquireable secret information; - displaying a virtual keyboard for acquiring secret information to be enrolled, the virtual keyboard comprising the plurality b of symbols that can be acquired, the symbols being displayed in an order established in the coded elementary data table (140); - acquisition on the virtual keyboard of N symbols (p;), the N acquired symbols (pi) forming secret information to be enrolled (P)(145); - generation of coded secret information to be enrolled (W) from the coded elementary data (Vi,pi) determined in the table of coded elementary data for each acquired symbol (p;) forming the secret information to be enrolled, as a function of the acquired symbol and the position (i) of this symbol in the secret information to be enrolled (p) (150); - generation of a partial coded secret information to be enrolled (Cl) from the coded secret information to be enrolled (W) using the client random number (a) (155) and - sending the partial coded secret information to be enrolled (Cl) to the server device (160) to be enrolled.

2.

3.

4.

5. Method according to claim 1, characterized in that the array of coded elementary data is an array whose elementary elements have been permuted so that the elementary data coding the symbols which can be acquired j are not ordered. Method according to any one of the preceding claims, characterized in that the method further comprises: - a step of receiving a user identifier, a fingerprint of protected secret information to be enrolled and a signature from the server device; and - a step of memorizing the user identifier, the fingerprint of the secret information to be protected and the signature in order to enroll the secret information. Method according to any one of the preceding claims, characterized in that the method further comprises: - a step of receiving a masking table (¢) from the server device, each data item of the masking table being a masking of an acquireable symbol j and of the position of the acquireable symbol i; - a step of generating partial masking data (C2) from the masking table (¢), the acquired symbol j and the position i of the acquired symbol (315); - a step of sending the partial masking data (C2) to the server device. Method according to the preceding claim, characterized in that the method further comprises: - a step of receiving a server data parameter (F) from the server device; - a step of generating a random customer masking number (ô); - a step of generating a first customer masking data (A) from a generator (g) of a finite group and the random customer masking number (ô); - a step of generating a second client masking data (D) from the server data parameter (F) and the random client masking number (ô); - the step of generating a partial coded secret information to be enrolled (Cl) is further carried out from the first client masking data (A); and - the step of generating partial masking data (C2) is further carried out from the second client masking data (D).

6. Method according to any one of the preceding claims, characterized in that the coded secret information to be enrolled (W) is generated by means of a multiplication function of the coded elementary data determined in the coded elementary data table (V, VP) for each acquired symbol (p;) forming the secret information to be enrolled.

7. A method of enrolling secret information (p) comprising N symbols from a plurality b of symbols that can be acquired, implemented in a server device, the server device comprising a key pair comprising a private key (h) and a public key (H), the method comprising the following steps: - reception of N client data (Tj) from said client device; - generation of N random server numbers (q) (120); - generating a table of coded elementary data (V, VP), each coded elementary data (Vij, VPij) being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information, the coded elementary data (Vij, VPij) being further dependent at least on the client data (Tj) at position i, the public key (H) and the i-th server random number (q) generated (125); - sending the coded elementary data table (V, VP) to the client device (135); - receipt of partial coded secret information to be enrolled (Cl) from the client device; - generation of partial verification data (CO) based on at least the N server random numbers (q) (165); - generation of secret information to be protected (M) to from the partial coded secret information to be enrolled (Cl), the partial verification data (CO) and the private key (h) (170); - processing the protected secret information to be enrolled (M) in order to enroll the secret information.

8. Method according to claim 7, characterized in that the method further comprises a step of permuting the coded elementary data of the coded elementary data table to obtain a permuted coded elementary data table (130).

9. Method according to any one of claims 7 to 8, characterized in that the processing of the protected secret information to be enrolled (M) comprises a storage of the protected secret information to be enrolled (M) in order to enroll the secret information.

10. Method according to any one of claims 7 to 8, characterized in that the server device further comprises a private hash key (Ks) and a private signature key (SKs), and in that the processing of the protected secret information to be enrolled (M) comprises: - a step of generating a fingerprint of the protected secret information to be enrolled (M) from a cryptographic hash function, the private hash key (Ks) and the protected secret information to be enrolled (M); - a step of generating a signature from the private signature key (SKs), an identifier of a user and the generated fingerprint; - a step of sending to the client device, the identifier of the user, the generated fingerprint and the generated signature, in order to enroll the secret information.

11. Method according to any one of claims 7 to 10, characterized in that the method further comprises: - a step of generating a masking table (¢), each data item of the masking table being determined from an acquireable symbol j, the position of the acquireable symbol i, a first random masking number (y) for masking the acquireable symbol j and a second random masking number (|3) and a third random masking number (f) for masking the position of the acquireable symbol j (305); - a step of sending the masking table (¢) to the client device; - a step of receiving partial masking data (C2) from the client device; - a step of generating an unmasking data item (C) from the partial masking data item (C2), the second random masking number (|3), the third random masking number (f) and the number b of symbols that can be acquired; - the step of generating protected secret information to be enrolled (M) is further carried out from the unmasking data (C) and the first random masking data (Y)-

12. A method for acquiring and verifying secret information (p') comprising N symbols from a plurality b of symbols that can be acquired, implemented in a client device, the client device having a plurality N of client secret keys (s;), the method comprises the following steps: - generation of a random customer number (a') (205); - generation of N client data (T'i) from at least the client random number (a') and the plurality N of client secret keys (sO (210); - sending the N client data (T'i) to a server device (215); - reception of a table of coded elementary data (V', VP') from said server device, each elementary data (V'ij, VP'ij) encoding an acquireable symbol (j) among the plurality b of acquireable symbols, at a position i in an acquireable secret information; - displaying a virtual keyboard for acquiring secret information to be verified, the virtual keyboard comprising the plurality b of symbols that can be acquired, the symbols being displayed in an order established in the coded elementary data table (240); - acquisition on the virtual keyboard, of N symbols (p'i), the N acquired symbols (p'i) forming the secret information to be verified (P') (245); - generation of a coded secret information to be verified (W') from the coded elementary data (V'i,pi, VP'ijPi) determined in the coded elementary data table for each acquired symbol (p'i) forming the secret information to be verified, as a function of the acquired symbol and the position (i) of this symbol in the secret information to be verified (p') (250); - generation of a partial coded secret information to be verified (Cl') from the coded secret information to be verified (W') using the client random number (a') (255); - sending the partial coded secret information to be verified (Cl') to the server device (260) to be verified and - receiving an indication comprising a result of the verification from the server device.

13. Method according to claim 12, characterized in that the array of coded elementary data is an array whose elementary elements have been permuted so that the elementary data coding the symbols which can be acquired j are not ordered.

14. Method according to any one of claims 12 to 13, characterized in that the client device further comprises a user identifier, a fingerprint of protected enrolled secret information and a signature, and in that the method further comprises a step of sending the user identifier, the fingerprint of protected enrolled secret information and the signature to the server device.

15. Method according to any one of claims 12 to 14, characterized in that the method further comprises: - a step of receiving a masking table (O') from the server device, each data item of the masking table being a masking of an acquireable symbol j and the position of the acquireable symbol i; - a step of generating a partial masking data item (C2') from the masking table (O'), the acquired symbol j and the position i of the acquired symbol (415); - a step of sending the partial masking data item (C2') to the server device.

16. Method according to the preceding claim, characterized in that the method further comprises: - a step of receiving a server data parameter (F') from the server device; - a step of generating a random client masking number (ô'); - a step of generating a first client masking data item (A') from a generator (g) of a finite group and the random client masking number (ô'); - a step of generating a second client masking data item (D') from the server data parameter (F') and the random client masking number (ô'); - the step of generating a partial coded secret information to be verified (CF) is further carried out from the first client masking data item (A'); and - the step of generating a partial masking data item (C2') is further carried out from the second client masking data item (D').

17. Method according to any one of claims 12 to 16, characterized in that the coded secret information to be verified (W') is generated by means of a multiplication function of the elementary data determined in the coded elementary data table (V', VP') for each acquired symbol (p'O forming the secret information to be verified.

18. A method for acquiring and verifying secret information (p') comprising N symbols from a plurality b of symbols that can be acquired, implemented in a server device, the server device comprising a key pair comprising a private key (h) and a public key (H), the method comprising the following steps: - receiving N client data (T'O from said client device; - generating N server random numbers (r'O (220); - generating a table of coded elementary data (V', VP'), each coded elementary data (V'ij, VP'ij) being a coded representation of an acquireable symbol j among the plurality b of acquireable symbols, at a position i in an acquireable secret information, the coded elementary data (V'ij, VP'ij) being further dependent at least on the client data (T'i) at the position i, the public key (H) and the i-th server random number (r';) generated (225); - sending the table of coded elementary data (V', VP') to the client device (235); - receiving a partial coded secret information to be verified (Cl') from the client device; - generating a partial verification data (CO') as a function of at least the N server random numbers (r';) (265);- generating a protected secret information to be verified (M1) from the partial coded secret information to be verified (Cl'), the partial verification data (CO') and the private key (h)(270); - verifying the correspondence between the protected secret information to be verified (M1) and a protected enrolled secret information (M), without having access to the protected secret information to be verified (M') (275); and - sending an indication comprising a result of the verification to the client device.;

19. Method according to claim 18, characterized in that the method further comprises a step of permuting the coded elementary data of the coded elementary data table to obtain a permuted coded elementary data table (230).

20. Method according to any one of claims 18 to 19, characterized in that the server device further comprises a private hash key (Ks) and a public signature key (PKs), and in that the method further comprises: - a step of receiving a user identifier, a fingerprint of protected enrolled secret information and a signature from the client device; - a step of verifying the signature from the public signature key (PKs) and - the step of verifying the correspondence between the protected secret information to be verified (M1) and the protected enrolled secret information (M) comprises a step of generating a fingerprint of the protected secret information to be verified (M') from a cryptographic hash function, the private hash key (Ks) and the protected secret information to be verified (M') and a step of comparing the correspondence between the fingerprint of the protected secret information to be verified and the fingerprint of the protected enrolled secret information.

21. A method according to any one of claims 18 to 20, characterized in that the method further comprises: - a step of generating a masking table (Ch'), each data item of the masking table being determined from an acquireable symbol j, the position of the acquireable symbol i, a first random masking number (y') for masking the acquireable symbol j and a second random masking number (|3') and a third random masking number (f') for masking the position of the acquireable symbol j (405); - a step of sending the masking table (O') to the client device; - a step of receiving partial masking data (C2') from the client device; - a step of generating an unmasking data item (C') from the partial masking data item (C2'), the second random masking number (|3'), the third random masking number (f') and the number b of symbols that can be acquired; - the step of generating protected secret information to be verified (M') is further carried out from the unmasking data (C') and the first random masking data (?')•

22. A device configured to implement the method according to any one of claims 1 to 6 or the method according to any one of claims 7 to 11 or the method according to any one of claims 12 to 17 or the method according to any one of claims 18 to 21.

Images