System and method for authenticating users

Abstract

The invention relates to a system for authenticating users, comprising at least one application (10) installed on a mobile device (1) and comprising: an acquisition module (10B) for acquiring biometric data, a management module (10C) for managing information provided by a user (UR) and comprising at least the biometric data, the module being configured to store and record the information in a secure database, and an information transfer module (10D) configured to exchange the information between the application (10) and at least one server, the biometric data acquired and recorded by the application (10) comprising a facial photograph of the user and a photograph of their identity document, the information being configured to be confirmed by a third-party server (3), so as to create a user account associated with the user's information, the secure database being installed in an authentication server (5) distinct from the third-party server (3).

Description

Description Title: User authentication system and method. [Technical field. [1] The present invention relates to a user authentication system using in particular a mobile device application. The invention also relates to a user authentication method, as well as various uses of said method. [2] The invention relates to the technical field of security, in particular computer security and verification of the identity of users of the application. State of the art. [3] Currently, security and user authentication are topics of increasing concern in the field of computer science. Various authentication methods have been proposed to secure access to systems and data, including passwords, smart cards, biometric devices, and / or other forms of unique identifiers. Other, more complex systems have also been developed, but only allow partial verification of the user's identity. In fact, there is no way to ensure that a user is who they claim to be. [4] In addition, most companies have implemented, in recent years, their own application with an authentication system specific to each application, so that the user can access given goods and services. But this requires a large number of different applications for the user, and, due to an authentication system specific to each application, it also complicates their use. [5] Published patent document WO 2021 / 041566 A1 discloses an authentication method and a system associated with said method, the system using a PAM (acronym for “pluggable authentication module”) and a telephone application. This method makes it possible to record biometric data of a user in the application and to request the opening of a session on a computer. PAM carries out exchanges between the computer and the server, encoding and transmitting data from one to the other. However, this system is complex and does not allow verification of the information provided by the user. [6] Published patent document US 2014 / 0359299 A1 discloses an authentication method using a phone application requiring the creation of a user account on the application. When using a service, a QR code is offered to the user, who will use the application to decode it. However, no detailed explanation is provided to explain how the disclosed method works. The information provided by the user is also not verified. [7] The invention aims to overcome at least one of the drawbacks of the aforementioned state of the art. More particularly, the invention aims to improve user authentication. It also makes it possible to simplify existing authentication systems, while maintaining a high level of security. [8] The invention also aims to improve security when opening a computer session. [9] The invention also aims to facilitate the determination of the user's age, without the user needing to provide personal information.

[0010] The authentication method allows users' identity to be verified to access certain goods requiring identity verification, such as purchasing tickets or receiving a package, for example.

[0011] The invention finally aims to facilitate and secure banking transactions and means of payment, by ensuring that the user is authorized to make the request. Presentation of the invention.

[0012] The solution proposed by the invention is a user authentication system comprising at least one application configured to be installed on a mobile device and at least one server, said application comprising: a transmission module configured to exchange data from at least one imaging device of the mobile device, a biometric data acquisition module configured to acquire and receive said data from the transmission module, a module for managing information provided by a user and comprising at least the biometric data, said module being configured to store and record said information in at least one secure database, and an information transfer module configured to exchange the information between the application and the at least one server, the biometric data acquired and recorded by the application comprising a facial photograph of the user and a photograph of his identity document, the information being configured to be received and then verified with governments by the at least one server, said server being a third-party server,so as to create a verified user account associated with the information of said user, the secure database being installed in an authentication server separate from the third-party server, the authentication system further comprising an installation module on a digital interface configured to exchange instructions with the authentication server so as to be able to request authorizations.,

[0013] An "authentication system" means a system for verifying that the user is who they claim to be. This system operates in two stages: first, it verifies the validity of the identity document provided by the user when creating the account with the relevant services, then, secondly, it verifies that the user whose identity has been verified is the one using the application to access goods or services. These two successive verifications are carried out by two separate servers, managed by two separate companies. A "user" means the person using the application and requesting the creation of a verified user account. This user may possibly be associated, in the mobile device application, with other people or users with other accounts, such as children, persons under guardianship or a spouse, for example.Access to certain data may also be partial, for example to allow a user to give authorization to another user (to receive a package, among other things).

[0014] Preferably, a user account is associated with a set of information including in particular the user's biometric data, each account corresponding to a single user. This information may include personal information such as the user's surname, first name, or date of birth, for example, and include biometric data such as a photo of the user or fingerprints, for example.

[0015] The imaging device(s) of the mobile device that can retrieve the biometric data may be a camera, a photo camera, or any reader integrated into the mobile device, such as, for example, a fingerprint reader.

[0016] Advantageously, the user's information and biometric data associated with his or her account are stored in secure databases provided in the application and / or in the application manager's authentication server.

[0017] Advantageously, the installation module can be implemented on any digital interface, so as to allow different uses of the application (computers or payment terminals for example). This therefore simplifies the authentication process for the user while maintaining a high level of security.

[0018] The main objective of the invention is to ensure the identity of the user who holds the account, in order to ensure that the person who creates the account is who they claim to be. The creation of this account will allow organizations, companies, associations and more generally, third parties to ensure the identity of the user in a simple and secure manner. The security provided by the application is reinforced compared to existing systems, in particular thanks to the use of several authentication methods.

[0019] Other advantageous features of the system that is the subject of the invention are listed below. Each of these features can be considered alone or in combination with the remarkable features defined above. Each of these features contributes, where appropriate, to the resolution of specific technical problems defined further in the description and which do not necessarily include the remarkable characteristics defined above. The latter may be the subject, where appropriate, of one or more divisional patent applications.

[0020] According to one embodiment of the invention, the application of the mobile device further comprises a control module configured to regulate and secure the exchanges between the modules of said system.

[0021] Exchange regulation ensures the proper functioning of the application, in particular ensuring that information is transmitted at the right time and that the modules are activated. This also allows for better security of exchanges between modules and improves the robustness of the system against external attacks and communication errors.

[0022] According to one embodiment of the invention, the biometric data stored by the management module comprises a video of the user.

[0023] Using a video ensures that the person using the application and the user account are the same. Video therefore increases the level of security by using additional biometric data for user authentication.

[0024] According to one embodiment of the invention, the application of the mobile device further comprises a QR code reading module configured to activate the imaging device(s) of the mobile device and to decode and validate the photographed QR code.

[0025] The use of QR codes allows for faster and more secure authentication. QR codes are also easier to use, and their use facilitates the integration of the authentication system with other platforms and services that use the same QR codes.

[0026] Particularly preferably, the QR codes used are temporary and dynamic, which strengthens the security of the authentication system.

[0027] According to one embodiment of the invention, the system further comprises an analysis and verification module installed on the authentication server, said module being configured to compare biometric data with registered biometric data associated with the user account.

[0028] Using this type of module allows for stronger and more efficient authentication. Indeed, this module allows for a comparison of the biometric data of the user account with data pre-registered in a database, which increases the reliability of the authentication system.

[0029] This module is also configured to verify that the user account has been validated by the third-party server.

[0030] According to one embodiment of the invention, each user account verified by the third-party server includes the user's photograph associated with a unique dynamic watermark configured to enable visual verification of the user's identity.

[0031] The watermark is dynamic and unique, meaning it is valid for one use only and remains in motion for a period preferably between 5 seconds and 1 minute. This watermark is associated with the account holder's photograph and serves to authenticate the identity of the user of said account by allowing third parties to visually verify their identity and ensure that the photograph presented is not a copy.

[0032] The invention also relates to a method for authenticating users comprising at least one step of sending an authorization request to an authentication server by a user or a third party from an installation module of a digital interface, the method being carried out using an authentication system according to the invention, the method further comprising a step of triggering the acquisition module of the authentication system after the step of sending the authorization request by the installation module, the activation of the acquisition module resulting in the activation of at least one imaging device of the mobile device, the user then being invited to take a facial photograph as well as a short video by following instructions provided by the application, an additional step of sending the photo and video of the user to the authentication server, after the step of triggering the acquisition module, and a step of verifying the identity of the user carried out by an analysis and verification module of an authentication server, said server comparing the photograph of the user taken and sent by the application to the photograph recorded in the database(s), and verifying the presence of the user in front of the mobile device by the video; so that, when these verifications are positive, the authentication server validates the authorization request.

[0033] This authentication method allows for a double verification of the user's identity, on the one hand by verifying the validity of the user account using a third-party server, and on the other hand by comparing the identity of the user who owns the account with the identity of the user requesting authorization from the application.

[0034] A "short video" means that the video is generally less than 30 seconds long, preferably less than 10 seconds. The user can present different postures to verify their presence in front of the mobile device. This additional verification improves the security of the system and allows third parties to verify the identity of users.

[0035] These last two steps allow the user's identity to be verified by ensuring that the person requesting authorization is the same as the person in the user account used (by comparing the photograph taken by the user with the photograph recorded in the database), and the presence of said user in front of the mobile device (using the video).

[0036] According to one embodiment of the invention, the method further comprises a step of reading a QR code by the reading module of the application, said code being displayed by the digital interface after the step of sending the authorization request to the authentication server.

[0037] Using QR codes improves security when using the app, as well as being easy to use and quick to implement. It also provides an additional means of authentication and increases the flexibility of the authentication system.

[0038] According to one embodiment of the invention, the step of sending the authorization request is carried out by the digital interface to the authentication server, said server returning a QR code to the digital interface configured to be read by the reading module of the application of the mobile device.

[0039] Preferably, the QR code is dynamic and temporary, which improves the security of the method. This type of QR code is indeed more difficult to duplicate.

[0040] Preferably, the method includes a step of opening the application on the mobile device, which results in activation of the QR code reading module. This additional step may optionally trigger the process of verifying the user's identity.

[0041] According to one embodiment of the invention, reading the QR code causes information to be sent from the application to the authentication server, together with a request to activate the acquisition module, so that the validity of the user account is verified by the authentication server.

[0042] Sending this information allows the authentication server to verify that the user is authorized to make the authorization request. The authentication server also verifies at this stage that the user account has been validated by the third-party server.

[0043] According to one embodiment of the invention, the method comprises a preliminary step of creating and validating the user account in the application, said step comprising the following sub-steps: a first sub-step of recording the information provided by the user so as to create the user account, a second sub-step of taking a facial photograph of the user and their identity document, then recording the photographs obtained, a third sub-step of sending the information and biometric data to a third-party server configured to carry out a verification of the validity of the identity card and the information provided by the user, then a final sub-step of confirming the validity of the user account.

[0044] This step allows an initial verification of the user's identity by the third-party server which ensures the validity of the user account, in particular the information provided by the latter (validity of the identity document for example).

[0045] The invention also relates to a use of a user authentication method according to the invention for opening a computer session, the authorization request being a request to open a computer session.

[0046] This use allows for better security of computer sessions without the use of passwords.

[0047] The invention also relates to a use of a user authentication method according to the invention to verify the age of a user of the application holding a user account in order to access goods or services, said application being configured to provide third parties only with information on the user's majority or minority.

[0048] This method allows third parties to verify a user's age without having to request personal information.

[0049] The invention also relates to a use of a user authentication method according to the invention to validate banking transactions or to validate payment to a third party.

[0050] This method allows banking transactions to be validated more securely by ensuring that the user making the request is authorized to carry out the transaction.

[0051] The invention also relates to a use of a user authentication method according to the invention to allow the user to access goods or services, such as to provide access to a ticket office or to allow the recovery of a package.

[0052] This method allows the identity of ticket users to be verified against the identity of the buyer using the app. This method can also be used to verify that a user is authorized to pick up a package.

[0053] Thanks to the invention, a single application can serve various purposes and be used by different companies or third parties to secure access to their data or to verify the identity of their users. This also allows third parties to simplify their authentication systems, by using only one system that can grant different authorizations after verifying the identity of users, while ensuring maximum security for the personal data of said users. Brief description of the figures.

[0054] Other advantages and characteristics of the invention will appear more clearly on reading the description of a preferred embodiment which follows, with reference to the appended drawings, produced as indicative and non-limiting examples and in which: - [Fig. 1] is a diagram representing a user authentication system according to the invention; - [Fig. 2] represents the first step of creating and verifying a user account on an application of the authentication system according to the invention; - [Fig. 3] represents a method of authenticating a user to open a computer session; - [Fig. 4] represents a method of user authentication to verify the age of a user; - [Fig. 5] represents a method of authenticating a user to authorize a banking transaction. Description of the embodiments.

[0055] As used herein, and unless otherwise indicated, the use of the ordinal adjectives "first", "second", etc., to describe an object merely indicates that different occurrences of similar objects are referred to and does not imply that the objects so described must be in any given sequence, whether in time, space, ordering, etc. "X and / or Y" means: X alone or Y alone or X+Y. Generally speaking, it will be appreciated that on the various attached drawings, the objects are arbitrarily drawn to facilitate their reading.

[0056] Figure 1 shows the various constituent elements of a user authentication system according to the invention.

[0057] An authentication system according to the invention is intended to enable verification of the identity of a user (UR) at several levels. Firstly, when creating the user account on an application 10, the verification of the user's identity is carried out so as to ensure that the person holding the account has a legal existence (in particular by verifying an identity document provided by the user). Then, in order to access a good or service, the identity of the user requesting access is again verified, in particular by comparing the user's biometric data to ensure that the person holding the account is indeed the one making the authorization request. This system is therefore more efficient than previously existing authentication systems.

[0058] This authentication system is managed by an independent end-user manager and affiliated companies that may use the system to determine the identity of users requesting access to their goods and services. These companies may, for example, provide tickets (for access to shows or transportation services, for example), or authorize the purchase of specific goods whose access is limited to certain groups of people, such as alcohol or medication.

[0059] The authentication system according to the invention comprises at least one application 10 configured to be installed on a mobile device 1 of a user (UR), such as a smartphone for example. Other mobile devices can however be used to support the application 10, such as tablets, smart watches or smart glasses for example. Thus, the application 10 can be adapted to integrate with various devices, according to the needs of the end user or companies wishing to use it.

[0060] This application 10 allows the creation of at least one user account. This account may include information about this user, such as his names, first names, date of birth for example. Other information may be useful, in particular to verify the validity of the account or to provide limited access to certain goods or services. This information may also include the user's physical address, email address, profession or location history for example. Biometric data is also requested, such as the user's facial photograph (displayed in particular on the user account), as well as a photograph of the user's identity card. In a particularly preferred manner, a video of the user may also be recorded, this video being used in particular to verify the presence of the user in front of the mobile device. Other biometric data specific to the user may also be requested, depending for example on the needs of the companies or depending on the mobile devices supporting the application 10.Thus, fingerprint recording, iris or retina scanning, ear recognition or voice recognition may also be provided. This set of information and biometric data will therefore be used to create the user account, and to verify the information contained in this account.

[0061] This mobile device 1 can therefore comprise at least one imaging device 11, such as a camera or a video camera for example, said device making it possible to photograph the user or possibly making it possible to record a video. Thus, depending on the needs, the mobile device 1 can also comprise other imaging devices 11 such as fingerprint sensors or an iris scanner for example.

[0062] More specifically, the application 10 of the mobile device 1 comprises several modules allowing the activation of certain components of said device (such as the imaging devices 11) or allowing the exchange of information between the modules. Only the most important modules are listed below, but other modules, not mentioned, can be added as needed.

[0063] The application 10 of the mobile device 1 comprises a data transmission module 10A which transmits in particular the biometric data of the user (UR). This module 10A can exchange said data between the imaging device(s) 11 and one or more other modules of the system authentication. It can thus receive data allowing the activation of the imaging devices 11, or send the biometric data taken by these same devices to other modules. The general structure of such a module is known to those skilled in the art and will not be described in more detail.

[0064] The application 10 of the mobile device 1 further comprises a biometric data acquisition module 10B used to acquire and receive said data using the imaging device(s) 11 of said device. Thus, if the transfer of the data is carried out by the transmission module 10A, the acquisition of said data is carried out using this acquisition module 10B. The general structure of such a module is also known to those skilled in the art and will not be described in more detail.

[0065] The application 10 of the mobile device 1 further comprises a management module 10C for the information provided by the user, said information including in particular his biometric data. This module 10C is intended to store and record the information in at least one secure database. The database is preferably located on an authentication server 5 of the manager (as shown in FIG. 1). Alternatively, the database may be located in the application 10 of the mobile device 1. Alternatively, two databases may coexist, one on the application 10 of the mobile device (and securing only the information of the user or users using this device) and a database on the authentication server 5 of the manager (securing the data of all users of the application 10).The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0066] The application 10 of the mobile device 1 further comprises a module 10D for transferring information from the application 10 to one of the servers (3, 5), and possibly from said servers to the application. This server may, for example, be the authentication server 5 of the manager, or be a third-party server 3. This module may therefore transfer all or part of the information and biometric data provided by the user, it may also send only part of the information provided, such as information relating to the account and used to verify its validity for example (ID UR: identity of the account user sent to the server 5, see figures 3 to 5). The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0067] The authentication system further comprises a user identity verification module 3A installed on a third-party server 3. A “third-party server” means a server managed by a company separate from the manager of the application 10. This company compares the information and data provided by the user with information provided by governments. It is therefore a Remote Identity Verification Service Provider (PVID), which will verify the validity of the user’s identity document using their photograph (if it is still valid and if it really exists). Once this verification has been carried out, the user account is validated and can be used to request authorizations or to access goods or services. Advantageously, each user account is associated with a set of unique information and biometric data.Each account preferably includes a main page showing the user's photograph associated with a dynamic watermark, this watermark preferably lasting between 5 seconds and 1 minute. This watermark allows a third party to visually check the user's identity while ensuring the absence of fraud. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0068] Advantageously, the application 10 of the authentication system also comprises a control module 10E configured to regulate the different modules of said system and to control the exchanges carried out between said modules. This module therefore allows the application 10 to manage the exchanges. The general structure of such a module is known to those skilled in the art and will not be described in more detail.

[0069] Advantageously, the application 10 of the authentication system further comprises a QR code reading module 10F configured to activate one of the imaging devices 11 of the mobile device 1 in order to photograph a QR code, decode it and validate it. This will allow information to be sent from the application 10 to the authentication server 5 of the manager, the information comprising at least part of the user account so that the authentication server 5 of the manager checks whether this account has been verified and validated by the third-party server 3. Advantageously, the QR code read is a dynamic and temporary QR code, with a validity period of less than 1 minute, preferably less than 30 seconds, so as to maximize the security of the authentication system. The general structure of such a module is known to those skilled in the art and will not be described in further detail.

[0070] Advantageously, the authentication system further comprises an analysis and verification module 5A installed on the authentication server 5 of the manager. This module 5A retrieves the information and biometric data sent by the application 10, and more specifically, the information sent by the transfer module 10D of said application, and compares them with the information contained in the secure database(s). In particular, this module will compare the facial photographs of the user, and may possibly verify the presence of the user in front of the mobile device 1 using the video. The general structure of such a module is known to those skilled in the art and will not be described in more detail.

[0071] Advantageously, the authentication system further comprises a receiving and sending module installed on the authentication server 5 of the manager, this module being used to receive authorization requests so that a user (UR) holding an account on the application 10 can access goods or services. This module also makes it possible to send QR codes in order to validate the authorization requests, and in order to launch the procedure for verifying the identity of the user. The general structure of such a module is known to those skilled in the art and will not be described in more detail.

[0072] Finally, the authentication system may optionally include an installation module 7A configured to be installed on a digital interface 7. By “digital interface” is meant any interface comprising a screen and capable of sending or receiving data, such as a tablet, a computer, video game consoles or payment terminals for example. This installation module 7A will allow exchanges between the digital interface 7 and the authentication server 5 of the manager. This module may also send authorization requests to said server, and more specifically to the receiving and sending module of said server, and receive access authorizations following said requests. It will also receive the QR code (preferably dynamic and temporary), thereby validating the triggering of the operation of the application 10. The general structure of such a module is also known to those skilled in the art.

[0073] As mentioned above, the authentication system according to the invention therefore comprises the mobile device 1 on which the application 10 is installed, but also the third-party server 3, the authentication server 5 and the digital interface 7 which each comprise modules interacting with the application 10.

[0074] Alternatively, the mobile device application may also exchange information directly with the digital interface installation module, this interface being in this case preferentially associated with a third party, such as a natural person or a company. The third party may thus communicate with the user's mobile device and send it information, via the application or not.

[0075] The digital interface installation module may then include a third-party account creation sub-module that records the third-party's data and allows the creation of their account, in order to interact with the application and / or the authentication server and / or the third-party server. This module further includes a communication sub-module that sends one or more verification means to the user's mobile device. This verification means may be a verification link, a QR code, or any other verification means known to those skilled in the art. This link may be sent directly to the user via an SMS or an email, or may be sent via the application, and is used to request verification of the user's identity from the authentication server. Finally, the installation module includes a reception sub-module that receives the user's authentication or non-authentication and records it in the installation module.The third party will then have access to this authentication via their account.

[0076] Figures 2 to 5 show steps of the authentication method according to the invention, and will be described together. The characteristics described in Figure 1 will be repeated in Figures 2 to 5. Figure 2 describes more specifically a common preliminary step regardless of the application of the method, concerning the creation of the user account in the mobile device application. Figures 3 to 5 describe the other steps of the authentication method for three different uses, for opening a computer session (Figure 3), for verifying a user's age (Figure 4) and for validating a banking transaction (Figure 5).

[0077] The user authentication method therefore comprises a preliminary step of creating and validating the user account 101 in the application 10 of the mobile device 1. This device 1 is preferably a smartphone, even if other mobile devices, as mentioned above, can be considered as supports for the application 10. This step comprises several sub-steps described below.

[0078] After downloading the application 10 using methods known to those skilled in the art depending on the mobile device 1 on which the application is installed, the user (UR) will make a request to create the user account.

[0079] Following this request, a first sub-step 101 A of recording the personal information provided by the user is carried out, with the aim of enabling the creation of the user account in the application 10. This personal information may be, for example, his / her surname, first name and date of birth. This information may be recorded by the management module 10C in the secure database(s).

[0080] Then, a second sub-step consisting of photographing the user 101 B and photographing his identity document takes place. These photographs are advantageously taken by the acquisition module 10B of the application 10. Two photographs are therefore obtained by this means: a facial photograph of the user, and a photograph of his identity document. The facial photograph will be used when creating the account, and will also allow the authentication server 5 to compare it later with that of the user requesting access to the goods or services. Advantageously, a dynamic watermark will also be associated with this photograph in the user account. The photograph of the identity document will allow the third-party server 3 to verify the authenticity of said document by comparing it, for example, to government databases, it will also verify the validity of the information provided by the user when creating the account. As mentioned above, other biometric data may also be requested and / or used to verify the user's identity and verify their legitimacy in creating the account, such as fingerprints for example. The photographs, and possibly other biometric data of the user, are recorded in the secure database(s) and are associated with the user account. This data is recorded and stored using the management module 10C.

[0081] Then a third sub-step of sending the information 101 C to the third-party server 3 is provided, said information including in particular the biometric data of the user. This information and data is possibly transferred to the third-party server 3 using the transfer module 10D of the application 10. The verification module 3A of the third-party server 3 allows the company that manages it to carry out a verification of the validity of the identity of the user of the account. Thus, the server verifies that the identity document is valid, that it is still valid and that it corresponds to the identity document of the user. At the same time, the information provided by the user is verified. This information may be verified with administrations or governments. This information may also be compiled by a third-party company that can then quickly verify a person's identity with the recorded data.

[0082] Finally, once the user's identity has been verified, a final sub-step 101 D in which the verified user account is validated by the third-party server 3 for a limited period, preferably less than 5 years, and particularly preferably, for a period of 3 years. The server 3 thus confirms the validity of the account, and sends this validation to the application 10 of the mobile device 1 having made the request. This validation is necessary so that the user can use his account to make certain authorization requests or access goods or services, or to access other accounts or websites for example.

[0083] The authentication method, as shown in Figures 3 to 5, is characterized by exchanges made between the application 10 of the mobile device 1, the digital interface 7 and the authentication server 5. Once the preliminary step has been completed, no exchange is planned with the third-party server 3, except in the case of renewal of the validity of the account. The steps below are common, regardless of the use chosen for the authentication method.

[0084] First, a request is made from the digital interface 7 and consists of sending an authorization request 102 to the authentication server 5. This request can be made directly by the user, for example when the user requests the opening of a computer session, requests accessibility to a website or wishes to validate a banking transaction for example. This request can also be made by a third party when the interface is a payment terminal for example (in a store among others) or on another type of interface, such as to be able to retrieve a package.

[0085] The digital interface 7 will therefore send this authorization request in the form of a query to the authentication server 5 of the application manager 10, via the installation module 7A installed on said interface 7. This request is then received by the authentication server 5 and processed by its receiving and sending module 5B. Advantageously, this module then sends a QR code, preferably dynamic and temporary, to the digital interface 7. This QR code, displayed by said interface via its installation module 7A, must then be photographed by the application 10 in order to trigger the verification of the user's identity. Other methods can also be used to trigger the use of the application, such as sending a bar code for example or a temporary code.

[0086] The user will then open the application 10 on his mobile device 1, and the biometric authentication of the user will be able to take place. Via the application, the user will use the QR code reading module 10F to photograph and decipher the code presented by the digital interface 7 (corresponding to the step of reading, 102). This 10F module is configured to be triggered by the user from the application.

[0087] Reading the QR code triggers the sending of information from the application 10 to the authentication server 5. Certain account information is then sent, such as a user identifier (UR ID) associated with the account, and a request to request the triggering of the acquisition module 10B of the application 10. This information can be sent by the transfer module 10D of the application 10 to the authentication server 5.

[0088] The authentication server 5 of the manager will then analyze the user identifier (UR ID) and check whether the account with which he is seeking to identify himself has been validated by the third-party server 3. This verification is carried out by the analysis and verification module 5A of said server. If this verification is positive, the server sends an authorization to the application 10 to allow the triggering of the acquisition module 10B, as well as the activation of one or more imaging devices 11 of the mobile device 1.

[0089] After receiving this authorization, the application 10 triggers 104 the acquisition module 10B which will activate the imaging device(s) 11 using the transmission module 10A, and thus allow the facial photography of the user associated with the recording of a short video. By “short”, we mean a video of a duration of less than 1 minute, more preferably less than 30 seconds. The user will be able to adopt certain positions, such as movements of the head or other movements, by following precise instructions.

[0090] Once these photographs and videos have been taken, they are sent 105 to the authentication server 5. This sending is carried out by the transfer module 10D of the application 10. Optionally, these photographs and videos can be recorded by the management module 10C of the application 10, in the secure database(s).

[0091] The authentication server 5 receiving the user's biometric data will then carry out two successive verifications 106. First of all, a comparison will be carried out between the photograph recorded in the databases and associated with the user account to the photograph taken following the request. Preferably, this verification is carried out by artificial intelligence (AI), preferably combined with a verification by an individual working for the manager of the application 10. This comparison can be carried out by the analysis and verification module 5A of said server. Then, a verification of the video is carried out. This makes it possible to ensure the presence of the user of the account in front of the mobile device 1, and thus to eliminate the risk of using a simple photograph to activate the account. This verification can also be carried out by the analysis and verification module 5A of said server.

[0092] When this double verification is positive, demonstrating that the user is who he claims to be, the validation of the authorization request is sent by the authentication server 5 to the digital interface 7. This authorization can also be sent by the analysis and verification module 5A of said server. The installation module 7A of the digital interface will then validate the authorization request, and allow the user to access the desired goods and / or services.

[0093] More specifically, the authentication method can be used to improve security when requesting access to a computer session. This use is more specifically represented in Figure 3. The digital interface can then be a computer, a tablet, or any interface whose use may require improved security to access a system or a server, for example. This method is particularly suitable for limiting access to a limited number of people, and for keeping the information contained in the session confidential. Thus, the request made on the digital interface 7 is, in this case, a request to request the opening of a session. Validation of the user's identity by the authentication server 5 will allow this request to succeed, and will allow the opening of the computer session.This prevents a third party requesting access without having the necessary authorizations from gaining access, as they could by recovering passwords.

[0094] The authentication method can also be used to verify an individual's age, particularly to access goods or services prohibited to minors (sale of alcohol or medicines, access to specific websites such as online betting sites, for example). This use is more specifically represented in Figure 4.

[0095] The advantage of such an application is that only information relating to the user's age can be disclosed to a third party (person or company), without having to provide personal information. Thus, an authorization request is sent by the user from a digital interface 7 (access to online sites for example), or requested by a third party (from a payment terminal in a store, for example). The user's biometric data is also verified as previously described. Two scenarios are then possible.

[0096] In the first case, the user account displayed on the application 10 and presented to the third party includes a feature that makes it possible to visually distinguish the user accounts of minors from the user accounts of adults. This allows a third party to request verification of the user's age without having access to this personal information (access to a performance hall, purchase of alcohol, etc.).

[0097] In the second scenario, this would allow the user to access websites without providing any information other than their age. This can also be coupled with a control device to limit access to certain sites or platforms, such as devices allowing parental monitoring, for example. A third-party manager of a sports betting site could, for example, go through application 10 and request verification of the user's age. The user would not have to provide any other personal information, and use of the site in question could therefore be limited to adults only. This method would allow the person's age to be truly verified while limiting the transmission of personal information as much as possible.

[0098] The authentication method can also be used to verify the identity of a UR user before validating a payment or transactionbanking. This use is more specifically represented in Figure 5. The application 10 would ensure that the user is indeed the account holder, and is authorized to carry out the requested transaction. The digital interface can then be a computer, a smartphone, a tablet or a payment terminal for example. Other types of interfaces can however be considered to carry out this transaction or payment. The request sent from the interface is a request for authorization to carry out a payment or a banking transaction. As before, this request is sent to the server which will, thanks to the application 10, verify that the user account used has been validated by the third-party server 3, and that the user of the account is indeed the same one who requests to carry out the transaction or payment.Once these operations have been carried out, an authorization is sent by the authentication server 5 to the digital interface 7, and the transaction or payment is authorized.

[0099] The digital interface can possibly be assimilated to the user's mobile device, the authorization request can be sent directly by the device to the authentication server, in order to allow the user's authentication. This would simplify the method by reducing the number of exchanges between the different modules.

[0100] It is also possible for a third party who wishes to verify the identity of its customers before authorizing them to access its goods or services to create an account via the authentication system, in particular from the digital interface (a computer, smartphone or tablet for example).

[0101] The authentication method may therefore optionally include an additional step of creating and using an account by a third party, a company or a natural person. This step includes a first sub-step of creating the account and recording the information by the third party, then a second sub-step of generating a means of verification, such as a link, specific to the account of this third party. This means of verification will allow the third party to retrieve information on the verification of the user's identity from the authentication server.

[0102] Finally, a final sub-step of sending the verification means by the third party to the user takes place. This final sub-step consists either of directly sending the means to the user's mobile device, or of sending it to the authentication server, which then transfers it to the user's mobile device. Thus, a request for verification of the user's identity by the third party is made. This request can be likened to an authorization request as previously described, since it will, following verification of the user's identity, authorize the transaction or action requested by the user to take place. When the authentication means is sent to the user, the activation of said means by the user makes it possible to trigger steps 104 to 106 of verifying the user's identity.

[0103] Other uses are possible for this authentication system and for the authentication method, but are not reproduced in these figures. In particular, this system or this method can be used by a delivery person to ensure the identity of the user receiving a package, or can be used by the user to collect a package without using an identity document. Additionally, the application 10 can be used to verify the identity of a person carrying a ticket, and to verify their identity in public transport, or at the entrance to a show for example.

[0104] The arrangement of the various elements and / or means and / or steps of the invention, in the embodiments described above, should not be understood as requiring such an arrangement in all implementations. In any event, it will be understood that various modifications may be made to these elements and / or means and / or steps, without departing from the spirit and scope of the invention.

[0105] Further, one or more features disclosed only in one embodiment may be combined with one or more other features disclosed only in another embodiment. Similarly, one or more features disclosed only in one embodiment may be generalized to other embodiments, even if that or those features are described only in combination with other features.

[0106] The use of the verb "comprise", "comprise" or "include" and its conjugated forms does not exclude the presence of other elements or other steps than those set out in a claim.]

Claims

Claims

1. [User authentication system comprising at least one application (10) configured to be installed on a mobile device (1) and at least one server (3, 5), said application comprising: - a transmission module (10A) configured to exchange data from at least one imaging device (11) of the mobile device (1), - a biometric data acquisition module (10B) configured to acquire and receive said data from the transmission module (10A), - a management module (10C) for information provided by a user (UR) and comprising at least the biometric data, said module being configured to store and record said information in at least one secure database, and - an information transfer module (10D) configured to exchange information between the application (10) and the at least one server (3, 5), characterized in that the biometric data acquired and recorded by the application (10) comprise a facial photograph of the user (UR) and a photograph of his identity document, the information being configured to be received and then verified with governments by the at least one server, said server being a third-party server (3), so as to create a verified user account associated with the information of said user, the secure database being installed in an authentication server (5) separate from the third-party server (3), the authentication system further comprising an installation module (7A) on a digital interface (7) configured to exchange instructions with the authentication server (5) so as to be able to request authorizations.

2. User authentication system according to claim 1, characterized in that the application (10) of the mobile device (1) further comprises a control module (10E) configured to regulate and secure the exchanges between the modules of said system.

3. User authentication system according to one of claims 1 or 2, characterized in that the biometric data stored by the management module (10C) include a user video (UR).

4. User authentication system according to one of claims 1 to 3, characterized in that the application (10) of the mobile device (1) further comprises a QR code reading module (10F) configured to activate the imaging device(s) (11) of the mobile device (1) and to decode and validate the photographed QR code.

5. User authentication system according to one of the preceding claims, characterized in that said system further comprises an analysis and verification module (5A) installed on the authentication server (5), said module being configured to compare biometric data with recorded biometric data associated with the user account.

6. User authentication system according to one of the preceding claims, characterized in that each user account verified by the third-party server (3) comprises the photograph of the user associated with a unique dynamic watermark configured to allow visual verification of the identity of the user.

7. Method for authenticating users comprising at least one step of sending an authorization request (102) to an authentication server (5) by a user (UR) or a third party from an installation module (7A) of a digital interface (7), characterized in that the method is carried out using an authentication system according to one of claims 1 to 6, the method further comprising, - a step of triggering (104) the acquisition module (10B) of the authentication system after the step of sending the authorization request (102) by the installation module (7A), the activation of the acquisition module (10B) resulting in the activation of at least one imaging device (11) of the mobile device (1), the user (UR) then being invited to take a facial photograph as well as a short video by following instructions provided by the application (10), - an additional step of sending (105) the photo and the video of the user (UR) to the authentication server (5), after the step of triggering (104) the acquisition module (10B), and - a step of verifying (106) the identity of the user (UR) carried out by an analysis and verification module (5A) of an authentication server (5), said server comparing the photograph of the user (UR) taken and sent by the application (10) to the photograph recorded in the database(s), and verifying the presence of the user (UR) in front of the mobile device (1) by the video; so that, when these verifications are positive, the authentication server (5) validates the authorization request.

8. Method of authenticating users according to claim 7, characterized in that the method further comprises a step of reading a QR code (103) by the reading module (10F) of the application (10), said code being displayed by the digital interface (7) after the step of sending the authorization request (102) to the authentication server (5).

9. User authentication method according to claim 8, characterized in that the step of sending the authorization request (102) is carried out by the digital interface (7) to the authentication server (5), said server returning a QR code to the digital interface (7) configured to be read by the reading module (10F) of the application (10) of the mobile device (1).

10. User authentication method according to one of claims 8 or 9, characterized in that reading the QR code causes information to be sent from the application (10) to the authentication server (5), together with a request to activate the acquisition module (10B), so that the validity of the user account is verified by the authentication server (5).

11. Method for authenticating users according to one of claims 7 to 10, characterized in that the method comprises a preliminary step of creating and validating the user account (101) in the application (10), said step comprising the following sub-steps: - a first sub-step of recording (101A) the information provided by the user (UR) in order to create the user account, - a second sub-step of facial photography (101 B) of the user (UR) and his identity document, then of recording the photographs obtained, - a third sub-step of sending the information (101 C) and the data biometrics to a third-party server (3) configured to carry out a verification of the validity of the identity card and the information provided by the user, then - a final sub-step of confirmation of the validity of the user account (101 D).

12. Use of a user authentication method according to one of claims 7 to 11 for opening a computer session, the authorization request being a request to open a computer session.

13. Use of a user authentication method according to one of claims 7 to 11 to verify the age of a user (UR) of the application (10) holding a user account in order to access goods or services, said application being configured to provide third parties only the information of majority or minority of the user (UR).

14. Use of a user authentication method according to one of claims 7 to 11 to validate banking transactions or to validate payment to a third party.

15. Use of a user authentication method according to one of claims 7 to 11 to enable the user (UR) to have access to goods or services, such as to provide access to a ticket office or to enable the collection of a package.

Images