Method using a single authentication device to authenticate a user to a service provider among a plurality of service providers and device for performing such a method

Abstract

A method for authenticating a user to a provider, among a plurality of providers. The method uses an authentication device comprising, for each of provider, a record comprising a pairing key and first data, both as shared data. Provider authentication data comprises a first cryptogram obtained by encrypting said first data with said pairing key. Authenticating provider authentication data is performed at the authentication device by the steps of decrypting said first cryptogram by means of the pairing key stored in one of said records, then comparing the result of this decryption with first data resulting from pairing data stored in said record, if the comparison does not indicate a match, then processing again the previous decryption and comparison steps by using the pairing key of another record until each of said records stored in the authentication device has been processed.

1 . (canceled) 
     
     
         2 . A method for authenticating a user to a service provider using an authentication device identified by a device identifier, said method comprising a prior registration phase to register the authentication device with the service provider by:
 creating a new user account at the service provider; and   performing a pairing process for providing both the authentication device and the service provider with common pairing data.   
     
     
         3 . The method of  claim 2 , wherein said pairing data comprise at least one of pairing keys, shared data, functions and algorithms. 
     
     
         4 . The method of  claim 2 , wherein said pairing data are stored in a secure memory of the authentication device. 
     
     
         5 . The method of  claim 2 , wherein said pairing data are stored at the service provider in a database. 
     
     
         6 . The method of  claim 5 , wherein said pairing data being stored at the service provider in the user account created in the database of the service provider. 
     
     
         7 . The method of  claim 2 , further comprising:
 sending the device identifier from the authentication device to the service provider;   generating, by the service provider, a provider message enabling to derive at least a provider identifier;   sending the provider message to the authentication device;   preparing at the authentication device a response enabling to authenticate the authentication device; and   sending the response to the service provider.