Gemalto Sa

Thales Dis France Sas

Thales Dis France Sa

Frédéric Faure

Xavier Berard

Frédéric Dao

Lionel Mallet

Frédéric Paillart

Nicolas Roussel

Richard Pico

Fabrice Delhoste

Gary Chew

Benoit Gonzalvo

Christophe Foesser

Franck Dehlinger

Thomas Dandelot

Florent Labourie

Jérôme Duprez

David Halle

Nicolas Joubert

Thierry Silvestre

Jean-Sébastien Paris

Benoît Gonzalvo

Emilien Charbonnier

Alain Brun

Lionel Martin

Franck Borghino

Pascal Di-Girolamo

The present invention relates to a method for authentication of a user using a user equipment, comprising an authentication engine for authenticating at least one user, said authentication engine being configured to operate with a local authentication model, wherein the method comprises the step for the user equipment of enhancing its local authentication model by at least one authentication factor, wherein said at least one authentication factor is stored in the local authentication model with a validity indication, indicating the time the authentication factor is valid for taking into account by the authentication engine, and authenticating a user by means of a match of the local authentication model with a set of user behavior indications retrieved by the user equipment through the authentication engine.

Method for authenticating a user at a user equipment

A system configured to perform decision tasks carried out by a machine learning engine operates with a machine learning model, and includes a training component for improving the machine learning model, a device for carrying out decisions based on a set of input data, and an interaction interface for switching the machine learning model between training component and a device that includes a model attestation checker. The device performs acquiring input data, and ascertaining at least one machine learning model over the interaction interface. The model attestation checker performs checking if said machine learning model is trusted by a model attestation, and considering, for decision making, only those machine learning models that are trusted. The machine learning engine performs carrying out the decision task for input data by using a trusted machine learning model, and providing a result attestation for the decision output.

Method for securing a machine learning based decision system

Method for improving user authentication efficiency performed by a communication device belonging to an authentication system. The communication device includes a local machine learning engine having a set of N artificial neural network ANNadapted to process N different types of input signals. The method includes the steps: receiving a first set of N input signals S_() for authentication purpose; determining respectively for each of the N input signals S_() by the N artificial neural networks ANN, N estimations LH(i) of the likelihood that a given input signal is provided by a legitimate user; determining based on a risk scoring established using the N estimations LH(i) if the requesting user is authenticated as the legitimate user; if the requested user is authenticated, determining if at least one likelihood estimation determined for a given input signal S_() is below a predetermined threshold T, and if it is the case: transmitting the input signal S_() to a remote server implementing a server machine learning engine adapted to process said N different types of input signals and trained to identify a user U_C; receiving an input signal S_() associated to the closest candidate U_C and executing by the local machine learning engine an additional learning phase using the input signal S_() as an input signal that is not associated to the requesting user.

Method for improving user authentication performed by a communication device

A method for establishing a first secured communication channel between an administrative agent in a device and a distant server, the device comprising a secure element communicating with the administrative agent, the secure element being administrated through the administrative agent by the distant server, the administrative agent being administrated by a third party server through a second secured communication channel, the distant server and the third party server being connected through a third secured channel. The third party server requests, from the distant server, an operation on the secure element and a one-time PSK. The distant server sends, to the third party server, the one-time PSK. The third party server sends, to the administrative agent, a triggering message including the one-time PSK. A TLS-PSK handshake is performed between the administrative agent and the distant server with the one-time PSK to establish the first secured communication channel.

Method, server and telecommunications system for establishing, through an OTA server, a secured communication channel between an administrative agent comprised in a device and a third party server

The invention is a method for managing communication between a secure element and a device. The secure element comprises a physical communication interface and first and second virtual profiles. It is configured to exchange data targeting the virtual profiles with the device through the physical communication interface. The method comprises the steps of:

Method of managing several profiles in a secure element

A first device stores a subscription manager and at least two subscriptions. A first subscription is active and a second subscription is non-active. A second device sends a request for switching to the second subscription. The subscription manager sets a first variable relating to a next active subscription to the second subscription. The subscription manager sends to the first device a message requesting the first device to re-launch an execution of the subscription manager and to read data. The first device sends to the subscription manager a message including a command for re-launching an execution of the subscription manager. The subscription manager de-activates, based upon the first variable value, the first subscription. The subscription manager activates, based upon the first variable value, the second subscription, and sends to the first device operating system data relating to the second subscription, as a current active subscription.

Method for accessing a service and a corresponding device

The invention is a secure element comprising a virtual machine able to work in admin mode and in runtime mode. The secure element comprises two enhanced containers. Each of said enhanced containers can be either in an activated state or in a disabled state. Only one of the enhanced containers can be in activated state at any given time. The virtual machine is adapted to access each of the enhanced containers when working in admin mode. The virtual machine cannot access an enhanced container which is in disabled state when working in runtime mode.

Secure element comprising separated containers and corresponding method

Mutual authentication between: (i) a user terminal cooperating with a security element and an application for registering with a service, and (ii) a remote server that provides the service, by means of a third-party portal, includes: i) transmitting, to the remote server by means of the portal, signed information R enabling the security element to be authenticated in the remote server; ii) authenticating the security element in the remote server; iii) transmitting a value R' signed by the remote server to the application by means of the portal; iv) transmitting a request for verification of the signed value R&#x2032; from the application to the security element; v) verifying, in the security element, the signature of the remote server and whether the requested service has been granted by the remote server; vi) establishing a secure connection with the remote server using the security element, and requesting that the service be executed.

Method for mutual authentication between a terminal and a remote server by means of a third-party portal

A method of managing data in an electronic token includes an initial step of storing a first data into the electronic token and into a secured site. Secret data, intended to be initialized in the electronic token, is identified. Instructions and a subset of the first data are also identified, wherein the subset allows the secret data to be rebuilt by applying the instructions. A reference identifying the subset is sent to the electronic token. In the electronic token, the secret data is rebuilt from the first data and the reference by applying the instructions.

Method of managing sensitive data in an electronic token

The invention is a method of analyzing the wear of a non volatile memory embedded in a secure electronic token. A set of events are intended to generate writing and/or erasing operations in said memory. The token comprises a buffer. The method comprises the following steps: each time an event belonging to said set occurs, generating a data which reflects the event and storing said data in the buffer, sending the buffer to a remote machine, analyzing the buffer to determine the wear of the memory.

Method of analyzing the wear of a non volatile memory embedded in a secure electronic token

A method of detecting an abnormal environmental operating condition of an element embedded in an apparatus. The element is able to communicate with a telecommunications network. The method includes cyclically measuring at least one environmental operating parameter of the element, detecting that the element is operating for an excessive duration in at least one reference operating span and transmitting an alert message to the telecommunications network if the element has operated for an excessive duration in the reference operating span.

Method of detecting an abnormal environmental operating condition of an element embedded in an apparatus and corresponding element

In order to broadcast a commercial content corresponding to the centers of interest of a user of a communicating object, the disclosed method involves generating a message including at least one piece of commercial content associated with at least one piece of meta-information characterising the subject concerned by the commercial content. The method is implemented by the object for extracting a piece of commercial content from the message only if the piece of meta-information of the content corresponds to a piece of meta-information characterising a center of interest of the user.

Method and object for extracting content having a commercial aspect from a message emitted in a radiocommunication network

A first user of a first communicating object shares personal data in response to a request from a second user. The shared data are associated with a reference of the second user in the first communicating object and are transmitted to the second communicating object in order to be recorded therein in association with a reference of the first user. The first user controls the shared personal data from the first communicating object by transmitting a control instruction to the second communicating object. The instruction contains at least the reference of the first user in order to find the personal data of the first user in association with the reference in the second communicating object, and to treat the personal data according to the transmitted control instruction.

Controlled sharing of personal data

The invention concerns a terminal (T) comprising an agent (AS) for processing a secure content encrypted with a key (KCN) and transmitted by a first server (SCN). In order to manage a secure access to the secure content, an application (AG) of a portable communicating object, such as a chip card, associated with a terminal stores one type of related digital right (TDN) and a certificate and transmitted by the agent and stores an access right (DA) and the key (KCN) related to the secure content transmitted from a second server (SAD). The application adapts the access right and the key and modifies the secure content, based on the type of right, and produces a secure access file based on the adapted access right and the key and on the certificate, the produced file being accessible by the terminal so that the agent may process the modified content.

Management of secure access to a secure digital content in a portable communicating object

When a user records confidential data in a communicating object, the user inputs the confidential data which are encoded and transmitted, with a reference of the user, towards a server in order to record the encoded confidential data in association with the reference. When a user searches for a reference of another user of a communicating object in the communicating object, the user inputs a search datum which is encoded and transmitted to the server for comparing therein the encoded search datum transmitted to all of the encoded confidential data recorded in the server. The server transmits a reference associated with an encoded confidential datum corresponding to the encoded search data to the communicating object. In this way, the user of the communicating object is put into contact with the other user without knowing the data of the other user.

Growing community of inventors

Cassis, France

Frédéric Faure