ICC reader

1 . An Integrated Chip Card, ICC, reader comprising:

a microcontroller, provides a hardware-based user-presence confirmation compliant with FIDO2 authentication requirements, configured to exchange data with an insertable ICC while the insertable ICC is inserted and powered, and with an end-user entity, an ICC connector configured to allow the exchange of data between the microcontroller and the inserted ICC, and

an end-user entity interface connector configured to allow the exchange of data between the microcontroller and an end-user entity,

wherein the ICC reader further comprises an activatable, user-operable, 2-position built-in switch defining two states:

a first state wherein the exchange of data between the microcontroller and the inserted ICC is allowed, and

a second state wherein the exchange of data between the microcontroller and the inserted ICC is interrupted emulating an ICC withdrawal.

2 . The ICC reader according to claim 1 , wherein the activatable built-in switch is:

a push button, wherein the first and second states correspond to a pushed and non-pushed position, or vice-versa, or

an on/off switch, the on position corresponding to the first state and the off position to the second state.

3 . The ICC reader according to claim 1 , wherein the activatable built-in switch is spring-biased to the position corresponding to the first state, such as the un-pushed position for the push button or the on position for the on/off switch, the built-in switch being maintained on the second state as long as an active user's interaction.

4 . The ICC reader according to claim 1 , wherein the ICC reader is a USB host adapted to embed the ICC as a non-removable USB-ICC connected to the ICC connector of the USB host.

5 . The ICC reader according to claim 4 , wherein the ICC reader is configured to support a Chip Card Interface Device, USB CCID, protocol with the insertable ICC and the end-user entity.

6 . The ICC reader according to claim 1 , wherein the activatable 2-position built-in switch is operatively connected to the microprocessor and is configured to send a command to the microprocessor for interrupting the data exchange with the inserted ICC upon shifting to the second state.

7 . The ICC reader according to claim 1 , wherein the activatable 2-position built-in switch is operatively connected to an interrupt-IN endpoint connector of the ICC connector to send an interruption command from the inserted ICC to the microprocessor upon shifting to the second state for emulating an interruption of the data exchange with the inserted ICC.

8 . An authentication token comprising:

the ICC reader according to claim 1 , and

an inserted ICC configured to allow the exchange of data with the microcontroller of the ICC reader through the ICC connector.

9 . The authentication token according to claim 8 , wherein the inserted ICC is a Fast IDentity Online2, FID02, compliant smartcard.

10 . The authentication token according to claim 9 , wherein the FIDO2 compliant smartcard is configured to generate pairs of Elliptic Curve Digital Signature Algorithm, ECDSA, keys bound to at least a relying party identity and an end-user account.

11 . The authentication token according to claim 10 , wherein the FIDO2 compliant smartcard has a Subscriber Identity Module, SIM, form factor or a MFF form factor.

12 . System for registering and authenticating an end-user account with an online service, the system comprising:

an authentication token according to claim 8 ;

an end-user entity being configured to communicate with a relying party providing the online service; and

the relying party, wherein the relying party is configured to store public keys each associated to an end-user account.

13 . System according to claim 12 , wherein the system further comprises a FIDO server accessible by the relying party and configured to store metadata of the authentication token such as form factors, characteristics, and capabilities for verification purposes.

14 . Method for registering an end-user account with an online service, the method comprising:

providing an authentication token;

receiving, by an end-user entity being configured to communicate with a relying party providing the online service, the credentials of the end-user account;

connecting the authentication token to an end-user entity though the end-user entity interface;

shifting the activatable 2-position built-in switch of the connected authentication token at least from the second state to the first state;

generating, by the authentication token, a cryptographic key pair unique for the authentication token, the online service and the end-user account to be registered;

sending, by the authentication token to the relying party through the end-user entity, the public key;

registering, by the relying party, the end-user account by storing the end-user account associated with the public key.

15 . Method for authenticating an end-user account already registered with an online service, the method comprising:

providing an authentication token;

receiving, by an end-user entity being configured to communicate with a relying party providing the on line service, the credentials of the end-user account;

connecting the authentication token to an end-user entity though the end-user entity interface;

creating a challenge response by shifting the activatable 2-position built-in switch of the connected authentication token at least from the second state to the first state;

retrieving, by the authentication token, the private key associated with the online service and the registered end-user account,

signing, by the authentication token, the challenge response;

sending, by the authentication token to the relying party through the end-user entity, the signed challenge response; and

verifying, by the relying party, the signed challenge response with the public key stored and, if both matches, authenticating the end-user account.