Conditional authentication access control method

1 . A method for controlling access of a user to a physical or logical resource, said user being equipped with a terminal provided with a first authentication device, said access control method comprising a signing-in phase with a service provider and a verifying phase with an access control operator, wherein the signing-in phase comprises:

generating, by a secure cryptographic device, an access token from an access criterion defined by the service provider, generating a keystream using a stream encryption, from the access token and from an initialization vector, and transmitting the keystream to the terminal; and

obtaining, by the terminal, an authentication reference of the user using the first authentication device, masking the authentication reference using the keystream, and transmitting the masked authentication reference to a homomorphic encryption unit to obtain a masked and encrypted authentication reference using a public key of a homomorphic cryptosystem, the masked and encrypted authentication reference being transmitted to a remote server to be stored in a database, and the verifying phase comprises:

transmitting, by the access control operator, the access token to the secure cryptographic device, the secure cryptographic device generating the keystream again if the access criterion is met, and transmitting the keystream to the remote server;

obtaining, by the access control operator, an authentication characteristic of the user using a second authentication device, encrypting the authentication characteristic using the public key of said homomorphic cryptosystem, and transmitting, to the remote server, the encrypted authentication characteristic;

performing, by the remote server, an addition operation of adding the encrypted authentication reference of the user to the keystream so as to obtain the homomorphically-encrypted authentication reference of the user;

performing, by the remote server, a comparison of the encrypted authentication characteristic and the homomorphically-encrypted authentication reference in a homomorphic domain, and transmitting, to the access control operator, a result of the comparison obtained in the homomorphic domain; and

decrypting, by the access control operator, the result of the comparison using a private key of the homomorphic cryptosystem, and granting or denying access to the user according to the decrypted result.

2 . The access control method according to claim 1 , further comprising obtaining the access token by aggregating a plurality of access conditions defined by the service provider.

3 . The access control method according to claim 2 , wherein the plurality of access conditions comprises at least one time-based access condition and one space-based access condition.

4 . The access control method according to claim 1 , further comprising signing the access token, by the secure cryptographic device, and transmitting the signed access token to the terminal, the terminal verifying an origin using a signature.

5 . The access control method according to claim 1 , further comprising incrementing the initialization vector at each new phase of signing-in the user.

6 . The access control method according to claim 1 , further comprising signing the keystream generated by the secure cryptographic device by the secure cryptographic device, encrypting the signed keystream using the public key of a cryptosystem of the user, decrypting, by the terminal, the keystream using the private key of the cryptosystem, and verifying an origin of the keystream using a signature.

7 . The access control method according to claim 1 , further comprising masking, by the terminal, a first biometric model with the keystream using an a XOR operation.

8 . The access control method according to claim 1 , wherein the first and second authentication devices are biometric readers of a same type, the authentication reference being a biometric reference and the authentication characteristic being a biometric characteristic.

9 . The access control method according to claim 8 , wherein the comparison between the biometric characteristic and the biometric reference is based on a classification of the biometric characteristic and the biometric reference into a plurality of classes, the comparison being conclusive if the classes in which the biometric characteristic and the biometric reference are classified are identical.

10 . A method for controlling access of a user to a physical or logical resource, said user being equipped with a terminal provided with a first authentication device, said access control method comprising a signing-in phase with a service provider and a verification phase with an access control operator, wherein the signing-in phase comprises:

for each of a plurality of cryptographic modules, generating an access token from an elementary access criterion defined by the service provider, generating a corresponding keystream using a stream encryption, from the access token associated with the elementary access criterion and an initialization vector, and transmitting the keystream to the terminal; and

obtaining, by the terminal, an authentication reference of the user using the first authentication device, masking the authentication reference using the keystreams, transmitting the masked authentication reference to a homomorphic encryption unit, to obtain a masked and encrypted authentication reference using a public key of a homomorphic cryptosystem, the masked and encrypted authentication reference being transmitted to a remote server to be stored in a database, and, the verification phase comprises:

transmitting, by the access control operator, the access tokens to the cryptographic modules that have generated the access tokens, each operator generating the keystream again if the associated elementary access criterion is met, and transmitting the keystream to the remote server;

obtaining, by the access control operator, an authentication characteristic of the user using a second authentication device, encrypting the authentication characteristic using the public key of said homomorphic cryptosystem, and transmitting, to the remote server, the encrypted authentication characteristic;

performing, by the remote server, successive addition of the masked and encrypted authentication reference of the user to the keystreams of said plurality of cryptographic modules, so as to obtain the homomorphically-encrypted authentication reference of the user:

performing, by the remote server, a comparison of the encrypted authentication characteristic and the homomorphically-encrypted authentication reference in a homomorphic domain, and transmitting, to the access control operator, a result of the comparison obtained in the homomorphic domain; and

decryption, by the access control operator, the result of the comparison using a private key of the homomorphic cryptosystem, and granting or denying access to the user according to the decrypted result.