Method for opening a secure session on a computer terminal

1. A method for initiating a secure session on a computer terminal connected to an authentication server, the method comprising:

transmitting, by the authentication server, a downward notification to a mobile terminal, through a real-time notification server, the downward notification is an enhanced authentication request comprising a set of authentication data including at least one session key,

wherein said transmitting of the downward notification to the mobile terminal by the authentication server is triggered by a user action on the computer terminal, wherein the user action is a session initiation attempt,

wherein the mobile terminal is connected to the computer terminal and the authentication server via an access point,

wherein the enhanced authentication request comprising the set of authentication data further comprises a user identifier for the authentication server and a one-time password,

wherein the set of authentication data is encrypted using a public key known to the authentication server associated with a private key known only to the mobile terminal,

wherein the at least one session key is produced on request and is associated with the user identifier via a user database;

transmitting, by the mobile terminal, an upward notification to the authentication server, through the real-time notification server, the upward notification comprising the user identifier and the public key encrypted using an enrollment key after the user identifier and the enrollment key are acquired by reading a QR code that is displayed by a screen of the computer terminal and further comprising a sub-set of the set of authentication data, at least the sub-set of the set of authentication data being encrypted using symmetric encryption using at least the at least one session key,

wherein the mobile terminal receives the upward notification and decrypts contents of the upward notification using the private key,

wherein the mobile terminal produces an authentication notification response using the sub-set of the set of authentication data, the sub-set of the set of authentication data being encrypted with the user identifier for the authentication server and the one-time password as encrypted content,

wherein the authentication notification response comprises in clear text the user identifier;

transmitting the authentication notification response to the authentication server via the mobile terminal;

receiving, by the authentication server, the authentication notification response that is transmitted which comprises the user identifier in clear text to allow the authentication server to find a user record in the user database;

decrypting the encrypted content of the authentication notification response using the at least one session key, wherein the authentication server finds the at least one session key via the user record;

verifying, by the authentication server, a conformity of the sub-set of the set of authentication data included in the upward notification compared to the set of authentication data that is transmitted and included in the downward notification, wherein said verifying comprises verifying that the one-time password encrypted in the upward notification conforms to the one-time password of the enhanced authentication request of the downward notification;

authorizing the initiating of the secure session on the computer terminal when said verifying is successful and when said one-time password encrypted in the upward notification matches the one-time password of the enhanced authentication request of the downward notification, such that the mobile terminal is used as a physical token in an enhanced authentication.

2. The method for initiating a secure session according to claim 1 , wherein the downward notification and the upward notification that are transmitted to the authentication server are routed through an intermediate server.

3. The method for initiating a secure session according to claim 2 , wherein the intermediate server is an XMPP server.

4. The method for initiating a secure session according to claim 1 , wherein the real-time notification server is public.

5. The method for initiating a secure session according to claim 1 , wherein the public key and the private key are produced by the mobile terminal during an enrollment phase of the mobile terminal on the authentication server.

6. The method for initiating a secure session according to claim 5 , wherein the enrollment phase is carried out by implementing at least one of:

acquiring, by the mobile terminal, of

an authentication server identifier;

configuration data for communication with the real-time notification server;

transmitting, by an enrollment tool, a message to the authentication server, the message comprising

the user identifier;

the enrollment key;

producing, by the mobile terminal, the public key and the private key;

transmitting, by the mobile terminal, the upward notification to the authentication server, the upward notification further comprising

the user identifier;

the authentication server identifier;

enrolling by the authentication server, such that the mobile terminal is used as the physical token.

7. The method for initiating a secure session according to claim 6 , wherein the user identifier is a temporary identifier associated with a permanent identifier, to prevent a real user identifier for the authentication server from being circulated in clear text, and wherein the temporary identifier is managed as the enrollment key and is transmitted with the enrollment key.