EP3394812A1

EP3394812A1 - Authentication method

Info

Publication number: EP3394812A1
Application number: EP16829414.8A
Authority: EP
Inventors: Stéphane GIRODON
Original assignee: Idemia France SAS
Current assignee: Idemia France SAS
Priority date: 2015-12-22
Filing date: 2016-12-21
Publication date: 2018-10-31
Also published as: US10909530B2; CN108701304B; CN108701304A; FR3045877A1; US20190005490A1; WO2017109405A1; FR3045877B1

Abstract

The invention relates to an authentication method implemented by an authentication server (ACS), comprising: receiving, from a service (S) access server (SW), an authentication request comprising transaction data (DT) associated with a chip card; determining whether a security code included in the transaction data is of the dCVV type; and if it is, detecting that no 3DS authentication is required and cooperating with a verification server (SV) in order to verify the validity of the dCVV security code.

Description

Authentication method

Background of the invention

The present invention is in the field of authentication mechanisms and more particularly relates to an authentication from a security code of a smart card.

The invention may in particular be used to control a user's access to an online service accessible via a telecommunications network such as the Internet for example.

Financial transactions carried out remotely (online or by telephone for example), using a bank card, present greater risk of fraud than when the user comes to a point of sale with his credit card. These risks of fraud are due to the fact that there is always a risk that the data of a bank card is stolen and used in a malicious way without the knowledge of the legitimate holder of the bank card. In particular, there is a risk that a fraudster will steal the PAN (Primary Account Number), the expiry date of the bank card, and the static security code (referred to as CW). for "Card Check Value") generally appearing on the back of the card.

In order to enhance the security of remote financial transactions, a 3DS authentication protocol for "3-D Secure" has been developed. This protocol provides for the sending of a secret code to the user, via for example an email or an SMS, in order to authenticate the user when the latter attempts to perform a transaction remotely with his credit card.

The 3DS authentication protocol well known to those skilled in the art reduces the risk of fraud in a remote financial transaction, but this protocol also has certain disadvantages. During a 3DS authentication phase on the Internet, for example, a window usually opens in the user's Internet browser to invite the user to enter the secret code that he has just received by SMS or email. This phase sometimes disturbs the user who can in some cases lose trust and abandon the current transaction, especially if there is any doubt about the authenticity of this invitation window. Moreover, the user is not always able to receive the secret code that has been sent to him as part of the 3DS protocol, or does not have the time or the desire to enter this secret code when the invitation is made to him.

A need exists today for an authentication mechanism to effectively secure a chip transaction while limiting the disadvantages mentioned above.

Object and Summary of the Invention / Summary

For this purpose, the present invention relates to an authentication method implemented by an authentication server, comprising:

receiving, from a service access server, an authentication request comprising transaction data associated with a smart card;

determining whether a security code included in the transaction data is of the DCW type; and

- if so, detection that no 3DS authentication should be performed and cooperation with a verification server to verify the validity of the DCW security code.

The present invention is advantageous in that it makes it possible to dispense with the authentication mechanism according to the 3DS protocol when it is possible to authenticate the user of the transaction by verifying a dynamic security code DCW generated by the card. user's smart card (when said card is of DCW type). As explained above, the authentication according to the 3DS protocol has certain disadvantages, in particular in that it can cause discomfort for some users sometimes leading to the abandonment of the current transaction. The invention makes it possible to inhibit the 3DS mechanism while maintaining a high level of security by verifying, where possible, a DCW code. Thanks to the invention, it is possible to facilitate the authentication of a user, and therefore his access to a service.

According to a particular embodiment, the authentication method comprises sending, to the access server, a positive authentication message transaction data if the validity of the DCW code is verified successfully during said cooperation.

According to a particular embodiment, the authentication method is such that: the authentication server determines whether the smart card is of the DCW type from a PAN identifier included in the received transaction data; and

- if yes, the authentication server determines that the security code is DCW.

According to a particular embodiment, if the security code is of DCW type, the authentication server prevents the realization of a 3DS authentication of said smart card.

According to a particular embodiment, if the security code is of CW type and if the authentication server determines, from the transaction data, that it is authorized to perform a 3DS authentication, the authentication server authorizes performing a 3DS authentication of said smart card.

According to a particular embodiment, the smart card is a credit card, and the transaction data comprises a PAN identifier and an expiration date of said bank card.

According to a particular embodiment, said cooperation comprises:

sending, to the verification server, transaction data comprising the DCW type security code, the PAN bank identifier and the expiry date; and

receiving, in response to said sending, the result of the validity check of the DCW code.

According to a particular embodiment, the smart card is a bank card and the authentication server is an access control server,

wherein, if the security code is determined to be of DCW type, the access control server performs the following steps:

- checking, from the transaction data, if a 3DS authentication can be performed for the bank card; and

if so, performing an authentication according to the 3DS protocol of said bank card.

According to a particular embodiment, the smart card is a bank card and the authentication server is a 3DS directory server,

wherein, if the security code is determined to be of DCW type, the 3DS directory server performs the following steps:

- checking, from the transaction data, if a 3DS authentication can be performed for the bank card; and if so, transmitting the transaction data to an access control server to cause the authentication of said bank card to be performed according to the 3DS protocol.

According to a particular embodiment, the authentication server configures itself, only if a parameter received from the access server with the transaction data is in a predefined state, to detect that no 3DS authentication must be performed if a code security included in the transaction data is of the DCVV type.

The invention also relates to a control method implemented by a server for access to a service, comprising:

receiving transaction data associated with a smart card during a transaction with the access server;

- transmission of the transaction data to an authentication server to request authentication of the transaction according to the 3DS protocol; and

determination, from a message received from the authentication server, that no authentication according to the 3DS protocol must be carried out if the smart card is of the DCW type.

According to a particular embodiment, the access server determines that the authentication is performed successfully on reception, from the control server, of a positive verification message of a security code DCW included in the data of transaction.

According to a particular embodiment, the access server sends, to the authentication server, a parameter with the transaction data, said parameter being in a predefined state to indicate that no 3DS authentication should be performed if a code of Security included in the transaction data is DCVV type.

In a particular embodiment, the different steps of the authentication method implemented by the authentication server as defined above are determined by instructions of computer programs.

Similarly, according to a particular embodiment, the different steps of the control method implemented by the access server as defined above are determined by instructions of computer programs.

Consequently, the invention also relates to a computer program on an information carrier (or recording medium), this program being capable of being implemented in a server, or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of at least one of the methods as defined above.

The invention also relates to a recording medium (or information carrier) readable by a computer, and including instructions of a computer program as mentioned above.

Note that the programs mentioned in this presentation may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form , or in any other desirable form.

In addition, the recording media mentioned above can be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a disk. hard.

On the other hand, the recording media may correspond to a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet type network.

Alternatively, the recording media may correspond to an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

Brief description of the drawings

Other features and advantages of the present invention will emerge from the description given below, with reference to the accompanying drawings which illustrate embodiments having no limiting character. In the figures:

FIG. 1A schematically represents a system comprising a terminal, a service access server, a 3DS directory server, an ACS server and a DCW verification server, according to a particular embodiment of the invention;

- Figure 1B schematically shows a smart card according to a particular embodiment of the invention;

FIG. 2 diagrammatically represents the structure of an access server according to a particular embodiment of the invention; - Figure 3 schematically shows modules implemented in the access server shown in Figure 1A and 2, according to a particular embodiment of the invention;

FIG. 4 schematically represents the structure of an ACS server according to a particular embodiment of the invention;

- Figure 5 schematically shows modules implemented in the ACS server shown in Figures 1A and 4, according to a particular embodiment of the invention;

FIG. 6 represents an example of a table stored in a memory of the server ACS represented in FIGS. 1A and 4, according to a particular embodiment of the invention;

FIG. 7 represents, in the form of a diagram, the steps implemented in particular by the access server, the directory server 3DS and the server ACS, according to a particular embodiment of the invention; and FIG. 8 represents, in the form of a diagram, the steps implemented in particular by the access server, the directory server 3DS and the server ACS, according to a variant of the embodiment illustrated in FIG. 7.

Detailed description of several embodiments

As already indicated, the present invention relates to the authentication mechanisms and relates more particularly to an authentication from a security code of a smart card.

In order to secure transactions remotely, one solution is to use bank cards able to generate and display on a screen of the card, a dynamic security code (called DCW) that changes over the life of the card. The computer processing system of the financial service of the transaction is able to check the validity of this dynamic security code, depending for example on a time parameter, to validate or not the transaction. The use of such a dynamic security code makes it possible to ensure that the user actually has in his possession the bank card concerned at the time of the transaction. If it is stolen, the dynamic security code has a limited usefulness since the validity of this code is only temporary.

In the present disclosure, a smart card DCW (or DCW card) will be called a smart card capable of generating dynamic security codes DCW. DCW codes are known to those skilled in the art and will therefore not be described in more detail in this presentation.

The invention proposes to improve the existing authentication mechanisms by inhibiting the 3DS authentication protocol when it is possible to authenticate an ongoing transaction from a dynamic security code DCVV (for "Dynamic Card Verification Value"). "), In the case where such a dynamic code can be is generated by the user's smart card.

It should be noted that the concept of transaction is understood here in a broad sense and includes, for example, in the banking field, any type of financial transaction, such as for example a payment transaction, a transfer transaction, or a consultation of 'a bank account.

The invention, according to different embodiments, implements, for example, an authentication server able to receive, from a service access server, an authentication request comprising transaction data associated with an authentication server. Smartcard ; determining whether a security code included in the transaction data is of the DCVV type; and if so, detecting that no 3DS authentication must be performed to authenticate said card and to cooperate with a verification server to check the validity of the security code DCW.

The invention, according to a particular embodiment, also relates to an access server adapted to receive transaction data associated with a smart card during a transaction with the access server; transmitting the transaction data to an authentication server to request authentication of the transaction according to the 3DS protocol; and to determine, from a message received from the authentication server, that no authentication according to the 3DS protocol must be performed if the smart card is of DCVV type. The access server may for example determine that the transaction data is authentic from a message received from the authentication server, indicating that a DCW code included in the transaction data has been verified successfully.

Other aspects and advantages of the present invention will emerge from the exemplary embodiments described below with reference to the drawings mentioned above.

Unless otherwise indicated, the elements common or similar to several figures bear the same reference signs and have identical or similar characteristics, so that these common elements are generally not described again for the sake of simplicity. FIG. 1A schematically represents a system SY according to one particular embodiment of the invention. The SY system comprises in this example a terminal T, an access server SW, a directory server 3DS (or "3DS Directory Server" in English) here denoted SDIR, an access control server ACS (for "Access Control Server And a verification server SV, according to a particular embodiment of the invention.

The SY system allows in this example to control the access of a user to a service S. In the example considered here, a user tries to use the service S, using a smart card C shown in Figure 1B.

According to the embodiment illustrated in FIG. 1B, and as explained in the following exemplary embodiments, the smart card C is here a bank card including credit card data, namely a bank identifier PAN (for "Primary Account Number"). "), An EXP expiry date, and a CSC card security code. It will be understood that the security code CSC can be a static code (CW code for "Card Verification Value") on the card or a dynamic code (DCW for "Dynamic Card Verification Value") that can be generated by the card.

The bank card C is for example in accordance with the EMV protocol. Other types of smart cards can be envisaged within the scope of the invention.

The user of the terminal T represented in FIG. 1A is here able to communicate, via an RI communications network such as the Internet for example, with an access server SW controlling access to the service S. During a transaction the terminal T is able to send, to the access server SW, transaction data DT associated with the smart card C, for example to carry out a financial transaction (purchase ...) with the service S. The data of DT transactions include, for example, the PAN ID, the exp expiration date, and the CSC security code.

The server SW is for example a web server, walking or other type, able to manage the access of users to the web server S in question. It will be understood that the service S can be any. In a particular example, the service S is a marching service.

The access server SW is able to cooperate with a directory server 3DS SDIR to trigger if possible authentication according to the 3DS protocol of the user during a transaction. To do this, the access server SW is able to transmit, to the directory server 3DS SDIR, the transaction data DT to request authentication of the current transaction. The access control server ACS is able, from the transaction data DT received, to determine whether a 3DS authentication of the transaction must be performed. The ACS control server determines whether this 3DS authentication must be performed from the transaction data DT transmitted by the directory server 3DS SDIR. According to a particular embodiment, the ACS server is configured to detect that no 3DS authentication must be performed if the security code CSC included in the transaction data DT is of the DCVV type.

In the example envisaged here, if no 3DS authentication is to be performed, the ACS server is further configured to cooperate with the verification server SV to check the validity of the DCVV type CSC security code. If the authentication of the security code CSC is positive, the server ACS then sends to the access server SW, via the directory server 3DS SDIR, a message of positive authentication of the transaction data DT. According to a particular example, this positive authentication message further indicates to the access server SW that no 3DS authentication is performed, for example by means of a parameter provided for this purpose in said message.

According to a particular exemplary embodiment, if the security code CSC is a CVV type static code, the ACS server is configured to detect that a 3DS authentication must be performed in association with the received transaction data DT. The ACS access control server then performs the 3DS authentication according to the 3DS protocol well known to those skilled in the art.

Figure 2 schematically shows the structure of the access server S according to a particular embodiment of the invention. In this example, the access server SW comprises a processor 10, a non-volatile memory MR1 and a communication interface INT1.

In the example envisaged here, the memory M RI is a rewritable non-volatile memory or a read only memory (ROM), this memory constituting a recording medium (or information carrier) according to a particular embodiment, readable by the access server SW, and on which is recorded a computer program PG1 according to a particular embodiment. This computer program PG1 includes instructions for carrying out the steps of a control method according to a particular embodiment.

The processor 10 controlled by the computer program PG1 here implements a number of modules shown in FIG. 3, namely: a reception module M2, a transmission module M4 and a determination module M6. According to a particular embodiment, the reception module M2 is able to receive the transaction data DT associated with the smart card C during a transaction with the access server SW. The transmission module M4 is able to transmit the transaction data DT to the directory server 3DS SDIR to request authentication of the transaction according to the 3DS protocol. The determination module M6 is able to determine, from a message received from the authentication server, that no authentication according to the 3DS protocol must be performed if the smart card is of the DCVV type.

FIG. 4 diagrammatically represents the structure of the ACS access control server according to a particular embodiment of the invention. In this example, the server ACS comprises a processor 20, a nonvolatile memory MR2, a communication interface INT2 and a nonvolatile memory MR4 comprising a table TB.

In the example envisaged here, the memory MR2 is a rewritable non-volatile memory or a read only memory (ROM), this memory constituting a recording medium (or information carrier) according to a particular embodiment, readable by the ACS server, and on which is recorded a PG2 computer program according to a particular embodiment. This computer program PG2 includes instructions for performing the steps of an authentication method according to a particular embodiment.

In a particular example, the table TB comprises at least one correspondence between a PAN identifier and a DN data, said DN data indicating whether the bank card C associated with said PAN is DCW type. The server ACS is able, from said data DN, to determine if the bank card C is of the DCVV type. The server ACS can thus determine, from the table TB, whether the security code CSC included in the transaction data DT is of type DCVV. It is assumed here that the table TB identifies, for example, DN data in association with three identifiers PAN1, PAN2 and PAN3.

In a particular example, each data DN can take two distinct states indicating that the corresponding PAN identifier is respectively associated with a bank card type DCW and CW.

The processor 20 controlled by the computer program PG2, here implements a number of modules shown in FIG. 5, namely: a reception module M20, a determination module M22, a detection module M24 and a module of verification M 26. According to a particular embodiment, the reception module M20 is able to receive, from the access server SW, an authentication request comprising transaction data DT associated with the smart card C. The determination module M22 is configured to determine whether the security code CSC included in the transaction data DT is of type DCVV. If the security code CSC is determined to be of type DCW:

the detection module M24 is configured to detect that no 3DS authentication must be performed; and

o The M26 verification module is configured to cooperate with the SV verification server to check the validity of the DCW security code.

It will be understood that the definition of the modules M2 to M6 illustrated in FIG. 3 and the modules M20 to M26 illustrated in FIG. 5 is only a non-limiting example of embodiment of the invention, other implementations being conceivable in the context of FIG. of the invention.

A particular embodiment of the invention is now described with reference to FIG. 7. More specifically, the access server SW implements a control method by executing the computer program PG1, and the server ACS. hereby implements an authentication method by executing the computer program PG2.

It is now assumed that a user attempts to perform a transaction with the access server SW (or more precisely with the service S) using his bank card C. In a particular example, the transaction is a financial transaction, corresponding by example to a payment. It will be understood that other implementations are conceivable within the scope of the invention.

During a sending step A2, the terminal T of the user sends the access server SW transaction data DT associated with the bank card C. In this example, the transaction data DT comprises the identifier PAN, the CSC access code and EXP expiration date of the card C. To do this, the user firstly enter all or part of the transaction data DT on his terminal T in response to an invitation from the services.

The access server SW receives the transaction data DT during a reception step B2. The access server SW then sends (B4) the transaction data DT to the directory server 3DS SDIR in an authentication request RQ1. In a particular example, the authentication request RQ1 requires authentication according to the 3DS protocol. Following the reception (C4) of the transaction data DT, the directory server 3DS SDIR determines (C6), from all or part of the transaction data DT (for example from the identifier PAN), if it is authorized to perform a 3DS authentication for the current transaction. In a particular example, the SDIR server performs the C6 determination from a list of PAN identifiers excluded from the 3DS mechanism or from a list of PAN identifiers authorized to use the 3DS mechanism.

If it is determined in C6 that a 3DS authentication is not allowed, the process terminates (C8). The SDIR server may optionally send a 3DS authentication refusal message to the access server SW.

If, on the other hand, the 3DS directory server SDIR determines (C10) that it is authorized to perform a 3DS authentication in association with the received transaction data DT, said SDIR server sends (C10) to the ACS server an authentication request RQ2 comprising the transaction data DT.

The access control server ACS receives the transaction data DT included in the authentication request RQ2 during a reception step D10.

The ACS server then determines (DU), from the transaction data DT, whether the security code CSC is of DCW type. In a particular example, the ACS server determines (DU) whether the security code CSC is a DCW code from the identifier PAN included in the transaction data DT. According to one particular example, the server ACS uses the table TB to determine, from the identifier PAN, if the security code is of type DCW.

If it is determined in DU that the CSC code of the card C is not a DCW dynamic code, the authentication method of the invention ends (D12). During step D12, the ACS server can perform a 3DS authentication of the transaction (if this is possible), or send a refusal message of a 3DS transaction (if authentication according to the 3DS protocol is not possible ).

According to a particular embodiment, if the security code CSC is a static code of type CW and if the server ACS determines, from the transaction data, that it is authorized to carry out a 3DS authentication, the ACS server authorizes (D12) performing a 3DS authentication of said bank card. During such a 3DS authentication, the user can receive via an SMS or email a secret code on a terminal (T or other), and be invited on his terminal T to enter this secret code to be authenticated by the ACS server. The 3DS protocol is well known to those skilled in the art, it will not be described in more detail in this presentation for the sake of simplicity. If, on the other hand, it is determined in DU that the security code CSC is of type DCW, the server ACS:

detects (D13) that no 3DS authentication should be performed, and

- cooperates (D14-D20) with the verification server SV to check the validity of the security code CSC.

According to a particular embodiment, if the security code is of the DCW (DU) type, the ACS server prevents the realization of a 3DS authentication of the bank card C. In other words, when the bank card C is of DCW type, the ACS server is configured to block performing a 3DS authentication for the transaction being authenticated.

According to one particular example, during said cooperation D14-D20, the server ACS sends (D14) to the verification server SV, the transaction data DT comprising the security code CSC of the DCW type, the banking identifier PAN and the date EXP expiration. Once this data has been received (E14), the verification server verifies (E16) the validity of the dynamic security code CSC. The verification server checks, for example, the validity of the dynamic security code CSC by generating a second DCW code and comparing it with the dynamic security code CSC received at E14. In a particular example, the verification server SV obtains this second DCW code by applying a cryptographic function to the identifier PAN, EXP expiration date and a time data. Other examples of verification of a DCW type dynamic security code are conceivable. Since the calculation and verification of the validity of a DCW security code are known per se, they will not be described in more detail in this disclosure.

The verification server SV then sends (E18) the result of the verification E16 (here in a message M2) to the server ACS.

The server ACS receives the result M2 of the validity check of the security code CSC during a reception step D20. The server ACS then sends (D22) to the directory server 3DS SDIR, a message M4 positive authentication of the transaction data DT if the verification E16 of validity of the security code CSC has been passed successfully. In the opposite case, the server ACS sends (D22) a message M4 of negative authentication to the directory server 3DS SDIR. In a particular example, the message M4 specifies whether the security code DCW present in the transaction data DT has been verified or not successfully. Once received (C22), the directory server 3DS SDIR transfers (C24) to the access server SW the message M4 indicating whether the authentication based on the dynamic security code CSC has been passed successfully.

The access server SW determines (B26) whether the authentication of the transaction is successfully passed from the message M4 received prior to the reception step B24. It will be understood that the access server SW may be configured to perform any appropriate processing depending on the result of the authentication.

According to a particular embodiment, if it is determined (B26) that the authentication has passed successfully, the access server SW authorizes (B26) the current transaction with the user. In the opposite case, the access server SW refuses (B26) the transaction.

The present invention is advantageous in that it makes it possible to dispense with the authentication mechanism according to the 3DS protocol when it is possible to authenticate the user of the transaction by verifying a dynamic security code DCW generated by the card. user's smart card (when said card is of DCW type). As explained above, the authentication according to the 3DS protocol has certain disadvantages, in particular in that it can cause discomfort for some users sometimes leading to the abandonment of the current transaction. The invention makes it possible to inhibit the 3DS mechanism while maintaining a high level of security by verifying, where possible, a DCW code. Thanks to the invention, it is possible to facilitate the authentication of a user, and therefore access to a service.

It will be understood that the embodiment described above with reference to FIG. 7 is only a nonlimiting exemplary embodiment of the invention, various alternative embodiments being conceivable within the scope of the invention.

According to a particular embodiment, once the verification step E16 has been performed, the verification server SV (or one of the server ACS, the directory server 3DS SDIR and the access server SW) sends (E18) in addition to an M6 message to the terminal T (or another terminal) of the user. From the received message M6 (A30), the user is then able to determine the result of the authentication of the security code CSC (DCW type) by the verification server SV.

According to a particular embodiment, the ACS server includes in its positive authentication message M4 a parameter indicating to the access server SW that no authentication according to the 3DS protocol has been performed. From this parameter, the access server SW can thus deduce that the authentication mechanism 3DS has been blocked, but the authentication has nevertheless been successfully carried out thanks to a verification of a DCW security code.

Another embodiment is now described with reference to FIG. 8. In this embodiment, the steps A2, B2, B4 and C4 are carried out as already described above with reference to the embodiment illustrated in FIG. 7. The embodiment illustrated in FIG. 8 differs from the previous embodiment in that it is this time the 3DS directory server SDIR which determines (C50), from the transaction data DT, whether the bank card C is of DCW type. and, if so, which detects (C51) that no authentication according to the 3DS protocol is to be performed and which then cooperates (C52) with the ACS server, or directly with the verification server SV, to check the validity of the CSC dynamic security code. The determination step C50 and the detection step C51 are carried out analogously to the respective steps D1 and D13 described above with reference to FIG. 7.

As illustrated in FIG. 8, following the detection step C51, the 3DS directory server SDIR sends (C52) to the verification server SV a verification request RQ10 comprising the transaction data DT. Alternatively, the 3DS directory server SDIR sends (C52) the verification request RQ10 to the server ACS which transmits (D52) it to the verification server SV.

The verification server SV checks (E16) the validity of the dynamic security code CSC as already described with reference to FIG. 7.

During a sending step E54, the verification server SV then sends a message M8 of positive or negative authentication (according to the result of E16) of the transaction data DT to the directory server 3DS SDIR, possibly via of the ACS server which transfers (D54) then said message.

It will be understood from the foregoing that, according to the implementation of the invention, it is the 3DS directory server SDIR or the ACS server which determines, from the transaction data DT, whether the bank card C is DCW type and, if so, which detects that no authentication according to the 3DS protocol should be performed and which causes the verification of the validity of the CSC dynamic security code of the C card. Also, the 3DS directory server SDIR and the server ACS can each constitute an authentication server within the meaning of the invention.

According to a variant of the preceding embodiments, the authentication server of the invention is configured, only if a parameter received from the access server SW with the transaction data DT is in a predefined state, to detect that no 3DS authentication shall only be performed when a security code included in the transaction data is of the DCVV type. In other words, from a parameter sent by the access server SW, the authentication server of the invention (ie the 3DS directory server SDIR or the ACS server as the case may be) is able to determine whether it should implement the inhibition mechanism of the 3DS authentication mechanism according to the invention. In a particular example, if this parameter is in a first predetermined state, the authentication server systematically attempts to trigger a 3DS authentication, and if said parameter is in a second predetermined state, the authentication server inhibits the 3DS mechanism if a authentication based on a DCW security code is possible.

According to a particular embodiment, the authentication server of the invention (ie the 3DS directory server SDIR or the ACS server as the case may be) determines, based on historical data (banking for example) recorded in association with the PAN identifier, if it must implement the inhibition mechanism of the 3DS authentication in accordance with the invention. The authentication server can thus judge, for the current transaction, a level of risk and deduce whether it is necessary to perform a 3DS authentication (possibly in addition to a verification of a security code DCW, according to the chosen configuration).

Those skilled in the art will understand that the embodiments and variants described above are only non-limiting examples of implementation of the invention. In particular, those skilled in the art may consider any adaptation or combination of the embodiments and variants described above to meet a particular need.

Claims

An authentication method implemented by an authentication server (ACS; SDIR), comprising:

- receiving (D10; C4), from an access server (SW) to a service (S), an authentication request (RQ2; RQ1) comprising transaction data (DT) associated with a smart card (C);

determination (DU; C50) of whether a security code (CSC) included in the transaction data is of the DCW type; and

- If yes, blocking (D13; C51) of performing a 3DS authentication of said smart card and cooperation (D14; C52) with a verification server (SV) to check the validity of the security code DCW.

2. Method according to claim 1, comprising sending (D22; C56), to the access server (SW), a message (M4; M8) for positive authentication of the transaction data if the validity of the code DCW. is successfully verified during such cooperation.

The method of claim 1 or 2, wherein:

the authentication server (ACS; SDIR) determines whether the smart card is of the DCW type from a PAN identifier included in the received transaction data (DT); and

- only in the affirmative, the authentication server determines (DU;

C50) that the security code is DCW type.

A method according to any one of claims 1 to 3, wherein if the security code is of type CW and the authentication server determines, from the transaction data, that it is authorized to proceed with a 3DS authentication, the authentication server authorizes (D12) the realization of a 3DS authentication of said smart card.

The method of any one of claims 1 to 4, wherein the smart card is a bank card, and the transaction data (DT) includes a PAN ID and an expiration date (EXP) of said bank card. (VS). A method according to claim 5, wherein said cooperating comprises: sending (D14) to the verification server (SV) transaction data (DT) comprising the security code of the DCVV type, the bank identifier PAN and the date d expiration (EXP); and

receiving (D20), in response to said sending, the result (M2) of the validity check of the DCVV code.

7. Method according to any one of claims 1 to 6, wherein the smart card (C) is a credit card and the authentication server is an access control server (ACS),

wherein, if the security code (CSC) is determined to be of DCW type, the access control server (ACS) performs the following steps:

- verification (D12), from the transaction data (DT), if a 3DS authentication can be performed for the bank card; and

- If yes, realization (D12) of an authentication according to the 3DS protocol of said bank card.

8. Method according to any one of claims 1 to 6, wherein the smart card is a bank card and the authentication server is a directory server 3DS (SDIR),

wherein, if the security code (CSC) is determined to be of DCW type, the 3DS directory server (SDIR) performs the following steps:

- checking (C50), from the transaction data, if a 3DS authentication can be performed for the bank card; and

if so, transmitting the transaction data to an access control server to cause the authentication of said bank card to be performed according to the 3DS protocol.

The method according to any one of claims 1 to 8, wherein the authentication server configures itself, only if a parameter received from the access server (SW) with the transaction data (DT) is in a state. predefined, to detect that no 3DS authentication should be performed if a security code (CSC) included in the transaction data is DCW type.

10. Control method implemented by an access server (SW) to a service, comprising: receiving (B2) transaction data (DT) associated with a smart card (C) during a transaction with the access server;

- transmission (B4) of the transaction data to an authentication server (ACS; SDIR) to request authentication of the transaction according to the 3DS protocol; and

determination (B26; B58), based on a received message (M4; M8) from the authentication server, that no authentication according to the 3DS protocol is to be performed if the smart card is of the DCW type.

The method of claim 10, wherein the access server determines

(B26; B58) that authentication is successfully performed upon reception (B26; B58) from the control server of a positive verification message of a security code DCW included in the transaction data.

The method of claim 10 or 11, wherein the access server sends, to the authentication server, a parameter with the transaction data, said parameter being in a predefined state to indicate that no 3DS authentication should be performed if a security code included in the transaction data is DCW type.

Computer program (PG1; PG2) comprising instructions for performing the steps of a configuration method according to any one of claims 1 to 12 when said program is executed by a computer.

14. Recording medium (MR1; MR2) readable by a computer on which is stored a computer program (PG1; PG2) comprising instructions for carrying out the steps of a method according to any one of claims 1 at 12.

15. Authentication server (SA; SS), comprising:

a reception module (M20) capable of receiving, from a service access server, an authentication request comprising transaction data associated with a smart card;

a determination module (M22) for determining whether a security code included in the transaction data is of the DCW type; and

a detection module (M24) and a verification module (M26), in which, if the security code is determined to be of DCW type: o the detection module is configured to block the achievement of a 3DS authentication of said smart card; and

o The verification module is configured to cooperate with a verification server to verify the validity of the DCW security code.

16. Access server (SW) to a service, comprising:

a receiving module (M2) for receiving transaction data associated with a smart card during a transaction with the access server;

a transmission module (M4) for transmitting the transaction data to an authentication server to request authentication of the transaction according to the 3DS protocol; and

a determination module (M6) for determining, from a message received from the authentication server, that no authentication according to the 3DS protocol is to be performed if the smart card is of the DCW type.