EP0617819B1 - Device for intervention on a terminal delivering goods or services - Google Patents

Description

The subject of the invention is an intervention device on a delivery terminal for a good or service. In a preferred example, the terminal is a parking meter or a parking meter. It can however be any distributor automatic goods or services such as a distributor of drinks or even a counter connected to a managing server a database. The terminals concerned by the invention comprises at least one device for payment by smart card, and in some cases a mixed chip card payment and direct payment in cash, coins or banknotes, or by magnetic card. Payment by smart card is either a count of prepaid and registered units in a card memory, in this case the card is a smart card with at least one memory. Be the payment is a payment by direct debit from an account in the bank. In the latter case the card is a banking, magnetic or chip type.

The problems encountered with this type of device mixed payment concerns the monitoring of agents who regularly work on the terminals, for example to withdraw the cash injected by them users. Indeed, payments are made by users more or less in cash. Terminal therefore normally issues three types of balances in three counters. A first type of balance in a first counter measures the quantity of services issued, a second type of balance in a second counter represents card payments (currency called electronic), and the third type of balance in a third counter, when present, indicates the amount of cash for the agent to collect, heard deliver to the authorities which manage the terminal. The total of the last two counters must be equal to total of the first counter. Agents are suspected rascals are going to be trafficked the second counter, so as to increase its value, in order to keep the corresponding cash for themselves the difference created. We know, by documents EP-A-0 391 302 and US-A-4 471 905, withdrawal of cash stored in a thick headed. However, these devices do not provide information on the state of the terminal, especially when there is no money to collect. They also require a specific arrangement of the terminal for their implementation service.

It is also feared that others stakeholders do take advantage of the complexity of such system to steal from authorities that manage a large terminal park. In fact, in a big city, you can admit that there are several thousand terminals of such a type, even to deliver only one good: for example parking tickets. These terminals are prone to break down or to receive a preventive maintenance. A company foreign to these managing authorities can therefore be responsible for these operations. This company can report intervention in which costly operations have been declared, e.g. change of printer that prints parking tickets, when it was not.

It is known from document EP-A-0 413 636 a system and a method for controlling the collection of terminals at prepayment. This system includes means electronic dialogue with the terminal to collect information contained therein. These means electronics are expensive in their design, especially because they have a screen, or even a keyboard. In practice systems of this type are connected to a specific terminal input. This document provides in particular for this purpose an entry by infrared. The presence, in itself, of such an entrance specific is a weakness of the system vis-à-vis fraudsters because it gives another additional way to access the system, whatever either the precautions with which we protect this other access.

Document EP-A-0 387 972 discloses an intervention device on a delivery terminal for a good or service according to the preamble of claim 1. It is also known from this document a means for transferring into the secure portable medium information relating to the state of the terminal before an intervention.

The object of the present invention is to provide ways to resolve these fraud issues. According to the invention, this object is achieved in accordance with the characterizing part of claim 1.

In the invention, the stakeholders are asked to introduce a secure intervention support of the type and smart card format in the card reader terminal chip. This terminal therefore includes necessarily a smart card reader. The support secure therefore has one end at the smart card format when it is not itself a Smartcard. This end is the one introduced in the smart card reader. The secure support is then recognized as an intervention smart card by the terminal. This recognition can be provoked by the intervener who can act by elsewhere on terminal control buttons. This recognition can also preferably be automatic, from the introduction of secure support, to the initiative of the terminal or of a contained microprocessor in the secure intervention support. These checks of a known type naturally lead when necessary unlocking a lock logic or physical lock, such as an access door in the terminal, so that the operator can do what that he has to do there. In the invention, after the recognition, and before unlocking, when that is necessary, we inject into the secure support of the speaker of intonations relating to the state of terminal, in particular the balance values when it comes of usual readings, or in particular the values of state registers representing the states of operation of the various organs of this terminal when it comes to maintenance intervention. The opening in particular the terminal may not be necessary if the content of cash stored there is insufficient to justify emptying the trunk containing cash. In this case we do not transfer in the smart card as the meter states.

At the time of recognition, a protocol for recognition can even in a known way determine what type of intervention will be undertaken, do not transfer that information that is sensitive with respect to this intervention, and of course only open the door to the terminal corresponding to this intervention.

This system then has the advantage that the practitioner has nothing to do: everything is done by the card microprocessor in program execution prerecorded contained in the card. Not only what system is thus simple, but in addition, appearing like a black box to the speaker, this one has no influence on this program and cannot falsify it. This would not be the case if this program was loaded in the memory of a microcomputer as is mentioned in document EP-A-0 413 636. Indeed in in this case the service provider may be tempted to modify this program. The smart card therefore brings the advantage to be readable by the device's payment method and to be very secure in itself.

• figure 1: une représentation d'un dispositif utile pour intervenir sur une borne de délivrance d'un bien ou d'un service;
• figure 2: un organigramme des opérations pour intervenir sur une borne de délivrance d'un bien ou d'un service.

Other characteristics and advantages of the invention will become apparent on reading the description which follows and on examining the figures which accompany it. These are given for information only and in no way limit the invention. The figures show:

• Figure 1: a representation of a useful device to intervene on a terminal for the delivery of a good or service;
• Figure 2: a flowchart of operations to intervene on a terminal for the delivery of a good or service.

Figure 1 shows a useful device to intervene on a delivery terminal for a good or service. It has a terminal 1 provided a smart card reader 2, and in some cases a slot 3 or similar device for introduce cash into the terminal. Terminal also has a number of buttons orders such as 4 to choose a good or service among several or to cancel the operation. Terminal is therefore in contact with a distributor of these goods or services. Here in a payment application from parking space, the terminal issues a 5 ticket parking corresponding to a duration chosen by a user. This places this ticket prominently behind the windshield of his vehicle, so that supervisors can verify that the vehicle is authorized to park.

During interventions on the terminal, speakers introduce into a smart card reader the terminal, for example reader 2, secure support intervention 6 with one end of card format smart. This secure support 6 includes a microprocessor 7 in connection with a memory programmed 8, with a data memory 11, and with contact pads such as 12 needed to enter in relation to reader 2. In some cases the studs are absent: the connection is made by electromagnetic waves. Programmed memory 8 has two programs. According to the organization chart of the FIG. 2, a first program 9 is a program for recognition, for example a response program to classic type recognition. In such recognition the terminal interrogates the support. The support responds by transmitting their identification and / or code secret, stored in part 16 of its memory 11. The microprocessor 7 can encrypt the secret code if necessary media before sending it to drive 2. In this case reader 2 must be provided with means deciphering. Such a program is for example described in a European patent application EP-A-0 284 133.

As terminal 1 has a keyboard 4, you can for this recognition use this keyboard 4 to ask the operator to authenticate his intervention. He therefore indicates his personal code with this keyboard. This personal code, which can be the same as that of the card or another, is compared, by terminal 1 or microprocessor 7 on the card, one carrier code contained in the card or even a code contained in the terminal. This prevents a card intervention chip that would be lost can be used to a thief to loot the monetary content of terminals: the cash received there. this allows also to detect the presence of false terminals, the terminal to check the card, then the card performs a terminal check.

A second program 10 contained in memory 8 is also a program of the invention: it has for goal, after the authentication operations, to cause the information contained in terminal 1 counters or status registers to memory 11 of the secure medium. Preferably, as of its introduction in reader 2 the microprocessor 7 waits for response. As soon as the recognition protocol is completed, the microprocessor 7 of support 6 takes control of the thick headed. This grip is simply carried out by the fact that after recognition reader 2 is puts an order on hold. Program 9 on the card can for example then include for this purpose, ultimately, a time delay instruction calibrated after from which program 10 of the card is triggered. Under the effect of the instructions in this program 10, the microprocessor 7 then reads the content of the counters and or the content of terminal status registers. Then he stores this information read in memory 11 of the support. When these recordings are made on microprocessor 7 sends an order to reader 2 so that this reader 2 causes the unlocking of a lock logic or a physical lock that prevents opening of a door 13 of the terminal and therefore the course of the desired intervention.

Program 10 can also contain counter or register reset instructions player 2 status. Alternatively program 10 includes instructions for changing a rate of consumption with the terminal. These instructions are executed, if necessary, before opening the door. But it is not essential. Program 10 includes preferably instructions for recording terminal information in a form encrypted in memory 11. Therefore this information are not even directly understandable by a operator who would just read the memory 11. The encryption is of the same type as that which is used to encrypt the secret code in the program 9 before sending it.

When the intervention is finished, when the door of the terminal is closed, the rest of program 10 can include instructions to register at again in memory 11, in places other than previously, the values of the state registers resulting from the intervention. Thereafter the card is ejected from drive 2.

To simplify the interventions we can preferably have the microprocessor 7 execute all necessary operations. In case of change then it’s easier to change the supports 6 as terminals 1.

To read the memory 11, by means of a reader 14 to the disposition of the authorities which manage terminals 1 and the supports 6, we solicit in the support 6 the execution of a third program 15. In this program 15 the microprocessor 7 of the support 6 checks that the reader 14 which interrogates it is a reader authorized. If this is the case program 15 includes instructions for writing into a memory of the reader 14, if necessary after decryption, information stored in its memory 11. In this way the authorities that manage the terminals have reports accurate on the operations carried out by the participants.

Claims (9)

1. Device for use by an attendant of a terminal (1) which delivers goods or services comprising

   In the terminal a chip card reader with which goods or services are paid at the terminal,

   A portable security device for attending to the terminal comprising a memory (11), a micro-processor (7), a micro-program (8) and means (12) to exchange data with the terminal,

   The said portable security device having one end in the form of a chip card (6) which can be inserted into the said card reader of the terminal, this card reader of the terminal then comprising means to exchange data between the portable security device and the terminal, device characterized in that it has in addition:

   A lock preventing unauthorized interference

   Means to compare a secret code relating to the terminal with a secret code (16) relating to the portable security device in order to authorize attendance of the terminal;

   Means to unlock the lock after data has been transferred to the portable security device,

   Means to transfer - after valid comparison but before the lock is unlocked - to a data storage memory (11) of the portable security device data relating to the status of this terminal before attendance.
2. Device according to Claim 1, characterized in that the portable security device is a chip card.
3. Device according to Claim 1 or Claim 2 characterized in that it comprises, to read the data storage memory after attendance of the terminal,

   A further chip card reader (14) to insert the portable security device there,

   A keypad of this further chip card reader to key in an access code to be read by this portable security device,

   Means to compare this access code with a read access code contained in the portable security device, and

   Means to authorize reading and possibly writing or deletion of the data storage memory (11) depending on the result of this comparison.
4. Device according to any one of Claims 1 to 3, characterized in that the micro-programmed (8) micro-processor (7) of the portable security device comprises means to compare the codes.
5. Device according to any one of Claims 1 to 4, characterized in that it comprises means, when writing to the data storage memory, to code or decode the stored data.
6. Device according to any one of Claims 1 to 5, characterized in that it comprises a keypad (4) in the terminal to allow the attendant to key in a code to allow this attendant to be recognized by the terminal and/or the portable security device, when the attendance is authorized.
7. Device according to any one of Claims 1 to 6, characterized in that it comprises means to re-configure the terminal while it is being attended to.
8. Device according to Claims 1 to 7, characterized in that the lock is a physical lock which prevents a door (13) of the terminal being opened.
9. Device according to Claims to 1 to 7, characterized in that the lock is based on logic.

Images