EP0909432B1 - Portable device for performing secure internal and smart card transactions, and method therefor - Google Patents

Description

The field of the invention is that of contactless electronic transactions, particularly in the field of electronic payment. More precisely, the invention relates to an improvement of the devices making it possible to carry out such transactions:

Electronic payment is a well-known technique. Its most common is micro-circuit cards, which are now widespread. We can distinguish two major types of cards: credit cards, which correspond basically a carrier authentication, allowing a debit on an account prepaid cards, which carry an amount debited as and when operations. These last cards are advantageously rechargeable.

A major disadvantage of the cards currently used is that they must be introduced in the terminals provided for this purpose, in order to read the information they contain. This operation is restrictive, and sometimes not easy, for the user, and causes a deterioration of the contact elements of the card, because of the friction successive.

In order to overcome this drawback, devices similar to the cards have been devised. conventional micro-circuits, but able to communicate remotely (without contact) with terminals.

However, these contactless devices are not yet available on the market, while many types of cards have been used for a long time. The diffusion of such devices proves difficult, because they must cohabit with the cards already distributed. This poses problems on the one hand for the user, who must know the two procedures of use, and secondly for the terminals, which must be equipped card readers and contactless communication means.

US-A-4277837 discloses a portable device for conducting transactions secure with transaction terminals (POS, bank terminal): it has resources of communication with micro-circuit cards and means of communication without contact.

EP-A-0565469 discloses a contactless data exchange system between a terminal and a modular portable set. The portable set consists of two separate mating elements: a transmitting / receiving device and a portable object. The sending / receiving device is devoid of microprocessor and the portable object hosts the management means including the transmission / reception protocol of said set portable.

None of the two previous documents, however, discuss how a device can enable transactions based on simple but compatible contactless terminals with existing cards.

The object of the invention is in particular to overcome these drawbacks of the state of the technical.

More specifically, an object of the invention is to provide a device for contactless transactions that can be introduced without imposing the deletion systematic maps already implemented for the same application.

Another object of the invention is to provide a technique for achieving simple terminals, providing only one type of means of dialogue with the transaction objects.

An object of the invention is also to provide such a device, which is simple and user friendly, and that offers many facilities, such as the consultation or configuration.

Yet another object of the invention is to allow greater ease the use of micro-circuits of known types, both for payment only for reloading operations.

The invention also aims to provide a transaction device without contact whose update (configuration, maintenance, ...) is easy and does not require important specific means, particularly within the scheme, both for reasons of congestion than of cost of return.

These objectives, as well as others which will appear subsequently, are achieved according to the invention by means of a portable device intended to carry out secure transactions with transaction terminals, comprising first means enabling the realization of a secure transaction, from transaction resources stored in a memory, and contactless communication means with said transaction terminals,
characterized in that it comprises means for dialogue with a micro-circuit card, which comprises second means for performing a secure transaction, and selection means between said first secure transaction means and said second secure transaction means, so that a transaction can be performed either by said portable device or by a valid micro-circuit card presented to the dialogue means, and secondly that said communication means without contact are arranged for, in both cases of transaction, ensure the exchange of data with said transaction terminals.

"Transaction" means in this application any transaction requiring an exchange of information between the device or the card and a terminal. In the context of payment systems, these may include payments (similar to checks), reloads (withdrawals of checks and / or coins) or deposits ( checks and / or money).

The invention thus relates to a completely new product, which makes it possible to use in the same way contactless transaction devices and micro-circuit cards already developed. Thus, the use of the cards is greatly improved, since they acquire the quality of contactless devices, and the diffusion of devices is facilitated, since they allow the use of pre-existing maps and the realization of terminals comprising only contactless communication means.

This technique is not obvious to the person skilled in the art because it combines two types of object that it usually considers as independent and competing. According to the invention, the non-contact device is not the replacement of the micro-circuit card, but an element cooperating with it in order to provide it with the quality of contactless communication.

The use of the same means of communication allows of course a gain appreciable.

It should be noted that according to the invention, the device and the card retain their independence in the implementation of the transaction. All operations Securing is done by the element in charge of the transaction. In other words, the card is not a simple memory supplying the device, but an element able to perform all transaction operations.

• un mode direct, dans lequel la transaction est gérée par ledit dispositif portatif ; et
• un mode transparent, dans lequel la transaction est gérée par une carte à micro-circuits couplée opérationnellement audit dispositif,

une communication sans contact avec lesdits terminaux de transaction étant mise en oeuvre de façon identique dans les deux modes.Thus, the implementation of the device according to the invention provides two modes of operation:

• a direct mode, in which the transaction is managed by said portable device; and
• a transparent mode, in which the transaction is managed by a microcircuit card operatively coupled to said device,

contactless communication with said transaction terminals being implemented identically in both modes.

According to a preferred embodiment of the invention, said first means of secure transaction and / or said second secure transaction means the issue of electronic checks bearing an amount transmitted by a terminal of transaction, and authenticated by an encrypted signature using a key algorithm public, said checks being stored in a blank form in a memory rewritable.

Other techniques are of course conceivable. In particular, the micro-circuit card can be a bank credit card, which allows to group the benefits pre-payment systems (in the device) and credit systems (in the card).

Advantageously, the device of the invention comprises means of reloading the transaction resources of said device, by a communication without contact with a charging terminal.

In this case in particular, the device may comprise means for transferring transaction resources of said device to one of said microcircuit cards and / or one of said micro-circuit cards to said device. This allows in particular reload a card by contactless communication, via the memory of the device.

According to a preferred embodiment of the invention, said means of dialogue can receive a configuration and / or maintenance control comprising means for distinguishing it from one of said micro-circuit boards, and authorizing the configuration and / or maintenance of said device from a terminal of control, through said contactless communication means.

Thus, the technical realization of the device is simplified. Indeed, all Data exchanges use the same means of communication. Security is provided by the presence of a keying element: it is not possible that false maneuver (or a fraudulent maneuver) affects the configuration of the device. This key being received by the means of dialogue with the card, it reduces again the complexity of manufacture, and therefore the cost and the size of the device.

According to another embodiment, said dialogue means can receive a configuration and / or maintenance element comprising means for the distinguish one of said micro-circuit cards, and ensuring the configuration and / or the maintenance of said device.

In other words, the element introduced into the dialogue means is no longer a simple keyer, but a smart element, able to support the configuration or maintenance of the device.

Advantageously, said control element or said configuration element and / or maintenance delivers a voltage higher than the electrical voltage of operation of said device, and for erasing and reprogramming the content reprogrammable memory.

Preferably, said contactless communication means are means of communication by infrared. Advantageously, said communication contactless is a communication of the master-slave type, the transaction terminal playing the role of the master and said device playing the role of the slave.

According to an advantageous embodiment of the invention, said means of dialogue with a micro-circuit board operate at a transmission frequency predetermined rating, and include means for detecting transmission, leading to the transition to a fallback transmission frequency corresponding to half of said nominal transmission frequency.

The fallback frequency may be, in particular, the standardized frequency of 3.5 MHz, the nominal frequency then being 7 MHz.

In a particular embodiment of the invention, the device comprises a multiplexer associating with a single port access to a control microprocessor is said means of dialogue with a micro-circuit board, means of internal security of a transaction.

According to one mode of implementation, it is expected that said multiplexer connects systematically said means for dialogue with a micro-circuit card when the presence of a valid card is detected.

The invention also relates to a method for implementing the device portable described above.

• assurer l'émission de chèques électroniques portant un montant transmis par un terminal de transaction ;
• sécuriser un chèque par la transmission d'une signature cryptographique ;
• gérer au moins deux soldes correspondant à des devises différentes, de façon à permettre le paiement dans plusieurs devises et/ou à transcrire des montants transmis-dans plusieurs devises ;
• assurer le dépôt et/ou le retrait d'un montant sur un compte ;
• valider l'utilisateur du dispositif et/ou de la carte à l'aide d'un code confidentiel ;
• recharger en chèques vierges et/ou en un montant financier ledit dispositif ;
• transférer des chèques (vierges ou crédités) et/ou un montant financier dudit dispositif vers une desdites cartes à micro-circuits et/ou d'une desdites cartes à micro-circuits vers ledit dispositif ;
• consulter un solde (montants et chèques) du dispositif et/ou de la carte, une liste des dernières transactions et/ou des taux de change ;
• configurer et personnaliser le fonctionnement du dispositif.

This method may especially implement at least one of the following operations:

• ensure the issuance of electronic checks bearing an amount transmitted by a transaction terminal;
• secure a check by transmitting a cryptographic signature;
• manage at least two balances corresponding to different currencies, so as to allow payment in several currencies and / or to transcribe transferred amounts in several currencies;
• ensure the deposit and / or withdrawal of an amount on an account;
• validate the user of the device and / or the card using a confidential code;
• recharge in blank checks and / or in a financial amount said device;
• transfer checks (blank or credited) and / or a financial amount of said device to one of said micro-circuit cards and / or one of said micro-circuit cards to said device;
• consult a balance (amounts and checks) of the device and / or the card, a list of the latest transactions and / or exchange rates;
• configure and customize the operation of the device.

• la figure 1 est un schéma synoptique simplifié illustrant le principe général de l'invention ;
• la figure 2 illustre de façon plus détaillée un mode de réalisation particulier du dispositif de la figure 1 ;
• la figure 3 est un organigramme présentant un mode de mise en oeuvre du système de la figure 1.

Other features and advantages of the invention will appear on reading the following description of a preferred embodiment of the invention, given by way of a simple illustrative and nonlimiting example, and the appended drawings, among which:

• Figure 1 is a simplified block diagram illustrating the general principle of the invention;
• Figure 2 illustrates in more detail a particular embodiment of the device of Figure 1;
• FIG. 3 is a flow diagram showing an embodiment of the system of FIG. 1.

The embodiment described below is in particular intended to be implemented in the framework of the European project Esprit number 7023 called "CAFE". He has in particular to provide a contactless transaction system based on encrypted electronic checks.

FIG. 1 schematically illustrates the structure of the device according to the invention, as well as the elements to which it can be connected, or with which it can communicate.

The device 11 thus comprises a microprocessor 111, capable of doing so function, from the information (program, configuration ...) contained in a reprogrammable memory 112. It still includes means 113 to ensure Securing the issuance of a check (coding of cryptographic signatures based on on public key algorithms, PIN verification, security module in the form of "plug-in" ...) taking into account information (number of checks and amount) contained in a transaction resource memory 114, and means 115 contactless communication, for example by infrared, with a terminal of These means 115 may, for example, implement the IRDA standard. ("InfraRed Data Association"), at 38400 bauds.

Moreover, the device 11 has means 116 for dialogue with one or several micro-circuit cards 13, for example according to the ISO 7816-3 standard.

According to a particular embodiment of the invention, the means of dialogue 11 6 operate at a predetermined nominal transmission frequency (for example 7 MHz), which can be reduced to a fallback transmission frequency corresponding to the half (ie the normalized 3.5 MHz frequency) if there are problems in the exchange of data is detected.

The cards 13 include complete means for performing a transaction (independently of the device 11) such as similar security means 131 means 113, a resource memory 132 and a microprocessor 133.

The device 11 comprises a multiplexer 117, or any other means for make a selection (this can for example also be carried out directly by the microprocessor 111). The multiplexer 117 makes it possible to choose between the means for perform a transaction of the device or those of a card. In both cases, the communication is provided by the infrared communication means 115, under the control of the microprocessor 111. On the other hand, the security of the transaction is fully supported by the element (card 13 or device 11) which ensures the transaction. So when it comes to the card, the device works so transparent, only to allow contactless communication.

The device 11 comprises means 118 for detecting the presence of a card in the means of dialogue 116, and to check its validity. In one embodiment of the invention, these means act directly on the multiplexer 117 for select the card as soon as a valid card is present.

A transaction may include the issue of a check or a check reloading of resource memories. This last operation is carried out preferentially systematically in the memory 114 of the device. It is then possible to transfer this memory 114 to the memory 132 of the card. Other types of transfer are of course possible, depending on the applications.

The invention furthermore provides an advantageous technique for the maintenance or configuration (that is, operations that can only be performed by authorized persons) of the device 11. The authorized person has a keying device 14, which has the same format, as well as the same electrical contacts, as a card 12, so that it can be inserted into the dialogue means 116. This key 14 comprises means 141 which allows the device 11 to detect that it is a access request for maintenance and not a conventional card. This means 141 is by example a mechanical and / or electrical keying.

The polarizer 14 moreover advantageously comprises a feed 142 in a voltage (for example 12 V) for erasing the contents of the memory of programming 112, in order to reprogram it. This erase voltage 142 is greater than the operating voltage of the device (for example 5 V).

When the polarizer 14 is present in the device 11, the microprocessor 111 can communicate with a maintenance terminal 15. Preferably, this communication is carried out according to the same protocol (infra-red) than a transaction communication.

According to another embodiment, the polarizer 14 may comprise directly intelligence (microprocessor and memory), or be a micro-circuit board specific, allowing maintenance or configuration.

FIG. 2 is a more detailed block diagram of an embodiment of the device 11.

A low-power microprocessor 21, for example of the MCU 8051 type (registered trademark), manages the operation of the device, depending on the information stored in the program memory 22 and the data memory 23 (which are accessible during the maintenance and configuration operations indicated above).

The microprocessor 21 manages on the one hand the relations with the means of communication 25, comprising the infrared interface 251, and on the other hand the interface man / machine 26, which includes a keyboard 261 (with 14 keys for example) and a screen 262 (for example 2 lines of 16 characters, liquid crystal).

This man / machine interface 26 makes it possible to provide numerous services user-friendly, such as consultation (visualization of the balance of the device and card), configuration and customization of the device, ...

A non-volatile memory 24 stores the data corresponding to the resources transaction (number of checks, amount available, maximum amount allowed, blank checks, ...).

Securing a transaction, when it is performed by the device, is provided preferentially by a cryptographic coprocessor 271 connected to the microprocessor 21 and by a security module 272. This security module has essentially to protect the interests of the bank. It is therefore a module monitoring (still called "observe"), configured in a particular mode and inaccessible to users, which maintains a secure image of the content of the resource memory (also called "purse"). Any operation carried out on the Resource memory systematically affects this monitoring module. Note that the card also includes such a security system.

When the transaction is performed by a card, the microprocessor 21 is connected to the interface 28 with the card. In order to use only one access bus to microprocessor 2 1, a multiplexer 29 associated with this bus is the interface 28, if a card is present, the security module 272.

Figure 3 shows an example of operation of the system described above. There are two modes of operation (30): the connected mode, when the device cooperates by infrared with a terminal, and the unconnected mode, when operates autonomously. The possible operations are of course different according to the fashion.

Any operation in connected mode begins, of course, by the institution. a connection between a terminal and the portable device. The communication to be established is bi-directional, but the procedure 31 is preferentially unsymmetrical. It's about of a master-slave procedure, the terminal playing the role of the master.

• le maítre (terminal) boucle sur l'émission d'un même paquet de données prédéfini dans la zone de communication avec les dispositifs ;
• l'esclave (dispositif) a deux possibilités :
  • s'il est en fonction en dehors d'une zone de communication : il est en mode non connecté ;
  • s'il est mis en fonction ou introduit en fonction dans une zone de communication, il reste en fonction et émet une réponse par son interface de communication, de façon à établir la connexion avec le maítre (mode connecté).

This procedure can for example be the following:

• the master (terminal) loops on the transmission of the same predefined data packet in the communication zone with the devices;
• the slave (device) has two possibilities:
  • if it is in operation outside a communication zone: it is in non-connected mode;
  • if it is activated or placed in function in a communication zone, it remains in function and sends a response via its communication interface, so as to establish the connection with the master (connected mode).

In the latter case, the exchange of messages can begin, and the two-way communication remain active until the slave device is switched off or communication area, or until the exchange of data is normally by the terminal-master.

In practice, when turned on, the device performs systematically a connection test, to determine whether or not it is in a communication area. He then repeats this test regularly.

Once the connection is established, at least three types of operations are possible (32): payment, reloading and maintenance. The first two, called transactions, are carried out by the carrier of the device. The third is reserved for authorized persons.

Regarding the payment, it was chosen to use the card first, where possible. We check the presence of a map, then the validity of it. In case of favorable responses, a payment by card 35 is made. In the case otherwise, payment is made by the device 36.

• le terminal communique au dispositif le montant à payer, éventuellement dans plusieurs devises ;
• le dispositif affiche ces données pour que l'utilisateur connaisse la somme à payer, dans plusieurs devises possibles, et les vérifie ;
• l'utilisateur accepte (dans une devise choisie) ou refuse la transaction grâce au clavier du dispositif. En cas de refus, la procédure est terminée (37) ;
• en cas d'acceptation, le terminal vérifie dans sa mémoire de ressources les autorisations accordées à l'utilisateur (montant maximum ou autorisation de paiement par exemple). Si l'un des éléments manque, la procédure est terminée (37) ;
• sinon, un chèque est émis par le dispositif, avec sécurisation des données qu'il contient, à l'aide d'une signature cryptographique ;
• le terminal vérifie la validité du chèque qu'il a reçu, par exemple en contrôlant à partir d'une clé publique sa signature cryptographique, puis accepte la transaction, si le chèque est validé. Sinon, la transaction est annulée.

Several techniques are possible to ensure payment 35, 36. They can be identical or different depending on whether the card or the device is used. The sequence can for example be the following:

• the terminal communicates to the device the amount to be paid, possibly in several currencies;
• the device displays these data so that the user knows the amount to be paid, in several possible currencies, and verifies them;
• the user accepts (in a chosen currency) or refuses the transaction thanks to the keyboard of the device. In case of refusal, the procedure is completed (37);
• if accepted, the terminal verifies in its resource memory the permissions granted to the user (maximum amount or authorization of payment for example). If one of the elements is missing, the procedure is complete (37);
• otherwise, a check is issued by the device, with securing of the data it contains, using a cryptographic signature;
• the terminal verifies the validity of the check it has received, for example by checking from a public key its cryptographic signature, then accepts the transaction, if the check is validated. Otherwise, the transaction is canceled.

The recharging 38 is performed between the terminal and the resource memory of the device, following a procedure similar to that described above for payment. It is possible to recharge in blank checks and in financial amount (s), possibly in several currencies.

Maintenance and configuration 312 being permitted only to persons enabled, the device verifies (311) the presence of the polarizer. If the keying is present, a dialogue can be established with a configuration terminal, via infrared communication means. Advantageously, the protocol of communication allows direct access to most of the components forming the device, for configuration or miantenance operations.

In unconnected mode, three major types of operations 39 are also possible: query, resource transfer, and configuration.

The query 310 makes it possible, for example, to consult the balance of the account (or accounts, when multiple accounts in multiple currencies are managed) on the card and / or on the device, as well as view the list of the last transactions made and memorized, or exchange rates:

• changeant le code confidentiel du dispositif ou de la carte ;
• choisissant la-langue d'utilisation du dispositif ;
• choisissant la monnaie utilisée pour les transactions.

The configuration 313 makes it possible to personalize the device and the card, in particular by:

• changing the confidential code of the device or the card;
• choosing the language of use of the device;
• choosing the currency used for the transactions.

Finally, the transfer of resources (blank checks and / or amounts) can be done (314) of the card to the device 315 (for example when one wants to get rid of the remaining of a card), or from the device to card 316 (for example when one comes from recharge the device). It is also possible to make transfers of credited checks of a chosen amount, from a card to a device and vice versa (in particular in order to effect a transaction between two persons, one being of the device and the other of the card).

Claims (14)

1. A portable device (11) designed for conducting secure transactions with transaction terminals (12), comprising a first set of means (111, 113; 21, 271, 272) that allow a secure transaction to be conducted using transaction resources stored in a memory (114; 24) and means (115; 25) for contactless communication with the said transaction terminals (12),
      characterised, on the one hand in that it comprises means (116; 28) for dialogue with a chip card (13), which comprises a second set of means (131, 133) that allow a secure transaction to be conducted, and means (117; 29) for switching between the said first secure transaction means and the second secure transaction means, so that a transaction can be conducted either by the said portable device (11) or by a valid chip card (14) presented to the dialogue means and, on the other hand, in that the said contactless communication means (115; 25) are arranged such as to provide an exchange of data with the said transaction terminals (12) in both transaction cases.
2. A device according to claim 1, characterised in that the switching means (117; 29) make it possible to issue electronic cheques bearing an amount transmitted by a transaction terminal (12) and authenticated by a signature encrypted using a public-key algorithm, either by the said device (11) or by a chip card (14), and in that the said checks are stored in blank form in a rewriteable memory (24).
3. A device according to either of the claims 1 or 2, characterised in that it comprises means for recharging the said device with transaction resources, by means of contactless communication with a recharging terminal.
4. A device according to any one of the claims from 1 to 3, characterised in that it comprises means for transferring transaction resources from the said device to a chip card and/or from a chip card to the said device.
5. A device according to any one of the claims from 1 to 4, characterised in that the said dialogue means can receive an element (14) for configuration and/or maintenance control comprising means (141) for telling it apart from a standard chip card.
6. A device according to claim 5, characterised in that the presence of an element (14) in the said dialogue means allows the said device (11) to establish communication with a control terminal (15) via the said contactless communication means (115) in order to perform configuration and/or maintenance operations on the said device.
7. A device according to either of the claims 5 or 6, characterised in that it contains a reprogrammable memory and in that it is able to receive a voltage that is higher than the operating voltage of the said element (14) which makes it possible to delete and reprogram the contents of the said reprogrammable memory.
8. A device according to any one of the claims from 1 to 7, characterised in that the said contactless communication means are infrared bi-directional communication means (251).
9. A device according to any one of the claims from 1 to 8, characterised in that the said means (116; 28) for dialogue with a chip card operate at a predetermined nominal transmission frequency, and in that they comprise means for detecting transmission faults, which switch the means to a fold-back transmission frequency equal to half the nominal transmission frequency.
10. A device according to any one of the claims from 1 to 9, characterised in that it comprises a multiplexer (29) associating either the said means (28) for dialogue with a chip card or the means (272) for internally securing a transaction to the single access port of a microprocessor (21).
11. A device according to claim 10, characterised in that the said multiplexer (29) systematically connects the said means (28) for dialogue with a chip card whenever the presence of a valid card is detected.
12. A method for implementing a portable device designed for conducting secure transactions with transaction terminals, characterised in that it provides two operating modes:

    a direct mode, in which the transaction is managed by the said portable device;

    a transparent mode, in which the transaction is managed by a chip card operationally coupled to the said device,

       contactless communication with the said transaction terminals being implemented identically in both modes.
13. A method according to claim 12, characterised in that the said contactless communication is infrared communication of the master-slave type, the transaction terminal playing the part of the master and the said device playing the part of the slave.
14. A method according to either claim 12 or 13, characterised in that the said transactions comprise at least one of the operations consisting of the following:

    providing the issue of electronic cheques bearing an amount transmitted by a transaction terminal;

    securing a cheque by transmitting a cryptographic signature;

    managing at least two balances in different currencies, in order to enable payment in several currencies and/or transcribing the transmitted amounts into several currencies;

    providing deposits and/or withdrawals of amounts from an account;

    validating the user of the device and/or of the card using a confidential code;

    recharging the said device with blank cheques and/or sums of cash;

    transferring cheques, blank or credited, and/or sums of cash from the said device to a chip card and/or from a chip card to the said device;

    consulting a balance, cash and cheques, of the device and/or of the card, a list of recent transactions and/or exchange rates;

    configuring and personalising the operation of the said device.

Images