EP2577629A1

EP2577629A1 - Method and system for secure teletransmission

Info

Publication number: EP2577629A1
Application number: EP11727258.3A
Authority: EP
Inventors: Christian Soulez
Original assignee: KCS MONETIC
Current assignee: KCS MONETIC
Priority date: 2010-05-27
Filing date: 2011-05-24
Publication date: 2013-04-10
Also published as: FR2960675B1; WO2011148096A1; FR2960675A1; US20130117822A1

Abstract

The system for secure teletransmission destined for a receiving person (22) comprises a secure server (3) comprising a program for providing a redemption code (ALEA) and a code for designating an object to which the teletransmission pertains. A terminal (1) comprises an interface for allowing a sending person (11) to indicate the designation code and to take cognizance of the redemption code (ALEA), and means for connection to the secure server (3) so as to send a request and to receive the redemption code (ALEA) in response. A terminal (5) comprises an interface for allowing the receiving person (22) to enter the redemption code and the designation code, means for connection to the secure server (3) so as to receive an authorization from the secure server (3) which confirms a correlation of the redemption code entered with the designation code, and means for automatically delivering the object after receipt of the authorization.

Description

"Secure teletransmission method and system"

The present invention relates to a method and a secure teletransmission system.

The known means of communication and information processing provide flexibility and speed to implement local or remote transmissions that facilitate exchanges between people.

However, the facilities offered by the means of communication and information processing must not be a source of vulnerability when the transmitted material is sensitive and / or of value because it is appropriate that the transmission succeed without being corrupted, to the person to whom it is actually intended. This is particularly the case when the transmission involves a transfer of money.

In the prior art known, the publication of the patent EP0807910B1 on June 4, 2008, discloses a method of implementation of electronic money in which a monitoring institution orders a bank to transfer a payment amount to a bank account after checking the validity of the electronic money. The imposition of a bank account as the recipient of the transfer is a factor of security. However, the method disclosed in this first patent cited above, has the disadvantage of not suitable when the recipient does not have a bank account.

The publication of patent EP1168762B1 on July 16, 2008, discloses an information provider system in which a terminal device transmits financial information of users to an information management device arranged to perform payment processing. However, the method disclosed in this second patent cited above, has the disadvantage of not allowing to concretely deliver an object, including a sum of money to a money transfer recipient.

More generally, the known security techniques are essentially using electronic means that control each other relatively opaque to the user. These techniques are not entirely satisfactory in terms of certainty for the user as to the correct receipt of the correct sum by the correct recipient. On the other hand, the non-repudiation of the transmission by the user, crucial in money transfer, is difficult to guarantee when the user faced with the opacity of purely electronic controls, could be tempted to refute the integrity electronic control means.

Various attempts using electronic means of communication have been undertaken without any real success in delivering an object to a recipient, so as not to require the recipient to have a bank account, even when the object is a sum of money .

The patent grant publication EP0960499B1 on November 2, 2005, discloses a system adapted to provide funds requested to a recipient by verifying that a first security code included in transfer data, is equal to a second security code. security included in recipient data, the transfer data being entered by a sender and recipient data being entered by the recipient. The implemented method is not entirely satisfactory in terms of security, for example in case of interception of the security code in the transfer data or in the recipient data.

The present invention aims to overcome the disadvantages presented above known safety devices. For this purpose, according to the invention, a secure remote transmission method ordered by a transmitting person to a receiving person comprises:

a first main step and a second main step activated when a secure server receives from a first electronic device a first request containing a designation code of an object to which the remote transmission relates and a receiver personal equipment address attributable to the receiving person;

the first main step of providing the first electronic device with a removal code;

- The second main step of providing the receiving personal equipment, a ticket containing data comprising at least the designation code of the object to which the teletransmission relates; and

a third main step activated when the secure server receives from a second electronic device a second request containing the withdrawal code and all or part of the data comprising at least the designation code of the object;

the third step of verifying a match between the withdrawal code and at least the designation code of the object for providing the object to the receiving person when the code match is positively verified.

Advantageously, the secure teletransmission method comprises:

a first peripheral step activated when the transmitting person initiates a call from a sending personal equipment to the receiving personal equipment;

a second peripheral step activated when the receiver takes the launched call from the sending personal equipment; the first peripheral step and the second peripheral step of allowing the transmitting person to recognize the receiving person so as to ensure that the receiving personal equipment is actually allocated to the receiving person and to communicate to him the withdrawal code. According to a possible embodiment, the first electronic device is a first terminal, the second electronic device is a second terminal and the method comprises:

a formulation step in which the first terminal receiving a verification token requests the issuing person to indicate the designation code of the object to which the transmission relates;

a request step in which the first terminal transmits to the secure server a request comprising the token and the designation code to request the secure server to provide the withdrawal code;

a signaling step in which the first terminal communicates the withdrawal code to the transmitting person; and

a distribution step in which the second terminal terminates the transmission by delivering the object after receiving the withdrawal code and the designation code entered by the receiving person and after receiving an authorization issued by the secure server to confirm a correlation of the withdrawal code entered with the verification token.

Especially:

- In the formulation stage the first terminal asks the issuer to indicate at least one unambiguous nominative code of the recipient and / or the person sending; and - In the request step the first terminal places the (s) said unique name (s) code (s) in the request sent to the secure server.

More particularly, in the distribution step, the second terminal delivers the object after additional reception of at least one unambiguous nominative code entered by the receiving person.

Preferably, the unambiguous nominative code is a telephone number.

Advantageously, the unambiguous nominative code is a telephone number of the receiving person and the receiving person receives by telephone the designation code on a first communication channel linked to the secure server and the withdrawal code on a second communication channel linked to the person sending.

According to another possible embodiment, the first electronic device is the sending personal equipment for accessing an account controlled by the secure server and the second electronic device is a terminal. The method then includes a sub-account creation step accessible from the receiving personal equipment when the secure server receives an add request from the personal equipment, and the data provided in the second main step includes subaccount access information.

In the context of one or other of the embodiments, the secure remote transmission method preferably comprises:

a step of displaying data received from the secure server by the receiving personal equipment;

an authorization request step sent to the secure server when the received data is entered with the access code in the second terminal.

In particular, temporally and / or spatially limited validity is associated with the removal code. According to one possible variant, the object is a sum of money and the designation code is an amount of the sum of money.

According to another possible variant, the object is a sub-account, the designation code is a user alias name of the sub-account and the second electronic device is the receiving personal equipment.

Advantageously in this other variant, the secure server creates a virtual card number in the third main step.

The invention also relates to a secure teletransmission system for a receiving person ordered by a transmitting person, which comprises:

- a first electronic device available to the person transmitting;

- receiving personal equipment attributable to the receiving person;

a secure server comprising a program for providing a withdrawal code to the first electronic device and for supplying a designation code of an object to which the remote transmission to the personal equipment relates; and

a second electronic device comprising an interface for enabling the recipient to enter at least the withdrawal code, means of connection to the secure server for issuing the withdrawal code and the designation code and for receiving an authorization from the secure server which confirms a correlation of the withdrawal code entered with the designation code, and means for automatically issuing the object after receipt of the authorization.

Advantageously, the system includes personal transmitting equipment enabling the person sending the call to retrieve the personal equipment for ensure that the receiving personal equipment is actually allocated to the receiving person.

According to a first possible embodiment, the first electronic device is a first terminal comprising an interface arranged to request the issuing person to indicate at least one unambiguous nominative code of the receiving person and / or the person transmitting so as to place the unambiguous nominative code (s) in a request sent to the secure server.

In particular, the second electronic device is a second terminal arranged to deliver the object after additional reception of at least one of the unique nominative code (s) entered by the receiving person.

More particularly, the unambiguous name code is a telephone number, more particularly is a telephone number of the receiving person and the receiving person receives by telephone the designation code on a first communication channel linked to the secure server and the withdrawal code. on a second communication channel linked to the person sending.

According to a second possible embodiment the first electronic device is the transmitting personal equipment then containing a program for accessing an account controlled by the secure server and the second electronic device is personal receiving equipment. The secure server is then arranged to receive an add request from the personal equipment, to create a subaccount accessible from the receiving personal equipment and to transmit data containing information to the receiving personal equipment. access to the sub-account.

In one or other of the embodiments, the secure server is advantageously arranged to limit temporally and / or spatially a validity associated with the withdrawal code.

According to a possible variant of the system the object is a sum of money and the designation code is an amount of the sum of money.

According to another possible variant of the system, the object is a sub-account, the designation code is a user alias name of the sub-account and the second electronic device is the receiving personal equipment.

The invention will be better understood, and other objects, features, details and advantages thereof will appear more clearly in the explanatory description which follows with reference to the accompanying drawings given solely by way of example illustrating a method of embodiment of the invention and in which:

- Figure 1 is a schematic view of an implementation system of the invention;

FIG. 2 shows process steps according to the invention for enabling an issuer to transfer a sum of money;

FIG. 3 shows process steps according to the invention for enabling a receiving person to collect the sum of money;

FIGS. 4 and 5 show process steps according to the invention for enabling the person sending the data to create a sub-account for the benefit of the receiving person; and

FIG. 6 shows process steps according to the invention applicable to embodiments other than those presented.

The system shown in FIG. 1 comprises a bank computer 2 which houses a bank account which a person 11 has to issue an order to withdraw a sum of money from said bank account. The system further comprises a first terminal 1 which allows strong authentication of the person 11 as the one who has said bank account. The terminal 1 is for example a bank machine of the Automatic Cash Dispenser (ATM) type by means of which the person 11 can give evidence to authenticate that it has the account using a bank card associated with a secret code that only the person knows. The terminal 1 is for example also a peripheral of the bank computer, accessible only by an employee of the bank who occupies in an agency, a meeting point equipped with the device and who can physically authenticate the person 11 by his documents. identity or by the personal knowledge that the employee has of the person 11. The terminal 11 is for example still a programmed mobile phone or whose SIM card is programmed in a known manner to offer the functions of a bank card. The possible means of authentication are not limited to a secret code. The means of authentication may be based on the biometric characteristics of the person 11. The type of the terminal 11 is not limited to those just stated but extends to any type of electronic equipment that offers digital services. strong authentication comparable as it is for example the case of a personal computer set to do banking on the bank account through a secure dialogue with a website of the bank.

The system also includes a second terminal 5 whose essential function is to be able to distribute banknotes. Due to its nature, a bank machine is well suited to carry the terminal 5. The terminal 5 allows a person 22 to be able to collect a sum of money without having to justify having a bank account, in other words without having necessarily a bank account to carry out banking operations.

The terminal 5 is connected to a second bank computer 6 which manages any remittance of money on the terminal 5, in particular by issuing banknotes.

The bank computer 6 is connectable to the bank computer 2 by means of a specialized interbank network or secure links on the Internet network 8. The computer 6 can also, in some cases of use, be confused with the computer 2, in particular but not necessarily when the terminal 5 is identical with the terminal 1. The particular cases depend essentially on the respective geographical positions of the persons 11 and 22.

Remarkably, the system comprises a secure transfer server 3 (SSTF) connectable to the computers 2 and 6 by means of connection comparable to those used by the computers 2 and 6 to communicate with each other, so as to set up a money transfer service that can be operated within the same bank or by a third-party operator acting on behalf of several banks.

The money transfer service offered by the server 3 differs from the money withdrawal services known in that the person 22 to whom is physically delivered a sum of money, notably in the form of banknotes, is not not necessarily the person who authenticates to debit the amount of money from the account at his disposal.

The server 3 is arranged to deliver a single-use ALEA withdrawal code to the person 11 authenticated on the terminal 1 by the system to access the account. Person 11 communicates, out of the system, the code to the person by means that enables him to ascertain humanly, in other words to recognize that the person is really the person to whom the person intends to silver. The person 22 then uses the code to withdraw the amount of money on the terminal 5.

The uses of this service are multiple.

According to a first possible use, the person 22 is a person located at a distance from the person 11, in the same country or in a distant country. The person 11 uses his telephone 7 to call the person 22 on his telephone 4. Recognizing the person 22 with the tone of his voice and possibly the personalized dialogue that is established, the person 11 vocally communicates the withdrawal code to the person 22.

According to a second possible use, the person 22 is close to the person 11. This is for example the case of two people from the same family residing close to each other. The person 11 visually recognizes the person 22 and communicates the withdrawal code orally or written on a sheet of paper.

According to a third possible use, the person 22 holds the account on which the sum of money is debited but does not have electronic credit card type authentication means or the like. The person 11 is then an employee in an agency of the bank that manages the account. After having duly verified the identity of the person 22, the employee uses his personal device of the bank computer on which he is authenticated to obtain the withdrawal code in the form of a paper receipt that he gives to the person 22. The bank computer can also directly send the withdrawal code by SMS to the mobile phone 4. The person 22 then uses the paper receipt or the SMS to make the withdrawal requested on the agency of the machine.

According to a fourth possible use, the person 22 and the person 11 are one and the same person who wishes to withdraw a sum of money without having to wear his authentication device, for illustrative purposes his credit card at the time of withdrawal, for example in returning from a workout or beach. It suffices for the person 11 to obtain beforehand the withdrawal code and to memorize it by heart or to note it in the palm of the hand if it is less trusting to the person 22 that she will have become on returning from her sport.

Other uses, obtained by combination or extension of the uses mentioned above, are possible without departing from the scope of the present invention.

In particular, the terminal 1 can be used to deposit a sum of money if it is provided for this purpose. It is then the deposited amount that is transferred.

With reference to FIG. 2, a terminal of a first system A (hereinafter terminal A) initially in a waiting step 100 executes steps of the method that allow a transmitting person (E) to issue an order to deliver to a remote receiving person (R) a directly usable amount of money debited to an account managed by a bank computer of System A (hereinafter bank A). Typically, the terminal A and the bank computer A are respectively hosted by the terminal 1 and the computer 2 of FIG. 1. The person E is then the transmitting person 11 and the person R is then the receiving person 22 of the figure 1.

A signaling transition 101 is validated when the person E arrives at the terminal A, which is for example a bank machine (ATM for ATM in French or ATM for Automated Teller Machine in English) of his bank or a bank in agreement with his bank. The terminal is for example still an electronic payment terminal (TPE), or even a secure telecommunications equipment such as a mobile phone including a cryptographic module. Different modes of presentation to the terminal A can be implemented, for example those of introducing a medium of personal information into a terminal A reader provided for this purpose. By way of illustration and in no way limiting, mention may be made of magnetic stripe cards and EMV-compliant chip cards or another standard ensuring international interoperability of monetary transactions. The personal information stored on the medium is correlated with a PIN (Personal Identification Number) secretly held by the person E or any other type of identifier including biometric data such as a fingerprint, veins of the hand, a fundus of the eye or an iris that unequivocally distinguish the person E within the human race.

A validation of the transition 101 activates an interrogation step 102 in which the terminal A asks the person E to communicate his identifier by typing his confidential code on a keyboard of the terminal or by submitting a part of his appropriate body to a sensor of the terminal. terminal dedicated to the biometric data correlated to the personal information stored on the medium.

An identification transition 103 is validated when the person E has communicated his identifier to the terminal A.

A validation of the transition 103 activates a step

104 of authentication in which the terminal A transmits the identifier to the bank computer A, preferably in encrypted form by the terminal A.

The bank computer A initially in a waiting step 200 executes steps of the method that make it possible to link the account of the person E to authorize an execution of the order sent by the person E on the terminal A.

An account access transition 201 is validated when the bank computer A receives the identifier of the person E, preferably encrypted as indicated by the star by exponent in FIG. A validation of the transition 201 activates a verification step 202 in which the bank computer A checks the correlation of the identifier with the personal data of the person E and generates a token linked to the person E (token E) if the Correlation is verified positively. The token is for example an EMV cryptographic element. The bank computer A uses, for example, a known ATM manager (GDG) for this purpose. The bank computer A then sends the token E to the terminal A.

An authentication acknowledgment transition 105 is validated when the terminal A receives the token E.

A validation of the transition 105 activates a selection step 106 in which the terminal A asks the person E to select a function from a menu among several proposed monetary functions such as the withdrawal of bank notes, the consultation of the account and more particularly in the context of the invention, the transfer consisting in handing over a sum of money in person to a person R.

Other known or future steps in the technical field of remote access to a bank account can be used to carry out the preliminary phase which leads to step 106 from which the essential steps of the procedure are carried out. invention which are explained below. The steps 102 and 104 may for example be grouped in a single step in the case where a biometric data detected by a sensor of the terminal A is sufficient for the identification and identification of the person E.

Regardless of how it is obtained, the token E is the element that makes it possible to start and validate the secure transmission phase explained below. The token usually loses validity when secure transmission is complete.

A control transition 107 is validated when the person E selects a transmission function secure according to the invention, including the function "money transfer" in the menu.

A validation of the transition 107 activates a formulation step 108 in which the terminal A asks the person E to indicate a designation code of an object to which the secure transmission relates. When the secure transmission relates to a money transfer, the designation code is the amount of money to be transferred. According to a variant of preferred implementation of the method, the terminal also requests the person E a unique nominative code which facilitates, as we shall see in the following description, the processing of secure transmission. The nominative code is unambiguous in that it is attached specifically to the person E or the person R. The nominative code is for example an address which allows the person to contact the person R to inform him of the elements necessary for a withdrawal of the person. object to which the transmission relates, including a withdrawal of the sum of money it is intended to remit to him. Said address is for example an Internet e-mail address. Preferably said address is a telephone number to which it is possible to call the person R. Preferably higher, said address is a mobile phone number which makes it easier to reach the person R and to send him written information. by short message service (SMS for short service message in English) or by multimedia message service (MMS for multimedia message service in English). The telephone number does not only have the advantage of making it possible to reach the person R, it also has the advantage of being generally memorized both by the person R and by the person E mentally or in an electronic directory and therefore easily found both by the person E and by the person R. In this respect, the telephone number may also be the telephone number of the person E who personally identifies the person E, in other words, which designates the person E unambiguously. The persons E and R, being people who know each other, it is sufficient if the person E communicates his telephone number to the person R by some way so that the person R retains him.

A transition 109 of information is validated when the person E indicates the designation code of the object, including the amount of the sum of money to be transferred and preferably also the univocal nominative code, including the mobile phone number that allows reach the person R who will receive the money. Preferably, the person E enters the amount to be transferred in the currency of the country where the person resides. In other words, the amount is usually expressed in the currency of the country where the person resides, essentially if the person R resides in the same country.

A validation of the transition 109 activates a request step 110 in which the terminal A requests the secure transfer server SSTF, typically the server 3 of Figure 1, to provide a first ALEA withdrawal code. To do this, the terminal A sends to the server SSTF a request that includes the token issued in step 202 by the bank computer A, the amount and the address entered by the person E on the terminal A.

The secure SSTF server, initially in a waiting step 300, executes steps of the secure transmission method that make it possible to transmit the object, more specifically the sum of money to the person R.

A boot transition 301 is validated when the SSTF server receives the request including the token that binds the account to be debited and the amount of the sum of money to be transferred. In the variant that uses the unambiguous nominative code, the request also includes the address, including the telephone number allowing to inform of the transfer, the person to whom the sum of money must be handed over.

A validation of the transition 301 activates in the server SSTF a step 302 of response to the request sent by the terminal A and a step 304 of generating an electronic ticket for withdrawing the sum of money.

In step 302, the server SSTF creates a data structure dedicated to the secure transmission, in particular dedicated to the money transfer transaction, for example a line indexed by an identifier ID in an associative table. In order not to unnecessarily burden the text, it will be understood later in the description that the amount of the sum of money also refers, more generally, to the designation code of any object that is not necessarily a sum of money. money. The identifier ID can also be a pointer to another type of data structure. The server SSTF stores in the data structure, the parameter values communicated in the request and including the token, the amount of the sum of money to be transferred with the address, in particular the telephone number making it possible to inform the transfer, the person to whom the sum of money must be handed over, optionally a telephone number of the person E and / or a bank card number of the person E. The credit card number is for example obtained from the computer of bank A from the token, regardless of whether or not the terminal A. The SSTF server then pulls a number, or more generally a string of random characters that is the first ALEA withdrawal code whose nature is random or pseudo random. The server SSTF stores the ALEA code in a box of the data structure reserved for this word and sends the ALEA code in a response message to the terminal A, possibly via the GDG when the terminal A is a bank payment machine. Note that the ALEA code can also be generated as a temporary PIN code which is usable once by the beneficiary. In this case a hash code is preferable, especially for two people 11 and 22 different.

In step 304, the SSTF server assigns the future cash withdrawal transaction a PTV validity time range that it stores in the data structure. The validity time range provides additional security for the transmission, which can not be executed outside the validity time range. Other additional security can be considered as for example the neighborhood of a place of validity. The SSTF server applies a hash function to all or part of the content of the data structure which gives a second Hash Data removal code whose nature is deterministic. The SSTF server stores or does not store the Hash Data code in a box of the data structure, groups the second Hash Data withdrawal code with the PTV validity time slot and / or a location criterion of the withdrawal, so as to generate the electronic ticket then sends the electronic ticket in a notification message to the address of the personal equipment of the person R which is stored in the data structure. The notification message is advantageously sent in the form of an SMS when the address is a mobile phone number. When no address of the person R is communicated in the request, an address of the person R may be available from a database subject to prior registration. When no address of the person R is known in one way or another, step 304 may very well not be executed.

An acknowledgment transition 111 is validated when the terminal A receives the first withdrawal code.

A validation of the transition 111 activates a step

112 in which the terminal A communicates the first ALEA withdrawal code to the person E. Various embodiments can be envisaged to communicate the first ALEA withdrawal code to the person E, for example visually by displaying the code on a local screen, vocally by means of a loudspeaker located on the terminal A or a wireless link to the 802.11 protocol or a proximity field communication (NFC for near field technology in English) or another to a communicating object held by the person E such as for example the mobile telephone 7 equipped with a radio receiver at short distance. In a preferred embodiment, the terminal A prints the amount of the sum to be transferred, the address of the personal equipment of the person R and the first withdrawal code ALEA on a receipt that is issued to the person E.

A transition 401 alert is validated when the personal equipment of the person R, typically the phone 4, receives the electronic ticket.

A validation of the transition 401 activates an alarm step 402 in which the personal equipment of the person R informs the person R so as to enable him to read the contents of the electronic ticket to acquaint with the second withdrawal code and the time range in which the withdrawal of the sum of money is allowed.

Steps 304 and 402 may be part of an option in which the method proposes to the person E, the "payer" to notify the person R, the "paid" of the upcoming transfer by SMS or by call combined with a voice synthesis device, if the "Paid" has a mobile phone. Regardless of this option, the address given in the request of step 110 in the form of a telephone number, allows the person E to easily indicate the person R and the person R to easily be recognized by association of the person R with the phone number which it is easy to remember so much for the person E than for the person R. The telephone number is in a way a unique naming code of the person R as we will see now in the following description.

However, these steps can only be optional if the generated ALEA code is also used by the transaction key to retrieve the ticket.

In the case of the transfer steps 302 and 304 are not optional. Step 304 serves in particular to transmit the virtual card number that is generated on the basis of the Hash code and according to the method described below.

Ideally, the SSTF builds a special card number including a fixed fixed part, a specific Bank Identification Number (BIN) which identifies the bank to which the issuer of the transfer belongs. The BIN is followed by a number correlated with the ALEA code, for example the ALEA code in clear or the encrypted ALEA code. The correlated number can also be the hashdata, especially if the ALEA code is comparable to a temporary PIN.

Here appears a concept comparable to that found in DNS domain name servers to ultimately find the transmitter's card number (as in TCP / IP) with several SSTF servers in networks, each attached. to a bank server such as here at the server 2 of Bank A and the server 6 of Bank B.

The virtual card number or virtual PAN, is an alias of the card number of the bearer whose part BIN makes it possible to go up towards the transmitter and to find the server SSTF of the bank of the issuer, and whose variable part corresponds to the hashcode which retrieves the ticket in the SSTF server of the bank of the issuer. There are two advantages made possible by the type of architecture that has just been described.

A first advantage is to associate a T-PIN code with the virtual card number which does not modify the transfer of data between the withdrawal machine 5 and the computer 2 of Bank A.

A second advantage is to use two different channels of transmissions of these two information that enhances security.

The step 112 completes a first phase of the method which provides the person E with an intangible control key on the transfer of the sum of money that it orders. This light control key consists of the first ALEA removal code.

In a second phase, the "Payer", that is to say the person E personally communicates the withdrawal code ALEA to the "Paid", that is to say to the person R in a humanly controllable way for example vocally directly or by telephone, by hand delivery or other equivalent conventional means to ensure that the person receiving the withdrawal code is the R person to whom the money transfer is intended . The meeting or the dialogue during which the person E hands the code ALEA to the person R, allows the person E to recognize the tone of the voice, the facial features of the person R and / or information shared for example on family. In this regard, the mobile phones 7 and 4 are particularly well suited means for establishing a voice communication channel or television between people E and R.

Particularly when the person R is remote, the telephone communication allows the person E to ensure that the information of the ALEA code is transmitted to the right person. Electronic messaging devices (MEL) on the Internet or short message services (SMS) are a priori rejected of the process because they are sources of error except to use pre-registrations of "Paid" (potentially R persons) with their numbers or MEL addresses with prior control of these data before any transaction.

The person R, in other words the "Paid", having received by the voice channel the ALEA code and optionally having been warned not SMS in the case of an implementation of step 402 on his personal equipment. communication, activates the second phase of the process by going to an ATM of a bank in agreement with the bank of the person E, in other words the "Payer" or on a PLC of a bank having subscribed the service " Transfer of money "from the same operator as the bank of the person E to implement the method of the invention.

Referring to Figure 3, the terminal of a second system B (hereinafter terminal B) initially in a waiting step 500, performs process steps that allow the person R to withdraw the amount of money transmitted. by the remote person E, the amount of which is debited by compensation from a bank computer system B (hereinafter bank B). In step 500, the terminal B typically displays a menu of several possible functions or services, including purely illustrative and non-limiting, withdrawal of bank note, bank account consultation and more particularly in the context of the invention, the transfer of money and the collection of money transferred.

A selection transition 501 is validated in the terminal B when a person, in particular the person R, selects the function "Money collection".

A validation of the transition 501 activates a step 502 in which the terminal B displays an electronic form which invites the person R to enter successively or randomly, a set of data comprising:

- the amount of the sum to be collected in the local currency of the place where Terminal B is installed;

the first ALEA withdrawal code that the person R has received from the person E via the voice channel; and eventually

- depending on the chosen implementation option, the unambiguous nominative code, for example the phone number of the person R, and / or all or part of the content of the electronic ticket, for example the second Hash Data withdrawal code.

Preferably, a hashcode transaction identifier and / or telephone number is particularly useful if the ALEA code is comparable to a temporary PIN, generally short to facilitate the search for the transaction in the SSTF database.

It should be noted in this regard that when two withdrawal codes are entered, they are a priori different and they are both entered by the person R.

A data reception transition 503 is validated in the terminal B when the set of required data is received.

A validation of the transition 503 activates a request step 504 in which the terminal B requests the secure fund transfer server SSTF to provide a withdrawal authorization. The authorization request includes the data requested in step 502 by the terminal B, in particular the amount and the ALEA code entered by the person R on the terminal B and optionally the second removal code corresponding to the hashcode received during the optional steps. 304 and 402 especially if the ALEA code is comparable to a temporary PIN code.

Different modes of routing the request to the secure SSTF funds transfer server are possible. For example, the terminal B when materialized by a bank machine, initially transmits the authorization request to the GDG management service of the bank computer B. The amount and the currency are normally transmitted according to the rules. the protocol used by the PLC to communicate with the bank computer B (HOST-GDG). The bank computer B, then identifying in the authorization request a specific request for the transfer of funds using the BIN, routes the data of the request to the SSTF.

The server SSTF initially secured in the waiting step 300, performs the following steps of the method that transfer the money from the person E to the person R.

A transition 305 for receiving data is validated when the server SSTF receives the data of the request comprising in particular the amount and the ALEA code.

A validation of the transition 305 activates a search step 306 in which the SSTF (or the SSTF network) checks the validity of the ALEA code and checks the amount with its currency. Optionally, it is also possible to check the hashdata. After having performed positive checks and verifications, the secure SSTF server returns to bank computer B (HOST-GDG) an authorization with the amount and the Personal Authentication Number (PAN) of the bank. "Payer", that is to say the person E. The transaction to which the validation of the transition 305 is related can be retrieved by indexing the ALEA code if it is pseudo-random so as to be unambiguous, by indexing the amount on a first level then the ALEA code on a second level. Preferably, the transaction is found by indexing the unique nominative code specially transmitted for this purpose by the person R on the terminal B. An approval transition 601 is validated when the bank computer B receives the amount approved by the secure SSTF server.

A validation of the transition 601 activates a step 602 in which the bank computer B sends to the terminal B a response to the authorization request. The answer can be developed in different ways, for example by direct broadcast of the amount approved terminal B. Preferably when the amount approved is accompanied by the PAN of the person E, the B bank computer starts with re ^¬ route the request of authorization in modified form with the credit card number of the "Payor" to its authorization server (HOST-SA) standard so as to go up to the bank computer A "Payer" according to the standard schemas of authorization. In this particular case, it is only upon receipt of the authorization from the bank computer A that the bank computer B transmits to the terminal B, the authorization to issue the funds, it that is, to remit the amount of money that is being transferred.

An authorization transition 505 is validated when the terminal B receives a positive response to the authorization request it had issued in step 504.

A 505 transition validation activates a step

506 distribution in which the terminal B performs a final check and proceeds to the issuance of the sum of money, for example by distributing bank notes in an amount corresponding to the amount of the sum transferred. When it is implemented in the form of a bank machine, the terminal B conventionally checks the authorization received from the bank computer B (HOST-GDG) to perform the last check.

A withdrawal transition 507 is validated when the person R withdraws the notes.

A validation of the transition 507 activates a step 508 in which the terminal B generates a report of transaction it transmits to the bank computer B and optionally the secure SSTF server.

A confirmation transition 603 is validated when the bank computer B receives the report.

A transition validation 603 activates a step

604 in which the bank computer B compensates the sum of money with the bank computer A in a known manner.

A confirmation transition 307 is validated when the secure SSTF server receives the report.

A validation of the transition 307 activates an optional step 308 in which the secure SSTF server notifies a withdrawal notice made to the person E. If the phone number 7 of the person 11 is stored in the secure SSTF server 3, the SSTF server Secure can notify the notice of withdrawal made directly on the phone 7, for example by sending an SMS.

It will be noted that contrary to certain prior art methods in which information comprising a secret and a transaction identification are transmitted from a "payer" to a "paid" by a single channel with the disadvantage of favoring interception, in the method and system of the invention, a code obtained by a hash function for sealing a set of elements of the transaction, is conveyed by a second channel, in this case an SMS, different from a first channel for routing the secret code shared by the persons E and R on the basis of mutual recognition. This hash code, which signs the transaction and serves as identification of the "paid" transaction, can only be generated and verified by the SSTF server. This hashed code, which constitutes the second withdrawal code, can only be rebuilt if it has the keys of the SSTF server used to generate it and the data sent back by the voice channel (notably the secret, etc.). either by the SMS channel (OTP, Amount, mobile number of the paid, ...).

The SMS is an effective means of transmitting the data to the "paid", that is to say the person R who will be able to reproduce them during the withdrawal. But they remain unusable without the secret, namely the first withdrawal code that passes through the voice channel.

Assuming that the person E decides to send the secret, in other words the ALEA code also by SMS to the person R presenting a risk of interception of the two SMS in case of corruption of the then unique transmission channel , the invention proposes additional security measures explained below.

On the other hand, the method of the invention falsifies any misunderstanding on the authentication of the person R following an error on the telephone number of the person R, by requiring the person E to dial the number twice. "Paid", namely once on the first terminal, including the bank machine for which the person E can not use his phone book, thus avoiding the selection errors in a directory, and once on his mobile phone for the voice call or sending by SMS if the person E decides to use this channel in the absence of means to prevent it.

If the person E makes a mistake when entering the telephone number of the person R on the PLC, the SMS of transmission of the ticket from the server SSTF can reach an unwanted recipient but the SMS will be unusable without the secret constituted by the first ALEA withdrawal code.

If the person E makes a selection error when transmitting the secret via the voice channel, the person E will recognize his error immediately for example by detecting an unknown voice. If the person E makes a good entry of the number of the person R on the controller and then decides to transmit the secret, namely the first ALEA withdrawal code by SMS. A possible error on the number of the person R committed by the person E from his mobile phone 7, is of no detrimental consequence because the wrong recipient will receive a secret which he will know what to do without having the SMS transmitted from the server SSTF .

If the person E makes a bad entry on the automaton then decides to transmit the secret by SMS by selecting the correct number of the person R, the receiver of the first SMS will not be able to use it without the secret.

The risk of error is also considered if the person

E uses twice the same wrong number both on the controller to create the transaction than on his mobile phone to transmit the secret to the person R, the wrong recipient then having all the information needed to make the withdrawal.

Although the risk considered above is limited by the fact that the person R is a familiar of the person E and that the person E has in this case a correct number in his directory, without having to type the number live on his mobile phone, the process can be improved by countering this risk by the following means.

We add a location criterion of the automaton where the withdrawal can be made. The erroneous recipient is unlikely to be near the localized PLC to make the withdrawal within the time allowed by the time range.

Preferably, the method may provide for a pre-registration, on the ATM manager side of the bank of the person E, of the mobile numbers of persons R potentially authorized to receive money transfers. This option may have an advantage in the framework of legislation on currency transfer and money laundering.

With reference to FIG. 4, an emitting personal equipment assigned to the transmitting person (hereinafter personal equipment E) initially in a waiting step 700 executes process steps, referred to as enlistment steps, which allow the transmitting person ( E) issuing an order to provide a remote receiver (R) with means to access an account subaccount associated with the personal equipment E under the control of the secure server SSTF. Typically, the personal equipment E is the mobile phone 7 of Figure 1 which hosts a secure access program to the account controlled by the secure server 3. The secure access program includes instructions executable by a microprocessor of the equipment personal script form or preferably in the form of an applet to implement the method of the invention. Compared to a script of interpreted nature, the compiled nature applet has the advantage of a greater speed and a better user-friendliness of execution. The applet is previously loaded by a download process known in the technical field. The person E is typically the transmitting person 11 and the person R is then the receiving person 22 of FIG.

A signaling transition 725 is validated when the person E activates the applet on his personal equipment. The applet installed on the personal equipment includes for example the instructions and the data, preferably in encrypted form, which make it possible to emulate, in conjunction with the data of the account of the person E opened in the database of the secure server. SSTF, an EMV compliant card or other standard that provides for international interoperability of monetary transactions. Personal information stored on the media is correlated to a code confidential (E-PIN for Electronic Personal

Identification Number) secretly held by the person E or any other type of identifier including biometric data such as a fingerprint, veins of the hand, a fundus of the eye or an iris which unequivocally distinguish the person E within the human race.

A validation of the transition 725 activates an interrogation step 726 in which the applet activated on the personal equipment displays a menu of various available teletransmission functions, among which may be mentioned, non-exhaustively, those which relate to an object. which is a sum of money or an object which is a sub-account of the main account accessible by the PIN code E-PIN.

A transition 727 is validated when the issuing person selects from the menu a function for adding an account beneficiary.

A validation of the transition 727 activates a step 728 which retransmits the request to add to the secure server SSTF, typically to the server 3 of FIG.

A transition 319 is validated when the SSTF server receives the add request.

A validation of the transition 319 activates a step 320 in which the secure server sends an E-PIN code request to the personal equipment.

A transition 729 is validated when the personal equipment receives the request for E-PIN code from the secure server SSTF.

A transition validation 729 activates a step

732, in which the applet activated on the sending personal equipment, asks the transmitting person 11 to enter his confidential code E-PIN, for example on a keyboard of the personal equipment E.

An identification transition 733 is validated when the person E has communicated his identifier to his personal equipment. A validation of the transition 733 activates an authentication step 734 in which the personal equipment transmits the identifier E-PIN to the server SSTF, preferably in encrypted form by a cryptographic module of the personal equipment. Step 734 consists in asking the secure server for a random or pseudo random temporary withdrawal code called ALEA for the circumstance. The temporary withdrawal code will allow the receiving person 22 to remove subaccount access parameters or limited access to the main account. The transmission of the identifier E-PIN to the SSTF server is accompanied by the International Mobile Equipment Identity (IMEI) mobile equipment identity number of the transmitting personal equipment.

A transition 321 is validated when the secure server receives the code E-PIN and the number IMEI.

A validation of the transition 321 activates a step 322 in which the secure server looks for the user account associated with the IMEI number and verifies that the E-PIN code makes it possible to access the retrieved user account. If the check is positive, the secure server generates the ALEA code and stores the ALEA code or seed of that code in memory. This ALEA code is different and completely independent of other ALEA codes generated at other times in step 322 for other users or generated for other uses in other steps, for example in step 302. The ALEA code is not necessarily generated in step 322 but can also be generated at a later step 332 explained later in the description. Indeed, at the end of step 322, the secure server sends the personal equipment, preferably simply a correct code acknowledgment E-PIN, for example in the form of a token E according to the EMV standard.

A transition 735 is validated when the personal equipment E receives the token E. A validation of the transition 735 activates a step 738 in which the personal equipment E which continues the execution of the activated applet, asks the issuing person to specify the beneficiary to add as a secondary user R.

A transition 739 is validated when the transmitting person practices on the personal equipment E, a personal equipment address input (R), for example in the form of a mobile telephone number when the personal equipment R is the mobile phone 4. The issuing person also enters an authorized account alias name of the account, preferably under the control of the issuing person who is the primary account holder.

A validation of the 739 transition activates a step

740 in which the personal equipment E sends to the secure server, the address and the alias name, possibly accompanied by the token E.

A transition 331 is validated when the secure server receives the data transmitted in step 740.

A validation of the transition 331 activates one or more steps 332, 333, 334.

Step 333 is to create a data structure containing a transaction identifier, the destination address which preferably is a secondary user mobile phone number, the primary user IMEI number in other words Personal sending equipment, ALEA withdrawal code, enrollment time range, and hash data.

Step 332 is to send the ALEA code to the sending personal equipment preferably using MS-ISDN (Mobile Station Integrated Services Digital Network) authentication. When the personal equipment E is the mobile phone 7, the ALEA code is sent in an SMS.

Step 334 is to send SMS short message to personal equipment R attributable to the person receiver, a ticket including at least the time slot and the hash data.

A transition 741 is validated when the personal equipment E receives the ALEA withdrawal code.

A transition validation 741 activates a step

742 which consists in visually or vocally displaying the ALEA code for information of the person sending.

A transition 411 is validated when the personal equipment R receives the message associated with the ticket.

A transition 411 validation activates a step

412 which consists in signaling the reception of the message containing data including in particular the time slot and the hash data for information of the receiving person. Preferably, this operation is possible only in the presence of a bank window so as to allow a complementary control operation by human intervention.

With reference to FIG. 5, a transition 411 is validated when the receiving person opens the message received in step 412.

A transition validation 411 activates a step 412 which displays the SMS message on a screen of the personal equipment R. The text of the message contains a request to enter the ALEA withdrawal code.

Peripherally, the sending person calls the receiving person on his / her personal equipment R. When the receiving person picks up, the transmitting person recognizes the tone of his voice or his face when videoconferencing is possible. The sending person can thus ensure that the receiving personal equipment is allocated to the right receiver. After making sure of the receiving person, the transmitting person gives him the ALEA withdrawal code so that the receiving person can then enter the ALEA code into the body of the message opened in step 412. A transition 413 is validated when a response message containing the data and the ALEA code is put in the sending box of the transmitting personal equipment. The received message already containing the data, it is sufficient for the recipient to complete it with the ALEA code to return it as a response message.

A validation of the transition 413 activates a step 414 which consists in sending a tenure request to the secure server SSTF in the form of the response message containing the data and the ALEA code.

A transition 335 is validated when the secure server receives the data and the ALEA code from the personal equipment R.

A validation of the transition 335 activates a step 336 in which the secure server SSTF checks the time slot and verifies that the ALEA code is correlated with the hash data. Manual control can be considered with the operator to identify the secondary user with his actual identity. After positive verification, the secure server SSTF creates a virtual card number associated with the account of the person sending and paired with the personal equipment R of the receiver then listed with the name allias previously communicated. The virtual card can be multi-use or single-use with a PAN (Personal Authentication Number) number generated immediately or later depending on the type of use. The secure server then sends an account creation confirmation by SMS to the personal equipment of the transmitting person who is the main user and to the personal equipment of the receiving person who is the secondary user.

The receipt of a first confirmation SMS by the personal equipment of the transmitting person validates a transition 747 which activates a step 748 of tenure notification carried out. The receipt of a second confirmation SMS by the personal equipment of the receiving person validates a transition 417 which activates a step 418 of tenure notification carried out including a storage or display of the virtual card number contained in the second text message. confirmation.

From this step, a withdrawal of money on a banking terminal with the personal equipment R can be done using a known method of withdrawal based on a mobile phone that emulates a virtual credit card or using a method based on that previously explained with reference to FIG.

To increase the security and allow control of each withdrawal by the main user, the secure server can generate a temporary personal identification number T-PIN for each withdrawal on the model of the ALEA code which is communicated each time orally by the primary user to the secondary user.

FIG. 6 shows the essential steps of the method according to the invention which applies as well to the first embodiment presented with reference to FIGS. 2 and 3, to the second embodiment presented with reference to FIGS. 4 and 5 or to any other Another embodiment that requires to ensure that receiving personal equipment participating in a teletransmission is actually allocated to the receiver that a person transmitting wishes to benefit from the object of the teletransmission.

The secure teletransmission method ordered by the transmitting person 11 to the receiver 22 includes preparation steps that are performed by means of a first electronic device available to the transmitting person to order the remote transmission.

From a standby step 800 of the first electronic device, a transition 809 is validated when the transmitting party indicates the object to which the teletransmission relates and the address, the telephone number or any other suitable type of contact information of the receiving personal equipment.

809 transition validation activates a step

810 which consists of sending a teletransmission request to the secure server SSTF initially in the standby step 300.

In the embodiment of Figures 2 and 3, the first electronic device is typically the first bank terminal 1. In the embodiment of Figures 4 and 5, the first electronic device is typically the mobile phone 7.

In the secure server 3 which is the pivot of the embodiments enabled by the invention, a first main step 802 and a second main step 804 are activated by a transition 801 which is validated when the secure server 3 receives from the first electronic device, the first request containing the designation code of the object and the address of the receiving personal equipment attributable to the receiving person. Receiving personal equipment is typically the mobile phone 4.

The first main step 802 which corresponds to step 302 of FIG. 2 or step 332 of FIG. 4 essentially consists of supplying the first electronic device with an ALEA removal code.

The second main step 804, which corresponds to step 304 of FIG. 2 or step 334 of FIG. 4, essentially consists in providing the receiving personal equipment with a ticket containing data which comprise at least the code of designation of the object to which the teletransmission in clear or encrypted relates.

The receipt of the ALEA code in the first electronic device, validates a transition 811 which activates a step 812 consisting essentially of displaying the code ALEA so as to bring it to the attention of the issuing person.

The reception of all or part of the ticket in the personal equipment receiver, validates a transition 461 which activates a step 462 essentially consisting of storing in the receiving personal equipment, see to display the data of the ticket which are useful to the execution of teletransmission from receiving personal equipment.

The personal equipment E, typically the mobile phone 7, is then used to execute a first peripheral step 762 activated by a transition 761 which is validated when the transmitting person 11 makes a call to the personal equipment receiver R, typically the mobile phone. 4.

The personal equipment R, typically the mobile phone 4, is then used to perform a second peripheral step 464 activated by a transition 463 which is validated when the receiving person 22 takes the call launched from the personal equipment transmitter E.

The peripheral steps 762 and 464 essentially consist in allowing the transmitting person 11 to recognize the receiving person 22 so as to ensure that the receiving personal equipment R is actually allocated to the receiving person 22 so as to communicate to him the code of reception. ALEA withdrawal vocally or televisually for a hearing impaired person.

A second electronic device initially in a standby step 900, typically the bank terminal 5 for the embodiment of FIGS. 2 and 3 or the mobile telephone 4 for the embodiment of FIGS. 4 and 5, is used to perform a code communication step 904. ALEA and data by the receiver to the secure server. Step 904 is activated by a transition 903 which is validated when the data and the ALEA code are introduced in the second electronic device.

When the second electronic device is the bank terminal 5, the data displayed in step 462 and the ALEA code communicated in step 464 are inputted by the receiving person.

When the second electronic device is the mobile phone 4, the data stored in step 462 already reside in the second electronic device. Only the ALEA code communicated in step 464, is introduced by the receiving person.

A third main step 366 is activated by a transition 365 which is validated when the secure server 3 receives from the second electronic device 4 or 5, the ALEA withdrawal code and all or part of said data comprising at least the designation code of the object as a second request.

The third step 366 which corresponds to the step 306 of FIG. 2 or the step 336 of FIG. 3 essentially consists in checking a concordance between the ALEA retrieval code and at least the designation code of the object for provide the object of teletransmission to the receiver 22 when the concordance of the codes is positively verified.

Incidentally, a step 764 is activated by a transition 763 which is validated when the personal equipment E receives a report of the teletransmission from the secure server 3. The step 764 essentially consists of displaying the report.

Claims

A secure teletransmission method ordered by a transmitting person (11) to a receiving person (22) comprising:

a first main step (802, 302, 332) and a second main step (804, 304, 334) activated when a secure server (SSTF) receives from a first electronic device (1, 7) a first request containing a designation code of an object to which the teletransmission relates and a receiving personal equipment address (R) attributable to the receiving person;

said first main step (802, 302, 332) of providing said first electronic device with a first ALEA and sending said first removal code to the receiving personal equipment by the first electronic device;

said second main step (804, 304, 334) of providing to said receiving personal equipment a ticket containing data comprising at least a second Hash Data of the object to which the teletransmission relates; and

a third main step (366, 306, 336) activated when the secure server (SSTF) receives from a second electronic device (4, 5) a second request containing the first withdrawal code (ALEA) and the second withdrawal code (Hash Data);

said third step (366, 306, 336) of checking a match between the first retrieval code (ALEA) and the second retrieval code to provide said object to the receiving person (22) when the code concordance is positively verified .

2. Method according to claim 1, characterized in that the first withdrawal code (ALEA) and the ticket comprising at least the second removal code (Hash Data) are transmitted to the receiving personal equipment by two different transmission paths for enhance security.

3. Method according to claim 2, characterized in that the first electronic device sends the first withdrawal code (ALEA) to the receiving personal equipment in a humanly controllable manner, preferably vocally, directly or by means of a telephone.

4. Method according to one of claims 2 or 3, characterized in that the ticket containing data comprising at least the second removal code (Hash Data) is transmitted by the secure server (SSTF) to the receiving personal equipment advantageously as a short message (SMS).

5. Secure remote transmission method according to one of claims 1 to 4, characterized in that it comprises:

a first peripheral step (762) activated when the transmitting person (11) initiates a call from a personal sending equipment (E) to the receiving personal equipment (R);

a second peripheral step (464) activated when the receiving person (22) takes the call launched from the transmitting personal equipment (E);

said first peripheral step (762) and said second peripheral step (464) of allowing the transmitting person (11) to recognize the receiving person (22) to ensure that the receiving personal equipment (R) is actually allocated to the receiving person (22) by communicating to him the withdrawal code

(ALEA).

6. Secure remote transmission method according to one of claims 1 to 5 wherein the first electronic device is a first terminal (A), the second electronic device is a second terminal (B) and comprising:

a formulation step (108) in which the first terminal (A) receiving a verification token (E) requests the transmitting person (11) to indicate the designation code of the object to which the transmission relates;

a request step (110) in which said first terminal (A) transmits to the secure server (SSTF) a request comprising said token (E) and said designation code to request the secure server (SSTF) to provide the code withdrawal (ALEA);

a signaling step (112) in which the first terminal (A) communicates the withdrawal code (ALEA) to the transmitting person (11); and

a step (506) of distribution in which the second terminal (B) terminates the transmission by delivering the object after receiving the withdrawal code and the designation code entered by the receiving person (22) and receiving an authorization issued by the secure server (SSTF) to confirm a correlation of the withdrawal code entered with the verification token.

7. Process according to claim 6, characterized in that:

in step (108) the first terminal (A) requests the person sending (11) to indicate at least one unambiguous nominative code of the person receiving and / or the person sending; and

in the request step (110), said first terminal (A) places the said unambiguous nominative code (s) in the request sent to the secure server (SSTF).

8. The method of claim 7 characterized in that in step (506) the second terminal (B) delivers the object after additional reception of said at least one univocal nominative code entered by the receiving person.

9. The method of claim 7 or 8, characterized in that said unambiguous nominative code is a telephone number.

10. Method according to one of claims 7 to 9 characterized in that said unambiguous nominative code is a telephone number of the receiving person and in that the receiving person receives by telephone the designation code on a first communication channel bound to the secure server and the withdrawal code on a second communication channel linked to the person sending.

11. Secure remote transmission method according to claim 5 wherein the first electronic device is the transmitting personal equipment (E) to access a secure server controlled account (SSTF) and the second electronic device is a terminal (B). ), characterized in that it comprises a sub-account creation step (333) accessible from the receiving personal equipment (R) when the secure server (SSTF) receives an add request from the personal equipment (E), and that the data provided in the second main step includes sub-account access information.

12. Secure remote transmission method according to one of the preceding claims, characterized in that it comprises:

a step of displaying (402, 412, 462) data received from the secure server (SSTF) by the receiving personal equipment;

- An authorization request step (504) sent to the secure server (SSTF) when said received data is entered with the access code (ALEA) in the terminal (B).

13. Method according to one of the preceding claims, characterized in that a temporally and / or spatially limited validity is associated with the withdrawal code.

14. Method according to one of the preceding claims, characterized in that said object is a sum of money and in that said designation code is an amount of the sum of money.

15. Method according to claim 1 to 5, characterized in that said object is a sub-account, in that said designation code is a user alias name of the sub-account and in that the second electronic device is personal equipment receiver.

16. The method of claim 15, characterized in that in the third main step (336), the secure server (SSTF) creates a virtual card number.

17. Secure teletransmission system for a receiving person (22) ordered by a transmitting person (E) comprising:

- a first electronic device (1, 7) available to the person transmitting;

- personal receiving equipment (4) attributable to the receiving person (22);

a secure server (3) comprising a program for providing a withdrawal code (ALEA) to the first electronic device and for supplying a designation code of an object on which the remote transmission to the personal equipment is carried out ( 4);

- and

a second electronic device (4,5) comprising an interface for enabling the receiving person (22) to enter at least the withdrawal code, means of connection to the secure server

(3) to issue the withdrawal code and the designation code and to receive authorization from the secure server (3) which confirms a correlation of the withdrawal code entered with the designation code, and means for automatically issuing the object after receiving said authorization.

18. System according to claim 17, characterized in that it comprises a transmitting personal equipment (7) allowing the transmitting person (11) to call the receiving personal equipment (4) to ensure that the personal equipment receiver (4) is actually allocated to the receiver (22).

19. The system of claim 17 or 18 characterized in that the first electronic device is a first terminal (1) comprising an interface arranged to ask the transmitting person (11) to indicate at least one unambiguous nominative code of the receiving person. and / or the sending person so as to place the unambiguous name (s) code (s) in a request sent to the secure server (3).

20. The system of claim 19 characterized in that the second electronic device is a second terminal (5) arranged to deliver the object after additional reception of said at least one univocal nominative code entered by the receiving person.

21. System according to claim 19 or 20, characterized in that said unambiguous nominative code is a telephone number.

22. System according to one of claims 19 to 21 characterized in that said unambiguous nominative code is a telephone number of the receiving person and in that the receiving person receives by telephone the designation code on a first linked communication channel. to the secure server and the withdrawal code on a second communication channel linked to the person sending.

23. The secure remote transmission system as claimed in claim 18, in which the first electronic device is the transmitting personal equipment (7). containing a program for accessing an account controlled by the secure server (3) and the second electronic device is personal receiving equipment (4), characterized in that the secure server (3) is arranged to receive a request for adding from the personal equipment (7), to create a subaccount accessible from the receiving personal equipment (4) and to transmit to the receiving personal equipment (4) data including access information to the subaccount.

24. System according to one of claims 17 to 23, characterized in that the secure server (3) is arranged to temporally and / or spatially limit a validity associated with the withdrawal code.

25. System according to one of claims 17 to 24, characterized in that said object is a sum of money and in that said designation code is an amount of the sum of money.

26. System according to claim 17, characterized in that said object is a sub-account, in that said designation code is a user alias name of the sub-account and in that the second electronic device is the equipment. receiving staff (4).