FR2927750A1 - Electronic payment terminal e.g. chip card reader, for exchanging e.g. confidential data, over Internet network, has security module removing private key based on reception of alarm signal provided by intrusion detector - Google Patents

Abstract

The terminal has a microprocessor (22) connected to a man-machine interface (27) and for realizing payment operations to be controlled by users. RAM (24) stores data representing a user profile for each operation and each user, where the data comprises an identifier of the profile and a certificate with a public key of the profile. RAM (23) stores data representing a private key of the profile. An intrusion detector (30) detects unauthorized access to the terminal, and a security module (29) removes the private key based on reception of an alarm signal provided by the detector. An independent claim is also included for a method for utilizing a payment terminal.

Description

B8457 - 13834 / Monetel 1 ELECTRONIC PAYMENT TERMINAL FOR SECURE DATA EXCHANGE ON AN OPEN NETWORK

FIELD OF THE INVENTION The present invention relates to electronic payment terminals adapted to exchange data over an insecure network or an open network, in particular the Internet network. Description of the Prior Art In order to carry out certain payment transactions, an electronic payment terminal such as, for example, a card reader (chip cards and / or magnetic cards), or a check reader, etc., may be brought to exchange data with a computer, or server, via a data exchange network. For payment transactions, dedicated networks are conventionally used which, by virtue of their realization, are difficult to access to unauthorized third parties, which makes it possible to exchange confidential data in a secure manner. The current trend is towards the realization of payment transactions, by electronic payment terminals, implementing the exchange of data on so-called open networks, that is to say to which access is not restricted. , for example the Internet network. A difficulty then consists of B8457 - 13834 / Monetel

2 ensure that the level of security of data exchange on the open network is sufficient in view of the specific risks of open networks. To do this, the exchange of data is achieved by the implementation of secure exchange protocols such as, for example, the SSL protocol (acronym for Secure Sockets Layers), the ILS protocol (acronym for Transport Layer Security). , IPSEC (Internet Protocol Security), etc. Most of the protocols for securing data exchange between a client and a server aim at providing the following functions: first, authentication of the server and possibly the client; second, the confidentiality of the exchanges; and third, the integrity of the data exchanged. For most SSL and TLS protocols, the first function is provided by the certificate exchange between the client and the server. A certificate is an identity card of its owner. It is issued by an organization, or certification authority, to which participants in the data exchange place their trust. One difficulty comes from the implementation of security protocols for the exchange of data between an electronic payment terminal and a server, in particular with regard to the first function provided by the security protocols. Indeed, an electronic payment terminal is generally adapted to operate in an environment called "multi-applications". This means that the same electronic payment terminal can perform different functions or applications such as payment by smart card, magnetic card, check, etc. In addition, an electronic payment terminal is generally adapted to operate in a so-called "multi-user" environment. This means that different users can use the same payment terminal. It can then be difficult B8457 - 13834 / Monetel

3 to ensure proper authentication of the electronic payment terminal and the server between which data must be exchanged taking into account the user who manipulates the payment terminal and the type of payment transaction performed. In addition, for payment transactions, it is generally necessary to comply with additional security rules specific to payment terminals, which notably require the protection of certain so-called sensitive data used to carry out payment transactions.

SUMMARY OF THE INVENTION An embodiment of the present invention is an electronic payment terminal adapted to exchange data with a server on an open network during a payment transaction, the terminal being adapted to operate in a multi-user environment. applications and multi-users while respecting the security rules specific to the realization of electronic payment transactions. Thus, an aspect of the present invention provides an electronic payment terminal adapted to exchange data with servers on a network. The terminal comprises an interface intended to be handled by several users, a microprocessor connected to the interface and adapted to perform several types of payment transaction, the realization of each type of payment transaction being able to be controlled by at least one one of the users, and a first memory in which are stored for each type of payment transaction and for each user able to control the realization of said type of payment transaction, first data representative of a user profile comprising: a user profile identifier; a certificate of the user profile including a public key of the user profile; and at least one root certificate of a CA associated with one of the servers and including a public key of the CA.

B8457 - 13834 / Monetel

4 The terminal further comprises a second memory in which are stored, for each user profile, second data representative of a private key of the user profile, at least one detection module unauthorized access to the terminal and a security module adapted to erase the private keys upon receipt of an alarm signal provided by the detection module. According to an embodiment of the present invention, the first memory further comprises, for each user profile, third data representative of the position, in the second memory of the second data representative of the private key of said user profile. . According to one embodiment of the present invention, the microprocessor comprises a module for reading smart cards, magnetic cards and / or checks. According to one embodiment of the present invention, the microprocessor is adapted to read and / or modify the first and second data associated with a single user profile at a time. Another aspect of the present invention provides a method of using the payment terminal as previously defined during an authentication phase when exchanging data with one of said servers over a network, said server comprising a certificate server issued by the associated certification authority. The method includes the steps of selecting one of the user profiles, transmitting to the server a server certificate request, receiving said server certificate, verifying the validity of the server certificate with the public key of the server certificate. associated certification authority and, optionally upon request from the server, to transmit the certificate of the selected user profile to the server. According to an embodiment of the present invention, the method comprises, when creating at least one of the user profiles, the steps of providing at least B8457 -13834 / Monetel.

fourth data stored in the first memory representative of an initialization profile comprising at least the root certificate of one of the certification authorities, to determine, for said user profile, the private key of the user profile and the public key of the user profile, to transmit, to said certification authority, a certificate request of the user profile, to receive from the certification authority the certificate of the user profile and to store the certificate of the user's certificate. user profile in the first memory. According to an embodiment of the present invention, the method further comprises the steps of transmitting, to said certification authority, a request from the root certificate of the certification authority, receiving the root certificate and verifying the validity of the root certificate received from the root certificate of the initialization profile. According to an embodiment of the present invention, the method further comprises the step of receiving from the certification authority the identifier of the user profile. According to one embodiment of the present invention, the fourth data further comprises a public key of the initialization profile, the method of providing fifth data stored in the second memory representative of a private key of the profile. initialization, and to establish a communication with the certification authority by respecting a security protocol using the private key and the public key of the initialization profile. BRIEF DESCRIPTION OF THE DRAWINGS These and other objects, features, and advantages will be set forth in detail in the following description of a particular non-limiting embodiment in connection with the accompanying drawings in which: FIG. a schematic perspective view of an example of an electronic payment terminal; B8457 -13834 / Monetel

FIG. 2 schematically represents an example of distribution of user profiles at the electronic payment terminal; Figure 3 schematically shows the data associated with a user profile; FIG. 4 schematically represents internal components of the payment terminal of FIG. 1; Figure 5 shows, in the form of a block diagram, the initial steps of an exemplary method of exchanging data between an electronic payment terminal and a server; and Figure 6 shows, in the form of a block diagram, an example of a method of creating a user profile. DETAILED DESCRIPTION For the sake of clarity, the same elements have been designated with the same references in the various figures. In addition, only the elements necessary for understanding the present invention have been shown in the figures. FIG. 1 schematically represents an exemplary embodiment of a TPE electronic payment terminal, corresponding, for example, to a card reader and / or a check reader. The terminal TPE comprises a housing 12 at which are provided a display screen 14 and a keyboard 16. In addition, an opening, not shown, is provided in the housing 12 to allow the introduction of a smart card or a magnetic card. Another opening, not shown, can be provided in the housing 12 to allow the introduction of a check. A cable 18, connected to the terminal TPE, makes it possible to connect the terminal TPE to a data exchange network, for example the Internet network. A cable 19, connected to the terminal TPE, makes it possible to connect the terminal TPE to a power supply network, for example the sector. So that the terminal TPE can be used by several users and can perform several functions or B8457 - 13834 / Monetel

7 applications, such as an electronic payment transaction from a smart card, a magnetic card, a check, etc., it is planned to store in the terminal TPE, for each function, a profile user for each user who can implement the function. The user profiles are used when exchanging data between the terminal TPE and a server to enable the authentication of the terminal and the server according to the exchange security protocol used, for example a protocol of the SSL version 3.0 type. . FIG. 2 illustrates an example in which the terminal TPE is capable of performing a payment transaction by credit card and a payment operation by check. As an example, for the credit card payment function, four Profile 'to Profile4 user profiles are created and for the check payment function, three ProfilA Profile user profiles are created. Figure 3 illustrates the data stored at the TPE terminal for each user profile. The Profili user profile associated with a user UT and a function F comprises the following data: an identifier 40 (Profiler ID) of the user UT; for each server with which the terminal TPE can exchange data on an open network when it is used by the user UT to perform the function F, the certificate 42 CAN, i), also called root certificate, of the CA certification authority of the server and the address 43 (address_IP ', i, ..., address_IPN, i) of the server on the network; a certificate 44 (C_TPEi) of the user profile which corresponds to a certificate of the terminal TPE associated with the user UT for the function F; and a private key 46 (KS_TPEi) of the user profile which corresponds to a private key of the TPE terminal associated with the user UT for the function F.

B8457 - 13834 / Monetel

As will be described in more detail below, the root certificates CA1, i, CAN, i and the certificate C_TPEi of the terminal TPE are used during initial authentication steps during a data exchange between the terminal. TPE and a server. The private key KS_TPEi is used for the encryption of the data exchanged between the terminal TPE and the server, generally after the authentication phase. In one example, the private key KS_TPEi is used to perform the data exchange between the terminal TPE and the server in asymmetric encryption. According to another example, when the SSL protocol is implemented, the private key KSTPEi of the terminal TPE is used for the determination of a session key by means of which the data exchange between the terminal TPE and the server is realized according to symmetric encryption. The C_TPEi certificate corresponds, for example, to the X.509 standard of the ITU (International Telecommunications Union). It is issued by a certification authority. It is divided into two parts, a first part containing information and a second part corresponding to the signature (thumbprint) of the issuing certification authority. The first part includes the following data: the version of the X.509 standard to which the certificate corresponds; the serial number of the certificate; the encryption algorithm used to sign the certificate; the name, in English Distinguished Name or DN, of the issuing CA; the date of the beginning of validity of the certificate; the expiry date of the certificate; the purpose of using the public key; and the public key of the certificate owner (ie the terminal for the user profile considered). 30 B8457 - 13834 / Monetel

9 The second part of the certificate corresponds to a signature issued by the certification authority. The signature (in English thumprint) is obtained by applying a hash function to the data of the first part to obtain a digest (in English message digest). This digest is then encrypted using the private key of the certification authority. CAN root certificates, i may have a structure similar to that of the CTPEi certificate. They are generally said to be self-signed insofar as the certification authority signs its own certificate. FIG. 4 schematically represents certain internal electronic components of the terminal TPE of FIG. 1. The terminal TPE comprises a supply terminal B1 to which is connected the supply cable 19 which connects the terminal TPE to a source of power. Power supply 20 (Main Power) providing a main supply voltage. The terminal TPE comprises a microprocessor 22 (1P), powered by the main supply voltage, which performs, in normal operation, the conventional operations of the terminal TPE. The terminal TPE further comprises two RAMs 23, 24 (RAMI, RAM2) in which the microprocessor 22 is adapted to read and write data. The microprocessor 22 is connected to a communication module 25 (Communication Module) corresponding, for example, to a modulation / demodulation device. The terminal TPE comprises a terminal B2 connected to the module 25 and connected to the cable 18. The microprocessor 22 can exchange data with a SERVER server via the module 25 and a data exchange network 26 (Internet), for example the Internet network. The microprocessor 22 is, in addition, connected to a human-machine interface 27 (Interface) including in particular the keyboard 16 and the screen 14. Finally, the microprocessor 22 is connected to a module for reading cards and / or checks 28 (Reader).

B8457 - 13834 / Monetel

The TPE terminal further comprises a security module 29 (Security Module). The security module 29 is a logic circuit which has a simpler structure than the structure of the microprocessor 22. In normal operation, the security module 29 is powered by the main supply voltage. The security module 29 can exchange data with the microprocessor 22 and at least perform write operations in the memory 23. The security module 29 is connected to one or more intrusion detection devices 30 (Intrusion Detector) equipping the TPE terminal. Each detection device is adapted to detect unauthorized access to the terminal TPE and then to provide an alarm signal to the security module 29. The security module 29 may decide that unauthorized access takes place at the reception of one of the alarm signals.

When the security module detects an unauthorized access, it controls the erasure of at least some of the data stored in the memory 23, called sensitive data. In normal operation, the security module 29 is powered by the main supply voltage. When the main supply voltage is not present, the security module 29 is powered by an emergency power source 31 (Emergency Power) providing a backup power supply. The elements of the terminal TPE which are not operative when the main supply voltage is not present and, above line 32, the elements of the terminal TPE which are not functional, are arranged below a dashed line 32. , when the main supply voltage is not present, continue to operate while being powered by the emergency supply voltage, possibly in a mode of operation different from the normal operating mode. When the main power supply voltage is not present, the security module 29, powered by the emergency power source 31, continues to operate and can therefore erase the sensitive data stored in the memory 23 when access is not available. allowed is detected.

B8457 - 13834 / Monetel

By way of example, three profiles of user Profil ', Profil2 and ProfilA have been represented stored in the memories 23, 24. The profiles Profil' and Profil2 are associated with a first application and the profile ProfilA is associated with another one. application. More precisely, for each Profili user profile, all the data of the profile are stored in the memory 24 with the exception of the private key KS_TPEi which is stored in the memory 23. Each profile Profili then comprises an additional data Pointeri, stored in the memory 24, which is representative of the position of the private key KS_TPEi in the memory 23. The private keys KS_TPEi are part of the sensitive data stored in the memory 23 which are erased when unauthorized access to the terminal TPE is detected by the security module 29.

The microprocessor 22 is controlled so that only a user of the TPE terminal with sufficient access rights can modify the data of the user profiles Profil ', Profil2, ProfilA once they are created. In addition, the modification of data in a user profile can only be done profile by profile. In addition, the microprocessor 22 can only use the data of only one user profile at a time. The user profiles are therefore stored "sealed" in the memories 23 and 24, which is illustrated by the double vertical bars 34.

FIG. 5 illustrates an example of steps of the authentication phase during a data exchange between the TPE terminal and a SERVER server. On the left-hand side of FIG. 5, the operations carried out at the TPE terminal are shown and, in the right-hand part, the operations performed at the server SERVER are shown. Line 50 represents an open network, for example the Internet, through which data is exchanged between the TPE terminal and the SERVER server. The method begins at step 60 at which the application for use by the terminal is selected. Step B8457 - 13834 / Monetel

12 60 can be performed by a voluntary action of the user, for example by the manual introduction of a code by means of the keyboard 16. Step 60 can be performed automatically, the terminal determining that a payment transaction by card must be performed by the introduction of a card in the reading module 28. The method continues in step 62. In step 62, it is determined, for the selected application, which user profile must be used. To do this, the terminal can display the list of user profile identifiers on the screen 14 and the user can select one via the keyboard 16. The process continues in step 64. step 64, the user selects the server with which the terminal must exchange data in the case where the selected user profile provides the choice between several possible servers. To do this, the terminal can display the list of possible servers on the screen 14 and the user can select one through the keyboard 16. The process continues in step 66. Step 64 may This is done once, the selection of the server by the user is then stored and then this selection is performed automatically during a new exchange of data when the same application and the same server are selected. In step 66, the terminal transmits to the server a data exchange request (Hello message) using the server address stored in the user profile. The request may include data necessary for the smooth running of the data exchange. It is, for example, the type and the version of the data exchange security protocol used, a session identifier, the list of encryption algorithms that the terminal can use in order of preference, etc. The process continues at step 68.

B8457 - 13834 / Monetel

In step 68, the server transmits to the terminal a message that may include data necessary for the smooth running of the data exchange. This is, for example, the encryption algorithm that has the highest preference in the list provided by the terminal and that the server can use. The server certificate is also transmitted to the terminal. The server certificate can have the same format as the C_TPEi certificate of the terminal described previously. It includes, in particular, the public key of the server. The server certificate was issued (and signed) by the certificate authority whose root certificate is stored in the selected user profile. The server can, in addition, sign the transmitted message. To do this, the server applies a hash function to the transmitted message to obtain a digest that is encrypted with the private key of the server. The result of the encryption corresponds to the signature, or seal, of the server. Finally, the server transmits a certificate request to the terminal. The method continues in step 70. In step 70, the terminal verifies the validity of the server certificate. To do this, the terminal applies on the one hand the hash function to the first part of the server certificate to obtain a first digest. On the other hand, the terminal decrypts the signature of the server certificate with the public key of the certification authority that is stored in the user profile. He then gets a second digest. The server certificate is valid if the first and second digests are identical. The terminal can, in addition, check the validity of the received message. To do this, the terminal applies on the one hand the hash function to the message sent by the server to obtain a first digest. On the other hand, the terminal decrypting the signature of the server with the public key of the server that is included in the server certificate. He then gets a second digest. The message is valid if the first and second digests are identical. If the server certificate and the received message are valid, the terminal transmits the B8457 -13834 / Monetel

14 certificate from the user profile to the server. The terminal may further indicate to the server which encryption algorithm will ultimately be used. In the case of an exchange security protocol of the SSL type, the terminal also transmits to the server a master key which is encrypted with the public key of the server. The method continues in step 72. In step 72, the server verifies the validity of the certificate of the user profile and the validity of the message transmitted by the terminal in a manner similar to that described above. If the user profile certificate and the message sent by the terminal are valid, the data exchange itself can begin. To do this, in the case of an SSL type security protocol, the server decrypts the master key transmitted by the terminal with the private key of the server and the data exchanges between the terminal and the server are performed by encrypting the data. exchanged by symmetric encryption using keys obtained from the master key. FIG. 6 represents an exemplary method of creating a user profile in the TPE terminal. On the left-hand side of FIG. 6, the operations performed at the TPE terminal are represented and, in the right-hand part, the operations performed at the level of the CA certification authority adapted to issue the terminal certificate and the certificates are represented. the roots of the CAs associated with the servers with which you want to exchange data. Initially, the TPE terminal includes an initialization profile. Compared to the user profile described above, the initialization profile does not include a terminal certificate. In the case where the security protocol used requires it, the initialization profile may further comprise an initial KPINI public key and an initial private KSINI key, provided for example by the TPE terminal manufacturer or by an authorized organization. In addition, the initialization profile includes the B8457 - 13834 / Monetel certificates

15 roots of the most commonly used certification authorities when performing electronic payment transactions. The method begins in step 100 by triggering an initialization program at the terminal for creating a user profile. The initiation of the initialization program can be obtained by a manual operation of the user. The method continues in step 102. In step 102, the terminal determines a private key KS_TPEi and a public key KP_TPEi of the user profile being created. These keys are obtained by the algorithm defined by the asymmetric encryption method implemented by the terminal. The method continues in step 104. In step 104, the operator selects in the initialization profile, the address of the certification authority that corresponds to the application and user considered. The terminal then begins the exchange of data, for example according to an SSL security protocol, with the certification authority selected. In the case of a single authentication SSL type security protocol, only the identity of the certification authority is verified by the terminal. Initial private and public keys are not required. The terminal transmits to the certification authority a data exchange request (Hello message). The method continues in step 106. In the case of a double authentication protocol, authentication of the terminal can be performed. In step 106, the root certificate of the certification authority is transmitted to the terminal. The process continues at step 108.

In step 108, the terminal verifies the validity of the root certificate of the certification authority. To do this, the terminal applies the hash function to the first part of the root certificate to obtain a first digest and decrypts the signature of the root certificate with the public key of the certification authority stored in the profile B8457 -13834 / Monetel

16 initialization to obtain a second digest. The transmitted root certificate is valid if both digests are identical. In the case where authentication of the terminal by the certification authority is provided, the terminal can transmit the initial public key KSINI to the certification authority. The terminal transmits, in addition, a signature that is encrypted with the initial private key KSINI of the terminal. In the case of an exchange security protocol of the SSL type, the terminal transmits to the certification authority a master key which is encrypted with the public key of the certification authority. The sequence of exchanges is then encrypted, for example according to a symmetric encryption from keys derived from the master key. The terminal transmits to the CA a user profile certificate request.

The certificate request message may include: an identification of the terminal, for example the serial number, a manufacturer's reference, etc .; the public key KPTpE of the considered user profile; optionally, a password corresponding, for example, to a sequence of digits entered by the user on the keyboard 16. This password is used to identify the terminal and is issued in advance by the certification authority to the user. terminal, for example by e-mail, telephone, fax, etc. In step 110, the certification authority transmits to the terminal the certificate C_TPEi of the user profile including the signature of the certification authority. In addition, the CA provides the root certificates of the certificate authorities for the created profile. It also sends the ID Profili ID of the user profile that will be used later. The process continues in step 112. In step 112, the terminal creates the user profile from the data provided by the certificate authority. B8457 - 13834 / Monetel

17 tion. The profile created is therefore available for the various applications and / or users likely to use it. For each user profile, it may be necessary to renew the certificate of the C_TPEi profile when its end of validity date is reached. A renewal operation can be implemented by a method analogous to the previously described method of creating a user profile, with the difference that the terminal can start the data exchange by transmitting the certificate of the user profile C_TPEi to replace to be authenticated by the CA. Particular embodiments of the present invention have been described. Various variations and modifications will be apparent to those skilled in the art. In particular, the embodiments of the invention have been described for a particular structure of the electronic payment terminal. However, it is clear that the present invention can be applied to an electronic payment terminal whose structure is different, for example an electronic payment module integrated in sales machines and therefore having different interface.

Claims (9)

An electronic payment terminal (EPT) adapted to exchange data with servers on a network (26), comprising: an interface (14, 16) for manipulation by a plurality of users; a microprocessor (22) connected to the interface and adapted to perform several types of payment transaction, the realization of each type of payment transaction can be controlled by at least one of the users; A first memory (24) in which are stored for each type of payment transaction and for each user able to control the realization of said type of payment transaction, first data representative of a user profile comprising: user profile identifier; a certificate of the user profile including a public key of the user profile; and at least one root certificate of a certificate authority associated with one of the servers and comprising a public key of the certification authority, a second memory (23) in which are stored for each user profile, second data representative of a private key of the user profile; at least one module for detecting an unauthorized access to the terminal; and a security module adapted to erase the private keys upon receipt of an alarm signal provided by the detection module. Terminal according to claim 1, wherein the first memory (24) further comprises, for each user profile, third data representative of the position, in the second memory (23) of the second data representative of the private key of said user profile.B8457 - 13834 / Monetel 19 Terminal according to claim 1 or 2, wherein the microprocessor (22) comprises a module (28) for reading smart cards, magnetic cards and / or checks. 4. Terminal according to any one of claims 1 to 3, wherein the microprocessor (22) is adapted to read and / or modify the first and second data associated with a single user profile at a time. 5. A method of using the payment terminal according to any one of claims 1 to 4 during an authentication phase during a data exchange with one of said servers on a network, said server comprising a server certificate issued by the associated CA, comprising the following steps: selecting one of the user profiles; transmit to the server a request for the server certificate; receive said server certificate; verify the validity of the server certificate with the public key of the associated CA; and possibly, upon request from the server, transmit the certificate of the selected user profile to the server. 6. A method of using the payment terminal according to any one of claims 1 to 4, when creating at least one of the user profiles, comprising the following steps: providing at least fourth data stored in the first memory (24) representative of an initialization profile comprising at least the root certificate of one of the certification authorities; Determining, for said user profile, the private key of the user profile and the public key of the user profile; transmitting, to said certification authority, a certificate request of the user profile; 20B8457 -13834 / Monetel 20 to receive the certificate of the user profile from the CA; and storing the certificate of the user profile in the first memory. The method of claim 6, further comprising the steps of: transmitting to said certification authority a request for the root certificate of the certification authority; Receive the root certificate and verify the validity of the root certificate received from the root certificate of the initialization profile. The method of claim 6 or 7, comprising receiving from the certification authority the identifier of the user profile. The method of any one of claims 6 to 8, wherein the fourth data further comprises a public key of the initialization profile, the method of providing fifth data stored in the second memory (23) representative a private key of the initialization profile, and to establish a communication with the CA by respecting a security protocol using the private key and the public key of the initialization profile.