AU709926B2 - A secure transaction terminal - Google Patents

Description

q '1 2 Subscriber's telephone or radiotelephone equipment, with card reader and transaction function, and corresponding keypad layout.

The invention relates to telephone or radiotelephone equipment with a transaction facility, such as individual subscriber's terminal or set with card reader, designed to allow the equipment user to perform transactions with at least one remote transaction server, via a telecommunications network, to which equipment and server have access, in view in particular of obtaining a product or a service, when this transaction involves the use of a card by the user, such as an authorization or credit card with memory and internal logic, and requires that the server be capable of communicating in voice mode. The invention also relates to a keypad layout for the transaction equipment and, especially, for an equipment such as defined above.

Remote purchasing and remote payment of products or services via telephone are known techniques being developed more and more because of the proliferation of transaction servers fitted with some means allowing them to generate and/or 15 interpret voice signals and, consequently, to communicate with users via standard telephone or radiotelephone sets, such as for example those fitted with a keypad having 10 dialling keys and the two additional keys and As it is known, such servers can be used to perform transactions between a user and a remote product or service supplier, via a telecommunications network to which users and suppliers have S 20 access. These transactions can be very different from one another and, although some can be simple, for instance in the case of a request and granting of an authorization to do something, they can also be very elaborate and involve a series of complex S~.operations, thus involving exchange of information between user and supplier and, consequently, between subscriber equipment and transaction server.

As it is known, cards, and notably memory cards with internal logic, are a convenient way of providing identification allowing their holders to be recognized as authorised to obtain products or services from suppliers and allowing the latter to be paid.

A known remote purchasing and remote payment process involves notably that a user having called a transaction server via a telephone transmits to this server, the number of a credit card he owns, following an express voice request generated by the server called. This card number is for example entered on the user's telephone keypad and is transmitted via telephone in the same manner as the dialling signals transmitted by the telephone set after having been generated via the same keypad during any call from this telephone set. It is therefore relatively simple for someone ill-intentioned to find out the card number thus transmitted by a user to a server.

Consequently, better security features are required.

Therefore, the invention proposes a subscriber's telephone or radiotelephone equipment with electronic card reader and transaction function facility, designed to allow transaction operations involving the use of a card, preferably a card with internal memory and internal logic, to take place with at least one transaction server via a telecommunications network to which both equipment and server have access, notably in view of obtaining a product or a service. The equipment is fitted with a hardware locking device enclosing at least one equipment management microcontroller in a module and disabling this equipment in case an attempt is made 15 to open the module.

According to an embodiment of the invention, this equipment is fitted with some means designed to ensure confidentiality of the information entered via a keypad which is part of the equipment, and to be transmitted to a card, via the card reader, the said means including a hardware device disabling the keypad in the event 20 an attempt is made to dismantle it, and a hardware locking device enclosing at least one circuit of the aforesaid keypad in a module, with at least one equipment S* management microcontroller to which the keypad circuit is connected and possibly a part of the card reader of this equipment, the enclosure being such that the module is disabled if an attempt was made at opening it.

The invention also relates to a keypad layout for transaction equipment, with keypad and card reader, especially, reader of cards with internal memory and internal logic, fitted with some means of communication allowing it to transmit and/or receive information.

According to an embodiment of the invention, this layout comprises some means designed to ensure confidentiality of the information entered via the keypad contained in the equipment and to be transmitted to a card, via the card reader, these means including a hardware device disabling the keypad in the event an attempt is made at dismantling it, and a hardware locking device enclosing at least one circuit of the keypad in a module, with at least one management microcontroller to which the keypad circuit is connected and possibly a part of the card reader, the enclosure being such that the module is disabled if an attempt is made at opening it.

The invention, its characteristics and advantages are specified in the following description to be read in conjunction with the single figure described below. This single figure represents a synoptic diagram relating to an example of assembly used to implement the process according to the invention. The assembly shown in figure 1 comprises a telecommunications network 1 to which are notably connected various equipment, including at least a transaction server 2 likely to be used with the telecommunications network 1. This transaction server is, in this instance, assumed to be able to communicate in voice mode with telecommunication equipment, such as telephone and/or radiotelephone sets, or supporting a function of this type, after S 15 communication is established according to a usual call set up procedure Such a transaction server 2 is conventionally fitted with some means which are themselves known, allowing it to be connected to a usual telecommunications network. In the implementation envisaged, transaction server 2 comprises specialized means, themselves known, allowing it to generate voice signals to be sent to equipment such as telephone or radiotelephone sets, and/or to interpret such voice signals coming from such equipment. As it is known, these voice signals may correspond to speech which the users of the above mentioned equipment must be able to interpret. They may also correspond to signalling information transmitted in the voice band as are the signals corresponding to speech.

The organization of such a server is not developed here in so far as it is already known and has no direct relationship with the subject of the present invention.

Telecommunications equipment likely to establish a communication with the transaction server 2, and in particular likely to be a telephone or a radiotelephone, are symbolized by a telephone 3 in figure 1. It must be understood that what is indicated concerning the telephone in the rest of the description equally applies to a radiotelephone terminal which is overall equivalent on a general functional view point. It must also be understood that the invention is not limited to the telephone 3 described hereafter, but may equally apply to other sets or terminals and especially to sets and terminals in an integrated services digital network.

Telephone 3 represented here is assumed to be connected to telecommunications system 1 via a conventional telephone line 4 to which it is connected via the two terminals L1 and L2. A ringing circuit 5 and on input device 6 are assumed to be connected to terminals L1 and L2 according to a usual setting involving a switching mechanism conventionally called switch hook, a component of which itemised CC1 connects the ringing circuit 5 to the telephone line 4, in the absence of communication, when the switch hook is maintained in a first position, for instance by the weight of a handset resting on it (not illustrated). Lifting the handset or an equivalent operation places the component CC1 in a second position such that the input device 6 is connected to terminals L1 and L2 of the telephone line, while the 15 connection between the ringing circuit and this line is interrupted. The telephone 3 is then remotely powered via this telephone line 4, the direct current then obtained is -transmitted to a power circuit 7 supplying the various components to be powered in the telephone set, this power circuit 7 may be connected to an electrical power source available locally if need be, as is known.

The above switching mechanism also comprises a second component itemised CC2 which is activated with component CC1 and which connects a transmission circuit B, included in the telephone set, to a telephone line 4 via the input device 6, **when components CC1 and CC2 are simultaneously placed in their second respective positions. This transmission circuit 8 is in this instance assumed to be conventional, it comprises for instance a signal conversion circuit called two wires/four wires, via which is supplied an audio circuit comprising at least a microphone 10 and a listener or speaker 11. The transmission circuit 8 is also connected to a modem 12 associated with a management microcontroller 13 managing the telephone 3 such that the latter may communicate via the telephone connection 4. A voice frequency signal generator 14 is in this instance assumed to be associated with the modem 12 and the microcontroller 13 such that the latter may send signalling in multifrequency form via the telephone connection 4, notably in response to entries made by a user via a dialling keypad 15 included in the telephone 3. Exchanges between the microcontroller 13, and associated ROM and/or RAM memories 16 occur conventionally in the digital form via a bus type bi-directional connection 17, to which is also connected the modem 12, a display 18 and the keypad 15 or, more precisely, a circuit(s) 15A of this keypad allowing to convert into digital signals, the commands manually generated by a user via the keys included in the keypad. A card reader 19 is, in this instance, associated with the telephone 3, it being for instance housed in this telephone set in order to be able to communicate with a card 20, preferably with internal memory and internal logic, which it houses when this card has been correctly inserted by the user.

As it is known, it may suffice that a card be placed near the reader 19, if this card and this reader are designed to communicate without contact.

When the card 20 is suitable to co-operate with the reader 19, it can exchange 15 information, for instance in digital form, with the telephone 3 and more particularly with the microcontroller 13 it contains. This information can notably be used locally in the telephone set for instance to be displayed on the display 18, or compiled so as to .be transmitted via the telephone connection 4 and, in this instance, via the transmission circuit 8. Others information may be entered by a user via the keypad 20 to be transmitted either to a card 20, or to the telephone connection 4, via the keypad circuit In a preferred form of implementation, for security reasons and to ensure confidentiality of the information generated via the keypad, to be sent to a card 20 via the reader 19, the telephone 3 is fitted with a hardware device disabling the keypad 15 if an attempt has been made at dismantling it.

This is achieved for instance by building a keypad having at least some of its components positioned in a preset manner by a specific set-up during keypad manufacture, which is no longer preserved if an attempt at dismantling it occurs and which is not reproducible once this attempt has taken place.

Furthermore, a prohibitive hardware device is associated with the keypad and ensures the enclosure of the most critical components in the same module designed such that the assembly formed by these components becomes disabled should the module be opened.

This module contains for instance at least the keypad circuit 15A; the microcontroller 13 and at least one of its memories 16 and, when possible, a part of the card reader 19.

Such a module is for instance made in the form of a casing comprising destructive means designed to damage at least one of the enclosed components either directly, or eventually at the level of one or several connections connecting this component to another in the module, for example by breakage, should the casing be opened.

Such a module can also be made in the form of a moulded block in which the components designed to be enclosed are at least partially embedded with their *.*.respective connections.

Measures allowing to render destructive any attempt aiming at opening a 15 module such as described above are known to the man skilled in the art, and they will S* not be discussed here.

Their objective is to prohibit any direct physical intervention on embedded components and, especially, any intervention aiming at modifying the shunting of digital data having a sensitive content with regard to security which are entered by the user via the keypad upon express request from the server and/or the card, and being involved in some operations and especially in case of remote purchasing and/or remote payment of products or services.

*Furthermore, the microcontroller is fitted with some software means which cannot be modified, and qualified here as unalterable, preventing the telephone or radiotelephone transfer of data generated by the keypad, to the card via the card reader. These means constitute, in a known manner, a lock preventing in particular any unscheduled shunting of sensitive digital data which is to be transmitted from the keypad to the card in the conditions described above, i.e. upon specific request from a server for instance.

According to an example of implementation of the invention, the microcontroller is fitted with some known software means designed to encrypt the 8 information sent to a server 2 by a user either via the keypad 15 or a microphone or eventually from a card 20 via the card reader 19.

This encryption is performed for example using a public algorithm based on information supplied by a server 2 and/or by a card, for a given transaction.

According to a further implementation alternative, the microcontroller comprises some known software means designed to allow the use of the keypad for local operation of the card, but not during a communication involving the use of the telecommunications network 1. It is thus possible to perform operations in order to read the data stored in a card and/or to be stored in this card, under the control of the internal logic contained in this card, whereby, whole or part of the data, controls and reports are for instance displayed on display 18 associated with keypad Furthermore, a keypad and a module described above in reference with a telephone equipment can makeup a layout for transaction equipment fitted with a card reader and some means of communication allowing it to transmit and/or receive 15 information. The following description gives an example of implementation of a subscriber's telephone or radiotelephone equipment according to the invention linked to a voice transaction server 2, via a telecommunications network. This example must S not be considered as limitative In general, a transaction between a user having an equipment such as the one S 20 symbolized by telephone set 3 in the figure 1, systematically involves a telephone and or/ radiotelephone call set-up between a telephone such as 3 and a transaction server 2, via a telecommunications network 1, usually initiated by the telephone user or, eventually and alternately, initiated by the server.

Following an exchange of information more or less long, for instance in the form of voice, between telephone set 3 and server 2 in communication, in view of obtaining a product or a service, there is a phase during which a card 20, such as a credit card or equivalent, is to be involved in the exchange procedure in progress between telephone set and server in communication, this involves the use of card reader 19 fitted in the telephone set. It is then followed by a control phase during which the server sends a request to the telephone set, for example in the form of a specific multifrequency signalling and/or in the form of a voice message, asking the 9 set to check that an appropriate and valid card 20 is present and duly connected to the card reader 19 and to ask in this case, that the user of the telephone set enter on its keypad 15 the confidential code number relating to the card, and that this code number be verified by the internal logic contained in this card. In the envisaged implementation, the telephone set microcontroller 13 communicates with the card via the card reader 19 to obtain specific data relating to the conformity and validity of this card, so as to verify that the card used does correspond to a card of the type required for the transaction involved between the server and the telephone set, and that this card is valid. The results obtained are then communicated for information to the server 2 by the telephone set microcontroller 13. The server then asks the user to enter, on the keypad 15 of the telephone 3 used, the confidential code relating to the card 20 he uses, this request being here assumed to occur by the server sending a voice message to the user via the audio circuit 9 of the telephone set.

The entry by the user on the keypad 15 of the digits making up the confidential 15 code triggers the transmission of signals corresponding to these digits to the S telephone set microcontroller 13. As indicated earlier, this microcontroller is here assumed to be contained in an enclosed module together with the circuit(s) involved in the generation of signals resulting from the entry made by the user from the keypad in order to reduce the risks of tapping and fraudulent use of the information entered and, in particular, of the confidential codes. Furthermore, the microcontroller 13 comprises some internal control means, for instance, some unalterable software means, to direct only to card reader 19 the dialling signals corresponding to the digits of the number entered on the keypad 15 which are supplied by this keypad for verification by the internal logic of the card 20 used at that time with the above mentioned card reader. These means are here assumed to be implemented when the telephone 3 receives via the telephone line 4 a request for entry of the confidential code relating to the card 20, this card having internal memory and internal logic, which is used in conjunction with the telephone set, this request being, a priori, assumed to originate from the server 2 then in communication with the above mentioned set.

The result of any verification of the confidential code carried out in known fashion by the card 20 having internal memory and internal logic, is transmitted in digital form by this card to the telephone set microcontroller 13 with which this card is used, via the card reader 19, in view of the transmission of this result to the server 2 with which the set is then in communication, for example under the form of a specific multifrequency signalling.

Communications operations then continue and include at least one transmission phase for the transmission of at least one coded information and, especially, of one identification information relating to the card 20 used in conjunction with the telephone set 3, as well as at least one control information, these items of information being transmitted in voice mode, via this telephone set to the server 2.

In a preferred form of implementation, upon the initiative of the server 2, at least some of the information transmitted is encrypted for reasons of confidentiality, this encryption is performed for example according to one of the techniques known in this matter. The encryption is preferably performed using a known algorithm which 15 therefore does not involve any storage of secret information at telephone set level. It is S for example expected that upon specific request from the server 2, encryption of sensitive information originating from the user is performed by the microprocessor 13 at the telephone set level, using an encryption key then supplied by the electronic payment card used as well as a code provided by the server itself.

20 Of course, as known on the subject, at least part of the operations, especially in the case of remote payment, is likely to be carried out by a specialized server, such as a banking server, not illustrated, which may be different from the server 2 initially in communication with the telephone 3 previously considered, in this case, at least part of the exchange relative to the same communication is at least temporarily rerouted.

The claims defining the invention are as follows: 1. A subscriber's terminal equipment with card reader and transaction function facility, designed to allow transaction operations involving the use of a card, to take place with at least one transaction server via a telecommunications network to which both equipment and server have access, the equipment being fitted with a hardware locking device enclosing at least one equipment management microcontroller in a module and disabling this equipment in case an attempt was made at opening the module, the said equipment being characterised in that it is fitted with first means designed to ensure confidentiality of the information entered via a keypad which is part of the equipment, and to be transmitted to a card, via the card reader, the said first means including a hardware device disabling the keypad in the event an attempt is made at dismantling it, and a hardware locking device enclosing at least one circuit S-of the keypad with the microcontroller to which the this circuit is connected.

2. Equipment as claimed in claim 1, wherein the card includes an internal memory 15 and internal logic.

S 3. Equipment as claimed in claim 1 or claim 2 wherein the hardware locking device also encloses at least a part of the card reader.

4. A terminal equipment in accordance with any one of claims 1 to 3, characterised in that the microcontroller is fitted with some unalterable software means preventing 20 the telephone or radiotelephone transfer of data generated by the keypad to be er etransmitted to a card via a card reader.

5. A terminal equipment in accordance with any one of the preceding claims, characterised in that the microcontroller is fitted with some means designed to encrypt the information sent via the keypad and/or a card and/or a microphone included in the equipment, to a server to which the equipment can be connected via the telecommunications network it uses, based on information supplied by the server via the call set up between them and/or by a card via the card reader.

6. A terminal equipment in accordance with any one of the preceding claims, characterised in that the microcontroller is fitted with some means designed to allow the use of the keypad for local operation of the card, such as read and write operations via the card reader.

Claims (2)

1. 7. A keypad layout for transaction equipment, with keypad and card reader especially for cards with internal memory and internal logic, the keypad layout being fitted with some means of communication allowing it to transmit and/or receive information, said keypad layout being characterised in that it comprises second means designed to ensure confidentiality of the information entered via the keypad and to be transmitted to a card, via the card reader, the second means including a hardware device disabling the keypad in the event an attempt is made at dismantling it, and a hardware locking device enclosing at least one circuit of the keypad in a module, with at least one management microcontroller to which the keypad circuit is connected and possibly a part of the card reader, the enclosure being such that the module is disabled if an attempt is made at opening it.
2. 8. A subscriber's terminal equipment substantially as herein described with reference to the accompanying drawing. p 15 DATED THIS TWENTY-EIGHTH DAY OF JANUARY 1997 "I ALCATEL ALSTHOM COMPAGNIE GENERALE d'ELECTRICITE ABSTRACT Subscriber's terminal equipment, with card reader and transaction function, and corresponding keypad layout, designed to allow transaction operations, involving the use of a card (20) such as a credit card, to take place with at least one transaction server via a telecommunications network the equipment being fitted with protection means designed to ensure confidentiality of the information entered via a keypad (15) and to be transmitted to a card the protection means include a hardware device disabling the keypad in the event an attempt was made at dismantling it, and a hardware locking device enclosing at least one circuit (15A) of the keypad in a module, with at least one equipment management microcontroller (13) to which the keypad circuit (15A) is connected and a part of the card reader (19) of this equipment. Figure to be published: Single figure. 6 6*O@@S *e o