EP1044435B1 - Method and device for processing confidential codes - Google Patents

Abstract

The invention concerns a method for processing confidential codes in a system with security functions (180) consisting in receiving a code; verifying a first clearance, conditioned by a fist code, to access a first function (180); authorising access to the first function (180) if the first clearance is identified; and if the first clearance is not identified, using the code to verify a second clearance, conditioned by a second code distinct from the first code, to activate at least a second function (170), without revealing the fact that the code does not enable to obtain the first clearance. The invention also concerns a device for implementing the method.

Description

The invention relates to the field of code devices and code processing methods. More specifically, the invention relates to the domain of systems with confidential access code, in particular, devices and methods for securing access to certain operations such as transactions, in particular electronic banking.

Many security features use a PIN. This code, numeric, typically from 2 to 12 digits, associated with a profile holder identification authorized to hold this code, allows the holder to use certain protected functions, and only knowledge of the code allows unlocking of functions.

The generalization of this means of authentication, in particular combining code and microprocessor card, leads to development attacks in which the holder of the code, under threat, is forced to reveal his code.

Solutions have been sought to try to avoid these attacks. Thus, the document “Alert pin for personal banking terminais” (IBM Disclosure Bulletin, vol. 36, No. 5, 1993, pages 309-312) describes a process and a confidential code processing device making it possible to give alert of fraudulent use, without notifying the fraudster, thanks to the use of a backup code (see also US A-5,354,974).

An object of the invention is to simplify this type of device and procedures, while minimizing the risks incurred by the holder of a code, victim of such attacks and retaining the protection of functions at protect.

• recevoir un code ;
• vérifier une première habilitation, conditionnée par un premier code, pour accéder à une première fonction ;
• autoriser l'accès à la première fonction si la première habilitation est reconnue ;
• utiliser, si la première habilitation n'est pas reconnue, le code afin de vérifier une deuxième habilitation, conditionnée par un deuxième code distinct du premier code, pour déclencher au moins une deuxième fonction en ne révélant pas le fait que le code ne permet pas d'obtenir la première habilitation ;

   caractérisé en ce que l'étape de vérification de la deuxième habilitation comprend les opérations consistant à obtenir un nouveau code, par une deuxième transformation inverse d'une première transformation simple permettant au titulaire du premier code d'obtenir le deuxième code à partir du premier code, et exécuter à nouveau l'étape de vérification de la première habilitation pour tester le nouveau code.Thus, the invention proposes a method for processing confidential codes in a system with secure functions comprising the steps consisting in:

• receive a code;
• check a first authorization, conditioned by a first code, to access a first function;
• authorize access to the first function if the first authorization is recognized;
• use, if the first authorization is not recognized, the code in order to verify a second authorization, conditioned by a second code distinct from the first code, to trigger at least a second function by not revealing the fact that the code does not allow obtain the first authorization;

characterized in that the step of verifying the second authorization comprises the operations consisting in obtaining a new code, by a second reverse transformation of a first simple transformation allowing the holder of the first code to obtain the second code from the first code, and execute the first authorization verification step again to test the new code.

Thanks to the invention, the victim can reveal to the aggressor a second code; thanks to the method according to the invention, this second code is distinguished from a first code, empowered to access a first function; there is then no access to the first function which remains protected; but second code can be enabled to trigger a second function which can serve as a decoy, intended to divert the aggressor from the project to access to the first function. The aggressor diverted from his project will not seek to further threaten the victim for whom the risks involved are found therefore reduced. However, this process remains simple to implement. work, since the verification stage of the first authorization is common to testing the code entered directly into the function system secure and to the test of the code obtained after the second transformation.

Advantageously, the first function of the method according to the invention is a bank transaction.

Advantageously, the steps of the method according to the invention, consisting in verifying the first and second authorizations, involve a microprocessor card.

Advantageously, said first simple transformation of the process according to the invention is carried out by an elementary shift of one character of the first code.

Advantageously, the method according to the invention further comprises an invalidation step, if the step of verifying the first clearance has been tested more than a specified number of times without success.

Advantageously, the second function, of the method according to the invention consists in displaying a message randomly chosen from several messages indicating that access to the first function is not possible, without however specifying that the code is not the one allowing to obtain the first authorization.

Advantageously, the second simple transformation of the process according to the invention is a function of parameters accessible on the card to microprocessor.

According to another aspect, the invention is a control device access to secure functions, with confidential code.

• des moyens pour recevoir un code ;
• des moyens pour vérifier avec ce code une première habilitation, conditionnée par un premier code, pour accéder à une première fonction ;
• des moyens pour autoriser l'accès à la première fonction si l'habilitation est reconnue ; et
• des moyens pour utiliser, si l'accès à la première fonction est refusé, le code pour vérifier une deuxième habilitation conditionnée par un deuxième code distinct du premier code pour déclencher au moins une deuxième fonction en ne révélant pas le fait que le code ne permet pas d'obtenir la première habilitation ;

   et il est caractérisé en ce que les moyens pour vérifier la deuxième habilitation permettent les opérations consistant à obtenir un nouveau code, par une deuxième transformation inverse d'une première transformation simple permettant au titulaire du premier code d'obtenir le deuxième code à partir du premier code, et exécuter à nouveau l'étape de vérification de la première habilitation pour tester le nouveau code.Advantageously, this device comprises:

• means for receiving a code;
• means for verifying with this code a first authorization, conditioned by a first code, for accessing a first function;
• means to authorize access to the first function if the qualification is recognized; and
• means for using, if access to the first function is refused, the code for verifying a second authorization conditioned by a second code distinct from the first code to trigger at least a second function by not revealing the fact that the code does not allow not get the first clearance;

and it is characterized in that the means for verifying the second authorization allow the operations consisting in obtaining a new code, by a second reverse transformation of a first simple transformation allowing the holder of the first code to obtain the second code from the first code, and execute the first authorization verification step again to test the new code.

Advantageously, the device according to the invention is a terminal for Bank card.

Advantageously, the device according to the invention is used for secure a bank transaction.

Advantageously, the steps consisting in verifying the first and second authorizations involve a registered user profile numerically.

Advantageously, the means of the device according to the invention, for check the first and second authorizations, involve a credit card microprocessor.

Advantageously, said simple transformation of the device according to the invention is carried out by an elementary shift of one character of the first code.

Advantageously, the device according to the invention further comprises means of invalidation implemented if the first authorization has been tested more than a specified number of times without success.

Advantageously, the second function of the device according to the invention is carried out by means which display a message chosen at random among several messages indicating that access to the first function is not not possible, without however specifying that the code is not the one allowing to obtain the first authorization.

Advantageously, the second simple transformation of the device according to the invention is a function of parameters accessible on the card to microprocessor.

• la figure 1 est un diagramme représentant schématiquement les principales unités composant un dispositif particulier pour la mise en oeuvre de l'invention ; et
• la figure 2 est un synopsis de l'ensemble des étapes d'un exemple de mise en oeuvre du procédé selon l'invention.

The invention will be better understood with the aid of the detailed description which follows and of the accompanying drawings in which:

• FIG. 1 is a diagram schematically representing the main units making up a particular device for implementing the invention; and
• FIG. 2 is a synopsis of all the steps of an example of implementation of the method according to the invention.

In a preferred, but not limiting, mode of carrying out the device according to the invention, this is an automatic cash dispenser. As shown in Figure 1, it conventionally comprises per se a central unit 1 which processes and exchanges information with a reader 2 bank cards 10, and a keyboard 3 (or any other interactive device for entry), to control a mechanism for dispensing 4 banknotes, the reader 2 of bank cards 10 and produce messages displayed on a screen 5. Information processing and control of mechanisms composing the device according to the invention by the central unit 1, is based on exchanges with a memory unit 6.

A card 10 is provided with a microprocessor. This microprocessor corresponds to a holder profile authorized to hold a first code.

The holder also holds a second code which will be used as emergency code in the manner which will be explained below.

The user therefore has two codes. The first code is his code confidential usual, authorized to access a first function, in the occurrence, for the example described here, of an electronic payment transaction of the type automatic ticket distribution.

The second code is a backup code. It can be revealed by a user threatened by an attacker instead of his confidential code.

This second code is easily memorized and is obtained by a first simple arithmetic transformation from the first.

Preferably, the second code differs from the first code only by a digit, which digit is advantageously modified only by plus 1 or minus 1 compared to the number of the same rank in the first and second codes.

Preferably, too, the device according to the invention is implemented work according to the following process, described with reference to FIG. 2.

When a user wishes to obtain a first function 180, in the occurrence of the distribution of tickets from the device according to the invention, he inserts his card 10 into the reader 2 and dials a code on the keyboard 3.

The central unit 1 then begins at the start 100 a procedure for test, with successive steps as shown below.

Follow a step to read the user profile and reset 105 of the count of the number of times the code is dialed.

An indicator 110 testifying to the fact that the code has not yet been transformed is generated.

Then comes the step 115 for entering the code.

The code is tested, by a code 120 test to verify a first empowerment.

If test 120 gives a negative result, it means that the code supplied to the device according to the invention does not correspond to the first code held by the user, ie his confidential code. A first indicator test 130 is then performed. If the indicator shows that the code has not still been transformed, central unit 1 initiates a second test empowerment and proceeds to a derivation 140 of a second transformation, reverse of a simple first transformation allowing the holder of a first code to obtain a second code (its backup code) from the first code.

An indicator 145 testifying to the fact that the bypass 140 has been performed, is generated.

This code obtained by derivation 140 is used to reproduce the first authorization verification step, at the code test level 120. If after the derivation 140, the code obtained still does not correspond to the first code (usual confidential code), is that the code introduced to early 100 was not the second code (backup code). It can be, by example of a typing error on the part of the user. The procedure is continues by repeating the first indicator test 130. But this time, indicator test 130 detects that a second authorization has already been tested (T = 1). The procedure therefore continues with code processing erroneous 150 similar to those known to those skilled in the art. More specifically, a test of the number of times the code was dialed 190 is done. If this number is equal to 3, for example, a step 200 is invalidated to terminate 210 the procedure. If this number is less than 3, the user is asked if he wants a abandonment 220 of the procedure. If so, the procedure ends 210, otherwise the code must be re-entered after the indicator 110 has been reset.

If code test 120 gives a positive result, a second test 160 of the indicator is performed. If the indicator shows that the code has not not transformed, the user has access to protected function 180 (by example ticket distribution). If the indicator shows that the code has already been transformed, is that the code having successfully passed the first clearance test, had previously undergone bypass 140. The code entered at the beginning of 100 of the procedure was therefore the emergency code. The the procedure then continues with a second function 170, in this case, a rescue transaction 170, which can be a decoy function.

The second function 170 corresponds for the example described here to a rescue transaction which can cover several solutions.

A solution can consist in displaying on screen 3, a message randomly chosen from several messages indicating that access to the first function 180 is not possible, without however specifying that the code provided to the device according to the invention is not the one allowing to obtain the first clearance.

For example, the message will be of the type “momentary transaction unavailable "or" insufficient credit "or any of the other common messages used to indicate a malfunction an ATM or a malfunction of the bank account holder.

Alternatively, the normal ticket distribution procedure will be initiated, for example by asking how much is desired, then if the user wants a receipt, but a failure will be simulated and the sum requested will not be issued.

According to another solution, a sum, but limited, will be issued by example, the minimum that can be distributed.

Furthermore, the second simple transformation 140 makes it possible to find the first code (usual confidential code) from the second code (code rescue). Advantageously, this simple second transformation 140 is variable, depending for example on parameters accessible on the card with microprocessor. For example, for a certain banking organization, the second transformation 140 can consist in incrementing by 1 the digit of second in the code, while for another organization, the transformation will consist in subtracting a unit from the figure of the last row. The second transformation 140, and in particular the direction of variation on a digit, can also depend on the even or odd nature of the number constituting the "bank code", the "bank code", etc.

Many other possibilities can be envisaged.

Another advantage of the invention in its form described above is that only one code needs to be tested at the microprocessor of card 10. The cards 10 currently used are therefore compatible with this embodiment of the invention and it is not no need to change the cards already in circulation.

We will understand all the same that it is possible to use cards 10 allowing to test the first code and the second code, independently from each other, and without performing the second transformation 140, without depart from the spirit of the invention.

It will also be understood that it has been used for the detailed description above. the example of cash dispenser type devices, but that the invention also applies to card payment terminals banking as well as any type of system with a secure function 180, such as certain IT devices, certain military, industrial sites, etc.

Instead of testing the code composed in combination with a 10 to microprocessor, to access systems with secure function 180, we may consider testing it in combination with a username, or any other user profile item.

The second function 170 described above is a decoy function simulating a malfunction of the system to be protected. It might be considered in other cases, as a second function 170, the triggering of an alert signal, emission of defense gases, etc.

Claims (16)

1. A method of processing confidential codes in a system having secure functions (180), the method comprising the steps consisting in:

   receiving a code;

   verifying a first entitlement for accessing a first function (180), and as determined by a first code;

   authorizing access to the first function (180) if the first entitlement is recognized; and

   if the first entitlement is not recognized, using the code to verify a second entitlement as determined by a second code that is different from the first code, to trigger at least one second function (170) without revealing the fact that the code does not make it possible to obtain the first entitlement;

      the method being characterized in that the step of verifying the second entitlement comprises the operations consisting in: obtaining a new code from the first code by means of a second transformation (140) that is the inverse of a first simple transformation that enables the holder of the first code to obtain the second code from the first code; and testing the new code by performing again the step of verifying the first entitlement.
2. A method according to claim 1, characterized by the fact that said first simple transformation is performed by a unit shift of one character of the first code.
3. A method according to either preceding claim, characterized by the fact that the steps consists in verifying the first and second entitlements make use of digitally-recorded user profile.
4. A method according to any preceding claim, characterized by the fact that the second function (170) consists in displaying a message selected randomly from a plurality of messages stating that access to the first function (180) is not possible, without specifying that the code is not the right code for obtaining the first entitlement.
5. A method according to any preceding claim, characterized by the fact that the first function (180) is a bank transaction.
6. A method according to any preceding claim, characterized by the fact that it further comprises a disabling step (200) if the step that consists in verifying whether the first entitlement has been tested more than a determined number of times without success.
7. A method according to any preceding claim, characterized by the fact that the steps consisting in verifying the first and second entitlements make use of a microprocessor card (10).
8. A method according to claim 7, characterized by the fact that the second simple transformation (140) is itself a function of parameters that are accessible on the microprocessor card (10).
9. Apparatus for controlling access to secure functions (180) by means of a code, the apparatus comprising:

   means for receiving a code;

   means for using said code to verify a first entitlement for accessing a first function (180), and as determined by a first code;

   means for authorizing access to the first function (180) if the entitlement is recognized; and

   if the first function (180) is refused, means for using the code to verify a second entitlement as determined by a second code which is different from the first code in order to trigger at least one second function (170) without revealing the fact that the code does not enable the first entitlement to be obtained;

      the apparatus being characterized in that the means for verifying the second entitlement perform operations consisting in obtaining a new code from the first code by means of a second transformation (140) that is the inverse of a first simple transformation that enables the holder of the first code to obtain the second code from the first code, and executing again the step of verifying the first entitlement in order to test the new code.
10. Apparatus according to claim 9, characterized by the fact that said first simple transformation is performed by a unit shift of one character of the first code.
11. Apparatus according to claim 9 or 10, characterized by the fact that it is used for making a banking transaction secure.
12. Apparatus according to any one of claims 9 to 11, characterized by the fact that the second function (170) is performed by means which display a message selected randomly from a plurality of messages stating that access to the first function (180) is not possible, but without specifying that the code is not the right code for obtaining the first entitlement.
13. Apparatus according to any one of claims 9 to 12, characterized in that it constitutes a bank card terminal.
14. Apparatus according to any one of claims 9 to 13, characterized in that it further comprises disabling means that are implemented if the first entitlement is tested more than a determined number of times without success.
15. Apparatus according to any of claims 9 to 14, characterized by the fact that the means for verifying the first and second entitlements make use of a microprocessor card (10).
16. Apparatus according to claim 15, characterized by the fact that the second simple transformation (140) is itself a function of parameters accessible on the microprocessor card (10).

Images