Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
  • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/0866—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means by active credit-cards adapted therefor
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/0873—Details of the card reader
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/0873—Details of the card reader
  • G07F7/088—Details of the card reader the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself
  • G07F7/0886—Details of the card reader the card reader being part of the point of sale [POS] terminal or electronic cash register [ECR] itself the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F2221/2143—Clearing memory, e.g. to prevent the data from being stolen

Definitions

• Electronic module especially for electronic payment terminal
• the present invention belongs to the field of electronic transactions. It relates to an electronic module able to be used for example in an electronic payment device.
• An electronic payment device is a device for making electronic payments. Electronic payments are often made using a bank or credit card, such as a smart card (also known as a microprocessor card) or a magnetic stripe card.
• An electronic payment device generally comprises means for reading a smart card with or without contact, a microprocessor, a keyboard in particular for entering a confidential code, and a display screen.
• Electronic payment terminals (EPTs) are electronic payment devices that allow complete electronic payment until the printing of a ticket. There are simpler electronic payment devices, called confidential code entry boxes (known as "PIN-Pad” in Anglo-Saxon literature), which only allow authentication of the holder of a smart card.
• electronic payment devices are subject to banking security standards. Electronic payment devices must be certified by recognized organizations to demonstrate compliance with these banking security standards. A certification translates in practice by the allocation of serial numbers, a serial number being assigned to each hardware component and software component of the device. Examples include the EMV security standards defined by the financial institutions EUROPAY, MASTERCARD and VISA. A first certification, called “EMV Level 1”, relates to communication with the smart card. A second certification, called “EMV Level 2”, concerns the processing of applications. Each hardware or software evolution of an electronic payment device requires a new certification. The plaintiff posed the problem of accelerating the certification of payment devices electronic, when an evolution concerns insecure software components.
• a secure software component is a software component that processes confidential data.
• an electronic payment application may include secure software components and non-secure software components.
• hybrid devices making it possible to carry out not only electronic payments, but also tasks unrelated to electronic payment (electronic agenda, spreadsheet, word processing, etc.), the applications making it possible to perform these tasks. with no secure software components.
• a hybrid device can be trained by a personal electronic assistant (known by the acronym PDA in the English literature) equipped with a smart card reader, and used to make electronic payments.
• PDA personal electronic assistant
• the invention makes it possible to accelerate the certification of electronic transaction devices when an evolution relates to insecure components.
• the subject of the invention is an electronic module able to be used in an electronic transaction device, the electronic module comprising at least: - an anti-intrusion device, delimiting a secure area, configured to detect physical intrusions in the secure area, romance
• a program memory in the secure area, in which is stored at least one secure software component of an electronic transaction application, - a microprocessor, in the secure area, connected to the program memory, intended to execute the component secure software,
• the electronic transaction application further comprises a non-secure software component intended to operate in interaction by exchanging non-confidential data with the secure software component, said non-confidential data being exchanged via the interface communication, the non-secure software component being intended to be executed by the external processing unit.
• the module further comprises means for securing software, at the transport layer of the IP model, the communication link intended to be connected to the communication interface, so as to guarantee the confidentiality of the data exchanged on this link with the microprocessor.
• the electronic module further comprises a smart card interface, connected to the microprocessor so as to transmit requests from the microprocessor to a smart card and responses from the card to the microprocessor during the execution of the secure application.
• the program memory and the microprocessor are an integral part of a microcontroller.
• the electronic module further comprises at least one interface for a secure memory card, connected to the secure microcontroller, for storing secret information in a secure memory card.
• the electronic module further comprises means for authenticating a smart card holder (8, 9), connected to the secure microcontroller, the execution of the secure application implementing a method for authenticating a smart card holder, the authentication method using said means for authenticating a holder.
• the authentication means comprise input means, connected to the secure microcontroller, the input means being configured to receive secret information entered by the carrier.
• the authentication means further comprise display means, connected to the secure microcontroller, the display means being configured to allow the display of information for the wearer during activation. implementation of the authentication process.
• the display means are formed by a screen or a matrix of individually controllable light elements.
• the authentication means are biometric means making it possible to authenticate a carrier by comparison of physiological characteristics of the carrier with data stored in the chip card.
• the electronic module further comprises a magnetic stripe card interface, connected to the secure microcontroller, to allow the reading of a magnetic stripe card by the secure microcontroller.
• the secure microcontroller further comprises a random access memory, in which secret information is intended to be stored.
• secret information is intended to be stored permanently in the RAM, the microcontroller being intended to be powered permanently, the electronic module comprising means for erasing or altering the content of the RAM. on command.
• the means for erasing or altering the content of the random access memory comprise a wired logic function of the secure microcontroller.
• the random access memory is formed by a register.
• the secure microcontroller is configured so that any intrusion detection activates the command to erase or alter the content of the RAM.
• the invention has the advantage of making it possible to simply combine secure functions (electronic payment for example) with non-secure functions within the same device. It also allows the use of the same electronic payment module in different electronic payment devices, such as an electronic payment terminal and a confidential code entry box. It makes it possible to add electronic payment functions simply and in a modular way to a personal electronic assistant, while guaranteeing a level of security at least equal to that of conventional electronic payment terminals.
• FIG. 1 an example of an electronic module according to invention, in the form of a block diagram
• FIG. 2 an example of an electronic payment terminal integrating a module according to the invention
• FIG. 3 an example of a confidential code entry unit integrating a module according to the invention
• Figure 4 an example of the programs stored in a permanent memory of a microcontroller of a module according to the invention
• - Figure 5 an example of secure microcontroller according to an advantageous embodiment of the invention in which secret information, intended to be erased in the event of an intrusion, is permanently stored in a back-up RAM
• FIG. 6 an example of di an analogy between an external processing unit and a secure microcontroller during authentication of the wearer.
• An electronic module 1 comprises hardware and software components.
• the hardware components can be mounted on an electronic card.
• the hardware components include for example a secure microcontroller 2 to which other peripheral components are connected.
• the peripheral components include, for example, a smart card interface 3 and a communication interface 4.
• the electronic module also comprises an anti-intrusion device 53 (see FIG. 5), delimiting a determined area around the secure components of the electronic module, and in particular around the secure microcontroller 2 and its secure links.
• the function of the anti-intrusion device is to detect any attempt at physical intrusion into this zone, hereinafter called "secure zone". It can take the form of a flexible circuit, having one or more conductive tracks which meander.
• the secure microcontroller is a box that includes permanent memory, random access memory, and a microprocessor. Permanent memory allows data to be stored without power supply. Permanent memory is used to store software components, ie applications or parts of applications. An application is software that allows you to perform a particular task. An application can comprise several parts operating in interaction by exchanging data, these parts being executed by different microprocessors. Otherwise, the permanent memory contains at least one secure software component intended to be executed by the microprocessor. The secure software component forms part or all of an electronic transaction application, such as an electronic payment application.
• the permanent memory can be a non-modifiable memory (known under the name of ROM, acronym for "Read Only Memory”), a reprogrammable memory, or an association of these memories.
• a reprogrammable memory is a memory that can be erased and reprogrammed, such as a FLASH or EEPROM memory (acronym of the Anglo-Saxon expression “Electrically Erasable Programmable Read Only Memory”).
• the random access memory makes it possible to store data during the execution of the applications, in particular of the secure software component.
• RAM is also known by the acronym RAM, from the Anglo-Saxon expression “Ra ⁇ dom Access Memory”.
• the smart card interface 3 comprises for example a connector intended to establish electrical connections with the contacts of a smart card.
• the smart card interface 3 includes an antenna formed by a magnetic loop, the antenna being intended to exchange radio frequency information with a smart card without contact.
• the smart card interface is connected to an input / output port of the secure microcontroller.
• the communication interface 4 makes it possible to establish communication between the secure microcontroller 2 and the outside, that is to say with processing units external to the electronic module 1.
• the external processing unit can for example be a microprocessor an electronic assistant or a computer external to the device integrating the module 1.
• the external processing unit can also be a microprocessor external to the module, but internal to the device integrating the module 1.
• the external processing unit can be a microprocessor of an electronic payment terminal integrating module 1, this microprocessor being external to module 1.
• the communication interface is a standardized interface, synchronous or asynchronous, such as SPI (acronym of the English expression -saxon "Serial Peripheral Interface"), USB or UART.
• the electronic module comprises several different communication interfaces, each one being connected to the secure microcontroller. This allows greater interoperability of the electronic module.
• the electronic module includes an SPI interface, a USB interface and two UART interfaces.
• the electronic module. Includes other peripheral components.
• the electronic module thus comprises one or more interfaces for secure memory cards 10, connected to the secure microcontroller 2, for storing secret information in secure memory cards.
• the electronic module further comprises means for authenticating a card holder to chip, connected to the secure microcontroller.
• the execution of the secure software component implements a method for authenticating a smart card holder, the authentication method using said means for authenticating a holder.
• the authentication means comprise input means 9, connected to the secure microcontroller, the input means being configured to receive secret information entered by the wearer.
• the secret information can for example be a confidential code, the authentication method being based on the knowledge of this confidential code by the holder.
• the input means can include a keyboard for example.
• the authentication means of the electronic module further comprise display means 8, connected to the secure microcontroller.
• the display means are configured to allow the display of information for the wearer during the implementation of the authentication process.
• the information displayed may include, for example, an invitation to enter a confidential code. They may also include stars or other symbols, a star being displayed each time a character or number of the confidential code is entered by the holder.
• the display means can be formed by a screen, such as a liquid crystal screen.
• the display means can be formed by an array of individually controllable light elements, such as an array of light emitting diodes (LEDs).
• the display means can be replaced by an interface to an external screen or any other display means.
• the external screen can be connected via a layer of wires to this interface.
• the connection between the interface and the external screen must then be secure (anti-intrusion detection), so as to ensure that the information displayed on the screen is indeed that transmitted by the secure microcontroller to the interface.
• the authentication means are biometric means making it possible to authenticate a wearer by comparison of characteristics physiological of the wearer with data stored in the smart card.
• the electronic module further comprises a magnetic stripe card interface 7, connected to the secure microcontroller, to allow the reading of a magnetic stripe card by the secure microcontroller.
• the magnetic stripe interface comprises discrete components, such as a magnetic read head 7a and an integrated circuit 7b, the read head being connected to the integrated circuit, the integrated circuit being connected to the secure microcontroller.
• the integrated circuit can be a decoder, such as an F2F decoder, that is to say a circuit having the function of shaping the signals coming from the read head before their transmission to the secure microcontroller.
• the electronic module further comprises one or more memories 5, 6.
• the memories 5, 6 can be memories of the FLASH or RAM type. The memories are connected to the secure microcontroller.
• An electronic module according to the invention can be used to perform the electronic payment functions of an electronic payment terminal 20. It is thus possible to certify the electronic module to banking security standards independently of the other hardware components. and or software of the electronic payment terminal. These other hardware components can for example comprise a printer, this printer being intended for printing tickets.
• the electronic payment terminal 20 can comprise an electronic card 21 and a link 22 connected to the communication interface 4 of the electronic module 1.
• the electronic card 21 comprises a processing unit independent of the secure microcontroller, the processing unit allowing '' run insecure software components.
• the processing unit can be a microprocessor for example.
• Such insecure software components can be part of an electronic payment application, the secure software components of this application being executed by the secure microcontroller, the non-secure software components using the secure software components (see the example in FIG. 6).
• FIG. 3 An electronic module according to the invention can be used to carry out the electronic payment functions of a box for entering confidential code 30.
• the box can comprise the electronic module 1 alone.
• the link 31 between the confidential code box 30 and a point of sale terminal (for printing tickets and recording the transactions) is then connected to the communication interface 4 of the electronic module. Thanks to the invention, it is thus possible to use the same electronic module in an electronic payment terminal and in a confidential code entry box.
• the communication interface, 4 (see FIG. 1) is intended to be connected to an external processing unit (for example a microprocessor), which is not necessarily secure.
• This processing unit can be an integral part of the electronic payment device in which the electronic module is placed, as in the example shown in FIG. 2.
• This processing unit can, on the contrary, be external to the electronic payment device itself. same, as in the example shown in Figure 3.
• the microcontroller comprises one or more permanent memories 40 in which are stored software components.
• FIG. 4 represents a practical embodiment in which the microcontroller comprises two permanent memories: a reprogrammable memory of the EEPROM type and a non-modifiable memory (ROM).
• the different software components can be divided into layers, each layer comprising software components offering services to software components of an upper layer.
• a first layer 41 the lowest, can be stored in the ROM memory.
• This first layer includes a software primer, called "boot” in Anglo-Saxon literature. It may also include complementary services, such as cryptography services.
• a second layer 42 higher than the first, comprises interface drivers, called “drivers” in the Anglo-Saxon literature. For example, it can include an interface driver for the screen 8, for the keyboard 9, and for the memories 5, 6.
• a third layer 43 superior to the second, comprises a real-time operating system, also called the kernel.
• the operating system provides the hardware resources (interfaces, memories ...) to the applications of the last layer, and manages the multitasking operation.
• a fourth layer 44 higher than the third, comprises an application manager. The application manager directs messages from the .interfaces to the appropriate applications in the last layer.
• the fifth and last layer 45 higher than the fourth, comprises applications or parts of applications intended to perform a particular task. It can include part of an electronic payment application. Reference may be made to FIG. 6 for an example of the operation of such an application. Reference is now made to FIG.
• the secure microcontroller further comprises a random access memory 52, in which secret information is intended to be stored.
• the RAM can be formed by a register of the secure microcontroller.
• the secret information can be cryptographic keys for example. This information is deleted in the event of a power failure.
• the memory being a random access memory, the erasure or the degradation of its information can be faster.
• the microcontroller can be powered by a main power supply 55, such as batteries or a transformer from alternating current to low voltage direct current.
• the electrical supply of the random access memory is saved. In other words, the random access memory is supplied by a reserve of electrical energy 11 making it possible to supply the random access memory when the main supply 55 is cut.
• the electrical energy reserve 11 can be a lithium battery, a battery or any other appropriate energy reserve.
• Secret information can thus be permanently stored in the backed up RAM. This secret information will be kept in the event of the main power supply 55 being cut, for example when the batteries are changed.
• a tilting device 56 which is an integral part of the secure microcontroller, can make it possible to switch between the main power supply 55 and the electrical energy reserve 11, in particular to supply the backup RAM memory of the microcontroller.
• the energy reserve 11 is an integral part of the electronic module according to the invention. In this way, electronic modules can be stored before being delivered and integrated into electronic payment devices, secret keys already being stored in the backed up RAM of the secure microcontroller.
• the energy reserve of the electronic module likewise makes it possible to store this terminal without batteries, secret keys being stored in the secure microcontroller.
• the electronic module includes means for erasing or altering the content of the RAM on command. These means may include a wired logic function 51 of the secure microcontroller.
• the secure microcontroller is configured so that any intrusion detection activates the command to erase or alter the content of the RAM.
• FIG. 6 is shown an example of dialogue between two parts of a payment application.
• the first part is an insecure software component 67, that is to say that does not use any secret data.
• the non-secure software component is executed by the external processing unit.
• the non-secure software component allows for example the management of a printer, the management of a modem, the management of radio communication means, etc.
• the second part is a secure software component 68, executed by the secure microcontroller.
• the secure software component implements the payment functions themselves.
• the authentication of the holder of a smart card will now be described.
• the non-secure component 67 sends a request 61 to the secure component 68, this request being an order to enter a transaction amount.
• the secure component 68 displays an invitation message on the screen, such as "amount?", And waits for a keyboard entry. After entering an amount, the secure component 68 sends a response to the non-secure component 67, the response containing the amount entered using the keyboard.
• the non-secure component 67 then sends a request 63 to the secure component 68, this request 63 comprising an order to enter the carrier code, and the amount to be displayed, this amount being the amount transmitted with the response 62.
• the secure component 68 displays the amount and an invitation message, such as "code:”, and waits for a keyboard entry. After entering the code, the secure component sends a response to the non-secure component 67. This response does not include the code entered, but an indication whether this code has been entered or not. Thus, the non-secure component 67 does not process any secret information.
• the non-secure component if the code has been entered, then sends a request 65 to the secure component, this request 65 comprising an order of presentation of the entered code to the smart card.
• the secure component presents the code entered on the card and waits for the card to respond. After receiving the response from the card, the secure component sends a response 66 to to the non-secure component 67, this response indicating whether the code entered is correct or not.
• a payment application based on the use of a track card can operate on the same principle, that is to say from two software components, one secure and the other not, the secure software component being executed. by the secure microcontroller and exchanging non-secure data with the non-secure software component.
• the secure software component may in particular carry out card reading operations, inputting the transaction amount, and encrypting a data block of an electronic transaction, said data block containing the information read from the card, the amount of the transaction, the time and date, and of the merchant's identification data (merchant number issued by the bank where his bank account is domiciled).
• the information leaving the secure microcontroller is only transmitted on the communication interface 4 if the request requesting this information has been previously signed and authenticated by the secure microcontroller.
• the information transmitted on the interface to the microcontroller can contain a text intended for. be displayed. This text can for example be an invitation to enter a confidential code, such as "Code?". If this message is not signed, no information will be sent back. This avoids any fraudulent use of the electronic module.
• the information transmitted on the interface to the microcontroller can contain a message code, this message code corresponding to a message to be displayed. For example, a table of predetermined messages can be stored in a memory of the secure microcontroller. If the message code is of the type an invitation to enter confidential information, then no information is transmitted in return.
• the message code is of the type an invitation to enter the amount of the transaction
• the information entered following the display of this message can be transmitted in return.
• the nature (confidential or non-confidential) of the information entered it is possible to determine the nature (confidential or non-confidential) of the information entered.
• no secret information confidential code, biometric information, etc.
• the module according to the invention can be used for applications other than electronic payment. It generally applies to electronic transactions requiring a certain level of security. Mention may in particular be made of access control with badges, encryption of documents, certification of electronic data, electronic signature, etc.
• the communication link connected to the communication interface 4 can be secure in software, at the transport layer of the IP model (acronym for the English expression "Internet Protocol").
• IP model for the English expression "Internet Protocol”
• a merchant using a terminal incorporating such a module can thus exchange data with a bank via a secure Internet link.
• the electronic module includes secret keys and programs, stored in a memory located in the secure area.
• the programs allow you to implement encryption algorithms, such as RSA, SHA, DIFFIE-HELLMAN, MD5. They are used to secure a communication link of the Ethernet type in terms of confidentiality of the information exchanged on this link.
• the Ethernet type link connects the communication interface 4 (USB, SPI, UART ...) of the secure module to an IP gateway.
• the IP gateway can be implemented by means of a box, such as the MISTRAL box from the company THALES E-SECURITY or a box from the company CISCO.
• programs can communicate by implementing a protocol of the SSL type, acronym of the Anglo-Saxon expression “Secure Socket Layer”.
• an electronic transaction software component of the secure module can communicate with a software component of a box. remote to which the module is connected, this communication implementing an application-to-application security protocol of the SSL type.

Applications Claiming Priority (2)

Publications (1)

Family

ID=34630357

Family Applications (1)

Country Status (3)

Families Citing this family (6)

Family Cites Families (3)

• 2003
  • 2003-12-19 FR FR0315025A patent/FR2864286B1/fr not_active Expired - Lifetime
• 2004
  • 2004-12-17 WO PCT/EP2004/053566 patent/WO2005066904A1/fr not_active Application Discontinuation
  • 2004-12-17 EP EP04804909A patent/EP1695298A1/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events