Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
  • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
  • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
  • G06Q20/00—Payment architectures, schemes or protocols
  • G06Q20/38—Payment protocols; Details thereof
  • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
  • G06Q20/401—Transaction verification
  • G06Q20/4012—Verifying personal identification numbers [PIN]
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
  • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07F—COIN-FREED OR LIKE APPARATUS
  • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
  • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
  • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
  • G07F7/1025—Identification of user by a PIN code
  • G07F7/1083—Counting of PIN attempts

Definitions

• the invention relates to applications secured by a personal identification number, commonly called PIN code or PIN.
• a UICC card (ISO 7816-X ISO 7816-X hardware-defined smart card) or USIM (Universal Subscriber Module in English) classically stores personal information and applications. Most USIM cards provide access to information or applications only when the user has entered a personal identification number (PIN) of the smart card.
• PIN personal identification number
• a counter formed in a non-volatile memory of the UICC card stores the number of incorrect entries of the PIN of the smart card and the maximum number allowed. The mode of entering the PIN of the smart card is blocked, and with it, the card, when the number of erroneous entries equals the maximum number allowed.
• the counter reset is performed either when a valid chip card PIN is entered before blocking, or when a PIN Unblock Key (PUK) is entered after blocking. Entering the PUK after blocking unlocks the UICC card.
• PUK PIN Unblock Key
• UICC cards and digital devices in general have an increasing number of applications secured by a personal application identification number (hereinafter referred to as an application PIN) and sometimes developed by a company other than the company. telephony operator delivering the UICC card. As each of these applications may have an application PIN and a unique PUK code, the user does not have all of these data in practice when needed. The telephone platforms are then more complex to organize, each company having to store a database for the PUK codes of its application. The user must also identify which platform to contact to unlock the UICC card. For these reasons, a large number of applications are not locked by an application PIN.
• an application PIN personal application identification number
• the invention aims to solve one or more of these disadvantages.
• the invention thus relates to a method of securing applications of a smart card arranged in a digital apparatus, comprising the steps of:
• the smart card used is a UICC type smart card equipped with a SIM or USIM application provided by a telephone operator and the digital apparatus is a mobile telephone apparatus.
• the smart card orders the issuance of an alert to a control authority when the number of erroneous entries reaches a predetermined threshold.
• the smart card used is a credit card type credit card provided by a telephone operator.
• the smart card controls the extinction of the digital device following the blocking. It can further be provided that the method does not include any step of entering a code for unlocking the personal identification number of the application.
• the reset of the count and the unblocking are performed when the personal identification number of the smart card is entered after a reset of the smart card.
• the invention further relates to a smart card comprising:
• a personal identification number of the smart card whose entry is necessary to access all or part of the card; an application associated with a separate personal identification number in its implementation of the personal identification number of the card;
• a processing module blocking the card or the application when the number of erroneous entries reaches a predetermined threshold and requiring the valid entry of the personal identification number of the card to unblock the card or the application and reset the counter.
• the card is of the UICC type with SIM application, USIM and provided by a telephone operator.
• the card is capable of transmitting a transmission command of an alert to a digital host device when the number of erroneous entries reaches a predetermined threshold.
• the card is capable of transmitting an extinction command from a digital host device when the number of erroneous inputs reaches a predetermined threshold.
• FIG 1 shows various stages of implementation of a method according to the invention, in its application to a mobile telephone apparatus
• FIG. 2 illustrates the operation of a state machine used by an application, implementing the invention.
• the invention proposes to provide an application of a smart card with an application personal identification number and to count the erroneous entries of this identification number.
• the application or the smart card is blocked.
• the count of the erroneous entries is reset and the application or the card is unlocked when the card is reset and the correct personal identification number of the smart card is entered.
• the PIN of the smart card is used as an unlock code for secure applications. Applications secured by an application PIN therefore have a high level of security without requiring an increase in the unlocking data to be stored.
• the applications are for example applications complying with STK specifications and issuing commands to the device housing the smart card.
• FIG. 1 represents various steps of an exemplary method according to the invention.
• the smart card in the example is a USIM card connected to a host mobile handset.
• step 101 a user has previously entered the PIN of the USIM card and has therefore had access to a number of information and features of this card, including access to the mobile telephone network.
• step 101 the user wished to use a secure application of the smart card.
• the handset requires PIN entry for this application.
• step 102 the application hangs: the smart card has previously counted the number of erroneous entries of the PIN application and determined that this number had reached a predetermined threshold.
• the threshold may be set to a value of 3, the usual value for testing a USIM PIN code.
• the blocking can take several forms: access to the information of the smart card is restricted or prohibited, the desired application or others are prohibited or a new entry of the PIN application is blocked.
• the smart card advantageously commands the handset to transmit an alert to a control authority.
• the alert is for example transmitted in the form of an SMS.
• the alert can be performed at each block or after counting a predetermined number of blockages.
• the alert can define the secure application that gave rise to the block, a handset ID, or other information that is useful to a controlling authority.
• the control authority is for example the instance that integrated the secure application in the smart card.
• the smart card may contain different control authority call numbers associated with respective secure applications. Thus, each supervisory authority will be able to manage the fraud problems related to its applications.
• step 104 the user is forced to turn off the handset to enter the
• step 105 the handset requires the entry of the PIN of the smart card, CAP NIP noted in Figure 1. If the user enters the correct PIN of the smart card, the application is unlocked and the count of Wrong entries are reset. Thus, trial-and-error application PIN testing requires knowing the PIN of the chip card, which reduces the risk of fraud for an application.
• the PIN check of the application still secures the application: the fraudster will have to enter the PIN of an application at a given time and after blocking it, he will have to enter the PIN of the smart card which had not until then been required.
• Figure 2 illustrates the operation of a state machine used by an application to manage the management of its PIN.
• the indications placed on the arrows correspond to the conditions of passage from one state to another.
• the operations performed in each state are detailed in each associated rectangle.
• the state 201 corresponds to a state of initialization of the smart card or deblocking of the application.
• the flag CHV.OK is initialized to 0. This flag is used to determine if the PIN of the smart card has been validly entered.
• the flag PIN.OK is initialized to 0. This flag is used to determine if the PIN of a given application has been validly entered.
• the RTC counter is initialized to 0. This counter identifies the number of entries of the application PIN.
• State 202 corresponds to a test state of the application PIN entered by a user.
• the Reset flag is set to 0. This flag is used to indicate whether or not the application has been reset.
• the validNIP () function performs the PIN request to the user and returns a value indicating whether the application PIN entry is valid or not.
• a valid application PIN leads to a value of 1 while an invalid application PIN leads to a value of 0 of this function.
• the result of the validNIP () function is then placed in the NIP.OK flag.
• the RTC counter is incremented.
• the state 203 corresponds to a state of entry of the PIN of the smart card in order to achieve the unlocking of the application. State 203 is obtained when the following cumulative conditions are met:
• the getCHV () function performs the PIN request from the smart card to the user and returns a value indicating whether or not the PIN entry of the smart card is valid. If the entered smart card PIN is valid, the getCHV () function takes a value of 1, otherwise the getCHV () function takes a value of 0. The result of the getCHV () function is then placed in the CHV flag. OKAY. The RTC flag takes a value of 0.
• the state 204 indicates the state in which the application is functional, in case of valid entry of the application PIN. Thus, the state 204 is only obtained when the flag NIP.OK takes the value 1. The counter RTC is then reset, the function 'ApplicationQ' executes the application. The PinOK flag is set to 0.

Landscapes

• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• Business, Economics & Management (AREA)
• Accounting & Taxation (AREA)
• General Business, Economics & Management (AREA)
• Theoretical Computer Science (AREA)
• Strategic Management (AREA)
• Computer Security & Cryptography (AREA)
• Finance (AREA)
• Microelectronics & Electronic Packaging (AREA)
• Computer Networks & Wireless Communication (AREA)
• Telephone Function (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34954427

Family Applications (1)

Country Status (6)

Families Citing this family (5)

Family Cites Families (9)

• 2004
  • 2004-11-08 FR FR0411880A patent/FR2877790B1/fr not_active Expired - Fee Related
• 2005
  • 2005-10-24 WO PCT/EP2005/055481 patent/WO2006048390A2/fr not_active Ceased
  • 2005-10-24 CN CN2005800462245A patent/CN101099331B/zh not_active Expired - Lifetime
  • 2005-10-24 US US11/667,120 patent/US8100336B2/en not_active Expired - Lifetime
  • 2005-10-24 EP EP05803102A patent/EP1810441A2/de not_active Withdrawn
  • 2005-10-24 JP JP2007539569A patent/JP2008519343A/ja active Pending

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events