EP4074004A1

EP4074004A1 - Method and system, device and payment terminal using personal data

Info

Publication number: EP4074004A1
Application number: EP20845184.9A
Authority: EP
Inventors: David Naccache; Michel Leger; Elena Trichina
Original assignee: Banks and Acquirers International Holding SAS
Current assignee: Banks and Acquirers International Holding SAS
Priority date: 2019-12-13
Filing date: 2020-12-11
Publication date: 2022-10-19
Also published as: WO2021116625A1; CA3161315A1; FR3104779B1; FR3104779A1; US20230004965A1

Abstract

The invention relates to an electronic transaction method for a system comprising a user-associated payment device 3 or 4 and a payment terminal 1. The payment device 3 or 4 and the payment terminal 1 perform a cryptographic key exchange 500 before performing a transaction step 501. The payment device includes personal information PI about the user. The payment terminal includes a transaction policy including a condition relative to the personal information PI. The method includes a verification step 510, 520, 530, prior to the transaction step 501, for securely verifying the condition of the transaction policy relative to the personal information using the cryptographic key.

Description

Title of the invention: METHOD AND SYSTEM, DEVICE AND TERMINAL FOR PAYMENT USING DATA

PERSONAL

[0001] Technical field

The present invention relates to a method, a system, a device and a payment terminal using personal data. More generally, the invention relates to an improvement in secure electronic payments.

[0003] Technological Background

An electronic transaction allows the sale or purchase of goods or services using electronic means of payment. This document relates more particularly to transactions initiated at a point of sale and carried out on a device having means to secure such transactions. To implement this type of transaction, a payment device stores payment identifiers, such as a bank card (magnetic, contact or contactless), a mobile phone or a smart watch, in order to be presented to a payment terminal which verifies the authenticity of the means of payment and validates the transaction. In current transactions, only the authentication of the means of payment and the ability to pay are verified. Many payment protocols exist. By way of non-limiting example, the EMV protocol (derived from the initials of the founding companies Europay international, MasterCard international and Visa international) specifies the interoperability between bank cards and payment terminals by authorizing numerous implementation variants: with or without contact, with cash or credit payment, with or without PIN code, with varying security levels depending on the type of transaction or the card issuer, etc.

[0005] Furthermore, payment conditions may be conditioned according to certain personal data of a purchaser and certain transactions may also be legally prohibited according to such personal data. When they exist, these transaction conditions are generally verified. by a seller when purchasing. Non-resident consumers may wish not to pay certain taxes imposed on the sale of products, such as, for example, VAT (Value Added Tax in France). To do this, they must justify their condition or make a request for zero-rating after a purchase. A buyer's age check may be required to obtain a price reduction or purchase authorization. This type of control is only achievable if a seller is present or, if such a purchase is made on a vending machine, trusting the data that is indicated by the buyer. In addition, a seller may fail to verify such personal data or be deceived by a malicious buyer, just like a vending machine.

[0006] There is a need to carry out transactions conditioned by the personal data of a holder of a means of payment in order to apply an appropriate tariff or to authorize a transaction in a secure and automated manner based on the personal data of a buyer with electronic means of payment.

[0007] Summary of the Invention

The invention proposes to improve electronic transactions at a point of sale by securely verifying the authenticity of one or more personal information of a purchaser without the latter having to produce proof to seller. To this end, a payment device comprises at least one personal item of information which is presented in a certified manner to a payment terminal. The payment terminal is suitable for implementing a transaction policy which takes into account one or more personal information to authorize or refuse to finalize a transaction.

The invention proposes an electronic transaction method between a payment device associated with a bank account of a user and a payment terminal associated with an acquiring bank account in which the payment device and the payment terminal perform at at least one cryptographic key exchange before performing a transaction step during which the transaction is validated or rejected. The payment device comprises at least one personal information relating to the user. The payment terminal includes at least one transaction policy including a condition relating to at least one personal information. The method includes a verification step, prior to the transaction step, to verify the condition of the transaction policy relating to personal information in a secure manner using the cryptographic key.

According to a first embodiment, the verification step can consist in that the payment device sends the personal information accompanied by a cryptographic signature made using the personal information and the cryptographic key in order to to authenticate personal information. The payment terminal can check the condition of the transaction policy after authenticating personal information.

[0011] According to a variant of this first embodiment, prior to sending the personal information, the payment terminal can send a request to the payment device to cause the sending of the personal information by the latter.

[0012] According to a second embodiment, the verification step can consist in that the payment terminal sends a request to verify the transaction policy to the payment device, the request being signed using the cryptographic key . The verification of the condition of the transaction policy can be carried out by the payment device, after having authenticated the request using the cryptographic key, which generates and transmits a validation or invalidation message to the payment terminal by depending on condition and personal information.

[0013] According to a particular embodiment, the amount of the transaction can be modified by the payment terminal depending on the result of the verification step.

Preferably, the cryptographic key exchange can be carried out during a mutual authentication step.

The invention also proposes an electronic transaction method implemented by a microprocessor of a payment device associated with a bank account of a user intended to cooperate with a payment terminal associated with an acquiring bank account in order to carry out a step of transaction during which the transaction is validated or rejected, said method comprising a step for exchanging at least one cryptographic key with the payment terminal. The payment device comprises at least one personal information relating to the user recorded in a data memory. The method comprises a step of verifying a condition of a transaction policy relating to the personal information is verified in a secure manner using the cryptographic key.

According to a first embodiment, the verification step may include sending a message containing personal information accompanied by a cryptographic signature made using the personal information and the cryptographic key in order to authenticate said personal information.

According to a second embodiment, the step of verifying the condition of the transaction policy may include a preliminary step for authenticating a request sent by the payment terminal containing the condition of the transaction policy, the request being signed using the cryptographic key, and a step of sending a validation or invalidation message depending on the condition and personal information.

In addition, the invention provides an electronic transaction method implemented by a microprocessor of a payment terminal, associated with an acquiring bank account, intended to cooperate with a payment device associated with a bank account of an user. Said method comprises a step for exchanging at least one cryptographic key with the payment device and a transaction step during which the transaction is validated or rejected. The payment terminal includes at least one transaction policy including a condition relating to at least one personal information relating to the user of the payment device. The method includes a verification step for requesting verification of the condition of the personal information transaction policy using the cryptographic key, and the transaction step is carried out if and only if the condition is verified.

According to a first embodiment, during the verification step, the method may include a step for receiving a message including personal information accompanied by a cryptographic signature made using the personal information and the cryptographic key and a step to verify the condition of the transaction policy after having authenticated the personal information using the cryptographic key.

[0020] According to a variant of this first embodiment, the method may include a step for developing and transmitting a request to the payment device in order to obtain personal information.

[0021] According to a second embodiment, the verification step may consist in developing and transmitting a request for verifying the transaction policy to the payment device, the request being signed using the cryptographic key.

[0022] According to a particular embodiment, the method may include a step for modifying the amount of the transaction as a function of the result of the verification of the condition prior to the validation of the transaction.

According to another aspect, the invention provides an electronic transaction system comprising a payment device associated with a bank account of a user and payment terminal associated with an acquiring bank account in which the payment device and the terminal payments are configured to perform an exchange of at least one cryptographic key before performing a transaction step during which the transaction is validated or rejected. The payment device includes at least one personal information relating to the user and the payment terminal includes at least one transaction policy including a condition relating to at least one personal information. The device and the payment terminal are configured to perform a verification step between the cryptographic key exchange step and the transaction step during which the condition of the transaction policy relating to personal information is verified. securely using the cryptographic key.

According to a first embodiment, the payment device can be configured to transmit to the payment terminal a message containing the personal information signed using the personal information and the key cryptographic to authenticate the personal information and the payment terminal can be configured to verify the condition after authenticating the personal information using the cryptographic key.

[0025] According to a variant of this first embodiment, the payment terminal can be configured to develop and transmit a request to the payment device in order to obtain personal information.

[0026] According to a second embodiment, the payment terminal can be configured to generate and transmit to the payment device a request for verifying the condition of the transaction policy signed using the cryptographic key. The payment device can be configured to authenticate said request using the cryptographic key before verifying the condition in response to the verification request and to return a validation or invalidation message to the payment terminal as a function of the condition and personal information.

[0027] According to a particular embodiment, the payment terminal can be configured to modify the amount of the transaction depending on the result of the verification step.

[0028] Also, the invention proposes a payment device associated with a bank account of a user intended to cooperate with a payment terminal to carry out an electronic transaction, said payment device being configured to exchange at least one cryptographic key with the payment terminal. The payment device includes at least one personal information relating to the user, and the payment device is configured to perform a step of verifying a condition of a transaction policy relating to personal information in a secure manner at the same time. 'using the cryptographic key

According to a first embodiment, the payment device can be configured to send the personal information to the payment terminal in a signed message using the personal information and the cryptographic key in order to authenticate the payment. 'personal information

According to a second embodiment, the payment device can be configured to check the condition of the transaction policy in response to the receipt of a verification request containing the condition, said request being signed and transmitted by the payment terminal using the cryptographic key, and to develop and transmit a validation or invalidation message to the payment terminal in function condition and personal information.

Preferably, the payment device can be a device included in the following list: smart card conforming to the IS07816 standard and / or to the 14443 standard, mobile phone or tablet comprising a secure payment capability, smart watch comprising payment functions, secure computer comprising a communication interface with or without contact and comprising a secure payment capability.

[0032] In addition, the invention provides a payment terminal associated with an acquiring bank account intended to cooperate with a payment device associated with a bank account of a user to carry out an electronic transaction in which the payment terminal is configured. to exchange at least one cryptographic key with the payment device before implementing a transaction step during which the transaction is validated or rejected. The payment terminal includes at least one transaction policy comprising a condition relating to at least one personal information stored in a memory of the payment device, said personal information relating to the user. The payment terminal is configured to perform a verification step, prior to the transaction step, in which the condition of the personal information transaction policy is securely verified using the cryptographic key.

According to a first embodiment, the payment terminal can be configured to receive a message containing the personal information signed using the personal information and the cryptographic key by the payment device. The payment terminal can be configured to check the condition after authenticating the personal information using the cryptographic key. As a variant of the first embodiment, the payment terminal can be configured to develop and transmit a request to the payment device in order to obtain personal information.

[0035] According to a second embodiment, the payment terminal can be configured to generate and transmit to the payment device a request for verifying the condition of the transaction policy signed using the cryptographic key. The payment terminal can be configured to complete the transaction following a validation or invalidation message returned by the payment device depending on the condition and personal information.

[0036] According to a particular embodiment, the payment terminal can be configured to modify the amount of the transaction depending on the result of the verification step.

Preferably, said payment terminal can be included in the following list of devices: point of sale terminal for chip card, mobile phone or tablet comprising a secure payment recording capacity, cash register comprising a capacity for secure payment registration.

Brief Description of the Figures

The invention will be better understood and other characteristics and advantages thereof will appear on reading the following description of particular embodiments of the invention, given by way of illustrative and non-limiting examples, and with reference to the accompanying drawings, among which:

[0040] [Fig.1] illustrates an electronic payment system concerned by the invention,

[0041] [Fig.2] illustrates a smart card according to the invention,

[0042] [Fig.3] illustrates a mobile phone used as a means of payment according to the invention,

[0043] [Fig.4] illustrates a payment terminal according to the invention,

[0044] [Fig.5] shows a modified payment scheme according to a first embodiment of the invention, [0045] [Fig.6] shows a modified payment scheme according to a second exemplary embodiment of the invention.

[0046] Detailed description

[0047] Figure 1 illustrates a secure electronic payment system used according to the state of the art and used to implement the invention. The system of FIG. 1 comprises a payment terminal 1 capable of communicating on the one hand with a bank server 2 and on the other hand with a payment device 3 or 4. This type of system is commonly used to perform payment operations. payment from a point of sale, as defined in many payment service standards, for example in the EMV standard which is the most widely used and which has many possibilities of implementation. The payment terminal 1 may be required to carry out “offline” or “online” transactions, that is to say in a disconnected or connected manner with the banking server 2. The payment device 3 is conventionally a smart card. 3 or a mobile phone 4, or even any other electronic device capable of emulating the operation of a smart card in a secure manner, such as for example a smart watch which is an extension of a mobile phone in the form of a watch bracelet, or any type of computer with the same capacities or functions.

By way of example, FIG. 2 functionally illustrates a bank card 3, or smart card, which comprises a microprocessor 31 controlling a central bus 32 for exchanging data with a memory 33, a crypto-processor 34, a contact communication interface 35 and a contactless communication interface 36. The contact communication interface 35 is for example compatible with the IS07816 standard. The contactless communication interface 36 is for example a near-field communication interface, of the NFC type (standing for Near Field Contactless) compatible with the IS014443 standard. Although many payment cards have these two types of communication interface 35 and 36, some cards only have a single contact or contactless communication interface. For the invention, the important thing is that the smart card 3 has at least one communication interface with or without contact. The memory 33 can be segmented into volatile memory of RAM type (standing for Random Access Memory), in non-writable program memory of ROM type (standing for Read-Only Memory) and in non-volatile memory of EEPROM (Electrically-Erasable Programmable Read-Only Memory) or Flash type. A secure operating system is implemented by the microprocessor 31 to guarantee the security of the information stored in the memory 33 of the smart card 3. Thus, the microprocessor 31 can authorize read or write access to certain areas. from the memory to commands coming from one of the communication interfaces 35 or 36. Other areas of the memory 33 can only be accessible to the microprocessor 31 or to the crypto-processor 34. Certain data can be made accessible by the microprocessor 31 from the outside conditionally.

Numerous variants of smart card architecture are known and those skilled in the art can at leisure use an architecture different or similar to that described in FIG. 2. However, those skilled in the art will take care of n ' only use secure card architectures sufficient for application to banking services and in particular compliant with the specifications of a banking transaction standard, such as for example and without limitation the EMV standard.

According to the invention, personal information PI is stored in the non-volatile part of the memory 33 during the personalization of the smart card concomitantly with data relating to a bank account with which the smart card is associated. Personal PI information relates to the holder of the bank account. It can relate to his age, his date of birth, his place of residence or consist of any other personal information which can be used during a transaction according to the invention. The personal information PI can be stored in a memory area which can be read directly from one of the communication interfaces 35 or 36 while being write-protected so that it cannot be altered after personalization by an unauthorized person. . However, preferably, the personal information PI is stored in an area of the memory 33 which is not directly accessible from one of the communication interfaces 35 or 36. In a variant, the personal information PI is not at all accessible from the outside. The use of this personal PI information will be described later in this description.

FIG. 3 functionally illustrates a portable telephone 4 which can be used as a payment device. By way of example, the portable telephone 4 is a portable telephone of the intelligent type, commonly called under the Anglo-Saxon name “smartphone”, which comprises a microprocessor 41 connected through a central bus 42 to a volatile memory 43, a non-volatile memory 44, a user interface 45, a SIM card 46, a radio communication interface 47, a proximity interface 48 and a secure element 49. Other elements can also be part of the mobile phone 4 but are not shown because they do not directly relate to the invention. By way of example, these other elements can comprise a microphone, a loudspeaker, a vibrator, a camera, a memory card reader, a wired communication interface, for example of the USB type, a battery or even any other integrated element. in a cell phone. In addition, the mobile telephone 4 described with the aid of FIG. 3 corresponds to a non-limiting preferred type of telephone. In particular, as a variant, it is possible that the mobile telephone 4 does not include the secure element 49 or the SIM card 46.

The microprocessor 41 is the "heart" of the mobile telephone 4 which manages all of the elements constituting it via the central bus 42 from programs stored in the non-volatile memory 44 using the volatile memory 43 as working memory . The non-volatile memory 44 is for example composed of memory of ROM type and of electrically erasable memory of EEPROM type or of Flash type. Among the stored programs, the operating system of the mobile telephone 4 makes it possible to manage the different functionalities by calling on specific programs which make it possible to produce different commands intended for the different elements of the telephone 4. In the preferred embodiment according to Figure 3 which includes the SIM card 46 and the secure element 49, the operating system is not secure as such because the securing of sensitive data and operations can be done in the SIM card 46 and / or in the secure element 49. According to a variant which does not include a SIM card 46, nor a secure element 49, it is necessary to have a secure operating system which makes it possible to restrict read, write and execute access to certain areas of the memory in order to guarantee the security of certain programs, in particular banking transaction programs.

[0054] The user interface 45 is preferably a touch screen that can also include a fingerprint reader. In a minimalist variation, the user interface can be limited to a display screen and a keyboard. Many other variations are also possible for a person skilled in the art without limiting the scope of the invention.

[0055] The SIM card 46 (from the English Subscriber Identity Module) is commonly used to store access identifiers to a mobile telephone network (not shown) and to secure access to said network. Typically, the SIM card 46 is a smart card used to authenticate the telephone on the telephone network according to one of the telephony standards, such a card for example conforms to the IS07816 standard and to the ETSI TS 102221 standard. preferred embodiment, the SIM card 46 only fulfills its role of communication with the mobile telephone network. The radio communication interface 47 is a programmable multi-frequency radio interface having modulation, demodulation, encoding and decoding circuits that can be configured in different ways in order to communicate on a frequency band and according to a protocol. communication chosen by the microprocessor 41 as a function of information contained in the SIM card 46. This interface is compatible with several radio telephony standards, such as 2G, 3G, 4G and / or with shorter range radio communication standards such as that, for example, WiFi or Bluetooth standards. Through this radio communication interface, it is possible to exchange voice and data. The proximity interface 48 is a CLF type interface (from English

Contactless Front-End) as defined in the ETSI TS 102613 standard, in order to allow the mobile phone to carry out field communications close to NFC type, which are compatible with the IS014443 standard. Thanks to this interface, the mobile telephone 4 can emulate the operation of a contactless smart card or of a contactless smart card reader. This proximity interface is controlled by means of the central bus 42 or by a specific communication port intended to be directly connected to a SIM card as defined in the ETSI TS 102613 standard.

Secure element 49 is an independent integrated circuit that contains a secure processor, runtime memory, and tamper-proof storage like a smart card. The secure element 49 comprises a first communication port linked to the central bus 42 and a second communication port linked to the specific communication port of the proximity interface 48. When the telephone 4 is switched off, the secure element 49 can be switched off. supplied directly by the proximity interface 48 from the electromagnetic field used for communication. Secure element 49 can securely store data and programs. It can also run them safely. This secure element 49 can contain and execute secure programs identical to those executable by the chip card 3 described above, in particular for carrying out payment transactions. According to a preferred embodiment, the secure element contains personal PI information.

According to a variant in which the mobile telephone 4 does not have a secure element 49, the SIM card 46 can be a multi-application card integrating a banking application and personal information PI. To this end, the SIM card can comply with the ETSI TS 102 613 standard and have a direct link with the proximity interface 48 via its specific communication port or perform data exchanges with the payment terminal 1 via the 'radiocommunication interface 47. The SIM card 46 can thus replace the secure element 49 and provide in its place the various functions described above. According to another variant, the mobile phone 4 does not have a secure element 49 or a SIM card 46. According to this variant, the phone 4 has a secure operating system, an application program banking and the personal information PI is stored in a protected area of the non-volatile memory 44.

Alternatively, the mobile telephone 4 can be replaced by any other electronic device comprising a microprocessor having all or part of the elements described in relation to FIG. 3. By way of non-limiting example, such a device can be a tablet, smart watch, or laptop. However, the electronic device should have a read, write and execute security capability for programs and data to be able to receive a secure payment application and a contact or contactless communication interface that allows communication with the customer. payment terminal 1.

FIG. 4 functionally illustrates a payment terminal 1 intended to receive payments in the form of electronic transactions. The payment terminal 1 can be a secure point-of-sale or POS terminal (standing for Point Of Sale), that is to say integrated in a structurally reinforced box against any malicious attempt to undermine its integrity. but can also be placed in an automatic product dispenser or be improper in a store cash register, or even be emulated on an intelligent portable telephone of the “smartphone” type.

By way of non-limiting example, the payment terminal 1 comprises a microprocessor 101 connected through a central bus 102 to a volatile memory 103, a non-volatile memory 104, a screen 105, a keyboard 106, a SAM card 107, a printer 108, a communication interface 109 with and / or without contact, a smart card reader 110 with contact, a proximity communication interface 111. Other elements can also form part of the payment terminal 1 but are not shown because they do not directly relate to the invention. By way of example, these other elements may comprise a battery, a SIM card, a memory card reader or even any other element which can be integrated into a payment terminal. In addition, the payment terminal 1 described corresponds to a terminal of the non-limiting preferred POS type. In particular, as a variant, it is possible for the payment terminal 1 to be simplified or emulated on a secure mobile telephone and not to include proximity communication interface 111, smart card reader 110, printer 108 or SAM card 107. In addition, the screen 105 and the keyboard 106 can be replaced by a touch screen or any other type of display. man-machine interface allowing interaction with a user.

The microprocessor 101 is the heart of the payment terminal 1 which manages all of the elements constituting it via the central bus 102 from programs stored in the non-volatile memory 104 using the volatile memory 103 as working memory. The non-volatile memory 104 is for example composed of a ROM type memory and an electrically erasable memory of the EEPROM type or of the Flash type. Among the programs recorded in the non-volatile memory 104, we can cite a secure operating system implemented by the microprocessor 101 to guarantee the security of the information stored in the memory 104. Thus, access in reading and / or in writing to certain memory areas is only possible under the control of the microprocessor 101 from one of the communication interfaces 109.

The non-volatile memory 104 also includes programs executable by the microprocessor 101 intended for carrying out banking transactions. These programs include a certain number of subroutines capable of supporting different transaction options which depend on the type of bank card, on the issuer of the bank card, and also on particular parameters which can for example be defined by a merchant who uses said bank card. payment terminal 1. Among the sub-programs, some may relate respectively to transaction policies (in English Transaction Policies) which define particular payment conditions, for example electronic verifications to be carried out according to the type of card, a threshold of payment beyond which the bank must be contacted to authorize or refuse the transaction, conditions relating to the entry or entry of a verification code or to additional verifications that can be configured by the merchant having said terminal 1.

The screen 105 allows the users of the payment terminal 1 to view information during the execution of a transaction. The keyboard 106 allows its user to indicate to the payment terminal 1 payment information. transaction such as for example the amount of the transaction or the entry of a personal identification code or PIN (standing for Personal Identification Number). The printer 108 is used to print a transaction receipt intended for the debtor and / or the merchant. In a variant, the printer 108 is not present and the transaction receipt can be sent in the form of an electronic message to each of the parties to the transaction or to another machine connected to the payment terminal 1 which will perform the transaction. 'edition instead of said terminal 1.

[0067] The SAM 107 (from the English Secure Access Module) card is a secure access module or secure application module. The SAM card guarantees the security of the transaction and the sensitive information of the payment terminal 1. The SAM 107 card can store and produce cryptographic keys and / or implement cryptographic calculation algorithms necessary for the implementation of a security policy, for example to carry out a strong authentication process carried out during a transaction. The SAM 107 card is a chip card inserted into an internal reader (not shown) of the payment terminal 1. According to a variant, the SAM card 107 can be replaced by a secure element or by the microprocessor 101 if the latter comprises a cryptographic processor. and a secure operating system to ensure sufficient security of sensitive information.

The communication interface 109 allows the terminal to communicate with the bank server 2. Depending on the type of payment terminal 1, such a communication interface 109 conventionally supports so-called "wired" communications, for example according to the protocol. Internet and / or communications of radiocommunication type, for example according to a 3G or 4G radiotelephony protocol. The encryption of the communications carried out via the communication interface 109 is preferably carried out by the SAM card 107. According to a variant, a communication between a payment device 4 and the payment terminal 1 can be carried out via the intermediary. of the communication interface 109.

The smart card reader 110 is a smart card reader conforming to the IS07816 standard in order to receive a bank card 3 and to communicate with it by electrical contacts. The proximity interface 111 is a contactless card reader conforming to the IS014443 standard which makes it possible to communicate with a bank card 3 or any other contactless payment device 4 having a proximity interface compatible with said IS014443 standard.

According to a preferred embodiment of the invention, the memory 104 of the payment terminal 1 comprises one or more subroutines corresponding to one or more transaction policies Pol (PI) in order to take into consideration the personal information PI stored in the payment device 3 or 4. Such transaction policies may be justified from a legal point of view or from a commercial point of view. Each Pol (PI) transaction policy includes a condition relating to personal PI information which conditions the completion of a transaction depending on whether or not said condition is verified by said personal PI information. By verifying that the personal PI information complies with the condition of the Pol (PI) transaction policy, the payment terminal 1 makes it possible to avoid having to justify the veracity of this information to a seller by producing example an identity document. Thus, it is possible to carry out transactions conditioned by personal information without the presence of a seller being necessary and therefore to carry out this type of transaction using distribution machines.

By way of non-limiting example, some personal information verification policies are indicated. A first transaction policy Pol (PI) may relate to a minimum age of the bearer of the payment device in order to be able to carry out a transaction on a legally restricted product. For example, a sale may be refused to a minor. This first policy allows, for example, a distributor of cigarettes or alcoholic beverages to verify the age of the customer without having to resort to a person to carry out said verification. A second Pol (PI) transaction policy may relate to a commercial discount according to the age of the person as part of a commercial promotion to favor a young or senior clientele. For example, if the card holder is under twenty-five or over sixty-five, the payment terminal 1 can verify the personal information PI corresponding to the age of the holder of the device. payment and calculate a ten percent discount on a transaction amount. A third Pol (PI) transaction policy may consist of zero-rating foreign persons in order to avoid subsequent zero-rating operations. With this third policy, the payment terminal 1 can, for example, verify personal information PI corresponding to the country of residence of the bearer of the payment device and deduct the amount of taxes if the personal information PI corresponds to a country for which the zero-rating is applicable. The address can also be used commercially in a fourth Pol (PI) transaction policy that causes trade discounts to people residing in trade promotion geographies. According to this fourth policy, the terminal verifies personal information PI corresponding to the address or postal code of the bearer of the payment device and then calculates a commercial discount if the address of residence corresponds to a geographical area of commercial promotion. Many other policies can be considered as long as certain personal information is present in the payment device. Very many variants are possible since a transaction can be conditioned by personal information PI.

Verifying the conformity of personal PI information with the condition of the Pol (PI) transaction policy can be done in different ways. According to the invention, the authenticity of the personal information PI is verified prior to the verification of compliance with said condition. Figures 5 and 6 illustrate two verification techniques. For these two FIGS. 5 and 6, the payment terminal 1 and the bank server 2 are considered jointly. Indeed, for certain authentication operations, the payment terminal 1 becomes “transparent” and only serves as a relay or gateway between a payment device 3 or 4 and the bank server 2. For the descriptions of FIGS. 5 and 6, we consider a payment terminal 1 of the chip card reader type, in conjunction with a payment device 3 of the bank card type. However, all the variants of banking terminal or payment device 3 or 4 can replace the system described. In FIG. 5, a first example of a method of using personal information is described. The payment terminal 1 and the payment device 3 implement their respective transaction programs including the subroutines relating to the various steps of the method which will be described and in particular the subroutines relating to the implementation of the transaction policies. Pol (PI). In this first example, the payment terminal 1 and the payment device 3 perform a mutual authentication step 500, as defined in a bank payment protocol, for example the EMV protocol. During this mutual authentication step 500, the payment device 3 and the payment terminal 1 can exchange public keys, certificates, a secret, carry out a challenge, determine a session key and, optionally, exchange a PIN code. The purpose of the authentication step 500 is to allow, on the one hand, the payment terminal 1 to verify that the payment device 3 is an authorized payment device and, on the other hand, the payment device 3 to verify that the payment terminal 1 is an authorized payment terminal and, optionally, that the holder of the payment device validates the transaction on the payment terminal 1. For more details, those skilled in the art will refer to the various standards existing payment transaction. In the context of the invention, any transaction standard can replace the EMV standard and it is not necessary to have mutual authentication when at least one cryptographic key is exchanged between the payment terminal 1 and payment device 3.

According to the state of the art, a transaction step 501 comes after the mutual authentication step 500. During the transaction step 501, the payment terminal 1 and the payment device 3 exchange the transaction data, such as for example the amount of the transaction, and executes each of the offline risk analysis subroutines, possibly supplemented by an online risk analysis by communicating with the bank server 2 then finalize the transaction either by refusing the transaction or by accepting it and memorizing the transaction carried out on both sides.

According to the invention, a step of verifying the personal information PI is added between the mutual authentication step 500 and the transaction step 501. The application of the transaction policy Pol (PI) can then be executed before or at the time of the transaction step 501. In the example of FIG. 5, the payment terminal 1 sends a request 510 requesting one or more personal information PI to the payment device 3. Following this request 510, the payment device 3 sends back a response 520 containing the information. personal PI requested accompanied by an authentication data Sig (PI) of the personal PI information. Then, the payment terminal 1 verifies the authentication data of the personal information PI in a step 530 and, if the latter is authenticated, verifies that the personal information complies with the condition of the transaction policy Pol (PI). The transaction policy Pol (PI) is then applied according to the verification before or during the transaction step 501.

The 510 request can be sent in several ways, or even sent implicitly. According to a first embodiment conforming to the EMV protocol, the request 510 is not sent. During the mutual authentication step 500, information relating to the possibilities of the payment terminal 1 can be sent to the payment device 3 so that the latter is informed of the protocol to be applied with respect to the payment terminal 1 . Among the information sent, the payment terminal 1 indicates that personal data PI is required to finalize the transaction. At the end of the mutual identification step 500, the payment terminal 1 performs a hot reset of the payment device 3, also known by the English terminology “Hot Reset”. Following the reset signal, the payment device 3 sends a response 520 which corresponds to an ATR type message (standing for Answer To Reset) completed by the personal information PI and by a signature Sig (PI) of personal PI information. Preferably the Sig (PI) signature is a cryptographic signature of the personal data PI, for example a signature as defined in the PKCS # 1 standard using a cryptographic key which can be a common encryption key, or an encryption structure to public key, shared by the payment device 3 and the payment terminal 1. Very many types of signatures are possible, as a complementary non-limiting example, a MAC (for English Message Authentication Code) as defined in the publication RFC 2104: “HMAC: Keyed-Hashing for Message Authentication” can also be used. The important thing is that the cryptographic key used by the payment device 3 allows the payment terminal 1 to ensure the authenticity of the personal data PI during step 530. The personal information PI being considered authentic , the payment terminal checks whether said personal information PI complies with the condition of the transaction policy Pol (PI).

According to a second embodiment, the payment terminal 1 sends a request 510 in the form of an APDU type command (standing for Application Protocol Data Unit) defined in the IS07816 standard to read personal information. PI. Among the APDU commands that can be used for the request 510, those skilled in the art can use, by way of nonlimiting example, the commands GET_DATA, READ_BINARY and READ_RECORD make it possible to read information in a payment device 3. In response to the one of these commands identifying the personal PI information or an area containing said PI information, the payment device responds by sending a response message 520 containing the personal PI information accompanied by a certificate or a cryptographic signature Sig (PI ) to allow the payment terminal to authenticate said personal information PI during step 530. The certificate or the cryptographic signature is produced for example according to one of the techniques described above. Since personal PI information is considered authentic, the payment terminal checks whether said personal PI information complies with the condition of the Pol (PI) transaction policy.

FIG. 6 illustrates a second example of a method of using personal information PI. The payment terminal 1 and the payment device 3 implement their respective transaction programs including the subroutines relating to the different steps of the method which will be described and in particular the subroutines relating to the implementation of the transaction policies. Pol (PI). In this second example, the payment terminal 1 and the payment device 3 perform a mutual authentication step 500 and a transaction step 501, as previously defined according to an electronic payment protocol. A verification of the personal information PI is added between the mutual authentication step 500 and the step transaction 501 before applying the transaction policy prior to or at the time of transaction step 501. In the context of the invention, any transaction standard can replace the EMV standard and it is not necessary to have mutual authentication as soon as at least one cryptographic key is exchanged between the payment terminal 1 and payment device 3.

In this second example, the payment terminal 1 sends a request 610 for verifying the personal information PI to the payment device 3 indicating a condition to be verified with respect to the personal information PI in order to apply the policy Pol (PI) transaction. During a step 620, the payment device 3 verifies that the personal information PI corresponds to the condition sent in the request 610. The payment device 3 sends a response 630 to the payment terminal 1 containing the result of the verification. . The payment terminal 1 then applies the transaction policy Pol (PI) as a function of the result of the verification before or during the transaction step 501. Thus, the personal information PI can remain confidential because the only information given is that the personal PI information satisfies the condition of the transaction policy.

The verification request 610 can be sent using a VERIFY type APDU which has a number of data fields which specify the personal PI information to be verified and the condition of the transaction policy. Pol (PI). In addition, in order to guarantee confidentiality of the personal data, the request 610 can also include a signature made using a cryptographic key shared by the payment terminal 1 and the payment device 3. The signature is carried out for example. on all the bits of the request that correspond to the condition. The condition can include a value and a relationship between the value and the personal PI information. By way of example, for a personal information PI corresponding to an age or a date of birth, the value can be the age or the cut-off date of birth and the relation can be a comparison to this age or date of birth of the type "Lower" or "higher". If the personal information is a place of residence, for example For example a country, a postal code or an address, the relation can be of the type "equal" or "different".

On receipt of the request 610, the payment device 3 implements a verification subroutine during step 620. Thus the payment device checks that the signature of the request 610 complies with the condition requested. This first check makes it possible to ensure that the request is indeed sent by the payment terminal 1 which is considered to be a device authorized to perform such a check. Once the request has been verified successfully, the microprocessor 31 of the payment device 3 reads from its memory 33 the personal information PI specified in the request 610. Then, the payment device 3 performs the requested comparison of the information. personal PI with the specified value. Once the comparison has been made, the payment device will then prepare and send back a response 630 corresponding to the result of said comparison. The result is binary, ie the condition is verified or the condition is not verified and the response 630 may correspond to a response message to the VERIFY command validating or invalidating the comparison carried out in a secure manner. Optionally, the response can also be signed using the cryptographic key. The payment terminal 1 then applies the transaction policy Pol (PI) according to the result of the verification, before or during the transaction step 501.

[0082] Those skilled in the art may notice that the second example of implementation of the invention also makes it possible to store personal information PI in the payment device. This keeps personal PI information confidential, which may be sensitive information, such as the holder's address, for example.

In other embodiments, several personal information can be present in the payment device 3 and several Pol (PI) transaction policies can be used during the same transaction. According to a particular embodiment, it is possible to repeat steps 510 to 530 or 610 to 630 as many times as necessary. According to another example of implementation, it is possible to use more complex commands addressing several personal information and / or several conditions simultaneously.

In the examples of Figures 5 and 6, the APDUs used must be defined both in the payment device 3 and in the payment terminal 1. For this purpose, those skilled in the art will understand that it is necessary to codify and standardize such functionalities in order to be able to use them.

According to one variant, it is possible not to use communication interfaces conforming to the IS07816 or IS014443 standards. This is particularly the case when the payment device corresponds to the mobile phone 4.

In this case, the transaction can be done using a radiofrequency communication protocol, for example conforming to the IEEE 802.11 standard better known under the name of Wifi. Securing the transaction can be done by using, for example, an encrypted channel using a transaction method similar to that described above. The embodiments described with the aid of FIGS. 5 and 6 can be applied in a similar manner while taking into account that the messages exchanged between the payment terminal 1 and the mobile telephone 4 will be made according to another exchange protocol. data that does not necessarily use APDUs.

[0086] Regardless of the embodiment implemented, the use of a certification of personal information PI helps to guarantee at the transaction level that the information is authentic. For this purpose, the personal information PI is stored in the payment device 3 by an authorized third party, such as for example a banking establishment, and the certification carried out by the payment device constitutes certification by the authorized third party.

Claims

[Claim 1] electronic transaction method between a payment device (3, 4) associated with a bank account of a user and a payment terminal (1) associated with an acquiring bank account in which the payment device (3, 4) and the payment terminal (1) perform at least one cryptographic key exchange (500) before performing a transaction step (501) during which the transaction is validated or rejected, characterized in that:

- the payment device contains at least one personal information (PI) relating to the user;

- the payment terminal has at least one transaction policy (Pol (PI)) including a condition relating to at least one personal information (PI); and in that the method comprises a verification step (510, 520, 530, 610, 620, 630), prior to the transaction step (501), to verify the condition of the transaction policy relating to the information personal in a secure manner using the cryptographic key.

[Claim 2] A method according to claim 1 for which, the verification step consists in that the payment device (3, 4) sends (520) the personal information accompanied by a cryptographic signature (Sig (PI)) made. using the personal information and the cryptographic key in order to authenticate the personal information and in that the payment terminal (1) verifies (530) the condition of the transaction policy after having authenticated the information personal.

[Claim 3] The method of claim 2 for which, prior to sending (520) the personal information (PI), the payment terminal (1) sends (510) a request to the payment device to cause the payment. sending personal information (PI) by the latter.

[Claim 4] A method according to claim 1 for which the verification step consists of the payment terminal (1) sending (610) a request for verifying the transaction policy (Pol (PI)) to the payment device. payment (3, 4) the request being signed using the cryptographic key, and in that the verification (620) of the condition of the transaction policy is carried out by the payment device (3, 4), after having authenticated the request using the cryptographic key, which generates and transmits (630) a validation or invalidation message to the payment terminal depending on the condition and the personal information (PI).

[Claim 5] Method according to one of claims 1 to 4, in which the amount of the transaction is modified by the payment terminal according to the result of the verification step.

[Claim 6] The method according to one of claims 1 to 5, wherein the cryptographic key exchange is performed during a mutual authentication step.

[Claim 7] Electronic transaction method implemented by a microprocessor of a payment device (3, 4) associated with a bank account of a user intended to cooperate with a payment terminal (1) associated with a bank account acquirer in order to perform a transaction step (501) during which the transaction is validated or rejected, said method comprising a step for exchanging with the payment terminal (1) at least one cryptographic key (500), characterized in that the payment device comprises at least one personal information (PI) relating to the user recorded in a data memory, and in that the method comprises a verification step (510, 520, 530, 610, 620, 630) d A condition of a personal information transaction policy is securely verified using the cryptographic key.

[Claim 8] The method of claim 7 for which, the verification step comprises sending (520) a message containing the personal information accompanied by a cryptographic signature (Sig (PI)) made using personal information and the cryptographic key in order to authenticate said personal information.

[Claim 9] The method of claim 7 for which, the step of verifying (620) the condition of the transaction policy comprises a prior step for authenticating a request sent by the payment terminal (1) containing the condition of the transaction. transaction policy, query being signed using the cryptographic key, and a sending step (630) of a validation or invalidation message as a function of the condition and of the personal information (PI).

[Claim 10] Electronic transaction method implemented by a microprocessor of a payment terminal (1), associated with an acquiring bank account, intended to cooperate with a payment device (3, 4) associated with a bank account of 'a user, said method comprising a step for exchanging at least one cryptographic key (500) with the payment device (3, 4), a transaction step (501) during which the transaction is validated or rejected, characterized in that the payment terminal comprises at least one transaction policy (Pol (PI)) comprising a condition relating to at least one personal information (PI) relating to the user of the payment device, in that the method comprises a step verification (510, 520, 530, 610, 620, 630) to request verification of the condition of the transaction policy relating to personal information using the cryptographic key, and in that the transaction step is mi is implemented if and only if the condition is true.

[Claim 11] The method of claim 10 wherein, during the verification step, the method comprises a step for receiving (520) a message including personal information accompanied by a cryptographic signature (Sig (PI)) performed using the personal information and the cryptographic key and a step for verifying (530) the condition of the transaction policy after authenticating the personal information using the cryptographic key.

[Claim 12] The method of claim 10 or 11, the method comprising a step for developing and transmitting (510) a request to the payment device in order to obtain personal information (PI).

[Claim 13] The method of claim 10 wherein, the verification step consists of developing and transmitting (610) a request for verifying the transaction policy (Pol (PI)) to the payment device (3, 4), the request being signed using the cryptographic key.

[Claim 14] The method according to one of claims 10 to 13, the method comprising a step for modifying the amount of the transaction according to the result of the verification of the condition prior to the validation of the transaction.

[Claim 15] An electronic transaction system comprising a payment device (3, 4) associated with a bank account of a user and a payment terminal (1) associated with an acquiring bank account in which the payment device (3, 4 ) and the payment terminal (1) are configured to perform an exchange of at least one cryptographic key (500) before performing a transaction step (501) during which the transaction is validated or rejected, characterized in that the payment device (3, 4) comprises at least one personal information (PI) relating to the user and the payment terminal (1) comprises at least one transaction policy (Pol (PI)) comprising a condition relating to the 'at least one personal information (PI), and in that the device and the payment terminal are configured to perform a verification step (510, 520, 530, 610, 620, 630) between the exchange step of cryptographic key (500) and the transaction step n (501) in which the condition of the Personal Information (PI) Transaction Policy (Pol (PI)) is securely verified using the cryptographic key.

[Claim 16] The system of claim 15, wherein the payment device (3, 4) is configured to transmit to the payment terminal (520) a message containing the signed personal information (PI) (Sig (PI)) to using the personal information and the cryptographic key in order to authenticate the personal information (PI) and in which the payment terminal (1) is configured to verify (530) the condition after having authenticated the personal information using the cryptographic key.

[Claim 17] The system of claim 16, wherein the payment terminal is configured to generate and transmit (510) a request to the payment device to obtain personal information.

[Claim 18] A system according to claim 15, wherein the payment terminal (1) is configured to generate and transmit (610) to the payment device (3, 4) a request for checking the condition of the policy. transaction (Pol (PI)) signed using the cryptographic key and in which the payment device (3, 4) is configured to authenticate said request using the cryptographic key before verifying (620) the condition in response to the verification request and to send (630) a validation or invalidation message to the payment terminal (1) as a function of the condition and of the personal information.

[Claim 19] The system according to one of claims 15 to 18, wherein the payment terminal (1) is configured to modify the amount of the transaction depending on the result of the verification step.

[Claim 20] Payment device (3, 4) associated with a bank account of a user intended to cooperate with a payment terminal (1) to perform an electronic transaction, said payment device (3, 4) being configured for exchange at least one cryptographic key (500) with the payment terminal (1), characterized in that the payment device (3, 4) comprises at least one personal information (PI) relating to the user, and in that the payment device (3, 4) is configured to perform a verification step (510, 520, 530, 610, 620, 630) of a condition of a transaction policy (Pol (PI)) relating to the personal information (PI) securely using the cryptographic key.

[Claim 21] Device according to claim 11, wherein the payment device (3,4) is configured to send to the payment terminal (1) the personal information (PI) in a signed message (Sig (PI)) to using personal information (PI) and cryptographic key to authenticate personal information.

[Claim 22] An apparatus according to claim 20, wherein the payment device is configured to verify (620) the condition of the transaction policy (Pol (PI)) in response to receiving a verification request containing the condition. , said request being signed and transmitted by the payment terminal (1) using the cryptographic key, and to develop and transmit (630) a validation or invalidation message to the payment terminal (1) according to condition and personal information.

[Claim 23] Device according to one of claims 20 to 22, in which the payment device (3, 4) is a device included in the following list: smart card conforming to the IS07816 standard and / or to the 14443 standard , mobile phone or tablet comprising a secure payment capacity, smart watch comprising payment functionalities, secure computer comprising a contact or contactless communication interface and comprising a secure payment capacity.

[Claim 24] Payment terminal (1) associated with an acquiring bank account intended to cooperate with a payment device (3,4) associated with a bank account of a user to perform an electronic transaction in which the payment terminal ( 1) is configured to exchange at least one cryptographic key (500) with the payment device before implementing a transaction step (501) during which the transaction is validated or rejected, characterized in that the payment terminal (1) comprises at least one transaction policy (Pol (PI)) comprising a condition relating to at least one personal information (PI) stored in a memory of the payment device, said personal information (PI) relating to the user , and in that the payment terminal (1) is configured to implement a verification step (510, 520, 530, 610, 620, 630), before the transaction step (501), during which the condition of the transaction policy relating to personal information is verified in a secure manner using the cryptographic key.

[Claim 25] A terminal according to claim 24, wherein the payment terminal (1) is configured to receive a message containing the personal information (PI) signed (Sig (PI)) using the personal information and of the cryptographic key by the payment device and in which the payment terminal (1) is configured to verify (530) the condition after having authenticated the personal information using the cryptographic key.

[Claim 26] A terminal according to claim 25, wherein the payment terminal (1) is configured to generate and transmit (510) a request to the payment device (3, 4) in order to obtain the personal information (PI). .

[Claim 27] A terminal according to claim 24, wherein the payment terminal (1) is configured to generate and transmit (610) to the payment device (3, 4) a request for verifying the condition of the transaction policy ( Pol (PI)) signed using the cryptographic key, and in which the payment terminal (1) is configured to terminate the transaction following a validation or invalidation message sent back by the payment device according to condition and personal information.

[Claim 28] Terminal according to one of claims 24 to 27, wherein the payment terminal (1) is configured to modify the amount of the transaction according to the result of the verification step.

[Claim 29] Terminal according to one of claims 24 to 28, wherein said payment terminal (1) is included in the following list of devices: point of sale terminal for chip card, mobile phone or tablet comprising a capacity secure payment registration, cash register including secure payment registration capability.