FR2824659A1 - Method for verifying the integrity of a terminal used in a transaction with a chip card by calculation of a cryptograph that can be compared with that of a card-holder - Google Patents

Abstract

Method has the following steps: supply (20) of a cryptograph calculated using information that can be read from the card memory, during a transaction, reading (24) by the terminal of data in the card memory and calculation of a cryptograph using the read information and display (28) by the terminal of the calculated cryptograph. The owner can thus compare the calculated cryptograph with that input. An Independent claim is made for a terminal with a card reader, a circuit for calculating a cryptograph using information originating from the reader and a display for outputting the calculated cryptograph.

Description

otherwise.

  METHOD FOR VERIFYING THE INTEGRITY OF A TEINAL DURING

  OF A TRANSACTION WITH A MEMORY CARD

  The present invention relates to terminals using memory cards, and more specifically, the integrity of such terminals. Terminals using memory cards are now widespread, especially

  proportion of the use of memory cards, magnetic stripes or integrated circuits.

  ISO 7816-1 to 11, ISO 781O, ISO 7811, EMV 3.1.1, EMV 4.0 etc ...

  define the characteristics of such cards. Examples of payment terminals are described in EMV 3.1.1, EMV 4.0, MPE V5.2, ISO 8583 (Protocol

CB2A).

  Payment terminals using cards most often operate in the following manner. The merchant enters the amount of the transaction. The customer's card is inserted into the terminal, in the case of a smart card, or read by the terminal in the case of a magnetic stripe card. The terminal then invites the customer to enter on the terminal keyboard a personal identification number (or PIN, abbreviation of English "personal identification number"); this number is assumed to be known only to the card holder. To accept the transaction, the customer types their number. The terminal then checks the number; in the case of a smart card, the number is transmitted to the card. If it is determined in the card that the number provided is correct, the card issues a certificate to the terminal, which validates the transaction; in the case of a magnetic stripe card, the number is transmitted to an authorization center, which returns to the data terminal which is printed on the ticket. This process is for example described in detail in the Manual of electronic payment edited by the Groupement des Cartes Bancaires. A similar process is

  implemented in automatic teller machines.

  One of the problems encountered for such terminals is that of the integrity of the terminal. Indeed, the validation of a transaction assumes that the card holder enters their personal identification number into the terminal. It is important that the holder has enough confidence to type his number and thus provide this number to the terminal; identified fraud consists in effect of making a false terminal to recover an identification number as well as the corresponding information from the card Other physical attacks on a terminal make it possible to recover certain H: \ DACrYUi \ 18400 \ 18483.doc. 11 10ilJ05 / 01 - 1/12

2 2824659

  secrets or keys used for example to encrypt an identification number during online transactions. The international standards EMV (Eurocard-Mastercard-Visa) thus impose on the terminal the intogration of mechanisms making them "tamper resistant", that is to say resistant to falsification or even "tamper evident", that is to say say making a forgery obvious. These mechanisms are designed to protect an authentic terminal and avoid any prohibited intervention on the terminal. This is particularly the case if the card holder is convinced of the integrity of the terminal; thus, he is not afraid that his number could be stored in memory to be used without his knowledge. Conventional solutions to this problem consist in securing the terminal, so that malicious people cannot derive information entered into the terminal, without the intervention on the terminal being visible to the card holder. These solutions are therefore based

  implicitly on a visual verification of the integrity of the terminal by the user.

  In addition, there is the problem for traders of remote transactions; Remote transactions are transactions for which the merchant is not in possession of the customer's card. It can be transactions by telephone or through a network like the Internet. The merchant in such transactions has an interest in verifying that the customer has a card and that this card is legitimate. The company Visa U.S.A. Inc. offers under the reference CVV2 a solution to this problem, in the form of a three-digit value, which constitutes a cryptographic verification of the data contained in the magnetic strip of the card. This value is printed on the back of the card, but is not contained in the magnetic strip and does not appear on sales receipts either. The process for exploiting the CVV2 value is as follows. During an online transaction, for example an electronic transaction, the merchant asks the user for his card number and the expiration date of the card; he also asks him for the CVV2 value printed on the back of the card. The merchant transmits this information to his bank or to his authorization center and receives in return a response validating or not the CVV2 value. Insofar as the value CVV2 does not appear among the information recorded on the magnetic strip, nor on sales receipts, this value cannot be deduced by a malicious fraudster during a dummy transaction, except by copying the value on the back of the card; similarly, it cannot be deduced simply from the information present on a sales receipt. This solution H: \ DACTYLO \ 1 R400H R4g3.doc - I 1:10. 05/11/01 - 12/12

3 2824659

  is specifically designed for magnetic strip eartips, in order to prevent merchants from accepting counterfeit cards or fraudulent distance transactions. There is therefore a need for a time-saving process to improve the confidence of users of bank cards in temlinaux. An embodiment of the present invention therefore proposes a process for verifying the integrity of a terminal during a transaction using a memory card, comprising the steps of - providing the holder of the memory card a cryptogram calculated using readable information in the card memory; - during a transaction, reading by the tenminal of information in the memory of the card and calculation by the terminal of an eryptogram using the information read in the memory of the ear; - posting by the tenminal to the holder of the ear of the eryptogram

I eally.

  The process advantageously comprises, after the ripening step, a step of

  comparison by the holder of the displayed eryptogram and of the eryptogram supplied.

  In this case, if the comparison step is positive, provision may be made for the holder to enter personal information such as a number on the terminal.

personal identification.

  The memory ear can be an integrated ear or a magnetic track ear, and in ee eas, the closure includes reading the integrated circuit or the

runway through the terminal.

  It is possible that the step of ealeul by the terminal of an eryptogram is carried out according to the same process as the ealcul producing the cryptogram supplied to the holder; the information read from the memory of the

  card and a key contained in the temlinal.

  In one embodiment, the calculation step understands the choice in function

  from the transmitter of the ear of an ele contained in the terminal.

  Another embodiment of the invention proposes a tenminal, including - a memory card reader, - a circuit for calculating a cryptogram using information from the reader; and H: U) ACrY11) \ 18400 \ 18483 doc. 11: 1 0 - 11/05 101 - 3/1 2

4 2824659

  - a display showing the calculated cryptogram.

  It is also possible to provide a storage cabinet for at least one readable key.

  by the calculation circuit, as well as a security module containing the calculation circuit.

  In this case, it is preferable that the security module also contains the memory

Storage.

  It is also possible to provide for the terminal to present a second card reader and a memory card in the second reader, the second card containing the calculation circuit. Other characteristics and advantages of the invention will appear on reading

  the following description of embodiments of the invention, given by way of example

  and with reference to the accompanying drawings which show: - Figure l a schematic representation of a payment terminal; - Figure 2 a flowchart of an embodiment of the invention; - Figure 3 a flowchart of a calculation of cr, vptogram that can be used to implement the invention;

  - Figure 4, a schematic representation of the architecture of a terminal.

  The inventi on offers a so luti on to the new fraud represented by the construction of a completely dummy terminal, with the aim of fraudulently obtaining the information relating to a card and then the identification number of the card holder . It allows a user to verify the authenticity of a terminal, without relying solely on visual examination of the terminal. Thus, it improves the confidence of

  cardholders in payment terminals.

  Figure 1 shows a schematic view of a payment terminal 2. This includes a keyboard 4 allowing the merchant to enter the amount of a

  transaction and the cardholder to enter their personal identification number.

  The terrninal also includes a screen 6, which allows the amount of the proposed transaction to be displayed, like a prompt for the card holder to enter their identification number. The terminal is provided with a card reader 8; as in FIG. 1, it may be a smart card reader according to ISO 7816-3 or EMV 3.1. 1; it is also possible to provide, alternately or in combination, a magnetic stripe card reader according to ISO standard 7811. A card 10 is shown in the figure.

reading in the terminal.

  H: \ DACrYlol84oo \ l8483 doc. I 1:10. 11105/01 - 4112

2824659

  Figure 2 is a flow diagram of an embodiment of the invention; in a first step 20, a cryptogram is provided to the card holder. This cryptogrammc is calculated from the information contained in the card, using a complex calculation; an example of calculation of the cryptogram is provided below in reference to FIG. 3. The calculation is said to be complex in that it is not easily reproducible by a fraudster: it is in particular possible to use a function kept secret to calculate the cryptogram; well-known encryption algorithms can also be used, and the secret can be kept useful or several keys used for the calculation of the cryptogram using these algorithms. It will appear to those skilled in the art that the qualification of "complex" is essentially qualitative, in a given context. The cryptogram is provided to the card holder by the card issuer, or by the payment terminal manager. It can be supplied in different forms; in one example, the cryptogram is printed on the card, for example printed on the back of the card. It can also be provided to the card holder along with their personal identification number; in this case, it is not necessarily printed on the card itself. The fact that the cryptogram is printed on the card guarantees that the card holder can easily find it; it is also advantageous in this case that the cryptogram can be read by the holder when the card is in the terminal reader. If the cryptogram is not printed

  on the card, it cannot be read by fraudsters and subsequently reproduced.

  Steps 22 to 36 describe a transaction. In the example in the figure, it is a payment from a merchant, cant using a payment card. The method described applies more generally to any type of transaction, that is to say to any operation in which the card holder is asked to provide a terminal 25 with his identification number, which e that this is the finality of this operation. Step 22 is characteristic of a transaction: the merchant enters the amount of the transaction using the terrninal keyboard; this amount is displayed on the terminal. In step 24, the integrated circuit card is inserted into the terminal reader and is read by this reader; alternatively, the magnetic strip of the card could be read by the

terminal.

  In step 26, the terminal calculates, as a function of the information read from the card, a cryptogram. This cryptogram can be calculated as explained with reference to Figure 3; it is calculated according to the same method as that used in step 20 for H \ DACTY11) \ 18400 \ 18483 doc 11 10. 11105101 - 5/12

6 2824659

  provide a cryptogram to the card holder. In step 28, the cryptogram is displayed on the screen, so that it can be read by the card holder. The display of the cryptogram allows the card holder to compare the cryptogram calculated by the terminal with the cryptogran1me which has been supplied to him. If the cryptogram displayed by the terminal is identical to the cryptogram supplied to the card holder, the card holder can assume that the terminal is an authentic terminal; in fact, the terminal is able to calculate the cryptogram from the data read from the card. On the other hand, if the cryptogram displayed by the terminal is not identical to the cryptogram supplied to the holder, the latter may assume that the terminal could not calculate the cryptogram and is therefore not an authentic terminal. So is

  even in the absence of display of a cryptogram.

  In step 30, the card holder therefore compares the cryptogram displayed with that supplied to him in step 20. If the cryptograms are identical, the holder enters his personal identification number, which is shown on the figure in step 32. On the other hand, if the cryptograms are not identical, or even in the absence of display of a cryptogram, the card holder can interrupt the transaction, which is shown in step 34 of the figure. After step 32, the method proceeds to step 36: as in the prior art, the terminal checks the identification number and validates the transaction. The process is

  finished - step 38 - after step 34 or 36.

  The process of FIG. 2 allows the card holder to verify the authenticity of a terminal, before providing his identification number or confidential information. Unlike the state of the art, in which the card holder can only visually examine the terminal, the process in FIG. 2 immediately and simply allows the card holder to know that the probability of authenticity of the terminal is high. The process is no longer based on mechanical elements, but on the contrary on a cryptographic calculation, which can

  be made as complex as you want.

  The method of FIG. 2 is different from the CVV2 method described above. Indeed, it differs first in its implementation; in the prior art, the CVV2 value is not displayed by a terminal during the transaction to be read by the card holder, but is simply used by the merchant. The process also differs in its finality: the state of the art represented by the CVV2 process aims at H: \ DACTYLO \ 18400 \ 18483 doc 11 10 - 11/05/01 - 6/12

7 2824659

  to allow the merchant to verify the legitimacy of the card offered to him, in a remote transaction. On the other hand, the method of FIG. 2 aims to

  to allow the card holder to verify the integrity of the terrnina].

  Figure 3 shows an example of calculating a cryptogram, which can be used for implementing the method of Figure 2. In the example, the cryptogram is calculated using a triple DES algorithm and keys which are loaded in the temlinal in a secure environment. Figure 3 shows on the one hand in 40 the information read on the card, for example the card number. It is generally possible to use for the calculation of the cryptogram any information contained in the memory card and capable of being read by the terminal. This information is provided as input to an algorithm 42 which in the example of the figure is a triple DES algorithm. FIG. 3 also shows a secret key 44 which constitutes the other entry of the algorithm 42. This key can be part of a plurality of keys 46 supplied to the terminal by the different possible issuers of cards. The application of the algorithm to the information contained in the card and to the key provides a result; this result, or part of it, constitutes the cryptogram 48 which is displayed for the benefit of the card holder. In the example of a triple DES algorithm, the cryptogram can consist of the four "nibbles"

  (set of 4 bits) of low weight of the result of the algorithm.

  Figure 4 shows a schematic representation of the architecture of a terminal. In the example, the cryptogram calculation is implemented in the terminal in a security module. This module is protected in a manner known per se, for example by ensuring that an attempt to break in the terminal causes the erasure of keys and software, or even by physical protection such as the fact of drowning the components in the resin . The security module contains one or more keys dedicated to the cryptogram calculation. These keys are loaded in a secure environment, for example during the manufacture of the terminal, by each of the card issuers. The card issuer uses the same secret to generate the cryptogram when it provides it to the card holder and when the cryptogram is calculated in the terminal. If the process is implemented for several issuers, the cryptogram calculation begins with an identification of the issuer of the card

  to choose the corresponding key.

  H: \ DAC1YLO \ 1840018483 doc - 11:10 am - 05/11/01 - 7/12

8 2824659

  The security module of the tenminal can be the same as that which controls the entry of the personal identification number of the card holder, or its encrypted transmission to the server center for online systems. He can also carry out the local verification of the personal identification number. The fact of using the same security module makes it possible to implement the method of FIG. 2 without modifications to the hardware architecture of a terminal, by simply implementing complementary software functions in the terminal. FIG. 4 therefore shows the keyboard 4,1 'screen 6, the reader 8, as well as the security module 50. This comprises a calculation circuit 52 and a memory 54 for the storage of one or more keys 56 used by the calculation circuit. The arrows in the figures show that the calculation circuit receives the information read from the memory of the card by the reader 8, the information entered on the keyboard 4, as well as the key or keys stored in the memory. It sends the cryptogram to the screen, for display

  to the card holder.

  Of course, the invention is not limited to the embodiments described above; thus, FIG. 2 shows the case of a transaction carried out on a payment terminal; the method also applies to an online transaction, for which the reading of the card information can be replaced by a transmission of the card number and the expiration date to the merchant. In this case, the method allows the user to verify that the merchant actually has the means of calculating the cryptogram; this suggests that the terminal is intact, in other words that the merchant has not fraudulently attempted to interfere with the

terminal it has.

  In the example of FIG. 2, the method is applied to a payment at a merchant. It applies more generally to any type of transaction, in which the card holder must provide confidential or close information to a nearby or remote terminal. Thus, in an access security system, the method can be used to verify the integrity of the terminal before the card holder enters an identification number or pronounces a password - in the case of '' identification by voice - or even allow the terminal to read a

  biological characteristic such as fingerprints or an eyeprint.

  H. \ DACrYLO \ la400 \ 1 8, iS3 doc - I 1:10 - i 1/05/01 - 8/12

9 2824659

  Such terminals do not necessarily include a keyboard since they

  present other means of entry by the holder of personal information.

  The comparison in FIG. 2 must lead to an identity of the cryptogram calculc and that which is provided to the card holder; one can also imagine other embodiments, for example an increment of the cryptogram calculated during each transaction. We could still perform the cryptogram calculation not in a terminal security module, but in a merchant memory card installed in the terminal; in this case, the merchant's memory card serves as a security module and protects against means the fraudsters

for calculating the cryptogram.

  H: \ DACTYLO \ lé400 \ 18483 doc - I 1:10 - I 1/05 / 01- 9112

2824659

Claims (13)

  1. Method for verifying the integrity of a tenminal (2) during a transaction using a memory card (10), comprising the steps of providing (20) to the holder of the memory card a calculated cryptogram using readable information in the card memory; - during a transaction, reading (24) by the tenminal of information in the memory of the card and calculation (26) by the terminal of a cryptogram using the information read in the memory of the card; - display (28) by the terminal to the card holder of the calculated cryptogram. 2. The method of claim 1, characterized in that it comprises, after the display step (28), a comparison step (30) by the holder of the cryptogram displayed and the cryptogram provided.   3. The method of claim 2, characterized in that it comprises, if the comparison step is positive, an entry step (32) by the holder on the terrninal of a   personal information such as a personal identification number.   4. The method of one of claims I to 3, characterized in that the card to   memory is an integrated circuit card, and in that the reading step (26) comprises   reading of the integrated circuit by the terminal.   5. The method of one of claims I to 3, characterized in that the card is a   magnetic stripe card, and in that the reading step (26) includes reading the magnetic strip by the terminal.   6. The method of one of claims I to 5, characterized in that the step of   calculation (26) by the tenminal of a cryptogram is carried out according to the same process   than the calculation producing the cryptogram supplied to the holder.   7. The method of one of claims I to 6, characterized in that the step of   calculation by the terminal of a cryptogram is carried out using the information read H: \ DACI.YLO \ 18400 \ 18483 doc - 11:10 - 11/05101 - 10/12   in the card memory and a key contained in the terminal.   8. The method of claim 7, characterized in that the step of calculating comprises the bell function according to the transmitter of the card of a key contained in the terminal. 9. A terminal (2), comprising - a memory card reader (8), - a circuit for calculating (52) a cryptogram using information coming from the reader; and   - a display (6) displaying the calculated cryptogram.   10. The terminal of claim 9, characterized in that it further comprises a   memory (54) for storing at least one key (56), readable by the calculation circuit.   11. The terminal of claim 9 or 10, characterized by a security module   (50) containing the calculation circuit (52).   12. The terminal of claim 11, characterized in that the security module   l S also contains the storage memory (54).   13. The terminal of claim 9 or 10, characterized by a second card reader and by a second memory card in the second reader, said card containing the calculation circuit.