EP0298831B1 - Anti-fraud device and method for a selective access system - Google Patents

Anti-fraud device and method for a selective access system Download PDF

Info

Publication number
EP0298831B1
EP0298831B1 EP88401646A EP88401646A EP0298831B1 EP 0298831 B1 EP0298831 B1 EP 0298831B1 EP 88401646 A EP88401646 A EP 88401646A EP 88401646 A EP88401646 A EP 88401646A EP 0298831 B1 EP0298831 B1 EP 0298831B1
Authority
EP
European Patent Office
Prior art keywords
memory
card
access
prom
confidential code
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP88401646A
Other languages
German (de)
French (fr)
Other versions
EP0298831A1 (en
Inventor
Simon Barakat
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Schlumberger SA
Original Assignee
Schlumberger SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Schlumberger SA filed Critical Schlumberger SA
Publication of EP0298831A1 publication Critical patent/EP0298831A1/en
Application granted granted Critical
Publication of EP0298831B1 publication Critical patent/EP0298831B1/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1025—Identification of user by a PIN code
    • G07F7/1083—Counting of PIN attempts

Definitions

  • the present invention relates to a method and a device intended to prevent the fraudulent use, on a selective access system, of spoofed access titles, by means of an effective detection of the operations for systematic search of the confidential codes assigned to these security titles. access.
  • the invention aims, for example, to prevent fraudulent use, on cash registers, of stolen magnetic credit cards.
  • the method of the invention comprises, in a known manner, the steps consisting in: obtaining, on each presentation to the system of an access ticket, the result of a verification of the validity of a confidential code indicated by the user of this title, this result being interpreted as a success if this code is valid and as a failure otherwise; keep, in a memory, a trace of the failures observed during successive presentations of access tickets; and emitting a fraud indicator signal when the number of these failures exceeds a predetermined limit.
  • each access title consists of, or contains, information, generally public, which makes it possible to verify, thanks to a relationship kept secret, the validity of the confidential code that the user of the access title provided independently, for example via a keyboard.
  • the known solution to prevent this fraud consists in keeping, in a memory of the cash register, a list of numbers or identification codes of the last magnetic cards, for which the confidential code entered by the customer was false.
  • Security is obtained by imposing a limit on the number of appearances of the same number on this list, that is to say by imposing a maximum number of failures for the same magnetic card.
  • the document FR-A-2349181 describes such a method, intended to avoid the fraudulent use of credit cards with magnetic strips used in particular for the distribution of banknotes.
  • any new failure removes from memory the number of the card which was the oldest failure, so that all traces of the latter disappear.
  • the security device can therefore be deceived by searching for the confidential codes of several magnetic cards at the same time, by proceeding in rotation and in such a way that the ratio of the maximum number of numbers stored in the list, to the number of cards tested, remains lower. the limit number of failures whose exceeding would result in the cancellation of a card.
  • the aim of the present invention is to propose a security method and device which, thanks in particular to a great saving in memory space, does not have the faults of the technique described above.
  • the method of the invention is essentially characterized in that the operation consisting in keeping track of failures itself comprises the operations consisting in: defining, in the memory, a plurality of memory areas; assign to each access title presented one of the classes from a set of classes each of which corresponds to a memory area; and keep, in each zone of the memory, the count of the number of failures which are subject to those of the access titles presented which belong to the class to which this zone of memory corresponds, and in that the operation d 'emission of a fraud indicator signal is conditioned by the exceeding, by the number of failures recorded in any of the areas of the memory, of a limit number assigned to this area and constituting said predetermined limit.
  • each magnetic card is assigned at least one intrinsic attribute, such as the confidential code, or an identification number, the class number. assigned to each magnetic card is preferably deduced from the intrinsic attribute of this card by the application of a predetermined surjective function.
  • the number of the class assigned to each magnetic card is given by a set of at least one digit extracted from the identification number of this card, each digit being extracted according to a position it occupies in this number, and this position being predetermined and chosen closer to the end of the identification number, in the writing direction of the latter, than to the beginning of this number, so that all the possible values, from 0 to 9 , of each digit extracted, are substantially equiprobable for all of the cards presented, said limit number then being the same for all the memory areas.
  • each class in a simple embodiment of the invention, the correspondence between each class and a memory area is such that the number of each class defines the address of the memory area to which it corresponds.
  • the method of the invention can comprise a second operation of emission of a fraud signal, conditioned by the overrun, by the number of failures recorded in the set memory areas, a second predetermined limit.
  • the device of the invention comprises, in a known manner: means for entering information suitable for receiving on the one hand at least one intrinsic attribute of the access ticket, this attribute being linked to said exact confidential code of this and on the other hand a confidential code indicated by the user of the access ticket; processing means linked to the input means, capable of verifying the validity of the confidential code indicated by the user; and a memory connected to the processing means, in which the latter record failure data each time that a confidential code turns out to be invalid.
  • this device is essentially characterized in that, the memory being divided into areas accessible to different addresses, the processing means are designed to develop a memory address as a function at least of said attribute of the access ticket, and to save the failure data in the memory zone corresponding to this address.
  • the memory advantageously comprises a read-only memory, in which each failure data item is recorded in the form of a single bit.
  • the memory consists of the PROM memory of a memory card, while the processing means comprise the microprocessor thereof.
  • the invention relates to a method and a device for preventing fraudulent use of a spoofed access document, in combination with a selective access system.
  • selective access system we mean precisely a system capable of granting each of the potential users a certain privilege, such as access to a service or delivery of a product, provided that this user presents to this system a valid access document, the validity of which is confirmed by that of a confidential code also supplied by the user.
  • a computer system managing a database to which users can only access after having indicated their name or user code on the one hand and the exact confidential code assigned to them on the other, constitutes a system with selective access; a cash register, which is equipped with a magnetic credit card reader and a keyboard by means of which the card holder indicates his confidential code, and which accepts payment by card only after verification of the validity another code with selective access.
  • the user's access title is immaterial in nature: it consists, for example, of a series of letters; in the second example, the user's access title is of a physical nature: it is a magnetic card; these two cases are however similar in the sense that, in both cases, the access titles are personalized, vis-à-vis the user, by intrinsic attributes generally devoid of confidentiality, namely the proper name of the user in the first example, and the identification number or code of the user's magnetic card in the second example.
  • access to the system is obtained only after the user has indicated a confidential code which has been assigned to him, and verification of the validity of this code; this verification is for example carried out by the comparison of a function of the confidential code, itself kept secret, with the intrinsic attribute of the access title.
  • the comparison reveals a disparity, its result leads to a failure in terms of access to the system, while this result leads to a success, i.e. access to the system, if the comparison reveals an identity.
  • the SAS selective access system schematically represents a cash register
  • the invention is applicable, as those skilled in the art will perceive, to any other selective access system , and in particular to a computer system managing a database.
  • the SAS cash register comprises in particular, in a known manner, a management unit UG connected to several peripheral organs, including a magnetic card reader LCM, an console interface circuit ICS and a telephone interface circuit ITL.
  • the LCM reader makes it possible to read an attribute of each magnetic card CM, for example the number or identification code CODIDENT of this card.
  • the ICS interface connected to the CS console, is capable of receiving the confidential code CODCONF typed by the user of the CM card.
  • the SAS cash register also has an interface circuit for an ICE electronic card, allowing a bidirectional exchange of information between the management unit UG and an electronic microprocessor card CE.
  • Interface circuits such as ICE, and electronic cards such as CE, are well known to those skilled in the art, so their detailed description is unnecessary here.
  • the electronic microprocessor cards CE comprise an microprocessor mP generally connected to a read-only memory non-programmable ROM, to a read-only memory programmable PROM, and to a random access memory RAM.
  • This CE card is traditionally provided with means, not shown, allowing the mP microprocessor not only to read, but also to write, data in the read-only memory PROM.
  • CE electronic cards are also conventionally provided with means preventing access, from outside the card, to the information recorded in the PROM memory. In fact, these properties are those which are sought for the implementation of the invention, for which the specific recourse to the use of an electronic card remains optional.
  • the merchant owner of the SAS cash register, must insert a CE electronic card in the ICE circuit to allow the cash register to function.
  • the VALPROM signal is for example stored in the PROM memory of the electronic card CE.
  • the microprocessor mP verifies that the electronic card CE has been validated by seeking whether the VALPROM data item is present in the memory with a value representative of its validity.
  • the microprocessor mP sends to the ICE circuit an INVALPROM blocking signal which inhibits the operation of the SAS cash register.
  • the CE electronic card when validated, receives, via the LCM reader, the UG unit and the ICE interface, the CODIDENT identification code of the magnetic card CM, generally consisting of a simple serial number.
  • the electronic card CE receives the confidential code CODCONF introduced by the user of the card CM by means of the console CS, via the interface ICS, the unit UG and the interface ICE.
  • each digit of the CODCONF code is itself coded in the console CS and decoded by the microprocessor mP, so as to avoid any fraudulent interception of the confidential code CODCONF, for example on the line connecting the console CS to the interface circuit ICS.
  • the mP microprocessor having the CODIDENT identification code and the CODCONF confidential code, verifies the validity of the latter by looking, in a manner known per se, if the compatibility conditions which must exist between CODIDENT and CODCONF are actually satisfied.
  • the microprocessor mP issues a VALACCES order authorizing access to the SAS system, that is to say payment by means of the CM card, on the SAS cash register.
  • the method which is the subject of the invention no longer treats the magnetic card CM as the access ticket which is unequivocally defined by its identification code CODIDENT, but as an undifferentiated element of a class. to which corresponds an area of the PROM memory.
  • the method consists in assigning, to the CM card whose CODCONF code is invalid, one of the classes of a set classes whose number is equal to that of the memory areas.
  • the PROM memory usable for the implementation of the invention comprises 4 Kbytes, and is considered to consist of 1000 areas of 32 bits each.
  • the class of each magnetic card is determined by the last three digits of CODIDENT, that is to say the three least significant digits.
  • a magnetic card CM taken at random has a homogeneous probability, equal to 0.001, of belonging to any of the classes.
  • the microprocessor mP reads the number recorded in the area of the PROM memory which corresponds to this class.
  • the microprocessor reads the contents of the PROM memory area of address 357, that is, in other words, the contained the 357 th PROM area.
  • the microprocessor mP issues an INVALPROM command, which inhibits the operation of the SAS cash register.
  • the merchant who owns this box can recover normal use only after having received, in the form of a VALPROM signal transmitted over the telephone network, authorization to use a new CE electronic card. , as previously described.
  • the number read in zone 357 of the PROM memory is not equal to this limit of 32 bits, it is increased by one unit, that is to say modified by setting the first bit to "1" which in the 32-bit series stored in this area is a "0" bit.
  • This operation corresponds to the recording, in the PROM memory, of the failure to access the SAS cash register for the CM magnetic card, or for any other CM card belonging to the same class as it.
  • the microprocessor mP reads all the bits recorded in all the PROM memory, each of which corresponds to an access failure, and compares the total with a second predetermined limit number, for example 96.
  • the mP microprocessor issues an INVALPROM signal.
  • the microprocessor mP In the event of an inequality, the microprocessor mP emits an INVALACCES signal. This last signal has the effect of informing the merchant, and the card holder, of the invalidity of the confidential code, of temporarily refusing payment by card, but of authorizing a new introduction of the confidential code.
  • the probability that a person, ignoring the confidential code CODCONF of a magnetic card, discovers it by successive tests on a SAS cash register equipped with a new CE electronic card is only 0.32%.
  • the assignment, to the CM magnetic card, of a class defined by the last three digits of the CODIDENT code, is of course a non-limiting example.
  • Such an assignment has the advantage of leading to a homogeneous distribution of the magnetic cards CM in the different classes and to the use of the same limit number in each zone (32 for the example chosen).
  • these characteristics although advantageous, are not essential.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
  • Control Of Vending Devices And Auxiliary Devices For Vending Devices (AREA)
  • Credit Cards Or The Like (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Description

La présente invention concerne un procédé et un dispositif destinés à empêcher l'utilisation frauduleuse, sur un système à accès sélectif, de titres d'accès usurpés, grâce à une détection efficace des opérations de recherche systématique des codes confidentiels affectés à ces titres d'accès.The present invention relates to a method and a device intended to prevent the fraudulent use, on a selective access system, of spoofed access titles, by means of an effective detection of the operations for systematic search of the confidential codes assigned to these security titles. access.

Dans une de ses applications possibles, l'invention vise par exemple à empêcher l'utilisation frauduleuse, sur des caisses enregistreuses, de cartes de crédit magnétiques volées.In one of its possible applications, the invention aims, for example, to prevent fraudulent use, on cash registers, of stolen magnetic credit cards.

Le procédé de l'invention comprend, de façon connue, les étapes consistant à: obtenir, à chaque présentation au système d'un titre d'accès, le résultat d'une vérification de la validité d'un code confidentiel indiqué par l'utilisateur de ce titre, ce résultat étant interprété comme un succès en cas de validité de ce code et comme un échec dans le cas contraire; garder, dans une mémoire, une trace des échecs constatés à l'occasion de présentations successives de titres d'accès; et émettre un signal indicateur de fraude lorsque le nombre de ces échecs dépasse une limite prédéterminée.The method of the invention comprises, in a known manner, the steps consisting in: obtaining, on each presentation to the system of an access ticket, the result of a verification of the validity of a confidential code indicated by the user of this title, this result being interpreted as a success if this code is valid and as a failure otherwise; keep, in a memory, a trace of the failures observed during successive presentations of access tickets; and emitting a fraud indicator signal when the number of these failures exceeds a predetermined limit.

L'invention est applicable dans tous les cas où chaque titre d'accès se compose de, ou contient, une information, généralement publique, qui permet de vérifier, grâce à une relation gardée secrète, la validité du code confidentiel que l'utilisateur du titre d'accès fournit de façon indépendante, par exemple par l'intermédiaire d'un clavier.The invention is applicable in all cases where each access title consists of, or contains, information, generally public, which makes it possible to verify, thanks to a relationship kept secret, the validity of the confidential code that the user of the access title provided independently, for example via a keyboard.

Dans l'un de ses modes de réalisation, elle est même efficace lorsqu'il existe a priori une possibilité de fraude basée sur une recherche systématique des numéros confidentiels de plusieurs titres d'accès à la fois.In one of its embodiments, it is even effective when there is a priori a possibility of fraud based on a systematic search for the confidential numbers of several access titles at the same time.

Des possibilités d'usurpation de titres d'accès existent, par exemple, avec des cartes magnétiques de crédit volées, utilisées en conjonction avec une caisse enregistreuse qui possède un clavier au moyen duquel les clients désirant payer avec une carte de crédit magnétique doivent normalement indiquer leur code confidentiel.Possibilities of usurpation of access tickets exist, for example, with stolen magnetic credit cards, used in conjunction with a cash register which has a keyboard by means of which customers wishing to pay with a magnetic credit card must normally indicate their confidential code.

Dans la mesure où l'invalidité du code confidentiel indiqué par le porteur de la carte se traduit par un refus du paiement à effectuer, toute personne ayant accès à une telle caisse enregistreuse et détenant une carte magnétique volée est a priori en mesure de rechercher, par des essais successifs, le code confidentiel affecté à cette carte, puis d'utiliser ce code confidentiel pour débiter un compte bancaire dont il n'est pas titulaire.Insofar as the invalidity of the confidential code indicated by the card holder results in a refusal of the payment to be made, any person having access to such a cash register and holding a stolen magnetic card is a priori able to search, by successive tests, the confidential code assigned to this card, then to use this confidential code to debit a bank account which it does not hold.

Les chiffres du code confidentiel étant normalement au nombre de quatre, la recherche systématique conduit nécessairement au succès après un nombre d'essais au maximum égal à 10000.Since the digits of the confidential code are normally four in number, systematic research necessarily leads to success after a maximum number of trials equal to 10,000.

La solution connue pour empêcher cette fraude consiste à tenir, dans une mémoire de la caisse enregistreuse, une liste des numéros ou codes d'identification des dernières cartes magnétiques, pour lesquelles le code confidentiel introduit par le client était faux.The known solution to prevent this fraud consists in keeping, in a memory of the cash register, a list of numbers or identification codes of the last magnetic cards, for which the confidential code entered by the customer was false.

La sécurité est obtenue en imposant une limite au nombre d'apparitions d'un même numéro sur cette liste, c'est-à-dire en imposant un nombre maximum d'échecs pour une même carte magnétique.Security is obtained by imposing a limit on the number of appearances of the same number on this list, that is to say by imposing a maximum number of failures for the same magnetic card.

En cas de dépassement, la carte qui l'a provoqué est annulée. Le document FR-A-2349181 décrit un tel procédé, destiné à éviter l'utilisation frauduleuse des cartes de crédit à pistes magnétiques utilisées en particulier pour la distribution des billets de banque.If it is exceeded, the card that caused it is canceled. The document FR-A-2349181 describes such a method, intended to avoid the fraudulent use of credit cards with magnetic strips used in particular for the distribution of banknotes.

Le principal défaut de cette technique connue est que la mémoire, dans laquelle est tenue la liste des numéros de cartes, se comporte comme un registre à décalage.The main shortcoming of this known technique is that the memory in which the list of card numbers is kept behaves like a shift register.

Lorsque la liste est pleine, tout nouvel échec élimine de la mémoire le numéro de la carte qui a fait l'objet de l'échec le plus ancien, de sorte que toute trace de ce dernier disparaît.When the list is full, any new failure removes from memory the number of the card which was the oldest failure, so that all traces of the latter disappear.

Le dispositif de sécurité peut donc être trompé en recherchant les codes confidentiels de plusieurs cartes magnétiques à la fois, en procédant par roulement et de façon telle que le rapport du nombre maximum de numéros mémorisés dans la liste, au nombre de cartes testées, reste inférieur au nombre limite d'échecs dont le dépassement produirait l'annulation d'une carte.The security device can therefore be deceived by searching for the confidential codes of several magnetic cards at the same time, by proceeding in rotation and in such a way that the ratio of the maximum number of numbers stored in the list, to the number of cards tested, remains lower. the limit number of failures whose exceeding would result in the cancellation of a card.

Dans ce contexte, le but de la présente invention est de proposer un procédé et un dispositif de sécurité qui, grâce notamment à une grande économie de l'espace mémoire, ne présente pas les défauts de la technique précédemment décrite.In this context, the aim of the present invention is to propose a security method and device which, thanks in particular to a great saving in memory space, does not have the faults of the technique described above.

A cette fin, le procédé de l'invention est essentiellement caractérisé en ce que l'opération consistant à garder trace des échecs comprend elle-même les opérations consistant à: définir, dans la mémoire, une pluralité de zones de mémoire; assigner à chaque titre d'accès présenté l'une des classes d'un ensemble de classes dont chacune correspond à une zone de mémoire; et tenir, dans chaque zone de la mémoire, le compte du nombre d'échecs dont font l'objet ceux des titres d'accès présentés qui appartiennent à la classe à laquelle correspond cette zone de mémoire, et en ce que l'opération d'émission d'un signal indicateur de fraude est conditionnée par le dépassement, par le nombre d'échecs enregistrés dans l'une quelconque des zones de la mémoire, d'un nombre limite assigné à cette zone et constituant ladite limite prédéterminée.To this end, the method of the invention is essentially characterized in that the operation consisting in keeping track of failures itself comprises the operations consisting in: defining, in the memory, a plurality of memory areas; assign to each access title presented one of the classes from a set of classes each of which corresponds to a memory area; and keep, in each zone of the memory, the count of the number of failures which are subject to those of the access titles presented which belong to the class to which this zone of memory corresponds, and in that the operation d 'emission of a fraud indicator signal is conditioned by the exceeding, by the number of failures recorded in any of the areas of the memory, of a limit number assigned to this area and constituting said predetermined limit.

Selon le procédé de l'invention, appliqué à des cartes magnétiques, telles que des cartes de crédit, à chacune desquelles est affecté au moins un attribut intrinsèque, tel que le code confidentiel, ou un numéro d'identification, le numéro de la classe assignée à chaque carte magnétique est de préférence déduit de l'attribut intrinsèque de cette carte par l'application d'une fonction surjective prédéterminée.According to the method of the invention, applied to magnetic cards, such as credit cards, to each of which is assigned at least one intrinsic attribute, such as the confidential code, or an identification number, the class number. assigned to each magnetic card is preferably deduced from the intrinsic attribute of this card by the application of a predetermined surjective function.

Par exemple, le numéro de la classe assignée à chaque carte magnétique est donné par un ensemble d'au moins un chiffre extrait du numéro d'identification de cette carte, chaque chiffre étant extrait en fonction d'une position qu'il occupe dans ce numéro, et cette position étant prédéterminée et choisie plus proche de la fin du numéro d'identification, dans le sens de l'écriture de ce dernier, que du début de ce numéro, de façon que toutes les valeurs possibles, de 0 à 9, de chaque chiffre extrait, soient sensiblement équiprobables pour l'ensemble des cartes présentées, ledit nombre limite étant alors le même pour toutes les zones de mémoire.For example, the number of the class assigned to each magnetic card is given by a set of at least one digit extracted from the identification number of this card, each digit being extracted according to a position it occupies in this number, and this position being predetermined and chosen closer to the end of the identification number, in the writing direction of the latter, than to the beginning of this number, so that all the possible values, from 0 to 9 , of each digit extracted, are substantially equiprobable for all of the cards presented, said limit number then being the same for all the memory areas.

Dans une forme de réalisation simple de l'invention, la correspondance entre chaque classe et une zone de mémoire est telle que le numéro de chaque classe définit l'adresse de la zone de mémoire à laquelle elle correspond.In a simple embodiment of the invention, the correspondence between each class and a memory area is such that the number of each class defines the address of the memory area to which it corresponds.

Pour éviter les fraudes faisant intervenir un grand nombre de cartes magnétiques, le procédé de l'invention peut comprendre une seconde opération d'émission d'un signal de fraude, conditionnée par le dépassement, par le nombre d'échecs enregistrés dans l'ensemble des zones de mémoire, d'une seconde limite prédéterminée.To avoid fraud involving a large number of magnetic cards, the method of the invention can comprise a second operation of emission of a fraud signal, conditioned by the overrun, by the number of failures recorded in the set memory areas, a second predetermined limit.

Le dispositif de l'invention comprend, de façon connue: des moyens de saisie d'information propres à recevoir d'une part au moins un attribut intrinsèque du titre d'accès, cet attribut étant relié audit code confidentiel exact de celui-ci et d'autre part un code confidentiel indiqué par l'utilisateur du titre d'accès; des moyens de traitement reliés aux moyens de saisie, susceptibles de vérifier la validité du code confidentiel indiqué par l'utilisateur; et une mémoire reliée aux moyens de traitement, dans laquelle ces derniers enregistrent une donnée d'échec à chaque fois qu'un code confidentiel s'avère invalide.The device of the invention comprises, in a known manner: means for entering information suitable for receiving on the one hand at least one intrinsic attribute of the access ticket, this attribute being linked to said exact confidential code of this and on the other hand a confidential code indicated by the user of the access ticket; processing means linked to the input means, capable of verifying the validity of the confidential code indicated by the user; and a memory connected to the processing means, in which the latter record failure data each time that a confidential code turns out to be invalid.

Selon l'invention, ce dispositif est essentiellement caractérisé en ce que, la mémoire étant découpée en zones accessibles à des adresses différentes, les moyens de traitement sont conçus pour élaborer une adresse mémoire en fonction au moins dudit attribut du titre d'accès, et pour enregistrer la donnée d'échec dans la zone de mémoire correspondant à cette adresse.According to the invention, this device is essentially characterized in that, the memory being divided into areas accessible to different addresses, the processing means are designed to develop a memory address as a function at least of said attribute of the access ticket, and to save the failure data in the memory zone corresponding to this address.

La mémoire comprend avantageusement une mémoire à lecture seulement, dans laquelle chaque donnée d'échec est enregistrée sous la forme d'un seul bit.The memory advantageously comprises a read-only memory, in which each failure data item is recorded in the form of a single bit.

Selon un mode de réalisation préféré de l'invention, la mémoire est constituée par la mémoire PROM d'une carte à mémoire, tandis que les moyens de traitement comprennent le microprocesseur de celle-ci.According to a preferred embodiment of the invention, the memory consists of the PROM memory of a memory card, while the processing means comprise the microprocessor thereof.

D'autres caractéristiques et avantages de l'invention ressortiront de la description qui en est faite ci-après, à titre indicatif et nullement limitatif, en référence aux dessins annexés, parmi lesquels:

  • ― La figure 1 représente une partie de l'architecture fonctionnelle d'une caisse enregistreuse à accès sélectif, à laquelle a été intégré le perfectionnement de l'invention, et
  • ― la figure 2 est un organigramme représentant le déroulement du procédé de l'invention.
Other characteristics and advantages of the invention will emerge from the description given below, by way of indication and in no way limitative, with reference to the appended drawings, among which:
  • FIG. 1 represents part of the functional architecture of a cash register with selective access, into which the improvement of the invention has been integrated, and
  • - Figure 2 is a flowchart showing the progress of the method of the invention.

L'invention concerne un procédé et un dispositif permettant d'empêcher l'utilisation frauduleuse d'un titre d'accès usurpé, en association avec un système à accès sélectif.The invention relates to a method and a device for preventing fraudulent use of a spoofed access document, in combination with a selective access system.

Par système à accès sélectif, on entend précisément un système susceptible d'accorder à chacun des utilisateurs potentiels un certain privilège, tel que l'accès à un service ou la remise d'un produit, sous réserve que cet utilisateur présente à ce système un titre d'accès valide, dont la validité est confirmée par celle d'un code confidentiel également fourni par l'utilisateur.By selective access system, we mean precisely a system capable of granting each of the potential users a certain privilege, such as access to a service or delivery of a product, provided that this user presents to this system a valid access document, the validity of which is confirmed by that of a confidential code also supplied by the user.

Les exemples de systèmes à accès sélectifs sont nombreux.There are many examples of selective access systems.

Un système informatique gérant une base de données, à laquelle les utilisateurs ne peuvent accéder qu'après avoir indiqué d'une part leur nom ou leur code utilisateur et d'autre part le code confidentiel exact qui leur a été affecté, constitue un système à accès sélectif; une caisse enregistreuse, qui est dotée d'un lecteur de cartes magnétiques de crédit et d'un clavier au moyen duquel le possesseur de la carte indique son code confidentiel, et qui n'accepte le paiement par carte qu'après vérification de la validité du code confidentiel, constitue un autre système à accès sélectif.A computer system managing a database, to which users can only access after having indicated their name or user code on the one hand and the exact confidential code assigned to them on the other, constitutes a system with selective access; a cash register, which is equipped with a magnetic credit card reader and a keyboard by means of which the card holder indicates his confidential code, and which accepts payment by card only after verification of the validity another code with selective access.

Dans le premier exemple, le titre d'accès de l'utilisateur est de nature immatérielle: il est constitué, par exemple, par une suite de lettres; dans le second exemple, le titre d'accès de l'utilisateur est de nature matérielle: c'est une carte magnétique; ces deux cas sont cependant semblables en ce sens que, dans les deux cas, les titres d'accès sont personnalisés, vis-à-vis de l'utilisateur, par des attributs intrinsèques généralement dépourvus de caractère confidentiel, à savoir le nom propre de l'utilisateur dans le premier exemple, et le numéro ou le code d'identification de la carte magnétique de l'utilisateur dans le second exemple.In the first example, the user's access title is immaterial in nature: it consists, for example, of a series of letters; in the second example, the user's access title is of a physical nature: it is a magnetic card; these two cases are however similar in the sense that, in both cases, the access titles are personalized, vis-à-vis the user, by intrinsic attributes generally devoid of confidentiality, namely the proper name of the user in the first example, and the identification number or code of the user's magnetic card in the second example.

Dans ces deux exemples également, l'accès au système n'est obtenu qu'après indication, par l'utilisateur, d'un code confidentiel qui lui a été assigné, et vérification de la validité de ce code; cette vérification est par exemple réalisée par la comparaison d'une fonction du code confidentiel, elle-même gardée secrète, avec l'attribut intrinsèque du titre d'accès.In these two examples also, access to the system is obtained only after the user has indicated a confidential code which has been assigned to him, and verification of the validity of this code; this verification is for example carried out by the comparison of a function of the confidential code, itself kept secret, with the intrinsic attribute of the access title.

Si la comparaison révèle une disparité, son résultat conduit à un échec pour ce qui concerne l'accès au système, alors que ce résultat conduit à un succès, c'est-à-dire à l'accès au système, si la comparaison révèle une identité.If the comparison reveals a disparity, its result leads to a failure in terms of access to the system, while this result leads to a success, i.e. access to the system, if the comparison reveals an identity.

Ainsi, bien que, sur la figure 1, le système à accès sélectif SAS représente, de façon schématique, une caisse enregistreuse, l'invention est applicable, comme le percevra l'homme de l'art, à tout autre système à accès sélectif, et notamment à un système informatique gérant une base de données.Thus, although in FIG. 1, the SAS selective access system schematically represents a cash register, the invention is applicable, as those skilled in the art will perceive, to any other selective access system , and in particular to a computer system managing a database.

La caisse enregistreuse SAS comprend notamment, de façon connue, une unité de gestion UG reliée à plusieurs organes périphériques, dont un lecteur de cartes magnétiques LCM, un circuit d'interface de console ICS et un circuit d'interface téléphonique ITL.The SAS cash register comprises in particular, in a known manner, a management unit UG connected to several peripheral organs, including a magnetic card reader LCM, an console interface circuit ICS and a telephone interface circuit ITL.

Le lecteur LCM permet de lire un attribut de chaque carte magnétique CM, par exemple le numéro ou code d'identification CODIDENT de cette carte.The LCM reader makes it possible to read an attribute of each magnetic card CM, for example the number or identification code CODIDENT of this card.

L'interface ICS, reliée à la console CS, est susceptible de recevoir le code confidentiel CODCONF tapé par l'utilisateur de la carte CM.The ICS interface, connected to the CS console, is capable of receiving the confidential code CODCONF typed by the user of the CM card.

Selon l'invention, la caisse enregistreuse SAS est également dotée d'un circuit d'interface pour carte électronique ICE, permettant un échange bidirectionnel d'informations entre l'unité de gestion UG et une carte électronique à microprocesseur CE. Les circuits d'interface tels que ICE, et les cartes électroniques telles que CE, sont bien connus de l'homme de l'art, de sorte que leur description détaillée est ici superflue. Il suffit, pour la compréhension de la présente invention, de rappeler que les cartes électroniques à microprocesseur CE comprennent un microprocesseur mP généralement relié à une mémoire à lecture seulement non programmable ROM, à une mémoire à lecture seulement programmable PROM, et à une mémoire vive RAM. Cette carte CE est traditionnellement dotée de moyens, non représentés, permettant au microprocesseur mP non seulement de lire, mais aussi d'écrire, des données dans la mémoire à lecture seulement PROM.According to the invention, the SAS cash register also has an interface circuit for an ICE electronic card, allowing a bidirectional exchange of information between the management unit UG and an electronic microprocessor card CE. Interface circuits such as ICE, and electronic cards such as CE, are well known to those skilled in the art, so their detailed description is unnecessary here. It suffices, for the understanding of the present invention, to recall that the electronic microprocessor cards CE comprise an microprocessor mP generally connected to a read-only memory non-programmable ROM, to a read-only memory programmable PROM, and to a random access memory RAM. This CE card is traditionally provided with means, not shown, allowing the mP microprocessor not only to read, but also to write, data in the read-only memory PROM.

Bien entendu, l'écriture de données dans la mémoire PROM est irréversible, de sorte que celle-ci se comporte, pour l'écriture, comme une mémoire consomptible. De ce fait, la mémoire PROM est non volatile. De surcroît, les cartes électroniques CE sont également dotées, de façon classique, de moyens prohibant l'accès, de l'extérieur de la carte, aux informations enregistrées dans la mémoire PROM. En fait, ces propriétés sont celles qui sont recherchées pour la mise en oeuvre de l'invention, pour laquelle le recours spécifique à l'emploi d'une carte électronique reste facultatif.Of course, writing data to the PROM memory is irreversible, so that it behaves, for writing, like a consumable memory. Therefore, the PROM memory is non-volatile. In addition, CE electronic cards are also conventionally provided with means preventing access, from outside the card, to the information recorded in the PROM memory. In fact, these properties are those which are sought for the implementation of the invention, for which the specific recourse to the use of an electronic card remains optional.

Le commerçant, possesseur de la caisse enregistreuse SAS, doit insérer une carte électronique CE dans le circuit ICE pour permettre le fonctionnement de la caisse.The merchant, owner of the SAS cash register, must insert a CE electronic card in the ICE circuit to allow the cash register to function.

Il doit en outre demander, au service chargé de la distribution et du contrôle des cartes électroniques CE, de valider, par l'émission d'un signal VALPROM sur le réseau téléphonique, via le téléphone TL, et les circuits ITL, UG et ICE, l'utilisation d'une nouvelle carte électronique CE ou la validation d'une carte électronique qui a été invalidée par dépassement d'un quota prédéterminé par le nombre total d'échecs enregistrés dans cette carte, comme décrit en référence à la dernière opération de l'organigramme de la figure 2.It must also ask the service responsible for the distribution and control of CE electronic cards to validate, by sending a VALPROM signal over the telephone network, via the TL telephone, and the ITL, UG and ICE circuits. , the use of a new CE electronic card or the validation of an electronic card which has been invalidated by exceeding a predetermined quota by the total number of failures recorded in this card, as described with reference to the last operation in the flowchart in FIG. 2.

Le signal VALPROM est par exemple mémorisé dans la mémoire PROM de la carte électronique CE.The VALPROM signal is for example stored in the PROM memory of the electronic card CE.

L'insertion d'une carte magnétique CM dans le lecteur LCM déclenche un ensemble d'opérations dont un enchaînement possible est illustré sur l'organigramme de la figure 2.The insertion of a magnetic card CM in the LCM reader triggers a set of operations, a possible sequence of which is illustrated in the flow diagram of FIG. 2.

Le microprocesseur mP vérifie que la carte électronique CE a été validée en recherchant si la donnée VALPROM est présente dans la mémoire avec une valeur représentative de sa validité.The microprocessor mP verifies that the electronic card CE has been validated by seeking whether the VALPROM data item is present in the memory with a value representative of its validity.

Dans le cas contraire, le microprocesseur mP envoie au circuit ICE un signal de blocage INVALPROM qui inhibe le fonctionnement de la caisse SAS.Otherwise, the microprocessor mP sends to the ICE circuit an INVALPROM blocking signal which inhibits the operation of the SAS cash register.

La carte électronique CE, lorsqu'elle est validée, reçoit, via le lecteur LCM, l'unité UG et l'interface ICE, le code d'identification CODIDENT de la carte magnétique CM, généralement constitué par un simple numéro de série.The CE electronic card, when validated, receives, via the LCM reader, the UG unit and the ICE interface, the CODIDENT identification code of the magnetic card CM, generally consisting of a simple serial number.

Parallèlement, la carte électronique CE reçoit le code confidentiel CODCONF introduit par l'utilisateur de la carte CM au moyen de la console CS, via l'interface ICS, l'unité UG et l'interface ICE.In parallel, the electronic card CE receives the confidential code CODCONF introduced by the user of the card CM by means of the console CS, via the interface ICS, the unit UG and the interface ICE.

De préférence, chaque chiffre du code CODCONF est lui-même codé dans la console CS et décodé par le microprocesseur mP, de manière à éviter toute interception frauduleuse du code confidentiel CODCONF, par exemple sur la ligne reliant la console CS au circuit d'interface ICS.Preferably, each digit of the CODCONF code is itself coded in the console CS and decoded by the microprocessor mP, so as to avoid any fraudulent interception of the confidential code CODCONF, for example on the line connecting the console CS to the interface circuit ICS.

Le microprocesseur mP, disposant du code d'identification CODIDENT et du code confidentiel CODCONF vérifie la validité de ce dernier en recherchant, de façon en soi connue, si les conditions de compatibilité qui doivent exister entre CODIDENT et CODCONF sont effectivement satisfaites.The mP microprocessor, having the CODIDENT identification code and the CODCONF confidential code, verifies the validity of the latter by looking, in a manner known per se, if the compatibility conditions which must exist between CODIDENT and CODCONF are actually satisfied.

Si tel est le cas, le microprocesseur mP émet un ordre VALACCES autorisant l'accès au système SAS, c'est-à-dire le paiement au moyen de la carte CM, sur la caisse enregistreuse SAS.If this is the case, the microprocessor mP issues a VALACCES order authorizing access to the SAS system, that is to say payment by means of the CM card, on the SAS cash register.

En cas d'invalidité de CODCONF s'engage un processus opératoire qui constitue l'essentiel de l'invention.In the event of CODCONF's disability, an operational process which constitutes the essence of the invention is undertaken.

Dans ce cas en effet, le procédé, objet de l'invention ne traite plus la carte magnétique CM comme le titre d'accès qui est défini de façon univoque par son code d'identification CODIDENT, mais comme un élément indifférencié d'une classe à laquelle correspond une zone de la mémoire PROM.In this case, in fact, the method which is the subject of the invention no longer treats the magnetic card CM as the access ticket which is unequivocally defined by its identification code CODIDENT, but as an undifferentiated element of a class. to which corresponds an area of the PROM memory.

Pour cela, la mémoire PROM étant virtuellement ou physiquement découpée en une pluralité de zones de mémoire accessibles à des adresses différentes, le procédé consiste à assigner, à la carte CM dont le code CODCONF est invalide, l'une des classes d'un ensemble de classes dont le nombre est égale à celui des zones de mémoire.For this, the PROM memory being virtually or physically divided into a plurality of memory areas accessible to different addresses, the method consists in assigning, to the CM card whose CODCONF code is invalid, one of the classes of a set classes whose number is equal to that of the memory areas.

Par exemple, la mémoire PROM utilisable pour la mise en oeuvre de l'invention comprend 4 Koctets, et est considérée comme constituée de 1000 zones de 32 bits chacune.For example, the PROM memory usable for the implementation of the invention comprises 4 Kbytes, and is considered to consist of 1000 areas of 32 bits each.

La classe de chaque carte magnétique est déterminée par les trois derniers chiffres de CODIDENT, c'est-à-dire les trois chiffres de poids le plus faible.The class of each magnetic card is determined by the last three digits of CODIDENT, that is to say the three least significant digits.

Comme il existe de nombreuses cartes dont les numéros d'identification CODIDENT respectifs présentent les mêmes trois derniers chiffres, l'application qui, du code CODIDENT, conduit à la classe de carte CM ayant ce code, est dite "surjective". Par ailleurs, comme chacun des trois derniers chiffres du code CODIDENT varie de 0 à 9, cette application définit 1000 classes, c'est-à-dire autant de classes qu'il y a de zones de mémoire PROM.As there are many cards whose respective CODIDENT identification numbers have the same last three digits, the application which, from the CODIDENT code, leads to the CM card class having this code, is called "surjective". Furthermore, since each of the last three digits of the CODIDENT code varies from 0 to 9, this application defines 1000 classes, that is to say as many classes as there are PROM memory areas.

Enfin, comme toutes les valeurs, de 0 à 9 de chacun des trois derniers chiffres de CODIDENT sont équiprobables, une carte magnétique CM prise au hasard a une probabilité homogène, égale à 0.001, d'appartenir à n'importe laquelle des classes.Finally, as all the values, from 0 to 9 of each of the last three digits of CODIDENT are equiprobable, a magnetic card CM taken at random has a homogeneous probability, equal to 0.001, of belonging to any of the classes.

La classe de la carte CM ayant été définie, le microprocesseur mP lit le nombre enregistré dans la zone de la mémoire PROM qui correspond à cette classe.The class of the CM card having been defined, the microprocessor mP reads the number recorded in the area of the PROM memory which corresponds to this class.

Par exemple, si le code d'identification CODIDENT est 16244962357, la classe est 357, et le microprocesseur lit le contenu de la zone de mémoire PROM d'adresse 357, c'est-à-dire, en d'autres termes, le contenue de la 357ième zone de mémoire PROM.For example, if the identification code CODIDENT is 16244962357, the class is 357, and the microprocessor reads the contents of the PROM memory area of address 357, that is, in other words, the contained the 357 th PROM area.

Si le nombre lu dans cette zone 357 est égal à un premier nombre limite, correspondant à 32 bits mis à "1" dans l'exemple choisi, le microprocesseur mP émet un ordre INVALPROM, qui inhibe le fonctionnement de la caisse enregistreuse SAS. Dans cette hypothèse, le commerçant possesseur de cette caisse n'en peut recouvrer l'utilisation normale qu'après avoir reçu, sous la forme d'un signal VALPROM transmis sur le réseau téléphonique, l'autorisation d'utiliser une nouvelle carte électronique CE, comme décrit précédemment.If the number read in this zone 357 is equal to a first limit number, corresponding to 32 bits set to "1" in the example chosen, the microprocessor mP issues an INVALPROM command, which inhibits the operation of the SAS cash register. In this case, the merchant who owns this box can recover normal use only after having received, in the form of a VALPROM signal transmitted over the telephone network, authorization to use a new CE electronic card. , as previously described.

Si le nombre lu dans la zone 357 de la mémoire PROM n'est pas égal à cette limite de 32 bits, il est augmenté d'une unité, c'est-à-dire modifié par la mise à "1" du premier bit qui, dans la série de 32 bits enregistrée dans cette zone, est un bit "0".If the number read in zone 357 of the PROM memory is not equal to this limit of 32 bits, it is increased by one unit, that is to say modified by setting the first bit to "1" which in the 32-bit series stored in this area is a "0" bit.

Cette opération correspond à l'enregistrement, dans la mémoire PROM de l'échec d'accès à la caisse SAS pour la carte magnétique CM, ou pour toute autre carte CM appartenant à la même classe qu'elle.This operation corresponds to the recording, in the PROM memory, of the failure to access the SAS cash register for the CM magnetic card, or for any other CM card belonging to the same class as it.

Ensuite, le microprocesseur mP lit tous les bits enregistrés dans toute la mémoire PROM, dont chacun correspond à un échec d'accès, et compare le total à un second nombre limite prédéterminé, par exemple 96.Then, the microprocessor mP reads all the bits recorded in all the PROM memory, each of which corresponds to an access failure, and compares the total with a second predetermined limit number, for example 96.

En cas d'égalité, le microprocesseur mP émet un signal INVALPROM.In the event of a tie, the mP microprocessor issues an INVALPROM signal.

En cas d'inégalité, le microprocesseur mP émet un signal INVALACCES. Ce dernier signal a pour effet d'informer le commerçant, et le porteur de la carte, de l'invalidité du code confidentiel, de refuser provisoirement le paiement par carte, mais d'autoriser une nouvelle introduction du code confidentiel.In the event of an inequality, the microprocessor mP emits an INVALACCES signal. This last signal has the effect of informing the merchant, and the card holder, of the invalidity of the confidential code, of temporarily refusing payment by card, but of authorizing a new introduction of the confidential code.

Les calculs montrent qu'en l'absence de test utilisant une comparaison entre le nombre total d'échecs enregistrés dans la mémoire PROM et un second nombre limite, et avec les exemples numériques précédemment cités (mémoire PROM de 4 Koctets découpée en 1000 zones de 32 bits), la probabilité pour qu'une carte électronique CE soit périmée à la suite de 12000 échecs n'est que de 1%; elle est de l'ordre de 50% pour 16800 échecs.The calculations show that in the absence of a test using a comparison between the total number of failures recorded in the PROM memory and a second limit number, and with the numerical examples previously cited (PROM memory of 4 kbytes divided into 1000 zones of 32-bit), the probability that a CE electronic card will expire after 12,000 failures is only 1%; it is around 50% for 16,800 failures.

Comme les utilisateurs de cartes magnétiques se trompent statistiquement une fois sur dix dans l'indication de leur code confidentiel, cela signifie qu'une carte électronique CE peut, avec une probabilité de 99%, traiter, en l'absence de fraude, 120000 opérations de paiement par carte magnétique.As the users of magnetic cards are statistically mistaken once in ten in the indication of their confidential code, this means that an electronic EC card can, with a probability of 99%, process, in the absence of fraud, 120,000 transactions payment by magnetic card.

Par la mise en oeuvre de l'invention, et toujours sur la base de l'exemple numérique ci-dessus, la probabilité pour qu'une personne, ignorant le code confidentiel CODCONF d'une carte magnétique, le découvre par essais successifs sur une caisse enregistreuse SAS équipée d'une carte électronique CE neuve (ce qui correspond à 32 essais possibles pour 10000 possibilités) n'est égale qu'à 0.32%.By implementing the invention, and still on the basis of the digital example above, the probability that a person, ignoring the confidential code CODCONF of a magnetic card, discovers it by successive tests on a SAS cash register equipped with a new CE electronic card (which corresponds to 32 possible tests for 10,000 possibilities) is only 0.32%.

En revanche si cette personne dispose de N cartes cette possibilité, en l'absence de surveillance du nombre total d'échecs enregistrés dans la PROM, augmente considérablement avec N, puisqu'elle est égale à 1 - (1 - 0.032)N. La comparaison du nombre total d'échecs à un second nombre limite permet d'écarter cet autre type de fraude.On the other hand, if this person has N cards, this possibility, in the absence of monitoring the total number of failures recorded in the PROM, increases considerably with N, since it is equal to 1 - (1 - 0.032) N. Comparing the total number of failures to a second limit number allows this other type of fraud to be ruled out.

L'assignation, à la carte magnétique CM, d'une classe définie par les trois derniers chiffres du code CODIDENT, constitue bien entendu un exemple non limitatif. Une telle assignation a l'avantage de conduire à une répartition homogène des cartes magnétiques CM dans les différentes classes et à l'utilisation d'un même nombre limite dans chaque zone (32 pour l'exemple choisi). Néanmoins, ces caractéristiques, bien qu'avantageuses, ne sont pas indispensables.The assignment, to the CM magnetic card, of a class defined by the last three digits of the CODIDENT code, is of course a non-limiting example. Such an assignment has the advantage of leading to a homogeneous distribution of the magnetic cards CM in the different classes and to the use of the same limit number in each zone (32 for the example chosen). However, these characteristics, although advantageous, are not essential.

Quel que soit le mode d'attribution d'une classe à chaque carte magnétique présentée, il importe seulement, pour assurer la plus grande longévité et le meilleur usage possibles de la mémoire PROM, que le nombre de classes soit inférieur au nombre de cartes magnétiques CM, et que le nombre limite surveillé dans chaque zone de la mémoire PROM, c'est-à-dire en fait la dimension de cette zone, soit relié, à la probabilité pour qu'une carte magnétique quelconque CM soit affectée à la classe correspondant à cette zone, par un coefficient de proportionnalité qui se trouve être le même pour toutes les zones.Whatever the mode of attribution of a class to each magnetic card presented, it is only important, to ensure the longest longevity and the best possible use of the PROM memory, that the number of classes is lower than the number of magnetic cards CM, and that the limit number monitored in each zone of the PROM memory, that is to say in fact the dimension of this area, is related, to the probability that any magnetic card CM is assigned to the class corresponding to this area, by a coefficient of proportionality which happens to be the same for all zones.

Claims (10)

1. Method of protecting a selective access system against fraudulent use of at least one access card (MC) allocated a confidential code (CODIDENT), comprising operations consisting in obtaining upon each presentation of an access card (MC) to the system the result of a verification of the validity of a confidential code (CODCONF) entered by the user of this card (MC), this result being interpreted as a success if this code (CODCONF) is valid and otherwise as a failure, in keeping a record in a memory (PROM) of the failures recorded upon successive presentations of access cards (MC), and in emitting a signal indicating fraud (INVALPROM) when the number of these failures exceeds a predetermined limit, characterised in that the operation consisting in keeping a record of the failures itself comprises operations consisting in defining a plurality of storage areas in the memory (PROM), in allocating to each access card presented (MC) one of the classes of a set of classes, each one corresponding to one storage area, and in keeping count in each storage area of the memory (PROM) of the number of failures by those access cards presented (MC) belonging to the class to which this storage area corresponds, and in that the operation consisting in emitting a signal indicating fraud (INVALPROM) is determined by the number of failures recorded in any one of the storage areas of the memory (PROM) exceeding a limit number allocated to this storage area and forming the said predetermined limit.
2. Method according to claim 1, applied in cases where the said access cards (MC) are magnetic cards, such as credit cards, each allocated at least one intrinsic attribute, such as the confidential code (CODIDENT) or an identification number, characterised in that the number of the class allocated to each magnetic card (MC) is deduced from the intrinsic attribute of this card by the application of a predetermined surjective function.
3. Method according to claim 2, characterised in that the number of the class allocated to each magnetic card (MC) is given by a set of at least one figure extracted from the identification number (CODIDENT) of this card, each figure being extracted as a function of the position it occupies in this number, and this position being predetermined and selected closer to the end of the identification number (CODIDENT) than to the beginning thereof, so that all of the possible values for each figure extracted from 0 to 9 are substantially equiprobable for all of the cards (MC) presented, the said limit number thus being the same for all of the storage areas.
4. Method according to any one of claims 1 to 3, characterised in that the number of each class defines the address of the storage area to which it corresponds.
5. Method according to any one of claims 1 to 4, characterised in that it comprises a second operation consisting in emitting a signal indicating fraud (INVALPROM), determined by the number of failures recorded in all of the storage areas exceeding a second predetermined limit.
6. Device for protecting against the fraudulent use in a selective access system of at least one access card (MC) allocated a confidential code (CODIDENT) comprising data acquisition means (MCR) adapted to receive, on the one hand, at least one intrinsic attribute of the access card (MC), this attribute being connected to the said exact confidential code (CODIDENT) thereof, and, on the other hand, a confidential code (CODCONF) entered by the user of the access card (MC), processing means (MPU) connected to the data acquisition means (MCR) capable of verifying the validity of the confidential code (CODCONF) entered by the user, and a memory (PROM) connected to the processing means (MPU), in which the latter record failure data each time a confidential code (CODCONF) proves invalid, characterised in that, as the memory is split into storage areas accessible to different addresses, the processing means (MPU) are designed to produce a memory address as a function at least of the said attribute of the access card (MC) and to record the failure data in the storage area corresponding to this address.
7. Device according to claim 6, characterised in that the memory (PROM) is a read-only memory.
8. Device according to claim 7, characterised in that the failure data are each expressed by one single bit.
9. Device according to any one of claims 6 to 8, characterised in that the said memory (PROM) comprises a PROM memory of a smart card.
10. Device according to any one of claims 6 to 9, characterised in that the said processing means (MPU) comprise a microprocessor of a smart card.
EP88401646A 1987-07-07 1988-06-28 Anti-fraud device and method for a selective access system Expired - Lifetime EP0298831B1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
FR8709604A FR2618000B1 (en) 1987-07-07 1987-07-07 ANTI-FRAUD METHOD AND DEVICE FOR A SELECTIVE ACCESS SYSTEM
FR8709604 1987-07-07

Publications (2)

Publication Number Publication Date
EP0298831A1 EP0298831A1 (en) 1989-01-11
EP0298831B1 true EP0298831B1 (en) 1991-10-16

Family

ID=9352939

Family Applications (1)

Application Number Title Priority Date Filing Date
EP88401646A Expired - Lifetime EP0298831B1 (en) 1987-07-07 1988-06-28 Anti-fraud device and method for a selective access system

Country Status (6)

Country Link
US (1) US5006698A (en)
EP (1) EP0298831B1 (en)
JP (1) JPH0198095A (en)
DE (1) DE3865555D1 (en)
ES (1) ES2029336T3 (en)
FR (1) FR2618000B1 (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2694053B2 (en) * 1990-12-28 1997-12-24 富士通株式会社 Automatic transaction equipment
GB2263348B (en) * 1992-01-14 1995-08-09 Rohm Co Ltd Microcomputer and card having the same
FR2721420B1 (en) * 1994-06-15 1996-08-30 Solaic Sa Memory card for managing successive presentations and method for managing these presentations.
FR2722018B1 (en) * 1994-06-29 1996-08-30 Solaic Sa MEMORY CARD IMPROVING THE MANAGEMENT OF THE ACCESS AREA AND METHOD FOR MANAGING THIS AREA
US6601048B1 (en) * 1997-09-12 2003-07-29 Mci Communications Corporation System and method for detecting and managing fraud
WO1996041447A1 (en) * 1995-06-07 1996-12-19 E-Comm Incorporated Low power telecommunication controller for a host computer server
NL1004658C2 (en) * 1996-12-02 1998-06-03 Clewits Beheer B V R System and method for selectively activating one or more software and / or hardware functions of an electronic device.
US6422460B1 (en) 1999-01-29 2002-07-23 Verisign, Inc. Authorization system using an authorizing device
US7266527B1 (en) 1999-06-30 2007-09-04 Martin David A Method and device for preventing check fraud
US20020184152A1 (en) * 1999-06-30 2002-12-05 Martin David A. Method and device for preventing check fraud
DE10048939B4 (en) * 1999-12-11 2010-08-19 International Business Machines Corp. Conditional suppression of verification of a cardholder
US20040172563A1 (en) * 2001-07-06 2004-09-02 Brondijk Robert Albertus Method for protecting content stored on an information carrier
US20030177051A1 (en) * 2003-03-13 2003-09-18 Robin Driscoll Method and system for managing worker resources

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS4929083B1 (en) * 1970-03-03 1974-08-01
FR2349181A1 (en) * 1976-04-23 1977-11-18 Transac Dev Transact Automat Credit card verifying unit - compares code on card with characters entered manually via keyboard
FR2471000B1 (en) * 1979-11-30 1985-06-28 Dassault Electronique METHOD AND DEVICE FOR CONTROLLING THE NUMBER OF ATTEMPTS TO ACCESS AN ELECTRONIC MEMORY, PARTICULARLY THAT OF AN INTEGRATED CIRCUIT OF AN OBJECT SUCH AS A CREDIT CARD OR A PURCHASING CARD
US4629871A (en) * 1979-12-28 1986-12-16 Pitney Bowes, Inc. Electronic postage meter system settable by means of a remotely generated input device
DE3041109A1 (en) * 1980-10-31 1982-06-09 GAO Gesellschaft für Automation und Organisation mbH, 8000 München IDENTIFICATION ELEMENT
JPS592062B2 (en) * 1980-12-06 1984-01-17 オムロン株式会社 PIN code identification device in transaction processing equipment
US4578567A (en) * 1983-08-25 1986-03-25 Ncr Corporation Method and apparatus for gaining access to a system having controlled access thereto
JPS60207991A (en) * 1984-04-02 1985-10-19 Toshiba Corp Personal identification card
JPS6191790A (en) * 1984-10-12 1986-05-09 カシオ計算機株式会社 Card collator
JPS61210488A (en) * 1985-03-14 1986-09-18 Toppan Moore Co Ltd Ic card
JPS629470A (en) * 1985-07-05 1987-01-17 Casio Comput Co Ltd Identity collation system for individual identification card

Also Published As

Publication number Publication date
FR2618000B1 (en) 1989-11-03
DE3865555D1 (en) 1991-11-21
FR2618000A1 (en) 1989-01-13
ES2029336T3 (en) 1992-08-01
JPH0198095A (en) 1989-04-17
EP0298831A1 (en) 1989-01-11
US5006698A (en) 1991-04-09

Similar Documents

Publication Publication Date Title
EP0426541B1 (en) Method of protection against fraudulent use of a microprocessor card and device for its application
EP0507669B1 (en) Method for electronic payment with an IC-card provided with numbered tokens; and card to implement this method
EP0423035B1 (en) Payment or information transfer system using an electronic memory card as wallet
EP0298831B1 (en) Anti-fraud device and method for a selective access system
EP0820620B1 (en) Electronic payment method for purchase-related transactions over a computer network
EP0617819B1 (en) Device for intervention on a terminal delivering goods or services
WO1998013991A2 (en) Method and system for ensuring the security of telephone call management centres
FR2905187A1 (en) BIOMETRIC ELECTRONIC PAYMENT TERMINAL AND TRANSACTION METHOD
FR2716021A1 (en) Chip card transaction method and system.
EP0097110A2 (en) Method of testing the use of reserved documents
FR2643475A1 (en) METHOD FOR CONTROLLING THE USE OF AN INFORMATION MEDIUM, IN PARTICULAR MAGNETIC OR MAGNETO-OPTICAL, AND SYSTEMS FOR ITS IMPLEMENTATION
WO1995030976A1 (en) Method for the production of a key common to two devices for implementing a common cryptographic procedure and associated apparatus
FR2710769A1 (en) System for processing the data from a microcircuit card, card and reader for this system and method of implementation
EP2016700A1 (en) Terminal activation method
WO1997031343A1 (en) Multiple account management system and method using same
FR2863088A1 (en) Electronic purse charging system for, e.g., games, has unit for storage of access information and charging value in server associated with management network, and unit for connecting purse to network
WO1997040473A1 (en) Security access control system enabling automatic invalidation of stolen or lost electronic keys and/or transfer of authorisation to make keys
EP0831434A1 (en) Method for blocking a plurality of services by blacklisting them, and associated blocking server, receiving terminal and portable device
WO2003065181A1 (en) Method for controlling the use of digital contents by means of a security module or a chipcard comprising said module
FR2824659A1 (en) Method for verifying the integrity of a terminal used in a transaction with a chip card by calculation of a cryptograph that can be compared with that of a card-holder
WO2003049443A1 (en) Method for managing access provision to an encrypted content to be broadcast on a network, and system, servers and signal therefor
WO2002023497A1 (en) Electronic note of fiduciary value, protocol for payment of electronic commerce purchases and corresponding server system
FR2745404A1 (en) Portable smart card with personalisation and lottery function to encourage return
WO2003065304A1 (en) Digital data support
WO2001095270A1 (en) Method for author registration and certification of the authorship of an electronic document and for verification

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): BE CH DE ES FR GB IT LI NL SE

17P Request for examination filed

Effective date: 19890203

17Q First examination report despatched

Effective date: 19910207

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): BE CH DE ES FR GB IT LI NL SE

REF Corresponds to:

Ref document number: 3865555

Country of ref document: DE

Date of ref document: 19911121

ITF It: translation for a ep patent filed

Owner name: DR. ING. A. RACHELI & C.

GBT Gb: translation of ep patent filed (gb section 77(6)(a)/1977)
PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: CH

Payment date: 19920612

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 19920617

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 19920622

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 19920623

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: SE

Payment date: 19920626

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: BE

Payment date: 19920629

Year of fee payment: 5

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: NL

Payment date: 19920630

Year of fee payment: 5

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2029336

Country of ref document: ES

Kind code of ref document: T3

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed
PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Effective date: 19930628

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Effective date: 19930629

Ref country code: ES

Free format text: LAPSE BECAUSE OF THE APPLICANT RENOUNCES

Effective date: 19930629

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Effective date: 19930630

Ref country code: CH

Effective date: 19930630

Ref country code: BE

Effective date: 19930630

BERE Be: lapsed

Owner name: SCHLUMBERGER INDUSTRIES

Effective date: 19930630

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Effective date: 19940101

NLV4 Nl: lapsed or anulled due to non-payment of the annual fee
GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 19930628

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Effective date: 19940301

EUG Se: european patent has lapsed

Ref document number: 88401646.0

Effective date: 19940110

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 19991007

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20020621

Year of fee payment: 15

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20040227

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES;WARNING: LAPSES OF ITALIAN PATENTS WITH EFFECTIVE DATE BEFORE 2007 MAY HAVE OCCURRED AT ANY TIME BEFORE 2007. THE CORRECT EFFECTIVE DATE MAY BE DIFFERENT FROM THE ONE RECORDED.

Effective date: 20050628