EP3479518A1 - Procede d'authentification de donnees de paiement, dispositifs et programmes correspondants - Google Patents
Procede d'authentification de donnees de paiement, dispositifs et programmes correspondantsInfo
- Publication number
- EP3479518A1 EP3479518A1 EP17733483.6A EP17733483A EP3479518A1 EP 3479518 A1 EP3479518 A1 EP 3479518A1 EP 17733483 A EP17733483 A EP 17733483A EP 3479518 A1 EP3479518 A1 EP 3479518A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- obtaining
- user device
- private key
- communication terminal
- authentication code
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Ceased
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/327—Short range or proximity payments by means of M-devices
- G06Q20/3278—RFID or NFC payments by means of M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
- G06Q20/352—Contactless payments by cards
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3823—Payment protocols; Details thereof insuring higher security of transaction combining multiple encryption tools for a transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3825—Use of electronic signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
- G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
- G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/0873—Details of the card reader
- G07F7/0893—Details of the card reader the card reader reading the card in a contactless manner
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
- H04L9/0841—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving Diffie-Hellman or related key agreement protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3218—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
- H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/72—Signcrypting, i.e. digital signing and encrypting simultaneously
Definitions
- the invention relates to the field of securing data exchanged via a contactless data transmission protocol.
- the technique relates more particularly to the transmission of NFC type data, in which a transmission is carried out between a first device and a second device separated by a distance of the order of ten centimeters or less.
- the technique does not apply and is not intended to apply in the context of data transmission techniques such as WiFi, WiMax, LTE, whose transmission technologies are different.
- NFC near field
- RFID refers to means of identification by radio frequency. Both use radio signals for all sorts of tracking and tracking purposes, sometimes replacing barcodes. Both use short-range data transmission means.
- contactless payment devices have appeared. These are, for example, contactless payment cards which make it possible to make a payment (the amount of which is generally capped) by affixing (or reconciling) the payment card of a compatible payment terminal. It is also the communication terminals, which also integrate contactless “chips”: these chips (also called “contactless chip”) and which offer data exchange capabilities to communication terminals, capacities that can be used to make payments, as if the communication terminal imitated the behavior of a contactless payment card.
- the device implements an authentication protocol with the terminal (for example a payment terminal, a terminal of a merchant, or any other appropriate device).
- the terminal checks that the authentication phase has succeeded and otherwise refuses the transaction or triggers an alert, or implements any other behavior deemed appropriate in such a situation.
- the terminal performing these checks is a secure device (such as a payment terminal). It has been designed to prevent most types of intrusions, both hardware and software. But if the payment terminal is a third-party device (tablet, smartphone, screen communication terminal), then the security of this communication terminal (third party) can not be guaranteed any more than the origin of the applications installed on this terminal (by the trader himself). If the merchant is not vigilant, it is possible that the applications installed on this terminal are fraudulent.
- V the verifier (for example the merchant's terminal or device)
- P the prover (user's device: smartphone, tablet).
- V asks P to digitally sign data.
- P signs the data, as requested by V and transmits the signed data to V.
- This signature is verified by V, and if it is correct, then the transaction is accepted and transferred to the rest of the processing chain. payments.
- Such a procedure is called a "challenge response" and is used for example by the EMV specifications.
- V works on an unsecured device (ie a terminal of the tablet, PC or other type, which has been added payment features) that is infected by malicious software (installed by the merchant or by a malicious third party), then this software can abuse the terminal of the client P.
- malicious software installed by the merchant or by a malicious third party
- Such an abuse can for example take the form of a succession of (invisible) transactions. This can be done for example when the merchant terminal forces the user device to sign arbitrary messages. The device of the user, in "slave" position, is then obliged to sign these data.
- the malware installed on the merchant's terminal then uses this signed data to create fraudulent transactions.
- the invention does not pose these problems of the prior art. More particularly, the invention provides a simple solution to the previously identified problem. This solution is fully compatible with existing hardware devices.
- a method of authenticating at least one piece of data a method implemented during a payment transaction occurring between a merchant's terminal and a user device, a method which includes the creation of an authentication triplet, comprising an authentication code and two components of signature, this triplet being constructed by the user device and being verifiable only by the merchant's terminal.
- a method for authenticating at least one piece of data a method implemented during a payment transaction occurring between a merchant's communication terminal and a user device, a method of the type comprising the authentication by the communication terminal of at least one message m generated by the user device, via a near-field wireless data link, characterized in that it comprises, at within the user device:
- Such a method makes it possible to create a triplet which can be transmitted to the communication terminal to enable a blind verification of the validity (and of the knowledge) by the user device of the message m.
- an authentication method which comprises, within the communication terminal:
- the method comprises, for said user device, prior to said step of obtaining an authentication code, a phase of determining a set of encryption parameters, comprising:
- a step of calculating, from the first private key (x), a public key such that X is an exponentiation of the generator g by the private key x, X g *;
- a step of calculating, from the first private key (y), a public key / such that Y is an exponentiation of the generator g by the private key y, Y g y .
- the method comprises, for said merchant's communication terminal, prior to said step of obtaining a first reference value, a phase of determining a set of encryption parameters, comprising:
- a step of calculating, from the private key (z), a public key Z such that Z is an exponentiation of the generator g by the private key z, Z g z .
- a user device comprising a general processing unit, a memory, a device comprising a secure processing unit and a secure memory and at least one reconfigurable payment transaction processing circuit with a terminal communication device comprising in particular an authentication of a piece of data, said user device comprising:
- Such a user device is generally in the form of a smart phone type communication terminal.
- a merchant terminal comprising a general processing unit, a terminal memory characterized comprising a secure processing unit and a secure memory and at least one reconfigurable payment transaction processing circuit with a device user including an authentication of a data
- said merchant terminal comprising:
- Such a merchant terminal may be in the form of a smartphone or tablet type terminal. Such a terminal may also be in the form of a payment terminal to which the means described above are added.
- the various steps of the methods according to the invention are implemented by one or more software or computer programs, comprising software instructions intended to be executed by a data processor of a relay module according to the invention. invention and being designed to control the execution of the various process steps.
- the invention is also directed to a program that can be executed by a computer or a data processor, which program includes instructions for controlling the execution of the steps of a method as mentioned above.
- This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape.
- the invention also provides a data carrier readable by a data processor, and including instructions of a program as mentioned above.
- the information carrier may be any entity or device capable of storing the program.
- the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a disk. hard.
- the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means.
- the program according to the invention can be downloaded in particular on an Internet type network.
- the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.
- the invention is implemented by means of software and / or hardware components.
- module may correspond in this document as well to a software component, a hardware component or a set of hardware and software components.
- a software component corresponds to one or more computer programs, one or more subroutines of a program, or more generally to any element of a program or software capable of implementing a function or a program. set of functions, as described below for the module concerned.
- Such a software component is executed by a data processor of a physical entity (terminal, server, gateway, router, etc.) and is capable of accessing the hardware resources of this physical entity (memories, recording media, bus communication cards, input / output electronic cards, user interfaces, etc.).
- a hardware component corresponds to any element of a hardware set (or hardware) able to implement a function or a set of functions, as described below for the module concerned. It may be a hardware component that is programmable or has an integrated processor for executing software, for example an integrated circuit, a smart card, a memory card, an electronic card for executing a firmware ( firmware), etc. Each component of the previously described system naturally implements its own software modules.
- Figure 1 shows a block diagram of the proposed technique for the creation of signature elements to the merchant terminal
- FIG. 2 presents a block diagram of the proposed technique for verifying signature elements received from a user device
- FIG. 3 schematically represents a communication terminal of the merchant according to the present
- Figure 4 depicts schematically a user device according to the present.
- the general principle of the invention consists in particular in integrating, in addition to a "challenge-response” scheme (or in place of this scheme), one or more additional operations.
- the present invention proposes a protocol modification that makes it possible to resist attacks from terminals comprising malicious software.
- this protocol modification also makes it possible to protect the terminals of the merchants themselves against unsolicited responses from other devices (that is to say, malicious devices that would attempt to attack an authentic merchant terminal).
- This protocol modification offers an additional layer of protection against other types of attacks (DoS "Dismeai of Serverce", Concurency Attacks).
- a "challenge / response" process is implemented so that the terminal the trader identifies (authenticates) the user device (and vice versa) through the exchange of a message m.
- the present technique makes it possible to dispense with a scheme of this type. It is thus no longer necessary to carry out a "challenge response" type process.
- the technique used is therefore not a “challenge-response” technique (which is an interactive process); nor is it a new signature (which is publicly verifiable); it is also not a message authentication code (which is only possible when sharing a secret key).
- the approach adopted by the present technique is to ensure that the device of the user can prove that he has legitimately signed the message "m" (the data) to authenticate, without having to transmit this message (the message can for example be known from both sides: by the merchant terminal and by the user device, so instead of traditionally signing the message and transmitting it (ie ie to transmit the signed message), we adopt a strategy of transmitting proof of signature of this message (which may be complementary to either the transmission of this message or to the sharing of the knowledge of the message between the merchant terminal and the user device).
- the merchant's terminal is not secure as such (it is a phone, a tablet or a PC), but that it has security resources.
- security resources can for example take the form of a "secure element - SE” (secure element in French), a “Trusted Execution Environment - TEE” (secure execution environment in French) or a other hardware component or dedicated software.
- TPC the payment application of the merchant's terminal
- V the verification module (identification) called V (it is for example an SE, a TEE or more generally a secure processing unit, which may even be remote, that is to say, not present in the terminal).
- the user device includes a proof module (of identity confirmation) called P (it is by example of an SE, a TEE or more generally a secure processing unit).
- P a proof module (of identity confirmation)
- the user device may be a conventional payment card, in which protocol and material modifications to implement this technique.
- the present technique combines the principles of Schnorr signatures and Diffie-Hellman key exchange (for the hypothesis of absence of computational solution). However, unlike the Schnorr signatures (which includes a couple of data), the technique used uses a signature comprising a data triple.
- the technique relies on the use of a private key pair and a public key pair, which is made available to the user device (and / or of the proof module).
- the module P calculates (10), from the message m, a random datum f and a hash function H, an authentication code Sj;
- the module P calculates (20), from the message m, the random data t, a public key Z of V, a first private key x of P and the authentication code Sj, a first component of signature S 2 ;
- the module P calculates (30), from the message m, the random data t, the public key of V, a second private key of P and the authentication code S lt a second signature component S 3 ;
- the module P transmits (40) to the merchant terminal (or module V), the authentication code S lt and the two signature components S 2 and S 3 .
- the public key of the merchant terminal is either transmitted by the merchant terminal to the initialization of the payment transaction, or obtained, for example from a database, accessible from the user device.
- the random datum f is, for its part, unilaterally chosen by the user device. It goes without saying that this public key should, according to good practice, be certified by a recognized authority. However this is not necessary for the operation of the invention, and is not even useful in some applications.
- the public key used for the recipient of the signature is not necessarily the public key of the merchant terminal. It could be for example that of the payment processor (the module V), the terminal only relaying the information.
- the merchant terminal From the data received ⁇ SS 2 and S 3 ), the merchant terminal (or the module V, or a remote recipient), will verify (by performing a calculation on these data) that they are synonymous with the knowledge ( by the user device or by P) of the message m.
- the merchant terminal (or module V):
- the method issues an authentication assertion. Based on the result of this verification the method transmits a step (90), by the communication terminal, of transaction validation data to a payment transaction processing system (STTP).
- STTP payment transaction processing system
- this hash function H this hash function is used by the module P to calculate the first authentication code Sj and by the module V to verify that the hash of U [r2] is equal to the first authentication code Sj;
- the module V and the module P thus share the knowledge of this function of Hash;
- the message m is determined by the merchant's terminal and by the user device;
- the message authentication code Si may, depending on the embodiment, take the place of the authentication codes conventionally used in the payment protocols, and more particularly in the payment protocols implemented within the framework of the EMV specifications.
- the proposed technique consists, in particular in a modification of the Schnorr signatures, adapted for two users (merchant terminal and user device).
- the security of the proposed technique is based in particular on the Diffie-Hellman Decisional Hypothesis (DDH) which is a hypothesis of computation hardness based on cyclic groups (“Decisional Diffie-Hellman Assumption").
- DDH Diffie-Hellman Decisional Hypothesis
- the proposed technique is implemented based on a group G suitable for the Schnorr signature problem, with a generator g.
- a group of Schnorr is a subgroup of Z the multiplicative group of integers modulos p for a prime number p.
- the generator g of this group the following method is applied:
- This group has a size and a size.
- the size of this group and its other parameters are typically determined beforehand.
- the size of the group G is of the order of 2 1024 (number 2 raised to the power 1024): this means that the size of the prime number p is of the order of 2 1024 .
- the group G and the generator g corresponding have been the subject of a prior configuration, both in the device of the customer in the merchant terminal.
- This pre-setting may have been done for example before the installation of the payment application on the side of the merchant or the payment application on the In other embodiments, this setting is made during the payment transaction.
- the merchant terminal and the user device agree on the parameters of the group. In this case, considering that the group is renegotiated with each transaction, the size of this group can be reduced, for example by half ( 2,512 ) or more ( 2,256 ).
- the device of the user which is for example a smartphone-type communication terminal, a tablet, is also equipped with an SE or a TEE (acting as a secure processing unit).
- SE electronic book reader
- TEE electronic book reader
- the customer wants to adjust with his device.
- This device therefore has the necessary data to make a payment. It may be, in a specific embodiment, credit card data (bearer name, PAN card number, validity date, verification code). It can also act other data, depending on the embodiments.
- the installation phase thus consists in depositing, in the SE or the TEE of the user's device (also called module P), the private keys x and y used to construct the elements of the device. signatures.
- This installation can typically be implemented by the installation of a payment application, as is the case of the payment application installed on the merchant's terminal.
- the user device obtains or generates a private key comprising two prime integers (x, y) and, based on this private key, calculates a public key (X, Y), in which :
- the two prime integers (x, y) each constitute a private key of the user device while the two integers X and Y each constitute the public key corresponding to these two private keys.
- the two private key / public key pairs have been pre-parameterized in the client device.
- This pre-setting can have been done for example before the installation of the payment application on the side of the user device.
- the selection of these keys is performed during the payment transaction.
- the user device selects its pairs ⁇ private keys / public keys ⁇ , based on the group G and the generator g.
- the sizes of these parameters can advantageously be reduced, because of the relative uniqueness of the parameters themselves: they are used only for a transaction, which significantly limits the chances of fraud on the part of an attacker.
- An advantageous possibility is to install these keys (and group parameters) at the same time as a banking application: for example the customer's banking application.
- a banking application for example the customer's banking application.
- the data required for payment are not necessarily credit card data, but may be data specifically prepared by the bank's banking application, or even specifically prepared, at the time of payment, by the financial institution itself. -even by a server to which the client's banking application is connected.
- the customer opens his banking application; selects the fact that he wishes to make a payment; enter a possible confidential code (or authenticate for example by biometric means); and affixes its device on the merchant's terminal.
- the banking application responds to the requests of the merchant's terminal (as explained herein) and the payment is made.
- the benefits are real, both in terms of the security of the transaction (made by the banking application), and in terms of customer loyalty (which is no longer obliged to perform a payment with a third party application, for which it has no guarantee, for example as regards the security and confidentiality of the data transmitted and processed).
- the user device provides these keys when the transaction, the merchant terminal is able to obtain these keys from a trusted third party.
- the user device has a unique identifier (Uid), which is associated, with the trusted third party, two public keys X and Y.
- the merchant terminal wishes to obtain these public keys, it transmits, to the trusted third party, a request for obtaining the keys based on the identifier (Uid) of the user device.
- the user device Prior to this transmission, the user device transmitted its unique identifier to the merchant terminal (for example during the initialization of the transaction).
- the pair of private key / public key has been the subject of a prior configuration in the merchant terminal.
- This preliminary setting may have been done for example before the installation of the payment application on the side of the merchant terminal.
- the selection of these keys can be performed during the payment transaction.
- the user device acquires the public key Z of the merchant terminal. Either the merchant terminal transmits this key directly to the customer device, or the customer device uses a unique identifier of the merchant terminal (Cid) to obtain this public key from a trusted third party.
- Cid unique identifier of the merchant terminal
- the installation phase is performed during the installation of a payment application on a communication terminal (smartphone, tablet, or computer type) of the merchant, said communication terminal being equipped with a TEE and / or an SE (also called module V).
- a communication terminal smarttphone, tablet, or computer type
- said communication terminal being equipped with a TEE and / or an SE (also called module V).
- This embodiment has the advantage of not having to communicate the private key z to the communication terminal as such: this data is only communicated to the SE or to the TEE. Thus, it is ensured that the communication terminal (and especially any fraudulent applications of this terminal), can not have access to this private key. 5.2.3. Run of Authentication
- the authentication is implemented as follows:
- the module P performs a transformation of the message m, in a digital form, so that this message m corresponds to an element of the group G: to do this, the message m is transformed into binary (binary representation of the message m) and the binary form is used to obtain a numerical form, the numerical form corresponding to an element of the group G; other methods may be conceivable depending on the applications;
- the module P selects randomly (or pseudo randomly) an element f of the group G;
- the module P calculates, from the message m, the random data f and the hash function H, an authentication code Sj according to the following formula:
- the module P calculates, from the message m, the random data t, the public key Z, the first private key x of P and the authentication code S lt the first signature component S 2 , according to the following formula:
- the module P calculates, from the message m, the random data t, the public key Z, the second private key y P and the authentication code S lt the second signature component S 3 ;
- the module P transmits, to the merchant terminal (or module V), the authentication code S lt and the two signature components S 2 and S 3 .
- the user device has not transmitted the message m, or even a signed version thereof because it is concatenated with a hazard (f), before being chopped to produce Sj. Therefore, an attacker, who would intercept for example the authentication code S lt could not, from it, infer the content of the message m.
- S 2 and S 3 are quantities created from these three pieces of information and the message m. Exponentiation guarantees the protection of private keys, and the multiplication of the message by the exponentiated quantity protects its contents.
- the merchant terminal receives the data S lt S 2 and S 3 . On the basis of these data, it will determine (with reasonable doubt) that these data correspond to the results of calculations made on the basis of the message m.
- the merchant terminal implements the following steps:
- H U [r2]
- the merchant terminal has information of sufficient certainty to estimate that the user device is in possession of the message m and that the it is authentic. Therefore, the merchant's terminal can terminate the transaction (for example, he can send Sj to the payment system for validation of the transaction).
- the merchant terminal makes the following calculations:
- NFC Near Field Communication
- the communication terminal acting as a payment terminal, comprises a memory 31 comprising in particular a buffer memory, a general processing unit 32, equipped for example with a microprocessor, and driven by a computer program 33, and a secure processing unit 34 (noted previously V), driven by a computer program 35, these processing units implementing the authentication method as described above to make a payment from the merchant.
- the code instructions of the computer program 35 are for example loaded into a memory before being executed by the processor of the secure processing unit 34.
- the processing unit 34 receives as input at least an authentication code and two signature elements.
- the microprocessor of the secure processing unit 34 implements the steps of the authentication method, according to the instructions of the computer program 35, to supply, to the general processing unit 32, a representative data of transaction validation and where appropriate, transmit a transaction validation data to a processing system.
- the general processing unit 32 performs a processing of these data to transmit them to a device of a customer (for example a smartphone, a tablet) as part of a payment transaction.
- the communication terminal comprises, in addition to the buffer memory 31, communication means, such as network communication modules, data transmission means and data transmission circuits between the various components of the communication terminal.
- communication means such as network communication modules, data transmission means and data transmission circuits between the various components of the communication terminal.
- These means may be in the form of a particular processor implemented within the communication terminal.
- this device implements a specific application that is in charge of carrying out the transactions, this application being for example provided by the manufacturer of the processor in question in order to allow the use of said processor or by a provider. payment solution for "open" terminals.
- the processor comprises unique identification means. These unique identification means make it possible to ensure the authenticity of the processor.
- the device further comprises the near-field communication means, referred to as NFC, and means for transmitting and receiving data from communication networks.
- NFC near-field communication means
- These means are also presented as communication interfaces for exchanging data on communication networks, interrogation means and database update.
- the user device comprises a memory 41 consisting of a buffer memory, a general processing unit 42, equipped for example with a microprocessor, and driven by a computer program 43, and a secure processing unit. 44 (noted P, previously), driven by a computer program 45, these processing units implementing the authentication method as described above to make a payment from the merchant.
- the code instructions of the computer program 45 are for example loaded into a memory before being executed by the processor of the secure processing unit 44.
- the secure processing unit 44 receives as input, a message m of which it is necessary to prove the knowledge.
- the microprocessor of the secure processing unit 44 implements the steps of the authentication method, according to the instructions of the computer program 45 to supply, to the general processing unit 42, at least one authentication code and two signature elements to be transmitted to a merchant terminal.
- the general processing unit 42 carries out the transmission of these data.
- the user device comprises, in addition to the buffer memory 41, communication means, such as network communication modules, data transmission means and data transmission circuits between the various components of the device. user.
- these means may be in the form of a particular processor implemented within the user device.
- this device implements a specific application that is in charge of carrying out the transactions, this application being for example provided by the manufacturer of the processor in question in order to allow the use of said processor or by a provider. payment solution for "open" terminals.
- the processor comprises unique identification means. These unique identification means make it possible to ensure the authenticity of the processor.
- the device further comprises the near-field communication means, referred to as NFC, and means for transmitting and receiving data from communication networks.
- NFC near-field communication means
- These means are also presented as communication interfaces for exchanging data on communication networks, interrogation means and database update.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Computer Security & Cryptography (AREA)
- Accounting & Taxation (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Signal Processing (AREA)
- Finance (AREA)
- Algebra (AREA)
- Mathematical Physics (AREA)
- Pure & Applied Mathematics (AREA)
- Computing Systems (AREA)
- Mathematical Optimization (AREA)
- Mathematical Analysis (AREA)
- Microelectronics & Electronic Packaging (AREA)
- Power Engineering (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
Claims
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
FR1656240A FR3053549B1 (fr) | 2016-06-30 | 2016-06-30 | Procede d'authentification de donnees de paiement, dispositifs et programmes correspondants. |
PCT/EP2017/066365 WO2018002351A1 (fr) | 2016-06-30 | 2017-06-30 | Procede d'authentification de donnees de paiement, dispositifs et programmes correspondants |
Publications (1)
Publication Number | Publication Date |
---|---|
EP3479518A1 true EP3479518A1 (fr) | 2019-05-08 |
Family
ID=57583156
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP17733483.6A Ceased EP3479518A1 (fr) | 2016-06-30 | 2017-06-30 | Procede d'authentification de donnees de paiement, dispositifs et programmes correspondants |
Country Status (5)
Country | Link |
---|---|
US (1) | US10922679B2 (fr) |
EP (1) | EP3479518A1 (fr) |
CA (1) | CA3029154A1 (fr) |
FR (1) | FR3053549B1 (fr) |
WO (1) | WO2018002351A1 (fr) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109347635A (zh) * | 2018-11-14 | 2019-02-15 | 中云信安(深圳)科技有限公司 | 一种基于国密算法的物联网安全认证***及认证方法 |
CN111639187B (zh) * | 2019-03-01 | 2023-05-16 | 上海数眼科技发展有限公司 | 一种基于知识图谱的知识问答验证码生成***及方法 |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8700729B2 (en) * | 2005-01-21 | 2014-04-15 | Robin Dua | Method and apparatus for managing credentials through a wireless network |
US8290433B2 (en) * | 2007-11-14 | 2012-10-16 | Blaze Mobile, Inc. | Method and system for securing transactions made through a mobile communication device |
US20140032345A1 (en) * | 2012-07-30 | 2014-01-30 | Bank Of America Corporation | Authentication Using Transaction Codes on a Mobile Device |
FR3030828A1 (fr) * | 2014-12-22 | 2016-06-24 | Orange | Procede de securisation de transactions sans contact |
-
2016
- 2016-06-30 FR FR1656240A patent/FR3053549B1/fr active Active
-
2017
- 2017-06-30 WO PCT/EP2017/066365 patent/WO2018002351A1/fr unknown
- 2017-06-30 EP EP17733483.6A patent/EP3479518A1/fr not_active Ceased
- 2017-06-30 US US16/314,174 patent/US10922679B2/en active Active
- 2017-06-30 CA CA3029154A patent/CA3029154A1/fr active Pending
Also Published As
Publication number | Publication date |
---|---|
US10922679B2 (en) | 2021-02-16 |
WO2018002351A1 (fr) | 2018-01-04 |
FR3053549A1 (fr) | 2018-01-05 |
CA3029154A1 (fr) | 2018-01-04 |
FR3053549B1 (fr) | 2018-07-27 |
US20190228402A1 (en) | 2019-07-25 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3032799B1 (fr) | Procédé d'authentification d'un utilisateur, serveur, terminal de communication et programmes correspondants | |
EP1908215A1 (fr) | Procédé de contrôle de transactions sécurisées mettant en oeuvre un dispositif physique unique à bi-clés multiples, dispositif physique, système et programme d'ordinateur correspondants | |
EP2545722B1 (fr) | Detection d'un deroutement d'un canal de communication d'un dispositif de telecommunication couple a un circuit nfc | |
WO2007012583A1 (fr) | Procede de controle de transactions securisees mettant en oeuvre un dispositif physique unique, dispositif physique, systeme, et programme d'ordinateur correspondants | |
EP2509025A1 (fr) | Procédé d'accès à une ressource protégée d'un dispositif personnel sécurisé | |
EP3238150B1 (fr) | Procédé de sécurisation de transactions sans contact | |
EP3479518A1 (fr) | Procede d'authentification de donnees de paiement, dispositifs et programmes correspondants | |
FR3092927A1 (fr) | Procédé de traitement d'une transaction de paiement, dispositif, système et programmes correspondants | |
CN104320261B (zh) | 金融智能卡上实现身份认证的方法、金融智能卡和终端 | |
EP3479325B1 (fr) | Procédé d'authentification de données de paiement, dispositifs et programmes correspondants. | |
EP2306668B1 (fr) | Système et procédé de transaction sécurisée en ligne | |
EP3273398B1 (fr) | Procédé de traitement de données par un dispositif électronique d'acquisition de données, dispositif et programme correspondant | |
EP3095223B1 (fr) | Méthode de transmission de données chiffrées, méthode de réception, dispositifs et programmes d'ordinateur correspondants | |
EP3570238B1 (fr) | Procédé de réalisation d'une transaction, terminal, serveur et programme d'ordinateur correspondant | |
FR3070516A1 (fr) | Procede d'authentification d'un utilisateur aupres d'un serveur d'authentification | |
WO2017077210A1 (fr) | Procédé de verification d'identité lors d'une virtualisation | |
EP3029878B1 (fr) | Procédé de transmission de secret à durée de vie limitée pour réaliser une transaction entre un terminal mobile et un équipement | |
WO2021028639A1 (fr) | Procede de transmission d'une information numerique | |
EP4074004A1 (fr) | Procede et systeme, dispositif et terminal de paiement utilisant des donnees personnelles | |
WO2014154961A1 (fr) | Procédé de délivrance de billets électroniques |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: UNKNOWN |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20181219 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
RIN1 | Information on inventor provided before grant (corrected) |
Inventor name: GERAUD, REMI |
|
DAV | Request for validation of the european patent (deleted) | ||
DAX | Request for extension of the european patent (deleted) | ||
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20201119 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
RAP1 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: BANKS AND ACQUIRERS INTERNATIONAL HOLDING |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R003 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED |
|
18R | Application refused |
Effective date: 20221116 |