Authenticating method between a smart card and a terminal

• US 6,839,840 B1
• Filed: 11/04/1999
• Issued: 01/04/2005
• Est. Priority Date: 11/12/1998
• Status: Expired due to Fees

• Current Assignee: Gemalto SA (Thales SA)
• Original Assignee: Gemplus (Thales SA)
• Inventors: Cooreman, Pascal
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/831,634
• Time in Patent Office: 1,888 Days
• Field of Search: 713/172, 713/182, 713/185, 713/193, 713/200, 713/201
• US Class Current: 713/172
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

The invention concerns a method enabling a smart card and a terminal whereto it is connected to authenticate each other. The invention is characterized in that at the end of each transaction the terminal calculates, from data representing the card at said transaction end, a secret code CSC₂ which is recorded in a zone ZCSC with unprotected access in the card memory and an authentication certificate CA₂ which is recorded in a zone ZCA with protected access of the memory by presenting a secret code CSC₂. At the next transaction, the terminal calculates, by means of data contained in the card, a secret code and an authentication certificate which are compared to those previously recorded to perform authentication. The invention is applicable to smart cards.

Claims

1. An authenticating method between a memory chip card having at least one counter and a terminal, comprising the following steps:

(a) inserting the memory chip card into the terminal,

(b) calculating, in the terminal, a secret code CSC₁, according to a cryptographic function F of a number of variables comprising at least a code CSN identifying the memory chip card and the value of said counter,

(c) authenticating the terminal by the card when the calculated secret code CSC₁ is identical to a code CSC₀ recorded in a memory of the card at the end of a previous authentication operation,

(d) carrying out a desired transaction and modifying the value of said counter,

(e) calculating, in the terminal, a new secret code CSC₂ according to the cryptographic function F of the code CSN identifying the memory chip card and the new value of said counter,

(f) updating the memory chip card for the next transaction by recording, in said memory, the new secret code CSC₂ calculated by the operation (e).

2. A method according to claim 1, further including the following steps between the steps (c) and (d):

(x) calculating, in the terminal, an authentication certificate CA₁ according to a cryptographic function G of a number of variables comprising at least the code CSN identifying the memory chip card and the value of the counter,

(y) authenticating the card by the terminal when the calculated authentication certificate CA₁ is identical to a certificate CA₀ calculated and recorded at the end of the previous transaction,

and wherein step (e) is supplemented by the step of

(e′

) calculating, in the terminal, a new authentication certificate CA₂ according to the cryptographic function G of the code CSN identifying the memory chip card and the new value of said counter,

and wherein step (f) is supplemented by the step of

(f′

) updating the memory chip card for the next transaction by recording, in the memory, the new authentication certificate CA₂ calculated according to the step (e′

).

3. A method according to claim 2 wherein step (b) comprises the following steps:

first calculating, in the terminal, a session key K_s1 according to a cryptographic function F_ks of a number of variables comprising at least a parent key K_m known by the terminal, the code CSN identifying the memory chip card and the value of said counter,

next calculating, in the terminal, the secret code CSC₁ according to the cryptographic function F of the session key K_s1,

and wherein step (e) comprises;

first calculating, in the terminal, a new session key K_s2 according to the cryptographic function F_ks with the new value of said counter,

next calculating, in the terminal, the new secret code CSC₂ according to the cryptographic function F of the new session key K_s2.

4. A method according to claim 3 wherein step (e′

) includes the step of calculating the new authentication certificate CA₂ according to the cryptographic function G of the new session key K_s2.

5. A method according to claim 1 wherein the memory chip card comprises two counters, one counting the authentications and the other counting payment transactions, and wherein the variables of the cryptographic functions comprise the values of said counters.

6. A method according to claim 1 wherein the cryptographic functions are one-way functions.

7. A method according to claim 6, wherein the cryptographic functions are “

hashing”

functions.

8. A method according to claim 3, wherein step (b) comprises the following steps:

(b₁) reading the serial number CSN of the card,

(b₂) reading the content of the counter, and

(b₃) calculating the session key according to a cryptographic function F_ks such that;

Ks₁=F_ks (K_m, CSN, CTC₁).

9. A method according to claim 1, wherein step (c) comprises the following steps:

(c₁) transmitting the secret code CSC₁ to the card,

(c₂) comparing, in the card, this secret code CSC₁ with a secret code CSC₀ recorded in the card at the end of the previous transaction with the card, and

(C₃) authorizing the remainder of the operations if the comparison indicates the identity CSC₀=CSC, or refusing same if CSC₀ is not equal to CSC₁.

10. A method according to claim 2, wherein step (y) comprises the following steps:

(y₁) reading the content CA₀ of a designated area of the memory of the card CM,

(y₂) transmitting, to the terminal, the content CA₀ of said area which corresponds to an Authentication Certificate CA₀ calculated at the end of the previous transaction,

(Y₃) comparing, in the terminal, the calculated Authentication Certificate CA₁ with the certificate CA₀, and

(y₄) authorizing the remainder of the operations if the comparison indicates the identify CA₁=CA₀.

11. A method according to claim 1, wherein step (d) comprises the following steps:

(d₁) reading, from an area of the memory, the value BAL₀ of a balance resulting from the previous transaction and a corresponding certificate CBAL₀, and

(d₂) verifying that the certificate CBAL₀ correctly corresponds to the result of the cryptographic function such that;

CBAL₀=H(K_t, BAL₀, CSN, CTC₁),

K_t being a transaction key,

(d₃) incrementing the transaction counter to the value (CTC₁+1)=CTC₂.

(d₄) recording the new balance BAL₁ in said area,

(d₅) calculating a Certificate CBAL₁ for the new balance BAL₁ such that;

CBAL₁=H(K_t, BAL₁, CSN, CTC₂), and

(d₆) recording CBAL₁ in said area.

12. A method according to claim 1 wherein step (a) also comprises a step of entering a personal code of the user.

13. A method according to claim 3, wherein in step (b), one of the variables used for calculating the session key Ks₁ is a personal code PIN of the user.

14. A method according to claim 1 wherein step (b) comprises the following steps:

first calculating, in the terminal, a session key K_s1 according to a cryptographic function F_ks of a number of variables comprising at least a parent key K_m known by the terminal, the code CSN identifying the memory chip card and the value of said counter,

next calculating, in the terminal, the secret code CSC₁ according to the cryptographic function F of the session key K_s1,

and wherein step (e) comprises;

first calculating, in the terminal, a new session key K_s2 according to the cryptographic function F_ks with the new value of said counter,

next calculating, in the terminal, the new secret code CSC₂ according to the cryptographic function F of the new session key K_s2.

15. A method according to claim 14, wherein step (b) comprises the following steps:

(b₁) reading the serial number CSN of the card,

(b₂) reading the content of the counter, and

(b₃) calculating the session key according to a cryptographic function F_ks such that;

Ks₁=F_ks(K_m, CSN, CTC₁).