Method for indivisibly modifying a plurality of sites in a microcircuit card non volatile memory, in particular a contactless card

• US 7,370,203 B1
• Filed: 04/09/1999
• Issued: 05/06/2008
• Est. Priority Date: 04/09/1998
• Status: Expired due to Term

• Current Assignee: La Regie Autonome Des Transports Parisiens
• Original Assignee: La Regie Autonome Des Transports Parisiens
• Inventors: Didier, Stéphane, Grieu, Francois
• Primary Examiner(s): Revak; Christopher
• Assistant Examiner(s): Moorthy; Aravind K
• Application Number:
  US09/673,106
• Time in Patent Office: 3,315 Days
• Field of Search: 713/72, 713/73, 713/200, 713/201, 713/193, 705 64- 66, 705/67, 705/68, 705/75, 726/9, 726/20, 714/15, 714/19, 714/21, 707/202, 707/203, 902/38
• US Class Current: 713/172
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G07F 7/082 Features insuring the integrity of the data on or in the card
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

A method of connecting a card to a terminal including the following steps: a) on receiving corresponding respective commands from the terminal, it modifies the contents of the card memory by provisionally recording in the card memory each of said interdependent items of information without losing prior values corresponding to said items; and then b) the modifications are finalized either by all of them being confirmed or by all of them being discarded.

Claims

1. A method of modifying the content of the non-volatile memory of a contactless microcircuit card, wherein the card is temporarily coupled to a terminal while a transaction is being executed, in particular a remote ticketing transaction, the transaction including the terminal applying to the card a plurality of modification commands, each command comprising at least one operation of recording in the card memory a respective data item designated by the command, the various data items recorded in this way being mutually interdependent, said method comprising the card executing the steps of:

a) on receiving corresponding respective commands from the terminal, modifying the contents of the card memory by provisionally recording in the card memory each of said interdependent items of information without losing prior values corresponding to said items; and

b) finalizing the modifications to the card memory by one of confirming all of the modifications and by discarding all of the modifications, wherein for subsequent operations, the commands executed in step a) will either all have been taken into account, or else all of them will be without effect.

2. The method of claim 1, wherein:

in step b), a flag confirming proper execution is recorded in the memory of the card; and

when the card subsequently receives a command requiring at least one of the data items written in step a) or the value corresponding thereto to be read and/or modified, the card begins by examining the state of the flag, and if it has not been recorded, the card ignores or cancels the provisional recordings previously made in step a) and executes the command on the basis of said prior values corresponding to the data items.

3. The method of claim 2, wherein, when the card examines the state of the flag, and if the flag has been recorded, the card executes operations for copying the provisional writes made in step a).

4. The method of claim 1, in which the card is suitable for operating in two modes, namely:

an in-session mode in which recordings are made by executing steps a) and b); and

an out-of session mode in which the making of recordings is not confirmed to all of steps a) and b).

5. The method of claim 4, wherein when the card receives from the terminal commands for modifying the content of the memory and including verification of a cryptographic certificate, said verification is performed if the command is received out-of-session, and it is not performed if the command is received in-session, wherein said authentication is performed by the card which authenticates the terminal and/or the data interchanged between the terminal and the card, the card checking a cryptographic certificate produced by the terminal and transmitted to the card, and confirming the modifications in step b) only if the certificate is recognized as being correct.

6. The method of claim 4, wherein said authentication is performed by the terminal which authenticates the card and/or the data interchanged between the terminal and the card, the card producing and transmitting a cryptographic certificate in conditional manner to the terminal, if and only if the modifications have been confirmed in step b), wherein when the card receives from the terminal commands for modifying the contents of the memory and including the production of a cryptographic certificate, said production is performed if the command is received out-of-session, and is not performed if the command is received in-session.

7. The method of claim 4 taken in combination, in which at least some of the commands that may be executed in step b) include an optional inhibit attribute, and in which, if the card executes such a command in-session in a step b), the modifications performed by said command take effect independently of the result of step b).

8. The method of claim 1, comprising an authentication function combined with the function of finalizing step b), forcing step b) to be discarded in the event of authentication failing.

9. The method of claim 8, in which said authentication is performed by the card which authenticates the terminal and/or the data interchanged between the terminal and the card, the card checking a cryptographic certificate produced by the terminal and transmitted to the card, and confirming the modifications in step b) only if the certificate is recognized as being correct.

10. The method of claim 8, in which said authentication is performed by the terminal which authenticates the card and/or the data interchanged between the terminal and the card, the card producing and transmitting a cryptographic certificate in conditional manner to the terminal, if and only if the modifications have been confirmed in step b).

11. The method of claim 1, in which, when the card receives from the terminal in step b) commands for modifying the contents of the memory and including the production of a plurality of cryptographic certificates, these certificates are stored in step b), and then transmitted together to the terminal if, and only if the modifications have been confirmed in step b).

12. The method of claim 1, in which provision is further made, after step b) and in the event of modifications being confirmed, for the following sequence of steps to be performed:

d) the terminal executes an action following confirmation by the card; and

e) in the event of said action being properly performed by the terminal, ratification information is recorded in the card suitable for subsequent accessing by reading.

13. The method of claim 12, in which the recording command of step e) is an implicit command, any command received by the card after step b) being interpreted as an order for recording ratification information in the card.

14. The method of claim 1, wherein after said modifying step (a) and prior to said finalizing step (b), any interruption in operation of the card results in the cancellation of the modifications in the modifying step (a) and return of the values of the interdependent items of information of the card memory to their prior values.

15. The method of claim 14, wherein the cancellation step occurs when the card is next coupled to a terminal.

16. A method of modifying the content of the non-volatile memory of a microcircuit card, in particular a contactless card, in which method the card is temporarily coupled to a terminal while a transaction is being executed, in particular a remote ticketing transaction, said transaction including the terminal applying to the card a plurality of modification commands, each of said modification command comprising at least one operation of recording in the card memory a particular data item, determined among a plurality of data items contained in the card as a function of an index or of an identifier conveyed to the card by each of said commands, the various data items recorded in this way being mutually interdependent, the method comprising the card executing the following steps:

a) on receiving corresponding respective commands from the terminal, provisionally recording in the card memory each of said interdependent items of information;

then

b) finalizing such modifications such that for subsequent operations the commands executed in step a) will;

i) either all have been taken into account,

ii) or else all them will be without effect,

in which method;

said commands are commands for modification of the contents of the card memory,

in step a) the writing in the card memory of new values of said data items modifies the contents of the memory without losing prior values of said items, and

in step b), the modifications are finalized in such a way that, if all the commands performed in step a) are without effect, then the data contained in the non-volatile memory will remain the state they were before step b) being performed.

17. The method of claim 16, in which:

in the event of confirmation in step b), a flag confirming proper execution is recorded in the memory of the card; and

when the card subsequently receives a command requiring at least one of the data items written in step a) or the value corresponding thereto to be read and/or modified, the card begins by examining the state of the flag, and if it has not been recorded, the card ignores or cancels the provisional recordings previously made in step a) and executes the command on the basis of said prior values corresponding to the data items.

18. The method of claim 17, in which, when the card examines the state of the flag, and if the flag has been recorded, the card executes operations for copying the provisional writes made in step a).

19. The method of claim 16, in which the card is suitable for operating in two modes, namely:

an in-session mode in which recordings are made by executing steps a) and b); and

an out-of-session mode in which the making of recordings is not confirmed to all of steps a) and b).

20. The method of claim 19, in which, when the card receives from the terminal commands for modifying the content of the memory and including verification of a cryptographic certificate, said verification is performed if the command is received out-of-session, and it is not performed if the command is received in-session.

21. The method of claim 19, in which, when the card receives from the terminal commands for modifying the contents of the memory and including the production of a cryptographic certificate, said production is performed if the command is received out-of-session, and is not performed if the command is received in-session.

22. The method of claim 19, in which, when the card receives from the terminal in step b) commands for modifying the contents of the memory and including the production of a plurality of cryptographic certificates, these certificates are stored in step b), and then transmitted together to the terminal if, and only if the modifications have been confirmed in step b).

23. The method of claim 19, in which at least some of the commands includes an inhibit attribute, and in which, if the card executes such a command, the modifications performed by said command take effect independently of the result of step b).

24. The method of claim 19, in which provision is further made, after step b) and in the event of modifications being confirmed, for the following sequence of steps to be performed:

d) the terminal executes an action following confirmation by the card; and

e) in the event of said action being properly performed by the terminal, ratification information is recorded in the card suitable for subsequent accessing by reading.

25. The method of claim 24, in which the recording command of step e) is an implicit command, any command received by the card after step b) being interpreted as an order for recording ratification information in the card.

26. The method of claim 19, in which after performing at least one of said modifications in step a) which is not followed by a finalization by a step b) occurring thereafter, in case of later re-initialization of the card provision is made of a preliminary step infirming all modifications thus performed, such that for any following operations all commands performed in step a) be without effect.

27. The method of claim 16, comprising an authentication function combined with the function of finalizing step b), forcing step b) to be discarded in the event of authentication failing.

28. The method of claim 27, in which said authentication is performed by the card which authenticates the terminal and/or the data interchanged between the terminal and the card, the card checking a cryptographic certificate produced by the terminal and transmitted to the card, and confirming the modifications in step b) only if the certificate is recognized as being correct.

29. The method of claim 27, in which said authentication is performed by the terminal which authenticates the card and/or the data interchanged between the terminal and the card, the card producing and transmitting a cryptographic certificate in conditional manner to the terminal, if and only if the modifications have been confirmed in step b).