METHOD AND SECURE DEVICE FOR PERFORMING A SECURE TRANSACTION WITH A TERMINAL

• US 20130041812A1
• Filed: 08/10/2012
• Published: 02/14/2013
• Est. Priority Date: 08/12/2011
• Status: Active Grant

• Current Assignee: IDEMIA France (Advent International Corporation)
• Original Assignee: Oberthur Technologies SA
• Inventors: Aubin, Yann-loic, Guerin, Vincent, Boisde, Matthieu
• Granted Patent: US 9,792,606 B2
• Time in Patent Office: Days
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: G07F 7/1066 PIN data being compared to data on card
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for performing a secure transaction between a secure device (2) and a terminal (4), the method being carried out by the secure device (2) and comprising the steps of:

• • receiving transaction data from the terminal (4), characterized in that it comprises, before the step of receiving transaction data from the terminal (4), the steps of
  • obtaining transaction data entered by a user of the secure device (2), and
  • transmitting the transaction data to the terminal (4).

Claims

1. A method of performing a secure transaction between a secure device and a terminal, the method being carried out by the secure device and comprising the steps of:

receiving transaction data from the terminal, characterized in that before the step of receiving said transaction data from the terminal,

the transaction data is obtained by the secure device, followed by the step of

transmitting the transaction data from the secure device to the terminal.

2. A method according to claim 1, wherein the step of transmitting the transaction data to the terminal comprises sending the transaction data through a wireless link.

3. A method according to claim 1, wherein the secure device is inserted in a user device, and wherein the step of obtaining transaction data comprises obtaining transaction data entered on an input interface of the user device.

4. A method according to claim 1, wherein the step of transmitting the transaction data to the terminal is performed only if a predetermined condition is satisfied.

5. A method according to claim 4, wherein the predetermined condition is satisfied if a predetermined time from the step of obtaining transaction data has not expired, and the predetermined condition is not satisfied if said predetermined time from the step of obtaining transaction data has expired.

6. A method according to claim 1, which comprises a step of encrypting the transaction data, wherein the step of transmitting the transaction data to the terminal comprises transmitting the encrypted transaction data.

7. A method according to claim 1, wherein the transaction data comprises holder identification data, the method comprising the step of checking a match between the holder identification data received from the terminal and data held on the secure device, wherein a secure action is performed only when the holder identification data from the terminal and the data held on the secure device match.

8. A method according to claim 1, wherein the step of transmitting the transaction data to the terminal is performed in response to a command received from the terminal.

9. A method according to claim 1, wherein the step of receiving transaction data from the terminal comprises receiving a Verify EMV command from the terminal.

10. A method according to claim 1, wherein the transaction data comprise an amount, the method comprising, after the step of receiving transaction data from the terminal, a step of sending the amount to the terminal.

11. A computer program comprising instructions for implementing the method for performing a secure transaction between a secure device and a terminal according to claim 1 when said program is executed on a computer.

12. A computer program according to claim 11, comprising a Payment Applet, wherein:

a Banking Applet that is configured for execution in a secure domain of the secure device includes instructions for implementing the steps of obtaining transaction data entered by a user of the secure device and transmitting the transaction data to the terminal; and

the Payment Applet comprises instructions for implementing the steps of receiving transaction data from the terminal.

13. A secure device for performing a secure transaction between the secure device and a terminal, comprising:

means for receiving transaction data from the terminal, characterized in that it comprises;

means for obtaining transaction data entered by a user of the secure device, and

means for transmitting the transaction data to the terminal.

14. A system comprising a user device, a secure device according to claim 13, and a terminal.

15. A system according to claim 14, wherein the terminal comprises a delivery system for delivering bank notes or an amount of credit.

16. A system according to claim 15, wherein the amount of banknotes or credit to be delivered is entered by the user, encrypted and sent to the terminal.