Method and apparatus for acquiring access using a smart card

• US 6,003,014 A
• Filed: 08/22/1997
• Issued: 12/14/1999
• Est. Priority Date: 08/22/1997
• Status: Expired due to Term

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Sloan, Jerry, Lee, Alson A, Wentzein, Irv H.
• Primary Examiner(s): MacDonald, Allen R.
• Assistant Examiner(s): MEINECKE DIAZ, SUSANNA M
• Application Number:
  US08/918,559
• Time in Patent Office: 844 Days
• Field of Search: 705/13, 705/39, 705/41, 705/44, 705/65, 713/182, 713/184
• US Class Current: 705/13
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/08 by coded identity card or credit card or other personal identification means without personal verification means G07F7/02
• CPC Class Codes: G07F 7/0866 by active credit-cards adapted therefor G07F7/1008 takes precedence
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method for using a smart card to gain access through an access device upon payment of a value (V) is performed by first operatively coupling the card to the access device. The access device reads a first and a second set of data from the card, and performs a first authentication process on the first set of data. Access is permitted if the first authentication process meets a required condition. Access is denied otherwise. If access is permitted, the second set of data is stored in the access device for further processing, including a second authentication process which operates on the first and second sets of data.

Claims

1. A method for using a smart card to gain access through an access device upon payment of a value (V), the method comprising the steps of:

operatively coupling said smart card to said access device;

reading at least a first set of data and a second set of data from said smart card;

performing a first authentication process on said at least first set of data;

permitting access if said step of performing a first authentication process meets a required condition;

storing said at least first set of data and said second set of data in a memory of said access device; and

performing a second authentication process on said at least first set of data and said second set of data after said step of permitting access is accomplished.

2. The method of claim 1, wherein said first set of data includes information indicating a balance (B) of funds available in said smart card, and an expiration date (DEXP) of said smart card.

3. The method of claim 1, wherein said second set of data includes a card public key certificate, a card issuer public key certificate, and a signature generated by said smart card.

4. The method of claim 2, wherein said first authentication process includes the step of verifying that said balance (B) is greater than said value (V).

5. The method of claim 2, wherein said first authentication process includes the step of verifying that said expiration date (DEXP) has not passed.

6. The method of claim 2, wherein said required condition is said balance (B) being greater than said value (V).

7. The method of claim 3, wherein said second authentication process includes the steps of verifying said card certificate, verifying said issuer certificate, and verifying said card signature.

8. The method of claim 1, wherein said second authentication process is performed between a terminal device and said access device.

9. The method of claim 8, wherein said terminal device includes a security card.

18. The method of claim 1, wherein said second authentication process is performed on said at least first set of data and said second set of data after said at least first set of data and said second set of data are stored in said memory of said access device.

19. The method of claim 1, wherein said first authentication process is a low-level authentication process that includes ensuring that said smart card has sufficient value to permit access.

20. The method of claim 19, wherein said second authentication process is a high-level authentication process that includes generating a signed message that is suitable for transmission from said access device.

10. An access system, including:

an interface device, having contacts for coupling with a smart card to read at least a first and a second set of information;

an access device, coupled to said interface device, having at least a first processor for performing a low-level authentication of said at least first set of information received from said smart card;

a memory in said access device, storing said at least first set of information and said second set of information;

a gate device, coupled to said access device, said gate device granting access to a cardholder after said low-level authentication is performed; and

at least a first security module, said first security module being in communication with said access device, wherein said first security module is arranged to perform a high-level authentication of said at least first set of information and said second set of information received from said card after said at least first set of information received from said card and stored in said memory.

11. The access system of claim 10, wherein said gate device is a turnstile.

12. The access system of claim 10, wherein said first set of information includes at least a balance (B).

13. The access system of claim 12, wherein said low-level authentication includes verifying that said balance (B) is greater than a cost of access.

14. The access system of claim 10, further comprising:

a terminal device, coupled to said access device, said terminal device having said at least first security module for performing said high-level authorization of said at least first set of information and said second set of information received from said card and stored in said memory, said high-level authorization including at least one selected from the group consisting of verifying validity of said card and generating a signed message.

15. The access system of claim 14, further comprising:

a concentration point, coupled to said terminal device, for receiving information regarding said high-level authorization.

16. An access control system, comprising:

a plurality of card reading devices, each having a contact structure for reading at least first data and second data from a smart card;

a plurality of access devices, coupled to said card reading devices, for performing a low-level authentication on said at least first data from said smart card, said access devices having a memory for storing said at least first data and said second data from said smart card; and

a terminal device, coupled to said plurality of access devices, for performing a high-level authentication on said at least first data and said second data from said smart card after said at least first data and said second data are stored in said memory of said access devices.

17. The access control system of claim 16, wherein said terminal device includes a plurality of security cards, each security card for use in performing a high-level authorization of said at least first data and said second data from a specific one of said plurality of access devices.