EP2082364A1

EP2082364A1 - Biometric electronic payment terminal and transaction method

Info

Publication number: EP2082364A1
Application number: EP07823430A
Authority: EP
Inventors: David Naccache
Original assignee: Compagnie Industrielle et Financiere dIngenierie Ingenico SA
Current assignee: Worldline MS France
Priority date: 2006-08-22
Filing date: 2007-08-17
Publication date: 2009-07-29
Also published as: US20100030696A1; FR2905187A1; FR2905187B1; WO2008023114A1

Abstract

The invention relates to an electronic payment terminal comprising means of acquiring biometric data and a program capable of: - acquiring biometric data during a transaction by means of biometric data acquisition means; and storing the biometric data in the payment terminal. The invention also relates to a corresponding transaction method.

Description

BIOMETRIC ELECTRONIC PAYMENT TERMINAL AND TRANSACTION METHOD

The present invention relates to an electronic payment terminal. The invention also relates to a corresponding transaction method.

An electronic payment terminal (EPT) is an electronic device for registering a secure payment transaction. A TPE is typically a computer placed at a merchant, which allows payments by credit cards (such as smart cards or magnetic stripe cards). The merchant introduces the card of his client into the reader of the terminal and enters the amount of the transaction. The customer validates his purchase, for example by dialing his PIN on the device keypad and receives a ticket confirming the transaction.

Some TPEs are portable; they include a smart card reader, ticket printing means, a modem, and a GSM card. They are used in particular in taxis, markets, or for home delivery.

These VSEs are often connected at merchants to management means

(for example a cash register) which allows the management of the point of sale. The TPE / management system is a point-of-sale (POS) terminal. Some TPEs have a portable portion for reading smart cards and printing tickets. This part is based on a base when not in use, and communicates with this base by a wireless connection, for example radio, in use. The base can be connected to the management means; it typically includes a modem for obtaining authorizations of sampling of authorized organizations.

Although the payment system by TPE has a high level of security thanks to the identification of the credit card by chip and / or magnetic stripe, to the possible use of a user code (PIN code) and to the possible use of a signature, fraud is possible in case of theft of credit card and PIN code theft for example. On the one hand, it is therefore desirable to further improve the level of security by making fraud more dissuasive; and secondly possibly to allow a subsequent verification of the identity of the user at the origin of the transaction.

These problems arise in similar terms for other electronic terminals such as ATMs for example.

The invention therefore aims to design terminals with a system discouraging fraud. The invention thus relates to an electronic payment terminal comprising means for acquiring biometric data and a program adapted to:

acquiring biometric data during a transaction via the means for acquiring biometric data; and - store the biometric data in the payment terminal.

In preferred embodiments, the invention comprises one or more of the following features:

- The program is also suitable to request from a central authorization to validate the transaction and if necessary, to receive the authorization of the central transaction validation and validate the transaction;

- the program is further adapted to store the biometric data in the terminal definitively or for a specified period and to provide the stored biometric data, if necessary for the specified duration, and preferably provided that certain security conditions are met; the program is further adapted to provide the biometric data to the central office before requesting the validation authorization of the transaction or simultaneously;

the program is further adapted to receive biometric reference data from the central office, to establish a comparison of the acquired biometric data with the reference biometric data; and validate or not the transaction based on the result of the comparison;

the program is further adapted to establish a comparison of the biometric data with standard data; and where appropriate, depending on the result of the comparison, not validating the transaction or acquiring new biometric data via the biometric data acquisition means;

the program is further adapted to establish the comparison of the biometric data with the reference biometric data and / or the comparison of the biometric data with the standard data by form recognition;

the electronic payment terminal according to the invention furthermore comprises means for inputting a code by a user, and the program is configured so that the means for acquiring biometric data serve the user with means of validation of the code entry;

the means for acquiring biometric data are chosen from photographic apparatuses enabling the capture of moving or still images, fingerprint sensors, iris shape sensors; and

the program is further adapted to encrypt biometric data within the terminal using a probabilistic public key encryption algorithm, the key owned by one of the following entities: the bank, the owner of the card, a trusted third party or the manufacturer of the terminal.

The invention also relates to a transaction method comprising the acquisition by an electronic payment terminal of biometric data during a transaction and storing the biometric data in the payment terminal. According to one variant, this method is implemented with the electronic payment terminal according to the invention. According to another variant, this method also comprises a step of validating the transaction independently of the stored biometric data. Other features and advantages of the invention will appear on reading the following detailed description of the embodiments of the invention, given by way of example only.

In the remainder of the description, an electronic terminal according to the invention is taken as an example of an electronic payment terminal (EPT). This embodiment is advantageous because it is desirable to improve the trust of users (customers and merchants) in the payment system by TPE. In addition, the application of the invention to a TPE is all the more advantageous as the number of transactions carried out thanks to the TPEs is important.

The invention proposes a TPE comprising means for acquiring biometric data.

Biometric data means data relating to the physical characteristics of human persons. The biometric data can be for example relating to fingerprints, the shape of the face, the shape of the iris of the eye, a simple photograph or others. In this respect, it is important to note that the biometric data referred to in the present invention must not necessarily be analyzable or understandable by a machine but may be data whose analysis requires recognition for human intervention (eg a photograph) or that of a human expert. Human intervention, to the extent that it is required only ex post facto, for example in cases of proven fraud (that is to say relatively rarely), may be easier to implement.

The acquisition means of the biometric data may be any biometric data sensor, for example a fingerprint sensor or a camera or a combination of different sensors and / or cameras. Specific image acquisition devices (applied to the face or fingerprints), iris data, and voice recording devices are known. The acquisition of fingerprints is particularly well suited to payment terminals because it does not disrupt the habits of the user, accustomed to using his fingers with such a terminal. The acquisition of digital images can also be envisaged using devices similar to those commonly found today in mobile phones or cheap surveillance cameras. Thus, by biometric data, we also mean a film taken by the TPE, for example in the MPEG format.

The TPE also includes a program, stored in the central unit of the TPE. This program is part of the TPE operating system, for example, or is added (installed) over the operating system. The program is adapted to acquire biometric data during a transaction, that is to say to implement the means for acquiring biometric data, and to store the biometric data after acquisition. The storage can be transient (in the RAM) or durable, or even permanent, according to the embodiments. By transaction is meant a data modification operation, typically in one or more databases and devices. This modification can for example be done offline (in the card and / or the TPE only), online (at the central office) or in a mixed mode. In the case of the TPE, the transaction is a payment. According to a preferred embodiment, the validation of the transaction is not subject to any control by the TPE (and the central, possibly) acquired biometric data, prior to the transaction. It is thus possible for a user to lend his bank card, for example to a spouse or friend, without risk of blocking the transaction. Preferably, the TPE is connected to a central via means of communication with the central office. For example, the program may be adapted to request from the central office authorization for validation of the transaction. This request ^is accompanied by data transmission to the central. In particular, in the case of a payment transaction, the data may include data relating to the merchant, identification of the user payor's bank account and data relating to the amount of money that is the subject. of the transaction. Once this data has been processed by the central office, the central transmits to the TPE an authorization or a non-authorization to validate the transaction. The TPE program is then adapted to possibly receive the authorization or the non-authorization of validation of the transaction and to validate the transaction in case of receipt of a validation authorization (or not to validate the transaction in case of absence of reception ^of authorization or validation in case of receiving a non-authorization of validation). For more details, see for example the "Electronic Payment Manual" and "Transmission Protocol with Processing and Authorization Centers" published by the Group of Bank Cards "CB".

According to a particular embodiment, the program is adapted to store sustainably in the TPE acquired biometric data. This storage can be performed in a RAM block whose contents are maintained by a battery or in a flash memory, hard disk, etc. This storage can be provided permanently or only for a specific period of time depending on the configuration of the program. This duration can be for example a week, a month or a year. Optionally, the program is adapted to erase the biometric data once the determined period has elapsed or according to a first-in, first-out principle.

The program may further be adapted to provide on demand the biometric data stored during the storage period. Obviously, such provision of biometric data would typically be subject to the satisfaction of certain security conditions such as the presentation of a PIN code or the insertion into the terminal of an "administrator card". For example, the stored biometric data is available to the police and the judiciary if a dispute arises as to the identity of the TPE user (the payer in this case) or if fraud is proven after the transaction. The exploitation of the stored biometric data makes it possible to verify whether or not the user was a person authorized to carry out the transaction and possibly makes it possible to track a fraudster or even to determine the identity of the unauthorized user. It should be noted that this embodiment allows, if desired, to provide that the validation of the transaction is performed independently of the acquired biometric data. In this case, the biometric data is acquired during the transaction but does not intervene in the process of validation of the transaction, they remain simply available for later exploitation, in case of problem. By minimizing the opportunities for effective use of biometric data, this embodiment offers particular guarantees in terms of respect for privacy and individual freedoms.

According to another embodiment, the program is adapted to provide the acquired biometric data to the central office. In this case, it can be expected that the TPE stores the biometric data only transiently and then erases them. The biometric data may for example be stored at the central office for later use in a manner similar to that described above. The biometric data can also be, in exceptional cases, immediately processed by the central office so as to identify the user of the TPE, for example in case of doubt or particular risk on the transaction (for example: a large amount or a purchase in a distant country). In this case, the result of the analysis of the biometric data, possibly in addition to that of other data such as a PIN code or data specific to the means of payment (bank card), partly conditions the transmission or not by the central office of an authorization or a non-authorization of transaction validation.

The analysis of the biometric data consists, for example, in comparing the biometric data with reference biometric data, for example associated with the authorized user (s) of the means of payment. There is therefore formal identification of the user before the transaction (but preferably in exceptional cases only), which makes fraud (and dispute) impossible or extremely difficult. As such cases of particular risk should normally be rather rare, the implementation of the system does not require heavy calculations and does not slow down the fluidity of cash transactions. This is all the more advantageous as the number of customer passes per hour increases. According to one variant, and always (preferably) in case of particular risk on the transaction, the comparison of the biometric data with the reference biometric data can be performed at the level of the TPE. In this case, the central office provides for example to the TPE biometric reference data (associated with the payment means used in the requested transaction). This reference data can alternatively be read directly into the bank card or the SIM of the user. Alternatively, this reference data can come from any reliable storage source including the memory of the TPE itself. The TPE validates or not the transaction based on the result of this comparison, that is to say that the transaction is validated if the acquired biometric data are judged to be consistent with the reference biometric data.

After validation of the transaction, it is possible, according to one variant, to provide for the erasure of the biometric data and biometric reference data at the terminal to guarantee the confidentiality of the biometric data.

In the modes described above, the analysis of the biometric data may involve automated form recognition (for example recognition of the shape of a fingerprint, an iris, a face) or human form (visualization of the real-time photograph by a bank clerk knowing the legitimate user of the card), in which case the reference biometric data is representative of a form of fingerprint, iris or face of one or more users authorized partners associated with the means of payment.

According to a particular embodiment, the program is also adapted to ensure that the data acquired is indeed exploitable. To do this, it establishes a comparison of the biometric data with standard data (possibly by form recognition). Thus, if necessary, depending on their exploitability, the program can be configured not to validate the transaction or require and acquire new biometric data via the biometric data acquisition means. In other words, the program is adapted to verify whether the data acquired has the characteristic form necessary for their exploitation. For example, if the biometric data correspond to a fingerprint, the program is adapted to search in the image obtained during data acquisition characteristics typical of any fingerprint to verify whether the acquired biometric data corresponding to fingerprint are exploitable. If this is not the case, for example because the user wears a glove, the program, depending on the configuration chosen, does not validate the transaction or is adapted to acquire new biometric data (for example after a request to this effect ). The procedure can be repeated if the new biometric data is still not satisfactory. The same procedure can be applied in the case of the recognition of the shape of a face or the shape of an iris to avoid that is treated as a picture does ^not appear correctly face or iris of the user. Thus, it can make it impossible for the SOHO user to evade the ^acquisition of biometric data usable to complete the transaction.

Thus, in the TPE, for example, the data structures {T, B} where T is the reference of the transaction (for example the transaction number) and B is the biometric data acquired during the transaction, for example, are kept for subsequent audit. Also, it is possible to enrich the data structures saved in the TPE with additional fields, not returned to the central but saved to facilitate a subsequent investigation. Such additional data (rated D and generalizing the data structures {T, B} in {T, B, D}) include a photograph of the property purchased, an electronic copy of the contents of receipt, ^the identity of who made the sale and could potentially testify later, etc.).

A particularly advantageous and natural encoding mode is to encode ^the image of ^the fingerprint into a graphics file named T.jpg. Thus the information B is the file T.jpg and there is no need to create a database itself. Also, in the case where the data would be sent back to the central office, it should be noted that the transmission of T and B (or {B, D}) may not take place at the same time. Thus, T can be transmitted in real time while the set of B (or {B, D}) accumulated during the day could be brought back to the central office during the night. This makes it possible to shorten the duration of the transaction.

Finally, it should be noted that the transaction can be concurrent (simultaneous) with the capture of the biometric information. This makes it possible to optimize the time of checkout.

In addition, the archiving of the biometric data may be conditioned to the prior agreement of the legitimate user. In this embodiment, when obtaining the means of payment (typically credit card), the user freely chooses to associate (or not) a biometric backup to his card. Thus, when a TPE comes into contact with the card, it contacts the central office which, before validating the transaction, consults its database in order to determine whether the user has subscribed or not the biometric backup. If so, the central notifies this to the terminal that will not validate the transaction before proceeding to the acquisition and safeguarding of a print. Alternatively, the implementation information of a biometric backup may be encoded in the card. In this case, in order to avoid card clones that would systematically declare themselves as not requiring biometric backup, a digital signature-based cryptographic protocol can be implemented between the card and the terminal. Typically the TPE would issue the card a challenge r and ask the card to return a digital signature valid on the chain (r | "no biometric backup necessary"), where the operator "| "Refers to the concatenation. The implementations of such protocols are known to those skilled in the art.

In general, the safeguarding of biometric data will preferably be done with the precaution of respecting confidentiality. To do this, a particularly advantageous method consists in encrypting the data on board the terminal using a probabilistic encryption algorithm public key whose only public key is contained in the terminal. For example the RSA algorithm OAEP. Thus, even in the event of a violation of the terminal, the biometric data remains confidential because the terminal contains no secrets and can only encrypt the biometric information without having the capacity to decrypt it. Several embodiments are possible with regard to the entity whose public key is used for this encryption. This entity can be the user's bank, a trusted third party or even the user himself. It goes without saying that whatever the entity may be, its public key must depend on a chain of valid certificates before being accepted by the TPE.

Moreover, a TPE generally comprises means for entering a code by a user (user code or PIN code), as well as means for validating the code entry. In concrete terms, the means of entering a code include a numeric or alphanumeric keypad and the code input validation means generally consist of a "validation" key which is intended to be pressed by the user once he has entered his code. Pressing this key tells the TPE that the code is entered. The TPE according to the invention may have such characteristics. In this case, the biometric data acquisition means are distinct from the code input means and the code input validation means. The program is then adapted to record the entry of the code and proceed to the validation of the code by the user and then to the acquisition of biometric data or, conversely, to the acquisition of biometric data then to the entry of the code and to validation of the code by the user.

But according to another embodiment, the biometric data acquisition means act as means for validating the code entry. Thus, the TPE does not include a "validation" key, which is replaced by the means for acquiring biometric data. The program is then configured so that the user is called upon to enter his code, then to lend himself to the acquisition of biometric data, which also validates the entry of the code.

An example of a TPE suitable for the implementation of the invention is now described.

This TPE is equipped with a GSM / GPRS communication module (dual band 900/1800 or 900/1900 MHz). In the event of an incident on the GSM / GPRS network, an optional modem can, if necessary, ensure continuous operation.

The TPE is for example equipped with a 32-bit processor supporting the usual cryptography (RSA, DES, triple DES ...). The architecture of the processor is preferably chosen so as to allow several applications to operate independently of each other (multi-application and multi-tasking) within the device.

In this regard, the program described above can be loaded independently of other applications provided in the TPE, to ensure a logical security (or software seal). A particularly suitable platform for implementing the invention is adapted from Ingenico's UNICAPT 32 platform, built around a 32-bit processor (HSC hardware module, for "High Security Core"), including embedded security and a security system. Multi application operation supporting advanced programming languages such as C, C ++ or JAVA. Such a platform integrates into many environments:

- Roaming use with GPRS mobile telephony or with Bluetooth;

- Multi-cash environments using Ethernet or Wi-Fi with TCP / IP;

- Traders with high sales volumes using ADSL; - External communication via USB / PCMCIA;

- Internet connection through Wi-Fi hotspots

This platform can be modified (in particular its configuration program) in order to allow the implementation of characteristics according to the invention.

The invention is however not limited to the variants described above but is capable of many other variations easily accessible to those skilled in the art. For example, it is possible to provide applications of the invention to fixed, portable and mobile TPEs. Similarly, the foregoing description can also be read by replacing the TPE by a company telephone, a company photocopier or any device where post-use control would be likely to deter fraud, the use of against the subject or abuse. Of course, it should be borne in mind that the storage of the biometric data in the device is preferably performed independently of the transaction (or any operation permitted by this device, for example a phone call or a photocopy) and that a control of the stored biometric data is, possibly, a posteriori. In this way, the confidentiality of these data is preserved and these data are only used on specific request, for example with the agreement of the user. Here, abuse or fraud is discouraged after the fact. By way of example, an embodiment may be envisaged in which biometric data stored in a bank card serve as reference or standard data. In addition, any physical features such as face, voice, iris, retina, thumb, hand and ear shape, DNA may be subject to biometric measurements for the purpose of applying the invention. By extension, one can consider using behavioral characteristics such as the signature or the way of typing on a keyboard.

Claims

An electronic payment terminal comprising means for acquiring biometric data and a program adapted to: acquiring biometric data during a transaction via the biometric data acquisition means; and

storing the biometric data in the payment terminal, the electronic payment terminal being adapted to validate the transaction independently of the stored biometric data.

An electronic payment terminal according to claim 1, wherein the program is further adapted to:

- request from a central office authorization to validate the transaction; - if necessary, receive authorization from the central office to validate the transaction and validate the transaction.

3. electronic payment terminal according to claim 1 or 2, wherein the program is further adapted to: - store the biometric data in the terminal permanently or for a specified period;

- provide the stored biometric data, where appropriate for the specified duration, and preferably provided that certain security conditions are met.

The electronic payment terminal of claim 2, wherein the program is further adapted to:

- provide the biometric data to the central office before requesting authorization to validate the transaction or simultaneously.

5. electronic payment terminal according to one of claims 1 to 4, wherein the program is further adapted to establish a comparison of the biometric data with standard data.

The electronic payment terminal of claim 5, wherein the program is further adapted to: - to compare the biometric data with the reference biometric data and / or the comparison of the biometric data with the standard data by form recognition.

7. electronic payment terminal according to one of claims 1 to 6, further comprising means for entering a code by a user, and whose program is configured so that the biometric data acquisition means serve for the user means for validating the entry of the code.

8. electronic payment terminal according to one of claims 1 to 7, wherein the biometric data acquisition means are selected from the cameras for capturing still or moving images, fingerprint sensors, sensors of the shape of the iris.

9. electronic payment terminal according to one of claims 1 to 8, wherein the program is further adapted to encrypt biometric data within the terminal using a probabilistic encryption algorithm public key, the key belonging to one of the following entities: o The bank; o The owner of the card; o A trusted third party; or o The manufacturer of the terminal.

10. Transaction method comprising:

- the acquisition by an electronic payment terminal of biometric data during a transaction;

Storing the biometric data in the payment terminal; and

- validation of the transaction independently of stored biometric data.

11. The method of claim 10, implemented with the electronic payment terminal of one of claims 1 to 9.