FR2792088A1 - Method for performing secure payment over network such as Internet by comparing data stored in IC card with that stored in server to allow, after confirmation, user's access to products and services - Google Patents

Abstract

A microcomputer via a modem (3) connects with a server (6) via a telecommunications network (5) while an interface (4) reads an IC card (1) of a user to verify user's identity. The data (D) stored in the IC card is compared with data stored in the server (6) to allow, after confirmation, the user's access to the products and services set. In case of purchase it verifies the user's confidential code before validating the payment. An Independent claim is included for: (a) a device for implementing operation of the claimed method

Description

The present invention relates to a secure payment method and a

device

  for the implementation of such a method.

  Many products and services are now available for sale on the Internet.

  Most often, payment is made by giving a credit card number.

  Secure payment methods have been proposed, involving encryption

of data.

  However, these known secure payment methods are not entirely satisfactory, and there is still some apprehension of users to perform

  their purchases on the Internet, for fear of piracy of banking information.

  The present invention aims to propose a new secure payment method for electronic commerce, which is safe and relatively inexpensive to implement. The secure payment method according to the invention is characterized in that it comprises the steps of: a) providing a smart card to each user of a plurality of user groups,

  (b) if necessary, provide each group of users with at least one micro-

  computer, equipped on the one hand with a modem allowing the connection to a server via a telecommunications network and on the other hand with an interface making it possible to read smart cards, c) memorize in the smart card of each user data known to the server, allowing the latter to identify the user and the group of users to which it belongs and to validate a specific PIN to the user, d) after connecting a user to said server to means of a microcomputer equipped with a modem for connection to said server via said telecommunications network and an interface for reading the smart card assigned to this user, check the membership of this user to one said user groups by reading data stored in said smart card and comparison with known data from the server, e) allowing, if so, the access of the user to offers of pr predetermined costs and services, f) in case of purchase, check the user's PIN before validating the payment. Payment security is guaranteed by the invention in an efficient manner, thanks to the fact that multiple hardware and IT checks are performed at multiple levels, making it difficult to

hack.

  Firstly, each transaction is subject to the physical possession by the user, at the time of purchase, of the smart card in which are stored

known information from the server.

  Then, the smart cards are delivered only to users selected from predetermined user groups, which contributes not only to the safety of the user but also to that of the suppliers of products or services made available to the users. by the server, since the user group to which the user belongs may be chosen according to predetermined criteria, including

solvency.

  Finally, any transaction can be performed only after reading data stored in the smart card to identify the user and the user group

  it belongs to and verification of a user-specific PIN.

  In a preferred implementation of the invention, the user only provides the server once the bank details of the account he wants to see debit during the

  transactions, the server keeping in memory these bank details.

  Thus, the user no longer has to give his bank details during subsequent transactions, which reduces the risk of interception by a hacker of said bank details, unlike known secure payment methods, which require that each transaction the user provides his bank details, which well

  encrypted still remain susceptible to being intercepted.

  Still in a preferred implementation of the invention, the aforementioned interface comprises a support having the general external shape of a floppy disk, capable of being

  introduced into a floppy disk drive of the microcomputer.

  In this way, the smart card can be read by virtually any micro-

  computer, without the need to make new connections to the serial ports or

  parallel, often already used for devices.

  The invention also relates to a device for implementing the method defined above, this device being characterized by the fact that it comprises: a set of smart cards for each of the users of a plurality of groups of 'users, - a server,

  at least one microcomputer for each user group, each micro-computer

  computer being equipped with a modem allowing the connection to said server via a telecommunications network and an interface for reading smart cards, - means for storing in each smart card data known to the server allowing the latter to identify the user and the user group to which he belongs and validate a PIN

specific to the user.

  The invention also relates to a set of smart cards for a group

  of users, for the implementation of the method as defined above.

  The invention will be better understood on reading the detailed description which will

  follow, an example of non-limiting implementation and the examination of the single figure of the

attached drawing.

  In the illustrated example, each user of a plurality of user groups is addressed to a smart card I whose structure is known in itself, each card to

  chip 1 having a non-volatile memory capable of storing information.

  In the example described, it is assumed that there are user groups G 1,..., G p, each group G q (1 <q <p) having a given number r (q) of users Us, q ( I <s <r (q)).

  In accordance with the invention, each group of users Gq has a micro-

  Computer 2 equipped with a modem 3 and a 3.5 "floppy disk drive Each user group Gq is constituted for example by the employees of the same company, the microcomputer 2 then being advantageously put at the disposal of the customer.

works council.

  The modem 3 allows the connection to a server 6, via a network of

telecommunications 5.

  This connection is made in the example described by the Internet network.

  Each microcomputer 2 has an interface 4 enabling the reading of smart cards, each interface 4 having in the embodiment example the general form

external 3.5 "floppy disk.

  The interface 4 is intended to be introduced into the 3.5 "floppy disk drive of the microcomputer 2. The interface includes means for the exchange of data with the electronic circuits of the smart card 1 and the card. on the other hand with the magnetic head of the

  3.5 "floppy disk drive of the microcomputer 2.

  The server 6 is interconnected to the server 8 of a bank, to debit the accounts

  bank users during transactions.

  Prior to sending smart cards 1 to users, data D is

  stored in each smart card 1, by writing means 9 known in themselves.

  same. This data D comprises a user-specific identification code and information enabling the server 6 to identify each connected user and the user group to which it belongs, as will be specified below. When the user belonging to a user group Gq wishes to make a purchase, he introduces his smart card 1 into the interface 4, which is then put in place

  in the 3.5 "floppy drive of the microcomputer 2.

  This user then connects to the server 6, via the telecommunications network 5. During the connection, the server 6 checks, by reading information contained in the smart card I and comparison with known data of the server 6, the the user's membership of one of the user groups G1, ..., Gp and, if so, authorizes the user to access predetermined product and service offers. When making a purchase, the user dials his PIN on the

  keyboard of the microcomputer 2, after the server 6 asked him.

  In the example described, the server 6 furthermore requests the user during the

  first transaction, to indicate his bank details.

  These bank details are stored in the server 6 for subsequent transactions. Thus, during the latter, the server 6 directly sends to the bank server 8 the order to debit the account of the logged-on user of a given amount, without this user has again to pass on the Internet its bank details .

  Of course, the invention is not limited to the embodiment described.

  In particular, it is possible, without departing from the scope of the present invention, to use another type of interface that makes it possible to read smart cards, and to use, for example,

  microcomputers with built-in smart card readers.

Claims (5)

  1. Secure payment method, characterized in that it comprises the steps of: a) providing a smart card (1) to each user (Usq) of a plurality of groups (Gq) of users,   (b) if necessary, provide each group (Gq) of users with at least one micro-   computer (2), equipped on the one hand with a modem (3) for connection to a server via a telecommunications network (5) and on the other hand with an interface (4) for reading smart cards , c) storing in the smart card (1) of each user data (D) known to the server (6), allowing the latter to identify the user and the group of users to which it belongs and validate a specific PIN code to the user,   d) after connecting a user to that server by means of a micro-   computer equipped with a modem for connection to said server via said telecommunications network and an interface (4) for reading the smart card assigned to this user, checking the membership of this user to one of said groups of d users by reading data (D) stored in said smart card and comparing it with data known to the server (6), e) allowing, if so, the user's access to offers of products and services predetermined, f) in case of purchase, check the user's PIN before validating the payment.   2. Method according to claim 1, characterized in that the user (Us.q) provides only once to the server (6) the bank details of the account he wants to see debit during all transactions, the server (6) retaining in memory these bank details.   3. Method according to any one of the preceding claims, characterized by the   the interface (4) comprises a support having the general external shape of a   3.5 "floppy disk, suitable for insertion into the floppy disk drive of the microcomputer (2).   4. Device for implementing the method according to any one of   preceding claims, characterized in that it comprises:   a set of smart cards (1) for each of the users (Us, q) of a plurality of groups (Gq) of users, - a server (6), - at least one microcomputer (2) for each group (Gq) of users, each microcomputer (2) being equipped with a modem (3) allowing the connection to this server (6) via a telecommunications network (5) and an interface (4) for reading smart cards, - means (9) for storing in each smart card known data of the server (6) for identifying the user (Us, q) and the user group (Gq) which it belongs and to validate a specific PIN to the user. 5. Set of smart cards (1) for a group (Gq) of users for the   implementing the method as defined in any one of claims 1 to 3.