DE19634418A1 - Security system for data transmission in electronic payment transactions - Google Patents

Abstract

The use of a card in a terminal results in an electronic receipt being generated based on the data stored in the chip of the card. The data is used in a security module built into the terminal and this controls the transaction

Description

The invention relates to methods for data transmission in electronic Payments.

In electronic payment transactions, a buyer identifies himself through a mobile data carrier from, e.g. B. a chip card. The company that provides the cashless service offers and, if necessary, provides the data carriers, is referred to below as the publisher designated. The publisher's computing system initiates the bank transactions, which associated with cashless payments. This computing system is as follows referred to as the accounting system or account management system.

As a rule, a point of sale terminal (service provider terminal) is connected to the accounting system connected, e.g. B. over a telephone line. If an operation is switched over a Line processed, one speaks of online processing, otherwise of offline Processing.

Via an online connection to the accounting system, stolen or lost media can be excluded from further use by is checked against a blacklist. It is also used to process bookings The safest way to immediately transfer the booking records to the accounting system. This means that data records cannot be lost.

Because of the line costs, online testing of every single data carrier is not economically. Therefore, data carriers are only checked and sporadically online Posting records collected. These electronic receipts are then packaged transferred, preferably at times of low line costs.

That is why every POS terminal contains a security module, which the publisher provides. This security module checks the authenticity of the data carrier and saves the booking records in a secure manner. There are different security procedures known. Some of the methods are based on cryptography, with the required ones Keys in the security modules and mobile data carriers (e.g. chip cards) Readout are protected. The security modules (possibly also the data carriers themselves) generate electronic signatures for the data records which are used to process the Bank transactions are transmitted. This prevents messages can be manipulated unnoticed.

Appropriate methods are known from the ec-cash system and other systems.

Some terminals may have Maybe no way, online connections at any time to manufacture. This applies in particular to mobile terminals in sales vehicles. A The obvious solution is to collect the bookings in the security module. Around Transferring the electronic receipts to the accounting system becomes the security from time to time connected to a transmission device. The acceptance point (Service provider) is forced to do this to get the money for the goods sold receive.

Even if a possible attacker's mobile data carriers and security modules technically cannot change, fraudulent abuse may still be  possible. Namely, if it is prevented that stored messages from the Security module to be transferred to the accounting system.

The following two are among others used for payment systems based on chip cards Payment methods discussed:

• - Creditor exchange: The amount is debited from the buyer's account. Around To secure payment, a credit line can be stored in the data carrier, which is reduced by the purchase amount.
• - Prepaid exchange (prepaid exchange): An amount of money is paid in advance to the Publisher paid and saved on the card.

Both methods show advantages in certain situations. The owner of the Data carriers usually do not want to pay very large amounts of money in advance. Larger He therefore does business with a credit-related stock exchange. For the invention It does not matter whether the value of the electronic exchange is a paid amount or corresponds to a credit line (overdraft). Payment from the credit The stock exchange corresponds to the issuing of a check that the acceptance point cashes. Through the Updating the amount saved prevents the holder from opening his account or overdraw a given credit line.

Since transactions are carried out via (bank) accounts, the holder loses money Credit-related exchanges not if the mobile data carrier is lost or defective.

The cost of the bank transaction, which comes with paying from the credit Connected to the stock exchange, however, cannot be justified for small amounts of money. Here it makes sense to transfer amounts from small change exchanges into the security module of the Cash register terminals simply add up and from time to time the total amount to transfer. In the event of loss or a defect, the contents of the change can not be replaced because the management of the necessary information is saved. Payment from the small wallet can therefore best be done by paying through Cash can be compared. The origin of the money can no longer be determined and with the loss of the mobile data medium also means the loss of money, just like that Loss of a wallet.

Transfer postings from the credit-related stock exchange to the small change at the dealer terminal are desirable for several reasons. The corresponding rebooking can be done with Protected from manipulation with the help of the security module. The electronic Rebooking voucher is easy with the accounts of the acceptance point by the Security module submitted.

Methods for rebooking between different exchanges in chip cards are from DE 42 43 851 known.

Compared with banking transactions that are carried out on paper receipts this transfer of a cash withdrawal. Here it becomes clear that the evidence for the Editor is very important. Because the receipt does not reach the publisher, loses the publisher the transferred money.  

If the rebooking is carried out online, there is no risk of misuse. Will the If the booking is made offline, the operator of the terminal can receive the Prevent documents in the accounting system. He simply does not connect the terminal to the Transmission line.

An attacker (fraudster) can do the following. He gets himself one Terminal with security module for offline operation and one or more mobile Disk. The attacker can access these devices through theft or as a participant the relevant services. The attacker uses his Security module the rebooking in the small change. It prevents the electronic receipt is forwarded to the accounting system. Because the origin of Amounts from small change markets is not controlled, the attacker can Clear the small wallet. The disk is reported as lost, so that the Publisher reimburses the attacker the amount that was originally saved.

The object of the invention is to ensure the receipt of electronic documents (or to minimize the probability of loss of the document) and thus fraud prevent.

In general, these principles are suitable, larger ones for any type of document Create security against loss. It is irrelevant whether the loss due to a defect, Theft or fraud. It is also irrelevant whether an attempt to defraud principles other than those described.

The invention reduces the chances of losing receipts and fraud Loss caused by the following countermeasures:

• a) Restrictions on rebookings: The number and / or amount of bookings from The creditor exchange in the small change market is restricted. This will make the Limited damage. The limitation and the number or amount of bookings which has already been made is saved in the data carrier.
• b) Storage of bookings in the data carrier: Electronic documents via Umbu Inquiries and other transactions from the credit-related exchange are also processed in the Disk itself filed. This means that the documents reach the accounting system if the holder reloads the card.
• e) Transfer of documents via online terminals: the data carrier arrives During a payment process to an online terminal, the receipt is transferred directly. (This requires storage according to b).) After the transfer, the document from the Media removed or marked as transferred.
• d) Transfer through offline terminals: When using the data carrier on In another offline terminal, the document is transferred to the transfer Transfer security module. The document goes to the billing system at normal transfer of revenue. This transmission path is used on several Tried offline terminals. No later than after an online transmission more attempts made. A prerequisite for the procedure is unique identification of the document so that multiple arrivals can be tolerated.

At line costs and processing costs by multiple transmission of the To restrict the receipt, the number of storage in terminals must be limited. Whether the document is actually transferred to a particular terminal is therefore a factor Determined using a rule. This rule can contain a random number generator. Of the Then the attacker is never sure that he is transmitting (in his own terminal) can intercept.

The publisher can pay for the forwarding of documents and thus for the Make acceptance points attractive. However, more effective methods are those which Obtaining legal economic benefits from the transfer of supporting documents coupled, the suppression of which can be used to defraud. I.e. Acceptance points will then be the transfer of all documents from the security module undertake if their economic benefits from legal transactions outweigh the possible fraudulent profit. One can also assume that the behavior solid acceptance points will continue in the future. Further procedures are based on this.

• e) Sequence of transmission from the security modules: the security module first transfers data about rebookings. Tries a fraudulent acceptance point To prevent the transfer of the transfer posting documents, it must be based on revenue Waive transfer of their sales receipts.
• f) Preference for terminals in which large amounts are stored: one Acceptance point has a particularly great interest bookings from the security transfer modules if large amounts have already been accumulated. An over Carrying into these security modules leads to transmission with greater certainty the accounting system.
• g) Preference for terminals with previously frequent transmission: It can be here be assumed that the document will be forwarded with a high probability.
• h) Blocking the rebooking by the security module: the terminal or the Security module blocks further rebooking if abuse can be suspected. This can be assumed if
• - a specified number of rebookings, or a total is exceeded
• - Totals that are moved by rebooking a certain amount Share in other sales.

The terminal can be unblocked again by transferring the receipts. The Blocking can be limited to the functions used for fraud can be. The blocking can also be withdrawn if appropriate documents were saved during further use, which the Defraud suspicion of fraud.

This procedure at least limits the amount of fraud.

• i) Unblocking: The blocking of a data carrier can be withdrawn if it was justified by supporting documents which have now been sent to the Accounting system were transferred.

Of course, line costs also have to be paid when transferring transfer posting documents be taken into account. Transfers of the transfer document in security modules from Offline terminals, as described in b), is therefore not with every booking desirable. If the document has already reached the accounting system, you should further sending can be stopped. One method describes method j).

• j) Recognition of data carrier and security module: In the data carrier notes to which security modules documents were transferred. The cardholder usually visits certain acceptance points frequently (e.g. the corner shop). If the document is no longer stored in the security module, the document was sent to the Billing system sent. The corresponding document can then be stored in the data carrier deleted or marked as transferred.
• k) Recognition of safe transmitters: If method i) is used, easily suspected that the terminal in question reliably forwards receipts and unnecessary distribution of the document through procedure i) with high probability is restricted. The data carrier itself can manage a list of these terminals and take this information into account in the future.

The above procedures are described in such a way that only documents are in the data carriers stored, which were generated when this data carrier was used. This is however not necessary. When using a data carrier, the terminal can Documents that have arisen from the use of other data carriers in data carriers save and initiate the forwarding. The data medium distributes this document then continue on the same principles as he does for his own evidence. Attempts to transmit can and should be made in a meaningful way through the procedures be limited, which were explained above.

Balance is particularly important for the practical application of the processes between security and costs, in this connection the transmission costs. To frequent transfers drive up costs and can even take advantage of Small change exchanges, namely the saving on line costs. Too few about Carries, in extreme cases none at all, allow fraud. If the rule is too rigid an attacker can intercept the transmission by attacking them Applications running on his terminal and this device is not ready for transmission the accounting system connects.

If the storage in a terminal is made dependent on conditions that the If the attacker cannot predict, he can receive the document in the Do not safely prevent the billing system. To realize unpredictability, can a random number generator can be used. Random number generators are from the Lite maturity known.

A simple rule that determines whether a document is transferred can be set as follows:

• 1) Different evaluation criteria can be used to calculate a barrier s be used, e.g. B. so that  
• - s increases with the number of previous stores,
• - s increases with the number of previous stores in "secure terminals"
• - s decreases with the connection frequency of the terminal,
• - s decreases with the amount of book money stored in the terminal,
• - s decreases with the transmission security through the terminal,
• - s decreases with the amount to be debited from the small wallet.
• 2) A number r is calculated with the random number generator. Only if r <s is the Transfer made.

Rules based on these criteria prefer terminals that are highly likely Arrange forwarding to the accounting system. On the other hand, it drops Probability of storage with time, so the number of transfers is already limited by the rule. The part of the rating that is given by previous Transfers is determined, can be stored in the data carrier itself. The review be stored in the data field w. The publisher sets w to an initial value. w becomes after each storage incremented, depending on an assessment of the made Transmission. I.e. if the terminal is classified as a safe transmitter, the Increase from stronger.

Claims (18)

1. A method for securing data transmission in electronic payment transactions by means of a mobile data carrier, in particular a chip card, to service providers terminal devices that are not permanently connected to a billing / account management system, the use of the mobile data carrier generating electronic documents, characterized in that

• - a copy of the electronic receipt is stored on the mobile data carrier,
• - And this document is transferred to at least one other application of the mobile data carrier to a further terminal device for forwarding to the billing / account management system.

2. The method according to claim 1, characterized in that the electronic document is each transferred to a device that uses the billing / account management system is connected or can establish a connection directly with it, and the document is immediately forwarded to the accounting / account management system. 3. The method according to claim 1, characterized in that the electronic document is transferred to a device that is not permanently linked to the billing / Account management system is connected, and with repeated use of the mobile Data carrier in the same terminal is determined whether the document is sent to the billing / Account management system was transferred, and when the transfer to the Billing / account management system for further transfers from the mobile data carrier There are no end devices. 4. The method according to any one of the preceding claims, characterized in that to reduce transmission costs by a predetermined rule or by a Rule which is a random number generator or another method of generation random values are used, it is determined whether the electronic receipt for forwarding is transferred to the accounting / account management system in the terminal with which the Disk is currently applied. 5. The method according to claim 4, characterized in that the electronic document is preferably transmitted by the rule to such terminals for the high Probability of transmission to the accounting / accounting system can be derived. 6. The method according to claim 5, characterized in that the electronic document is preferably transmitted by the rule to such devices in which receipts already exist are stored, the transmission of which to the accounting / account management system for the Operator of the terminal provides a high economic benefit. 7. The method according to claim 5, characterized in that the electronic document preferred by the rule on devices with a high connection frequency to the Billing / account management system is transferred. 8. The method according to claim 5, characterized in that

• - Information about successful forwarding of electronic documents by end devices to the billing / account management system is stored in the mobile data carrier and
• - Those devices are preferred by the rule that have previously forwarded recognizable receipts to the billing / account management system.

9. The method according to claim 4, characterized in that the rule Number of stores made in end devices are taken into account, so that the The probability of storage in other end devices decreases over time. 10. The method according to the preamble of claim 1, characterized in that at one Device that is not permanently connected to the billing / account management system is connected to a transfer of electronic documents before the transfer of evidence that is of economic benefit to the operator of the end device provide such electronic receipts to the accounting / account management system transmitted, the non-forwarding of which allows fraud or-from others Reasons for forwarding to the accounting / account management system in the end device were saved. 11. The method according to the preamble of claim 1, characterized in that a terminal immediately transmits electronic documents to the billing / account management system or blocks another application with mobile data carriers until a transmission has been made if a predefinable evaluation

• - the electronic documents, the non-transfer of which enables fraud, in particular according to the number or an amount of book money corresponding to these documents and / or
• - The electronic receipts, the transmission of which provides an economic benefit for the operator of the terminal, in particular according to the number or an amount of book money corresponding to these receipts

is no longer fulfilled. 12. The method according to claim 11, characterized in that the blocking itself refers to such applications with mobile data media that are fraudulent enable. 13. The method according to claims 11 and 12, characterized in that the Blocking is lifted if the predeterminable rating is saved by a higher one Book money amounts from unlocked applications is fulfilled again. 14. The method according to the preamble of claim 1, characterized in that a Disk is locked for further applications until appropriate transfers the billing / account management system was implemented if a predefinable one Evaluation of previous applications that are used for fraud can, is no longer fulfilled, in particular ratings according to number or one amount of book money corresponding to these applications.   15. The method according to claim 14, characterized in that the blocking itself relates to applications that can be used for fraud. 16. The method according to claims 15 and 3, characterized in that the Valuation is updated by recognizing transfers to the billing / Account management system are considered, and a lock of the disk thereby being canceled. 17. The method according to the preceding claims, characterized in that stored, electronic receipts from devices that are not permanently sent to the billing / Account management system are connected when using portable data carriers stored in this for forwarding to the accounting / account management system , the document not with the data carrier or its holder in Must be related.