WO1999022334A1

WO1999022334A1 - System for safe communication without contact between a terminal and a portable object such as a chip card

Info

Publication number: WO1999022334A1
Application number: PCT/FR1998/002209
Authority: WO
Inventors: Roland Moreno
Original assignee: Roland Moreno
Priority date: 1997-10-24
Filing date: 1998-10-14
Publication date: 1999-05-06
Also published as: EP1048003A1; FR2770316A1; JP2002530726A; FR2770316B1

Abstract

The invention concerns a system wherein the terminal (100) and the card (200) comprise each an electromagnetic field and the card comprises a chip with processing circuits and a writeable store controlled by the terminal. The card comprises validating means, conditioning at least one data exchange step between terminal and card to an external predetermined action operated with said card by the card bearer, said validating means comprising, in the card, means for receiving light (204) co-operating with the digital processing electronic circuits and with the store.

Description

System for secure contactless communication between a terminal and a portable object such as a smart card

The invention relates to contactless communication between two remote organs such as a fixed terminal and an independent portable electronic object held by a user.

Such contactless data exchange systems (that is to say without galvanic contact) are well known and, among the applications of this technique, we find - without limitation: physical access control, by example for access to a protected room or to which access is restricted to certain persons who must first identify themselves; logical access control, for example to an IT function; data decryption, etc. ; as well as monetary transactions such as "electronic wallet" type applications, toll or payment applications, etc.

In this regard, although in the detailed description reference is often made to a payment transaction, this application is in no way limitative and the invention can be implemented for any application, involving an exchange of contactless information, such as than those just mentioned.

The user is provided with a portable object, for example of the "contactless card" or "contactless badge" type, which will hereinafter simply be called "card" - the term "card" being however chosen that for convenience and without any limiting character, the invention applies to any type of electronic portable object such as badge, ring, bracelet, key, pendant, etc. likely to exchange information with a contactless terminal (hereinafter "terminal") by bringing the card closer to the latter so as to allow non-galvanic coupling between these two members. The exchange of information following this coupling is operated by modulating an electromagnetic field which can either be a field where the electrical component is dominant (in the field of radio frequencies, microwaves or even light frequencies) or else in which the component magnetic is preponderant, the coupling then being operated by varying a magnetic field produced by 10th induction coil, technique known as the "induction process". The card used in the latter technique, whatever the process used, can be of the "active" type, that is to say comprising an incorporated power supply battery, or else "passive ¹ , c is to say remote powered by energy emitted by the terminal, in particular magnetic energy, which often makes the induction method prefer.

The invention aims to protect against a certain risk of fraud and malicious acts to which the type of contactless communication system by electromagnetic field could be exposed.

More specifically, this type of system is vulnerable to "electronic pickpocketing", where an "electronic pickpocket" fraudster approaches the card, without the knowledge of its holder, a counterfeit portable terminal to fraudulently establish a communication link with the card and, for example in the case of an electronic purse, improperly withdraw monetary units from the memory of the card.

Admittedly, in such applications, security is often provided by coding or encryption, but these security are often limited in their performance due to the large memory space that they require in the card and the extension of the communication times that they can lead.

It therefore appears necessary to provide means making it possible to prevent such fraud without the knowledge of the user.

Thus, the object of the invention is a contactless communication system between a card and a terminal which makes it possible to ensure excellent protection against the risks of "electronic pickpocketing".

In its most general aspect, the invention provides a system for contactless communication between a terminal and a portable object such as a card, the terminal and the card each comprising electromagnetic field transceiver means and the card comprising a chip with processing circuits and a memory writable on command from the terminal, characterized in that the card comprises validation means, conditioning at least one step of the exchange of data between terminal and card to a predetermined external action of confirmation exercised with this card by the holder of the card, these validation means comprising, in the card, light receiving means cooperating with the electronic digital processing circuits and with the memory.

The predetermined confirmation action may in particular be the exposure of the card to ambient lighting.

In a particular embodiment, the memory contains a data forming an indicator of activation or inhibition of the validation means indicating whether, respectively, said step of the data exchange must or not be conditioned to said predetermined external action of confirmation . This activation or inhibition indicator can be a predetermined static datum, possibly an irreversibly predetermined static datum, or else a datum which can be dynamically modified by a terminal during said data exchange. The conditional step of the data exchange can be the activation of the writing of the memory of the card, and / or the activation of the reading of this memory.

In an advantageous form of implementation, the exchange of data is conditioned upon the reception by the card of a light emitted by the terminal. In this case, the terminal preferably emits light with its own characteristic modulation, and the memory of the card contains modulation setpoint parameters, compared by the card to the actual parameters of modulation of the light received by the light receiving means. from the menu. The terminal can also emit light with characteristic information modulation, the card memory containing setpoint information compared by the card to the actual information conveyed by the modulated light received by the light receiving means of the card, this information deposit is preferably transmitted in encrypted form, the card then containing corresponding encryption / decryption means.

Still in the aforementioned advantageous embodiment, the light emitting and receiving means of the terminal can be located in the vicinity of each other, or else be located at a distance from each other, semi-reflecting means then being provided for make the directions of propagation of the emitted and received rays substantially confused, respectively, or else be located in the vicinity of each other in the radial direction relative to the directions of propagation of the rays emitted and received, and offset between them in the axial direction.

Preferably, the card comprises a monolithic chip integrating the light receiving means and the electronic circuits for digital processing and for the memory. This chip can in particular carry an integrated mask obscuring at least the circuits of the card memory, or the coating material of the card can have an orifice leaving visible the light receiving means and obscuring at least the memory circuits of the map.

In a particular embodiment, the card chip includes an electrically accessible input terminal for the conditional activation of memory writing and / or an electrically accessible output terminal delivering a signal following the predetermined external confirmation action exercised by the card holder and / or an electrically accessible input terminal receiving a signal representative of the predetermined external confirmation action exercised by the card holder. It is even possible to provide a coupling between the input terminal for the conditional activation of the writing of the memory and the output terminal delivering a signal following the predetermined external confirmation action, with interposition of encryption means / decryption, and or provide a specific metallization of the card chip connecting the input terminal for the conditional activation of the writing of the memory and the output terminal delivering a signal following the predetermined external confirmation action .

Finally, one of the important aspects of the invention consists in providing means for mutual recognition of the presence of the card by the terminal, and of the presence of the terminal by the card, the terminal comprising transmitting means and receiving means. electromagnetic field and light transmitting and receiving means, and the card comprising transmitting means and electromagnetic field receiving means and light receiving means. We will now describe various implementations of the invention, with reference to the accompanying drawings. Figure 1 is a general schematic view of the system of the invention.

Figure 2 illustrates more precisely the exchange of signals between card and terminal.

FIG. 3 is a flowchart explaining the course of the various steps of communication between card and terminal.

FIG. 4 illustrates an embodiment of the card chip. FIG. 5 is a first improvement of the embodiment of FIG. 4.

FIG. 6 is a second refinement of the embodiment of FIG. 4.

FIG. 7 shows the card provided with detection means of the magnetic anti-theft target type.

FIG. 8 shows the card provided with detection means of the coded magnetic target type. Figure 9 illustrates how the targets in Figure 8 are coded.

FIG. 10 shows the system with the terminal provided with detection means for detecting the card by occultation.

FIG. 11 shows the system with the terminal provided with telemetric means for detecting the card.

FIG. 12 is a timing diagram of various signals noted on the assembly of FIG. 11.

FIG. 13 shows a first configuration of the light transmitter-receiver means of the terminal. FIG. 14 shows a second configuration of the light transmitter-receiver means of the terminal.

FIG. 15 shows a third configuration of the light transmitter-receiver means of the terminal.

FIG. 16 is a view of a monolithic chip integrating the light receiving means. FIG. 17 shows a possible implantation of the chip of FIG. 18 in the system card.

FIG. 18 shows a card provided with light reflecting means. Figure 19 illustrates the mutual recognition implementation of the system of the invention.

FIG. 20 illustrates a control logic for a card with inhibition of reading and / or writing as a function of the presence of an external light. FIG. 21 is a variant of FIG. 20, allowing a conditional invalidation of the inhibitor circuit.

FIG. 22 is a variant of FIG. 20, allowing conditional acquisition of the instructions.

FIG. 23 schematically illustrates a means of automatic compensation for the operation of the circuit of the card according to the level of the external illumination.

FIG. 24 illustrates a particular configuration of embodiment of the photoelectric member of the card, seen from above.

FIG. 25 is a section along A-A in FIG. 24. FIG. 26 is a section along B-B in FIG. 24.

FIG. 27 illustrates another particular configuration of embodiment of the photoelectric member of the card, seen from above.

According to a first aspect of the invention, to avoid the risks of "electronic pickpocketing" it is provided that at least a critical part of the communication between the card and the terminal is made conditional on a voluntary action on the part of the user, more precisely a voluntary action captured by the detection of a light, the communication function being made conditional on the presence (or absence) of this detection of the light.

More precisely, the light detection being carried out in the card, the voluntary action consists in taking out the card to present it to the terminal; in this case, the card may include a light detector ambient, a photosensitive element such as a photodiode, a phototransistor or a photovoltaic element, for example.

In a preferred embodiment, which will be explained below in detail, the card combines a reflecting surface and a detector of a beam emitted by the terminal, the latter comprising a detector of the beam reflected by the card.

The card detector can then be used to revive the card (in standby mode with low consumption in the absence of the beam), while the encoding of the beam can incorporate informational content (a specific authorization code for example) to which the card is sensitive. The detection at the terminal of the reflected beam can also serve, as will be explained below, to increase the power of the electromagnetic field produced by the latter (or to trigger its emission), as will be described below. These various embodiments lend themselves to the automatic or semi-automatic triggering of the initialization of the transaction by the detection of the entry of the card in the zone of the field emitted or to be emitted by the terminal.

Another aspect of the invention, which can be combined with the previous one, aims to reduce or interrupt the electromagnetic field emissions in periods when full power is not required continuously, the emission of the electromagnetic field can be reactivated when a card is present or likely to appear. Not only do we reduce the risks inherent in electromagnetic field emissions, but we can also obtain energy consumption savings in field generation.

The terminal may include means for detecting the approach or the presence of a user in order to reactivate the emission of the field, with a different communication channel for initialization, on the one hand, and for remote control and / or data transmission, on the other hand.

In a preferred embodiment, in particular for computer or logical access control, but also for other applications, the detection means comprise an ambient light detector (a photoelectric cell for example) which is obscured by the 'ap- close to the card or the user's hand or wrist holding the card.

In another embodiment, more suited to physical access control, the detection means can include a light beam which crosses the access passage to a facing photocell, and which is interrupted by user approach.

Alternatively, the approach of the user can be detected by a weight detector (for example more than 20 kg) located under the access passage, for example. In yet another embodiment, the terminal can be reactivated when passage control means are released, when the door of a bus is opened, for example.

Instead of shutting down completely, the terminal can operate in a reduced field during the quiescent period, then reactivate at higher power for the exchange of data with the card.

In a preferred embodiment, a reflective surface is provided on the card and the emission by the terminal of a light beam (not necessarily in the wavelengths of visible light) whose reflection by the card is detected at terminal by a cell. In this embodiment, one frees oneself for the initialization of the need for remote supply even of a card which is not self-powered. In order to ensure a certain latitude in the angle of presentation of the card which guarantees that the reflection of the beam arrives at the cell on the terminal, the reflecting surface is preferably catalytic, that is to say at both reflective and refractive, for example in the form of a network of transparent or translucent prisms, or with retroreflective balls, reflecting the incident beam on a solid angle much wider than the angle of the beam itself.

We will now describe various specific embodiments of the invention, with reference to the accompanying drawings.

In these figures, the reference 100 generally designates the contactless terminal or TSC, and the reference 200 the contactless card or CSC, the term "card" used being, as stated above, of course in no way limiting. In FIG. 1, the terminal 100 is designed to emit a field electromagnetic 102, for example at 13.57 MHz, which allows the activation of a card 200, as well as a light beam 104 in the direction of the card. The card 200 captures the electromagnetic energy by means of a winding 202 of a circuit tuned to the frequency of the field 102, the energy necessary for its operation is extracted from this field for:

The establishment of the internal supply V _cc and the "cold reset" associated with the energization of the circuits of the card chip, and

- the starting of the microprocessor or the electronic circuits in the case of a chip of type "wired logic".

Immediately the contactless transaction begins: for example, for a contactless payment transaction, exchange of characters and orders preliminary to the transaction itself such as: date, serial and batch number, banking information, validated , etc.

Prior to payment, a photodetector element 204 is interrogated to detect the possible presence of the light beam 104 expected from the terminal; on the presence at its terminals of a predetermined electrical signal, the transaction is authorized to execute. If the signal is not observed under the conditions provided (for example, after m milliseconds or else iterations of a software loop) writing into memory is refused, possibly until the chip is switched off, that is to say until leaving the field. As the terminal does not receive confirmation of the expected entry from the card, it therefore refuses the transaction.

Thus, an "electronic pickpocket" provided with an antenna, for example a coil concealed in a glove and connected to a terminal simulator box carried in a pocket or in a bag, cannot effectively activate the card without the knowledge of the user: even if the electromagnetic field 102 is correctly emitted by the antenna of the pickpocket, and the card is consequently correctly supplied and initialized, the latter cannot, except the will of its holder, receive the necessary light beam to the completion of the transaction, and therefore of the writing and then the report which must be made at the terminal. - More precisely, as illustrated in FIG. 2, the photodetector element 204 is connected, via an amplifier and demodulator circuit 206, to an input 208 of the chip 210 itself connected, via the pads 212, to the antenna (winding) 202 , the whole being mounted on a card 200 carrying a photoreflective element 214 such as a retro-reflector, a cataphot, a strip of retroreflective adhesive, etc. It is thanks to this photoreflective means provided on the card that the ray 104 emitted by the terminal returns to the photodiode 106 of this same terminal, which causes the triggering, diagrammatically by the switch 108, of the emission of the electro field. - magnetic 102 necessary for the contactless transaction operation, this via circuits 110 of the terminal. At any time, thanks to gate ET 112, the electromagnetic field can be interrupted by one or the other of the two signals RADIUS RECEIVED = 'FALSE' (signal 114) or END OF TRANSACTION = TRUE '(signal 116). The flow diagram of FIG. 3 explains the operating sequence of the terminal-card system.

On reception of the electromagnetic field emitted by the terminal (step 300), the card extracts the energy necessary for its operation (establishment of the internal supply V_ _c , step 302), then to its initialization:

- automatic reset signal (step 304),

- starting the microprocessor or electronic circuits in the case of a wired logic type chip (step 306).

Immediately begins the contactless data exchange protocol (step 308): exchange of characters and preliminary commands to the transaction itself (date, batch number, validity, etc.).

From this moment the card can be debited by simply activating a write-in memory signal allowing the amount of the debit to be entered. In a preferred embodiment, a condition is imposed for the writing to take place in the card, namely the establishment of a "transaction authorized" bit (step 310), by means which will be explained below. with reference to FIG. 5. The waiting loop 312 allows that, in the movement of presenting the card to the terminal which lasts only a few fractions of a second, a position occurs. correct operation of the photodetector element 204 vis-à-vis the light ray 104 for a few milliseconds. Once the transaction has been authorized, the actual debit can then be written, of the amount x provided, for example 25 francs. After that, the continuation and the end of the payment process can be er (step 312) the card can in particular report to the terminal by a last message of the completion of a complete transaction.

It will be noted that, in the event that the card moves away from the terminal to the point of no longer being able to continue properly exchanging signals with the terminal, it immediately returns to its inert state prior to entry into communication and the progress of the 'flowchart of the figure is interrupted thereby, allowing the return to the initial state also on the terminal side.

FIG. 4 schematically illustrates an embodiment of the invention which does not require modification of the software for controlling the chip (in the case of a microprocessor card), nor of any pre-existing logical arrangement d '' a wired logic card. This is of great interest, in particular in the case of chips, the design of which is already fixed, in particular to meet international standards or other constraints weighing on the specific definition of a rapid payment system for example.

To do this, the chip 210 can be organized so that it has:

- a specific EEPROMWE * input authorizing writing to the EEPROM memory by application of a low signal 218 and,

- a specific output 0 ₂ 220 which produces a VRV * signal ("will received and verified") which becomes true (in the low state) after reception and verification of the signal implying the will of the user.

The other components shown are: - the coil 202, connected to the input I ^ and the output O _{j ^} of the chip,

The specific input I ₂ receiving by the conductor 221 the signal CV ("confirmation of will") detected by the photodiode,

A RAMWE * entry for writing to RAM which, in the present case, is connected by connection 222 to the ground potential so as to make it possible at any time to write counters to RAM, scales, registers, batteries, etc. On the other hand, the writing in EEPROM which, alone, allows a useful transaction, depends materially - and only materially - on the truth of the signal VRV * in 220, without it being necessary to modify in any way the arrangement internal, logical or software, of chip 210.

The only constraints associated with this variant embodiment are:

- isolate on the chip the general "wire" (metallization of the chip) for writing command in EEPROM, and - connect to it the stable output (itself coming from a register or a rocker) indicating the reception and verification of the signal providing an indication of the will of the user, possibly with the interposition of encryption / decryption means 224 to increase the intrinsic security of the information exchanged.

FIGS. 5 and 6 illustrate improvements of the mode of implementation which we have just described, by providing for additional discrimination operated by the card on the physical characteristics of the light ray emitted by the terminal (FIG. 5) and or informational content. conveyed by this same light ray (Figure 6).

In FIG. 5, the light ray 104, received by the photodetector 204 and amplified at 206, is applied to a demodulation and decoding circuit 226 capable of extracting information representative of the frequency F, of phase 0 and of the pattern or "pattern" P specific to the light emission 104. These parameters are compared with expected values stored in the memory 228 of the chip and applied to a reference input 230 of the circuit 226. The conformity of all these parameters is detected by gate 230 and transmitted via a flip-flop 232 to gate 234 which, by controlling the WRITE write input of memory 228, authorizes the recording therein of the amount x of the transaction. As a variant or in addition to this additional discrimination by the modulation characteristics of the light beam, characteristics preserved in the memory of the card to allow recognition, it is possible to discriminate on informational parameters transmitted by the modulated beam 104 and pro- close to the card (parity, predetermined characters, up to and including the card's own serial number, or even registration number or bank details, in particular in certain variants of electronic wallet). In the latter case, after demodulation and decoding by the circuit

206, a comparator 236 determines the conformity of the information received via the light beam (and therefore passed on by the terminal, the latter having itself received it from the memory of the card) with the number directly extracted from the memory 228, if necessary after decryption by circuit 238.

The arrangements that have just been described are particularly advantageous when there is a risk of "collision" between information transmitted and received by a plurality of cards simultaneously present in the field (radio or light) of the terminal. As a variant, the exploitation of the signal delivered by the photodetector element of the card can take place at the start of the process, after extraction of the power supply then reset to cold and before any emission by the card, that is to say say between steps 306 and 308 of the flowchart of Figure 3. In this way, no information from the card can be captured by anyone without a specific voluntary gesture has been made by the wearer of the card, namely taking the card out of its pocket or its wallet and placing it in the field of light radiation.

We will now describe, with reference to FIGS. 7 et seq., Various variants of the means making it possible to detect the presence of a card near the terminal and thus activate wisely the means for transmitting the electromagnetic field of the latter.

In the variant of FIG. 7, the card 200 includes a strip 248 made of ferromagnetic material, of the type used in stores as an anti-theft device for discs or books. This strip comprises a combination of metal alloys arranged so as to enter into resonance by detection of hysteresis with a field 118 emitted by the terminal 100, itself comprising electronic circuits oscillators and amplifiers 120 for the production of this field and detection circuits 122 of the same type as those used in the systems my locks. On positive detection of the presence at a short distance of a ferromagnetic strip 148, the main transmitter of the terminal is activated. On the contrary, in the absence of a strip - therefore in the absence of a card - the electronic control circuits inhibit the main transmitter of the terminal.

It is even possible to exploit the characteristics offered by the antenna 202 of the card, with the components which form the tuned circuit, to detect its presence according to a method comparable to that of the anti-theft rings: such a technique makes it possible to emit relatively low power from the terminal to be able to detect the presence of the tuned circuit included in the card.

In the variant of FIGS. 8 and 9, thin rings of ferromagnetic material (ferrite) with a thickness of approximately 0.1 mm are incorporated into the thickness of the card 200. In the figure five of these rings are shown, but this number is not limiting, and one can for example provide a number of the order of two to twenty. Before being embedded in the plastic, some of these rings (262 in Figure 9) are partially sectioned, others (264 in Figure 9) being left intact. This constitutes a coded combination of toroids, some of which have an open air gap and others a closed air gap with respect to a magnetic field emitted by a circuit 124 of the terminal 100 in the region of an insertion slot 126 receiving the card and comprising five specially arranged detectors.

On positive detection (presence of the correct code formed by the five rings) the main transmitter of the terminal is then activated. On the contrary, in the absence of the correct code (therefore in the absence of a card), the electronic control circuits inhibit the main transmitter of the terminal. Of course, the terminal and the entire system are arranged to take account of the losses caused in the form of eddy current in the metal rings 260.

In the embodiment of FIG. 10, the terminal 100 includes an orifice at the rear of which is mounted a photodetector 128, which allows the emission of the field 102 to be triggered via an electronic circuit 130 and a switch means 132. Through to a monostable scale 134, the darkness detected by the shutter of the photodetector by applying the card 200 to it triggers the main transmitter for the shortest possible duration, for example 200 ms.

FIGS. 11 and 12 illustrate a variant operating by telemetry, where a certain distance between the card and the terminal is required for the entry into operation of the main transmitter, so that the latter is not inadvertently triggered by cards which, for example more than 50 cm away, would not be able to communicate with the terminal anyway. It is possible to use a phototelemetry method in order to exploit only the maps that are as precisely as possible under the useful conditions, for example about twenty centimeters. To this end, the propagation time of the light ray between its starting point (light-emitting diode 136 of the terminal) and its end point (photodiode 138 of the terminal) is measured: - operation of a fast clock (for example 100 MHz ) 140 on the inputs 142 and 144 (corresponding respectively to the signals illustrated in FIG. 12) of an EXCLUSIVE OR gate 146, whose output signal 148 is also illustrated in FIG. 12;

- delay on entry 144 caused by the round-trip propagation time of the light beam (for a card located 10 cm from the terminal: 0.6 ns); at a very short distance, for example 1 mm, the output 148 of the gate 146 offers an almost flat signal, since the logically created pulses are of a duration much less than the reaction time of the circuitry, of the order of 6 ps; - on the contrary, a pulse duration (signal 148) of the order of 0.6 ns (for a total cycle of 10 ns) constitutes a measurable quantity with components of appropriate characteristics, in particular by integration: RC 150 circuit , 152 delivering a voltage V 154 inversely proportional to the distance between the card and the terminal (we must of course take into account the time constants of the circuit and of the components which influence the rise and fall times on the signals) ;

- alternatively, a monostable flip-flop 156 can be triggered by a 0.6 ns pulse creating itself on the Q output (in the case where the distance between card and terminal is greater than 20 cm) x pulse of duration, for example equal to 150 ms, is necessary for the automatic progress of the complete transaction. In the example of FIGS. 13 to 15, an assembly is provided on the terminal comprising one or more light emitters 158 cooperating with a plurality of photoreceptors 160 such as photodiodes or the like, assembled for example on a 1 cm module. Advantageously, the photodiodes are equipped with an optical system such as a lens making it possible to pick up from several angles the ray reflected by the card, so as not to require a presentation of the card in a positio which is too predetermined, which would be restrictive for the user. Advantageously, a particular optical system could comprise, as illustrated in FIG. 14, a plurality of semi-reflecting mirrors 162 inclined at 45 ° in the axis of the light-emitting diodes 164, the photoreceptors 166 being arranged perpendicular to the axis of the light emitters.

The configuration of FIG. 14 can, as a variant, be replaced by that of FIG. 15, the transceiver comprising a plurality of emitting diodes 168 and a photodiode 170 slightly depressed relative to the plane of the emitting diodes 168 (or the reverse) so as not to be dazzled by the light 172 produced by the latter, but receiving only the light energy 174 returned by the reflective material 266 of the card 200.

In the variant of FIGS. 16 and 17, a chip 268 is provided in the card comprising: - pads 270 intended for connection of the coil 202, as well as possibly pads 272 intended for connection to the various contacts (in the case a contactless contactless card), - one or more photodetector elements 274 such as photodiode or phototransistor, photovoltaic structure, etc., - a layer of opaque material 276, where an orifice 278 (FIG. 17) allows the passage of light towards the photodetector 274, while the other organs of the chip, and in particular the programmable, erasable or rewritable memories such as EPROMs or EEPROMs which can be sensitive to light radiation, are protected from light. In an alternative embodiment, a protective window can be arranged outside the semiconductor, so for example not to be hit. Thus, the coating 280 of the chip (in PVC, ABS, etc.) may include such an orifice 278, provided that the latter is machined and positioned with precision; the dimensions of the orifice are of the order of 0.1 or 0.01 mm depending on the fineness of etching of the assembly and the optical characteristics of the material and its machining.

As for the card 200, which is illustrated in FIG. 18, there is provided on the body thereof, preferably as close as possible to the chip, a photoreflective surface 214 such as cataphot, reflector or retroreflective adhesive tape. The light reflection function can also be obtained by special machining or treatment of the coating, including for example aluminum particles.

In FIG. 19, the operation of the system has been illustrated according to a "mutual recognition" mechanism exploiting the recognition characteristics specific to the combination of electromagnetic and photoelectric effects, such as:

- the terminal is only authorized to operate (to send) on recognition of the presence of a card, and - the card is only authorized to operate (to write in memory) on recognition of the presence of a terminal. This mechanism is broken down into three successive stages, which are either optical or electromagnetic in nature:

- optically, a terminal 100 recognizes a card 200 by emission of a light ray 176, reflection at 282 by the photoreflector

214 of the card 200, then reception by the photodetector 106 of the terminal,

- electromagnetically, the card and the terminal enter into dialogue, on the initiative of the terminal (transceivers on both sides), - optically, the card expects from the terminal an authorization signal 178, used by the semiconductor 210, which validates the dialogue and allows writing to memory.

More specifically, in this case where an optical approach detector (on the terminal) is combined with a voluntary action detector of the carrier ^~ (on the card), the successive communication steps are: following:

1) the terminal permanently emits a light beam (therefore without biological risk), possibly modulated,

2) when approaching a card, this light emission is passively reflected towards the terminal,

3) the terminal picks up the reflected ray, processes and decodes the recovered signal in order to eliminate the effects of ambient light, and the resulting signal gives an indication of the approach or presence of a user, 4) the terminal leaves its quiescent state and emits the main electromagnetic field, 5) the card receives the electromagnetic field, extracts the energy necessary for its internal power supply, demodulates the signal and activates the microprocessor as well as the integrated detection photodiode, 6) the microprocessor of the contactless dialogue card with the terminal then, before debiting the amount provided, interrogates the photodiode integrated in the card, which generates a logic signal after processing and decoding the current generated by the beam; on positive detection, the microprocessor of the card validates the payment authorization, proceeds to the recording in the memory of the card and continues or completes the transaction.

We will now describe with reference to FIGS. 20 to 27 a certain number of other particular embodiments, adapted to the card according to the invention, which incorporates photodetector means. It has indeed been indicated above that, to avoid the risks of "electronic pickpocketing", it is arranged so that at least part of the communication between the card and the terminal is made conditional on a voluntary action of the on the part of the user, this voluntary action being able to be captured by the detection of a light (the communication function being made conditional on the presence or absence of this detection of the light).

A card has also been described comprising for this purpose an ambient light detector with a photosensitive element (referenced 274 in the figures) such as a photodiode, a phototransistor or a photovoltaic element for example, the voluntary action consisting in removing the card to activate this ambient light detector.

In Figure 20, the photosensitive member 274 produces, after amplification and thresholding logic signal LUX which will allow (or not) the operation of the card due to the illumination of celle- _c above, illuminance, as indicated above, may be the result of only ambient light.

In other words, to authorize the transaction, the user just has to take the card out of his wallet and expose it to ambient light, this simple gesture authorizing the subsequent progress of the transaction.

_{1 π} transaction, for example writing a credit or debit in memory. It will be emphasized that, in this implementation with detection of ambient light by the card, it is possible to use conventional terminals, not provided with optoelectronic means; detection of ambient light by the card simply adds a level of se-

- _ additional security, card side, to authorize the continuation of the transaction by the latter with the terminal, the rest of the transaction taking place in itself conventional.

A bistable 300 controls a specific WRITE_INHIBIT input of the microcircuit 268 (cf. FIG. 16), which will prohibit writing into memory.

₂ ~ The state of the bistable 300 is controlled, on the one hand, by the LUX signal and, on the other hand, by various signals applied by a control logic 302, which is in fact a subset of the microcircuit 268) .

The flip-flop 300 is reset to zero by the initial positive pulse of general reset of the chip, shortly after the power up of

₂ _ the latter, itself consecutive to the reception of the electromagnetic field (and therefore energy) emitted by the terminal.

In the dark, the photodetector 274 generates on the input 304 of the door 306 a LUX signal in the low state. As soon as the initial reset pulse has fallen, the flip-flop 300 is thus positioned at T

_3Q on its output 308 (WRITE NHIBIT), prohibiting writing.

On the other hand, if the card is, for example, taken out of its case or from a wallet and presented in a light atmosphere, the WRTTE_INHIBΓΓ command becomes inactive, thus authorizing writing, at least for the duration of the transaction. _o _ Thus, the "electronic pickpocketing" operation consisting in approaching the target card a false portable terminal provided with an antenna adequate to start up unduly map in order to record a debit transaction is impossible as long as the card resi ^¬ in the darkness of a bag, a wallet, a purse, etc. The user is therefore guaranteed against this particularly pernicious risk of fraud.

In an implementation variant, it can be provided that this security is made optional, at the option of the manufacturer manufacturing the protected card. Indeed, for the needs of this or that customer, it may be desirable that this security can be systematically activated or deactivated at will at the stage of card manufacturing / personalization.

To this end, a particular location of the memory is assigned to an indicator determining this setpoint. This indicator, located at an address ADDRESS_PROTECT_WRITE (AD_PROT_W), is read on the DATA data output _. OUT of memory. Depending on whether this indicator bit is stored at the factory at '0' or '1', reading the memory will cause or not, during a transaction, the switching of the bistable 300, thus inhibiting, or not, the security provided by the optical detector described above. Another risk linked to the use of contactless smart cards is that of indiscretion or espionage, for example due to a malicious will to become aware, without the knowledge of its holder, of the content of his card (this type of risk does not exist, of course, with galvanic contact cards). This is why it may be desirable to also make the read command conditional, rather than the only write operation. To do this, according to the invention, the content of a specific address ADDRESS_PROTECT_READ (AD_PROT_R) is decoded, which may for example be adjacent to the address ADDRESS_PROTECT_WRITE. The card is then provided with a bistable 310, similar to the bistable 300 and capable of producing on its output 312 a READJNHIBIT signal conditioning the reading operation of the memory of the card microcircuit, in the same way as the WRITE signal. .INHIBIT conditioned the writing. It is also possible to provide an OR gate (not shown) activated by the two signals READJNHIBIT and WRITE_INHIBIT to generate a general inhibition signal, in read and write.

Thus, without expanding its range of products, the manufacturer can indifferently offer either a traditional contactless smart card, or the same card which is also secured against "night access", that is to say against reading attempts and / or writing in the dark. This, for the low cost of a few components (less than ten doors), as well as a specific treatment of the surface of the plastic and / or the integrated circuit (as described above with reference to FIGS. 16 and 17, and below in reference to Figures 24 to 27).

The implementation sequence can be expressed by the following succession of process steps.

Start General reset

AD = 0 WRITE JNHIBΓT = o

READJNHIBIT = 0

Reading DATA.OUT

IGNORE.WRITE = DATA_OUT (AD) IGNORE_READ = DATA_OUT (AD +1)

WRITEJNHIBΓT = (IGNORE _. WRITE) NOR (LUX) READJNHIBIT = (IGNORE_READ) NOR (LUX)

Continuation of the transaction

End

At the time of the general initialization of the chip, the indicators corresponding to the two possible inhibitions are set to zero (WRITE JNHIBIT = 0 and READJNHIBIT = 0) at the same time as the address counter (AD = 0). Two indicators IGNORE.WRITE and IGNORE _READ reflect the content of the corresponding addresses in the memory, respectively AD = 0 and AD = 1.

The reading of the two initial positions of the memory, given by the command "Reading DATA_OUT", provides by execution of a NOR function with the LUX state of the photodetector the status of the two inhibition commands WRITE JNHIBIT and READJNHIBIT.

FIG. 21 illustrates an alternative embodiment allowing a conditional invalidation of the inhibitor circuit, that is to say allowing in certain specific cases determined a "night operation" of the integrated circuit, that is to say allowing operation despite the no ambient light.

Thus, in the case of an identification or toll card for access to a controlled area, it is desirable that the holders of the card are identified and / or debited with a certain amount when they enter the zone, or at the start of the day. This transaction is carried out in a conventional manner with presentation of the card (therefore with exposure to ambient light) in front of a reader intended for this function.

However, it would be constraining to have to force the holders to take the card out of their pocket or their wallet during each of their subsequent passages, or at the exit of the zone, or during a certain authorized time of presence inside of the site, etc.

For this, according to another characteristic of the system of the invention, provision is made for a conditional invalidation of the protection device described above.

A specific address AD _INV_NOC contains a specific indicator assigned to this function which, in combination with a predetermined content of the memory, for example '1', will position a flip-flop 314 via a gate 316. The signal INV_NOC (Protection invalidation Nocturne) thus produced at the output of the bistable 314 is directed to an additional particular input 318 of the bistable 300 so as to position the signal WRITE JNHIBIT at '0', and this independently of the state of the LUX signal representative of the absence or the presence of light on the photosensitive element 274.

The operating mode will be as follows: when entering the site, the holder extracts the card from his wallet, from his pocket, from his handbag, ... so as to expose it to ambient light. The terminal com- mence by performing on the memory of the card the operations of reading, and possibly of writing, necessary to control access to the site. After which, the terminal writes to the address AD JNV4N0C the agreed value, so as to predetermine at 'TRUE', later, the parameter INV_NOC.

Thus, during its next passage in front of a terminal, the card will not need to be lit and may therefore remain in the pocket, provided that the operating distance (distance between card and terminal) allows. The write and / or reader operations will then take place unconditionally: indeed, as soon as it is switched on, and upon reception of the clock signal, the microcircuit will have addressed the position AD_INV_NOC and read its content (INV.NOC = T) . The terminal can execute all operations necessary for controlling the situation, in particular vis-à-vis the card, which it can usefully reset (or, more generally, update) the content of the address ADJNVJ * ïOC . FIG. 22 illustrates a particular embodiment allowing a conditional acquisition of the instructions. In this embodiment, the state of three variables is positioned as soon as the microcircuit is switched on (RESET): presence of light (LUX), IGNO-RE_WRITE setpoint and IGNORE_READ setpoint. The first two data are taken into account when addressing the memory to the zero address (AD = 0), and the last when going to the next address (AD = 1).

The AND gates 318 and 320 sample the output DOUT (O) corresponding to the content of the memory at address zero (AD = 0). The bistables 322 and 324 keep this instruction for the time of a transaction. The AND gate 326 samples the content DOUT (1) of the memory when passing to the address AD = 1, and the bistable 328 which keeps this instruction for the time of the transaction. Finally, NOR gates 330 and 332 provide the WRITE JNHIBIT and READ JNHIBIT inhibition signals. FIGS. 23 to 27 illustrate particular technological aspects which are advantageous for producing a card incorporating photodetector means of the type illustrated in FIGS. 16 and 17.

FIG. 23 thus illustrates an automatic compensation circuit for the supply of the microcircuit 268 as a function of the possible level of illumination, in order to avoid risks of mid-malfunctions. crocircuit by parasitic illumination of the components. This parasitic phenomenon could moreover be exploited maliciously by a fraudster who wishes to override the security incorporated in the card by deliberately creating malfunctions so as to cause 5 untimely opening of doors, positioning of flip-flops in a state different from that predicted by logic equations, etc., all phenomena likely to occur when the card is caused to operate outside the nominal conditions provided.

With the compensation circuit of FIG. 23, the signal coming from the photodetector 274, suitably processed by the specific amplifier 334, ensures the control of the general supply of the microcircuit 268 (or, at least, of the most vulnerable to its organs) via a programmable regulation circuit 336 placed on the _DC supply line. Independently of this control exerted on the power supply, a corrective action can be exerted on a specific polarization input 338 of the microcircuit, capable of intervening on the gain or the threshold of the sensitive stages.

Another protection which it is important to implement consists in guiding the incoming light towards the target point (sensitive photodetector zone of the microcircuit) by avoiding the illumination of the other components.

Thus, in FIGS. 24 to 26, the photosensitive zone 340 extends along one of the sides of the chip 268, and the light arrives via an orifice 342 formed through the substrate 344, the light therefore penetrating, 5 as illustrated at 346 in FIG. 25, on the side of the substrate 344 opposite to that where the chip of the microcircuit 268 is located.

To guide the light towards the only photosensitive zone 340, the reflective nature of the metal wires intended for the connection socket ("bonding") of the chip 268 is exploited. For this purpose, one of the wires 348 is formed before welding with a section U (see in particular Figure 26) giving it an inverted gutter shape, the hollow part 350 being turned towards the photosensitive surface 340 of the microcircuit chip 268. Once the wire is soldered on the connection pad 350, its camber (visible in particular FIG. 25) allows it to behave like a specific light pipe, the latter arriving via the orifice 342 and being guided led by the wire to the only photosensitive zone 340.

In another alternative embodiment, illustrated in FIG. 27, with the aim of preventing any light ray from reaching the surface of the microcircuit carrying the various logic components (components located on the side referenced 352 in FIG. 27) , there is the photodetector member 274, here in the form of an attached component, next to the microcircuit chip 268, but vertically turned over, that is to say with its sensitive surface turned in the opposite direction to that of the surface 352. To this end, use is made of the possibility offered when mounting the microcircuit on a chip card "micromodule" consisting of a printed circuit in the form of a very thin substrate 344. Adequate tracks such as 354 are provided on the substrate 344 of the micromodule so as to be able to connect by welding the pads 356 of the photosensitive component 274 and the pads 358 of the inverted microcircuit 268.

Claims

1. A system for contactless communication between a terminal (100) and xm portable object such as a card (200), the terminal and the card each comprising electromagnetic field transceiver means and the card comprising a chip ( 210) with processing circuits and a memory (228) writable on command from the terminal, characterized in that the card includes validation means, conditioning at least one step of data exchange between terminal and card to a predetermined external confirmation action exerted with this card by the card holder, these validation means comprising, in the card, light receiving means cooperating with the electronic digital processing circuits and with the memory.

2. The system of claim 1, wherein the predetermined confirmation action is the exposure of the card to ambient light.

3. The system of claim 1, in which the memory contains data forming an indicator of activation or inhibition of the validation means indicating whether, respectively, said step of the data exchange must or not be conditioned to said action. external predefined confirmation.

4. The system of claim 3, wherein the activation or inhibition indicator is a predetermined static datum.

5. The system of claim 4, wherein the static data is irreversibly predetermined.

6. The system of claim 3, wherein the activation or inhibition indicatexir is a data modifiable dynamically by a terminal during said data exchange.

7. The system of claim 1, wherein the conditional step of the data exchange is the activation of the writing of the memory of the card.

8. The system of claim 1, wherein the conditional step the exchange of data is the activation of the reading of the memory of the card.

9. The system of claim 1, wherein said data exchange is conditioned upon the reception by the card of a light emitted by the terminal.

10. The system of claim 9, in which the terminal emits light with a characteristic own modulation, and the memory of the card contains modulation setpoint parameters, compared by the card to the effective parameters of modulation of the light received by the light receiving means of the card.

11. The system of claim 9, in which the terminal emits light with a characteristic information modulation, and the memory of the card contains setpoint information compared by the card with the actual information conveyed by the modulated light received by the light receiving means of the card.

12. The system of claim 11, wherein said setpoint information is transmitted in encrypted form, and the card contains corresponding encryptionVdecryption means.

13. The system of claim 9, wherein the terminal comprises light emitting (158) and receiving (160) means located in the vicinity of each other.

14. The system of claim 9, in which the terminal comprises light emitting (158) and receiving (160) means located at a distance from each other, as well as semi-reflecting means (162) to make the directions of propagation of the emitted and received rays substantially confused, respectively.

15. The system of claim 9, in which the terminal comprises light emitting (158) and receiving (160) means located in the vicinity of each other in a radial direction relative to the directions of propagation of the rays emitted and received, and offset between them in the axial direction.

16. The system of claim 1, wherein the card comprises a monolithic chip (268) integrating the light receiving means (274) and the electronic circuits for digital processing and for memory.

17. The system of claim 16, wherein the chip (268) carries an integrated mask (276) obscuring at least the circuits of the memory of the card.

18. The system of claim 16, wherein the coating material (280) of the card has xm orifice (278) leaving visible the light receiving means and obscuring at least the circuits of the memory of the card.

19. The system of claim 1, in which the card chip includes an electrically accessible input terminal (EEPROMWE *) for the conditional activation of the writing of the memory.

20. The system of claim 1, in which the card chip includes an electrically accessible output terminal (0 ₂ ) devUvant a signal (VRV *) sxήte to the predetermined external confirmation action exerted by the card holder .

21. The system of claim 1, wherein the card chip comprises an electrically accessible input terminal d ₂ ) receiving a signal (CV) representative of the predetermined external confirmation action exercised by the card holder.

22. The system of claims 19 and 21 taken in combination, comprising a coupling between the input terminal for the conditional activation of memory rewriting and the output terminal delivering a anxiety signal to the predetermined external confirmation action, with interposition of encryption / decryption means (224).

23. The system of claims 19 and 21 taken in combination, comprising a specific metallization of the card chip connecting the input terminal for the conditional activation of memory writing and the output terminal delivering a continued signal to the predetermined external confirmation action.

24. The system of claim 1, in which means are provided for mutual recognition of the presence of the card by the terminal, and of the presence of the terminal by the card, the terminal comprising transmitter means and receiver means of electromagnetic field and light transmitting and receiving means, and the card comprising transmitting means and receiving electromagnetic field means and light receiving means.