Card holder data extraction

Abstract

Method and card reader (6) for extracting card holder data CHD from an integrated circuit card (4) ICC on a payment unit (2). The card reader (6) sends a request (S102) to obtain a file list of application identifiers, AIDs, stored in the ICC (4) of the payment unit (2), and checks (S106) whether a short file identifier, SFI, associated with the AID is stored in a memory (10) of the card reader (6). If the SFI stored in the memory (10) is not stored, a fetch process option (GPO) command is executed (S110) to extract the SFI stored in the memory (10) from the ICC (4). The card reader 6 then reads (S114) the CHD file according to the SFI and extracts a primary account number PAN. If the CHD has been stored, the card reader (6) reads (S114) the CHD file according to the SFI and directly extracts the PAN.

Description

Technical Field

[0001] The present application generally relates to the use of The card holder data (CHD) is extracted from the integrated circuit card (ICC) of the payment unit of the card technology. Background Art

[0002] In early 2000, Eurocard, Mastercard and Visa introduced the IC card standard, named after the founders of Eurocard, Mastercard and Visa. Standard. This standard is described in more detail in the "Specification for Integrated Circuit Cards for Payment Systems". This specification consists of four books, namely Book 1 "Application Independent ICC to Terminal Interface Requirements", Book 2 "Security and Key Management", Book 3 "Application Specifications" and Book 4 "Cardholder, Service Provider and Acquirer Interface Requirements", of which Books 2 and 3 are most relevant to this application. All books can be found on the website http: / / www.emvco.com. The purpose is to improve the security of payment cards.

[0003] according to Standard, the application in the card saves the CHD, including data such as the Primary Account Number (PAN). When a transaction is made, the payment terminal will select the data to be read and send the data back to the payment card for valuation and other processes. PAN and other more sensitive data will be sent to the payment terminal when the payment terminal sends a request, Get Processing Options (GPO), which is a command to execute a function in the ICC. When the GPO is executed, it increments the Application Transaction Counter (ATC) in the ICC of the payment card. The ATC value is included in the transaction sent to the acquiring host and is synchronized with the counter saved in the host. Acquirers and issuers do not allow the difference between ICC-ATC and host-ATC to be too large. If the difference exceeds a threshold, the card may be blocked so that it can no longer be used.

[0004] As the ICC on payment cards evolves, the payment cards themselves can be used for more functions. Currently, there are multiple discussions and projects in the industry where the use of ICC is not limited to payment, for example, it can be used for identification, for access systems that link payment cards to specific individuals by extracting data from the ICC (especially sensitive data such as PAN). As mentioned above, the extraction of sensitive data is done by executing GPOs, which triggers the increment of the ATC in the ICC as mentioned above. However, compared to transactions that are usually conducted online with the acquiring host, most of the time these non-payment functions of the payment card are performed offline. This results in the ATC in the ICC being incremented without synchronizing with the host ATC. If this is done once, there is no problem, but if the offline incrementation of the ATC is performed repeatedly, the difference between the ICC-ATC and the host-ITC will eventually exceed the threshold and the payment card will be blocked the next time it is synchronized with the host-ATC. This may happen, for example, when the payment card is used for access control in different buildings or rooms within a building, which may trigger the ATC multiple times before the payment card connects to the host and synchronizes online. This will cause the ICC card to be blocked, depending on the Standard, the host cannot handle this situation.

[0005] U.S. Patent 6,003,014 discloses an early attempt at a method of obtaining access rights using a smart card. The method uses a smart card to obtain access rights through an access device after paying a certain amount of money, and is performed by operably coupling the card to the access device. The access device reads a first set and a second set of data from the card and performs a first authentication process on the first set of data. If the first authentication process meets the required conditions, access is allowed. Otherwise, access is denied. If access is allowed, the second set of data is stored in the access device for further processing, including a second authentication process operating on the first set and the second set of data. Since the method does not use standard, so this method does not have the above-mentioned problems related to ATC.

[0006] U.S. Patent Application 2018 / 293,580 discloses a method and system for processing access requests to physical assets. The system includes: an access control terminal coupled to the physical asset and operable to read a token from a user token device associated with a user and generate a control signal to allow access to the physical asset; an access control processing server operable to receive an access request from the access control terminal, the access request including the token, generate an authentication request including the token, send the authentication request to a network, receive an authentication response from the network, generate an access control response so that the access control terminal allows access to the asset in response to the authentication response, and send the access control response to the access control processing server.

[0007] Therefore, there is a need to be able to extract CHD from the ICC of a payment unit without negatively impacting the ATC, to avoid the payment unit being blocked when the number of offline "transactions" reaches above a threshold before online synchronization with the host. Summary of the invention

[0008] The purpose of the present application is to implement a method and a card terminal for extracting CHD data from a payment unit ICC without negatively affecting the ATC.

[0009] According to one aspect of the present application, the object is achieved by a method for extracting CHD from an ICC card of a payment unit, the payment unit being based on a Eurocard MasterCard Visa card. In a standard configuration, the extraction of CHD is performed by a card reader including a processor and a memory and connected to an external database, and the method includes establishing wireless communication between the payment unit and the card reader, sending a request for a file list of an application identifier (AID) stored in an ICC card of the payment unit from the card reader, selecting an application from the file list of the AID received from the card reader in the card reader, and checking by the card reader whether a short file identifier (SFI) associated with the AID is stored in the memory or in the external database. If the SFI is stored in the memory or in the database, the SFI indexed by the AID is read from the memory or in the external database by the card reader, and the CHD file is read and the primary account number PAN is extracted according to the SFI by the card reader. If the SFI is not stored in the memory or in the external database, the following operations are performed: a Get Processing Option (GPO) command is executed from the card reader in the payment unit, and the SFI is extracted from the ICC by the payment unit, the extracted SFI indexed by the selected AID is stored in the memory and / or in the external database by the card reader, and the CHD file is read and the PAN is extracted according to the SFI.

[0010] In an exemplary embodiment, the payment unit may be a credit card, a payment card, a mobile phone, a smart phone, or an ID card, as long as the payment unit includes a payment method using Integrated Circuit Card ICC card technology.

[0011] The step of establishing wireless communication includes sending a command application protocol data unit (APDU) from the card reader to the payment unit when the payment unit is within a reading distance of the card reader, and receiving a response APDU from the payment unit in the card reader.

[0012] In another exemplary embodiment, the method further includes creating a token from the PAN that can be used by the card reader, the created token being used with the card reader as access control to the facility.

[0013] In an exemplary embodiment, the selected application is a default application.

[0014] In another exemplary embodiment, the wireless communication is established via near field communication (NFC).

[0015] According to another aspect of the present application, the object is achieved by a card reader for extracting cardholder data (CHD) from an integrated circuit card (ICC) on a payment unit, the card reader being based on a European card, a MasterCard, a Visa card, a In a standard configuration, the card reader includes a processor and a memory, and is connected to an external database, wherein the memory includes instructions, which, when executed by the processor, cause the card reader to establish wireless communication with the payment unit, send a request for a file list of an application identifier (AID) stored in an ICC of the payment unit, select an application from the received file list of the AID, and check whether a short file identifier (SFI) associated with the AID is stored in the memory or the external database. If the SFI is stored in the memory or the external database, the SFI indexed by the AID is read from the memory or the external database, and the CHD file is read and the primary account number (PAN) is extracted based on the SFI. If the SFI is not stored in the memory or the database, a Get Processing Option (GPO) command executed in the payment unit is generated, and the SFI is extracted from the ICC by the payment unit, the extracted SFI indexed by the selected AID is stored in the memory and / or the external database, and the CHD file is read and the PAN is extracted based on the SFI.

[0016] In an exemplary embodiment, when the payment unit is within a reading distance of the card reader, the card reader sends a command application protocol data unit (APDU) to the payment unit and receives a response APDU from the payment unit to establish wireless communication.

[0017] In another exemplary embodiment, the card reader is caused to create a token for the payment unit from the PAN, which is used with the card reader as access control to the facility.

[0018] In an exemplary embodiment, the card reader is caused to select a default application as the selected application.

[0019] In another exemplary embodiment, the card reader is enabled to establish wireless communication with near field communication (NFC).

[0020] The advantage of this application is that it can be used The existing infrastructure of card technology is expanded and the use of payment units is extended not only for payment but also for access control, identity recognition, etc., without blocking payment units due to repeated addition of ATC. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present application will now be described by way of example and with reference to the accompanying drawings, in which:

[0022] Figure 1 It is a schematic diagram of the relationship between the payment unit, the card reader and the external database.

[0023] Figure 2 is a flow chart illustrating a method according to the present application.

[0024] Figure 3 is a flow chart of the steps for establishing wireless communication between a payment unit and a card reader. DETAILED DESCRIPTION

[0025] The present application will be described in detail below. Figure 1 Schematic diagram of the relationship between the payment unit 2, the card reader 6 and the external database 12. The payment unit 2 includes Integrated circuit card ICC of card technology. The card reader 6 includes a processor 8 and a memory 10. The external database 12 can be set in the cloud 14 or in a server, located at the same location as the card reader 6 or at any other suitable location. The card reader 6 can communicate with the external database 12 wirelessly, or can be connected to the external database 12 by wire. The card reader 6 is configured to establish wireless communication with the payment unit 2 when the payment unit 2 is within the reading distance of the card reader 2. The reading distance may vary depending on the wireless technology used, but it is preferably to use Near Field Communication (NFC), which typically has a reading distance of about 0.1 meters.

[0026] In the context of this application, a payment unit may be a credit card, a payment card, a mobile phone, a smartphone or an ID card, as long as the payment unit includes a Integrated Circuit Card ICC card technology.

[0027] Now go to Figure 2 , a method for extracting CHD from ICC 4 on payment unit 2 according to the present application will be described. The standard configuration and extraction of CHD is performed by a card reader 6 comprising a processor 8 and a memory 10. The card reader 6 can also be connected to an external database 12.

[0028] The method starts when the payment unit 2 is within the reading distance of the card reader 6 (i.e., typically within a distance of 0.1 m). In a first step S100, wireless communication is established between the payment unit 2 and the card reader 6. In an exemplary embodiment, Figure 3As shown, this is achieved in the following manner: when the payment unit 2 is within the reading distance of the card reader 6, in step 100A the card reader 6 sends a command application protocol data unit (APDU) to the payment unit 2. In response, the payment unit 2 sends a response APDU, and in step S100B, the card reader 6 receives the response APDU.

[0029] Now, when wireless communication is established between the payment unit 2 and the card reader 6, in step S102, the card reader 6 sends a request for a file list of application identifiers (Application Identifier, AID) stored in the ICC 4 of the payment unit 2. The AID list identifies the applications that the terminal supports and conforms to the standard ISO / IEC 7816-4 when the payment unit 2 is used for payment. The data set contained in the ICC 4 for supporting a given application is defined by an Application Definition File (Application Definition File, ADF), which is selected by the terminal using a selection command and an Application File Locator (Application File Locator, AFL), which is returned by the ICC in response to a Get Processing Options (Get Processing Options, GPO) command, which will be further described below. Among the applications stored in the ICC 4, there is usually a default application, which the terminal will use as long as the terminal does not request a special application. These applications contain data that can be used to identify the holder of the payment unit, such as the Primary Account Number (PAN).

[0030] After the card reader 6 receives the file list of the AID, in step S104, the card reader 6 selects an application from the file list of the AID, and checks the AID in step S106 to see whether the short file identifier (SFI) associated with the AID is stored in the memory 10 or the external database 12. If the SFI is already stored in the memory 10 or the external database 12, then in step S108, the card reader 6 reads the SFI indexed by the AID from the memory 10 or the external database 12. The SFI is used to identify the application elementary files (AEF) containing the data object.

[0031] Thereafter, in step S114, the card reader 6 will read the CHD file according to the SFI and extract the PAN. The PAN can then be used to identify the holder of the payment unit 2 in another application, for example, to allow access to a building or to associate a ticket, passport or other identity card with the payment unit 2.

[0032] If it is checked in step S106 that the SFI associated with the AID is not stored in the memory 10 or the external database 12, the card reader 6 needs to retrieve the SFI. Therefore, in step S110, the payment unit 2 executes the GPO command sent from the card reader 6 and extracts the SFI from the ICC 4. In step S112, the extracted SFI is stored in the memory 10 and / or the external database 12, indexed by the selected AID. Thereafter, in step S114, the CHD file is read according to the SFI and the PAN is extracted.

[0033] By using the above method, it is possible to repeatedly extract CHD but increment ATC only once, because the method always checks whether the SFI associated with the AID is already stored and only executes the GPO if the SFI is not already stored. This will thus extend the use of the payment unit not only to payment but also to access control, identification, etc., without the need to repeatedly increment ATC, which would cause the payment unit to be blocked.

[0034] In an exemplary embodiment of the present application, the method may further include: in step S116, creating a token from the PAN available to the card reader 6. In a further step S118, the created token may be used together with the card reader 6 as access control to the facility.

[0035] In another preferred embodiment of the present application, in step S104 , the selected application may be a default application in the AID file list received in the card reader 6 .

[0036] Preferably, the wireless communication between the card reader 6 and the payment unit 2 is established via Near Field Communication (NFC), but other equivalent technologies such as RFID, Bluetooth, etc. may of course also be used.

[0037] The present application also relates to a card reader 6 for executing the above method. Figure 1 , in order to avoid unnecessary repetition, the card reader 6 will be briefly described.

[0038] The card reader 6 is used to extract CHD from the ICC 4 on the payment unit, which is based on EurocardMastercardVisa, Standard configuration. The card reader 6 includes a processor 8 and a memory 10, and is connected to an external database 12. The memory 10 of the card reader 6 includes instructions, and when the processor 8 executes these instructions, the card reader 6 performs the following steps:

[0039] - establish wireless communication with the payment unit 2,

[0040] - Send a request for a list of application identifiers (AID) files stored in the ICC of the payment unit 2,

[0041] - Select an application from the list of received AID files,

[0042] - checking whether a short file identifier (SFI) associated with the AID is stored in the memory 10 or in an external database 12,

[0043] If storing:

[0044] - read the SFI indexed by the AID from the memory 10 or the external database 12, and

[0045] - Read CHD file according to SFI and extract Primary Account Number (PAN),

[0046] If there is no storage:

[0047] - executing in the payment unit 2 a Get Processing Options (GPO) command generated in the card reader 6 and extracting the Short File Identifier (SFI) from the ICC 4,

[0048] - storing the extracted SFI indexed by the selected AID in the memory 10 and / or in the external database 12, and

[0049] - Read CHD file according to SFI and extract PAN.

[0050] In an exemplary embodiment, the card reader 6 also performs the above combined Figure 2 and Figure 3 All further method steps are described.

[0051] Although the above description contains multiple specificities, these specificities should not be interpreted as limiting the scope of the concepts described herein, but should only provide an illustration of some exemplary embodiments of the concepts. It should be understood that the scope of the current concept fully encompasses other embodiments that may be understood by those skilled in the art, and therefore the scope of the current concept should not be limited. Unless explicitly stated, references to singular elements do not mean "one and only one", but "one or more". All structural and functional equivalents of the elements of the above-mentioned embodiments known to those skilled in the art are expressly incorporated herein and are intended to be covered by this article. In the exemplary figure, the dotted line generally indicates that the features within the dotted line are optional.

Claims

1. A method for extracting cardholder data (CHD) from an integrated circuit card (ICC, 4) on a payment unit (2), wherein the payment unit (2) is configured in accordance with Eurocard MasterCard Visa In a standard configuration, the extraction of the cardholder data (CHD) is performed by a card reader (6), the card reader (6) comprises a processor (8) and a memory (10), the card reader (6) is connected to an external database (12), and the method comprises: - establishing (S100) wireless communication between the payment unit (2) and the card reader (6), - sending (S102) from the card reader (6) a request for a file list of application identifiers (AIDs) stored in the integrated circuit card (ICC, 4) of the payment unit (2), - in the card reader (6), selecting (S104) an application from a file list of the application identifier (AID) received in the card reader (6), - checking (S106) by means of the card reader (6) whether a short file identifier (SFI) associated with the application identifier (AID) is stored in the memory (10) or in the external database (12), If the short file identifier (SFI) is stored in the memory (10) or in the external database (12): - reading (S108) the short file identifier (SFI) indexed by the application identifier (AID) from the memory (10) or the external database (12) using the card reader (6), and - reading (S114) the cardholder data (CHD) file and extracting the primary account number (PAN) through the card reader (6) according to the short file identifier (SFI), If the short file identifier (SFI) is not stored in the memory (10) or the external database (12): - executing (S110) a Get Processing Options (GPO) command from the card reader (6) in the payment unit (2), and extracting the Short File Identifier (SFI) from the Integrated Circuit Card (ICC, 4) through the payment unit (2), - storing (S112) the extracted short file identifier (SFI) indexed by the application identifier (AID) in the memory (10) and / or the external database (12) through the card reader (6), and - Reading (S114) the cardholder data (CHD) file based on the short file identifier (SFI) and extracting the primary account number (PAN).

2. The method according to claim 1, wherein: The payment unit (2) is a credit card, a payment card, a mobile phone, a smart phone or an identity card including an integrated circuit card (ICC).

3. The method according to claim 1 or 2, wherein: The steps to establish wireless communication include: - when the payment unit (2) is within the reading distance of the card reader (6), sending (S100A) a command application protocol data unit (APDU) from the card reader (6) to the payment unit (2), and - Receiving (S100B) in the card reader (6) a response application protocol data unit (APDU) from the payment unit (2).

4. The method according to any one of claims 1 to 3, further comprising: A token usable with the card reader (6) is created (S116) from the primary account number (PAN).

5. The method according to claim 3, further comprising: - Using (S118) the created token and said card reader (6) as access control to the facility.

6. The method according to any one of claims 1 to 5, wherein: The selected application is the default application.

7. The method according to any one of claims 1 to 6, wherein: Establishing wireless communication is done via Near Field Communication (NFC).

8. A card reader (6) for extracting cardholder data (CHD) from an integrated circuit card (ICC, 4) on a payment unit (2), the payment unit (2) being configured in accordance with Eurocard MasterCard Visa The card reader (6) comprises a processor (8) and a memory (10) and is connected to an external database (12), wherein the memory comprises instructions which, when executed by the processor (8), cause the card reader (6) to: - establishing wireless communication with the payment unit (2), - sending a request for a file list of application identifiers (AIDs) stored in said integrated circuit card (ICC, 4) of said payment unit (2), - selecting an application from the received list of files of said application identifiers (AIDs), - checking whether a short file identifier (SFI) associated with the application identifier (AID) is stored in the memory (10) or in the external database (12), and if the short file identifier (SFI) is stored in the memory (10) or in the external database (12): - reading said short file identifier (SFI) indexed by said application identifier (AID) from said memory (10) or said external database (12), and - reading the Cardholder Data (CHD) file based on the Short File Identifier (SFI) and extracting the Primary Account Number (PAN), If the short file identifier (SFI) is not stored in the memory (10) or the external database (12): - generating a Get Processing Options (GPO) command executed in said payment unit (2) and extracting said Short File Identifier (SFI) from said Integrated Circuit Card (ICC, 4), - storing the extracted short file identifier (SFI) indexed by the application identifier (AID) in the memory (10) and / or the external database (12), and -Read the Cardholder Data (CHD) file based on the Short File Identifier (SFI) and extract the Primary Account Number (PAN).

9. The card reader (6) according to claim 8, wherein: The payment unit (2) is a credit card, a payment card, a mobile phone, a smart phone or an identity card including an integrated circuit card (ICC).

10. The card reader (6) according to claim 8 or 9, wherein: When the payment unit (2) is within the reading distance of the card reader (6), the card reader (6) is also configured to send a command application protocol data unit (APDU) to the payment unit (2) and receive a response application protocol data unit (APDU) from the payment unit (2) to establish wireless communication.

11. The card reader (6) according to any one of claims 8 to 10, wherein: The card reader (6) is also configured to create a token for the payment unit (2) from the primary account number (PAN).

12. The card reader (6) according to claim 11, wherein: The card reader (6) is also configured to use the created token as access control to the facility.

13. The card reader (6) according to any one of claims 8 to 12, wherein: The card reader (6) is also configured to select a default application as the selected application.

14. The card reader (6) according to any one of claims 8 to 13, wherein: The card reader (6) is also configured to establish wireless communication with near field communication (NFC).

Images