GB2571308A

GB2571308A - Security of contactless cards

Info

Publication number: GB2571308A
Application number: GB1802951.2A
Authority: GB
Inventors: Meers Jason
Original assignee: Equinox Card Ltd
Current assignee: Equinox Card Ltd
Priority date: 2018-02-23
Filing date: 2018-02-23
Publication date: 2019-08-28
Anticipated expiration: 2038-02-23
Also published as: GB2571308B; GB201802951D0

Abstract

A contactless card 50 having a memory for storing card data and a contactless interface for supplying the card data from the memory to a remote reader. The card is provided with a user operable switch 52, 54 having two modes of operation. In the first mode, supply of the card data through the contactless interface is disabled. In the second mode, supply of the card data through the contactless interface is enabled. The card defaults to the first mode and is placed in the second mode by user actuation of the switch. Following placement in the second mode, the card returns to the first mode after expiry of a predetermined period. The return to the first mode after supplying card data may be immediate. The card may be driven by power harvested from an electromagnetic field used to interrogate the device. The card data may comprise an instruction to raise a value limit on a financial transaction. The contactless card may be a payment card or an access management card, e.g. a hotel room key, an identity card or a access card for e.g. public transport or bicycle rental.

Description

SECURITY OF CONTACTLESS CARDS

The present invention is concerned with contactless cards and with security measures implemented in such devices.

The term contactless as used herein in relation to a card or other form of electronic tag implies that data carried by the card is able to be read through a wireless interface. Known contactless cards may be interrogated through close proximity inductive coupling and/or through propagating electromagnetic waves, and the term contactless card must be understood to encompass, without limitation, both or either of these possibilities. Protocols used for transmission of data in this context at the time of writing include the near-field communication (NFC) protocol and other protocols applied in relation to radio-frequency identification (RFID) but the term contactless does not - as used herein - refer to any specific communications protocol. Some contactless cards do have electrical contacts which provide an alternative means of reading data from the card. At the time of writing contactless payment cards commonly have two interfaces - a contactless interface and a set of contacts for making a direct electrical connection to a reader. These are nonetheless contactless in the relevant sense that data carried by the card is able to be read through a wireless interface.

Contactless cards are widely used for a variety of purposes. Importantly, many payment cards issued by banks, credit card companies and other financial institutions have a contactless interface for use at a point of sale, for purposes including authorisation of the transfer of funds. This is highly convenient for the purchaser, who can effect payment merely by presenting a card to a reader at the point of sale. Other applications of contactless cards include:

access management, where access barriers such as turnstiles or doors have a reader and a user is required to present a suitable card to obtain access. Hotel room keys provide one example;

verification of identity, where a bearer of a contactless card is taken to be the person identified by data on the card;

verification of attendance - some institutions of learning, for example, use contactless cards to verify students' attendance at lessons, seminars etc.;

access to resources, such as public transport, bike rentals etc.

This is far from being an exhaustive list.

It will be apparent that if a malfeasor is able to obtain unauthorised access to data from a contactless card, that data may be put to a variety of illegitimate uses. In the case of payment cards, this misappropriated data may be used to steal money from a financial account. A cloned hotel key card bearing the misappropriated data may be used for a burglary. The malfeasor may use such data to access confidential data intended for the bearer of the card, and so on.

Whereas contact-based interfaces can be interrogated only if access is available to the card itself, contactless cards suffer from the fundamental vulnerability that they can be interrogated remotely. Hence subject to whatever security precautions are taken, there is the possibility of a malfeasor reading the card without having direct physical access to it. An individual with a suitable reader may for example collect card data in a public place from passers-by.

Barring the use of suitable security measures, the technical and practical barriers to this type of abuse are not large. Cards' wireless interfaces typically conform to publicly available standards. The ISO/IEC 7816 standard which is widely adopted in relation to payment cards at the time of writing is also implemented for example in door-entry systems, car park barriers, hotel room locks, gymnasia, electricity and gas meters. The know-how required to interrogate cards using these standards is widely available, as is the hardware. One existing range of card chips and readers is sold at the time of writing under the trade mark MIFARE, owned by NXP Semiconductors, who state that 150 million readers have been sold. The contactless cards issued by financial institutions to make transactions do have a slightly different level of security from the cards used in hotels and transport networks, requiring additional vendor specific steps to translate received data into human readable form, but the additional security provided thereby is minimal. The information needed to extract customer and account information from a contactless payment card can be found in the public EMV standard which was originally developed by Mastercard (RTM) and Visa (RTM) in the early nineties.

Devices exist within the criminal fraternity that can harvest data from contactless payment cards at a rate of approximately 15 cards per second, and that remain undetectable by the typical card holder. But specialist equipment is not required. Many modern smartphones and tablets contain RFID/NFC readers, so that a standard device with a suitable application can be used to collect data from contactless cards. Applications can even be downloaded from mainstream app stores that are capable of reading data from contactless cards.

As to the range over which information can be misappropriated, a typical payment card operating in the 13.56 MHz range needs to be placed within a few centimetres of a legitimate reader for data to be exchanged. But it is also possible to read these cards from over a metre away with the correct equipment, and from a much larger distance using a specialised antenna and related circuitry.

So for example where contactless cards are carried in public by users in coat pockets, trouser pockets or non-shielded wallets and purses there is a risk that data from the cards may be misappropriated. Fraudsters may use handheld readers for the purpose in crowded areas such as lifts (elevators), escalators, turnstiles, public transport and so on.

Another potential danger is that malware running on a user's own smartphone or tablet may be used to read that user's card and transmit its data to a malfeasor. A user's card and their mobile device may often be juxtaposed, e.g. because the user puts both in a pocket or handbag. The malware is thus able to use the mobile device's NFC/RFID interface to read the card, and its mobile (cellular) or WiFi data transmission capability to transmit the data to a malfeasor. Malware which propagates widely can in this way be used to obtain large volumes of card data without those responsible being in geographical proximity to the victims.

Fraud in relation to contactless cards is a real and current source of concern to consumers and to institutions using the technology.

Various security measures are available in this context.

One precaution that the user can take is to provide the card with a shield which blocks the signals used to exchange data. The card is placed in the shield when not in use and is intended to be removed from it only for use, e.g. at a point of sale. The shield may take the form of a sleeve to receive and surround the card. An electrically conductive layer can provide shielding, functioning in the manner of a Faraday cage. Wallets and purses claimed to screen radio frequency transmissions are commercially available. Shields provide an incomplete solution however. From the point of view of the institution issuing the card, the fact that not all users have adopted use of shields leaves them at risk. From the point of view of the end user, to be effective, a shield relies on that user manually taking the card out of the shield for use, and then returning it to the shield after use. This is potentially inconvenient for the user and there is the possibility that the card will not be returned to the shield after use, leaving it vulnerable.

US2013015955A (Verizon Patent and Licensing Inc. et al) discloses an RFID tag which may take the form of a credit card and which has a switch which is actuable by a user to change the tag from a first state in which it is not able to be activated by a carrier signal and a second state in which it is able to be activated by the carrier signal. In this way the card is disabled unless the user activates it by means of the switch. Other patent cases disclosing tags or cards whose interface is able to be activated using a switch are WO11067428A1 (Servicios Para Medios De Pago etal), US2003132301A (Massachusetts Institute of Technology), US2008011859A (Simon Phillips), US2006266831 (Douglas Kozlay), US8052052B (Intuit Inc.) and US7994920B (International Business Machines). In all these examples the card is reversibly activated/deactivated by some transient user input such as the application/withdrawal of a fingertip. Such devices add considerably to the complexity and cost of the card.

According to the present invention there is a contactless card comprising a memory for storing a data set, a contactless interface for supplying data from the memory to a remote reader, and a user operable switch, the device having two modes of operation:

a first mode in which supply of data from the data set through the contactless interface is disabled; and a second mode in which supply of data from the data set through the contactless interface is enabled, and being configured to default to the second mode and to be placed in the second mode by user actuation of the switch, the card being configured, following placement in the second mode, return to the first mode after expiry of a predetermined period.

Specific embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:Figure 1 depicts the exterior of a typical contactless payment card, viewed from the front;

Figure 2 represents depicts the exterior of the same card, viewed from the rear;

Figure 3 is a simplified depiction of an interaction between a contactless payment card and a reader used to interrogate the card;

Figure 4 is a highly schematic representation of an electronic circuit implemented on the card;

Figure 5 shows front and rear views of a contactless payment card embodying the present invention; and

Figure 6 is a partially sectional view of the Figure 5 card, being gripped by a user.

Figures 1 and 2 depict a conventional contactless payment card 10 conforming to industry standards ISO/IEC 7816 and ISO/IEC 14443. The card carries visual data including an embossed 16 digit card number 12. Other human-readable visual data printed on a typical card is omitted for the sake of simplicity. This example card 10 is able to be electronically interrogated through any of three different devices:

a contact chip 14 having multiple exposed electrical contacts conforming to the EMV standard, often referred to by the names Chip and Pin or Chip and Signature, according to the method of authentication employed by the card issuer. To use this interface the card is normally inserted into a reader which makes physical connections to the contacts to interrogate the contact chip;

a contactless interface housed within the card, whose components are formed by an inner layer of the card not visible from its exterior and whose presence is indicated by a logo 16 on the card; and a magnetic strip 18 on the rear of the card, which is provided for the sake of backwards compatibility, being used in older point of sale devices.

The rear of the card also carries visible alphanumeric characters 19 representing a CVV or CVV2 code, which is used in some online and telephone transactions, and a signature strip 21.

In a contactless interaction the card 10 is read by a remote reader 20 (Figure 3) which may for example be a point of sale device used to authorise a financial transaction. The reader need not be in physical contact with the card 10. The reader 20 interrogates the card through an interrogating electromagnetic field 22. In response the card 10 transmits data to the reader 20 through a suitably modulated data transmission electromagnetic field 24.

Figure 4 is a highly simplified representation of the architecture of the electronics of the card 10 as they pertain to exchange of data through the contactless interface. This is presented by way of example and not limitation. Other architectures may be adopted in embodiments of the present invention. The card 10 has a contactless interface comprising an antenna 26, which is depicted in this example as an inductive element, and associated interface electronics 28. The card 10 is in this example of the passive type which runs on power harvested through the antenna 26 from the interrogating electromagnetic field 22 generated by the reader 20. The invention may however be implemented in active cards having an on-board power supply. The interface electronics 28 comprise a voltage regulator through which power received from the interrogating electromagnetic field 22 is supplied to the card's other circuitry, and an RF modulator/demodulator function. The technical implementation of these functions is known in the art and familiar to the skilled person.

Figure 4 is wholly schematic and does not purport to represent the physical layout of the relevant components. In a practical implementation the antenna 26 is typically formed as a conductive loop extending repeatedly around the card close to its perimeter.

In the present example the card 10 further comprises a processing unit 30 and associated memory 32, which may, without limitation, comprise read only memory, non-volatile random access memory and/or EEPROM (electrically erasable programmable read only memory). The memory 32 stores, among other items, a data set which the card 10 is able to transmit to the reader 20 through the contactless interface 26, 28. In the case of a payment card, this data set includes in particular the identity and security information needed for authorisation of a financial transaction. In this case its transmission to malfeasors would pose a security risk to the user. The data set typically includes data which is written to the card before its delivery to the end user.

Figure 5 depicts a contactless card 50 which embodies the present invention, which has in the present embodiment the features of appearance, architecture and function described above with reference to Figures 1 to 4, and which additionally comprises a user-actuable switch 52. The switch may be of a mechanical type, having two contacts which are brought into contact by applied pressure, or may be a capacitive type, being sensitive to the local change of dielectric permittivity provided by the presence of e.g. a fingertip, or may be a piezoelectric device e.g. a piezoelectric film or button, or may be a pressure sensitive switch, or may take any other suitable form. The switch 52 is provided on a face of the contactless card 50. It may be provided only on one face of the contactless card 50. But in the embodiment depicted the switch comprises components 52, 54 on both the front and rear faces of the contactless card 50, so that actuation of the switch (i.e. changing its state) involves applying a finger/thumb tip concurrently to each, which can be done easily by gripping the contactless card 50 between thumb and finger, as depicted in Figure 6.

The contactless card 50 defaults to a first state in which the transmission of at least selected card data through the contactless interface 26, 28 is prevented. Actuation of the switch 52 changes the contactless card 50 to a second state in which transmission of the relevant data through the contactless interface is enabled. But the card remains in the second state only until:

(a) a predetermined period elapses after placement of the contactless card 50 in the second mode; or (b) a read of the contactless card 50 takes place.

In this way it is ensured that supply of the card data is normally inhibited. A malfeasor who attempts, while for example the contactless card 50 is being carried in a pocket or purse, to read the card remotely will therefore not be able to obtain the card data.

To make a transaction, the user will typically present the contactless card 50 to reader 20 whilst actuating the switch 52. The contactless card 50 is powered by the interrogating field 22 and adopts the second mode of operation due to the actuation of the switch 52, making it possible for the card to supply the card data to the reader 20, to facilitate the transaction.

There could potentially be an opportunity for a malfeasor to read the card data from the contactless card 50 while the card is in the second mode, in the course of the transaction. But any such opportunity is minimised because the card 50 is configured to return to the first mode as soon as it has been read. Any risk of the card 50 being placed in the second mode for a protracted period, e.g. due to inadvertent actuation of the switch 52, is avoided because the card returns to the first state after the said predetermined period, which may be of the order of 10 seconds. The return of the card to its first state takes place even if the user continues to actuate the switch 52.

If the user ceases to actuate the switch 52 during the predetermined period, the card may return without delay to the first state. Alternatively it may remain in the first state until the predetermined period expires.

In some embodiments supply of any data through the contactless interface 26, 28 is disabled in the first mode. In other embodiments the contactless card 50 is able to supply certain information whilst in the first mode, and additionally to supply the selected card data whilst in the second mode. In one such embodiment the selected card data serves to enable financial transactions above a default limit. So in this embodiment the switch 52 serves to create a time limited window for making a transaction above the default limit. The user can make transactions below the limit without making use of the switch 52, and can make larger transactions by actuating the switch whilst presenting the contactless card 50.

The above described embodiments serve as examples only of the manner in which the present invention can be implemented. Numerous possible variants and alternatives will be apparent to the skilled reader.

Claims

1. A contactless card comprising a memory for storing card data, a contactless interface for supplying the card data from the memory to a remote reader, and a user operable switch, the device having two modes of operation:

a first mode in which supply of the card data through the contactless interface is disabled; and a second mode in which supply of the card data through the contactless interface is enabled, and being configured to default to the first mode and to be placed in the second mode by user actuation of the switch, the card being configured, following placement in the second mode, to return to the first mode after expiry of a predetermined period.

2. A contactless card as claimed in claim 1 which is configured to return to the first mode after supplying the card data.

3. A contactless card as claimed in claim 2 in which the return to the first mode after supply of the card data is immediate.

4. A portable device as claimed in any preceding claim which is a payment card.

5. A portable device as claimed in any preceding claim which is configured to be driven by power harvested from an electromagnetic field used to interrogate the device.

6. A portable device as claimed in any preceding claim in which the card data comprises an instruction to raise a value limit on a financial transaction.

7. A payment system comprising a contactless card as claimed in any preceding claim and a transaction processing system which receives data from the contactless card and which authorises or declines a transaction in dependence upon it, wherein the transaction processing system is configured to decline transactions whose financial value is above a default limit if it does not receive the instruction to raise the value limit, and to authorise the transaction if it does receive the instruction to raise the value limit.