Patent Description:
Smart cards are portable small devices comprising a memory, a microprocessor and an operating system for computing treatments. They may comprise services applications like payment applications. Such secure elements may comprise a plurality of memories of different types, like non-volatile memory and volatile memory. They are considered as tamper-resistant (or "secure") because they are able to control the access to the data they contain and to authorize or not the use of data by other machines. A smartcard may also provide computation services based on cryptographic components. In general, smartcards have limited computing resources and limited memory resources and they are intended to connect a host machine which provides them with electric power either in contact mode or contactless mode.

A biometric smart card contains at least one biometric sensor, like a fingerprint sensor, which can contribute to the authentication of the user of the smartcard.

When performing transactions with a biometric card, most often, the cardholder is requested to give an approval through the biometric sensor of the card. Consequently, the PIN code is required less and less in practice and the user may forget the value of the PIN code.

When a genuine user has lost or forgotten the PIN code of a smart card, a new card may be manufactured and sent to the user which is informed of the new PIN code value through the usual flow. For instance, the user may receive a separate letter comprising the new PIN code value. Such a card replacement takes time and is costly.

The document <CIT> describes a mechanism for securely unblock a PIN using a remote server.

The document <CIT> describes a secure method for managing enrolling in a biometric card.

There is need to solve the above-presented problem.

The invention aims at solving the above mentioned technical problem.

An object of the present invention is a method for managing a PIN code in a biometric card which is associated to a user. The PIN code has a value and a state which can be set either to locked or to unlocked. The method comprises the steps:.

Advantageously, said data may be devoid of user code value and the PIN code value may remain unchanged in the biometric card.

Advantageously, said data may comprise the user code value and the PIN code value may be updated with said user code value in the biometric card.

Advantageously, the biometric card may send the cryptogram and a identifier of the biometric card to a card reader, the card reader may send the cryptogram, the identifier of the biometric card and a identifier of the card reader to the remote server via the communicating device and the remote server may perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the card reader has been previously registered and the remote server may send the admin code and the user code value to the communicating device only if said checking is successful.

Advantageously, the biometric card may send the cryptogram to a card reader, the card reader may capture a request from the user using a user interface embedded in the card reader, the card reader may send the cryptogram and a reference of the request to the remote server via the communicating device, the remote server may identify a user code value depending on said reference of the request and the communicating device may include the user code value in said data only if said request is a request for changing the value of the PIN code.

Advantageously, the communicating device may capture a request from the user using a user interface embedded in the communicating device, the communicating device may send a reference of the request to the remote server, the remote server may identify a user code value depending on said reference of the request and the communicating device may include the user code value in said data only if said request is a request for changing the value of the PIN code.

Advantageously, the biometric card may send an identifier of the biometric card to the communicating device, the communicating device may send both an identifier of the communicating device and the identifier of the biometric card to the remote server and the remote server may perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the communicating device has been previously registered and the remote server may send the admin code and the user code value to the communicating device only if said checking is successful.

Advantageously, the user may be provided with the user code value through the user interface of the communicating device by display or by an audio message.

An object of the present invention is a system for managing a PIN code in a biometric card associated to a user. The PIN code has a value and a state which can be set either to locked or to unlocked. The system comprises a communicating device, a remote server and the biometric card. The biometric card is configured to automatically generate a cryptogram specific to the biometric card only if the user has been successfully authenticated using a biometric sensor embedded in the biometric card. The biometric card is configured to send the cryptogram to the remote server via the communicating device. The remote server is configured to verify the cryptogram and to identify an admin code and a user code value which are both associated to the biometric card, only if the cryptogram is found to be valid by the remote server. The remote server is configured to send both the admin code and the user code value to the communicating device. The communicating device is configured to provide the user with the user code value through a user interface of the communicating device. The communicating device is configured to identify a data comprising the admin code and to send said data to the biometric card. The biometric card is configured to set the state of the PIN code to unlocked in the biometric card by performing a treatment based on said data.

Advantageously, said data may comprise the user code value and the biometric card may be configured to update the PIN code value with said user code value in the biometric card.

Advantageously, said system may comprise a card reader, the biometric card may be configured to send the cryptogram and an identifier of the biometric card to the card reader. The card reader may be configured to send the cryptogram, the identifier of the biometric card and a identifier of the card reader to the remote server via the communicating device. The remote server may be configured to perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the card reader has been previously registered. The remote server may be configured to send the admin code and the user code value to the communicating device only if said checking is successful.

Advantageously, the system may comprise a card reader, the biometric card may send the cryptogram to the card reader, the card reader may capture a request from the user using a user interface embedded in the card reader and the card reader may send the cryptogram and a reference of the request to the remote server via the communicating device. The remote server may identify a user code value depending on the reference of the request and the communicating device may include the user code value in said data only if said request is a request for changing the value of the PIN code.

Advantageously, the communicating device may be configured to capture a request from the user using a user interface embedded in the communicating device. The communicating device may be configured to send a reference of the request to the remote server. The remote server may be configured to identify a user code value depending on the reference of the request. The communicating device may be configured to include the user code value in said data only if said request is a request for changing the value of the PIN code.

Advantageously, the biometric card may be configured to send an identifier of the biometric card to the communicating device, the communicating device may be configured to send both an identifier of the communicating device and the identifier of the biometric card to the remote server. The remote server may be configured to perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the communicating device has been previously registered and the remote server may be configured to send the admin code and the user code value to the communicating device only if said checking is successful.

Other characteristics and advantages of the present invention will emerge more clearly from a reading of the following description of a number of preferred embodiments of the invention with reference to the corresponding accompanying drawings in which:.

The invention is defined in the independent claims <NUM>, <NUM>, <NUM> and <NUM>. The invention may apply to any type of biometric smart card associated to a user and intended to provide a service. The biometric smart card may be a bank smart card or an identity document for instance.

A PIN code, known as PIN (Personal Identification number) is a data having both a state and a secret value supposed to be known by the genuine card holder of a smart card. The cardholder may be authenticated by the card by entering the PIN code value. The PIN code may be in a locked (blocked) state where use of the PIN code is denied by the smart card. The PIN code may be in an unlocked (unblocked) state where use of the PIN code is accepted by the smart card. Usually, after a predefined number of consecutive incorrect presentations of the PIN code, the card sets the PIN code to the locked state.

<FIG> depicts a diagram of architecture of a system for restoring a biometric smart card to a state where it is operational and functional according to an example of the invention.

The system <NUM> comprises a communicating device <NUM>, a remote server <NUM> and a biometric smart card <NUM> associated to a user.

The biometric card has been associated to a user which is supposed to known the PIN code value of the biometric card.

The biometric card comprises a communication interface <NUM> adapted to exchange data in contact or contactless mode with another hardware device. For instance, the communication interface <NUM> may allow the card to communicate with the communicating device <NUM> through Bluetooth Low Energy ® (known as BLE).

The biometric card comprises a biometric sensor <NUM>, and a checking unit <NUM> able to verify that a biometric data captured by the sensor <NUM> matches with a preregistered reference value stored in the smart card. The biometric sensor <NUM> may be designed to capture fingerprint data for instance.

The biometric card comprises a PIN code <NUM> and an administration unit <NUM> able to set the PIN code to the locked state when a predefined number of failed attempts of PIN code presentation is reached. The administration unit <NUM> is able to set the PIN code to the unlocked state according to predefined security rules. Preferably, the administration unit <NUM> is configured to set the PIN code to the unlocked state only if it is provided with a secret key associated to the PIN code. In one embodiment, the administration unit <NUM> is configured to update the value of the PIN code <NUM> with a new value received through the communication interface <NUM>.

The biometric card comprises crypto unit <NUM> able to generate a cryptogram from a seed value which may come from the outside or be generated internally by the card itself. For instance the crypto unit <NUM> may use the Triple-DES algorithm to generate the cryptogram. Preferably, the seed value is a random challenge which is originated from the remote server <NUM>.

The biometric card is configured to automatically generate a cryptogram specific to the biometric card only if the user has been successfully authenticated using the biometric sensor <NUM>.

The biometric card is configured to automatically send the generated cryptogram to the remote server <NUM> via the communicating device <NUM>.

More precisely, the biometric card is configured to automatically send a message <NUM> comprising the generated cryptogram to the communicating device <NUM>. Alternatively, the biometric card may send the generated cryptogram to the communicating device <NUM> via an intermediate reader acting as a bridge.

The biometric card may store its own identifier <NUM> which may be a serial number for instance.

The communicating device <NUM> may comprise a communication interface <NUM> configured to communicate with the smart card <NUM> (via NFC, UWB or BLE for instance). The communicating device comprises a communication interface <NUM> configured to communicate with remote server. The communication channel between the communicating device <NUM> and the remote server <NUM> may be based on any combination comprising a telecom network, the Internet or a private network for instance.

The communicating device <NUM> may be a smartphone, a tablet, a personal computer for example. The communicating device <NUM> is configured to send to the remote server <NUM> a message <NUM> comprising the cryptogram received from the card <NUM>.

The communicating device <NUM> may store its own identifier <NUM> which may be a serial number for instance.

The remote server <NUM> is a hardware server comprising a processing unit <NUM> and instructions <NUM> which cause the remote server <NUM> to verify the cryptogram and to identify an admin code <NUM> (administration code) and a user code value <NUM> which are both allocated to the biometric card, only if the cryptogram is found to be valid by the remote server.

The remote server is configured to send a message <NUM> comprising both the identified admin code <NUM> and the identified user code value <NUM> to the communicating device.

The communicating device comprises a user interface <NUM> and a software application <NUM>. The communicating device is configured to provide the user with the user code value <NUM> through the user interface <NUM>. Preferably, the software application <NUM> is configured to extract the user code value <NUM> from the message received from the remote server and to trigger the rendering of the user code value <NUM> to the user through the user interface <NUM> as a reminder. The user may get the user code value <NUM> by display or by an audio message for instance.

The communicating device is configured to analyze the message received from the remote server and to identify a data comprising the admin code <NUM>. The communicating device is configured to send a message <NUM> comprising said data to the biometric card via its communication interface <NUM>.

The biometric card is configured to set the state of the PIN code <NUM> to Unlocked in the biometric card by performing a treatment based on the data received from the communicating device. In particular, the biometric card may check the validity of the received admin code <NUM> and set the PIN code state to Unlocked only if the received admin code <NUM> is valid.

Advantageously, the biometric card may also check that the user has been successfully authenticated through the biometric sensor during the same session before authorizing the change of the PIN code state to Unlocked. For example a flag may be set as soon as the user has been successfully authenticated via the biometric sensor, knowing that the flag is automatically reset when the card is no more powered.

The user may request that the PIN code value is kept unchanged in the biometric card. (i.e. only unblocking is requested) Such request may be entered through the user interface <NUM> of the communication device and handled by the software application <NUM>. The message <NUM> sent from the communication device to the remote server may comprise an indicator reflecting the user's request (to keep the PIN code value unchanged). The server may retrieve the current PIN code value from its own repository and use it as user code value <NUM> which is sent to the communication device. Then the data identified by the communication device may be devoid of user code value and, in the biometric card, the state of the PIN code may change while the PIN code value remains unchanged.

The user may request that the PIN code value is renewed in the biometric card. Such request may be entered through the user interface <NUM> of the communication device and handled by the software application <NUM>. The message <NUM> sent from the communication device to the remote server may comprise an indicator reflecting the user's request (to change the PIN code value). The server may identify a new PIN code value and use it as user code value <NUM> which is sent to the communication device. Then, the data identified by the communication device may contain the user code value. In other words, the biometric card may receive a data comprising both the admin code <NUM> and the user code value <NUM>. In this case the biometric card may be configured to change the state of the PIN code and to replace the value of the PIN code value with the received user code value <NUM>.

The biometric card <NUM> may be configured to send an identifier <NUM> of the biometric card to the communicating device. The communicating device may be configured to send both an identifier <NUM> of the communicating device and the identifier <NUM> of the biometric card to the remote server. The remote server may be configured to perform a checking to verify that a pairing of the identifier <NUM> of the biometric card and the identifier <NUM> of the communicating device have been previously registered. The remote server may be configured to send the admin code <NUM> and the user code value <NUM> to the communicating device only if the checking of the pairing is successful.

Thanks to such an embodiment, the update of the content of the biometric card can only be made at the request of a user having at his disposal both the card and the communicating device which have been bound in a previous stage.

The software application <NUM> may be designed to allow the registering of the pairing of the biometric card and the communicating device by collecting both the identifier <NUM> of the biometric card and the identifier <NUM> of the communicating device and declaring the pairing to the remote server during a registration phase.

In one embodiment, the software application <NUM> and the card biometric card <NUM> may be personalized so as to comprise one or several secret keys allowing to establish a secure communication channel between the software application <NUM> and the card biometric card <NUM>. Such secret keys may be identified during a prior pairing phase.

In one embodiment, the remote server <NUM> may generate a script comprising a set of ordered commands to be executed by the biometric card. Advantageously, a subset of the commands may be protected by a key stored in the biometric card <NUM>. The remote server <NUM> may send the script to the communicating device <NUM> which may send the commands of the script to the biometric card through one or several messages. The script may comprise a command for presenting the admin code <NUM> (and optionally the user code value <NUM>) to the biometric card <NUM>.

The script may comprise a PIN Change/Unblock command that allows either PIN to be unlocked (based on a Triple DES MAC for instance) or PIN to be changed (with a ciphered new PIN value and a Triple DES MAC). When a command like PIN Change/Unblock command is used, the admin code <NUM> is the MAC (Message Authentication Code).

<FIG> depicts a diagram of architecture of a system for restoring a biometric smart card to a state where it is operational and functional according to another example of the invention.

The system <NUM> is similar to the system <NUM> described at <FIG> with the following differences: The system <NUM> comprises a card reader <NUM> and components of the system behave as explained below.

The communication interface <NUM> of the biometric card is adapted to exchange data in contact or contactless mode with the card reader <NUM>. For instance, the communication interface <NUM> may allow the card to communicate with the card reader <NUM> in contact mode according to the protocols defined by ISO/IEC <NUM> or in contactless mode according to a protocol complying with ISO/IEC <NUM>, Mifare®, Felica®, ISO/IEC <NUM> or NFC Forum Tag specifications.

The biometric card is configured to automatically send the generated cryptogram to the remote server <NUM> via both the card reader <NUM> and the communicating device <NUM>. More precisely, the biometric card is configured to send to the card reader <NUM> a message <NUM> comprising the generated cryptogram and an identifier <NUM> of the biometric card. The identifier <NUM> allows to uniquely identify the biometric card.

The biometric card may be a banking card intended to be used by its associated user (i.e. bank customer) for payment or cash withdrawal for instance.

The card reader <NUM> may comprise a first communication interface <NUM> configured to communicate with the smart card <NUM> and a second communication interface <NUM> configured to communicate with the communicating device <NUM>. (via NFC, Wi-Fi, Bluetooth ®, BLE or Ultra-Wide Band known as UWB for instance) In one embodiment, the card reader <NUM> may communicate with the communicating device through a wired link.

The card reader <NUM> may comprise a memory storing an identifier <NUM> of the card reader <NUM>. The identifier <NUM> allows to uniquely identify the card reader <NUM>. For example, the identifier <NUM> may be a serial number.

The card reader <NUM> may be configured to send to the communicating device a message <NUM> comprising the generated cryptogram, the identifier <NUM> of the biometric card and the identifier <NUM> of the card reader.

The communicating device <NUM> may comprise a communication interface <NUM> configured to communicate with the card reader <NUM>.

The remote server <NUM> may be configured to perform a checking to verify that a pairing of the identifier <NUM> of the biometric card and the identifier <NUM> of the card reader have been previously registered and to send the admin code <NUM> and the user code value <NUM> to the communicating device only if the checking of the pairing is successful.

The communicating device may be configured to analyze the message received from the remote server and to identify a data comprising the admin code <NUM>. The communicating device may be configured to send to the card reader a message <NUM> comprising the identified data. The card reader <NUM> may be configured to send to the card <NUM> a message <NUM> comprising data received from the communicating device.

The card reader <NUM> may comprise a user interface <NUM>. The card reader may capture a request from the user using the user interface <NUM>. The card reader may send the cryptogram and a reference of the request to the remote server via the communicating device. The remote server may be configured to identify the user code value <NUM> depending on the reference of the request and the communicating device may be configured to send the user code value <NUM> to the card reader only if said request is a request for changing the value of the PIN code.

The user may request that the PIN code value is kept unchanged or replaced in the biometric card through the user interface <NUM> of the card reader device. The message <NUM> sent from the card reader to the communication device may comprise an indicator reflecting the user's request (to keep the PIN code value unchanged or to renew the PIN code value) so that both the communicating device and the server are aware of the type of request. The communication device may be configured to send (or not) the user code value <NUM> to the card reader depending of the type of user's request.

The card reader may comprise a processing unit <NUM>. The remote server <NUM> may generate a script comprising a set of ordered commands to be executed by the biometric card. Advantageously, a subset of the commands may be protected by a key stored in the biometric card <NUM>. The remote server <NUM> may send the script to the card reader <NUM> via the communicating device <NUM>. The processing unit <NUM> may send the commands of the script to the biometric card. The script may comprise a command for presenting the admin code <NUM> (and optionally the user code value <NUM>) to the biometric card <NUM>.

The software application <NUM> may be designed to allow the registering of the pairing of the biometric card and the card reader by collecting both the identifier <NUM> of the biometric card and the identifier <NUM> of the card reader and declaring the pairing to the remote server during a registration phase.

The card reader may be a hardware device comprising a user interface designed to allow the cardholder to request an enrolment of a biometric reference and the PIN code renewal (or PIN code unlocking). For instance, the card reader may embed two buttons each being dedicated to one of these requests. Features of the card reader may be limited to communication via a contactless protocol (like Bluetooth, BLE or UWB for instance) with a communicating device, communication with a biometric card, powering of the biometric card, treatments required for the biometric reference enrolment and treatments required for the PIN code renewal (or unblocking).

<FIG> shows an exemplary flow diagram to restore a biometric card to a state where it is operational and functional according to a first example of the invention.

In this example, the biometric smart card, the communicating device and the remote server may be those of the system <NUM> detailed at <FIG>.

The biometric smartcard <NUM> embeds a secure element (chip) comprising a hardware processing unit, memory and an operating system designed to contribute to bank services. The biometric card also comprises a reference biometric data which has been enrolled by the user (i.e. bank customer). The biometric card may use the reference biometric data to check the genuineness of a biometric data captured by its sensor.

At step S10, the biometric card <NUM> authenticates the cardholder using its biometric sensor and automatically triggers the generation of a cryptogram specific to the biometric card only if the cardholder (user) has been successfully authenticated. The biometric card <NUM> has a key prestored in its memory. The biometric card <NUM> may use this key to generate the cryptogram or derive a session key from the key prestored in its memory and generate the cryptogram using the session key. In both cases, the card uses a random value (also known as challenge or salt) to generate the cryptogram. The random value may come from the biometric card itself or from the remote server (via the communicating device). The server is assumed to have the relevant key needed to check the validity of the received cryptogram.

At step S20, the biometric card sends the cryptogram to the remote server through the communicating device.

At step S30, the remote server verifies the validity of the received cryptogram and, only if the cryptogram is found to be valid, identifies an admin code <NUM> and a user code value <NUM> which are both associated to the biometric card. The card may have sent its own identifier along with the cryptogram to ease the identification of the biometric card by the remote server.

At step S40, the remote server sends both the admin code and the user code value to the communicating device.

At step S50, the communicating device provides the user with the user code value <NUM> through its own user interface so that the user can remember it. Preferably, the user code value is displayed. The access to the display of communication device by the user may be unlocked by credentials presented by the user to the communicating device. For instance, the user may have to enter a secret code or present his finger to a biometric sensor of the communicating device to authenticate.

At step S60, the communicating device identifies a data comprising the admin code <NUM> then sends the identified data to the biometric card. The user may have requested either the unlocking or the renewal of the PIN code of the biometric card. If the user has requested the unlocking of the PIN code, the identified data may not contain the user code value <NUM>. If the user has requested the change of the PIN code value, the identified data do contain the user code value <NUM>.

At step S70, the biometric card <NUM> performs a treatment based on the data received from the communication device in order to set the PIN code to unlocked state in the biometric card. Additionally, if the identified data contains the user code value <NUM>, the biometric card may update its own PIN code value with the received user code value <NUM> once the state of the PIN code has been set to unlocked.

<FIG> shows a second exemplary flow diagram to restore a biometric card to a state where it is operational and functional according to an example of the invention.

The flow is similar to the one of <FIG> with the following differences: Steps <NUM> to <NUM> replace step <NUM> and steps <NUM> to <NUM> replace step <NUM>.

At step S22, the biometric card sends a first message <NUM> comprising the cryptogram to the card reader <NUM>.

At step S24, based on the first message <NUM>, the card reader identifies a second message <NUM> comprising the cryptogram and sends it to a communicating device.

At step S26, based on the second message <NUM>, the communicating device <NUM> identifies a third message <NUM> comprising the cryptogram and sends it to the remote server <NUM>.

At step S62, based on the fourth message <NUM> received from the remote server, the communicating device identifies a data comprising the admin code <NUM> and sends a fifth message <NUM> comprising the identified data to the card reader.

At step S64, based on the fifth message <NUM>, the card reader sends a sixth message <NUM> comprising the identified to the biometric card.

The biometric card <NUM> may include its own identifier along with the cryptogram into the message <NUM> it sends to the card reader <NUM>. The card reader may include its own identifier along with the cryptogram and the identifier of the biometric card into the message <NUM> it sends to the communicating device. The message <NUM> sent to the remote server <NUM> by the communicating device <NUM> may include the cryptogram, the identifier of the biometric card and the identifier of the card reader. The remote server may perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the card reader have been previously registered. The remote server may send the admin code <NUM> and the user code value <NUM> to the communicating device only if the checking is successful. Such a scheme allows to avoid a malevolent person which got the biometric card without the specific card reader associated to the biometric card to request change of the PIN code in the biometric card.

The card reader may get a request from the cardholder using the user interface <NUM> embedded in the card reader. The request may be either to unlock the PIN code or to renew the PIN code. The card reader may send the cryptogram and a data reflecting the nature of the request to the remote server via the communicating device. The communicating device may keep a track of the nature of the request before forwarding the message to the remote server. The remote server may identify a user code value which depends on the nature of the request: either the current PIN code value if an unlocking has been requested or a new PIN code value if a renewal has been requested. The communicating device may include the user code value <NUM> in the data it sends to the card reader only if a renewal of the PIN code has been requested.

In all cases, (whether the card reader is used or not), the cardholder may specify his request using the user interface of the communicating device. The communicating device may capture the request from the user using its user interface <NUM>. The communicating device may keep a track of the type of request and send a reference of the request to the remote server. The remote server may thus identify a user code value <NUM> depending on the request reference. The communicating device may send the user code value to the biometric card (via the card reader or not) only if the request is a request for changing the value of the PIN code.

In all cases, (whether the card reader is used or not), a pre-registered pairing of the communication device and the biometric card may be checked by the remote server. The biometric card may send its own identifier to the communicating device (via the card reader or not). The communicating device may send both its own identifier and the identifier of the biometric card to the remote server. The remote server may perform a checking to verify that a pairing of the identifier of the biometric card and the identifier of the communicating device have been previously registered. The remote server may send the admin code <NUM> and the user code value <NUM> to the communicating device only if the checking of the pairing is successful. Such an embodiment allows to avoid a malevolent person which got the biometric card without the specific communicating device associated to the biometric card to request change of the PIN code in the biometric card.

In all cases, (whether the card reader is used or not), a secure channel may be established between the biometric card and the remote server through the communication device (via the card reader or not). The secure channel may comply with GlobalPlatform Card Specification Version <NUM>, Oct <NUM> or any relevant secure protocols. The secure channel may be established between the biometric card <NUM> and the server <NUM> by using keys pre-stored on both sides. Preferably, the keys are symmetric, alternatively the keys may belong to a public/private pair according to PKI scheme. Due to the security provided by the secure channel, the communication device is not able to access the content of data exchanged between the card and the server through the secure channel. Thus, the remote server may send an additional message comprising the user code value <NUM> to the communication device, so that the communication device can provide the user with the user code value <NUM>.

Thanks to the invention, it is possible to securely unlock and/or update the current PIN code in a biometric smart card. In particular, unlocking and/or updating of the value of the current PIN code of a biometric card may be done without the need for the cardholder to go to a specific location since the server can be accessed remotely. In particular, there is no need for the user to go near an ATM (Automated Teller Machine) or an on-line POS (Point-Of-Sale) when the biometric card is a banking card.

Depending of the security level which is required by the entity which administrates the remote server, several additional checks can be carried out to verify the presence (and the use) of one or more hardware devices near the biometric card.

The invention is not limited to the described embodiments or examples. In particular, the described examples and embodiments may be combined.

The invention is not limited to Banking smart cards and applies to any biometric smart cards allocated to a user.

Although examples of the invention has been detailed in the banking domain, the invention also applies to other domains. For example, the smart card may provide access to a physical building, room or area.

Claim 1:
A method for managing a PIN code in a biometric smart card (<NUM>) associated to a user, said PIN code having a value and a state which can be set either to locked or to unlocked,
wherein the biometric smart card is in communication with a communicating device (<NUM>),
wherein the method comprises the steps of:
entering by said user, through the communication device, either a first request requesting that the state of the PIN code is changed while the PIN code value remains unchanged or a second request requesting that the PIN code is renewed,
- authenticating said user by the biometric card using a biometric sensor (<NUM>) embedded in the biometric smart card and automatically triggering the generation of a cryptogram specific to the biometric smart card by the biometric smart card only if the user has been successfully authenticated,
- sending the cryptogram from the biometric smart card to a remote server (<NUM>) via the communicating device (<NUM>),
- verifying the cryptogram at the remote server (<NUM>) and, only if the cryptogram is found to be valid, identifying by the remote server an admin code (<NUM>) and a user code value (<NUM>) both allocated to the biometric smart card, said user code value (<NUM>) being the PIN code value if the user entered the first request, said user code value (<NUM>) being a new PIN code value chosen by the remote server if the user entered the second request,
- sending both the admin code (<NUM>) and the user code value (<NUM>) from the remote server to the communicating device,
- providing, as a reminder, the user with the user code value (<NUM>) through a user interface (<NUM>) of the communicating device,
- identifying a data comprising the admin code (<NUM>) and sending said data from the communicating device to the biometric smart card, said data comprising the user code value (<NUM>) if the user entered the second request,
- setting the state of the PIN code to unlocked in the biometric smart card (<NUM>) by performing a treatment based on said data in the biometric smart card, and
- replacing the PIN code value stored in the biometric smart card with said user code value (<NUM>) if the user entered the second request.