GB2082816A - Solid state on-person data carrier and associable processing system - Google Patents

Abstract

A personal identification data carrier contains solid state logic and memory elements and is associable with a data processing system comprising a computer and program control unit, data being transferable by a magnetic link between the data carrier and the computer. The data carrier memory is a large scale I.C. chip in which the data may be erased and repeatedly altered. An amount of credit may be entered into this memory which may be added to or subtracted from when the data carrier is used for various transactions e.g. making a payment to a vending machine. The memory also has a part, which cannot be read out, into which a security check number is to be entered.

Description

SPECIFICATION Solid state on-person data carrier and associable processing system INTRODUCTION The principle of a solid state pocket-size carrier of electronically stored digital data and the manner of reactively transferring data bidirectionally between said carrier and a stationary computer has already been described by the applicants in their US patent applications Ser. No. and their British Paten 1,314,021 (Digital Data Carrying Component and Associable Data Transfer Device). The degree of security against fraudulent alteration of the data contents according to this patent was not very high but this drawback was overcome by the introduction of a barrier in the form of a check number comparison and a shut-down procedure after a number of fraudulent attempts as described in US patent No.

3,906,460.

Already British Patent 1,314,021 gives detailed description of a data carrier containing an inert, programmable, memory device (magnetic core shift register, also solid state bistable register with retentive magnetic loads), thus avoiding the need for a data maintaining voltage source (battery).

Recent technological progress has led to a fully solid-state electrically alterable Read Only Memory (EAROM) and this may with advantage replace a magnetic core memory because of its smaller size. it has also been proposed to use a socalled programmable memory in an on-person portable data carrier (Br. Patent No. 1,504,196), in which the configuration of a fixed memory is pre-set by means of current pulses which burn out unwanted inputs to tiny bistables. Such a memory may be usable in some applications requiring only a fixed data word. Equally, socalled re-programmable memories were suggested in which erasure of data must be done by means of Ultra Violet light. Such devices have poor security and would have by far too slow operating speed for normal use.

It is thus one of the purposes of this improvement to show how an integrated circuit of the EAROM type may be constructed, and used within an on-person solid state data carrier.

Another purpose of the invention is to provide a data carrier that can be inexpensively mass produced.

A further purpose is to elaborate on various electro-magnetic configurations of the data carrier to ensure, on the one hand, a satisfactory energy flow from the Sensor Unit to the data carrier circuit, on the other hand contribute to both simplicity and reliability of the transfer of data from and to the data carrier.

As described in the author's US and British patents, the data transfer is proposed to be carried out by reactive coupling means which are hidden within the smooth surface of the data carrier. It is believed that this is the best method for attaining a long-term reliabie system, and the same method is used also in the present invention. There exists another proposal (British Patent 1,504,196) in which the coupling means are accessable at the exterior of the data carrying device in the form of light-emitting diodes and photo transistors. The authors believe, however, that this method cannot offer long-term security because of the unavoidable detoriation of the surface condition in the process of handling the card.

DESCRIPTION To summarize, this paper describes three innovative improvements. One is a method for batteryless operation. Another is a simplified and more robust mechanical construction of the data carrier. A third is the exact circuit for synchronizing the processing steps in the controlling computer and the data component and to produce a start signal in dependence of the energy level injected into said component. In the drawings which illustrate these improvements.

Figure 1 is a partial cross section A-A through a portable data carrier.

Figure 2 is a section B-B of the same.

Figure 3 is a sectional view of the data sensor unit.

Figure 4 is a section B-B through said data sensor showing clock drive and data coils.

Figure 5 is an auxiliary sketch showing by way of example the nature of the currents flowing in the drive and data coils.

Figures 6, 7, 8 comprise the logic circuitry and the power supply circuit in the interior of the portable data carrier of fig. 1 & 2.

Figures 9 and 10 showing the essential portions of the circuitry of the data transfer control unit which is connected to the coils of the Data Sensor Unit, figs. 3 & 4.

Description of the on-person data carrier, Figs. 1 and 2 The same consists of a moulded or otherwise formed object 1 of a ceramic or semi-flexible ferrite material having a central core I c and finlike extensions 1 b. The corners 1 a of the essentially square-like object are re-inforced in thickness. Coils 3 and 3a are fitted on the core. A further coil with fewer number of turns is the coil 4. A printed circuit board 2 is attached to both sides of the central disk and carries various electrical and IC components such as for example flat packages 5 and 6 or capacitor 7, etc. The whole assembly may be closed by side plates 2a and potted in suitable resin or silicon compound. The finished component may then be placed into two halves of a flat disk 10 the hollow spaces of which filled with a softer grade of elastic material 9.Afterwards the two halve spheres are moulded and fused together, for example by microwave heat.

Description of the Sensor Unit, Figs. 3 and 4 The same consists in this example of two halves fitted into a supportive frame 1 2. This frame also serves as a receptacle for the data carrier component 10 which, as the drawing indicates, may be dropped into the sensor unit after which it would come to rest on the piston 20. The latter may be so connected to mechanical actuators that on completion of the data transfer transaction it is either sideways withdrawn permitting the data component to drop into a receptacle, or the piston 20 is lifted upwards to return the component 10 to the user. 13 and 14 are the above mentioned two parts. The outer diameter of the potlike insert is about equal to the diagonal dimension of part '1' of the On-person data carrier.Drive coils are 1 5 and 17; 16 has again fewer turns and mediates the data signal which, in this example, has a higher frequency than the clock pulses injected into the coils 1 5 and 1 7.

Description of the circuitry of the on-person data carrier Figures 6, 7 and 8 should be laid together, with Fig. 6 at the bottom and Figure 8 uppermost, to form one single circuit. The same provides an example for realizing an on-person data component by using a non-volatile ROM with repeatable data alteration capability. It is clear that the adaptation of the idea depends on the specific type of memory. The present description is oriented to a GI (General Instruments) chip known as ER 1400 for which a data sheet may be supplied. This circuit depends on the use of separate erase pulses having a negative voltage for erasing a memory location. More recent devices may not require this operation step but, on the other hand, may require others.What is described hereunder should therefore be taken only as an illustration of a principle. -- In the here proposed EAROM IC chip, one alteration has been made. Whereas the General Instruments device employs all-but one of the 'mode control inputs' C, C2, C3, the unused one being , this latter combination is used for the command 'Enter data stream into the Subtrahent Register'. The GI device has no subtrahent register.

The transformer coil TR1 in Fig. 6 is identical with coil 3a in Fig. 2. The coil TR2 in Fig. 6 corresponds to coil 3, Fig. 2, and TR3 corresponds to coil 4, Fig. 2. TR1 carries clock pulses as indicated in Fig. 5 and produces a dc output at VDD. TR2 carries the same clock pulses and produces a negative voltage VGG. TR3 carries only data pulses phase shifted against clock pulses as indicated in Fig. 5; they consist of pulses of a much higher frequency which are detected by tuned circuits or by a phase-locked loop circuit such as shown (integr. circuit 'P') in Fiy. 9, or 'DET' in Figure 7.

Method for causing the minimum voltage dc level being built up in the data carrier after insertion into the Sensor Unit to produce a synchronising pulse It must first be explained that the exchanging of data depends on the correct, synchronous operation of counters in the Control Unit circuit (figs. 9 and 10) and in the on-person component (figs. 6, 7, 8). In the former, these counters are word bit counter K0 and process counter LO, in the latter bit counter K and process counter L. The synchronizing pulse is generated in circuit fig. 6 and is passed via the sensor/data component transformer configuration to circuit fig. 9 causing there bystable F/F-2 to set.The following is a detail explanation: The clock pulses are shaped in 'E', fig. 6 and passed on to Nandgate N9 as also to a voltage sensor 'H'. AS ODD voltage is being built up beyond a required minimum level 'H' produces a dc output which is applied to 'G'. 'G' is a bistable clocked by output from 'E', i.e. by rising pulse fronts. When 'G' goes high, output from Nandgate N9 goes low, CKk at word bit counter K goes also low but this produces no count pulse as yet.The output SY from Nandgate N3 goes high to pass on an enabling pulse to OSC via OR gate 1 6. A high frequency pulse burst is generated in TR3 and detected by 'P' in fig. 9 producing a corresponding high-level dc output into Nandgate N12 thereby setting F/F-2. When next a clock pulse from CK-OSC. goes high, N 13 passes on a count pulse to counter K0 for the first time. The same also happens in the coupled data component with counter K. From that moment onwards all the events in the coupled circuit groups proceed in synchronous steps.The counters L0 and L are stepped on either by the reset pulse for counter K or by a single pulse generator TE (fig. 6). The K counters count up the word bits to be handled during each program step, in this case 14 and 20 bits and 1 bit. Where one bit applies which happens whenever OR Gate R1 4 has an input from the process counter L, the counter K is impeded. The single pulse length process steps are needed for read and erase instructions. If a program step contains 1 4 bits a data word is transferred; if it contains 20 bits an address instruction is transferred from circuits 9, 1 0.

The decoded single outputs from the process counters L0 and L are applied to various gates and functional subcircuits as during the consecutive program steps must play a part, all in accordance with the operating mode of the ROM ER 1400 as modified for our purposes. The following events are carried out in the individual program steps: K-Counters L-Counters Mode Control Operation (O) o - synchronising pulse. one clock pulse wide as described (1) - (20) 0 C2 & C3 address data generated in Computer are serially transferred to Fig. 8 via Di terminal and applied to ADDRESS BITS registers to select memory location. Output 0 from counter L is applied to OR gate R 8 in Figure 7 enabling mode control lines C3 and C3.Figure 7 contains most of the mode control logic (o) 1 C, Instruction: Read data of the selected location and enter them into the on-chip data register.

(1) - (14) 1 Cl & C3 data register contents are serially shifted out and transferred to computer circuits figs. 9, 10 and entered into shift register SR1 (fig. 10).

(O) 2 - In the computer or process controlled, apply the parallel readout bits of the SR1 register and of the SR2 register (containing the Intended debit) to the comparator circuit COMP (fig. 10).

Lamp GR lights if value in portable data component is larger than value to be debited.

If smaller, comparator output is applied to disable line DA and held, clock pulses stop.

A display IC (insufficient credit) is lit.

As the contents of the shift register SR1 contains also the reference or library bits by which the portable data component reveals which of the currently valid genuity check numbers it holds, the said bits are decoded selecting a register in the computer which holds the corresponding check number in readiness for the genuity check. This precedure is dealt with in more detail in a concurrent patent application.

(1) - (20) 2 C2 & C3 address data are transferred from computer to address register in portable component, for use in step 4.

(1) - (14) 3 C, & C2 & C3 Transfer the check number selected as described in the computer, to the data register in the PC (portable component) marked 'Subtrahent Register'.

(o) 4 Cl Readout into main data register.

(1) - (14) 4 C3 Recirculate the contents of both the data register and the subtrahent register through the 'Arithmetic Logic' circuit for serial comparison. If these numbers are identical, there will be no bitoutput from the said circuit.

If not identical, any bit output sets the bistable F/F (Fig. 8) as well as the bistable 'S' In figure 7. This causes clock pulses to stop in both the computer and the portable component, as applied to the counters. In the computer, after F/F sets, only ones appear at the data Input D1,fig, 9. This causes a display (not shown! "Not Acceptable" to be lit.

K-Counters L-Counters Mode Control Operation (o) 5 C Produces short pulse 'e' to obtain erase pulse at the present memory address.

Pulse 'e' derives from the OR gate R 14 Fig. 6 which, via TE circuit passes a pulse to the clock input of counter L; The length of the pulse might be controlled by counter K but this is not shown In the present circuit.

(1) - (20) 6 C2 & C3 ENTER new address for new check word.

(0) - (14) 7 C2 ERASE any data at new address location.

(1) - (14) 8 C, & C3 & C2 ACCEPT new check word data register.

g 9 C, & C2 WRITE word in data register into address location.

(1) - (20) 9 C2 & C2 ENTER address for value word.

In computer, after the check reference or library bits in such a manner that after passing through the arithmetic unit will represent the bit combination corresponding to the new check word to be entered. Not shown in Fig. 10. This aspect Is dealt with in greater detail in a concurrent application paper.

(1) - (14) 10 C2 Accept debit word from computer and enter into the 'Subtrahent Register'.

(O) 11 C, READ OUT value number from the selected memory address and enter into Main Data Register.

(1) - (14) 11 C, & C2 Circulate the contents of both the Subtrahent Register and the Main Data Register through the Arithmetic Logic unit and place the result in Data Register (equals the residual value).

(i) - (14) 12 C2 ERASE memory at the present address.

(1) - (14) ' 13 C, & C2 WRITE residual value in data register into the addressed memory location.

(O) 14 Cl READ OUT from said memory location into data register.

(1) - (14) 14 C, & C3 transfer the said residual value in data register to computer, for verification of correct entry into memory array.

the following steps do not occur in a vending operation but are required to be added to the afore-listed steps in order to carry out a value increment.

(1) - (14) 15 C, & C2 & C2 ACCEPT value word into Main Data Register (1) - (20) 16 C2 ERASE existing value in the present address.

K-Counters L-Counters Mode Control Operation (1) - (14) 17 Cl & C2 ENTER the new value into the addressed location from the data register.

(O) 18 Cl Read out the newly entered value word and enter into the data register.

(1) - (14) 18 Cl & C3 Shift out serially and transfer to computer for verification of correct entry.

In a value debiting (vending) unit there would be no equipment for carrying out the last five program steps; it would be included in equipment installed at Banks and other authorized places where credit can be increased. The chief obstacle to any fraudulent attempt at inserting a new value (i.e. a higher value) into the data carrier would be the difficulty in deriving the correct check number from the library bits of the data carrier and the correct address for same. This might be possible if the entire update unit were stolen and analysed in a laboratory. It could be arranged, however, that any removal of a unit from its installed place would cause the destruction of the check bit codes. In addition, the check numbers may alter over a period of time as described in a co-pending application.

There are thus set up formidable obstacles to reaching program count 14 in an unauthorized manner; the last five program steps cannot be reached without having first gone through the preceding 14 stages.

The circuit diagrams for the portable data carrier as shown in Fig. 6, 7, 8 provide a fairly complete basis for following through the above listed sequential performance of the data transfer system, with due regard to data sheet for EAROM 1400 chop though in its here modified form.

The following is a description of how the circuits figures 9 and 1 0 are used: Prior to the insertion of the PC (portable data component) into the point of sale or control equipment, that is, into the Sensor Unit as examplified in figures 3 and 4, a control preselection may be performed manually with the aid of value selector switch SEL whereby a number is encoded and put into a register marked "Individual Value". If a series of such individual values are to be added up this may consecutively be done by suitable means, either automatically or manually by pushing an "ADD" button which activates a unit marked "SUM"; as can be seen, this push button receives its voltage over MANL (manual) line from the output of the bistable FF-1 (Figure 9).This ensures that no further debit can be added to the SUM register after the PC is inserted into the Sensor Unit where it actuates a Switch SW (fig. 9). The latter, via Schmitt trigger SCH, sets the bistable FF1 whereby gate N1 1 is enabled and CK-Oscillator commences to produce clock pulses. These are amplified in 'A', passed through chokes DR which keep out the high frequency component of data signals, and through windings TRo. As already explained, these pulses built up a dc voltage in the PC. When the minimum safe operating voltage is reached, the synchronising start pulse is emitted from the PC to the computer unit where it is sensed by phase lock loop circuit P, triggering bistable FF-2, as already described in detail.

It should be noted that the connection line between the register 'SUM' and the shift register SR2 represents parallel data bit connections, equally the output lines from register SR2 to the comparator COMP. P/S is the contril input giverning serial/parallel -modes of the registers SR1 and SR2. The circuit group marked 'SEQUENTIAL PARALELL ENTRY CIRCUITS indicates the fact that the shift register in the course of the total program is consecutively used for various types of data which have to be sent to the PC and therefore has a parallel entry facility. The bit output lines from the register SR1 comprise those numbered I, II, lil, and IV which in this example contain the library code received from the PC for automatic selection of the requisite check number. This is described in greater detail in a-copending application.

Claims (14)

1. A solid state on-person data carrier and associable processing system comprising (a) at least one on-person data carrier containing solid-state logic and memory elements (b) a computer and program control unit (c) a sensor unit conveying data between (a) and (b) wherein both the said data carrier and the sensor unit are furnished with means for being reactively (non-galvanically) coupled when placed in proximity to each other, the improvement being characterized by the presence within the data carrier of a large scale integrated circuit chip including an electrically eraseable and repeatedly alterable memory circuit capable of responding many times to Erase- and Re-write commands additional to its ROM readout function, and means in the computer portion for applying said command signals via said sensor unit.

2. A data transfer system as in Claim 1, the combination within the data carrier of said EAROM memory circuit with an arithmetic register and subtrahent circuit, and a mode control channel for linking them with the memory input/output system.

3. A data transfer system as in Claim 1, the combination within the data carrier of said EAROM memory circuit with one or more program counters and requisite logic circuitry to follow through a certain sequence of process steps after the computer unit and the data carrier are physically brought into a working relationship via the Sensor Unit.

4. A data transfer system as in Claim 3 having program counters in both the on-person data carrier and in the computer control unit, with means for synchronising these counters.

5. A data transfer system as in Claim 4, means in the data carrier for producing a synchronising trigger signal in dependence of achieving a built up within the data carrier circuitry of the minimum safe operating voltage.

6. A solid state on-person data carrier and associable processing system as in claim 1 wherein both the data carrier and the sensor unit contain mutually complementary means for estabiishing a close electro-magnetic linkage with each other, the improvement characterized by the presence of a solid state IC EAROM chip within the said data carrier and means for loading a portion of said EAROM memory with a first number, furthermore means for accepting and temporarilystoring in the chip a second number transferred from the computer unit, means for comparing said first number with said second number, and finally means in the data carrier for sending out to the said computer unit a distinguishing signal by which said unit distinguishes a genuine from a defect or fraudulent data carrier.

7. A data transfer system as in Claim 6 in which the fraudor defect indicating signal has unchangable, uniform characteristics independent from the structure of said second number, thus not permitting any analytical study for deriving the true check number in the portable data carrier.

8. A data transfer system comprising a data carrier, a computer unit and a Sensor unit, mutually complementary reactive coupling means in both, at least one EAROM integrated memory circuit in the data carrier, the system characterized by the provision of means for recognizing the identity of a second data check word when received from the computer unit in the data carrier by reference to a first data word held in the data carrier for producing a logical output level change, and by the presence of Inhibit Gates in the data token circuit which normally inhibit the Erase and Write Mode Control Circuits of the EAROM memory.

9. A data transfer system comprising at least one portable on-person data carrier containing logic memory elements, a computer and program control unit, and a sensor unit, wherein both the said data carrier and the said sensor unit have means for being reactively coupled when placed in proximity to each other, the improvement characterized by the presence in the data carrier and in the sensor unit respectively of two reactive coupling channels both of which are employed for the transmission of electrical energy whereas the conveyance of data and control signals is represented by a modulation of one or more characteristics of the energy flow in'one, or the other, or in both of said coupling channels.

10. A data transfer system as in Claim 9 in which the said modulation includes the addition or omission of one or more signal components having a frequency substantially different from that of the energy (clock beat) flow.

11. A data transfer system as in Claim 9 in which said modulation includes frequency shift modulation.

12. A data transfer system as in Claim 9 in which said modulation includes phase shift modulation.

1 3. A data transfer system as in Claim 9 in which said modulation includes pulse width modulation.

14. A data transfer system as in Claim 9 in which said modulation includes delta modulation.

1 5. A data transfer system comprising at least one portable on-person data carrier containing solid state logic and memory elements, a computer and program control unit, and a sensor unit for interfacing the former, wherein both the said data carrier and the said sensor unit are furnished with means for being reactively (non-galvanically) coupled when placed in proximity to each other, the improvement being characterized by a data carrier consisting of a twin back to back shallow disk with flanged rim made of magnetically permeable material the bottom plate of which is common to noth, each having a centrally disposed stud of similar material wherein the said rims of the dishes or a part thereof, and the said studs serve as magnetically conductive yokes to, produce reactive coupling means on both sides of the disk.

1 6. A data transfer system as in claim 1 5 wherein the hollow spaces in said twin disk are used for placing eiectronic circuitry and for potting it in an air-tight manner.

1 7. A data transfer system comprising a portable on-person data carrier, a computer, and a sensor unit, the linkage between them being performed by reactive coupling means, wherein the general frame of the data carrier consists of an elongated shallow tray-like disk and wherein the bottom of the trays contains deposited inter-chip circuit connections.

1 8. A data transfer system as in claim 1 5 to 1 7 wherein the data carrier is enshrouded by a shell made of resilient, formstable material to procure maximum protection against physical and temperature shocks.