CA1194570A - Hierarchic arrangement for the verification and renewal of security date in electronic fund transfer systems - Google Patents

Abstract

ABSTRACT OF THE DISCLOSURE
The invention provides an electronic fund transfer and data protection system comprising; a plurality of portable data carriers; a plurality of transaction terminals; self-contained portable storage units for storing security test numbers and a list of transaction events data obtained from said transaction terminals; computer units with data storage space for receiving transaction event data from the self-contained storage units and for imparting new test numbers thereto; and an originating station where security test numbers are generated and electrically passed to the computer units via dedicated communication lines.

Description

This invention relates to an electronlc fund transfer and data protection system.
U.K. Patent publication No. 2,057,740 entitled Security Arrangements in Data Transfer Equipment, published April 1, 19~1 describes an arran~ement for ensuring -tha-t data contained in a data storage station cannot be read out without the station first passing a question-and-answer -test, which is of such a kind that stereotype (that is forgeable) test answers cannot be given by the storage station is known. A safeguard against the possibility of a set of test numbers becoming known, for example, through unauthorized manipulation of the equipment, is also described. The relationship be-tween test number storage addres-ses and the test numbers is changed, and entirely new test numbers are procured at regular or irregular intervals of time. The description refers to a cyclic change in the significance of the numbers, which are initially active, then "semi-retired" and then vacated numbers. Vacated numbers are always replaced by new "active" numbers. These test numbers, originating from a single centralized headquarters of a bank, or of a central clearing bank, and transmitted from there via scrambled dedicated data lines to the branches of banks, credit institutes, etc., mainly during night times, are very safe from unauthorized inspection or inter-ference, especially if the security measures described hereunder are applied.
In U.K. Patent publication No. 2,057,7~0 a method of changing test nurnbers without losing region or nationwide validi-ty at transaction stations is described. The description relating to the da-ta transFer bel:ween a portable ~ata token and a trans-action station is Fairly complete. The precise security measures required to insure that only an authorized station is able to change the test codes and that the transfer of transaction data to another data station is dependent on the fulfillment of ~ 5'~

certain test conditions are not clescr-ibed in cle-tail. An lnvesti-gation of the overall requirement shows that the concept oF a self-repairing security system For the data transfer between a widely dis-tributed pay token and point-of-sale or transaction terminals has also to be applied to the data communication between a transaction terminal and a bank or credit card branch, and again to the communication of test numbers from the clearing center or bank headquarters from and to the branches. This implies an hierarchical arrangement For the passing on of periodically changing test data in the context of an unpredictable sequence of right and wrong test numbers.
In order to take account of the requirements of an overall secure system the circuitry shown in Figure 1 of the cited patent publication has been improved.
According to the present invention there is provided an electronic fund transfer and da-ta protection system comprising:
a plurality of pcrtable data carriers; a plurality of transaction terminals; self-contained portable storage units for storing security test numbers and a list o-f transaction events data ob-tained from said transaction terminals; computer units with datastorage space for receiving transaction event data from the self-contained portable storage units and for imparting new test numbers thereto; and an originating station where security -test numbers are generate~ and electrically passed to the computer , units via dedicated communication lines.
The invention wiil now be described in more detail, by way of example only, with reference to the accompanying drawings, in which:-Figure 1 is a block diagram of an electronic fund and data transfer system similar to Figure 2 of the above-referenced patent application;
Figure 2 is a more detailed diagram of the system showing

- 2 -the improvemen-ts; and Figure 3 is a survey of the -total sys-tem s-tructure with respect -to the data flow therein.
In Figure 1 A represents a portable data component such as described in Figure 1 of -the above-referenced Paten-t application. The inductive coupling arrangement using coils 2 and 3 and the electrical detail circui-try connec-ted therewith are described in U.K. Patent Application No. 7,931,208.
The transaction control terminal has corresponding 10 coupling coils 2a for the bidirectional transFer of data and 3a for transferring clock pulses and energy to component A. A
clock phase counter and decoder ~ helps di-fferentiate between clock pulses having di fferent roles and timing. In conjunction with a program counter 9 a data multiplex circuit 10 addresses and activates various portions of the circuit at the required times and sequences via internal (microelectronic) wires 19, 14, 15, 16, 17, 18, 20, 21, 41 and 43. For example~ the synchronizing pulses come over wire 41, which ensures that the program counters in A are synchronized with program counter 9. The address or refer-20 ence number which originated in token A is passed to the addressdecode unit 30 via wire 19. The selected tes-t number of unit 31, flanked by one or two wrong test numbers, is clocked out via wire 36 and a current amplifier 6 into the transfer coils 2a, 2 and circuit A. Similarly, debi t data are transferred via wire 43 ! to the data coil 2a. The token circuit's response to the se-quence of right and wrong test numbers is transmitted via wire 16 -to the response evaluator 33. I f the response shows a faulty answer the circuit puts an inhibit signal on the oscillator 7 via wire 43 and a~.so produces a faul ty display via wire 35 on 30 the display section 26. Af-ter the token has been tested satis-factorily the value of the token, or of the selected token account is read out and shown up in store/display section 22. The debit calculator 11 responsive to a debit input 13 calculates the reduced token or account value and siplays it in section 24.
This display must be in agreement with the subsequent readout of the new value from the data token 11 directly, as fully described in the cited patent publication No. 2,057,740. The token is of course also tested against general qualifying data such as a code for the national network within which the electronic fund transfer token has validity or personal membership. This comparison is carried out by circuit blocks 29 and 29a, and if this test is negative the intended transation is rejected.
The buffer store 34 contains the new test numbers offer-ed, for example, via telephone connection to the terminal. This, however, is by way of indication only. It has always been clear that security against arbitrary insertion of test data has to be high, as high as provided for all data exchanges in the system.
Moreover, since the data in memory store 31 constitute variable data it is necessary to ensure that the functionally associated circuitry cannot be by-passed. This is best achieved by inte-grating all the related circuits on a single substrate. These include at the very least the automatic sequencing changer, the response evaluator, the address decoder, and all the multiplexing circuit elements. The transaction memory 63 should be fully encapsulated conjointly with the integrated circuitry. This leads to a separation of Fig. 1 into two sections, B and C, the boundary of B being indicated by the line a - a. This rearrangement is reflected in the diagram Figure 2. Here, A and B are now repre-sented by reactively coupled circuit blocks. Again reactively coupled to this system is now section C in which 31 is the block of registers for the wrong and right test numbers. (Note, even the wrong test numbers have address-enable inputs. These, however, are only used when new test numbers are inserted into block 31 to replace "vacated" test numbers. On such occasions even the wrong numbers are changed at times, for good reason).
Most of the circuit blocks can be recognized as being in Figure 1. The mul-tiplex circuitry, the program counter, and the clock phase decoder had to be duplicated, (lOa, 9a and ~a).
For communicating with a data center such as a bank branch D there are built into block C two further coupling links 2d and 3d which are capable or being coupled ~ith coils 2e and 3e in unit D. D' represents a MODEM whereby C can communicate wlth D via a pair of ordinary telephone lines.
The OR gate 54 can accept input data either from coupl-ing coils 2c or 2d. Similarly 0~ gate 58 accepts clock pulses either from coil 3d or 3c. Simultaneous inputs are inhibited by switches 59, 60 and 53.
The transaction memory 63 stores essential information related to each consecutive transaction individually, such as Account Number of token owner, bank branch code, date and debit amount. In order to read out this record from storage unit 63, certain conditions must be fulfilled. The interrogating computer unit D will check on the qualifying data held in store 51, which also aelivers an address number for the first test number held in store 31. Computer D must then generate the corresponding test number and transfer it to unit C where it is compared in exclusive OR gate 61. This is repeated for each of the four test numbers.
If only one is defective, the bistable 62 latches and inhibits any further processing. This is a safeguard against the transac-tion memory losing its data through an unwarranted readout. After the test and readout steps are carried out there remain further program steps in the program counter. These may be used for pro-viding a mark to existing active numbers whereby tney are trans-ferred to the class of semi-retired numbers for vacating another test number from the last-mentioned group to replace it by an s~3 entirely new -tes-t number, and fina]ly for changing one or -the other of the so-called wrong test numbers so as to elimina-te all ~amiliarity elements from the test number structure. As already indicated, the unit C consists of one or more integrated circuit chips pot-ted in a fully sealed box. A rechargable battery may be integral within the device.
As a rule, the unit C is remo~able from its location within the chassis of unit B, and may be bodily taken to the trader's own bank branch for the purpose of transferring the in-formation contained in storage segment 63 to the computer of thebank branch concerned in order to debit the various accounts of the trader's cus-tomers and to credit the account of the trader concerned. The fact that this procedure provides the opportunity for changiny the variable test numbers is an administrative matter which need not concern the trader.
The transaction list of memory 63 provides space to register for each transaction the account number of the token, the debit, a trasaction sequential number, a serial number for the location of the terminal, and a date. The transaction number is obtained from the to~en A and represents the number of trans-actions carried out with the token up to the momen-t before the next transaction. As the token is checked into sales terminal this number is incremented by 1 and returned to the token, and also passed on to unit C to be added to the transaction informa-tion in store 63.
Figure 2 indicates two stores in the Sales Terminal B, the just-referred-to store receiving from A the current transac-tion number and increasing it by 1. The other store holds the permanent location number identifying the location of the terminal.
These data are passed on to the store 63, but need not necessarily be repeated here for each transaction although further downstream, when transaction data are transferred -to the banks' computers, '7~:~

-they have to be added together with the time informa-tion. All these da-ta are needed Eor a certain amount of automa-tic audi-ting and validity checking in the banks' compu-ters.
The -technlque of the active, semi-active ancl re-tired test numbers can also be used to pro-tect ~le unalterability of the account number.
This is done by providing in-the token for two accoun-t regis-ters, one of which holds -the -true accoun-t number whereas the other holds a func-tion of -the account number ancl the -test number held in the ` -token. A simple case is where -this function is a difference.
If the accoun-t number is called AN and the -tes-t number TN, -the second account store must hold a number "anJ'=AN - TN irrespective of sign. When the -token is checked into a point-of-sale terminal or into an updating terminal bo-th accoun-t numbers are read out and -the difference formed in an arithme-tic circui-t in the termin-al must be equal -to TN. If it is not equal the comparator pro-duces an ou-tput siynal disabling all further opera-tion and pro-viding a visual indication such as "defective account number" or 'token retained for check-up".
Since, as has been described in the above-referred docu-ments, -the test numbers change at irregular intervals, the de-duced AN numbers will also necessarily change over the course of time. ~ potential forger of the accoun-t number will find himself rejec-ted, assuminy he may al-together succeed in incorporating a suitably mul-tiplexed, bu-t nevertheless direc-tly accessable, micro-store for holding account numbers which he may at will vary.
Since, according to the above defined scheme, i-t is not enough Eor the would-be forger to generate an account number differen-t Erorn his own, he must also enter a new AN number which is related -to the test number held in -the token. This test number~ however, is so locked into the circuitry that i-t has no ou-tlet to be read Erom the circuit. ~ot ]cnowing what -this number is, the would-be forger cannot thus eEEectively alter the account number of the token. The only other approach for him would be to -try to moni-tor, if that were at all possible, and this depends partly on the detailed techniques employed in tne data transfer, the transfer means at some point. This would require elaborate apparatus difficult to place at a publicly accessable terminal. At other points these data would be completely inaccessable. Nor could any person be asked what the test numbers are at a given time since they are electronically random-selected by the head quarters computer of the clearing house. They are transmitted in scrambl-ed form to banks and branches all over the country at unpredict-able dates and times and occupy the system lines for only an infinitesimal portion o~ their operating times. The token ter-minals at banks would not permit meddling and would cut even thin wire probes. Open rapid access terminals would incorporate pre-cautions against information tapping, and the opportunities for doing unusual things unobserved would be rare. Whereas one can never exclude one occasion when all the circumstances happen to furthex an unobserved fradulent attempt at discovering the test number, the liklihood that this can be repeated, say week by week, is virtually non-existent. The risk of being observed and apprehended would be greater as bank computers would trace the very first irregularity and also locate the terminal at which it occured. This would make it too unsafe to repeat illegal interference, even if possible. The system of variable test num-bers makes it necessary to monitor them continually.
In summaryl with -the aid of thevariable test numbers technique a forge attempt directed at the account number of the pay token can instantly be reEuted and the intended sale stopped.
Figure 3 shows how new test numbers, which originate at a national bank headquarters or a clearing house center F, are communicated to regional headquarters ~ , and from there to branches D oE the -various banks vla declicated scrambled data lines. The local bank branches, post offices (giro) and credit card agencies pass on any new test numbers to -the cumulatlve transaction box C when checked in physically at their respec-tive terminals or, via phone lines t. When the box C , as would normally be the caserforms part of the point~of-sale termin-als S it passes on to the individual tokens T, when presented to S, -the new test numbers concerned. While, in theory, it might be possible to tap the new test signal while it is being trans-mitted to a data token it is well within the scope of the artto place obstacles in thepath of a person wishing to do that at a public terminal with fraudulent intent.
The cashless value transfer sys-tem described permits the use of permanent electronic tokens while maintaining a high standard of security and versatility. The procurement cost of the ec~uipment is distributed over several agencies. The tokens, being permanent, are issued to the public against registration and an annual membership fee from which the cost of supply and administration can readily be covered. The box C is purchased by the individual trading firms. Banks purchase the terminals and rent them out to traders. Dedica-ted data lines for the trans-mission of inter-bank data already exist, or will shortly exist.
They will only be lightly loaded by the proposed system.
Thus, for example, in the described system, a pay or credit card A may be inductively coupled to a data transfer pro-gramming, processing, and display unit B, which in turn is coupled via inductive coupling links (2b-2c, 3b-3c~ to a third unit C
consisting of most]y miniaturized circuitry such as storage regis-ters 31 for two wrong security check numbers and four right num-bers and auxiliary logic circuitry, and also a transaction listmemory 63. The lat:ter may be constituted as a fully sealed -tape unit with built-in stepping motor and solid-s-tate comparator _ g _ circui-try. The security check numbers are received and Erom time -to time updated via inductive coupling lin]cs (2d-2e, 3d~3e) from a main -transaction office D such as a bank, credit card office, e-tc. During a card -transaction, responsive to a reference number emi-tted by the card, one or more of the righ-t numbers and a wrony number are selected. The automatic sequence chanyer cir-cuit 32 presents -to the card an unpredictable sequence of the selected numbers and then -tests -the card reaction to this inpu-t in a response evaluator circuit 33 . The test and transaction list unit C is optional at a card terminal and is required only a-t ofE-line sta-tions (i.e. for smaller -traders and vendiny machines where separate da-ta lines to banks would not be econorni-cal). Where on-line operation is possible, the bank computer D
performs the check operations of uni-t C. Accordinyly, the bank computer D communicates during day time wi-th cards A via pro-cessors s which belony to on-line terminals, while duriny niyht time and early morning hours the accummulated off-line transac-tions are received from the test and -transaction storaye unit C
~ia a MODEM D' , when also the cyclically required modifica-tion of one of the registers 31 is performed. The ~ank computer D
itself receives from time to time modification instructions for its security check number register via interbank da-ta lines from the bank head office. The head offices of different banks receive similar data from a sinyle random da-ta yenerator or clearing bank director respectively. A card processor for unpredictable sequenae of riyh-t and wrony test numbers is here presented as a complete card da-ta and regional transac-tion transfer security system.

Claims (18)

THE EMBODIMENTS OF THE INVENTION IN WHICH AN EXCLUSIVE
PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS:

1. An electronic fund transfer and data protection system comprising: a plurality of portable data carriers; a plurality of transaction terminals; self-contained portable storage units for storing security test numbers and a list of transaction events data obtained from said transaction terminals; computer units with data storage space for receiving transaction event data from the self-contained portable storage units and for imparting new test numbers thereto; and an originating station where security test numbers are generated and electrically passed to the computer units via dedicated communication lines.

2. An electronic fund transfer and data protection system as claimed in claim 1, wherein the portable data carriers, the transactor terminals, the portable storage units, and the computer units each contain reactive coupling links.

3. An eloctronic fund transfer and data protection system as claimed in claim 1, wherein each portable storage unit incorporates a store for several test numbers, and one of these test numbers is selected by means of a reference address which is transmitted by the portable data carriers, when associated with the transaction terminals, to the associated computer, whereupon the selected test number together with wrong test data is trans-mitted back to the portable doctor carrier via the transaction terminal.

4. An electronic fund and data protection system as claimed in any of claims 1 to 3, wherein the portable data carriers receive the combination of right and wrong test signals and transmit to the self-contained storage unit via the trans-action terminals evaluation signals of said test signals whereupon the storage unit examines said evaluati n by its own evaluation circuit to produce an output voltage which inhibits further pro-cessing if the evaluation by portable data proves to be defec-tive.

5. An electronic fund and data transfer and protec-tion system as claimed in claim 1, wherein the portable storage units have two separate input/output reactive coupling links and portions of the circuitry can be accessed via either of these links, that is to say, either by the transaction terminal, or by the computer terminal through an auxiliary modem, but not through both units simultaneously.

6. An electronic fund transfer and data protection system as in claim 5, wherein inhibit gates are provided to pre-vent simultaneous coupling of the portable storage units to circuits of the transaction terminals and the computer units.

7. An electronic fund transfer and data protection system as in claim 1, further comprising: in the portable storage units, a storage register for storing test number address data and means for transmitting these data to the computer units, in the computer units storage means and addressing means to select one of these numbers for readout by an interrogating station, in the portable storage units means for receiving and comparing such a selected test number with that stored in its said storage re-gister, and means to stop the communication link with the com-puter if said comparison is defective.

8. An electronic fund transfer and data protection system as in claim 7, wherein the data transfer program in the portable storage units permits the readout and subsequent testing of all the test numbers held in its memory against corresponding test numbers held by the computer unit and produced in response to consecutively transmitted addresses sent out by the portable storage units, and means are proved in the portable storage units circuitry to stop the communication link with the computer if any one of the comparison tests fails.

9. An electronic fund transfer and data protection system as in claim 1, further comprising means in the computer units for receiving instructions via dedicated data communica-tion networks for earmarking currently active test numbers as semi-retired test numbers, and of earmarking currently semi-retired test numbers as replaceable by new test numbers, means in the computer units for receiving and storing new test num-bers, means for encoding a semi-retired number and for trans-mitting said code or flag to the portable storage units within the time-multiplex plan of its program cycle, and means for displacing a retired number in the portable storage units stor-age space and for replacing it by said new test number.

10. An electronic fund transfer and data protection system as in claim 9, the computer units being adapted to re-ceive from the portable storage units consecutive transaction lists read out from a transaction list stored in the portable storage units, and inhibit means in the circuit of the portable storage units preventing said readout if the computer response to the test number addresses sent out by the portable storage units is defective.

11. An electronic fund transfer and data protection system as in claim 10, in which said transaction list store contained in the portable storage units consists of a tape deck with stepping motor and that said motor is powered by inductive coupling to data controlled stepping pulses, and which stepping pulses pass through an inhibit gate controlled by a logic sig-nal in the portable storage units.

12. An electronic fund transfer and data protection system as claimed in any of claims 1 to 3, wherein the major part of the circuits of the portable storage units constitute large-scale integrated circuits incorporated in an externally smooth, contactless, and readily transportable, tablet.

13. An electronic fund transfer and data protection system as claimed in claim 1, wherein the portable data carrier contains a store for holding a sequential transaction number which is transferred to the circuit of the transaction terminals where it is incremented by a number x and returned to the data token at a predetermined time slot of the transaction cycle.

14. An electronic data transfer system as in claim 13, wherein provisions are made in the portable storage unit for storing the said transaction number as an adjunct to the par-ticulars of each transaction within the transaction list memory in order to pass it on to the bank computers.

15. An electronic data transfer and data protection system as claimed in claims 13 or 14, wherein the computer units are programmed to compare the transaction numbers of consecutive transactions of the same account number, to reject any particu-lar transaction if the discrepancy exceeds a preset amount, and to initiate a printout of the transaction details for fur-ther action as required.

16. An electronic data transfer and fund protection system, wherein the transaction terminals or the portable stor-age units contain a location code by which its installed loca-tion is recognizable, and means in the computer units to attach this code to the transaction details for each individual fund transfer.

17. An electronic fund transfer and data protection system as claimed in claim 1, in which the portable data car-riers contain two further registers to hold in on register a true account number and in the other register a derived account number, the latter being a function of said true account number and the active test number held in the test number register of the said data carrier, and means for reading out from said data carrier both the true and the derived account numbers and the address code for addressing the corresponding test number regis-ter in the transaction terminal.

18. An electronic fund transfer and data protection system as claimed in claim 1, 16 or 17, further comprising pro-cessing means in the transaction terminals or the self-contained portable storage unit, which, after receiving two account num-bers and the address code from the portable data carrier, gener-ate a function of the interaction of the true account number and the duly addressed test number, comparator means to compare the number resulting from said interaction with the derived account number received from the portable data carrier, and means for disabling and displaying the transaction as disabled if iden-tity is not established by said comparator means.