SE454392B - PROCEDURE FOR MAKING IDENTITY CARDS AND PROCEDURE FOR IDENTIFYING THE HOLDER OF SUCH CARDS - Google Patents

Description

15 20 25 30 35 40 454 392 .v ~ Encryption Standard_Algorithm ", also called" DES "(see also U.S. Patent 4,123,747). A special feature of such coding systems is that the algorithm can be known per se without danger to the system. as long as the code, with which clear-text data is encrypted code-specifically via the algorithm, remains secret.

Therefore, the algorithm can also be obtained in the form of an IC module. For coding of customer-specific data, for example, PAN as well as FIN are entered on the DES module and coded while simultaneously applying a secret information (code). The result of the coding is stored on the card for subsequent comparisons. When such a DES module is available, the security of the system lies in keeping the code secret. If a code becomes known, which when used in the hitherto known systems must necessarily be stored in several places (card-issuing instance, vending machine), all identity cards treated with the code by means of DES modules become available for manipulation in fraudulent purpose. A reduction of the risks would be possible by dividing the issued identity cards into relatively small groups using different codes assigned to each of the groups. The use of a code for a sometimes very limited number of identity cards is nevertheless uneconomical for organizational and technical reasons.

In order to increase security when handling the PIN, it is also known (DOS 29 Ol 521) to make data on the identity card the subject of a two-step coding. For this purpose, a future cardholder is assigned both a PAN and a PIN (see Fig. 1). The latter can also be chosen freely by the customer, for example in the form of a four-digit number. Then a first coding of PAN is performed, whereby the PIN in combination with a first, secret security number serves as a code. A so-called first code number (Y1) is thereby transmitted by a predetermined conversion to a second code number (Y2). When deciphering this second code number, whereby a second secret security number is used as code, a control number (PCN) is obtained, which is stored on the card, for example.

To identify the user, the PAN read from the card is coded using the PIN and the first security number, so that with correct data the first code number (Y1) is obtained. In addition, the control lobster (PCN) read from the card is coded by means of the second security number, so that the second code number (YZ) is thereby obtained. The code numbers must comply with the conversion determined when issuing the card or the personalization thereof determined.

The higher security in relation to the previously mentioned systems is obtained in particular if two different security numbers are used, ie two different codes.

A disadvantage, however, is the additional storage requirements necessary for the second code as well as the associated additional secrecy measures.

This applies in particular to the department-wide offline systems, in which each customer not only has access to the institute's own vending machines but also to other vending machines.

Since all used codes must be stored in each machine, the system's inefficiency increases with the number of assigned machines. Likewise, the risks to the security system grow with the number of assigned machines, as each machine contains all the "secrets" required for manipulating the system.

Against this background, the object of the invention is to provide a system for handling personal identity numbers, which, while maintaining the fundamentally high security of the two-stage coding, improves the efficiency and security of PIN handling. The object is achieved according to the invention by the methods specified in the appended claims.

Despite the high security of the two-step coding, a sound storage need for the machine is obtained by also handling secret information (code) read from the identity card, whereby without special further measures a second code can be assigned to each identity card, thereby further improving the security of the system. .

As will be further demonstrated, the method according to the invention allows in a simple way a distribution of all the secret information on it in the handling of the "levels" participating in the PIN (institution level with issuance of PIN, personalization level with issuance of cards, the automatic level with user identification), without the total information necessary for PIN derivation being available in its entirety at one of the levels.

For the production of the code information on the identity cards, security-technically high-quality methods are used, which make it impossible or difficult to recognize and imitate the information, so that the required efforts, above all from a technical point of view, substantially exceed the profit that can be reached. The method for producing the code on the identity card is optional as long as the above requirements are met. It can be achieved, for example, by applying difficult-to-identify magnetic, electrographic, fluorescent or other substances. Similarly, however, the use of a manufacturing feature specific to the identity card caused by a manufacturing tolerance or also optically coded notes can also be used.

Further developments according to the invention of the method appear from the subclaims.

In the following, an embodiment of the invention is exemplified in the accompanying drawings. In the drawings, Fig. 1 shows a system for handling PIN in accordance with the state of the art, Fig. 2 shows a system for handling PIN according to the invention. ' Fig. 1 shows the handling of the PIN according to the prior art.

The procedure is divided into the procedure step personalization 1 and customer identification 2.

For personalization, a prospective cardholder is assigned a PAN 3 as well as a PIN 4. The latter can be chosen by the customer, for example in the form of a four-digit number. Then a coding of PAN 3 is performed in the first coding module 7, whereby PIN 4 serves as a code in combination with a first secret security number 5. The resulting so-called first code number Yi is transmitted -Q via a predetermined conversion 8 to a second code number YZ . By decrypting this second code number Y2 in the module 10, whereby a second secret security number 11 serves as a code, a control number PCN is obtained, which is for instance stored on the card 12.

To identify the user, the PAN 3 read from the card is coded by means of PIN 9 and the first security number 5, so that with correct data the first code number Yi is obtained again. In addition, the control number PCN read from the card is coded by means of the second secret security number 11 in the module 12 so that the second code number ¥ 2 is thereby obtained. The code numbers Y1 and YZ must comply with the conversion determined when issuing the card and the personalization thereof, which is checked in a comparator 15. As is clear from Fig. 1, both system data, also all secret codes and the like must be used both in the personalization and in the user identification in the machine. available. The risk of disclosure of confidential information or espionage of the data and measures required for the operation of the system is therefore relatively large. Fig. 2 shows an example of a possible embodiment for handling the PIN according to the invention. -H When using the PIN, you can distinguish three procedure levels marked with dotted linesí - institution level 15, in which the customer is assigned the corresponding customer data PAN, - personalization level 16, in which the identity card is provided with all necessary customer and bank data, - automatic level 17, in which the identity card data is read and checked for their conformity with the printed PIN.

Appropriately, the card issuing institution undertakes to assign the customer-specific data PAN 18 to the prospective cardholder.

PIN 19, for example a four-digit number, the customer can conveniently choose himself. The PIN 19 as well as PAN 18 selected by the customer and known only to him is transferred to the algorithm module 20 and converted therein by means of a first secret code, generated in a code store 21, to an intermediate value ZW. The intermediate value ZH and the corresponding customer-related data PAN are stored on a magnetic tape 22.

The magnetic tapes produced by the individual institutes are transferred for final production of the identity cards 23 to the central personalization bodies 16. Here, magnetic tape data is read and entered into the algorithm module 24, which can be constructed as the module 20. However, the second data manipulation code is obtained here from a secret card information, indicated by the dashed surface 7, by means of a reading head 28 connected to the code reader 25.

The coding result, the code number SZ, is stored together with the customer-related data PAN, for example on the magnetic track 26 of the card 23.

For user identification 17, the customer enters his secret PIN 19 in the machine via a keyboard. The PIN is coded together with the PANs read from the card during the supply of the first secret code from the code store 21. The result is immediately supplied to a second algorithm module 24 and is coded during the supply of the second secret code, which is recovered from the identity card 23 by means of a code reader 25 and the reading head 28, respectively, in the correct sequence, the result of the double coding corresponds to the code number SZ stored on the magnetic track 26. The comparator 27 emits a yes signal, which is either connected to an optical pointer or is connected to the electronics of the apparatus, which by means of corresponding electronic signals shows the control result and thus enables the corresponding further procedure. steps are initiated such as issuing the desired credit amount.

The system modules that must be secured against unauthorized access are indicated at all three procedure levels by means of a hatch. As already indicated and as illustrated by method method 1 'Fig. 2, the relevant information necessary for deriving m: is not directly available at any of the levels.

This fact in combination with the use of a coding procedure in two steps, whereby one of the codes is produced by a secret, eg card-specific property, enables a security-technically high-quality and economical system for handling PINs.

To ensure that the connecting line between the read head 28 and the signal evaluation module 25 can not be played, in the practical embodiment of the device, the read head 28 and the module 25 are jointly arranged in a sealed cover, into which the identity card can be inserted through an input slot.

As already mentioned, there are a series of methods by which identity cards can be provided with code information which cannot be spied on or imitated.

Thus, for example, U.S. Patent No. 3,620,590 discloses a holographic method for securing information against unauthorized access. In addition, the desired information is transmitted in an optically coded state via a special filter (Master-Code-Filter) on a hologram located in an identity card. The encoded information can only be reconstructed using a Master Code Filter. The filter is secured as part of the reading device against unauthorized use.

All methods of information production, the composition of which can only be reconstructed by a fraudster with special, unavailable aids and only with special expertise, are useful within the scope of the invention.

In analogy to the above-mentioned examples, it is also possible to provide, for example, the identity card with magnetic or also with fluorescent patterns, the information content of which can only be detected by means of special, not generally available means and corresponding specialist knowledge.

In the described embodiments, for ease of understanding, in the two coding steps, the same coding principle has been chosen 45.4 392 (NBS Data Encryption Standard Algorithm). However, there are a number of other coding methods which can also be applied within the scope of the invention. It is also possible to use different algorithms in the two steps. Irrespective of the actual coding principle, the essence of the invention, as mentioned above, lies rather in the fact that the coding is carried out in two steps in geographically different places and that a secret, card-specific information is involved in the coding process.

Claims (7)

l0 l5 20 25 30 35 PATENT REQUIREMENTS A method for producing identity cards, which are carriers of machine-readable data, each cardholder being assigned a personal identification number (PIN), which together with customer-related data is encrypted in a two-step process for applying customer-related data to the identity card, characterized in that the personal identification number (PIN) in a first coding step is processed to an intermediate value (ZW), and that the intermediate value (ZW) in a second coding step, independent of the first coding step, is processed using a from the identity card reads secret information, to a code number (SZ), which is stored on the identity card. _ 2. A method according to claim 1, characterized in that the first and the second coding operation are performed at spaced apart locations. Method according to claim 2, characterized in that the first coding operation is performed locally at the various card issuing institutes. Method according to claim 2 or 3, characterized in that the second coding operation is performed centrally at the card personalization institution. Method according to claims 1 to 4, characterized in that the secret information obtained from the identity card is generated from a card-specific feature. Method according to claim 5, characterized in that said feature is formed by means of a holographic, magnetically fluorescent or conductive code pattern. Method for identifying the holder of an identity card according to claim 1 in a control device, characterized in that the personal identification number (PIN) entered by the card holder in the control device together with customer-related data read from the identity card is processed to an intermediate value. (ZW), after which 10 15 20 25 30 ~ 35 9 ih Åsïl ': S92 this intermediate value together with customer-related data using a secret information read from the identity card is transferred to a code number (SZ), after which finally this code number is checked with respect to in accordance with the code number stored on the identity card.