DE2738113A1 - Processing device for banking operations - Google Patents

Abstract

The banking operations involved include delivery or reception or objects, and opening or closing or locks. An identification card, such as credit card cheque card etc., is inserted into an automatic testing device, and has a mark, e.g. a number, individually allocated to the owner.This number is checked by the automatic device before the required process is released. The mark (14) is produced in the form of an integrated circuit, and the testing device (10) is mounted on the card (1) so that the mark is available only in the identification card

Description

Device for performing machining operations with a

identifiers which can be entered into a receiving device of the device The invention relates to a device for performing machining operations, such as banking services, such as issuing and / or entering objects and how the opening of locks, with one in a receiving device of the device, such as a machine and / or a test device, identifiers that can be entered (credit card, Check card, machine card or the like), which has a feature memory, in which a personal one assigned only to the rightful owner of the identifier Feature, e.g. B. a number, is saved with an in the device inputtable feature to the existence of a predetermined relationship Can be checked by means of a Pitfeinrichtung to the processing operation of the device to release.

The invention is not limited to the card form; she can also z. B. be carried out with a key. In the following, therefore, the general expression identifier used. In such devices there is the task of slashing the identifier against misuse and counterfeiting, for what purpose a lot of suggestions have already been made.

For example, known cash dispensing systems use e.g. B. the account number as Identification marks and, as protection, a personal identification number that is included in any Allocation to the account number is available. When using the machine, the customer must then use the machine card into the machine and key in his personal number so that the Authorization can be checked. However, it cannot be checked whether there has been manipulation were made; this makes it easy for a potential fraudster to grant cards falsify when he decrypts the allocation criterion between account numbers and reference numbers Has. The decryption of known machine cards is made easier by that the personal number entered in the identifier can be determined from the outside is, be it visual or machine, be it encrypted or entered in plain text.

The identifiers often contain even more that the fraudster discourages Dai; en, namely employment conditions. These conditions include e.g. B. temporal and / or quantitative restrictions imposed by the authorized cardholder, but also the amount can easily change in his favor, especially if these dates are entered in a magnetic strip on the card.

From the extensive prior art that deals with the increase The security of such devices is concerned with abuse nT-o) 19 45 777, U.S. Patents 3,891,830, 3,868,057, 3,934 122, 7,702,464 and GB-PS 1 197 183.

However, all machine cards known as a result have the disadvantage that the personal index number - although not always easy - is determined, d. H.

can be deciphered and that it can also be deciphered by an authorized person Owner, e.g. B. by falsifying the terms of use, misused can.

This also applies to a generic device from the DT-OS 25 12 902 or 25 12 935 known type, in which the feature memory in the identifier and the feature checking device is included in the identifier receiving device is. Because there the stored feature from the identifier must be transferred to the receiving device Are transferred and is therefore easily accessible from the outside between the two parts.

The invention is therefore based on the object of an abuse and forgery-proof device of the generic type to indicate which the the disadvantages inherent in the prior art do not adhere and the use the identifiers for both automatic and non-automatic use allowed.

The solution according to the invention and advantageous embodiments of this Solution result from the claims.

Thereafter, the basic idea of the invention is a part or all of the data to be included in the identifier that is protected against misuse are to be stored in memory that is only loaded once and cannot be changed and the content of which cannot be ascertained from the outside. To deal with these identifiers To be able to work, further memories and resources are provided in the identifier, to externally entered data with the stored and within the identifier to be able to compare readable data, e.g. B.

for the purpose of identity and authorization checks. With identifiers memory and switching means are also provided for operating machines, which allow communication with the machine.

There are known memories that are only written to once and which cannot be deleted, but these memories can and must be externally be legible; (See U.S. Patent 3,702,464, ROS memory).

Since, according to the invention, the data protected in the identifiers are not can be determined from the outside, no further secrecy is required. The potential fraudster could know all the details of the device and then but do not break into the system successfully or take advantage of it.

Since the invention requires a number of memories and control circuits, it is advisable to combine all these parts in an integrated circuit (IC). Integrated circuits also increase the security against manipulation the identifiers themselves, since it will hardly be possible for a cheating to get an IC to research and reproduce with reasonable effort.

According to a development of the invention it is ensured that also in the so-called initialization, d. H. when assigning a neutral identifier to a customer by registered mail with the account number and personal reference number, no abuse is possible. For this purpose, a protection code is required during manufacture in the Identifiers introduced only under special conditions and only one Times can be read. Another essential feature of the invention is in that the customer can then also choose his personal key number completely freely, and that this number is then completely independent of other data of the identifier can be.

The invention has a number of advantages over the known Systems and cards. In the new device, both conventional and ATM cards can also be used. Furthermore, both an abuse by legitimate Cardholders as well as by unauthorized persons in terms of changes to the terms of use and / or the usage data is impossible. As the user freely selects his own number determined, no special precautions are taken to keep key numbers secret necessary.

Further features and advantages of the invention emerge from the claims and the following description of an exemplary embodiment in which, as an identifier a machine card is used. It shows: 1 shows an identifier; FIG. 2 shows an IC of the identifier according to FIG. 1; FIG. FIG. 3 is an enlarged one compared to FIG. 2 IC; 4 and 5 exemplary embodiments of simple test devices; Fig. 6 is a functional diagram the verification of identifiers; FIG. 7 shows a block diagram of a machine and FIG. 8 the functional sequence of the machine according to FIG. 7.

Fig. 1 shows an identifier 1, as a credit card or Eurocheque card is trained. It contains a name field 2 of the cardholder, a field 3 for the identification or account number in plain text, a photo field 4 and a Signature field 5. Field 3 is provided parallel to a narrow side so the account number remains legible from the outside when the card is inserted into the checking device is.

The card also includes an integrated circuit (IC) 6 with a Terminal strip 7 for the supply voltage and data input and output. Of the IC is invisibly implanted in the card.

A certain area 8 surrounding the IC is made of conductive materials kept free so that when the card is used it can be checked in a machine, whether there are connection lines from simulation circuits outside of a machine to the card in the machine. Since the total forgery of a card with a identical IC due to the excessively high economic / know-how / risk threshold can be assumed to be excluded, this measure prevents that a deceiver, provided him would be how the IC known to build an equivalent circuit from discrete components and this circuit z. B.

Connects via wires to a card that acts as an adapter for this purpose.

The machine also checks whether other types of connections are made via the Environment are made to the outside.

Fig. 2 shows a block diagram of the IC 6. All shown individually Parts are actually integrated into a single circuit. The supply of the IC with power and the inputs and outputs for data run via a Contact strip 9. This contact strip can either be galvanic contacts or z. B. also have an inductive coupling loop. When coupling data and the power is supplied via an inductive loop, contains the contact strip 9 also the converters required for this.

The IC contains a central unit 10. This central unit is a special microprocessor that works with a built-in program from a program memory 11 works. The central unit 10 and the program memory 11 can be in another Embodiment also as hard-wired logic within an integrated circuit be trained.

Power is supplied via an integrated power supply unit 12, in which the supply voltage fed in from the outside into that for the central unit 10 necessary values is converted. There must always be such a high power supply from the outside be made available that a programming part 19 of the IC is able to To program data memory 13 ... 17. In the supply part 12 it is therefore checked, whether the supply voltage is high enough to always operate the central unit 10 to be able to, and whether they are with embodiments of the card, which upon detection of abuse provide for a self-destruction of the IC, also sufficient for the destruction of the IC is. When the supply voltage increases is low, that works IC not. The self-destruct device of the IC can, for example, be reprogrammed of a gate 24 can be verified. Usually this gate stays open all the time and the conditions of use can be read out from the memory 16. If during the Identification verification, a permanent blocking of this identifier is required is, the gate 24 is locked and there are no longer any conditions of use readable.

The central unit works z. B. only if conditions of use can be read.

This self-destruction can be triggered by the card itself are, by appropriate control of the program memory 11, as well as by a Trigger signal from outside.

This trigger signal can be generated by the machine in the case of machine cards if additional tests in the machine make destruction necessary.

All data input and output take place via an input / output unit 18. The central unit 10 is able to program all of the previously described Perform functions. If the supply voltage is applied externally, it runs the microprocessor of the central unit 10 by itself and checks first, whether the supply voltage is large enough.

The central unit 10 then becomes wbiteren functions via data inputs caused. The functions that can run are described below. the Output of feedback after checking an entered personal number and other information is provided via the input / output unit 18.

All parts of the IC described so far are used during manufacture of the IC integrated into a rope. The data memories 13 ... 17 that are also required are PROM memories and can be used in whole or in part during the manufacturing process either integrated in the aforementioned IC or designed as a separate memory IC be.

In this PROM memory are described in individual steps below different dates are written in at different times, and one neutral generated a specific identification card. The data memories 13 ... 17 are treated differently. Some memories can only be programmed via gates 20 ... 24. These programming lock circuits can be disabled so that none further changes to the memory contents are subsequently possible. The data storage are also different in terms of their legibility; d. H. only some predetermined memories can be read from outside the card, others not. which Parts of when and why are programmable or readable is explained below.

As already stated, the data storage part of the IC contains the memories 13 ... 17.

The memory 13 in which a protection code to protect the card on the Away from the factory to the issuing point is only programmable, as long as gate 20 is in operation and can only be read internally via gate 21.

The memory 14 is used to store the personal note number that can only be enrolled when the gate 22 is in function. The number can not read from the card, but only stored in the central unit 10 where it is available for comparison purposes.

The memory 15 is used to hold data for identification of the respective card or account holder.

The account number or any other bank account number is stored in this memory others - also alpha-numeric - used to identify the account holder Specification registered. Only after this programming is the identifier a Assigned to customers. The memory 15 can only be programmed as long as the gate 23 is in function. After programming, gate 23 will be destroyed. The memory 15 then remains readable for the central unit 10.

The memory 16 is used to record conditions of use, such as z. B. Period length, period limit, daily limit. These data can only be used when outputting the card, d. H. initialization, via the gate 24.

In the memory 17, the data are stored for each operation, such as date, number of unsuccessful attempts to enter your personal memo number, account activity Etc..

In the following, the initialization and the Use of the card described using the example of a card for monetary applications.

After the last step in the production of the card, a Protection code generated as a numerical term in a random generator and stored in the Memory 13 written in. At the same time this protection code is on a separate Document posted, after the storage, the gate 20 is destroyed, so that a change the protection code or the writing of another code number in the memory 13 is no longer possible. The receipt is automatically generated under confidentiality conditions inserted into an envelope and finally sealed the envelope. The map and the envelope will then be given a visually readable, identical identifier, e.g. B. the same serial number. The cards thus provided with a protection code and Envelopes are brought separately to the issuing institute and separated there stored and managed. Up to this point the cards are still neutral. When issuing a card to a customer becomes the neutral card in question with the same consecutive number-bearing document merged.

Then the envelope is opened, preferably by the customer himself, and the visually readable protection code removed.

The card is then inserted into the input device at the issuing institute introduced to write the customer-specific data into the card. For this the read protection code number is first keyed in and via the input / Output unit 18 is stored in the central unit 10 of the card, where a comparison takes place with the protection code number stored in the memory 13. Is the Comparison negative, then after a specified number of negative attempts, causes the IC to self-destruct.

If the comparison is positive, the IC gives an enable signal the input device, so that further data can then be entered.

First, the customer feels the personal choice he has chosen Note number secret, which is then transferred back to the central unit 10 and from is stored there in the memory 14. After saving, the gate will be 22 automatically destroyed so that the personal number can no longer be changed can.

The institute then uses the identification of the customer used data entered. So is in the memory 15 z. B. the account number of the Customers stored and then automatically destroyed the gate 23, so that this too Data can no longer be changed.

The usage regulations are stored in the memory 16, and then the gate 24 is automatically destroyed.

Finally, the initial account balance can be stored in the memory 17 will.

After these stores have been made, the output gate 21 of the memory 15 is destroyed, so the card cannot be used a second time by means of the brewed protection codes can be initialized, as a check of this protection code is no longer possible.

The card prepared in this way is given to the customer.

Should a card be made valid again after its expiry date can be used, then other protection codes are used, which are treated as above will; accordingly, the memory 13 with the gates 20 and 21 is provided several times.

This is shown in Fig. 3, which opposes the corresponding extensions of FIG. 2. As you can see, the memories are for the protection code and for multiple accounts with the assigned goals are planned.

When the previously described period for a card has expired or the customer goes to his bank with the card. at in addition to the previously described first protection code from from the start a second, third, etc. protection code in further locked and sealed ones Envelopes must be kept. The card is now - as with the first protection code written - reinitialized after entering the second protection code.

During this initialization, the gate 26 is destroyed, so that in the first account memory 17 no more data can be written.

In addition, the gate 30 is now through a special programming opened, so that the account management is now carried out via "Account-2", memory 29.

The gates 27 and 28 correspond in their function to the gates 20 and 21, the protection code memory 41, the protection code memory 13.

The second and many other protection code memories are used during manufacture (last step) with the protection code "2" (resp.

"3" etc.) programmed.

This extension to further protection codes and further account storage leads to a longer service life and better utilization of the electronic parts the map.

To use the card, it is inserted into the corresponding test device or the corresponding machine introduced, where initially within the identifier it is checked whether the supply voltage has the required level, in particular for a possibly necessary self-destruction of the IC.

The user is checked for his or her owner identity by Enter the personal key number and compare it with the saved key number in the central unit 10. The personal number can therefore not be read externally. If the result is positive, the account number can next be checked while the IC is automatically destroyed on the nth unsuccessful attempt. In addition, the number any unsuccessful attempts are entered in the card.

To check the account number, this can be done with conventional cards Visibly applied to the outside of the card so that it can be read and inserted into a tester can be keyed in.

The check takes place again in the IC of the card itself.

In this test, an alarm is triggered after the nth unsuccessful attempt, because you can then assume that the account number on the card was changed, e.g. B.

to charge another account. Here too will the number of possible unsuccessful attempts is noted on the card.

Additionally and / or in combination with the tests described above Further test measures are taken that identify such a training of the function and / or memory circuits require that they be used with commercially available, that is, circuits not specially manufactured for the purpose according to the invention can be represented.

This prevents fraud with commercial counterfeits Circuits accommodated by identifiers generate a "good" signal without the aforementioned additional tests have taken place beforehand.

After these tests, the actual operation can now take place, z. B. the money issue can be initiated. If this operation is prohibited, e.g. B. because the spending limit is exceeded, d. H. too much money has been requested the customer automatically receives a corresponding note. Checking whether a transaction is allowed, takes place in the central unit 10. If the account number is also from the Card should be readable in the machine, the program memory 11 may have the appropriate Program included.

The account management takes place in the memory 17, namely all Processes saved one after the other, with readout possible at any time. There the old account balances cannot be deleted during account movements, the entire history of the account is available. Bank statements can also be used in this way of the map.

The invention is neither based on the example of banking transactions limited to the use of card-shaped identifiers. So can the access to protected areas is also protected by the new system be that only selected people who deal with a genuine, valid and unadulterated Show identifiers as authorized holders of the identifier, access granted will.

Furthermore, the identifiers can only be used as authorized recognized persons have access to facilities or their dedicated commissioning to allow the storage or retrieval of information (data).

It is particularly advantageous that usage conditions that can be stored in an unchangeable manner even in off-line operation all possible applications give the user a predeterminable one Allocate leeway.

4 and 5 are two exemplary embodiments of a receiving device in the form of simple test devices A1, A2 for checking the Eurocheque or credit card trained identifiers explained. These simplified test devices are used for Verification of the user / owner identity, and to check whether the externally imprinted Account number has been changed and they are used to verify the authenticity of the Card by using the two aforementioned tests to determine whether the required IC is present in the card.

Both embodiments differ only in one shown in FIG. 4 existing numerical display field 31, which is used to compare the identification / account numbers display the number automatically read from the card so that they can be visually identified the number 3 on the outside of card 1 can be compared.

In the embodiment according to FIG. 5, this display field is not included. The exam, d. H. the comparison of the externally applied number, which here has a Keyboard 32 is keyed in, takes place inside the card by means of the IC 6.

The IC outputs a signal based on the result of the comparison the tester that displays either "Approved" or "Correct" in a box 33 or "alarm" or incorrect "in a field 34 causes.

The displays in fields 33 and 34 are used in the same way Comparison of the personal score. A switch 35 is used to start the Device, while a delete key 36 to terminate a partial test and to delete of incorrect entries.

Even with this type of (simple) ID check, there is in principle a Self-destruction of the IC after a predetermined number of unsuccessful attempts at the Enter your personal identification number and, if necessary, identification / account number possible.

For such a self-destruction, the necessary one is in the test device electrical power provided.

In FIG. 6, according to the function of FIGS. 4 and 4 explained above. 5 is a self-explanatory functional diagram of the checking of identifiers in conventional Credit / Eurocheque cards or in corresponding non-machine applications.

In Fig. 7 is a block diagram and in Fig. 8 the functional sequence is a Recording device A3 reproduced in the form of a machine, which is also used to effect is suitable for account management in the identifier.

As a test device, the machine contains a reading part 37 into which the identification 1 can be introduced. The reading part is able to read the identifiers to be supplied with power and to send data to and from the identifier receive. The machine is controlled by the central unit 10 with the program memory 11, which to simplify the representation outside of the identifier are shown. Data is entered via a built-in Keypad 38. During the test, notices and alarms can be sent out and after a passed test, a release signal is given to the functional part of the machine to initiate the corresponding transaction.

In addition to the account management in the identifier, such a machine the data are stored in a data memory 39. This data store is either exchanged at regular intervals and transferred to the IT system in a central office or queried from the central EDP in the case of on-line operation.

The machine also contains a test device 40, with which it is determined whether from the point in the identifier where the IC is arranged, there are connections to the outside of the reading part or the machine. Here the system is supposed to be secured against lawbreakers who affect the functional complex of the IC in the identifier by means of a simulation circuit made up of discrete components want to replace outside the identifier.

The identifier can also be retained.

The arrangement for introducing the identifier into an automaton can be designed so that after the introduction or insertion of the identifier by the user to close a flap or a lid manually by the user or the flap or lid will be closed automatically. Flap or Lids are designed in such a way that they may lead from the identifier to the outside Interrupt connecting lines of any kind by the closing process, e.g. B. cut off, and that they also have the identifier in the machine in the Cooperation with a firmly attached to the identifier reading part of the machine Shielding against non-wire-dependent connections, e.g. B. electromagnetic or mechanical Waves, shield. The closure is designed so that the functions of the machine only when the flap or cover is completely closed expire and are interrupted when opening.

The further check is initially carried out in a similar way to the simplified one Test device according to FIGS. 4 and 5, by entering the personal reference number will. The personal number is transferred to the identifier and within of the identifier checked for agreement.

Only one signal comes back from the identifier, with the agreement or mismatch is displayed.

If the personal reference number is entered incorrectly, a will follow Note. The entry can be repeated a maximum of n times.

In practice, n is usually the number of three attempts chosen. After the nth entry, a failed attempt counter that can also be formed in the identifier, output an alarm signal, the IC electrically destroyed in identifiers and a reference to in the identifier the unsuccessful attempts entered.

If the personal reference number was entered correctly, you can then the data of the data memory are output from the identificand, which are used for identification of the user are necessary. The usage data and account data are also used read and stored in the machine. After this data from the identificand have been read, the desired transaction can be entered in the car data will.

With the help of the terms of use and / or the usage data checked whether the desired transaction is allowed. If the transaction is not allowed, a note can be issued and a changed transition request got to can be entered. If the transaction is found to be allowed, the next is Step initiates the account update in the identifier, and also the transaction data recorded in the machine and / or for evaluation in the Transfer to EDP center. A release signal is then issued from the test part of the Machine, and the transaction is carried out.

In the case of off-line operation, the data memory is used at certain time intervals exchanged for an empty data memory, and the written data is brought to the IT center for evaluation. In the IT center there is then a Update of the accounts of the owners of the identifiers so that the head office in Dependency on the change rhythm of the data memory in the transaction machine the Can hold accounts à jour.

The individual elements of the device described, such as identifiers, Input coding device, test device and automat can also be used in other devices. For these elements, element protection is therefore also provided in accordance with the relevant Claims desired.

L e r s e i t e

Claims (20)

Claims 0 device for performing machining operations, such as banking services, such as the issuing and / or entering of Gogenstãände and how the opening of locks, with one in a receiving device of the device, such as a car data and / or a test device, identifiers that can be entered (credit card, Check card, ATM card or the like), which has a feature memory, in which a personal assigned only to the rightful owner of the identifier Feature, e.g. B. a reference number is stored with a in the device enterable characteristic on the presence of a predetermined relationship iittdb a The test facility can be checked in order to approve the processing operation of the device, characterized in that the feature memory (14) can only be loaded once and the Checking device (10) for the stored feature only ii identifiers (1) available to hold, ii identifiers (t) is arranged. 2. Device according to claim 1, wherein the identifier is visual and / or contains machine-readable identification, authorization and / or processing data, at least some of which are stored in memories provided in identifiers themselves stored fl, and in which an authorization check can be carried out, where the identifier rit the receiving device via a corresponding. Input / output device cooperates, characterized in that further memories in the identifiers (15, 16) iUr the identity and authorization data as well as facilities for implementation the identity and authorization checks are provided. 3. Apparatus according to claim 1 or 2, characterized in that the identifier contains a central unit (10), which in turn has a microprocessor has, from which the storage and processing operations can be controlled and carried out are. 4. Device according to one of claims 1 to 3, characterized in that that the identifier has a control electronics as a central unit (10) in which the programs are contained in hardwired logic. 5. Device according to one of claims 1 to 4, characterized in that that on the input side of the or each memory (14; 15; 16) a gate (22; 23; 24) is provided, which can be destroyed automatically due to the first storage is. 6. Device according to one of claims 1 to 5, characterized in that that the identifier (1) a further memory (13) for a protection code and a Comparator (10) shows that the contents of the protection code memory through the comparator (13) with one which can be fed to the comparator (10) via an input device (18, 38) Protection code comparable and, in the event of a positive comparison, an enable signal for writing into the feature memory (14) and, if necessary, the implementation of further processing operations can be triggered. 7. Apparatus according to claim 6, characterized in that the storage gate (20) and the storage gate (21) of the protection code memory (13) after the first input or withdrawal process are automatically destructible. 8. Apparatus according to claim 6 or 7, characterized in that the identifier several parallel protection code memories (13, 41) with associated Gates (20, 21, 27, 28) and other parallel memories (17, 29) with associated Has gates (26, 30), each of which has one of the protection code Storage (13, 41) is assigned and their access by the enable signal of the assigned Protection code memory can be released. 9. Device according to one of claims 1 to 8, characterized in that that the storage and processing facilities of the identifier in integrated Circuit technology are formed. 10. Device according to one of claims 1 to 9, in which the circuit device of the Identi fikanden within a predetermined range of the Identi fikanden is housed, characterized in that the receiving device (A3) a Checking device (40), the presence outside of the predetermined Responds to the range of running signal transmission connections. 11. The device according to claim 10, characterized in that the Response of the test device (40) in the receiving device (A3) destruction of the storage and processing facilities in the identifier or a interrupts further clearance testing in the receiving device (A3). 12. Device according to one of claims 1 to 11, characterized in that that a reading part (37) of the external device (A3) against wireless connections, z. B. electromagnetic or mechanical waves, between the one in the receiving device Introduced sound identifiers and the environment of the reading part is shielded. 13. Device according to one of claims t to 12, characterized in that that a reading part (37) of the receiving device () has a locking device, e.g. B. a flap, a lid or a sliding gate, by the closing process after the identification has been introduced, this may lead to the outside world Connecting lines are interruptible. 14. Device according to one of claims 1 to 13, characterized in that that the storage and processing facilities of the identifier are covered by protective coatings against electromagnetic waves, e.g. B. UV or X-rays are protected. 15. Device according to one of claims 1 to 14, characterized in that that the circuits are arranged in the identifier in such a way that the Storage and processing facilities when opening the identifiers or when Peeling layers are destroyed. 16. Device according to one of claims 1 to 15, characterized in that that the storage and processing device of the identifier in the event of non-compliance6 defined test criteria can be automatically deactivated. 17. Device according to one of claims 1 to 16, characterized in that that by a storage and processing device of the identifier in the event of non-compliance of test criteria during use a predetermined signal to a recording device (A1;; A3) can be lifted. 18. The device according to claim 17, characterized in that the Receiving device (A1; ~ A3) has means by which upon receipt of the predetermined Signals the storage and / or processing device of the identifier except Function is settable. 19. Device according to one of claims 1 to 18, characterized in that that a failed attempt metering device is provided through which after n-times, preferably Entering the feature incorrectly three times prevents the release signal from being omitted is. 20. Device according to claim 19, characterized in that the claß Failure of the counter device after incorrect entry of the attribute n times destroyed of the storage and processing facilities in the identifier.