 |
Description  |
|
|
FIELD OF INVENTION
The invention relates to an automated transaction system which receives
with a user card having a microprocessor for executing secure transactions
in which an article or item of value is dispensed from a terminal, and an
account balance stored in the card's memory is debited. In particular, the
invention is applied to a postage transaction system in which a postage
account is maintained within the microprocessor card and is used in
transactions with postage printing and metering terminals.
BACKGROUND OF INVENTION
Point-of-sale (POS) terminals and automated teller machines (ATM) have been
widely used in conjunction with various types of cards issued to users for
sale or credit transactions. For example, banks regularly issue account
cards which have a magnetically coded number stored on a stripe for
accessing the user's account through ATM terminals. Credit cards which
have coded magnetic stripes are inserted in ATM or POS terminals to access
a central account system for authorization of a credit transaction. There
also have been proposals to use cards which have large non-volatile
memories, e.g. magnetic, integrated circuit (IC), or optical memory
storage, for storing and retrieving information specific to the user, such
as a medical history, biographical history, maintenance of an account
balance and transaction history, etc.
These conventional systems generally employ a card which has a passive
memory that is read in a card reader or computerized terminal maintained
by a vendor. The security of the cards is problematic since most account
cards used conventionally are passive and do not authenticate themselves
or the particular transactions for which they are used. Instead, on-line
access through a terminal to a central account system, such as bank or
credit card account records, is required for confirmation of each
transaction. This requirement places an access time and cost burden on
vendors, such as bank branches and retail stores, which must maintain the
terminal facilities, as well as on the operator of the central account
system, which must provide sufficient on-line access for all the users of
the system and ensure the security of the entire system.
By comparison, off-line transactions, i.e. between a user with an
authorized card and a terminal not connected to a central account system,
have the advantage that the vendor does not have to confirm each
transaction. A card bearer merely inserts the card in a terminal to pay
for a purchase and the authorized amount of the card is debited for the
amount of the transaction. In off-line transactions, the vendor's
responsibility can be reduced and the transaction process simplified, so
that a transaction can be completely automated through the use of widely
distributed user cards and automated terminals.
However, off-line transactions are more vulnerable to the use of
counterfeit cards and to tampering with the terminals. Thus, the cards
have to be made secure and the transactions limited to small amounts. As
an example of conventional card security measures, a memory card can be
divided into a number of separately validatable sectors of limited value
which are irreversibly debited with each transaction, as disclosed in U.S.
Pat. Nos. 4,204,113 and 4,256,955 to Giraud et al. A personal
identification number (PIN) can be written into the card's memory at the
time of issuance and requested of the user with each transaction.
Terminals are generally made secure by maintaining them in areas to which
access is restricted or supervised. However, these requirements increase
the cost of operating the system and at the same time decrease its
utility.
The sophistication of card counterfeiting and credit fraud has increased
with the widespread use of account and credit cards, and even greater
security measures are currently needed to ensure the validity of card
transactions. Conventional microprocessor cards employ resident programs
to control access to data stored on the card, store a selected user PIN to
confirm an authorized user, and prevent use of the card if an unauthorized
user is detected, such as after a limited number of incorrect PIN entries.
Although such microprocessor cards provide greater security than passive
cards, the overall system is still vulnerable in that, once a valid user's
PIN has been ascertained, a stolen card can be used for unauthorized
transactions in any terminal, and the terminals themselves are subject to
penetration. These vulnerabilities can be offset by limiting the
authorized amount of the card, controlling access to the terminals, or
requiring on-line confirmation of transactions. However, such measures
again increase the cost of the system and decrease its utility.
One potential area of application of automated systems employing account or
credit cards is in postage vending and metering machines. Purchases of
postage and mailing transactions are made primarily in person with cash
through tellers at post offices. Only limited types of postage stamps can
be purchased from public vending machines. Most private postage metering
machines have limited operational features and must have their metering
devices removed periodically to a post office for refilling. The size and
weight of the metering devices make them inconvenient to carry. Some
metering systems can be refilled by a remote computer, but the caller must
still phone the computer center and execute the operator's instructions on
the postage meter manually.
The elimination of cash purchases, in-person mailing transactions,
unnecessary limitations on automated postal services, and physical
refilling of postage metering machines could greatly reduce the waiting
lines at post offices and facilitate the wider dissemination of postage
vending and metering machines for the convenience of users and provide
greater access to postal services. The use of account or credit cards for
automated postal machines has been considered. However, the security
problems of conventional card automated systems would require that user
cards be validated only for relatively small amounts of prepaid postage,
that vending and metering machines provide limited postal products and be
refilled with limited total postage amounts, and that access to the
machines be strictly controlled. These restrictions are a substantial
obstacle which contribute to the difficulty of implementing an automated
postal transaction system.
SUMMARY OF INVENTION
In view of the foregoing disadvantages and problems of conventional
systems, it is a primary purpose of the invention to provide an automated
transaction system which has security features that will facilitate the
widespread use of account or credit cards for off-line transactions and
the dissemination of automated transaction terminals to which access does
not have to be strictly controlled. A principal object of the invention is
to provide an interactive card/terminal system in which the card and the
terminal each have a security feature which prevents the completion of a
requested transaction unless a secure handshake recognition procedure is
mutually executed between the card and the terminal such that they each
recognize the other as authorized to execute a transaction. In particular,
it is desired that the card and the terminal cooperate together to execute
a simultaneous dispensing of value by the terminal and debiting of an
authorized balance by the card.
A specific object of the invention is to apply the above-mentioned
automated transaction system to postage metering machines. A further
object is to provide a new generation of card automated postal terminals
which have greater flexibility in the range of postal products and
services offered, wherein the terminals are individually secure and can be
accessed in relatively unrestricted areas, and the cards can be refilled
at any desired location through secure refilling terminals validated by
the issuer.
In accordance with the purposes and objects of the invention, a card
automated transaction system employs a card having a secure, resident
microprocessor which operates to confirm that a requested transaction is
authorized and to then initiate an interactive handshake recognition
procedure with a resident microprocessor in the value dispensing section
of an automated terminal. Upon successful completion of the handshake
procedure, the card microprocessor and the dispensing section
microprocessor simultaneously actuate the dispensing of the requested
article or item of value and the debiting of an authorized balance from
the card.
A particular embodiment of the invention is a mutual handshake recognition
procedure executed as follows: (1) upon confirming that a requested
transaction is authorized, the card passes to the terminal a word
comprising a randomly generated or other object number encrypted by a
first resident algorithm and a key number stored in the card; (2) the
terminal decodes the number using a corresponding inverse of the first
algorithm and the key number; (3) the terminal sends back to the card a
second word comprising the decoded random number encrypted by a second
resident algorithm and the key number; (4) the card decodes the second
word using a corresponding inverse of the second algorithm and the key
number and compares the decoded number to the one originally sent; (5) if
the numbers match, the card microprocessor debits its authorized balance
for the indicated amount of the transaction and sends an actuation signal
to the terminal to proceed with the transaction; and (6) upon receipt of
the actuation signal, the dispensing microprocessor actuates the
dispensing section to complete the transaction. The transmitted actuation
signal may also be encrypted and decoded by the above algorithms or a
similar method.
Under the principles of the invention, the above-described interactive card
automated transaction system is applied to postage metering machines. In
one embodiment, a postage metering terminal has a slot for receiving a
microprocessor card issued with an authorized balance, a print head with a
secure microprocessor which interacts with the card microprocessor, a
keypad, a display, and an operations microprocessor which accepts a keyed
input of the postage amount requested, displays the keyed input, queries
the card to authorize and initiate the postage printing transaction, and
then resets the machine for the next transaction or executes a series of
transactions in a repeat mode.
In a related embodiment, a postage metering terminal has a first slot for
receiving a user microprocessor card, a second slot for receiving a postal
rate card, a print head with a secure microprocessor, a keypad and other
means for entering source and destination (postal zip) codes, means for
entering the weight and postal class of the article to be mailed, and an
operations microprocessor having a program for calculating the correct
postage based upon the listings of the rate card and the keyed-in
information.
The card automated postal transaction system can be readily applied not
only to the postal products and services of the U.S. Postal Service, but
also to private carriers and parcel delivery companies. In a further
embodiment, a postal waybill terminal has a third slot for receiving a
special services card which has stored data from which the terminal can
print postal and delivery services information on standard form blanks.
For example, the special services card can be used to print Post Office
forms, such as Certified Mail or Registered Mail, or the waybills of
private carrier companies. The terminal is also provided with a full field
display of the waybill form, prompts the user for information by
programmed cursor movements, and has command keys for inputting sender and
addressee information, rate or service class, waybill number, carrier
information, etc.
As subsidiary features, the microprocessor cards can be configured to
provide different types of access to the terminals as desired, for
example, limited numbers or types of users in limited numbers or types of
machines, unlimited users in limited machines, limited users in unlimited
machines, or unlimited users in unlimited machines. The different types of
access can be implemented by storing key numbers in the card for
identifying authorized users and/or machines, and/or key numbers in the
terminal operations microprocessor for identifying authorized users. The
user cards can also be configured at the time of issuance for limits to
the amounts and types of individual transactions, and temporary or
permanent locking upon detection of an unauthorized user or card. Another
system feature is the storing of a history of transactions executed by the
card, and the recomputing of the remaining balance upon each transaction
request, in order to save card memory space. A separate transaction
printer may be used to obtain a printout of the card's transaction
history.
The postage metering terminals according to the invention are also provided
with means for allowing a post office or carrier to authenticate the
postage marks or waybills that are printed. In one embodiment, the
terminal printer prints within or under the postmark a coded number or
sequence of marks corresponding to an element of the postmark, such as the
amount of postage, the terminal identification number, and/or the sender's
zip code. The marks may be disguised or made invisible by printing with a
magnetically or optically readable ink to deter tampering or unauthorized
simulation. They may then be machine-read by the post office or private
carrier company to determine whether the printed postmark was printed by
an authorized printer, and at the same time provide an audit trail to the
sender.
In accordance with a further application of the invention, an integrated
system of microprocessor cards and terminals provides transaction
facilities which permit widespread use and convenient access to users. The
authorized amount of the user card may be initially validated or refilled
from a master refilling card, which has a larger authorized amount,
preferably in conjunction with a supervisor card issued under strict
distribution control. A refilling terminal is provided with three
insertion slots for the three cards, and has an operations program to
check the identity of the master refilling card and the user card to
determine if they are valid for use in the refilling terminal. Upon
clearance, the secure handshake recognition procedure must be successfully
executed between the microprocessors of the supervisor and master cards in
order to permit a debit to the master card of the refill amount and a
credit to the user card. If the user card is a new card, a validation
procedure and the selection and storing of a user PIN are executed.
The card automated transaction system of the invention has broad
applicability to many other types of purchase or credit transactions
besides postal services and products. For example, it can also be used for
credit card transactions, inventory control, bills of lading, automated
cash machines, or virtually any other type of transaction in which a user
account must be securely debited through an automated terminal in exchange
for an article or item of value. The invention is especially advantageous
in off-line transactions in which distributed terminals not under strict
access controls are used. The above principles, advantages, and features
of the invention are described in further detail below in conjunction with
the following drawings.
BRIEF DESCRIPTION OF DRAWINGS
FIG. 1 illustrates schematically a preferred embodiment of an automated
postal transaction terminal using a microprocessor card in accordance with
the invention;
FIG. 2a shows a structure in the embodiment of FIG. 1 for executing a
secure handshake recognition procedure between the microprocessor card and
a value dispensing section of the terminal, and FIG. 2b outlines the
handshake sequence;
FIG. 3 illustrates the multiple levels of security provided by the system
of FIG. 1;
FIG. 4 shows another embodiment of the postal transaction terminal and an
optional scale of the invention which receives a rate card for
automatically computing postal amounts;
FIG. 5 is a flow diagram of the operation of the terminal of FIG. 4;
FIG. 6a shows the use of coded marks for authentication of a postmark
printed by a postal transaction terminal, and FIG. 6b shows one exemplary
form of authentication coding;
FIG. 7 illustrates schematically a preferred embodiment of an automated
waybill printing terminal and an optional scale using a microprocessor
card and a special services card in accordance with the invention;
FIG. 8 is a flow diagram of the operation of the terminal of FIG. 7;
FIG. 9 illustrates a standard form of waybill and cursor prompts for
filling in its information fields;
FIG. 10 illustrates schematically a preferred embodiment of an automated
refilling terminal using a microprocessor card, a master card, and a
supervisor card in accordance with the invention;
FIG. 11 is a flow diagram of the operation of the terminal of FIG. 10; and
FIG. 12 shows the integrated system of microprocessor cards, memory cards,
and terminals of the invention.
DETAILED DESCRIPTION OF INVENTION
In accordance with the basic principles of the invention, an automated
transaction system employs a microprocessor card in an automated
transaction terminal. Various types of microprocessor cards are available
commercially, and the technology of manufacturing such cards and using
them in terminal devices is well understood. As an example, Micro Card
Technologies Inc. of Dallas, Tex. makes the Micro Card Mask M4 card which
is a standard (ISO) size, similar to a credit card, having an 8-bit
microprocessor, 8 contact pinout, 9600 bps asynchronous serial exchange
protocol, 12.8 Kbits of Read-Only Memory (ROM), 288 bits of Random Access
Memory (RAM), and 8 Kbits of Erasable/Programmable ROM (EPROM). An array
of electrical contacts provided in one section of the card connects with
the corresponding contacts in the terminal to allow the card
microprocessor to communicate data with the terminal. It is of course
understood that other types of data communicating connections can be used,
such as, for example, by magnetic induction.
The conventional microprocessor card as used in the present invention
operates by executing an internally stored program (firmware) which cannot
be accessed from the outside. The firmware may be written in randomized
form to secure it against tampering from the outside. An electrically
programmable (EPROM) memory portion associated with the microprocessor of
the card is generally divided into three zones: a secret zone which can
only be accessed internally; a protected read/write zone which can only be
accessed after a key number or PIN has been confirmed, and a free-reading
zone. The card is used in a terminal for performing desired functions in
accordance with the rules, procedures, and data stored in or executed by
the card and the terminal.
When conventional microprocessor cards are issued to individual users, a
validation procedure is executed on a validating terminal. The procedure
generally requires the issuer to enter the correct manufacturers' serial
number of the card in order to confirm that the card is authorized. A PIN
is then assigned to or selected by the cardholder and stored in the secret
zone. Moreover, a secret key number unique to the issuer, which may be
common to a class or chronological series of cardholders, may also be
stored in the secret zone. In some card systems, the secret key is used as
an argument of an encryption algorithm to send an encrypted word to the
terminal for verification. If the word can be decoded by the terminal to
derive the secret key, the card is presumed to be authentic. Upon
completion of the validation procedure, the card MPU irreversibly alters
its program so that no further words can be written in the secret memory
zone. Thereafter, upon using the card, a user must enter the correct PIN
in order to confirm that the card is being used by its authorized user.
Conventional microprocessor cards also have the feature of temporarily or
permanently locking the card from use if a succession of incorrect PIN
entries on a terminal is detected.
At the time of issuance, an amount in monetary or other units is validated
for the card being issued. In conventional cards, the amount is
permanently written in one of a plurality of transaction sectors in the
protected memory zone. Each time the card is to be "filled" with a new
amount, one of the sectors is unlocked and written with a new amount by
the issuer. Thus, a limited authorized amount can be written each time,
and the card is then refilled a number of times before its memory space is
used up. This is a security feature to minimize monetary loss in case the
card is lost or stolen. The authorized amount is decremented with each
transaction and a new balance is written until the balance is used up.
Although any amount or balance can be written into the card's transaction
memory, as a further security feature the card may prevent a balance being
written which exceeds a predetermined limit or a previously written
balance.
A card automated transaction system incorporating the particular features
of the invention will now be described. It should be understood that
although particular embodiments are described, the invention is not
limited to such embodiments, but encompasses all modifications and
variations which use the principles of the invention. For purposes of this
description, the transaction terminal is selected to be a postage metering
terminal for printing a postmark on a label, envelope, or waybill for
articles to be mailed or shipped. However, it should be understood that
the general principles of the invention have broad applicability to any
type of transaction terminal in which a microprocessor card may be used.
For example, the terminal may also be a cash or article dispensing machine
or a printer which prints validation marks, coupons, receipts, tickets,
inventory documents, etc.
POSTAGE METERING TERMINAL
Referring to FIG. 1, a microprocessor card 10, as previously described, is
adapted to be inserted in a card insertion slot 11 of an automated
transaction terminal 20. The card 10 has a contact section 12 supporting a
number of contacts 13 connected to the pinout leads of an IC chip
including a microprocessor unit (card MPU) 60 laminated beneath a
protective layer of the card contact section 12. The contacts 13 are mated
with corresponding contacts 23 of a terminal contact section 22 upon
insertion of the card 10 into the slot 11 in the direction indicated by
arrow A. As the card is inserted, its leading edge abuts a part of the
terminal contact section 22 which is moved in the same direction,
indicated by arrow B, so as to merge in operative electrical contact with
the card contact section 12. A trip switch 22a is provided at the base of
slot 11, and triggers a start signal to an operations microprocessor
(terminal MPU) 30 when the card has been fully inserted in position in the
slot.
The card MPU 60 executes an internally stored (firmware) program to check
whether a requested transaction is authorized and, prior to debiting the
card account balance, to perform a secure handshake recognition procedure
(described further below) with a microprocessor in the terminal. Although
the handshake procedure can be performed with an operations microprocessor
for the terminal, or one remote to the terminal, it is preferred in the
invention that the procedure be performed with a secure microprocessor
embedded in the actual value dispensing section of the terminal. The value
dispensing section is a separate element in the terminal, and its
microprocessor is made physically secure, such as by embedding it in
epoxy, so that any attempt to tamper with it would result in rendering the
value dispensing section inoperative. For the postal transaction terminal
of the invention, the microprocessor is embedded in the printer unit which
prints the postmark.
The terminal contacts 23 are connected with the functional parts of the
terminal, including a Clock synchronizing connection 24, a Reset
connection 25, an operational voltage Vcc connection 26, an Input/Output
(I/O) port 27, an EPROM-writing voltage Vpp connection 28, and a ground
connection 29. The terminal MPU 30 controls the interface with the card
and the operation of the various parts of the terminal, including a
keyboard 31, a display 32, such as an LCD, and a postmark printer 40,
which is the value dispensing section of the terminal. A power source Vo
is provided by a battery and/or an external AC or DC line to power the
various parts of the terminal.
The printer 40 has a microprocessor unit (printer MPU) 41 which
individually and uniquely controls the operation of a print head 42, such
as an electrothermic or impact print head. The MPU 41 executes an internal
program (firmware), like the card microprocessor, so that it cannot be
tampered with from the outside. The printer MPU's internal program
includes unique encryption algorithms parallel to those stored in the
card's microprocessor, installed by the manufacturer, so that the printer
MPU can execute a secure handshake recognition procedure with the card's
microprocessor to authorize a requested transaction. The MPU 41 is also
formed integrally with the print head 42, such as by embedding in epoxy or
the like, so that it cannot be physically accessed without destroying the
print head. Thus, according to the invention, the print head 42 of the
postage metering terminal 20 can only be operated through the MPU 41, and
will print a postmark only when the handshake recognition procedure and a
postmark print command have been executed between the card MPU and the
printer MPU 41.
When a terminal is to be installed by the issuer in a location or
distributed to a retail intermediary for field use, the issuer may also
execute a validation procedure for the terminal similar to that for the
card. A secret key number may be written in the secret memory zone of the
printer MPU 41, so that postage printing transactions can only be executed
with cards provided with the corresponding secret key number. Thus, cards
validated by another issuer, even though obtained from the same
manufacturer, will not be usable in the first-mentioned issuer's machines.
The terminal MPU may of course be used for the handshake recognition
procedure. However, it is preferable to have the procedure executed by the
part which is actually dispensing the article of value, and to leave the
terminal MPU operable for general terminal operations. A machine ID number
(MIN) may also be assigned to the terminal so that it can be recorded in
the transaction history maintained on the card. As a further feature, the
MIN for one or more of the issuer's terminals can be stored in cards which
are to be used only in those terminals. Thus, in an automated terminal
system provided for one company, the terminals within the company can only
be used with the cards issued to the employees of that company which have
the company's secret key number and, optionally, the terminals within a
department of the company may be configured to accept only cards provided
with the MINs of that department's machines.
The interactive operation of the card/terminal system will now be
described. Upon inserting a card in slot 11, the trip switch 22a is
triggered, and the terminal MPU 30 initiates an identification request
procedure to confirm that the card is being used by an authorized user.
For example, the terminal MPU may cause a prompt to appear on the display
32 requesting that the user enter a PIN. The number entered by the user is
sent by the terminal MPU to the card MPU where it is checked against the
PIN number(s) stored in the secret zone of the card's memory. If the
number matches, the card MPU notifies the terminal MPU 30 to proceed. If
the card is restricted for use only in particular machines, the card may
request the terminal's MIN and check it against a stored list of
authorized terminal numbers. If the terminal is restricted for use only
with certain cards, the terminal may check the PIN or a card
identification or account number against a stored list of authorized card
numbers. As another security feature, the card program may check the
number of incorrect PIN entries attempted or a card expiration date
written in memory at the time of issuance. If the incorrect PIN entries
exceeds a predetermined number, or if the current date indicated from the
terminal MPU 30 is past the expiration date, the card MPU 60 can lock the
card against further use until the user has had it revalidated by the
issuer.
If the initial confirmation procedures are passed, the terminal MPU 30 next
prompts the user to enter information for a postage transaction. The user
inputs on keypad 31 the amount of postage requested and, as a further
option, the zip code of the sender's location and the date. As the
information is supplied in sequence, i.e. "Amount", "Zip", and "Date", it
is displayed on display 32 for confirmation. Alternatively, the date may
be maintained by the terminal MPU 30, and displayed for user confirmation.
When all the correct information has been entered, an edge of an envelope
51 to be mailed, or a label or mailing form to be attached to an item to
be mailed, is inserted in a slot 50 on one side of the postage metering
terminal 20. The movement of the label or envelope may be controlled to
bring it in registration with the print head, as provided in conventional
metering machines. The user then presses the "Print" key to initiate a
postage printing transaction.
HANDSHAKE RECOGNITION PROCEDURE
A basic principle of the invention is that the actual execution of a
value-exchanging transaction is securely controlled by a mutual handshake
recognition procedure between a secure microprocessor maintaining the card
account balance and a secure microprocessor controlling the value
dispensing operation. The card's MPU must recognize the value dispensing
section's microprocessor as valid, and vice versa, in order to execute a
transaction. The card and the value dispensing section therefore can each
remain autonomous and protected against counterfeiting or fraudulent use
even if the security of the other has been breached. Since they are
autonomous, the cards and terminals can be distributed widely with a low
risk of breach of the system and without the need for strict access
controls. It thus has significant cost and security advantages over
conventional card automated transaction systems.
A two-way encrypted handshake embodiment will now be described. However, it
should be understood that the invention is intended to encompass any
mutual handshake procedure by which the card and dispensing
microprocessors can recognize the other as authorized to execute a
requested transaction. In the preferred postage terminal embodiment, the
handshake procedure is executed between the card MPU 60 and the printer
MPU 41. As illustrated schematically in FIG. 2a, when the "Print" key
signal is received by the terminal MPU 30, the latter opens a channel 61
of communication between the card MPU 60 and the printer MPU 41. A
"commence" signal and the amount of the requested transaction, i.e.
postage, is then sent from the terminal MPU 30 to the card MPU 60, and a
similar "commence" signal to the printer MPU 41, in order to prepare the
way for the handshake procedure.
Referring to FIG. 2b, the card MPU 60 initiates the handshake procedure
upon receipt of the "commence" signal by first verifying if the requested
amount is available for the transaction. As an advantageous feature of the
invention, the card MPU 60 checks the available balance of the card and
(if implemented in the card's program) whether the requested transaction
is within any limits specified by the card issuer. For example, use of the
card can be limited to a maximum postage amount and/or class of postage
for each transaction or a cumulative total of transactions. Upon verifying
that the requested transaction is authorized, the card MPU 60 encrypts an
object number N, which may be a randomly generated number, with a key
number k1 (which may be the user's PIN) stored in the secret zone of its
memory by a first encryption algorithm E1 and sends the resultant word W1
through the handshake channel 61 of terminal MPU 30 to the printer MPU 41.
Upon receipt of the word W1, the printer MPU 41 decodes the number using
the same number k1 by the inverse algorithm E1'. The number k1 may be a
secret key number stored in the printer MPU's memory at the time of
validation, or in an open system, it may be the PIN entered by the user on
the terminal, or a combination of both. The printer MPU 41 then encrypts
the decoded number with the number k1 by a second encryption algorithm E2
to send a second word W2 back to the card MPU 60.
Upon receipt of the word W2, the card MPU 60 decodes the number again using
the key number k1 by the inverse of the second algorithm E2', and compares
the decoded number with the number it used in the first transmission. If
the numbers match, the handshake procedure has been successfully
completed, and the card and printer MPUs have recognized each other as
authorized to execute the requested transaction. The card MPU then debits
the postage amount from the card balance, and then sends a print command
and the postage amount to the printer MPU. The printer MPU prints the
postage on envelope 51, in cooperation with the terminal MPU 30 which
controls the movement of the envelope under the print head. The printer
MPU then sends an "end" signal to the terminal MPU 30, which accordingly
switches off the handshake channel 61 and resets itself to receive the
next transaction request.
In the preferred embodiment, the card MPU 60 stores only the amount of the
transaction in its transaction record, and does not store the new balance.
Instead, the balance is recomputed from the original authorized amount and
the stored history of transaction debits at the time a transaction is
requested. This procedure substitutes the MPU's computing power to save a
significant amount of card EPROM memory space.
The card automated transaction system of the invention is provided with
high security at a plurality of levels, which is particularly advantageous
for off-line transactions involving large numbers of issued cards and
widely distributed terminal devices. As depicted in FIG. 3, the encryption
algorithms are provided at the first security level I by the manufacturer,
the secret key, PIN, and/or MIN are provided at security level II by the
issuer, the PIN is used at security level III by a particular user, and
the MIN and/or secret key may be used at security level IV to operate a
particular machine(s).
At level I, the print head of the terminal is only operable to dispense
value, i.e. print postage, if the encryption algorithms provided by the
manufacturer match those of the card, thereby protecting against
counterfeit cards and terminals. Even if the security of the manufacturer
has been penetrated, and the encryption algorithms have been obtained by a
counterfeiter, the secret key may be assigned at level II by the issuer
and used in the handshake procedure, thereby deterring the use of
counterfeit ca | | |
