Note: Descriptions are shown in the official language in which they were submitted.
1326911
AUTOMATED TRANSACTION SYSTEM USING MICROPROCESSOR CARDS
The invention relates to an automated transaction
system which receives with a user card having a microprocessor
- for executing secure transactions in which an article or item
of value is dispensed from a terminal, and an account balance
stored in the card's memory is debited. In particular, the
invention is applied to a postage transaction system in which
a postage account is maintained within the microprocessor card
and is used in transactions with postage printing and metering
terminals.
~,
',~ B~K~B951~39.,9E~INY~
, Point-of-sale (POS) terminals and automated teller
machines (ATM) have been widely used in conjunction with
various types of cards issued to users for sale or credit
transactions. For example, banks regularly issue account
cards which have a magnetically coded number stored on a
stripe for accessing the user's account through ATM terminals.
Credit cards which have coded magnetic stripes are inserted in
ATM or POS terminals to access a central account system for
authorization of a credit transaction. There also have been
proposals to use cards which have large non-volatile memories,
; e.g. magnetic, integrated circuit (IC), or optical memory
.~
storage, for storing and retrieving information specific to
the user r such as a medical history, biographical historyr
maintenance of an account balance and transaction historyr
etc.
These conventional systems generally employ a card
which has a passive memory that is read in a card reader or
'~, . ;~ ,
1326911
computerized terminal maintained by a vendor. The security of
the cards is problematic since most account cards used
conventionally are passive and do not authenticate themselves
or the particular transactions for which they are ùsed.
Instead, on-line access through a terminal to a central
account system, such as bank or credit card account records,
is required for confirmation of each transaction. This
requirement places an access time and cost burden on vendors,
such as bank branches and retail stores, which must maintain
the terminal facilities, as well as on the operator of the
central account system, which must provide sufficient on-line
j access for all ~he users of the system and ensure the security -
'' of the entire system.
By comparison, off-line transactions, i.e. between a
user with an authorized card and a terminal not connected to a
central account system, have the advantage that the vendor
does not have to confirm each transaction. A card bearer
merely inserts the card in a terminal to pay for a purchase
and the authorized amount of the card is debited for the
amount of the transaction. In off-line transactions, the
vendor'~ responsibility can be reduced and the transaction
process simplified, so that a transaction can be completely
l .
automated through the use of widely distributed user cards and
~j automated terminals.
;1 However, off-line transactions are more vulnerable to
the use of counterfeit cards and to tampering with the
terminals. Thus, the cards have to be made secure and the
transactions limited to small amounts. As an example of
; conventional card!security measures, a memory card can be
. .
~j 30 divided into a number of separately validatable sectors of
... j .
limited value which are irreversibly debited with each
- 2 -
.,,
~`
- ~ 1326911
transaction, as disclosed in U.s. Patents 4,204,113 and
~,256,955 to Giraud et al. ~ personal identification number
(PIN) can be written into the card's memory at the time of
issuance and requested of the user with each transaction.
Terminals are generally made secure by maintaining them in
.... .
areas to which access is restricted or supervised. However,
these requirements increase the cost of operating the system
and at the same time decrease its utility.
The sophistication of card counterfeiting and credit
fraud has increased with the widespread use of account and
credit cards, and even greater security measures are currently
needed to ensure the validity of card transactions.
Conventional microprocessor cards employ resident programs to
control access to data stored on the card, store a selected
user PIN to confirm an auhorized user, and prevent use of the
, .
card if an unauthorized user is detected, such as after a
limited number of incorrect PIN entries. Although such
, microprocessor cards provide greater security than passive
cards, the overall system is still vulnerable in that, once a
; 20 valid user's PIN has been ascertained, a stolen card can be
used for unauthorized transactions in any terminal, and the
terminals themselves are subject to penetration. These
~, vulnerabilities can be offset by limiting the authorized
;'.~1 , .,
amount of the card, controlling access to the terminals, or
.,.,~
requiring on-line confirmation of transactions. However, such
, measures again increase the cost of the ~ystem and decrease
its utility.
One potential area of application of automated systems
','! employing account or credit cards is in postage vending and
:1 .
metering machines-. Purchases of postage and mailing
transactions are made primarily in person with cash through
- 3 -
,j
.. . - ~ - ~ ,.
`, 1326911
tellers at post offices. Only limited types of postage stamps
can be purchased from public vending machines. Most private
postage metering machines have limited operational features
and must have their metering devices removed periodically to a
post office for refilling. The size and weight of the
~; metering devices make them inconvenient to carry. Some
- metering systems can be refilled by a remote computer, but the
caller must still phone the computer center and execute the
operator's instructions on the postage meter manually.
The elimination of cash purchases, in-person mailing
transactions, unnecessary limitations on automated postal
services, and physical refilling of postage metering machines
could greatly reduce the waiting lines at post offices and
facilitate the wider dissemination of postage vending and
metering machines for the convenience of users and provide
greater access to postal services. The use of account or
credit cards for automated postal machines has been
considered However, the security problems of conventional
card automated systems would require that user cards be
;, 20 validated only for relatively small amounts of prepaid
1 postage, that vending and metering machines provide limited
postal products and be refilled with limited total postage
amounts, and that access to the machines be strictly
controlled. These restrictions are a substantial obstacle
which contribute to the difficulty of implementing an
automated postal transaction system.
SUM~ABY~ a9~
j~ The present invention provides an automated
transaction system comprising: ~a) a user card having a
,'.. ,~ . .
microprocessor mounted therein, said card having data output
- 4 -
;~
, ..
.~
1326911
. , ,
: .,
mealls conllected l:o ~aid JniCrOprOCessOrt ~b) a tran~action
,
(:erl~ al includillg mealls ~or receiving 3aid user card lnserted
~ ereill, mealls ~or establislling an operatlve connection with. ¦~
said card dal:a outpu~ mean~, a value dl~pen~ing section llaving
a microprocess~r or operating ~aid ~ection to dispense an
il:em o~ value, and means ~or establi~lling a data communication
patll between said card microproces~or inserted in ~aid
termillal and said dispensing section miceoprocessor; and (c~
eacl2 o~ said card microprocessor and said di~pensing section
10 microprocessor llaving program mean~ ~or executing a programmed
llandsllake procedure between said microprocessors and for
:..... preventing ~aid dispensing 6ection microproces~or from
proceeding with a value dispen~ing operation until said
halldsllake l?rocedure llas bee!l completed
, ~ . . . . .
~ particular a~pect of the invention iB an elllbVdiment
o~ the programmed hand~l~ake procedure wherein naid program
lolealls of said card microproces~or includes a ~ir~t encryption
;~ !algorithm, an inverse ~econd encryption algorithm, and an
ob~ect number, and ~aid prog~am means of said dispen~lng
Z0 section microprocessor includes an inver5e ~irst encryption
algoritllm, whicll is complementary to ~aid fir~t encryption
algorithm, and a ~econd encryptlon algorithm, which iB a
complement o~ said inverse second encryption algorithm,
.. ~ , . '
wherein ~aid llandshake procedure i8 executed by said program
means oE said card microprocessor encryptlng said ob~ect
nulnber with said Eir~t encryption algorithm and sending a
`"1 . . .
re~ulting encrypted ~ir~t word to ~a~id dlspenslng section
microproce~or, said program means of ~aid dispensillg ~ection
, ~ , , .
microprocessor dePoding said ob~ect number from said ~irst
30 word witll said inverse ~lrst encryption algorithm, enc;ryptlng
said decoded ob~ect number with ~aid second encryption
~'" ' .
_ 5 ;
..
.. . . . . . .
13269~ 1
; algorithm, and sending a resulting encrypted second word to
said card microprocessor,.said program means of said card
microprocessor decoding said object number from said second
word with said inverse second encryption algorithm, comparing
said decoded object number with said object number first
encrypted, and sending a value dispensing command signal to
said dispensing section microprocessor if said numbers match,
and said program means of said dispensing section
microprocessor operating said value dispensing section only in
lo response to said command signal.
further aspect of the automated transaction system
of the invention is a family of interactive cards and
machines, including ~a) a master card having a microprocessor
mounted therein with an associated memory having data
representing a master account balance recorded therein, said
card having data output means connected to said
microprocessorS and ~b) a refilling terminal including first
;.~; means for receiving said user card and second means for
^i receiving said master card inserted respectively therein, and
-~ 20 means operable when said cards are inserted in said terminal
:~!, for establishing a first data communication path between said
user card microprocessor and said master card microprocessor
for conducting a transaction in which said master card
! microprocessor transfers data to sa1d user card microprocessor
Por crediting a requested transaction account balance to be
:~ stored in said user card memory and debits said master account
balance stored in said master card memory by the credited
transaction account balance amount~
Under the!principles of the invention, the
; 30 above-described interactive card automated transaction system
is applied to postage metering machines. In one embodiment, a
- 6 -
" .
~32~9~1
postage metering terminal has a slot for receiving a
microprocessor card issued with an authorized balance, a print
head with a secure microprocessor which interacts with the
card microprocessor, a keypad, a display, and an operations -
microprocessor which accepts a keyed input of the postage
amount requésted, displays the keyed input, queries the card
to authorize and initiate the postage printing transaction,
and then resets the machine for the next transaction or
executes a series of transactions in a repeat mode.
In a related embodiment, a postage metering terminal
has a first slot for receiving a user microprocessor card, a
second slot for receiving a po~tal rate card, a print head
with a secure microprocessor, a keypad and other means for
entering source and destination (postal zip) codes, means for
entering the weight and postal class of the article to be
-- mailed, and an operations microprocessor having a program for
calculating the correct postage based upon the listings of the
rate card and the keyed-in information.
The card automated postal transaction system can be
readily applied not only to the postal products and services
of the U.S. Postal Service, but also to private carriers and
parcel delivery companies. In a further embodiment, a postal
waybill terminal has a third ~lot for receiving a special
service~ card which has stored data from which the terminal
can print postal and delivery services information on standard
,
form blanks. For example, the special service~ card can be
used to print Post Office forms, such as Certified Mail or
Registered Mail, or the waybill~ of private carrier companies.
The terminal iB a!lso provided with a full fleld display of the
30 waybill form, prompts the user for information by programmed
cursor movements, and has command keys for inputting sender
. .
:
132fi911
and addressee in~ormation, rate or service class, waybill
number, carrier information, etc.
~ 8 subsidiary featuresl the microprocessor cards can
be configured to provide different t~pes of access to the
terminals as desired, for example, limited numbers or types of
users in limited numbers or types of machines, unlimited users
in limited machines, limited users in unlimited machines, or
unlimited users in unlimited machines. The different types of
access can be implemented by storing key numbers in the card
for identifying authorized users and/or machines, and/or key
numbers in the terminal operations microprocessor for
identifying authorized users. The user cards can also be
configured at the time of issuance for limits to the amounts
and types of individual transactions, and temporary or
1 permanent locking upon detection of an unauthorized user or
:$ card. ~nother system feature is the storing of a history of
-~ transactions executed by the card, and the recomputing of the
.~ remaining balance upon each transaction request, in order to
~ save card memory space. A separate transaction printer may be
.~,
used to obtain a printout of the card's transaction history.
The postage metering terminals according to the
invention are also provided wlth means for allowing a post
office or carrier to authenticate the postage marks or
waybills that are printed. In one embodiment, the terminal
,;
printer prints within or under the postmark a coded number or
sequence of marks corresponding to an element of the postmark,
such as the amount of postage, the terminal identification
~' number, and/or the sender's zip code. The marks may be
disguised or made invisible by printing with a magnetically or
optically readablë ink to deter tampering or unauthorized
simulation. They may then be machine read by the post office
:,
132~9~
- or private carrier company to determine whether the printed
postmark was printed by an authorized printer, and at the same
; time provide an audit trail to the sender.
The card automated transaction system of the invention
has broad applicability to many other types of purchase or
credit transactions besides postal services and products. For
example, it can also be used for credit card transactions,
inventory control, bills of lading, automated cash machines,
or virtually any other type of transaction in which a user
~10 account must be securely debited through an automated terminal
in exchange for an article or item of value. The invention is
especially advantageous in off-line transactions in which
distributed terminals not under strict access controls are
used.
;~ In one broad aspect, the present invention relates to an
;~ automated transaction system comprising: a plurality of
portable rate cards each having a memory embedded therein for
storing rate information corresponding to a respective one of
a plurality of different services, and data output means
~20 connected to said memory; a transaction terminal having an
external slot for insertion by a user of any one of said
plurality of portable rate cards therein; operating means in
said terminal for executing terminal functions including the
function of transacting an item of value in accordance with
the respective rates of any selected one of said plurality of
different services; said terminal having connected means in
,~ said terminal for establishing a connection between said
! operating means and the data output means of an inserted rate
i 9
~',
`i
., .
.....
1326911
card, and input means for enabling a user to input a request
for an item of value of any selected one of said plurality of
*: different services; and said operating means of said terminal
including rate card verifying means for verifying that the
: rate card inserted by the user corresponds to the selected one
service for which the item of value was requested, and rate
calculation means for calculating the value of the requested
item using the rate information stored in said memory of said
inserted rate card which is verified as to said one service;
and dispensing means associated with said terminal for
dispensing the requested item of said one service having the
value calculated by said rate calculating means.
:, In another broad aspect, the present invention relates to
:~ an automated transaction system comprising: a plurality of
~ portable program cards each having a memory embedded therein
~,
~ for storing program information corresponding to a respective
.:.
,"'~`!; one of a plurality of different services, and data output
,~ means connected to said memory; a transaction terminal having
an external slot for insertion by a user of any one of said
o plurality of portable program cards therein; operating means
in said terminal for executing terminal functions including
~11 the function of transacting an item of value in accordance
. :~
with the respective program of any selected one of said
plurality of different services; said terminal having
connecting means in said terminal for establishing a
connection between said operating means and the data output
means of an inserted program card, and input means for
enabling a user to input a request for an item of value of any
- 9a -
....
1326~ ~
selected one of said plurality of different services; and said
operating means of said terminal including program card
verifying means for verifying that the program card inserted
by the user corresponds to the selected one service for which
the item of value was requested, and program executing means
for accessing the program information stored in said inserted
program card corresponding to the selected one service and
executing a transaction of the requested item in accordance
therewith; and dispensing means associated with said terminal
for dispensing the requested item of said one service in
response to said program executing means.
,:,
The above principles, advantages, and features of the
invention are described in further detail below in conjunction
with the following drawings.
.
BRIEF DESCRT~ION OF TNE DR~NGS
Fig. 1 illustrates schematically a preferred embodiment
of an automated postal transaction terminal using a
microprocessor card in accordance with the invention;
Fig. 2a shows a structure in the embodiment of Fig.l for
0 executing a secure handshake recognition procedure between the
..5
microprocessor card and a value dispensing section of the
J terminal, and Fig. 2b outlines the handshake sequence;
.
Fig. 3 illustrates the multiple levels of security
provided by the system of Fig. 1;
Fig. 4 shows another embodiment of the postal transaction
terminal of the invention which receives a rate card for
automatically computing postal amounts;
Fig. 5 is a flow diagram of the operation of the
, - 9b
, .,
,.
.;,;
` , 1326911
terminal of Fig. ~;
Fig. 6a shows the use of coded marks for
authentication of a postmark printed by a postal transaction
terminal, and Fig. 6b shows one exemplary form of
authentication coding;
Fig. 7 illustrates schematically a preferred
embodiment of an automated waybill printing terminal using a
microprocessor card and a special services card in accordance
with the invention;
~- 10 Fig. 8 is a flow diagram of the operation of the
' terminal of Fig. 7;
Fig. 9 illustrates a standard form of waybill and
cursor prompts for filling in its information fields;
Fig. 10 illustrates schematically a preferred
embodiment of an automated refilling term~nal using a
microprocessor card, a master card, and a supervisor card in
accordance with the invention;
;
Fig. 11 is a flow diagram of the operation of the
terminal of Fig. 10; and
~ 20 Fig. 12 shows the integrated system of microprocessor
`; cards, memory cards, and terminals of the invention.
. ~ ., .
aIL~13;0Ula~;S~ BI~CI9~uQ~;~4Ila~lill~23~Q~
... . . . . ........... . .... .
In the invention, an automated transaction system
. .
employs a microprocessor card in a transaction terminal. Such
cards are available commercially. For example, the Micro Card
`~ Mask M4 card i8 a tandard (ISO) credit card size, and has an
8-bit microprocessor, 8 contact pinout, 9600 bps asynchronous
serial exchange protocol, 12.8 Kbits of Read-Only Memory
. . .. .
(ROM), 288 bits of Random Access Memory (RA~), and 8 Kbits of
Erasable Programmable ROM (EPROM).
-- 10 --
.,
.~, '
; , 1326911
~n array of electrical contac~s provlded in one section of the
card connects with the corresponding contacts in the terminal
to allow the card microprocessor to communicate data with the
terminal. It i5 of course understood that other types of data
communicating connections can be used, such as, for example,
by magnetic induction.
The conventional microprocessor card as used in the
present invention operates by executin~ an internally stored
proqram (firmware) which cannot be accessed from the outside.
.....
The firmware may be written in randomized form to secure it
againæt tampering from the outside. An electrically
programmable (EPROM) memory portion associated with the
... .
microprocessor of the card is generally divided into three
~ zones: a secret zone which can only be accessed internally; a
','..S
protected read/write zone which can only be accessed after a
i
;~ key number or PIN has been confirmed, and a free-reading zone.
The card is used in a terminal for performing desired
functions in accordance with the rules, procedures, and data
stored in or executed by the card and the terminal.
When conventional microproces~or cards are issued to
individual users, a validation procedure is executed on a
validating terminal. The procedure generally requires the
issuer to enter the correct manufacturers' serial number of
the card in order to confirm that the card is authorized. A
; PIN is then assigned to or selected by the cardholder and
stored in the secret zone. Moreover, a secret key number
unique to the issuer, which may be common to a class or
chronological series of cardholders, may also be stored in the
secret zone. In some card systems, the æecret key is used as
an argument of an encryption algorithm to send an encrypted
word to the terminal for verification. If the word can be
-- 11 --
:;
.
,"~ , .
132~'911
decoded by the terminal to derive the secret key, the card is
presumed to be authentic. Upon completion of the validation
procedure, the card MPU irreversibly alters its program so
that no further words can be written in the secret memory
zone. Thereafter, upon using the card, a user must enter the
correct PIN in order to confirm that the card is being used by
its authorized user. Conventional microprocessor cards also
have the feature o~ temporarily or permanently locking the
card from use if a succession of incorrect PIN entries on a
terminal is detected.
At the time of issuance, an amount in monetary or
other units is validated for the card being issued. In
conventional cards, the amount is permanently written in one
. ,,
of a plurality of transaction sectors in the protected memory
zone. Each time the card is to be "filled" with a new amount,
~ -i
one of the sectors is unlocked and written with a new amount
~ by the issuer. Thus r a limited authorized amount can be
i~ written each time, and the card is then refilled a number of
times before its memory space is used up. This is a security
feature to minimize monetary loss in case the card is lost or
stolen. The authorized amount is decremented with each
transaction and a new balance is written until the balance is
~; used up. Although any amount or balance can be written into
the card's transaction memory, as a further security feature
the card may prevent a balance being written which exceeds a
predetermined limit or a previously written balance.
.. .
A card automated transaction system incorporating the
particular features of the invention will now be described.
It should be understood that although particular embodiments
are described, the invention is not limited to such
. . . . . . .
embodiments, but encompasses all modifications and variations
.
- 12 -
, 1326911
which use the principles of the invention. For purposes of
this description, the transaction terminal is selected to be a
postage metering terminal for printing a postmark on a label,
envelope, or waybill ~or articles to be mailed or shipped
However, it should be understood that the general principles
of the invention have broad applicability to any type of
~ transaction terminal in which a microprocessor card may be
-~ used. For example, the terminal may also be a cash or article
dispensing machine or a printer which prints validation marks,
;~ 10 coupons, receipts, tickets, inventory documents, etc.
:'..
,.
98~gg.,~
Referring to Fig. 1, a microprocessor card 10, as
previously described, is adapted to be inserted in a card
insertion slot 11 of an automated terminal device 20. The
smartcard 10 has a contact section 12 which has a number of
;~
contacts 13 connected to the pinout leads of an IC chip
including a microprocessor unit (card MPU) 60 laminated
beneath a protective layer of the card contact section 12.
"1
The contacts 13 are mated with corresponding contacts 23 of a
terminal contact section 22 upon insertion of the card 10 into
the ~lot 11 in the directlon indicated by arrow A. As the
card is in~erted, its leading edge abuts a part of the
terminal contact section 22 which is moved in the same
~;-.. . . .
direction, indicated by arrow B, so as to merge in operative
~'~ electrical contact with the card contact section 12. A trip
switch 22a is provided at the base of slot 11, and triggers a
start signal to an operations microprocessor ~terminal MPU) 30
; when the card has!been fully inserted in position in the slot.
The card ~PU 60 executes an internally stored
.
(firmware) program to check whether a requested transaction is
- 13 -
"
.
. .. ~ .
1326911
authorized and, prior to debiting the card account balance, to
perform a secure handshake recognition procedure (described
further below) with a microprocessor in ~he terminal.
~lthough the handshake procedure can be performed with an
operations microprocessor for the terminal, or one remote to
the terminal, it is preferred in the invention that the
procedure be performed with a secure microprocessor embedded
in the actual value dispensing section of the terminal. The
value dispensing section is a separate element in the
terminal, and its microprocessor is made physically secure,
, . . .
such as by embedding it in epoxy, so that any attempt to
- tamper with it would result in rendering the value dispensing
section inoperative. For the postal transaction terminal of
the invention, the microprocessor is embedded in the printer
.. ~
~ unit which prints the postmark.
;~, The terminal contacts 23 are connected with the
functional parts of the terminal, including a Clock
synchronizing connection 24, a Reset connection 25, an
operational voltage Vcc connection 26, an Input/Output (I/O)
port 27, an EP~OM-writing voltage Vpp connection 28, and a
ground connection 29. The terminal MPU 30 controls the
interface with the card and the operation of the various parts
of the terminal, including a keyboard 31, a display 32, such
as an LCD, and a postmark printer 40, which is the value
dispensing section of the terminal. A power source Vo is
provided by a battery and/or an external AC or DC line to
power the various parts of the termlnal.
The printer 40 has a microprocessor unit ~printer MPU)
41 which individually and uniquely controls the operation of a
,~ , . .............. .. .
print head 42, such as an electrothermic or impact print head.
The MPU 41 executes an internal program (firmware), like the
- 14 -
.;,;,., :., - .
1326911
card microprocessor, so that it cannot be tampered with from
the outside. The printer MPU's internal program includes
unique encryption algorithms parallel to those stored in the
card's microprocessor, installed by the manufacturer, so that
the printer MPU can execute a secure handshake recognition
procedure with the card's microproces~or to authorize a
requested transaction. The MPU 41 i5 also formed integrally
- with the print head 42, such as by embedding in epoxy or the
like, so that it cannot be physically accessed without
lo destroying the print head~ Thus, according to the invention,
the print head 42 of the postage metering~terminal 20 can only
be operated through the MPU 41, and will print a postmark only
when the handshake recognition procedure and a postmark print
~, command have been executed between the card MPU and the
s printer MPU 41.
When a terminal is to be installed by the issuer in a
location or distributed to a retail intermediary for field
use, the issuer may also execute a validation procedure for
the terminal similar to that for the card. A secret key
20 number may be written in the secret memory zone of the printer
MPU 41, so that postage printing transactions can only be
executed with cards provided with the corresponding secret key
number. Thus, cards validated by another issuer, even though
obtained from the same manufacturer, will not be usable in the
first-mentioned issuer's machines.
The terminal MPU may o course be used for the
handshake recognition procedure. However, it is preferable to
have the procedure executed by the part which is actually
dispensing the article of value, and to leave the terminal MPU
30 operable for general terminal operationæ. A machine ID number
... . .
` (MIN) may also be assigned to the terminal so that it can be
., .
~ - 15 -
.,~ .
.. . .
~.
1 3 ~
recorded in the transaction history maintained on the card.
~s a further feature, the MIN for one or more of the issuer's
terminals can be stored in cards which are to be used only in
:
those terminals. Thus, in an automated terminal system
~ provided for one company, the terminals within the company can
'~,`,!, only be used with the cards issued to the employees of that
,,
company which have the company's secret key number and,
optionally, the terminals within a department of the company
- may be configured to accept only cards provided with the MINs
; 10 of that department's machines.
The interactive operation of the card/terminal system
will now be described. Upon inserting a card in slot 11, the
trip switch 22a is triggered, and the terminal MPU 30
initiates an identification request procedure to confirm that
the card is being used by an authorized user. For example,
the terminal MPU may cause a prompt to appear on the display
32 requesting that the user enter a PIN. The number entered
by the user is sent by the terminal ~IPU to the card NPU where
it is checked against the PIN number(s) stored in the secret
zone of the card's memory. If the number matches, the card
MPU notifies the terminal MPU 30 to proceed. If the card i8
restricted for use only in particular machines, the card may
request the terminal's MIN and check it against a stored list
of authorized terminal numbers. If the terminal is restricted
for use only with certain card3, the terminal may check the
- PIN or a card identification or account number against a
stored list of authorized card numbers. ~s another security
. .
feature, the card program may check the number o~ incorrect
PIN entries attem~ted or a card expiration date written in
memory at the time of issuance. If the incorrect PIN entries
~ exceeds a predetermined number, or if the current date
:, .
;,. . .
~ - 16 -
... .
1326911
indicated from the terminal MPU 30 is past the expiration
; date, the card MP~ 60 can lock the card against further UBe
until the user has had it revalidated by the issuer.
If the initial confirmation procedures are passed, the
terminal MPU 30 next prompts the user to enter information for
a po~tage transaction. The user inputs on keypad 31 the
. . .
amount of postage requested and, as a further option, the zip
i code of the sender's location and the date. ~s the
information is supplied in sequence, i.e. "Amount", "Zip~, and
"Date", it is displayed on di~pla~ 32 for confirmati~n.
Alternatively, the date may be maintained by the terminal MPU
30, and displayed for user confirmation. When all the correct
information has been entered, an edge of an envelope 51 to be
mailed, or a label or mailing form to be attached to an item
to be mailed, is inserted in a slot 50 on one side of the
postage metering terminal 20. The movement of the label or
envelope may be controlled to bring it in registration with
the print head, as provided in conventional metering machines.
The user then presses the "Print" key to initiate a postage
printing transaction.
.~ .
b3~g~B~ Bl~ig~ r~ g
A basic principle of the invention iB that the actual
; execution of a value-exchanging transaction is securely
controlled by a mutual handshake recognition procedure between
a secure microprocessor maintaining the card account balance
and a secure microprocessor controlllng the value dispensing
operation. The card's MPU must recognize the value dispensing
;~ . .
section's micropr!ocessor as validl and vice versa, in order to
1 execute a transaction. The card and the value dispen6ing
. . :~ , . . .
section therefore can each remain autonomous and protected
..:
.. ~: . .
- 17 -
. i
1326911
against counterfeiting or fraudulent use even if the security
of the other has been breached. Since they are autonomous,
the cards and terminals can be distributed widely with a low
risk of breach of the system and without the need for ~trict
access controls It thus ha~ significant cost and security
advantages over conventional card automated transaction
,J systems.
- A two-way encrypted handshake embodiment will now be
described However, it should be understood that the
, .
invention is intended to encompass any mutual handshake
-- procedure by which the card and dispensing microprocessors can
recognize the other as authorized to execute a requested
transaction. In the preferred postage terminal embodiment,
the handshake procedure is executed between the card MPU 60
and the printer MPU 41. As illustrated schematically in Fig.
2a, when the "Print" key signal is received by the terminal
MPU 30~ the latter opens a channel 61 of communication between
the card MPU 60 and the printer MPU 41. A "commence" signal
and the amount of the requested transaction, i.e. postage, iB
then sent from the terminal MPU 30 to the card MPU 60, and a
~i similar "commence" signal to the printer MPU 41, in order to
prepare the way for the handshake procedure.
~ eferring to Fig. 2b, the card MPU 60 initiates the
handshake procedure upon receipt of the "commence" signal by
first verifying if the requested amount is available for the
transaction. AB an advantageous feature of the invention, the
card MPU 60 checks the available balance of the card and (if
implemented in the card's program) whether the requested
tran~action is wi!thin any limits specified by the card issuer.
For example, use of the card can be limited to a maximum
postage amount and/or class of postage for each transaction or
- 18 -
,
132691:~
. , .
a cumulative total o~ transactions. Upon verifying that the
requested transaction is authorized, the card MPU 60 encrypts
an object number N, which may be a randomly generated number,
with a key number kl (which may be the user's PIN) stored in
the secret zone of its memory by a first encryption algorithm
El and sends the resultant word Wl through the handshake
channel 61 of terminal NPU 30 to the printer MPU 41.
Upon receipt of the word Wl, the printer MPU 41
decodes the number using the same number kl by the inverse
algorithm El'. The number kl may be a secret key number
stored in the printer rlPu~s memory at the time of validation,
or in an open system, it may be the PIN entered by the user on
the terminal, or a combination of both. The printer MPU 41
then encrypts the decoded number with the number kl by a
.;
second encryption algorithm E2 to send a second word W2 back
to the card MPU 60.
Upon receipt of the word W2~ the card MPU 60 decodes
the number again using the key number kl by the inverse of the
second algorithm E2', and compares the decoded number with the
number it used in the first transmission. If the numbers
match, the handshake procedure has been successfully
completed, and the card and printer MPUs have recognized each
other as authorized to execute the requested transaction. The
card MPU then debits the postage amount from the card balance,
and then sends a print command and the postage amount to the
printer MPU. The printer MPU prints the postage on envelope
;:1 . .
~ Sl, in cooperation with the terminal MPU 30 whic controls the
.. ~ . . . . . . . . .
movement of the envelope under the print head. The printer
MPU then sends an!nend" signal to the terminal MPU 30, which
, ;,i . ... . . ....... . . . . . . . .
~ 30 accordingly switches off the handshake channel 61 and resets
`1 itself to receive the next transaction request.
:., -- 19 --
'
~,
i.. . .
~2~
., . /
In the pre~erred embodiment, the card MPU 60 stores
only the amount of the transaction in it~ transaction record,
and doe~ not store the new balance. Instead, the balance is
; recomputed from the original authorized amount and the stored
history of transaction debits at the time a transaction is
requested. This procedure sub~titutes the MP~'s computing
power to save a significant amount of card EPROM memory space.
The card automated transaction system of the invention
is provided with high security at a plurality of levels, which
is particularly advantageous for off-line transactions
involving large numbers of issued cards and widely distributed
; terminal devices. As depicted in Fig. 3, the encryption
algorithms are provided at the first security level I by the
manufacturer, the secret key, PIN, and/or MIN are provided at
security level II by the issuer, the PIN is used at security
level III by a particular u~er, and the MIN and/or secret key
may be used at security level IV to operate a particular
- machine~s).
At level I, the print head of the terminal i~ only
operable to dispense value, i.e. print postage, if the
encryption algorithms provided by the manufacturer match those
of the card, thereby protecting against counterfeit cards and
terminals. Even if the security of the manufacturer has been
penetrated, and the encryption algorithms have been obtained
.~, . . .
by a counterfeiter, the secret key may be assigned at level II
by the issuer and used in the handshake procedure, thereby
deterring the use of counterfeit cards and terminals which do
.
not have the secret key. At security level III, a card can
only be used to operate a terminal if the correct PIN is
known, and if initial confirmation procedures are passed. At
security level IV, a card can only be used in a particular
. ~
. .
- 20 -
., .
,~ ~ . ,
132~91~
terminal identified by the correct MIN.
related embodiment of the invention is illustrated
in Fig. 4 which employs a second card having postal rate data
stored in memory to compute the correct postage automatically.
~¦ ~ terminal 20, similar to the one previously described.
includes a second slot 91 for a "rate" card 9o. The terminal
has a slot 50 in which a postal label or envelope 51 is
inserted for imprinting by the printer 40. For a parcel 52,
the label 51 is printed then affixed to the parcel for
mailing. A scale 53 may be connected to the terminal and MPU
30 to provide the weight of the envelope or parcel 52.
The rate card has a memory device 92, preferably an IC
, ROM, which is accessed and read by the terminal MPU 30 through
contact portion 93 mated in contact with the pinout terminals
of the memory device. Switches 22a and 92a provide signals
when the user and rate cards have been inserted in the
respective slots. Insertion of the user card initiates
1 operation of the terminal. If a rate card is not inserted,
; the terminal MPU 30 can instead request the appropriate postal
amount from the user by a prompt on the display 32. The
terminal MPU may also have a mode for reading postal rates
~, from the rate card.
The program operation of the postage metering terminal
20 is illustrated in block diagram form in ~ig. 5. Upon
insertion of the user card 10 in slot 11, the user
l confirmation procedures previously described are carried out
between the terminal MPU 30 and card MPU 60. If an
'31 unauthorized card or user is detected, the card is locked and
.,
', the terminal operations are terminated. If a valid user card
is confirmed, the'terminal program then checks if a rate card
90 is inserted and whether it is valid. Validity can be
..~ .
- 21 -
-~ , 132691 3.
d~cermined by the issue number of the card or by an indicated
;~ expiration date. If there is no rate card, the terminal MPU
requests the user to input the desired postage and yoes to the
;~ print key decision block 97. If a valid rate card is present,
~1 the terminal program requests the codes for the source and
destination of the item and the class of mail desired. The
program then checks for a signal from the scale 53 indicating
the weight of the item. I~ no scale is connected or weight
indicated, the program requests the user to input the
lo information.
The rate card memory contains a current listing of the
rates for a particular carrier divlded according to zone
classifications, weight, and/or type of mail. For the U.S.
Postal Service, the postage amount is calculated based upon
the origin and destination zip codes, class of mail, and
~-; weight by looking up tables stored in the rate card memory 92.
If the "Print Key" is depressed, the terminal program then
sends the "commence" signal to the card MPU and printer MPU to
execute the handshake procedure and debiting and printing
~ 20 operations as previously described. If an "Auto" mode key of
`~ the terminal has been pressed or the user elects to continue
`i in response to a prompt, the terminal program return~ to the
beginning of the transaction loop indicated at block 94. The
"~uto" mode may be used in conjunction with an automatic
feeder for postmarking a series of envelopes or labels. The
. . ~ . .
terminal operation is terminated if the transaction loop is
~.': . .
not continued, or if the handshake procedure is not completed.
~3
t~ a~b~s~ t~a
... . . . . ........... .
In accordance with the principles of the invention as
applied to postage metering terminals, a postmark
-:,
.
- 22 -
''.`'.
,~.,
. ,
- ., ,, . . ~ . . . ..
t 132691~
authenticating procedure will now be described. The procedure
is provided as a security feature to deter the printing of a
counterfeit postmark by a printer, copier, o other facsimile
device which is not authorized by the issuer of the
above-described card/terminal system. Conventional high
re~olution printers and graphics capabilitieR of personal
computers present an increasing risk that value-confirming
marks, such as a postmark, ticket, coupon, etc. can be
simulated by a counterfeiter. In the invention, an underlying
and/or invisible machine readable code i~ printed first and
then overprinted with the human readable postmark. The code
can be uniquely selected by the issuer of the postage
card/terminal ~ystem, and periodically changed to eliminate
any benefit from gaining unauthorized access to the code.
Further, the code can be printed with ~nk that is invisible in
the normal light spectrum, so that it is readable only with a
magnetic, infrared, or ultraviolet reader.
Referring to an example shown in Figs. 6a and 6b, a
conventional imprlnted postmark has a logo or graphic design
70, text 71 indicating that the postage is issued through the
V.S, Postal Service, numbers 72 indicating the postage amount,
as well as the date 73, city 74, state 75, and zip code 76 of
origin, and the identification number 77 of the postage meter
from which the postmark was printed, In the invention, coded
marks 78 are printed beneath the visible postmark in a
predetermined code field 79 in invisible, machine readable
ink. The algorithm for the coded marks is selected by the
suer, for example, representing the binary equivalent of the
postage amount, i.e~ l-90" cents in Fig. 6a, shown in binary
.. . .... . ........... .. . .
^~30 form in Fig. 6b. The coded marks can repre~ent any other
.. . . . . . .
element of the postmark, such as the meter identification
''.1,, '
- 23 -
: ; ..
` ~
1~26911
number or zip code. ~lternatively, a bar code ~3 can be
. ~
printed with a postmark information section ~3a and a check
~; code section 83b, which is encrypted based upon one of the
postmark element~. The postmark element and/or the encryption
algorithm can be uniquely selected by the issuer. Even if the
coded marks`are printed in visible form, the encryption of a
variable postmark element, ~uch as the sender's zip code,
date, or postage amount, will make copying difficult.
The printing of the postmark and authentication code
lo can readily be incorporated in the card/terminal system
illustrated in Fig. 1. The printer 42 is provided with a
memory 43 to which data representing the visible information
of the postmark and the computed binary or other selected
check code or converted bar code is transmitted from the
terminal MPU 30 and stored. The fixed graphics of the
postmark may be stored in a memory assocated with the MPU 30,
which is preferable if the same terminal has the capability of
printing a variety of postmark graphics for different carriers
and/or classes of service, or it may be permanently stored in
a section of the printer memory 43. The fixed graphics may
; in~tead be stored in the card's memory and loaded by terminal
"J
MPU 30 in the printer memory 43 for a requested transaction.
;~ Alternatively, the fixed graphics may be provided on a platen
. . ,~ .,
`~ which operates with the print head if only one type of
postmark is to be printed.
In the preferred form, the print head 42 i8 an impact
; printer which has two ink ribbons 42a and 42b, one of
invisible, machine readable ink and the other of visible ink.
When the handshak!e procedure has been completed, and the print
command issued by the card MPU 60, the printer MPU 41 accesses
the data stored in the memory 43 and, in a first pass, prints
: . .
- 24 -
. . . .
: - 132~9~
....
the coded marks in invisible ink then, in a second pass,
prints the visible postmark information.
As indicated in fig. 6a, when mail or other articles
are subsequently presented to a central mail routing and
distribution system, such as that of the U.S. Postal Service
or a private carrier, the postmark may be passed under a
^ detector 80 which has a visible light spectrum reader 81 and a
code reader 82, such as a magnetic, infrared, or ultraviolet
reader, or a bar code reader ~3 for bar code marks. If the
code marks are absent or if the check code does not correspond
to the element of the postmark selected for coding, an audit
record can be made of the non-conformity, for example, by
recording the meter identification number, date, and zip code
of origin. An inve~tiga~ion of the source of the unauthorized
postage can then be initiated if numerous articles are found
bearing unauthorized postmarks. The postmark authentication
,
l marks of the invention thus provide an additional level of
;,.
security against counterfeiting which is not offered in
conventional postal metering n~achines.
""~
.,
:;~ 2 o ~ billw~
.$ . ,
A further embodiment of the invention is illustrated
in Fig. 7 which is adapted for printing standard form waybills
for mailing articles using a wide range of postal or private
carrier services. A terminal 20' includes a slot 11 for a
user card 10, a terminal MPU 30, a printer 40 and printer MPU
41, a keyboard 31', and a display 32', as previously described
with respect to Fig. 1. The terminal also includes a second
slot 91 for a "rate" card 90 and a third slot 101 for a
. ~, .. .. .. .
"special services" card. The terminal has a slot 50 in which
. . . . . . . . . . . ...................... .
~ 30 a ~tandard waybill form 51' is inserted for imprinting by the
... . . .
~ 25 -
.' .
:''., ~
- ( 13269~ 1
prlnter 40. The waybill 51' is then afflxed to an envelope or
parcel 52 for mailing. ~ scale 53 can be connected to the
terminal and MPU 30 to automatically provide the weight of the
parcel 52.
The rate and special services card have memory devices
92 and 102, respectively, which are preferably IC ROMs that
are accessed and read by the terminal MPU 30 through contact
portions 93 and 103, respectively, mated in contact with the
pinout terminals of the memory devices. Switches 22a, 9~a,
and 102a provide detection signals when the cards have been
inserted in the respective slots. A display 32' provides a
full field corresponding to the appearance of the waybill
form, and the keyboard 31' includes a full set of alphanumeric
characters and command keys.
The rate card memory contain~ a current listing of the
rates for a particular carrier. For example, if the carrier
iB the U.S. Postal Services, the Post Office rates are listed
1 according to zone classifications, weight, and class of mail.
~ The special services card memory contains a program for
','7 20 filling out a standard waybill form in accordance with the
l information required by and with indicia identifying the
.,~ . .
mailing services o~ a particular carrier. For example, if the
carrier is the U.S. Postal Service, the special services card
.. . ..... . .
can provide the programs for printing waybills for Express
Mail, Certified Mail, Registered Mail, Insured Mail, etc.
The program operation of the postal waybill terminal
20' is illustrated in block diagram form in Fig. 8, and a
sample waybill form is shown in Fig. 9. Upon insertion of the
. ~ .. . ......... .
user card 10 in slot 11, the user confirmation procedures
J30 previously described are carried out between the terminal MPU
l 30 and card MPU 60. If an unauthorized card or user is
: ,'.
- 26 -
; ,
,
: ` ~
1326911
detected, the card is locked and the terminal operations are
terminated. nith a valid user card, the terminal program then
` checks if a rate card 90 and/or a special services card 100 is
inserted and whether each is valid. Validity can be
, ~
determined by the issue number of the card or by an indicated
expiration date. If there is no rate card or special services
card, the terminal MPU requests the user to input the desired
postage and goes to the print key decision block 121. The
'.'$
- terminal is then used to print a postmark or postage label a~
described previously. If a valid service~ card is present,
the terminal program displays a menu of mailing or carrier
services from the services card and requests the user to
select a service.
~` The terminal MPU 30 loads the selected service program
from the service card and executes it, as indicated at block
: ;
118. For typical carrier services, the service program
displays a standard carrier waybill form used by the selected
carrier. For example, if the U.S. Postal Service Express Mail
service is selected, the form shown in Fig. 9 is displayed.
The form includes a carrier identification field 130, service
~ .. ,~ . . . . .
class field 131, and pointers on the display for inserting
information in fields 132-137 and 140-146. A waybill
identification number in bar code 138 and characters 139 is
, . . .
selected for the transaction and displayed. Preferably, the
services card has a list of reserved waybill numbers which are
sequentially incremented for each completed transaction. If a
transaction is not completed, the number 1s saved for the next
transaction. As described previously, the bar code can
include a section which is an encryption of one element of the
` 1 ' . . .................. .
~30 waybill information, so that the authenticity of the form can
be verified by machine processing of thë waybill.
' s . .
- 27 -
... , j .
. .
:
t 132~9~1
The services program as executed by the terminal MPU
30 next uses cursor prompts to request the user to provide
inormation for certain field~, such as the zip codes or
origin and destination 132 and 133, and the addresses of the
sender and recipient 140 and 141. As the user supplies each
item of information and presses an "Enter" key, the program
causes the cursor to shift to the next field of information to
be supplied, as indicated by the arrow~ C in Fig. ~. The date
and time fields 134 and 135 may be requested from the user or
supplied from the terminal if it is provided with a clock and
calendar. The weight 136 may be provided from the output of
the scale 53, if connected to the terminal, or supplied by the
user. The meter identification number (MIN) is supplied by
the terminal for field 137.
i Ba~ed upon the origin and destination zip codes and
'~f
weight, the postal amount, other service charges, and total
maount ~44-146 are calculated and displayed under program
control using the rate card if appropriate. The total
transaction amount is saved. If the Prlnt- key is depressed,
the terminal program then sends the "commence" signal to the
card MPU and printer MPU to execute the handshake procedure
and debiting and printing operations a~ previously described.
If an "Auto" mode key of the terminal is depressed or the user
, . . ............ .
, elects to continue in re~ponse to a prompt, the terminal
, . . . . . . .
;~f program returns to the beginning of the tran~action loop
, ............................. . . .. .. . . . . .
indicated at block 113. The terminal operation is terminated
if the transaction loop is not continued, or if the handshake
procedure is not completed.
., ,
: ' .
1,
-' - 28 -
'~.
.
1~26~911
. .
-~ The terminal can be used to program and print the
waybills of other selected carrier~ or services by insertion
of the proper user, rate and/or service cards. For
convenience o~ the automated terminal system, it is desirable
i~ all~postal and waybill forms can be standardized to one or
-~ a limited number of form blanks.
.
B~ B~lb2~ iB~l
Another embodiment of the invention is the provision
.... . . . . . . ...
of a user card refilling terminal which may be maintained at
any desired postal retail or distribution location for the
.. ... . ....
convenience of the issuer of the cards ana users A new
,j . . .. . . . . . . .
~ amount can be "filled", i.e. credited to an authorized balance
. . .
maintained in the user card, and a master refilling card
having a greater amount for distribution is correspondingly
:~ . . . ......... .. .... ...
debited. In accordance with the principles of the invention,
, ... .. .........
the secure handshake recognition procedure is executed before
.. " . . .
the transaction is authorized. The refilling terminal can
. . . .
- also be used to validate new cards to be issued.
, . ............ .
~n exemplary embodiment of the refilling terminal i~
.. ~ . . . . . . .
~ 20 shown in ~ig. 10, having a fir3t ~lot 161 for a ma~ter
., ........ .
refilling card 160, a second slot 171 for a supervisor card
170, a third slot 174 for a usër card 10, a terminal
.. . . .. . . . .. . . . .. . . . .. .
microprocessor 30", a keyboard 31", and a display 32". Each
...... .
card iB of the type desceibed previou~ly, with secure
.. ..
microprocessors (MPU) 162, 172, and 60, respectively, in
, . . ...... . . .
contact with respective terminal contacts 163, 173, and 175.
.. . . .... .. . . . . . . . .. .. ... . .. ... .. .
~ Switches 162a, 172a, and 176 provide detection signal~ when
.: . . . .. .... . .
the cards are ins!erted in their respective slots. The
operation of terminal MPU 30" i8 enabled after insertion of a
~30 master card 160 and a supervisor card 170.
.. .
- 29 -
. . ..
1~2~:3~
A master reilling card is initially purchased from a
central issuer, such as the U.S. Po~tal Service, an authorized
distributor for the central is~uer, or a private carrier
company. It is generally intended to be purchased by a local
. .
refilling entity which provides service to individual users,
such as a bank branch, retail store, or corporate department.
In the preferred embodiment, it is manufactured in a fixed
denomination and remains locked until it is activated by a
supervisor card of the central issuer. The encryption
10 algorithms used for the handshake procedure are already
written into its MPU firmware, and is enabled to execute the
handshake procedure when the secret key number is installed by
. .
a supervisor card d~ring the activation procedure. Once
J activated, the master card balance is debited for refilling
transactions until it is used up. ~ history of all debiting
transactions is maintained in the master card.
i A supervisor card is provided by the central issuer in
the custody of an officer or manager of the local refilling
i entity and a supervisor PIN i~ assigned. The supervisor card
;i 20 is u8ed to unlock all master cards sold to the refilling
entity and to maintain a record of the serial numberæ of the
master cards for subsequent card confirmation procedure~. It
, .. ~; . . .
is used to authorize crediting transactions to user cards, and
maintains a transaction record of all refilling operations and
the identity of the recipient user cards. The supervisor card
is manufactured with the handshake encryption algorithms in
firmware, and may be provided by the central issuer with a
secret key number to be installed in the master and user
cards. The master and supervisor cards together allow user
.. ... . . . .
cards to be conveniently refilled at widely distributed local
... . . . . . . .. .
entities without the need for on-line confirmation of each
.. ..
- 30 -
.
1326911
re~illing transaction ~rom the central is~uer. Alternatively,
the user card can be refilled by the master card alone, with
the handshake procedure executed between the user card's MPU
and te master card's MPU. However, the use of a controlling
supervisor card is preferred as an additional level o security
to deter counterfeiting or fraudulent use of the higher value
master cards.
The operation of the refilling terminal will now be
described for the preferred three-card embodiment with
reference to the block diagram o~ Fig. 10. Upon initiation of
the terminal program, the master card is checked at block 180
to determine if it is already activated. If not, the terminal
;~ follows an activation procedure at block 1~1 of confirming the
supervisor PIN, checking the master card serial number,
installing a secret key number in the master card, executing
the handshake procedure, then unlocking the master card ~8
balance, and recording the master card's serial number,
balance, date, and other transaction information.
If the master card has already been activated, the
supervisor card checks the master card serial number against
j its record of authorized master cards. If the master card iB
unauthorized, the terminal program goes to an end procedure at
block 197. With an authorized master card, the terminal
program checks if the user card inserted in the terminal is
... . . .
new or to be refilled. For a new user card, the refilling
terminal executes at blocks 190-193 a valldatlon procedure
which includes checking the designated card serial number with
the number embedded in its memory, recording the user'~
identification in~ormation, and assigning a user PIN. At
block 192, the terminal prompts the operator for any
limitations on the amounts or type of transactions the card
.. ..
- 31 -
1 3 2 ~ 9 ~ ~
can be used for, the identification numbers of the terminals
to which the card i~ restricted, or an expiration date if
required by the issuer. The validation procedure is completed
by installing the secret key number and sealing the secret
memory zone.
If the user card is to be refilled, the user PIN is
confirmed, and then the card is checked for any balance to be
credited toward the new amount or to the user's account. The
old memory section is then locked from further transactions,
10 and can only be used for reading out a transaction hi~tory.
Upon a request for a new amount, either for a new card that
; has been validated or for a card to be refilled, the terminal
MPU 30" opens a handshake channel, and the handshake procedure
previously described is executed between the master MPU 162
and the supervisor MPU 172. When the handshake procedure i8
completed, the master balance is debited and the supervisor
Z card proceeds to open a new transaction memory section in the
user card into which the new balance is written. The program
then provides at block 197 an end selection of further
20 operations which may be carried out on the refilling terminal.
~J
~or example, another refilling transaction may be processed,
the supervisor card record may be updated, the newly validated
user or master card may be embossed with a serial number or
,~J
account number if the terminal is connected to an embossing
Z machine, or operations may be terminated.
The described refilling system i8 protected at several
Z levels of security. First, a superviZ30r card is required, and
i~ the user card must be validated by the user PIN. The master
card must be validated by the supervisor card and must execute
o the handshake procedure before the user card is credited with
. . . .
a new amount. The card/terminal system has the primary
- 32 -
.. . . .
132~911
advantage that the debiting of the card balance is executed in
the same time frame that the value dispensing operation is
carried out, and the exchange can only be carried out for each
transaction if the mutual handshake recognition procedure is
executed between the secure microprocessors controlling each
part. Also, the central issuer purchases the card/terminal
system from the manufacturer with a given set of encryption
algorithms, and then selects a unique secret key not known to
the manufacturer. Thus, penetration of the manufacturer ~B
, ,'~! IO 8ecurity will not compromise the security of tbe issuer's
system. By issuing cards with defined expiration dates or
,';,.~J .
series numbers and changing the secret keys periodically, an
issuer system can be made even more impenetrable to
counterfeiters.
~! The user 18 card is not merely a passive record of an
account number and balance, but rather operates to
3 affirmatively protect against unauthorized use of the card,
for example, if a succession of incorrect PIN entrie6 i8 made,
if the card is used beyond its expiration date or ln an
` 20 unauthorized machine, or if a re~uested transaction is in
excess of predetermined limits. Similarly, the value
- dispensing part of the terminal is protected against tampering
by the physical bonding of the printer microprocessor to the
print head.
Moreover, since the postal and re$illing transactions
::.~ . . ........ . .
1 are executed with cards issued by a central issuer take place
.. . .
only within the issuer's system, they are protected from
counterfeit cards or cards issued by another system. one
issuer's system thus remains closed to all other issuer~
systems, and several systems can use the same terminals
without interference from the other. For example, the U.S.
- 33 -
i~ ~; 1326911
Postal Service and ~everal private carriers can each
constitute a separate issuer Rystem issuing it~ own cards, A
user can purchase a card from each system and use the proper
card in any terminal maintained at a local entity (branch post
of~ice, bank branch, local retail store) to generate
authorized postage or a waybill for u~e in the corresponding
system. Thus, users will have the benefit of secure and
convenient access to a wide range of postal and carrier
., .
- services.
In the invention, the microprocessor cards (user,
master, and supervisor), memory cards (rate and special
services), and terminals (metering, waybill printing, and
refilling) comprise an integrated postal transaction Rystem
which provides a greatly improved level of access,
convenience, and security, compared to conventional po~tal
machines. The overall system is illustrated in Fig. 12. It
allows widely issued user cards to be used in widely
distributed postage metering and waybill printing terminals,
with the appropriate rate and/or 6ervices cards, to access a
2o plurality of postal and carrier services. The refilling
.~ . .
~ terminals allows a central issuer to distribute postal
.;. . .
monetary value to users at widely distributed locations.
Strict physical access controls are not required, the need to
limit thé postal amounts and services obtainable by issued
cards is reduced, in-person purchase transaction~ are avoided,
~` and on-line confirmation by a central account office is
: ! .. ... .... .
obviated. The cards and terminals are cvonfigured to be
autonomous, yet mutual recognition and confiemation of
validity and transaction amounts are required, thereby
~lO providing a high level of security for the system.
.. . ... . .. .. .
Further, the invention is not limited to the described
- 34 -
, .
.~ ,
132~911
automated postal terminals. The principlee of the invention
can be adapted to any other value exchanging tran~action where
it is desired to use an account card in an off-line automated
terminal system Thus, the de~cribed ~martcards and value
dispensing terminals can also be used for dispensing cash,
. ,; ,
printing tiakets, issuing coupons, etc., and the user can
possess a varie~y of cards each issued by a central issuer for
the convenient purchase of different article~ of value. Also,
by implementing smartcard and terminal MPU programs which
check for authorized machine identification number~ and card
.
serial numbers, or execute the handshake procedure with
different algorithms and/or secret keys, an issuer's system
can be configured ~o that the issuer's cards and terminals may
, be made open or restricted to certain families, series or
, .
locations..
The invention also encompasses other features which
are u~eful adjuncts to the central concepts described above.
For example, a transaction history printer may be provided
from which a user can print a record of transactions stored in
the smartcard upon entry of the correct PIN. The various
cards can be provided with notches on a border or coded key
~, elements to prevent insertion of the wrong card in an
incorrect terminal s10t or in a terminal of another issuer
system. ~180, the invention can be adapted for on-line
transaction system~. For example, the terminal MPU can be
connected by a telephone line or local network to a central
processing office for approval of a transaction prior to
. .
execution of the transaction. On-llne confirmation may be
j desired for initialization and refilling transactions which
are less freguent and of higher value than purchase
; transactions. As another security featu~e, the card or series
. . .
- 35 -
~!
:
. ;~..
1~2~
of cards may be issued with encryption algorithms and/or
secret key numbers which are changed periodically, and the
encryption algorithms and secret keys corresponding to cards
presented for a transaction can be loaded in the terminal at
. the time the terminal MPU establishes an on-line connection to
the central office.
Based upon the foregoing disclosure, many other
peripheral features and modifications and variations on the
principles of the invention will become apparent to persons
lo familiar with automated terminals and smartcard systems. It
is intended that the embodiments and features described herein
and all further features, modifications, and variation~ be
included within the allowed scope of the invention, as defined
;
in the appended claimR.
f
'~ "
. ,
..
!
''
':',
. "
' ~.
- 36 -
..
.~ ~
