DE4230866A1 - Data handling system for smart data cards - has input of code and values to on card integrated circuit for checking to control access and use - Google Patents

Abstract

A data card of a type used for account transactions and purchases is of a so called `smart' card form in which the card contains an integrated circuit. The integrated circuit has an input-output stage (2) and a data handling stage (1). Values can be entered (2.1) and is transferred into a buffer (1.8) where it is compared (1.7) with the previous (or old) value (1.9) held in memory (1.6). If the new value is less than the current value in memory the transaction is allowed, provided that a legitimation input is produced. This is in the form of a personal identification number. USE/ADVANTAGE - Provides multiple protections against misuse.

Description

The invention relates to a data exchange system stem consisting of at least one input direction and at least one, one or more in portable data containing integrated circuits carrier in which there is a store of value in which a numerical value can be stored, the number lenwert readable from the input device and is decrementable.

Such data exchange systems are known per se. They essentially consist of an input entry direction in the form of one or more terminals and one or more portable, one or more each Volume containing integrated circuits ger, z. B. in the form of a chip card. A well-known case This is a game for such a data exchange system  public card telephone of the Deutsche Bundespost. One serves as a data carrier as a "prepaid card" or "Credit card" designated chip card, in the Value memory is stored a numerical value that represents an amount of money. By decrementing of the numerical value after inserting the chip card in the card phone becomes the amount of money electronically decreased until it is finally used up. The non - reusable prepaid cards will then be issued by User returned and destroyed and it will bought a new prepaid card, in which another one numerical value representing the desired amount of money is stored. Such a prepaid card is with described for example in EP 0 328 124 A2. A There is a disadvantage of the known data exchange system in that the user does not own the prepaid card can recharge, but a new prepaid card must advertise and that the use of the prepaid card only for a very narrow purpose, for example for making calls.

They are also controllable communications via chip cards on systems known in which the chip card itself does not contain a store of value and therefore also no Represented amount of money, but only for Legi Timing of booking processes, where of a debit account of the cardholder Amounts are debited. Examples of such Chip cards are credit cards, check cards or Zu gait authorization cards. With them, before the desired debit or the desired one Access is released, the access is checked  Card users are authorized to use it. This can, for example, by entering a so-called "PIN number" happen at the input device. A number of methods have been developed in order to prevent abuse or the Ma to prevent chip card nipulation and the Ge keep the data stored in it secure put. For example, reference is made to this to DE 26 21 269 C2, DE 38 09 028 A1 and EP 0 203 543 B1.

The systems in the second category have the Disadvantage that when used to acquire Wa anonymity is established and that both the handling by the user as well as the constantly necessary over test procedures a relatively high technical and require time expenditure.

The invention has for its object a data exchange system with the input and in the generic term of the features specified in claim 1 fen, which is designed so that with a por tablen disk, z. B. in the form of a smart card, the Users of cashless access made a huge difference services or purchases of goods becomes. On the one hand, the utilization of the Service or purchase of goods without large tech niche effort and completely anonymously possible, others on the other hand, a "recharge" of the disk gers be possible, both a legitimation  testing as well as various protection options against abuse.

This object is achieved according to the invention with the characteristics from the characteristic part of the Claim 1. Advantageous further developments of Invention are described in the subclaims.

The basic idea of the invention is that the Properties of a common prepaid card - such as B. a calling card - with the characteristics of a Kre ditkarte are linked. The use of the data carrier gers when using a service or when buying a product goes without identification of the user, without high technical effort and completely anonymous in front of you. The disk will be on "point-of-sale" (i.e. at the service provider or sales fer) read by an input device, and the Price is based on the number stored in the data carrier lenwert debited. It is not a complex communica tion with a central body, which checks the authorization, makes the debit or carries out other transactions. It must be on point-of-sale no "black lists" who kept the. Because the identity of the user at this ago is not registered, it remains completely anonymous. So in each of these relationships the disk has the quality of cash.

The fields of application of the data according to the invention exchange system, or such a data carrier,  are very diverse. In addition to the use at public Chen such a data carrier can above all when using public or private Services are used, such as B. in the public local public transport, in stationary traffic (Multi-storey car parks, parking lots) or at leisure facilities For this purpose, the data carrier is then in one Enter "automatic debit machine", which is the one for each the amount necessary to use the data carrier debits. The amount debited will then continue processed that he between the issuing point of the Data carrier and the owner of the "debit car maten "is billed.

Such a data carrier, once acquired, is theoretical table can be used indefinitely as it keeps going can be "charged". There are several for this Facilities and procedures conceivable. On the one hand the "charging" could be authorized specifically for this purpose ten "charging points" at which the Da Carrier by cash or credit card payment is charged. On the other hand, machines are conceivable where this process by the user independently can be carried out.

On the other hand, the user has his own Ver invoice account, which for him when acquiring the Da has been set up, he can use the data carrier also inserted into a special input system ben who charges the card and at the same time his clearing account with the equivalent  of the amount loaded. The legitimation this process could the input system z. B. there by checking that the input device Authorization of the user is checked and the user himself by entering a personal secret number certified. Such a "charging process" includes the verification of authorization and legitimacy tion can both independently via an input establishment as well as by means of an on-line connection be processed to a higher-level system. in the the latter are the "input device" various devices conceivable. Could do this e.g. B. existing machines such as tickets or money dispensing machines can be used. It is also conceivable that this charging process out specifically for this equipped phones can be done over which established the online connection mentioned becomes.

How conventional portable data carriers work non-volatile memories - especially from Chipkar ten - is known per se. From the outside gets in shape electrical signals, usually as a string, specified the address of a specific storage location ben and its content - usually a character - is read and transmitted to the outside, or a characters transmitted from the outside are also used in the Storage space written. The simplest This procedure can be applied to all memory locations read and write access. As before Chip cards mentioned above are also known,  the protection mechanisms in the form of logic circuits contain which the reading and / or writing Access to all or certain memory locations prevent, if not a certain one from the outside beforehand Code (e.g. the so-called PIN) and transmitted Agreement with one contained in the chip card a code that is not accessible from the outside has been.

To solve the basis of the invention Pro blems these known arrangements are not ge is suitable because they have access to certain dishes either free or after entering the Legitimation information is possible. That of the inventor The underlying problem is that the Access to the store of value, which contains the numerical value, which represents an amount of money in the bare Read out and be free when debiting while he when recharging only given legitimacy possible or completely free. The difference is that in one case the content lowers becomes or remains unchanged while it is in the other ren case should be increased. The invention sees for this a logical arrangement on the data carrier which, in the case of certain storage locations, the of externally transmitted, new information with the old Comparing content and describing it with the new one Only allows value if it is either equal to the old one or lower than this, or if not applies if there is legitimation.  

As below using an exemplary embodiment explained in more detail are in the Da according to the invention exchange system different procedures for Verification of legitimacy and prevention of Realized abuse in a technically simple manner bar. The facilities in the data carrier for Reading / reading of data as well as for comparison and / or Encrypting and decrypting codes can realized on the one hand by logic circuits on the other hand, it is also possible to use this Functions by means of a arranged in the data carrier programmable processor with memory ren.

It can also be used for certain types of applications be useful if the data according to the invention exchange system a variety of input devices contains genes, of which a first group only with devices for reading and decrementing the numerical value stored in the value memory is steady while a second group is alone or closed additionally with devices for incrementing the im Value memory stored numerical value equipped is.

The following are based on the attached drawings gene exemplary embodiments for data exchange systems according to the invention and for performing with them baren procedures for the exchange of data and for Si Protection against misuse of the data carrier or the Input device explained in more detail.  

The drawings show:

Fig. 1 shows a data carrier in the form of a smart card;

Fig. 2 device in a basic circuit diagram of a Einausgabe and a data carrier with the means for A / readout of the value memory;

Fig. 3 in a representation analogous to FIG 2, the output device A and the data carrier with the device parts for turning on / reading out of a memory for a PIN.

FIG. 4 in a representation analogous to FIG. 2, the input device and the data carrier with the device parts for reading / reading a memory for a super code;

FIG. 5 is an illustration analogous to Figure 2, the transfer device Onff and the disk with the device parts to the A / reading out of a memory for a fixed system code.

FIG. 6 in a representation analogous to FIG. 2, the input device and the data carrier with the device parts for reading / reading a memory for a variable system code;

FIG. 7 in a representation analogous to FIG. 2, the input device and the data carrier with means for checking the authenticity of the input device;

FIG. 8 in a representation analogous to FIG. 2, the input device and the data carrier with means for checking the authenticity of the data carrier;

Fig. 9, in a representation analogous to FIG 2, the A output device and the data carrier with means for blocking the A / readout of the data carrier after a predetermined number of errors.

Figure 10 is an example of a Einausgabeeinrichtung and a data carrier having a combination of different pieces of equipment to the A / reading out data and codes.

Figure 11 is a schematic perspective view of a Einausgabeeinrichtung in the form of a debiting device for public transport.

Figure 12 is a schematic perspective view of a Einausgabeeinrichtung in the form of a debiting device in a parking garage.

Fig. 13 is a schematic perspective view of an output and charging station for users without a personal clearing account;

FIG. 14 is a schematic perspective view of a charging station for user personal clearing account;

Fig. 15 is a block diagram of the technical features of an on-line charging.

In Fig. 1, a data carrier for use in egg nem data exchange system according to the invention is Darge. It is a data carrier for a user with a personal clearing account. The data carrier has the form of a conventional chip card 1 , in the integrated electronic circuits "chips" 1.5 are arranged. On the outside of the card, labeling fields 1.1 for the issuing point or the member company, 1.2 for the card type or the system name, 1.3 for the card number and 1.4 for the name of the card holder are arranged.

In the following it will be explained with reference to FIGS . 2 to 10 which input methods for data in the form of the numerical values representing a monetary amount and the various codes can be implemented with such a data carrier and the correspondingly equipped input means. In this case, only the parts of the device that are directly necessary for the described function are specified, while in particular the usual and known device parts of an input device are not shown in detail.

In FIG. 2, a data carrier 1 is shown, which cooperates with a Einausgabeeinrichtung 2. The data carrier 1 has a value memory 1.6 in which the numerical value representing the amount of money is stored. From a value input device 2.1 of the input device 2 , a new numerical value is entered into a buffer 1.8 in the data carrier 1 . The old value stored in it is entered from the value memory 1.6 into a buffer memory 1.9 . By means of a comparator 1.7 , the new value and the old value are compared with one another and it is determined whether the newly entered value is equal to or lower than the old one, or, if this is not the case, whether there is legitimation information. The new value is only written into the value memory 1.6 via an OR gate O1 and an AND gate U1 if it is either lower than the old value or if the identification information is available.

One way of entering legitimation information is by entering a code, for example in the form of a multi-digit PIN by the user, which is known only to the user. As can be seen from FIG. 3, the code is entered by the input device 2 via the “input PIN” 2.2 into the buffer memory 1.12 of the data carrier 1 and there by means of the comparator 1.11 with the one retrieved from the PIN memory 1.10 and in the buffer memory 1.13 stored old value of the PIN compared. In the event of a match, the legitimacy information is given to the OR gate O1 from FIG. 2. The code permanently programmed in data carrier 1 changes from data carrier to data carrier and cannot be read from the data carrier via the input device. This prevents a third party who comes into possession of the data carrier through loss or theft - but does not know the user code - from loading the data carrier at the expense of the rightful owner.

A variant of this method is shown in Fig. 4 Darge. Here, the user can enter a new user code of his choice into the data carrier 1 by means of a suitable input device 2 . However, this requires the input of a super code known only to him, which is also not readable and stored in a super code memory 1.14 in the data carrier. The super code is entered via an input terminal 2.3 of the input device 2 into a buffer 1.16 of the data carrier 1 and compared via a comparator 1.15 with the super code retrieved from the memory 1.14 into the buffer 1.17 . If there is agreement, an enable signal for the input of a new PIN is supplied to the memory via an AND gate U2.

This protects the rightful owner from be feared possession of the data carrier by a Person who knows the previously valid user code.

Now it is conceivable that a technically adept, legitimate holder of a data carrier builds a device or procures a corresponding input device and modifies it so that he uses the charging process bypassing the data exchange system provided for this purpose and using his account of his user code can be made as often as required. In order to make this fraudulent procedure impossible, it is possible to provide an additional protective device with system codes. It consists in a first variant according to FIG. 5 that a system code memory 1.8 is stored in the system code memory 1.8 on the data carrier 1, which is not accessible from the outside and is identical for all data carriers. This system code is fed via the buffer 1.21 to a comparator 1.19 and compared there with a code which is automatically fed from the code input device 2.4 of the input device 2 to the buffer 1.20 in the data carrier 1 . Appropriate legitimacy information is only given if there is a match.

In order to prevent the fraudulent holder of the data carrier from loading the data carrier as described above, even with this fixed system code, a variable system code is provided according to a second variant shown in FIG. 6. This system code is generated at the end of each loading process in the input device 2 or a higher-level system, for example as a random number, and there it is registered together with the owner data and transmitted to the data carrier 1 , which stores it in the memory 1.22 . At the beginning of the next on charging this variable code supplied from the code input means 2.5 on the buffer 1:24 in the data carrier 1 and there transferred by means of the Ver gleichers 1:23 with the buffer 1.25 saved last system code verg union. Only if there is a match, the legitimation information is given and the new system code is entered into the memory 1.22 via the AND gate U3. Since the fraudulent holder does not know this code, he cannot top up the card by using the data exchange system.

Another possibility of protection against fraudulent charging of the data carrier is that the data carrier itself checks the authenticity of the input device with which it is communicating. As can be seen from FIG. 7, for this purpose the input / output device 2 generates a random number at the beginning of the transaction with a randomizer 2.6 , which is encrypted in an encryption device 2.8 , for example by means of a system-specific code 2.7 . Both the random number itself and the result of the encryption are transmitted to the data carrier 1 . A comparator 1.8 , on the one hand, the random number transmitted encrypted by the input device 2 and, on the other hand, the random number transmitted in the data carrier 1 by means of the encryption device 1.26 based on a system-specific code 1.27, transmitted directly by the input device 2 . If there is a match, the legitimation information is given.

In an analogous method, which is shown in FIG. 8, the input / output device 2 can also be protected from being spied on. Here, too, the input device 2 sends an additional number directly from a data carrier 2.9 , which is encrypted there in an encryption device 1.29 on the basis of a system-specific code 1.3 and sent back to the input device 2 . It is compared in the input device 2 in a comparator 2.12 with the same random number which has been encrypted in the encryption device 2.11 of the input device 2 on the basis of the system-specific code 2.10 . Here too, information is provided to the other devices of the input device 2 only if the data carrier is authentic according to which the data carrier is authentic.

Influencing the encryption results system-specific code prevents a loading more deceptive in knowledge of the encryption process attempted to manipulate the disk. This system-specific influencing encryption Code is either for all disks and inputs facilities identical, or it can vary depending The location and purpose of the data carrier differ their codes come into question.

Finally, it is conceivable that a fraudster can find out the user code, the fixed system code, the card code or the encryption method used if he only carries one or more data, which he comes into possession of, long enough with a suitable device connects and examines the reactions of the data carrier to the transmission of targeted data. In order to prevent this, it is possible, as shown in FIG. 9, to provide the data carrier with devices which register erroneous attempts at access and, after a certain number of such attempts, lock the data carrier for any further use of any kind. For this purpose, for example, a comparator 1.31 is provided in the data carrier 1 for the PIN comparison and a comparator 1.32 is provided for the code comparison, which, upon immediate correct input, for example via an AND gate U4, provides legitimating information, while incorrect comparison results each give one Counters 1.33 and 1.34 are fed. After a preset number n of counting operations, the counters 1.33 and 1.34 emit a signal via an OR gate O2, which blocks the card.

The abovementioned possibilities for preventing abuse can of course be combined with one another within a data carrier and an input device. Such a Einrich device is shown in Fig. 10. In FIG. 10, the same reference numbers with the addition of a - or a "are used for device parts which are constructed analogously to the devices according to FIGS. 2 to 9. In addition, an error counter 2.13 is used in the input device 2 to prevent spying out an input device through manipulated or counterfeit data carriers, a control device 2.14 for charging, a code number sensor 2.15 with an encryptor 2.16 , a buffer memory 2.17 for the newly entered numerical value and a memory 2.18 for the old one read from the data carrier 1 In the data carrier 1 there is also a decoder 1.35 for the encrypted transmitted PIN and the code number, an additional error counter 1.36 for the authenticity check of the input device 2 and AND gates U5, U6 and U7, which were determined in a manner that can be read from the circuit diagram Enable functions within the data carrier.

Overall, the circuit diagram shown in FIG. 10 is understandable in itself and is therefore not explained in more detail here.

Fig. 11 illustrates a possible application of the data exchange system in public transport described. In this case, the Einausgabeein device designed as an automatic fare debiting device is installed in the vehicles, for example, and can be operated directly by inserting the corresponding chip card into the data carrier input and making the necessary entries via the operating unit. A display field shows the information necessary for the user.

Fig. 12 shows an example of an application of the described data exchange system in a parking garage. Appropriate booking machines are set up at the entrance and exit stations. The automatic debit machines are actuated via the card input and the corresponding information for the user is displayed on the display unit.

The amount debited in the automatic debit machines is then processed so that it between the Aus of the data carrier and the holder of the Abbu automatic billing machine.

Fig. 13 shows an automatic loading machine in which the data carrier can be loaded by payment with cash or credit card. For this purpose, the chip card is entered into the data carrier input / output. Payment is made by inserting the coin, checking the banknotes or entering credit cards. The necessary entries are made via the control unit with keyboard and the screen shows the user the necessary information.

If the user has his own clearing account, which was set up for him when the data carrier was purchased, the charging can be carried out on a machine installed specifically for this purpose, as is shown, for example, in FIG. 14. The individual steps of this charging process are shown in FIG. 14, namely

• 1. Enter the data carrier,
• 2. Choosing the "Charge" function,
• 3. Enter the PIN number,
• 4. Enter the desired amount,
• 5. Removing the data carrier.

Entries are made via the control unit, and the necessary information can be viewed on the screen be read.

In Fig. 15, in addition to Fig. 14, the equipment parts of an on-line charging station are shown in a prin zip circuit. They are understandable from the circuit diagram and are not explained in more detail below.

Claims (24)

1. Data exchange system consisting of at least one input device and at least one portable data carrier containing one or more integrated circuits, in which there is a value memory in which a numerical value can be stored, the numerical value being readable and decrementable by means of the input device , characterized in that at least one input device ( 2 ) is equipped for incrementing the numerical value stored in the value memory ( 1.8 ) of the data carrier ( 1 ) and the data carrier ( 1 ) contains devices ( 1.7 ) which can be read out and decremented as desired Allow the numerical value stored in the value memory ( 1.8 ) from the input device ( 2 ), while only allowing the incrementing of the numerical value stored in the value memory ( 1.6 ) from the input device ( 2 ) after inputting legitimation information. 2. Data exchange system according to claim 1, characterized in that the data carrier ( 1 ) contains a code memory ( 1.10 ) in which a user code is stored, and a comparator ( 1.11 ) for comparing one via the input device ( 2 ) entered codes, with the stored user code and for emitting a legitimation signal to the device for incrementing the numerical value stored in the value memory ( 1.6 ) if the code entered matches the user code. 3. Data exchange system according to claim 2, characterized in that the user code is unchangeable and not readable from the data carrier ( 1 ) is stored. 4. Data exchange system according to claim 2, characterized in that the user code is stored changeably and the data carrier ( 1 ) contains a further code memory ( 1.14 ) in which a supercode cannot be changed and cannot be read out from the data carrier ( 1 ), and one Comparator ( 1.15 ) for comparing a code entered via the input device ( 2 ) with the stored supercode and for outputting a release signal permitting the change of the stored user code via the input device ( 2 ) if the code entered matches the supercode. 5. Data exchange system according to claim 3, characterized in that the stored user code is an immutable system code and the comparator ( 1.19 ) via the Einausgabeein direction ( 2 ) automatically a code retrieved from an external memory and compared with the system code. 6. Data exchange system according to claim 2, characterized in that the stored user code is a changeable system code which is changed when the numerical value stored in the value memory ( 1.6 ) is incremented by an automatically generated and externally stored new one via the input device ( 2 ) Value for the system code is transmitted to the data carrier ( 1 ) and stored there in the code memory ( 1.22 ) and this new value of the system code is automatically fed to the comparator ( 1.23 ) of the data carrier ( 1 ) via the input device ( 2 ) during the next incrementing process is compared with the stored system code. 7. Data exchange system according to claim 6, characterized characterized that the values of the system code are generated as random numbers and together externally saved with additional information be saved. 8. Data exchange system according to one of claims 1 to 7, characterized in that in the data carrier ( 1 ) and the input device ( 2 ) A devices ( 1.26 , 1.29 , 1.35 ; 2.8 , 2.11 , 2.16 ) for encrypting and decrypting the exchanged data are arranged. 9. Data exchange system according to one of claims 1 to 8, characterized in that the data carrier ger ( 1 ) contains a plurality of value memories. 10. Data exchange system according to one of claims 1 to 9, characterized in that in the data carrier ger an encryption device ( 1.29 ) and in the input device an encryption processing device ( 2.11 ) and a comparator ( 2.12 ) are available for checking the authenticity of the data carrier ( 1 ) by submission a random number to the data carrier ( 1 ) from the input device ( 2 ), encryption of the random number in the data carrier, retransmission of the encrypted random number to the input device ( 2 ) and comparison of the data carrier ( 1 ) encrypted random number with which Originally from the input device ( 2 ) from the given and encrypted random number. 11. Data exchange system according to one of claims 1 to 10, characterized in that in the data carrier ger ( 1 ) an encryption device ( 1.26 ) and a comparator ( 1.28 ) and in the input device ( 2 ) an encryption device ( 2.8 ) are present for authenticity checking the input device ( 2 ) by delivering a random number in encrypted and unencrypted form to the data carrier ( 1 ) from the input device ( 2 ) and comparing the random number encrypted in the data carrier with the random number encrypted in the input device in the data carrier ( 1 ) and released the protected storage locations in the data carrier if they match. 12. Data exchange system according to claims 10 or 11, characterized in that the encryption and decryption of between the one output device ( 2 ) and the data carrier ( 1 ) exchanged data taking into account a fixed in the data carrier and not readable from the data carrier stored card code , which is stored in the input device ( 2 ), or can be called up from it from an external memory. 13. Data exchange system according to claim 12, characterized in that the card code for all Da tträger ( 1 ) is identical. 14. Data exchange system according to claim 12, characterized characterized that different card codes according to the location or purpose of use of the data carrier can be used. 15. Data exchange system according to one of claims 1 to 14, characterized in that the data carrier ( 1 ) contains devices ( 1.31 , 1.32 , 1.33 , 1.34 ), by which after a predetermined number of incorrect to the data carrier ( 1 ) or incorrectly decrypted codes, the data exchange is interrupted and / or a blocking signal is emitted, which triggers a change that prevents further use of the data carrier ( 1 ). 16. Data exchange system according to one of claims 1 to 15, characterized in that the input device ( 1 ) contains devices ( 2.13 ) ent, by the incorrectly transmitted to the input device ( 2 ) after a predetermined number or incorrectly decrypted codes of data exchange aborted and / or a blocking signal is emitted which triggers a change that excludes further use of the input device ( 2 ) at least for a predetermined period. 17. Data exchange system according to one of claims 1 to 16, characterized in that the connec tion of the data carrier ( 1 ) with the Einausgabeein direction ( 2 ) via an interface with wireless signal transmission. 18. Data exchange system according to one of claims 1 to 17, characterized in that the Einrich lines in the data carrier ( 1 ) for reading / reading data, as well as for comparison and / or encryption and decryption of codes are realized by logic circuits. 19. Data exchange system according to one of claims 1 to 17, characterized in that the Einrich in the data carrier for reading / reading data ten, as well as for comparison and / or encryption and decrypting codes by a program mable processor with memory realized are.   20. Data exchange system according to one of claims 1 to 19, characterized in that it contains a plurality of input devices ( 2 ) ent, of which a first group is only equipped with devices for reading and decrementing the numerical value stored in the value memory, while a second group alone or additionally equipped with devices for incrementing the numerical value stored in the value memory. 21. Data exchange system according to claim 20, characterized in that at least some of the input devices ( 2 ) equipped with devices for incrementing are connected via an on-line connection to an authorization computer. 22. Data exchange system according to claim 20 or 21, characterized in that at least part of the equipped with devices for incrementing input / output devices ( 2 ) is designed as a ticket machine. 23. Data exchange system according to claim 20 or 21, characterized in that at least part of the equipped with devices for incrementing input-output devices ( 2 ) is designed as a cash dispenser. 24. Data exchange system according to claims 20 or 21, characterized in that at least some of the input / output devices ( 2 ) equipped with devices for incrementing are designed as telephones.