Abstract:
The present invention permits ISO-7816 smart cards and their non-smart card supporting devices to be connected and to interact over networks, such as networks based on Internet Protocol (IP), broadband, and wide area networks (WAN) using the T=1 protocol, similarly to if these devices were connected locally. Broadly, the invention takes a node address in a small T=1 embedded terminal and maps each address into a network address or a Universal Resource Locator (URL), such that different components of the terminal that are T=1 addressable are able to exist throughout for example, an IP network. The advantages offered by the invention include security and speed, resulting in increased ease of use and application development and increased autonomy for the smart card itself.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application claims priority to applicant&#39;s co-pending application having U.S. Serial No. 60/125,154 filed Mar. 19, 1999. 
    
    
     FIELD OF INVENTION 
     The present invention relates to a method and system for sending data and other information based on protocol standards developed by the International Standards Organization (ISO), related to smart card applications, and more particularly to a method and system for deployment of smart card applications on data networks, such as IP and broadband in view of ISO-7816. 
     BACKGROUND OF THE INVENTION 
     Smart cards have been employed in the field of financial transaction systems to store value, owing to their ability to contain cryptographic engines and store secret keys securely. As such, they have come to be regarded as a cheap tamper-proof repository for secure data, such as loyalty value, personal identification (ID) information, and even cash value. 
     All smart card applications are built around a standard specified by the International Standards Organization (ISO) as ISO-7816. This standard specifies a framework for storing data within the card and a basic operating Application Programming Interface (API) for commanding the card to perform its functions. 
     All smart card applications requiring cryptographic authentication usually require two or more smart cards, one card held by an entity desiring authentication and another card held by an authenticating authority that carries out the authenticating protocol defined by the application. This authentication process involves the two smart cards exchanging data in some form of a challenge and response scenario. 
     The ISO-7816 committee was well aware that many applications would require multiple smart cards, as well as non smart card devices, to support the applications. These devices include user interface displays, data storage, and keyboards. The committee also knew that these smart card devices and non-smart card supporting devices would need to be addressable from within any card or device within the application. As a result, the committee specified that smart card devices and supporting devices could optionally communicate with each other on a simple bus network, for which a protocol for an application component device was described to facilitate interaction between the devices over this bus. 
     The name given to the protocol was T=1, and it merely required that any data going into or out of any component device within the application be prepended with a header that specified the device address from which the data was sent, called a Source Node Address, and a device address, to which the application desired the data be sent, called the Destination Node Address. 
     Under the protocol, the T=1 Router within the application would route data to the Destination Node Address specified in the header. Application designers who did not desire to avail themselves of this feature would use the T=0 protocol, in which no header is prepended to data going to or from the smart card. 
     Typical applications for the T=1 protocol are microprocessor-based purchase terminals for smart card based cash applications, in which the T=1 addressable nodes are always hard-wire connected together and consequently reside on the same circuit board. These terminals typically are used in retail establishments to transfer value from a customer&#39;s smart card to the merchant&#39;s smart card. However, there is a growing need for these same applications to run in topologies where the T=1 addressable Nodes cannot be wired together as they are in an embedded terminal. One such topology is a network application where one smart card may be on a personal computer (PC) on the Internet and another may be in an Internet Server. 
     The ISO committee did not address the issue of smart cards and their supporting non-smart card application components communicating over a network. Consequently, no standards currently exist in the ISO-7816 specification for connecting smart card application components over a network. 
     There is therefore a recognized need in the art for an application that connects and allows for secure and quick data transfer over networks. 
     SUMMARY OF THE INVENTION 
     An embodiment of the present invention advantageously permits ISO-7816 smart cards and their non-smart card supporting devices to be connected and interact over IP, broadband and Wide Area Networks (WAN) networks using the T=1 protocol, just as if they were connected locally. The invention takes a node address in a T=1 embedded terminal and maps each address into a network address, such as a Universal Resource Locator (URL), such that different components of the terminal that are T=1 addressable may exist throughout, for example, an IP network. The advantages offered by the invention include security and speed, resulting in increased ease of use. Furthermore, the invention gives the smart card autonomy and independence by enabling it to contain within itself all the network addresses of the components of the application of which it is a part. 
     Smart card addressable nodes and non-smart card addressable nodes can send and receive data to and from any other Addressable Node with no “knowledge” of where those addressable nodes may be located (e.g., in the microprocessor&#39;s memory, on a device connected by serial IO line, or on a computer on a remote network). This provides an improvement over the prior art by allowing embedded smart card applications to be ported to large networks with little modification. 
     The present invention also allows new applications to be developed that can avail themselves of a network connectivity mechanism that allows programs inside the smart cards themselves to autonomously configure the network topology and then issue commands to send and receive data to the application components of the network. 
     In one embodiment, the present invention relates to a method for routing data between a microprocessor on a smart card and a component device over at least one network. The method comprises sending data from the microprocessor on the smart card to a router through a smart card address handler. The router is preferably an extended T=1 router and includes a first extended routing table. The data is then routed over the network. In routing the data, the data is sent from the router to a network-coupled address handler to the network. The data from the smart card may be routed to an internet protocol network, to a broadband network, to a wide area network or another network through which data is normally sent. The data is received at a second router that is hard wire connected to the component device. In receiving the data at the second router, the data is received from the network and sent through a second network-coupled address handler to the second router. The second router is preferably an extended T=1 router and comprises a second extended routing table. The data is then sent from the second router to the component device through a node address handler. In one embodiment, the second component is a security access module. The security access module may be a second smart card that authenticates the first smart card. In another embodiment, the component device may be a terminal application responsible for starting and operating a terminal. In a further embodiment, the component device may be a data storage device, responsible for storing data from smart cards in non-volatile memory. In another embodiment, the component device may be a terminal having a display device and an input device, such as a keyboard or a mouse. 
     In another embodiment, data is routed between a first cluster and a second cluster over at least one network. The data is sent from the first cluster to a network by sending the data from a first component device through a first node address handler to a first router and through a network-coupled address handler to the network. In one embodiment, the first component device is a smart card having a microprocessor. The first router is preferably an extended T=1 router, including a first extended routing table. From the network, the data is received at the second cluster. To receive the data at the second cluster, the data is received from the network at a second network-coupled address handler. The data is then sent through a second router and a second node address handler to a second component device. In one embodiment, the second component device is a security access module, including a second smart card that authenticates a smart card from the first cluster. The second router is preferably an extended T=router, including an extended routing table. 
     In another method for sending data between a first cluster and a second cluster over at least one network, the first cluster may comprise more than one component device, where each component device has its own node address handler associated with it. Data is sent from the first cluster to a network by sending data from one of the component devices through the node address handler associated with the component device to a router. The router is preferably an extended T=1 router, including an extended routing table. From the router, the data is sent through a network-coupled address handler to the network. In one embodiment, a first component device in the first cluster is a smart card having a microprocessor. A second component device in the first cluster may be a terminal having a display device and a keyboard. The data may be sent from the first cluster to the second cluster over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. The data is received from the network at the second cluster. In an embodiment of the present invention, the second cluster may include more than one component device, where each component device has its own node address handler associated with it. In receiving the data at the second cluster, data is received from the network at a second network-coupled address handler and sent through a router to one of the component devices via the node address handler associated with the component device. The router is preferably an extended T=1 router, including an extended routing table. In one embodiment of the present invention, a first component device in the second cluster is a security access module, including a second smart card that authenticates a smart card in the first cluster. A second component device in the second cluster may be a data storage device, wherein the data storage device and the smart card send and receive data using the node address handlers and the second router. Among other functions, the data storage device may be responsible for storing data from smart cards in non-volatile memory. In another embodiment, a third component device in the second cluster is a clearing and settlement device. 
     Another embodiment of the present invention relates to a system for routing data between a smart card having a microprocessor and a component device over at least one network. The system includes means for sending data from the smart card to a first router. The means for sending the data from the smart card to the first router is preferably a first smart card address handler. The system further comprises means for routing the data over a network. The means for routing the data over the network preferably include the first router and a first network-coupled address handler. The first router is preferably an extended T=1 router, including an extended routing table. In an embodiment of the present invention, the data may be routed over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. An embodiment of a system for routing data between a smart card and a component over a network further comprises means for receiving the data at a second router. The means for receiving the data at the second router preferably comprises a second network-coupled address handler. The second router is also preferably an extended T=1 router, including an extended routing table. An embodiment of the system of the present invention also comprises means for sending the data from the second router to the component device. The means for sending the data from the second router to the component device preferably comprises a node address handler. In one embodiment of the present invention, the component device is a security access module, including a second smart card that authenticates the first smart card. In another embodiment, the component device may be a terminal application responsible for starting and operating a terminal. In a further embodiment, the component device may be a data storage device, responsible for storing data from smart cards in non-volatile memory. In another embodiment, the component device may be a terminal having a display device and a keyboard. 
     Another embodiment of the present invention relates to a system for routing data between a first cluster and a second cluster over at least one network. The system comprises means for sending data from the first cluster to the at least one network and means for receiving the data from the at least one network at the second cluster. The means for sending the data from the first cluster to a network preferably comprise a first component device, a first node address handler, a router and a network-coupled address handler found in the first cluster. In one embodiment, the first component device is a smart card having a microprocessor. The router is preferably an extended T=1 router, including an extended routing table. In another embodiment, the first cluster may comprise more than one component device and a node address handler associated with each component device. In addition to a smart card, another component device in the first cluster may be a terminal having a display device and a keyboard. In addition to communicating with each other, the component devices in the first cluster may also communicate with component devices in other clusters by utilizing a system of the present invention. In a preferred embodiment of the present invention, the means for sending data from the first cluster to the at least one network further comprises a network-coupled address handler coupled to each network. The first cluster may send data to the second cluster over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. According to an embodiment of the present invention, the means for receiving the data from the network at the second cluster comprise a second network-coupled address handler, a second router, a second node address handler and a second component device. In one embodiment, the component device in the second cluster is a security access module, including a second smart card that authenticates the smart card in the first cluster. The second router is preferably an extended T=1 router, including an extended routing table. In another embodiment, the second cluster may comprise more than one component device and a node address handler associated with each component. For example, if a first component device in the second cluster is a security access module, a second component device in the second cluster may be a data storage device. The data storage device and the smart card would preferably communicate with each other using the node address handlers and the second router. In a still further embodiment, a third component device in the second cluster may be a clearing and settlement device, which preferably communicates with the other components using the node address handlers and the second router. 
     A still further embodiment of a system for routing data between at least two clusters over at least one network comprises a first hard wired cluster comprising at least one component device, a node address handler associated with each component device, a router and at least one network-coupled address handler. The system further comprises a second hard wired cluster comprising at least one component device, a node address handler associated with each component device, a router and at least one network-coupled address handler. A component device in the first cluster sends data via the node address handler associated with the component device in the first cluster to the router in the first cluster. The router in the first cluster sends data through a network-coupled address handler in the first cluster to a network. The router in the second cluster receives the data from the network via a network-coupled address handler in the second cluster. A component device in the second cluster receives the data from the router in the second cluster via the node address handler associated with the component device in the second cluster. The routers in each cluster are extended T=1 routers. The data may be sent over an internet protocol network, over a broadband network, over a wide area network or over another network through which data is normally sent. A cluster may be coupled to more than one network through a network-coupled address handler associated with each network. For example, a cluster may be coupled to both an internet protocol network and a broadband network through a network-coupled address handler associated with each network. Additionally, each cluster may be coupled to the same network through more than one network-coupled address handler. 
     Additional objects, advantages and novel features of the invention will be set forth in part in the description which follows, and in part will become more apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 illustrates a T=1 Routing Table instituting the ISO-7816 specifications. 
     FIG. 2 illustrates an Extended Routing Table according to an embodiment of the present invention. 
     FIG. 3 illustrates an Extended Routing Table according to an embodiment of the present invention. 
     FIG. 4 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for an embodiment of the present invention in which data is sent between three clusters over a broadband network and an internet protocol network. 
     FIG. 5 is a flow chart which illustrates an embodiment of a method of the present invention for sending data between a smart card and a component over at least one network. 
     FIG. 6 is a flow chart which illustrates an embodiment of a method of the present invention for sending data between a first cluster and a second cluster over at least one network. 
     FIG. 7 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for an embodiment of the present invention in which data is sent from a smart card to a component over an internet protocol network. 
     FIG. 8 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent from a smart card to a component over an internet protocol network or over a broadband network. 
     FIG. 9 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent from a first cluster to a second cluster over an internet protocol network, over a broadband network or over a wide area network. 
     FIG. 10 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent between three clusters over an internet protocol network. 
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     FIG. 1 shows a T=1 Routing Table  5  implied in the ISO-7816 specification for use with an embodiment of the present invention. Since the application expects all the Addressable Nodes to be resident on the same circuit board, the sole function of the Routing Table  5  is to map each of the eight possible Node Addresses to a software procedure. 
     In FIG. 1, the Node Address  10  is the T=1 node address assigned to the component  20  by the application and may have any of the values { 0 - 7 }. The Routing Table  5  illustrated in FIG. 1 is for a simple hypothetical embedded application according to an embodiment of the present invention. In this embodiment, Node Address  0  is assigned to the smart card requiring authentication and Node Address  1  is assigned to the user interface. Node Address  2  is assigned to the smart card providing the authentication, and Node Address  3  is assigned to a logging program that stores transaction activity records in memory. 
     The ISO-7816 specification also specifies a Router program that has the function of handling all communications between the addressable Nodes of the application, the routing algorithm being: 
     while (ORIGINATOR_SAD is not equal DAD) {Routing_Table[DAD].Node_Address_Handler(Transmit, SAD, ApplicationData); 
     Routing_Table[DAD].Node_Address_Handler(Receive, DAD, ApplicationData)} 
     Return response ApplicationData to ORIGINATOR_SAD 
     Where ORIGINATOR_SAD is the Source Node Address of the originator of a message consisting of ApplicationData destined to a Destination Node Address, DAD. The DAD may change each time new ApplicationData is received from a Node Address, which of course gives any Node the freedom to route ApplicationData to any other Node in the system before it returns a response to the ORIGINATOR_SAD. 
     An embodiment of the present invention includes a Routing Table Extension to the Routing Table in FIG.  1  and an Extended T=1 Router. An Extended Routing Table  25  is shown in FIG. 2, in which the simple embedded application described by the Routing Table in FIG. 1 has been modified to run in accordance with an embodiment of the present invention. The Node Address field  30 , as in the original Routing Table, is the T=1 Node Address assigned to the component  45  by the application and may have the values of { 0 - 7 }. 
     The Coupling field  35  specifies how the component  45  is connected to the local Router. It may have the values of {Coresident, Input/Output Device (IODevice), Network, NotConnected}. 
     The Coresident Coupling type specifies that the component  45  is a program on the same circuit board as the Routing Table  25  and that its Node Address Handler  40  is a software procedure. In the Routing Table in FIG. 1, all of the Node Addresses have an implied Coupling type of “Coresident”. 
     According to an embodiment of the present invention, the IODevice Coupling type specifies that the component  45  addressed by the Node Address  30  is on an IO device connected to the same circuit board on which the Routing Table  25  is resident. 
     The Network Coupling type specifies that the component  45  addressed by Node Address  30  is not resident on the circuit board on which the Routing Table  25  resides, but resides on a processor that is connected to the circuit board of the Routing Table by a network connection. Entries in the routing table having a coupling type of “Network” may also specify the network address and port number of the node in the fields “Network Address” and “Port” of the extended routing table. FIGS. 2 and 3 show extended routing tables  25 , 50  having Network Address  47 , 72  and Port  49 , 74  fields. 
     The NotConnected Coupling type specifies that no connection exists in the application with any Node Address marked NotConnected. 
     An embodiment of the present invention defines addressable Node components that share the same circuit board or hardware or are otherwise not Coupled by Network coupling as Clusters. A single Node by itself on a circuit board without any other components sharing the hardware with that particular Node is considered one Cluster. The application configuration described in the Routing Table in FIG. 1 for one embodiment would consist of a single Cluster. The configuration in FIG. 2 for one embodiment consists of two Clusters, one to encompass Node Addresses  0 , 1 , 3 , 7  and one to encompass Node Address  2 . 
     In an embodiment of the present invention, each Cluster contains an Extended Routing Table, which specifies the path to the other addressable Nodes in the application. Nodes that reside in other Clusters are marked with a Coupling type of Network. FIGS. 2 and 3 present the Extended Routing Tables  25 ,  50  of the two Clusters belonging to a simple hypothetical application in accordance with an embodiment of the present invention. 
     In an embodiment of the present invention, Node Address Handlers are defined by the invention to be programs callable by the Invention&#39;s Extended Router to send ApplicationData to a Node associated with the Node Address Handler and to receive ApplicationData from the Node associated with the Node Address Handler. Accordingly, the invention specifies that the Node Address handlers have a send and receive interface. 
     Node Address Handlers of the Coresident Coupling type in an embodiment of the present invention, represent a program that writes the ApplicationData to a display screen and then returns. Node Address Handlers of the IODevice type call device drivers controlling the component Nodes, such as smart card readers attached to a serial port. Finally, Node Address Handlers of the Network Coupling type call Send and Receive programs that have passed ApplicationData to and from Transmission Control Protocol/Internet Protocol (TCP/IP) Sockets, Asynchronous Transfer Mode (ATM) Channels or the data channels defined by any data transmission protocol, such as frame relay or system network architecture (SNA). 
     The Network Address field  47 ,  72  (FIGS. 2 and 3) of the Network Coupling type in an embodiment of the present invention represents the network address of the machine or cluster in which the node described by this entry resides. Values that this field may take in the case of an IP network are a URL or a four part IP address as given in the extended routing tables  25 ,  50  shown in FIGS. 2 and 3. 
     The Port field  49 ,  74  (FIGS. 2 and 3) of the Network Coupling type in an embodiment of the present invention represents the port identifier by which the process implementing the node within the machine or cluster is known. The Port field can be used by the system to locate a specific node within a machine or cluster when multiple nodes are in the same cluster or machine, and therefore share the same network address. 
     FIG. 4 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for an embodiment of the present invention in which data is sent between three clusters over a broadband network and an internet protocol network. In FIG. 4, the component devices  90 ,  100 ,  155 ,  180  of the application, both smart card and non-smart card, are distributed in three Clusters  75 ,  80 ,  85  over two networks, a Broadband network  125  of the kind found in Cable television distribution and an IP network  130  of the kind used to deliver Internet content. Cluster A  75  is a cable television set top box with a smart card reader  90  and a user display apparatus  100 , such as, for example, a television screen. Cluster B  80  is a server connected to the cable operator&#39;s broadband headend  125  via ATM channels  135 . The server has a smart card  155 , which is used to authenticate requests from the subscriber&#39;s smart card  90 . Cluster C  85  is a remote server on the internet  130  that logs authentication activity. 
     Each Cluster has an Extended T=1 Router  110 ,  145 ,  170  and an Extended Routing Table  115 ,  140 ,  165 , which links Node Addresses to network channels or locally connected IO devices. Each component device  90 ,  100 ,  155 ,  180  has a node address handler  95 ,  105 ,  150 ,  175  associated with it. 
     The present invention may also be used as a network bridge to connect smart cards and non-smart card supporting devices that are not connected to the same network. For example, in FIG. 4, the Transaction Log  180  for the application is located by itself in Cluster C  85 , which has no direct connection with the smart card  90  in Cluster A  75 , but the Cluster A smart card  90  can send ApplicationData to the Log  180  because the Cluster B Server has both a Broadband connection via two of its network-coupled address handlers  135 ,  137  at Node=0 and Node=1, and an IP connection via a network-coupled address handler  139  at Node=3. Node=3 has been configured with a TCP/IP connection to connect with the same in Cluster C  85 , the cluster with the Transaction Log  180 . 
     The advantages of a system according to the embodiment shown in FIG. 4 include security and speed. The security results from taking advantage of the natural authentication properties of the smart card devices, such that the need for third party authentication packages requiring, for example, certificates and certificates servers may be avoided. Because the invention allows transactions to occur over networks as if they were occurring off-line between physically connected, secure devices, the data remains encrypted, thus avoiding the need for use of a secure sockets layer (SSL). The speed of the system results from taking advantage of such things as Internet-based high data rate specifications for sound. Further, the invention allows for direct communication between a smart card and a server, through bypassing of, for example, a browser. 
     FIG. 5 is a flow chart illustrating an embodiment of a method of the present invention for sending data between a smart card and a component device over at least one network. According to this embodiment, data are received  185  at a first router from a microprocessor on a smart card through a smart card address handler. The first router preferably comprises an extended T=1 router having an extended routing table. The data are then routed  190  over a network by sending the data from the first router through a network-coupled address handler to a network. The network may be an internet protocol network, a broadband network, a wide area network, or any other network over which data are normally sent. The type of network-coupled address handler will depend on the network. For example, if the network is a broadband network, the network-coupled address handler will be an asynchronous transfer mode (ATM) channel. The data are received  195  from the network through a network-coupled address handler at a second router. The second router also preferably comprises an extended T=1 router having an extended routing table. The data are sent  200  from the second router to a component device through a node address handler. The component device may be, for example, a data storage device, a terminal having an input device and a display device, a terminal application, a clearing and settlement device or a security access module. A security access module may further comprise a second smart card that authenticates the first smart card. An example of a function of the terminal application would be for starting and operating a terminal. Examples of functions of a data storage device include storing data from smart cards in non-volatile memory and logging transaction activity. An example of a function of a clearing and settlement device is the uploading of smart card transaction data to a bank&#39;s server. 
     FIG. 6 is a flow chart illustrating an embodiment of a method of the present invention for sending data between a first cluster and a second cluster over at least one network. According to this embodiment, data are sent  202  from a first cluster having an extended T=1 router to a network. The network may be an internet protocol network, a broadband network, a wide area network, or any other network over which data are normally sent. Sending of data from the first cluster preferably further comprises sending the data from a first component device through a first node address handler to the first extended T=1 router and through a first network-coupled address handler to the network. The first component device may be, for example, a smart card having a microprocessor. According to this embodiment, the data are then received  205  from the network at a second cluster having an extended T=1 router. Receiving of data at the second cluster preferably further comprises receiving the data from the network at a second network-coupled address handler and sending the data through the second extended T=1 router and a second node address handler to a second component device. The component device may be, for example, a data storage device, a terminal having an input device and a display device, a terminal application, a clearing and settlement device, a security access module or other component device or application that uses a T=1 router. The extended T=1 routers preferably further comprise extended routing tables. The first and second clusters may each comprise more than one component device. For example, the first cluster may comprise a smart card having a microprocessor and a terminal having a display device and an input device. The second cluster may comprise, for example, a security access module for authenticating a smart card in the first cluster and a data storage device for logging transaction activity. Each component device in a cluster preferably has its own node address handler associated with it. Although the above description relates to the transfer of data from a first cluster to a second cluster, data may also easily be sent from the second to the first cluster using the same method. 
     Other embodiments of the present invention relate to systems for routing data between T=1 applications over a network. FIG. 7 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for an embodiment of a system of the present invention in which data is sent from a smart card to a component device over an internet protocol network. FIG. 7 shows an extended T=1 router  260  that receives data from a smart card  250  having a microprocessor through a node address handler  255 . The data is routed over an internet protocol network  270  from the extended T=1 router  260  through a network-coupled address handler  265 . The data is received at another extended T=1 router  280  from the internet protocol network  270  via a network-coupled address handler  275 . The data is sent from the extended T=1 router  280  through a node address hander  285  to a component device  290 . The extended T=1 routers  260 ,  280  preferably further comprise extended routing tables. The component device  290  may be, for example, a data storage device, a terminal having an input device and a display device, a terminal application, a clearing and settlement device, a security access module or other component device or application that uses a T=1 router. 
     FIG. 8 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent from a smart card to a component over an internet protocol network or over a broadband network. In the embodiment shown in FIG. 8, data is sent from a microprocessor in the smart card  325  to a node address handler  330 . An extended T=1 router having an extended routing table  335  receives the data from the node address handler  330 . The extended T=1 router  335  is coupled with both an internet protocol network  350  and a broadband network via two network-coupled address handlers  340 ,  345 . The data may be sent over the internet protocol network  350  or the broadband network  355 . The data is received at a second extended T=1 router  370  having an extended routing table from the internet protocol network  350  via network-coupled address handler  360  or from the broadband network  355  via network-coupled address handler  365 . The data is sent from the extended T=1 router  370  through a node address handler  375  to a component device  380 . The component device  290  may be, for example, a data storage device, a terminal having an input device and a display device, a terminal application, a clearing and settlement device, a security access module or any other component device or application that uses a T=1 router. This embodiment may further comprise the sending of data through a wide area network or other network through which data is normally sent. 
     FIG. 9 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent from a first cluster to a second cluster over an internet protocol network, over a broadband network or over a wide area network. FIG. 9 shows a first cluster  505  having two component devices, a smart card  400  and a terminal including a display device and an input device  410 . Each of the component devices  400 ,  410  may send data to an extended T=1 router having an extended routing table  420  through respective node address handlers  405 ,  415 . Extended T=1 router  420  in the embodiment shown may send data over three networks, an internet protocol network  440 , a broadband network  445 , and a wide area network  450 . Any network through which data is normally transmitted may be used with the present invention. Data may be transmitted from the extended T=1 router  420  to one of the networks via the network-coupled address handlers  425 ,  430 ,  435  coupled with the respective networks  440 ,  445 ,  450 . A second cluster  510  receives the data from one of the networks  440 ,  445 ,  450  at one of the network-coupled address handlers  455 ,  460 ,  465 . Each network is coupled  440 ,  445 ,  450  with an address handler  455 ,  460 ,  465 . The data is sent from one of the network-coupled address handlers to an extended T=1 router having an extended routing table  470  in the second cluster  510 . The data may be sent from the T=1 router to a component device in the second cluster  510  via a node address handler. The embodiment of the present invention shown in FIG. 9 comprises three component devices in the second cluster  510 , a security access module  490 , a data storage device  495  and a clearing and settlement device  500 . As noted above, the security access module  490  may further comprise a second smart card that authenticates the first smart card. Examples of functions of the data storage device  495  include storing data from smart cards in non-volatile memory and logging transaction activity. An example of a function of the clearing and settlement device  500  is the uploading of smart card transaction data to a bank&#39;s server. 
     FIG. 10 is a schematic diagram which illustrates an overview of examples of key components and the flow of data between the key components for another embodiment of the present invention in which data is sent between three clusters over an internet protocol network. FIG. 10 shows three clusters  555 ,  560 ,  565  in different geographic locations, each having an extended T=1 router,  590 ,  600 ,  625 . In this embodiment, the three clusters  555 ,  560 ,  565  are able to send and receive data from the other clusters over an internet protocol network  570 , the world wide web. A first cluster  560  comprises a reloadable card  610 , which sends data through a reloadable card handler  605  to the extended T=1 router  600 . The extended T=1 router sends the data through a network-coupled address handler  615  to the world wide web  570 . The data may be routed over the world wide web to component devices in the other two clusters  555 ,  565 . The second cluster comprises three component devices, a clearing and settlement device (operating through a modem)  575 , a security access module (SAM)  580  and a data storage device  585 . Each of these component devices can send and receive data from an extended T=1 router  590  via a node address handler  577 ,  582 ,  587  associated with it. For example, the security access module  580  may send and receive data from extended T=1 router  590  through a security access module handler  582 . The extended T=1 router  590  sends and receives data from the world wide web  570  through a network-coupled address handler  595 . The third cluster  565  comprises two components, a terminal application  630  and a user interface illustrated in FIG. 10 by an HTML display  640  and HTML forms  645 . In one embodiment, the user interface sends and receives data from an extended T=1 router  625  in the third cluster  565  through a node address handler, shown as a user interface handler  647 . The terminal application  630  sends and receives data from the extended T=1 router  625  through its node address handler, shown as a terminal application handler  635 . The extended T=1 router  625  likewise sends and receives data from the world wide web through a network-coupled address handler  620 . 
     An example of the operation of the system shown in FIG. 10, may involve a user inserting a reloadable card  610  in the first cluster  560 . The reloadable card handler  605  receives data from the reloadable card and sends it to the extended T=1 router  600 . The data is routed over the world wide web  570  from the extended T=1 router  600  via the network-coupled address handler  615 . The data from the reloadable card  610  may be identification information for authentication of the reloadable card  610 . In such a scenario, the data would be routed from the world wide web  570  to the second cluster  555 . The data would be sent from the world wide web  570  to the extended T=1 router  590  through the network-coupled address handler  595 . From the extended T=1 router  590 , the data would be sent through the SAM handler  582  to the security access module  580 , where the reloadable card  610  would be authenticated. Data relating to the authentication may be sent to the data storage device  585  in the second cluster  555  through the SAM handler  582 , the extended T=1 router  590 , and the data store handler  587 . Likewise, the data relating to the authentication may be sent to a component device in the third cluster. 
     The type of network-coupled address handler in each embodiment of the present invention will depend on the network. For example, if the network is a broadband network, the network-coupled address handler will be an asynchronous transfer mode (ATM) channel. 
     In the present invention, each component device is capable of sending or receiving data from other component devices in the same cluster and of sending and receiving data from component devices in other clusters by implementing the systems and methods of the present invention. 
     Various preferred embodiments of the invention have been described in fulfillment of the various objects of the invention. It should be recognized that these embodiments are merely illustrative of the principles of the present invention. Numerous modifications and adaptations thereof will be readily apparent to those skilled in the art without departing from the spirit and scope of the present invention. Accordingly, the invention is only limited by the following claims.