Abstract:
The invention pertains to apparatus and methods for securely transmitting a personal identifier between an originator thereof and a preselected data base. Especially, pertaining to a computer terminal and a method and acquiring a personal identifier used in connection with an account number of an institution, such as a bank, and securely transmitting an encrypted version of the identifier along with a representation of the account number to the institution&#39;s data base.

Description:
FIELD OF THE INVENTION 
     The invention pertains to apparatus and methods for securely transmitting a personal identifier between an originator thereof and a preselected data base. More particularly, the invention pertains to a computer terminal and a method of acquiring a personal identifier used in connection with an account number of an institution, such as a bank, and securely transmitting an encrypted version of the identifier along with a representation of the account number to the institution&#39;s data base. 
     BACKGROUND OF THE INVENTION 
     Financial institutions have during the last several years made substantial efforts to promote the use of automated teller machines by their customers. The financial institutions view such machines as cost effective ways to provide services to individual customers. 
     However, such machines have experienced a number of drawbacks which have limited their acceptance with respect to the general public. One drawback is that a human teller is no longer present to carry out the transaction. Many customers, it has turned out, prefer human tellers over automated teller machines. 
     Another drawback that has been encountered with the use of such machines is a need to assure that the use of such machines is limited to authorized individuals and their respective accounts. In addition to utilizing an account number to identify a customer, a system has been developed which requires the customer to enter a personal identifier prior to carrying out a transaction. Provision is made for verification of not only the account number but also the personal identifier entered by the customer. The personal identifier, if kept in confidence, provides a level of security beyond the account number. 
     Obviously, if a personal identifier is not maintained in confidence, it has little or no value from the point of view of providing security to the system. Hence, not only should each personal identifier be unique at a given institution but in addition the personal identifier should not be publicly known. 
     In order to provide personal identifiers, institutions in the past have generated such identifiers and assigned them to customers in an arbitrary fashion. Much to the chagrin of the institutions, which are attempting to promote the popularity of automated teller machines, such arbitrarily assigned personal identifiers are often ignored or forgotten by the customers. Hence, there has been an attempt made to develop systems whereby the customer can freely specify his or her own personal identifier. 
     One way in which such specification can be securely carried out is to have the customer come into the institution, enter the relevant account number and then also enter the selected identifier. In such an arrangement, the identifier can be associated with the account number and stored in the institution&#39;s data base without any intervening human involvement which would permit connecting the customer&#39;s account number with the customer&#39;s personal identifier. Absent the availability of the customer to come into the institution, this is not a viable solution. 
     In another known system, a customer is mailed a document which explains the purpose for selecting a personal identifier. In addition, a translation table is provided in hard copy form with the same explanatory document. In this system, a customer selects an arbitrary personal identifier and then encrypts that identifier using the provided translation table. 
     The encrypted identifier along with the relevant account number, which may be preprinted, is recorded on a tear off return sheet which is to be returned to the institution by mail. Unfortunately, instead of returning only the tear off portion, from time-to-time, customers return the entire document including the translation table to the institution. This can provide access by personnel at the institution to both the account number and the unencrypted personal identifier. Such knowledge by one or more institution personnel provides an undesirable breach in the security of the system. 
     Further, not every customer is comfortable with or capable of making the necessary table translation to produce the encrypted personal identifier. In addition, the institution must maintain a decoding table for each customer so that the encrypted personal identifier can be decoded on receipt for storage in the institution&#39;s data base. 
     The above noted systems while workable can at times be inconvenient. The self-encrypting system can result in disclosure of an unencrypted personal identifier in combination with an unencrypted copy of the account number or the name of the associated customer. Hence, there continues to be a need for a convenient, inexpensive and very secure way in which a customer, remotely located from an institution and its data base, can specify in an arbitrary fashion a personal identifier. There is also a continuing need to be able to transmit that identifier to the institution for entry into the data base while at the same time maintaining an appropriate level of security. 
     SUMMARY OF THE INVENTION 
     In accordance with the invention, an apparatus and a method are provided for receiving a previously unspecified and unencrypted personal identifier along with an encrypted account number and for securely transmitting that information to a data base. A document is provided to an account holder which includes, in preprinted form, an encrypted representation of the corresponding account number. The account holder enters an arbitrarily selected personal identifier onto the document. 
     The document is then returned to the issuing institution. A terminal can be located at the issuing institution for the purpose of entering, from the document, the preprinted, encrypted, account number and the arbitrarily selected identifier. 
     The terminal includes a keyboard or keypad for entry of the arbitrarily selected identifier. A second source of input, a bar code reader, is provided so that the preprinted account number can be accurately and quickly entered into the terminal. As an alternate, the keyboard or keypad could be used for entry of the encrypted account number. 
     Once the account number has been entered into the terminal it is decoded and checked for authenticity. Prior to having been imprinted on the returnable document, the customer account number could be encrypted in a variety of different ways. Any form of encryption can be used with the account number provided the terminal can readily carry out the decryption process. 
     A display is also provided on the terminal so that the entered representation of the encrypted account number and the entered representation of the identifier can be visually checked for accuracy by the operator. Subsequent to the account number having been checked for authenticity, assuming it is authentic, the decoded account number provides one of the inputs to a DES encryption circuit located in the terminal. Another input to the encryption circuit corresponds to a pre-assigned institution key which had previously been entered into the terminal. The arbitrarily selected and nonencrypted personal identifier is then combined with the output from the encryption circuit. 
     An encrypted output is then generated based on these three inputs. The encrypted representation of the personal identifier can then be transmitted, along with the corresponding account number, to the instution&#39;s data base for storage and for subsequent use in verification of transactions. 
     It is a particular advantage of the present invention that the return document, from which the encrypted account number and unencrypted personal identifier are obtained cannot be connected to the name of the account holder nor the account number itself. In the former instance, the name does not appear on the return document. In the latter instance, the account number only appears on the document in encrypted form for use within the terminal. Hence, the return document may be returned by the customer through the mail to a blind post office box number. Even if that document is intercepted, there is inadequate information on it to be of use in improperly obtaining funds or services in connection with the respective account. 
     The terminal in addition to the input devices noted previously includes a programmable processor and a control program prestored in read-only memory. The DES encryption circuit is electrically coupled to the programmable processor. Further, the terminal includes buffer drivers for driving the keypad and the liquid crystal display output device. 
     A keyswitch is provided which has an enabled state and a disabled state. In the enabled state the institution&#39;s DES encryption key can be entered into the terminal and stored in volatile memory in the DES encryption circuit. Any attempt to disconnect the terminal once the institution&#39;s DES key has been entered results in a loss of the previously entered key from the volatile memory once power is removed. Hence, it will be necessary to reenter the key any time the terminal is disconnected or in any other fashion experiences an interruption of power. The terminal also includes an RS232-C serial interface. This interface provides an input/output port through which the terminal can be coupled to a remote data base by either hard wiring, via an interface device, or by telecommunications. 
     Assuming that the institution&#39;s DES key has been previously entered, in accordance with the method of the present invention, the account number on the returned document is first entered into the terminal. The account number can be scanned using a barcode reader or can be entered through keypad. The account number is then checked for authenticity to determine whether or not it comes within the class of acceptable account numbers. Assuming the account number is one of the class of acceptable account numbers, the personal identifier is then entered off of the returned document via the keyboard. The identifier can be displayed while being entered so as to provide a visual check thereof. In addition, it can be verified by requiring re-entry by the operator. 
     Subsequent to entry of the personal identifier, that identifier is encrypted. A variety of encryption schemes could be used for this process. In a preferred embodiment, the DES encryption system described in Federal Information Processing Standard Publication No. 46, Jan. 15, 1977 is utilized. Inputs to the encryption process include the unencrypted, arbitrarily selected personal identifier; the instution&#39;s DES key; and the unencrypted account number to be associated with the personal identifier. Output from the DES encryption process is used to create an encrypted offset value. 
     In subsequent steps, the unencrypted account number and the offset, corresponding to the encrypted personal identifier, are transmitted to the institution&#39;s data base. If desired, the account number can be again encrypted prior to transmission. 
     A further advantage of the present apparatus and method is realized in that the unencrypted personal identifier is never transmitted out of the terminal. Only the encrypted offset value is transmitted to the data base. 
     Numerous other advantages and features of the present invention will become readily apparent from the following detailed description of the invention and the embodiments thereof, from the claims and from the accompanying drawings in which the details of the invention are fully and completely disclosed as a part of this specification. 
    
    
     DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is an overall diagram of a system and method in accordance with the present invention; 
     FIG. 2 is a top planar view of an exemplary personal identifier return document in accordance with the present invention; 
     FIG. 3A is a top plan view of a terminal in accordance with the present invention; 
     FIG. 3B is a rear plan view of the terminal of FIG. 3A; 
     FIGS. 4A and B taken together are a schematic diagram of the circuitry of the present invention; and 
     FIGS. 5A and 5B together are a flow diagram of a method in accordance with the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
     While this invention is susceptible of embodiment in many different forms, there is shown in the drawing and will be described herein in detail a specific embodiment thereof with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention and is not intended to limit the invention to the specific embodiment illustrated. 
     With respect to the figures, FIG. 1 illustrates a system and method in accordance with the present invention. An institution such as a bank or savings and loan can originate a two part document 12. Document 12 can include a descriptive and instructional portion 12a which could be in the form of a letter to the institution&#39;s customer. Removably attached to the informational portion 12a of the document 12 is a return portion 12b. The return portion 12b can include, preferably in encrypted form, the customer&#39;s account number in a region 12c. The portion 12b can also include a section 12d wherein the customer is requested to record an arbitrarily selected personal identifier. 
     The personal identifier recorded in the region 12d can be numeric or it can be alphanumeric. The customer then detaches the return portion 12b and in some fashion returns it to the institution either by mail or personal delivery. The portion 12b contains no identification of the customer except for the encrypted account number in the region 12c. In addition to maintain security the portion 12b need not contain a return address to the institution. Hence, if the return portion 12b is intercepted during delivery, an individual attempting to obtain improper access to the customer&#39;s account could learn what the personal identifier selected by the customer was as that is recorded on the return portion 12B in unencrypted form. However, the customer&#39;s account number only appears in the region 12c in encrypted form. 
     When the return document 12b arrives at the institution, a terminal 14 can be used to enter the personal identifier and the encrypted account number. The terminal 14 can be linked either by hardwiring, via an interface device, or telecommunications to the institution&#39;s data processing unit 16. Coupled to the institution&#39;s data processing unit 16 will be a data base usually resident on one or more disk drives 18. 
     The data base can be used to store a representation of the personal identifier in combination with a representation of the account number for subsequent transaction verification. Such verification is required when the customer attempts to carry out a transaction using an automated teller machine. In connection with that transaction both the account number and the personal identifier would be entered by the customer at the teller machine&#39;s keyboard. A representation of the personal identifier and the account number would then be transmitted to the institution&#39;s data processing unit 16. The representation of the personal identifier received from the teller machine can then be compared with the prerecorded representation of the personal identifier stored in the data base 18. If the entered personal identifier is the same as the previously stored personal identifier, the transaction can be permitted to proceed. 
     FIG. 2 illustrates the details of the return portion 12b of the document 12. The return portion 12b can include a region 12e which contains further instructions to the customer. In the region 12c a bar code representation of the encoded account number can been preprinted. Immediately below the bar code representation is an alphanumeric representation of the encrypted account number. 
     In the region 12d a plurality of squares has been provided into which the personal identifier is to be entered or recorded by the customer. In the exemplary region 12d provision has been made for entry of a four element personal identifier. It will be understood that the number of the elements of the personal identifier is not a limitation of the present invention. 
     FIG. 3A is a top plan view of the data entry terminal 14. Terminal 14 includes a keypad or keyboard 20 for control and for operator entry of the unencrypted personal identifier. A second input device, a bar code reader 22 is also provided with the terminal 14. The bar code reader 22 can be used to detect the preprinted bar code in the region 12c of the return document 12b. The bar code reader 22 could be a Hewlett Packard HBCS-4300 reader. 
     The terminal 14 also includes a visual display 24. The display 24 could be, for example, a 20 character per line, two line liquid crystal display. 
     The terminal 14 also includes an on-off key switch 26 and a key switch 28. The key switch 28 is for the purpose of enabling the terminal 14 to receive an institutional encryption key. Financial institutions commonly use an encryption scheme known as the DES encryption system. This system is described in Federal Information Processing Standard Publication No. 46, Jan. 15, 1977. It requires the entry of an institution&#39;s specific multi-element key for the purpose of properly decrypting information, or the encrypting of information by the institution. The terminal 14, as discussed subsequently, can provide DES encryption of the unencrypted personal identifier provided by the customer on the return document 12b. 
     FIG. 3B is a rear plan view of the terminal 14. The terminal 14 also includes a serial input/output port 30. The input/output port 30 is an RS232-C serial port through which the terminal 14 can be coupled to the data processing unit 60. The coupling can either be by hardwiring, via an interface device or by telecommunications. Power is provided to the terminal 14 by means of an AC line cord 32. 
     FIGS. 4A and 4B together are a schematic diagram of the programmable electronic control system incorporated into the terminal 14. The control system 40 includes a programmable processor 42 implementable as an MC68HC11 integrated circuit. 
     The processor 42 includes electrically erasable programmable read only memory. The description table can be loaded therein via the RS232-C port 30. 
     Addresses bits 0-7 on a plurality of lines 44 provide inputs to an address latch 46. The address latch 46 can be implemented as 74HC373 integrated circuit. Output from the address latch 46 along with additional address lines form an address bus 48. 
     The address bus 48 provides address input signals to a programmable read only memory 50. The programmable read only memory 50 is an 8K by 8 bit storage unit which can be implemented as a 27C64 integrated circuit. The memory 50 can be used for nonvolatile storage of a control program. 
     Also coupled to the address bus 48 is an 8K by 8 bit random access memory 52. The random access memory 52 can be implemented as a 6264 integrated circuit. Data inputs and outputs are provided on an 8 bit data bus 54. 
     Memory chips 50 and 52 are controlled by address decoder 56 and associated gating circuitry. The address decoder 56 can be implemented as a 78HC138 integrated circuit. Reset and initialization signals are provided by a reset conditioner 58. The reset conditioner can be implemented as DS1232 integrated circuit. 
     The address bus 48 along with the data bus 54 are coupled to an input/output expander circuit 60. The circuit 60 can be implemented as a MC68HC24 integrated circuit. The circuit 60 provides interfacing between the processor 42 and input/output devices associated with the terminal 14. 
     Device data outputs from the expander circuit 60 are provided on a plurality of output lines 62. With respect to FIG. 4B, outputs from the expander 60 on one of the lines 62 provide an input to beeper drive circuitry 64, and column drive circuitry 66 for the keypad 20. Beeper circuitry 64 can be used to generate an audio feedback tone to the operator. 
     Device input signals are provided to the expander circuit 60 on a plurality of input lines 64. Signals are received on several of the lines 64 from row sensors 68 which are coupled to the rows of the keypad 20, key switch 28 which is coupled to members of the plurality of lines 64 utilizing circuitry 70 and input from the bar code sensor 22 using another member of the plurality of lines 64. 
     The data bus 54 also provides data inputs to a display buffer 76. The display buffer 76 can be implemented as a 74 LS245 buffer. Outputs from the display buffer 76, on a plurality of lines 78, and a plurality of lines 79 provide drive signals to the 40 character liquid crystal display 24. The liquid crystal display 24 can be type EPSON EA-X20027AZ. 
     A plurality of lines 80 which includes four lines from the address bus 48 provides address inputs to an encryption circuit 82. The circuit 82 can be, for example, a DES encryption circuit type MC6859L. Output from the encryption circuit 82, on a plurality of lines 84, and via buffer 86 is coupled to the data bus 54. 
     There is thus a bidirectional data communications path between the processor 42 and the encryption chip 82 along the bus 54. Address decoders 90 determine which of the buffers 76 or 86 is active at any one time. 
     FIGS. 5A and 5B together are a flow diagram illustrating the steps of a method in accordance with the present invention. In an initial step, an institution would assemble a list of names, addresses and corresponding account numbers. An encryption and a decryption table would be generated for use in encrypting and decrypting the account numbers. It will be understood with respect to the present invention that, the form of encryption or decryption of the account numbers is not a limitation of the present invention. Encryption tables represent only one form of encryption that can be used. Alternately, an encryption algonithm and corresponding decryption algonithm could be used. 
     The two part documents are then generated from the list of names, addresses. The corresponding encrypted account number is entered onto the separable, return, portion of the two part document as was previously discussed with respect to FIG. 2. The documents are then sent to the customers on the list. They can be sent via the mail or they can be personally delivered. 
     Subsequently, the corresponding decryption table is loaded into the computer terminal. The institution&#39;s DES encryption key is also loaded into the terminal, assuming it is an institution with an assigned DES encryption key. Then it is necessary to wait for the return of the tear off portions of the documents. 
     Upon receipt of the return portion of the document including the preprinted, encrypted account number as well as the unencrypted personal identifier recorded thereon the account number is scanned or keyed into the terminal from the document. Within the terminal the account number is decrypted and is checked for authenticity. Authenticity checking can include use of mod 10 check digits as is well known in the financial industry and described by the Luhn Formula in ISO 7812-1985E. 
     The terminal can by generation of a tone on its internal beeper indicate acceptance of an authentic account number. The operator can then enter the unencrypted personal identifier, which has been written on the return portion of the document, via the keypad. The identifier can then be encrypted taking into account the account number and the previously entered encryption key. The account number and the encrypted identifier can then be transmitted to the institution&#39;s data base. If desired, the account number could be again encrypted prior to transmission. At that time the operator can then go on to the next document. 
     Attached hereto as an Addendum is a listing of a control program usable with the electronic system 40. 
     From the foregoing, it will be observed that numerous variations and modifications may be effected without departing from the true spirit and scope of the novel concept of the invention. It is to be understood that no limitation with respect to the specific apparatus illustrated herein is intended or should be inferred. It is, of course, intended to cover by the appended claims all such modifications as fall within the scope of the claims. ##SPC1##