Pocket terminal, method and system for secured banking transactions

Claim 2

Method of securely communicating transaction information to an entity at one location from a user assigned to an identified terminal at a remote location using unsecured communication channels, characte-rized by the steps of: storing a key code in the terminal; storing in the entity the key code and data regarding the user and the terminal; generating a random number in the terminal; forming a first encoding key in the terminal as the first logical encoding combination of the random number and the stored key code and data regarding the user; forming a second encoding key in the terminal as the second logical encoding combination of the stored key code and data regarding the user; encoding in the terminal the transaction information and data regarding the user and the first encoding key in accordance with a third logical encoding combination thereof to form a message authentication code; encrypting in the terminal the message authentication code and the random number and the second encoding key in accordance with a fourth logical encoding combination thereof to form an output code; communicating the output code and transaction information and terminal identity to the entity; accessing the storage in the entity in response to received terminal identity to provide the data regarding the user assigned thereto; forming a second encoding key in the entity as said second logical encoding combination of the key code stored in the entity and the accessed data regarding the user; decrypting in the entity the received output code and said second encoding key in accordance with said fourth logical encoding combination to provide the message authentication code and the random number; encoding in the entity the random number and the key code and the data regarding the user stored therein in accordance with said first logical encoding combination thereof to form a first encoding key; encoding in the entity the received transaction information and data regarding the user, and the said first encoding key in accordance with said third logical encoding combination thereof to form a message authentication code; and comparing in the entity said decrypted message authentication code and said encoded message authentication code for producing in response to favorable comparison thereof an output indication of unaltered receipt of transaction information from an authorized user of the identified terminal.

Claim 3

The method according to claim 1, characte-rized oy the additional steps of: transmitting a selected portion of the message authentication code in the entity to the terminal-at the remote location in response to said output indication; and comparing in the terminal the corresponding selected portion of the message authentication code produced therein with the selected portion of message authentication code received at the remote location to provide an indication thereat of unaltered receipt of transaction information at the entity.

Claim 4

The method of claim 1 or 2, characte- rized by the step of storing in the terminal and in the entity a terminal identification code for identifying the terminal assigned to the user at the remote location.

Claim 6

Terminal apparatus for securely communicating transaction information to an entity at one location from a user assigned to the terminal at a remote location,cha-racterized by storage means (27) in the terminal (9) for storage and retrieval therefrom of a terminal identification code(TIC); said storage means also storing for retrieval therefrom of a key-exchange key (KEK); encryption means (26) in the terminal for encrypting signals applied thereto as a selected logical encoding combination of applied signals; means (10) in the terminal for selectively generating random numbers; entry means (19) in the terminal for manually entering information; said encryption means (26) being selectively coupled to said means (10),'and to the storage means (27) and to the entry means (19) for selectively a) encoding a random number, the key-exchange key, and data representative of a user to produce a first working key (WK l ) in accordance with a first logical encoding combination of applied signals; b) encoding the key-exchange key and data representative of a user to produce a second working key .(WK 2 ) in accordance with a second logical encoding combination of applied signals; c) encoding the applied first working key and transaction information to produce a message authentication code (MAC 52) in accordance with a third logical encoding combination of the applied signals; and d) encoding the applied second working key, random number, and message authentication code to produce an output code (54) in accordance with a fourth logical encoding combination of the applied signals; said output code providing security and deciphering data when communicated to an entity with transaction information, terminal identification code and data representative of the user's identity.

Claim 7

Terminal apparatus for securely communicating transaction information to an entity at one location from a user assigned to the terminal at a remote location,cha-racterized by storage means (27) in the terminal (9) for storage and retrieval therefrom of a terminal identification code(TIC); said storage means also storing for retrieval therefrom of a key-exchange key (KEK); encryption means (26) in the terminal for encrypting signals applied thereto as a selected logical encoding combination of applied signals; means (10) in the terminal for selectively generating random numbers; entry means (19) in the terminal for manually entering information; said encryption means (26) being selectively coupled to said means (10),'and to the storage means (27) and to the entry means (19) for selectively a) encoding a random number, the key-exchange key, and data representative of a user to produce a first working key (WK l ) in accordance with a first logical encoding combination of applied signals; b) encoding the key-exchange key and data representative of a user to produce a second working key .(WK 2 ) in accordance with a second logical encoding combination of applied signals; c) encoding the applied first working key and transaction information to produce a message authentication code (MAC 52) in accordance with a third logical encoding combination of the applied signals; and d) encoding the applied second working key, random number, and message authentication code to produce an output code (54) in accordance with a fourth logical encoding combination of the applied signals; said output code providing security and deciphering data when communicated to an entity with transaction information, terminal identification code and data representative of the user's identity.

Claim 8

Terminal apparatus as in claim 5, characte- rized by comparator means (72) coupled to receive a selected portion of the message authentication code (MAC) for comparison with a corresponding portion of a message authentication code received at the remote location from the entity at said one location to produce an output representative of favorable comparison of said portions of applied message authentication codes.

Claim 9

Data-handling apparatus for operation in an entity with a plural number of terminal apparatus according to claim 5, characterized by storage means (81 for storing and retrieving therefrom the key-exchange key (KEK) and terminal identification code (TIC) and data indicative of the user assigned to each terminal apparatus (9); accessing means coupled to the storage means for retrieving therefrom the key-exchange key and the data indicative of a user assigned to a terminal in response to data received from such terminal; means (40,58,60,61) operable for selectively encoding or decoding applied data signals in accordance with selected logical encoding or decoding combinations thereof, said means being selectively operable for: a) encoding (at 40) the key-exchange key retrieved for such terminal and the retrieved data indicative of the assigned user in accordance with said second logical encoding combination to produce therefrom a second working key (WK 2 ); b) decoding (at 60) said second working key and an output code received from such terminal in accordance with said fourth logical encoding combination to produce therefrom a message authentication code (MAC) and a random number (RN); c) encoding (at-58) said random number and retrieved key-exchange key and retrieved data indicative of the assigned user in accordance with said first logical encoding combination thereof to produce a first working key (WK ); and d) encoding (at 61) said first working key (WK,) and transaction information received from such terminal at the remote location in accordance with said third logical encoding combination thereof to produce a message authentication code (MAC); and comparator means (65) coupled to receive the message authentication code (MAC) produced according to the third logical encoding combination for comparison with the decoded message authentication code to provide, in response to favorable comparison, an output indicative of the unaltered transmission and reception by the entity of transaction information and output code and terminal identification code from an authorized user of the terminal at the remote location.

Claim 10

Data-handling apparatus according to claim 7 characterized by means coupled to receive the message authentication code and responsive to applied signal for transmitting a selected portion thereof to the terminal at the remote location as an indication of the status of the transaction for which information was transmitted to the entity.

Claim 11

System for securely communicating transaction information to an entity at one location from a user assigned to an identified terminal at a remote location, characterized by first storage means (27) in the terminal (9) for storing a key code at an accessible location therein; second storage means (41) in the entity for storing at accessible locations therein the key code and data regarding the user and the terminal; means (10) in the terminal (9) for generating a random number (48); encryption means (32,34,35,51) in the terminal operable to encode signals applied thereto according to selected logical encoding combinations thereof for selectively: a) encoding (at 34) said key code,said random number and data indicative of the assigned user in accordance with a first logical encoding combination thereof to produce a first working key signal (WK 1 (44)); b) encoding (at 32) said key code and said data indicative of the assigned user in accordance with a second logical encoding combination thereof to produce a second working key signal (WK 2 (46)); c) encoding (at 36) said first working key signal, data indicative of the assigned user, and transaction information in accordance with a third logical encoding combination thereof to produce a message authentication code (MAC 52); and d ) encoding (at 51) said random number (RN), said second working key signal and said message authentication code in accordance with a fourth logical encoding combination thereof to produce an output code (54) for communicating to said entity with the transaction information and terminal identity; means coupled to the second storage means in said entity for accessing the stored key and the data indicative of the assigned user in response to identity of the terminal; encoding/decoding means (40,58,60,61) in the entity operable to encode/decode signals applied thereto according to selected logical encoding/decoding combinations thereof for selectively: a) encoding (at 40) the accessed key code and data indicative of the assigned user in accordance with said second logical encoding combination thereof to produce a second working key signal (WK 2 ); b) decoding (at 60) the received output code and said second working key signal in accordance with said fourth logical encoding combination to produce said random number and said message authentication code; c) encoding (at 58) said accessed key code and data indicative of the assigned user and said decoded random number in accordance with said first logical encoding combination thereof to produce said first working key signal (WK l ); and d) encoding (at 61) the received transaction information and said first working key signal and the data indicative of the assigned user in accordance with said third logical encoding combination thereof to produce a message authentication code; and comparator means (65) in said entity for comparing said decoded message authentication code and said encoded message authentication code for producing in response to favorable comparison thereof an output indication of unaltered receipt of transaction information from an authorized user of the identified terminal.

Claim 12

System for securely communicating transaction information to an entity at one location from a user assigned to an identified terminal at a remote location, characterized by first storage means (27) in the terminal (9) for storing a key code at an accessible location therein; second storage means (41) in the entity for storing at accessible locations therein the key code and data regarding the user and the terminal; means (10) in the terminal (9) for generating a random number (48); encryption means (32,34,35,51) in the terminal operable to encode signals applied thereto according to selected logical encoding combinations thereof for selectively: a) encoding (at 34) said key code,said random number and data indicative of the assigned user in accordance with a first logical encoding combination thereof to produce a first working key signal (WK 1 (44)); b) encoding (at 32) said key code and said data indicative of the assigned user in accordance with a second logical encoding combination thereof to produce a second working key signal (WK 2 (46)); c) encoding (at 36) said first working key signal, data indicative of the assigned user, and transaction information in accordance with a third logical encoding combination thereof to produce a message authentication code (MAC 52); and d ) encoding (at 51) said random number (RN), said second working key signal and said message authentication code in accordance with a fourth logical encoding combination thereof to produce an output code (54) for communicating to said entity with the transaction information and terminal identity; means coupled to the second storage means in said entity for accessing the stored key and the data indicative of the assigned user in response to identity of the terminal; encoding/decoding means (40,58,60,61) in the entity operable to encode/decode signals applied thereto according to selected logical encoding/decoding combinations thereof for selectively: a) encoding (at 40) the accessed key code and data indicative of the assigned user in accordance with said second logical encoding combination thereof to produce a second working key signal (WK 2 ); b) decoding (at 60) the received output code and said second working key signal in accordance with said fourth logical encoding combination to produce said random number and said message authentication code; c) encoding (at 58) said accessed key code and data indicative of the assigned user and said decoded random number in accordance with said first logical encoding combination thereof to produce said first working key signal (WK l ); and d) encoding (at 61) the received transaction information and said first working key signal and the data indicative of the assigned user in accordance with said third logical encoding combination thereof to produce a message authentication code; and comparator means (65) in said entity for comparing said decoded message authentication code and said encoded message authentication code for producing in response to favorable comparison thereof an output indication of unaltered receipt of transaction information from an authorized user of the identified terminal.

Claim 13

The system according to claim 9, characte-rized by means in the entity for providing to the terminal at the remote location a portion of a message authentication code produced at tne entity; and means in the terminal for comparing a selected portion of the message authentication code produced in the terminal with the portion of message authentication code received from the entity for producing an output indication of unaltered transmission and receipt of transaction information at the entity.