Data Exchange System With Authentication Code Comparator

The invention is directed to a data exchange system employing a portable data carrier in the form of a chip card.

The protection of the data is playing an increasingly important part in modern data processing and communications systems. The quality of a system with respect to an adequate data protection is critically dependent upon the degree to which one succeeds in making access to the system possible only for authorized persons and, conversely, keeping unauthorized persons locked out with absolute certainty. A simple although not absolutely certain possibility for checking the access authorization to a system is to use passwords that are only known to the authorized user and which the user can change as often as he desires. Since there is the risk given passwords that unauthorized persons will find them out or hear them, additional protection measures are indispensible. One of these measures, for example, is the encoding and decoding of the transmitted information, a measure that is realizable in data processing systems, among other things, with the assistance of a chip card. With the increasing involvement of the chip card in data processing systems, however, an additional security risk again arises because chip cards can be relatively easily lost. Care must therefore be absolutely exercised to see that the chip card is protected against potential misuse in all instances when lost. The chip card is therefore designed such that the data stored in a protected chip card can only be accessed when the user previously inputs an identifier that is only stored in the chip card, for example, a personal identification number, referred to as a PIN.

A further security barrier can be erected with the assistance of the authentication of the chip card to the system. This authentication prevents an arbitrary subscriber from being authorized to access secret information in the system. A critical precondition for the authentication is a personal feature of the subscriber that cannot be copied. This non-copyable feature of the subscriber is achieved with the assistance of a secret cipher for the encoding and decoding that is known to the two partners, i.e. to the chip card on the one hand and to the system on the other hand, being known, namely, only to these two partners.

The close, circuit-oriented linkage between chip card and user terminal assumes that the user of the chip card not only documents his identity but also assumes that it is assured on the part of the terminal that the data flow in the terminal sequences is without manipulation. For example, the identification number PIN input by the chip card user cannot be read out, and the data indicated by the terminal likewise coincides with the data forwarded to the chip card. A manipulation of such a nature that supposedly true data are indicated to the user and that processing of the false data in the chip card must be impossible with absolute reliability.

It is therefore the object of the present invention to fashion a data system such that an unmanipulatable data flow control is guaranteed within the user terminal.

This object is achieved by the invention on the basis of an authentication code, calculated from a secret cipher and a random number. Advantageous developments of the invention are recited in the sub-claims. A system for generating a random number is shown, for example, in the copending application of Beutelspacher, et al. for "Circuit Arrangement For Protecting Access To A Data Processing System With The Assistance Of A Chip Card".

The exemplary embodiments of the invention shall be set forth in greater detail below with reference to the drawing; in which:

FIG. 1 is a circuit arrangement for checking the data flow in a data exchange system of the invention; and

FIG. 2 is a modification of the circuit arrangement of FIG. 1.

At the left, FIG. 1 shows a customer card KK fashioned as a chip card and, at the right thereof, a customer terminal KT in which the circuit components essential for explaining the invention are shown. When a proper program P for data flow control is situated in the customer terminal KT can be checked either by use of a customer card KK before inputting the personal identification number PIN, or by use of a test chip card, for instance upon the daily start-up of the terminal. This check is carried out with cryptographic methods. Required for this purpose is that the sensitive program parts P deposited in a memory of the customer terminal KT are deposited in the customer card or in a test card as reference data at the time of personalization of the card. A further prerequisite is that the protected storage of a secret cipher KPC is possible in the customer terminal KT. Further, both the customer card KK as well as the cutomer terminal KT have a shared authentication algorithm f at their disposal. An authentication parameter or, respectively, program authentication code PAC is then calculated with the assistance of this authentication algorithm f and of the secret cipher KPC from the program data both in the customer terminal KT and in the customer card KK. In order to prevent listening-in attacks and manipulations by learning the program authentication code PAC, a dynamic program check is executed with the assistance of a random number v. The random number v is generated in the customer card KK and is also forwarded to the customer terminal KT. Dependent on the random number v, a data block Pv is then seIected with the assistance of the selection module SEL from the sensitive program parts P, both in the customer card KK and in the customer terminal KT. The afore-mentioned caIcuIation of the program authentication code therefore ensues on the basis of this selected data block Pv according to the relationship

One of the two calculated program authentication codes PACv, namely that calculated in the customer terminal KT, is finally transmitted to the customer card KK, and the comparison means (COMP) provided therein determines whether the results calcuIated by the customer card KK and by the customer terminal KT agree.

Two possibilities are available for the protected storage of the secret cipher KPC deposited both in the customer card KK as well as in the customer terminal KT. One possibility is comprised in depositing the secret cipher KPC in a protected, programmable read-only memory. In the second possibility, the cipher KPC is read from a specific chip card into the write-read memory of the customer terminal via the card reader of the customer terminal KT. The power supply (not shown) for this memory may be external to the chip card.

A one-way function expediently comes into consideration as authentication algorithm f. At any rate, it should have so little complexity that it can be relatively easily implemented in a chip card.

A number of possibilities are conceivable for the selection of a data block Pv from the sensitive program data P with the assistance of the random number v. For example, every K.sup.th bit/byte can be selected from the program data P, whereby k is fixed and the random number v determines where the selection should be begun. Or, k=v applies and the start ensues with the first bit/byte of the program data P. However, the random number v, for example, can also initialize a further random number generator as a start value, with the output signals of this further random number generator determining the bits/bytes for the selected data block Pv.

The stored program part P can also be card-specific so that an excessive amount of memory capacity is not used in the customer card KK for storing the sensitive program data. Checking all of the sensitive program part P is nonetheless guaranteed on the basis of the totality of cards.

Given use of different card systems in a terminal, the program check can be system-independently executed in that the program authentication code PAC is not checked in the customer terminal KT but in a separate security module, for example, in a specific security card SK (See FIG. 2) in a POS-terminal. Whether and in which way the program check is carried out is then left up to the card supplier. In particular, the authentication algorithm fs and the secret cipher KPCs are freely selectable by the supplier. A further advantage of this type of program check is the fact that no secret cipher need be stored in the area of the customer terminal KT.

It will be apparent that various modifications and/or additions may be made in the apparatus of the invention without departing from the essential features of novelty involved, which are intended to be defined and secured by the appended claims.