US 4,852,165 AGrant
Secure System and Method for Providing Personal Identifier
Issue Date:1989-07-25
•29 Claims
•7 Drawing Sheets
Abstract
The invention pertains to apparatus and methods for securely transmitting a personal identifier between an originator thereof and a preselected data base. Especially, pertaining to a computer terminal and a method and acquiring a personal identifier used in connection with an account number of an institution, such as a bank, and securely transmitting an encrypted version of the identifier along with a representation of the account number to the institution's data base.
Metadata
Assignee
- National Computer Print, Inc.
Inventors
- Robert A. Copella
- Ann M. Flannery
- David R. Garrelts
- Sandra I. Krigers
Application Information
Application Number:US 0622419
Filing Date:1987-06-12
Priority Date:1987-06-12
Art Unit:222
Classifications
IPC:
H04L 904
Field of Search:
38034023-25;29;51;52825.34
Patent Drawings (7 sheets)
Description
Field of the Invention
The invention pertains to apparatus and methods for securely transmitting a personal identifier between an originator thereof and a preselected data base. More particularly, the invention pertains to a computer terminal and a method of acquiring a personal identifier used in connection with an account number of an institution, such as a bank, and securely transmitting an encrypted version of the identifier along with a representation of the account number to the institution's data base.
Background of the Invention
Financial institutions have during the last several years made substantial efforts to promote the use of automated teller machines by their customers. The financial institutions view such machines as cost effective ways to provide services to individual customers.
However, such machines have experienced a number of drawbacks which have limited their acceptance with respect to the general public. One drawback is that a human teller is no longer present to carry out the transaction. Many customers, it has turned out, prefer human tellers over automated teller machines.
Another drawback that has been encountered with the use of such machines is a need to assure that the use of such machines is limited to authorized individuals and their respective accounts. In addition to utilizing an account number to identify a customer, a system has been developed which requires the customer to enter a personal identifier prior to carrying out a transaction. Provision is made for verification of not only the account number but also the personal identifier entered by the customer. The personal identifier, if kept in confidence, provides a level of security beyond the account number.
Obviously, if a personal identifier is not maintained in confidence, it has little or no value from the point of view of providing security to the system. Hence, not only should each personal identifier be unique at a given institution but in addition the personal identifier should not be publicly known.
In order to provide personal identifiers, institutions in the past have generated such identifiers and assigned them to customers in an arbitrary fashion. Much to the chagrin of the institutions, which are attempting to promote the popularity of automated teller machines, such arbitrarily assigned personal identifiers are often ignored or forgotten by the customers. Hence, there has been an attempt made to develop systems whereby the customer can freely specify his or her own personal identifier.
One way in which such specification can be securely carried out is to have the customer come into the institution, enter the relevant account number and then also enter the selected identifier. In such an arrangement, the identifier can be associated with the account number and stored in the institution's data base without any intervening human involvement which would permit connecting the customer's account number with the customer's personal identifier. Absent the availability of the customer to come into the institution, this is not a viable solution.
In another known system, a customer is mailed a document which explains the purpose for selecting a personal identifier. In addition, a translation table is provided in hard copy form with the same explanatory document. In this system, a customer selects an arbitrary personal identifier and then encrypts that identifier using the provided translation table.
The encrypted identifier along with the relevant account number, which may be preprinted, is recorded on a tear off return sheet which is to be returned to the institution by mail. Unfortunately, instead of returning only the tear off portion, from time-to-time, customers return the entire document including the translation table to the institution. This can provide access by personnel at the institution to both the account number and the unencrypted personal identifier. Such knowledge by one or more institution personnel provides an undesirable breach in the security of the system.
Further, not every customer is comfortable with or capable of making the necessary table translation to produce the encrypted personal identifier. In addition, the institution must maintain a decoding table for each customer so that the encrypted personal identifier can be decoded on receipt for storage in the institution's data base.
The above noted systems while workable can at times be inconvenient. The self-encrypting system can result in disclosure of an unencrypted personal identifier in combination with an unencrypted copy of the account number or the name of the associated customer. Hence, there continues to be a need for a convenient, inexpensive and very secure way in which a customer, remotely located from an institution and its data base, can specify in an arbitrary fashion a personal identifier. There is also a continuing need to be able to transmit that identifier to the institution for entry into the data base while at the same time maintaining an appropriate level of security.
Summary of the Invention
In accordance with the invention, an apparatus and a method are provided for receiving a previously unspecified and unencrypted personal identifier along with an encrypted account number and for securely transmitting that information to a data base. A document is provided to an account holder which includes, in preprinted form, an encrypted representation of the corresponding account number. The account holder enters an arbitrarily selected personal identifier onto the document.
The document is then returned to the issuing institution. A terminal can be located at the issuing institution for the purpose of entering, from the document, the preprinted, encrypted, account number and the arbitrarily selected identifier.
The terminal includes a keyboard or keypad for entry of the arbitrarily selected identifier. A second source of input, a bar code reader, is provided so that the preprinted account number can be accurately and quickly entered into the terminal. As an alternate, the keyboard or keypad could be used for entry of the encrypted account number.
Once the account number has been entered into the terminal it is decoded and checked for authenticity. Prior to having been imprinted on the returnable document, the customer account number could be encrypted in a variety of different ways. Any form of encryption can be used with the account number provided the terminal can readily carry out the decryption process.
A display is also provided on the terminal so that the entered representation of the encrypted account number and the entered representation of the identifier can be visually checked for accuracy by the operator. Subsequent to the account number having been checked for authenticity, assuming it is authentic, the decoded account number provides one of the inputs to a DES encryption circuit located in the terminal. Another input to the encryption circuit corresponds to a pre-assigned institution key which had previously been entered into the terminal. The arbitrarily selected and nonencrypted personal identifier is then combined with the output from the encryption circuit.
An encrypted output is then generated based on these three inputs. The encrypted representation of the personal identifier can then be transmitted, along with the corresponding account number, to the instution's data base for storage and for subsequent use in verification of transactions.
It is a particular advantage of the present invention that the return document, from which the encrypted account number and unencrypted personal identifier are obtained cannot be connected to the name of the account holder nor the account number itself. In the former instance, the name does not appear on the return document. In the latter instance, the account number only appears on the document in encrypted form for use within the terminal. Hence, the return document may be returned by the customer through the mail to a blind post office box number. Even if that document is intercepted, there is inadequate information on it to be of use in improperly obtaining funds or services in connection with the respective account.
The terminal in addition to the input devices noted previously includes a programmable processor and a control program prestored in read-only memory. The DES encryption circuit is electrically coupled to the programmable processor. Further, the terminal includes buffer drivers for driving the keypad and the liquid crystal display output device.
A keyswitch is provided which has an enabled state and a disabled state. In the enabled state the institution's DES encryption key can be entered into the terminal and stored in volatile memory in the DES encryption circuit. Any attempt to disconnect the terminal once the institution's DES key has been entered results in a loss of the previously entered key from the volatile memory once power is removed. Hence, it will be necessary to reenter the key any time the terminal is disconnected or in any other fashion experiences an interruption of power. The terminal also includes an RS232-C serial interface. This interface provides an input/output port through which the terminal can be coupled to a remote data base by either hard wiring, via an interface device, or by telecommunications.
Assuming that the institution's DES key has been previously entered, in accordance with the method of the present invention, the account number on the returned document is first entered into the terminal. The account number can be scanned using a barcode reader or can be entered through keypad. The account number is then checked for authenticity to determine whether or not it comes within the class of acceptable account numbers. Assuming the account number is one of the class of acceptable account numbers, the personal identifier is then entered off of the returned document via the keyboard. The identifier can be displayed while being entered so as to provide a visual check thereof. In addition, it can be verified by requiring re-entry by the operator.
Subsequent to entry of the personal identifier, that identifier is encrypted. A variety of encryption schemes could be used for this process. In a preferred embodiment, the DES encryption system described in Federal Information Processing Standard Publication No. 46, Jan. 15, 1977 is utilized. Inputs to the encryption process include the unencrypted, arbitrarily selected personal identifier; the instution's DES key; and the unencrypted account number to be associated with the personal identifier. Output from the DES encryption process is used to create an encrypted offset value.
In subsequent steps, the unencrypted account number and the offset, corresponding to the encrypted personal identifier, are transmitted to the institution's data base. If desired, the account number can be again encrypted prior to transmission.
A further advantage of the present apparatus and method is realized in that the unencrypted personal identifier is never transmitted out of the terminal. Only the encrypted offset value is transmitted to the data base.
Numerous other advantages and features of the present invention will become readily apparent from the following detailed description of the invention and the embodiments thereof, from the claims and from the accompanying drawings in which the details of the invention are fully and completely disclosed as a part of this specification.
Description of the Drawings
FIG. 1 is an overall diagram of a system and method in accordance with the present invention;
FIG. 2 is a top planar view of an exemplary personal identifier return document in accordance with the present invention;
FIG. 3A is a top plan view of a terminal in accordance with the present invention;
FIG. 3B is a rear plan view of the terminal of FIG. 3A;
FIGS. 4A and B taken together are a schematic diagram of the circuitry of the present invention; and
FIGS. 5A and 5B together are a flow diagram of a method in accordance with the present invention.
Detailed Description of the Preferred Embodiment
While this invention is susceptible of embodiment in many different forms, there is shown in the drawing and will be described herein in detail a specific embodiment thereof with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention and is not intended to limit the invention to the specific embodiment illustrated.
With respect to the figures, FIG. 1 illustrates a system and method in accordance with the present invention. An institution such as a bank or savings and loan can originate a two part document 12. Document 12 can include a descriptive and instructional portion 12a which could be in the form of a letter to the institution's customer. Removably attached to the informational portion 12a of the document 12 is a return portion 12b. The return portion 12b can include, preferably in encrypted form, the customer's account number in a region 12c. The portion 12b can also include a section 12d wherein the customer is requested to record an arbitrarily selected personal identifier.
The personal identifier recorded in the region 12d can be numeric or it can be alphanumeric. The customer then detaches the return portion 12b and in some fashion returns it to the institution either by mail or personal delivery. The portion 12b contains no identification of the customer except for the encrypted account number in the region 12c. In addition to maintain security the portion 12b need not contain a return address to the institution. Hence, if the return portion 12b is intercepted during delivery, an individual attempting to obtain improper access to the customer's account could learn what the personal identifier selected by the customer was as that is recorded on the return portion 12B in unencrypted form. However, the customer's account number only appears in the region 12c in encrypted form.
When the return document 12b arrives at the institution, a terminal 14 can be used to enter the personal identifier and the encrypted account number. The terminal 14 can be linked either by hardwiring, via an interface device, or telecommunications to the institution's data processing unit 16. Coupled to the institution's data processing unit 16 will be a data base usually resident on one or more disk drives 18.
The data base can be used to store a representation of the personal identifier in combination with a representation of the account number for subsequent transaction verification. Such verification is required when the customer attempts to carry out a transaction using an automated teller machine. In connection with that transaction both the account number and the personal identifier would be entered by the customer at the teller machine's keyboard. A representation of the personal identifier and the account number would then be transmitted to the institution's data processing unit 16. The representation of the personal identifier received from the teller machine can then be compared with the prerecorded representation of the personal identifier stored in the data base 18. If the entered personal identifier is the same as the previously stored personal identifier, the transaction can be permitted to proceed.
FIG. 2 illustrates the details of the return portion 12b of the document 12. The return portion 12b can include a region 12e which contains further instructions to the customer. In the region 12c a bar code representation of the encoded account number can been preprinted. Immediately below the bar code representation is an alphanumeric representation of the encrypted account number.
In the region 12d a plurality of squares has been provided into which the personal identifier is to be entered or recorded by the customer. In the exemplary region 12d provision has been made for entry of a four element personal identifier. It will be understood that the number of the elements of the personal identifier is not a limitation of the present invention.
FIG. 3A is a top plan view of the data entry terminal 14. Terminal 14 includes a keypad or keyboard 20 for control and for operator entry of the unencrypted personal identifier. A second input device, a bar code reader 22 is also provided with the terminal 14. The bar code reader 22 can be used to detect the preprinted bar code in the region 12c of the return document 12b. The bar code reader 22 could be a Hewlett Packard HBCS-4300 reader.
The terminal 14 also includes a visual display 24. The display 24 could be, for example, a 20 character per line, two line liquid crystal display.
The terminal 14 also includes an on-off key switch 26 and a key switch 28. The key switch 28 is for the purpose of enabling the terminal 14 to receive an institutional encryption key. Financial institutions commonly use an encryption scheme known as the DES encryption system. This system is described in Federal Information Processing Standard Publication No. 46, Jan. 15, 1977. It requires the entry of an institution's specific multi-element key for the purpose of properly decrypting information, or the encrypting of information by the institution. The terminal 14, as discussed subsequently, can provide DES encryption of the unencrypted personal identifier provided by the customer on the return document 12b.
FIG. 3B is a rear plan view of the terminal 14. The terminal 14 also includes a serial input/output port 30. The input/output port 30 is an RS232-C serial port through which the terminal 14 can be coupled to the data processing unit 60. The coupling can either be by hardwiring, via an interface device or by telecommunications. Power is provided to the terminal 14 by means of an AC line cord 32.
FIGS. 4A and 4B together are a schematic diagram of the programmable electronic control system incorporated into the terminal 14. The control system 40 includes a programmable processor 42 implementable as an MC68HC11 integrated circuit.
The processor 42 includes electrically erasable programmable read only memory. The description table can be loaded therein via the RS232-C port 30.
Addresses bits 0-7 on a plurality of lines 44 provide inputs to an address latch 46. The address latch 46 can be implemented as 74HC373 integrated circuit. Output from the address latch 46 along with additional address lines form an address bus 48.
The address bus 48 provides address input signals to a programmable read only memory 50. The programmable read only memory 50 is an 8K by 8 bit storage unit which can be implemented as a 27C64 integrated circuit. The memory 50 can be used for nonvolatile storage of a control program.
Also coupled to the address bus 48 is an 8K by 8 bit random access memory 52. The random access memory 52 can be implemented as a 6264 integrated circuit. Data inputs and outputs are provided on an 8 bit data bus 54.
Memory chips 50 and 52 are controlled by address decoder 56 and associated gating circuitry. The address decoder 56 can be implemented as a 78HC138 integrated circuit. Reset and initialization signals are provided by a reset conditioner 58. The reset conditioner can be implemented as DS1232 integrated circuit.
The address bus 48 along with the data bus 54 are coupled to an input/output expander circuit 60. The circuit 60 can be implemented as a MC68HC24 integrated circuit. The circuit 60 provides interfacing between the processor 42 and input/output devices associated with the terminal 14.
Device data outputs from the expander circuit 60 are provided on a plurality of output lines 62. With respect to FIG. 4B, outputs from the expander 60 on one of the lines 62 provide an input to beeper drive circuitry 64, and column drive circuitry 66 for the keypad 20. Beeper circuitry 64 can be used to generate an audio feedback tone to the operator.
Device input signals are provided to the expander circuit 60 on a plurality of input lines 64. Signals are received on several of the lines 64 from row sensors 68 which are coupled to the rows of the keypad 20, key switch 28 which is coupled to members of the plurality of lines 64 utilizing circuitry 70 and input from the bar code sensor 22 using another member of the plurality of lines 64.
The data bus 54 also provides data inputs to a display buffer 76. The display buffer 76 can be implemented as a 74 LS245 buffer. Outputs from the display buffer 76, on a plurality of lines 78, and a plurality of lines 79 provide drive signals to the 40 character liquid crystal display 24. The liquid crystal display 24 can be type EPSON EA-X20027AZ.
A plurality of lines 80 which includes four lines from the address bus 48 provides address inputs to an encryption circuit 82. The circuit 82 can be, for example, a DES encryption circuit type MC6859L. Output from the encryption circuit 82, on a plurality of lines 84, and via buffer 86 is coupled to the data bus 54.
There is thus a bidirectional data communications path between the processor 42 and the encryption chip 82 along the bus 54. Address decoders 90 determine which of the buffers 76 or 86 is active at any one time.
FIGS. 5A and 5B together are a flow diagram illustrating the steps of a method in accordance with the present invention. In an initial step, an institution would assemble a list of names, addresses and corresponding account numbers. An encryption and a decryption table would be generated for use in encrypting and decrypting the account numbers. It will be understood with respect to the present invention that, the form of encryption or decryption of the account numbers is not a limitation of the present invention. Encryption tables represent only one form of encryption that can be used. Alternately, an encryption algonithm and corresponding decryption algonithm could be used.
The two part documents are then generated from the list of names, addresses. The corresponding encrypted account number is entered onto the separable, return, portion of the two part document as was previously discussed with respect to FIG. 2. The documents are then sent to the customers on the list. They can be sent via the mail or they can be personally delivered.
Subsequently, the corresponding decryption table is loaded into the computer terminal. The institution's DES encryption key is also loaded into the terminal, assuming it is an institution with an assigned DES encryption key. Then it is necessary to wait for the return of the tear off portions of the documents.
Upon receipt of the return portion of the document including the preprinted, encrypted account number as well as the unencrypted personal identifier recorded thereon the account number is scanned or keyed into the terminal from the document. Within the terminal the account number is decrypted and is checked for authenticity. Authenticity checking can include use of mod 10 check digits as is well known in the financial industry and described by the Luhn Formula in ISO 7812-1985E.
The terminal can by generation of a tone on its internal beeper indicate acceptance of an authentic account number. The operator can then enter the unencrypted personal identifier, which has been written on the return portion of the document, via the keypad. The identifier can then be encrypted taking into account the account number and the previously entered encryption key. The account number and the encrypted identifier can then be transmitted to the institution's data base. If desired, the account number could be again encrypted prior to transmission. At that time the operator can then go on to the next document.
Attached hereto as an Addendum is a listing of a control program usable with the electronic system 40.
From the foregoing, it will be observed that numerous variations and modifications may be effected without departing from the true spirit and scope of the novel concept of the invention. It is to be understood that no limitation with respect to the specific apparatus illustrated herein is intended or should be inferred. It is, of course, intended to cover by the appended claims all such modifications as fall within the scope of the claims. ##SPC1##
Claims
What is claimed:
1. An apparatus for receiving a previously unspecified, unencrypted first identifier along with an encrypted second identifier and for securely transferring a representation thereof to a data base, the apparatus comprising: a housing; manually operable means for entering a representation of the encrypted second identifier into said housing; means, carried within said housing, for decrypting the second identifier; means for testing the authenticity of said decrypted second identifier; manually operable means for entering a representation of the unencrypted first identifier into said housing, in response to an authentic second identifier; means, carried within said housing, for encrypting said first identifier; and means for transmitting said encrypted first identifier from said housing to the data base.
2. An apparatus as in claim 1 with said manually operable means for entering comprising a keyboard.
3. An apparatus as in claim 1 with said manually operable means for entering said unencrypted first identifier including a keyboard.
4. An apparatus as in claim 3 with said manually operable means for entering said encrypted second identifier including means for sensing a selected machine readable code.
5. An apparatus as in claim 4 wherein said sensing means includes a bar code reader.
6. An apparatus as in claim 1 wherein said testing means includes means for decrypting said encrypted second identifier prior to testing the authenticity thereof.
7. An apparatus as in claim 1 wherein said decrypting means includes a predetermined look-up table.
8. An apparatus as in claim 1 including means for entering a predetermined data base identifier.
9. An apparatus as in claim 8 wherein said encrypting means further includes means for sensing said predetermined data base identifier and wherein said encrypted output is generated in response, at least in part, to said sensed, predetermined data base identifier.
10. An apparatus as in claim 1 wherein said transmitting means includes means for transmitting said decrypted second identifier.
11. An apparatus as in claim 9 wherein said encrypting means includes means for implementing a DES encryption algorithm.
12. An apparatus as in claim 9 wherein said encrypting means includes an MC6859L type integrated circuit.
13. An apparatus as in claim 9 including visual display means completed to said entering means for visual verification of an entered first identifier.
14. An apparatus as in claim 13 wherein said transmission means includes a serial interface.
15. An apparatus as in claim 9 wherein said first identifier has been recorded in unencrypted form on a documentary medium that was already carrying a representation of said encrypted second identifier.
16. An apparatus as in claim 10 with said transmitting means including a serial bidirectional interface.
17. A terminal, couplable to a data base, for entering a previously unspecified, non-encrypted, first entity identifier along with a previously specified, encrypted, second entity identifier and for securely transmitting representations of both identifiers to the data base comprising: manually operable means for entering the unencrypted first identifier; manually operable means for entering the encrypted second identifier; means for decrypting and for testing the authenticity of said encrypted second identifier; means for encrypting said first identifier; and means for transmitting said encrypted first identifier and said second decrypted, identifier to the data base.
18. A terminal as in claim 17 wherein said first identifier entering means includes a keyboard and said second identifier entering means includes bar code sensing means.
19. A method of securely transmitting a previously unspecified first identifier, along with an associated, previously specified second identifier, to a data base, the method comprising: providing a documentary medium which carries a encrypted representation of the previously specified second identifier and upon which a visibly perceptible, unencrypted representation of the first identifier can be recorded; providing a terminal having manually operable means for entry of the encrypted and unencrypted identifiers; entering the representation of the second, encrypted, identifier carried on the medium into the terminal; entering the representation of the first, unencrypted, identifier recorded on the medium into the terminal; decrypting, within the terminal, the second identifier; testing the entered representation of the second identifier for authenticity; encrypting the entered representation of the first identifier; and transmitting, if the representation of the second identifier is authentic, the encrypted representation of the first identifier and the decrypted representation of the second identifier to the data base.
20. A method as in claim 19 wherein the decrypted step includes using at least part of the representation to specify an entry point into a predetermined decrypted table.
21. A method as in claim 19 wherein the recorded first identifier has a plurality of elements and the encrypting step includes converting each of said elements to an encrypted representation in accordance with a predetermined encrypted algorithm.
22. A method as in claim 19 wherein the recorded first identifier has a plurality of elements and the encrypting step includes converting said elements into an encrypted representation in accordance with a DES encrypting encoding algorithm.
23. A method as in claim 19 including: providing a visual display on the terminal; displaying the entered representation of the first identifier; and visually verifying the accuracy of the entered representation of the first identifier.
24. A method as in claim 23 including: displaying the entered representation of the second identifier; and visually verifying the accuracy of the entered representation of the first identifier.
25. A method as in claim 22 wherein the encrypting step includes computing a multi-element off-set and the transmitting step includes transmitting the off-set as the encrypted representation of the first identifier.
26. A method of securely transmitting an arbitrarily selected multi-element identifier, associated with a previously determined second identifier, to a spatially displaced data base, the method comprising: providing a medium which carries a encrypted representation of the previously specified second identifier and upon which a visibly perceptible representation of the multi-element first identifier can be recorded; providing a terminal having manually operable means for entry of the two identifiers; entering the encrypted representation of the second identifier carried on the medium into the terminal; entering the representation of the first identifier recorded on the medium into the terminal; decrypting and then testing the entered representation of the second identifier for authenticity; encrypting the entered representation of the first identifier if the second identifier is authentic; and transmitting the encrypted representation of the first identifier and the decrypted representation of the second identifier to the data base provided the second identifier is authentic.
27. A system for securely transferring an essentially arbitrary, multi-element, non-encrypted, identifier from an originator thereof along with a predetermined second identifier to a spatially displaced data base comprising: a sheet member which carries a preprinted encrypted representation of the predetermined second identifier and has a region for recording a representation of the multi-element non-encrypted identifier; manually operable means for entering the unencrypted first identifier; manually operable means for entering the encrypted second identifier; means for decrypting the second identifier; means for testing the authenticity of said decrypted second identifier; means for encrypting said first identifier; and means for transmitting at least said encrypted first identifier to the data base.
28. A method of securely transferring from an individual at a first location to an entity, which maintains a financial account with the individual, at a displaced storage location a personal identifier newly selected by the individual comprising: originating a documentary member with an encrypted identifier of the individual's financial account thereon; delivering that documentary member to the individual; applying an unencrypted representation of the newly selected personal identifier to the documentary member; delivering that documentary member to the entity; reading the encrypted account identifier from the documentary member; decrypting the account identifier; checking the decrypting account identifier and indicating if it is authentic or not; sensing the unencrypted, newly selected personal identifier if the account identifier is authentic; encrypting the personal identifier; and transferring the encrypted personal identifier and the decrypted account identifier to storage.
29. An apparatus for securely encoding a personal identifier newly selected by an individual and recorded, in unencrypted form, on a document which document also carries a previously printed, encrypted, machine readable, representation of an account number assigned to the individual and no other representation of that account number, the apparatus comprising: a closed housing defining a region therein; means, carried by said housing for sensing the encrypted representation of the account number from the document; means, enclosed by said housing, decrypting the sensed account number; means for verifying the authenticity of the decrypted account number; means, carried by said housing, for indicating that the decrypted account number is authentic; means for entering a representation of the unencrypted personal identifier on the document into said housing if the unencrypted account number is authentic; means, enclosed by said housing, for encrypting the personal identifier; and means for transmitting a representation of the encrypted personal identifier along with the encrypted account number from said housing.