Automated teller machines: their history and authentication protocols

Abstract

Luther Simjian filed a patent in 1959 for perhaps the first ATM; he convinced the City Bank of New York (now Citibank) to run a 6-month field test of his Bankmatic. The test was, however, not extended due to lack of demand. Simjian suggested that the only customers using the machine were a small number of prostitutes and gamblers who did not want to deal with bank tellers face to face. Nature abhors a vacuum and is also the mother of invention; John Shepherd-Barron (OBE), managing director of London’s De La Rue Instruments succeeded in 1964 with help from Barclay’s Bank. The DACS (De La Rue Automatic Cash System) was installed at their branch in Enfield, North London, on June 27, 1967. Since banks are guardians of your money, it was necessary to institute controls on who could get the moolah or lolly! JSB and his many successors required an ATM user to provide two identifiers: the first, a PAN—proof of the existence of a bank account—though not necessary well funded—and the second, a PIN—proof of identity, the creation of James Goodfellow of Chubb’s Integrated System. The PAN in time would ultimately be recorded magnetically on an ATM bankcard, the PIN entered at the ATM’s keyboard. Goodfellow’s invention was followed by ATM inventions of Geoffrey Constable (also of Chubb) and in the US by Donald C. Wetzel. He was former baseball player (shortstop) for a farm team of the San Francisco (nee New York) Giants, IBM sales person and then vice president of Docutel. Since pickpockets were plentiful in London, a substantial part of the security rested with knowledge of the PIN. But how were the PAN and PIN related and how was this tested during an ATM transaction? These remained to be discovered. The IBM Corporation entered the scene in 1968 with a contact to design an ATM. Horst Feistel working at their Yorktown Research Center developed the first cryptographic algorithm to relate the PIN and PAN. Feistel’s algorithm LUCIFER was modified and affirmed in 1976 as the Data Encryption Standard (DES) in the US by the National Bureau of Standards. It evolved into Triple DES (3DES), currently the guardian of most PINs today. This paper is a summary of the achievements of the inventors, the problems encountered and the necessary technical enhancements needed and introduced.