GB2130412A - Electronic money purse - Google Patents

Abstract

The essence of the invention is a socalled "data bit variable spacer generator", block 79 which contributes to the generation of a control output "c" from a combinatory logic circuit group 78. The logic level of "c" determines whether a clear data bit from buffer 82 is to be sent or a random bit from block RMG. The 'variable data bit spacer generator' is controlled by a number of parallel bit outputs from registers SH1 and SH2 which hold a cipher key after being conditioned by other logic inputs derived from key parity flip flops (FF1 and FF2) and clear data bit levels from block 81. Registers SH1 and SH2 shift and recirculate when the c - output is high. Similar principles are used when data are deciphered. The circuit is suitable for integration with other functions on a single substrate chip. <IMAGE>

Description

SPECIFICATION An electronic money purse and fund transfer system The invention relates to the general field of tamperproof electronic transfer of confidential data between a card-like data carrier component and a terminal. Numerous ideas have appeared in this field over the past fourteen years; examples are GB 1,314,021 of 1969, GB 2,057 740 and GB 2,075,732, US 3,870,866 and 3,906,460 besides others by different authors.

Insofar as these various techniques are also applied or expected to be applied to moneyless payment transactions they were prompted by the conviction that in many a service field the traditional money as a means of value transfer is not only inefficient and loaded with overheads but increasingly often becomes rightout an impediment to the service itself. And, if a satisfactory form for an "electronic money carrier" could be found, such innovation could have healthy repercussions on the streamlining and cost reduction of numerous public and semi-public services and vending transactions.

There exist published descriptions of debit cards from which a prepaid credit can be deducted for specific purposes, and which on exhaustion are thrown away. Rechargable cards where also conceived and descriptions published. But none can be said to fulfill the manifold stringent requirements to match the role of an electronic container of purchase entitlements, or 'money purse'.

It is the purpose of this invention on a systematic basis to embody in a single design such features as will satisfy among others the following conditions: (a) tapping the transfer links between card and terminal with fraudulent intent will not reveal any data or give any clue for deciphering data.

(b) the money purse should contain only a single LSl chip with the lowest possible number of bonding pads so as to ensure high yield, high reliability lowest cost and lowest power consumption.

(c) the design should permit repeated updating (re-loading of value data) and debiting operations.

the updating should be such that terminals for debiting operations cannot in any circumstances be modified for updating functions.

(d) It should be possible to add any amount to the value of a card up to a prescribed maximum card value: at Post Offices, Supermarket Supervisor offices, and from one's own home telephone.

(e) debit operations ( = electronic payments ) should take no more than one second.

(f) a card when lost can be readily returned to owner (g) an "electronic moneypurse" or card cannot be utilized by a thief, not even a first time.

(h) if there is any malfunction of equipment at a vending machine or terminal this shall not affect or alter any of the card data (i) the cipher keys shall not be hardware-based but shall be capable of being altered very frequently so as to preserve equipment and card stock validity even if any temporary fraudulent intrusion were possible.

(k)"the money-purse" shall be robust enough for many years of continued use.

(I) the system must be such that the large majority of debit transactions (electronic cash payments) shall be carried out in an off-line mode while a large majority or all the value adding operations shall be in an on-line mode.

Commenting on item (a) it must be pointed out that there exist today several top-grade cipher systems but it would in the opinion of the authors be difficult to make the required card hardware compatible with requirement (b). A cipher circuit will be described, therefore, which, it is believed can achieve with relatively modest logic the same standard of imperviousness to crypto-analysis as more advanced systems such as the well-known data encryption standard ( DES). However, in our design, the new circuit is not proposed to be a separate unit but is integrated with the value transaction processor on a single chip both in the "card" as also in the terminal. None of the clear data lines are accessible on the chip or outside with probes or the like. In other words, only ciphered data enter or leave the chip bonding pads.

Concerning condition (c) it should be observed that a very high degree of encryption safety is needed to satisfy this condition but, at the same time, it should be obtained at only moderate cost over and above the cost of a pure debit chip. Two solutions will be presented; one (Figure 4 and 7) is expected to be adequate for use by many organisations. The second (Figure 4 + 9) version would be adequate for regional usage (i.e. a common electronic data carrier for the whole of Europe, or Northern America, or Africa etc).

Further features and peculiarities will become evident from the description of the drawings Figure 1 - 10 in which Figure 1 shows the general data transfer relationship of the system between one or more "card readers", a local terminal, a central computer common to a multiplicity of terminals, and a card.

Figure 2 shows in more detail the data transfer relationship between a card and a Terminal which incorporates also a "Reader" unit.

Figure 3 shows a functional block diagram of the cipher sections 21e or 21t in Figure 2.

Figure 4 gives by way of example a logic diagram of the cipher control generator circuit consistent with the block diagram of Figure 3.

Figure 5 is a functional block diagram of the chip section 22c or 22t in Figure 2, mainly concerned with debit and credit operations.

Figure 6 is a sketch relating to a circuit portion in the terminal forwhich there is no corresponding part in the card circuit; it relates to the preliminary testing of the card-terminal interface performance.

Figure 7 gives an example for executing the block diagram of Figure 5 Figure 8 is a flow diagram of the functional and decision steps for a card employing the circuit combination of Figures 4 and 7 Figure 9 shows a logic diagram of a more advanced card circuit wherein the card is also equipped with push buttons, foremost for the purpose of entering a Pin number (personal identifying number of the owner).

Figure 10 is a flow diagram of the functional and decision steps for a card using circuit combination of Figures 4 and 9.

In Figure 1, "C" is a data carrier token or "card" 1, "R" is a token reader device 2 which, it is noted, has no moving parts, "T" is a terminal apparatus from which go out several cables, 71 to 76 leading to six similar readers "R" which may be operated quasisimultaneously by the socalled time sharing method. There is also a communication line 9 connecting a central computer 10, say a bank computer, with a multiplicity of "terminals". In the system here to be described the intention is to allow the majority of all card debiting operations to be executed by virtue of the built-in security measures of a terminal (8) alone.Nevertheless, the central computer 10 retains vital functions as follows: (a) in the nightly collection of summary cash data from terminals 8 (b) it is directly involved in allu up-dating (value incrementing) operations where a value is added to the card by on-line data transfer.

(c) as a means for auditing the effectiveness of the security measures relating to debit transactions; the provision shown in Figure 2 is introduced making a debiting terminal responsive to a command signal from the central computer.

(d) replacement of the socalled "semi-active" secret check numbers" ( see our patent application GB 2 057 740 ). According to the present paper, these check numvers are also used for cipher control. This is further explained in conjunction with Figures 9 and 10.

Figure 2 prepares the explanation of the inventive features by breaking down the single card chip 20c in the card C into functional blocks, with 21 c being the cipher/decipher circuit, 22c being the arithemtic circuit, 23c being an optional form of storing longterm accessory data, and 24c comprising the clock phase distributor circuit and program counter, etc.

To repeat, all these part circuits, especially the first three, are embodied on a single semicunductor chip.

The block 26 covers pulse shapers and d.c. rectifier circuits. These supply power, and a four phase clock respectively, to the main chip. The chip inputs 11 and 12 carry in-and output ciphered data respectively. - In the terminal apparatus "T" with which the card is coupled via card coils 3c and terminal coils 3t, a very similar chip 20t is placed having sections 21 t, 22 t, 23 t, and 24 t. An additional section 25 is provided the function of which is explained in connection with Figure 6. Block 30 symbolizes a price encoder circuit which may be set permanently (for example within a vending machine) or as required by means of a manual key board (at a cash register). 31 is a display device to show up the initial and final transaction phases. See also Figure la. If desired a small thermal printout machine may give the user a paper receipt.

An important element in the system philosophy is the relay 28 which can be operated from a central computer 10 to switch transmission line 9 (Figure 1).

Line 9 is here represented by lines x,y,z and they replace the interface connections to the local termin al Tin order centrally to spot-check the conditions of various tokens. The central terminal, in addition to performing the normai debiting operations of a local terminal, is capable of fetching from the card certain additional data derived from registers 111, 113 and 114 shown in Figure 5. These registers hold the following data: Serial number of card, total number of updating transactions performed since the card was bought, and date and amount of the last updating operation. These data are then compared with the central record at the Computer 10. If they do not agree the central Computer instructs the local terminal to capture the card and to produce an informative display.Alternatively, the central computer emits a code for entry into the card which disables certain portions of the card making it unsuitable for further up-dating or further use. It suffices if only a small portion of all debit transactions is audited in this manner and to discourage thereby any thought of fraudulent attempts against the system even if that were practically feasible.

The data encryption principles are now described, see basic block diagram Figure 3. The block 130c is a logic circuit which causes binary data inputs received at e, to be passed on to the exclusive OR gate 75 in nearly deciphered form. After passing that gate the data at "a" are fully deciphered.

Block 130 c is controlled by line "c" derived from a larger logic block 78. The same control output "c" is also applied to logic block 137c which via another exclusive OR, 74, receives clear data from point K and pases them on in ciphered form at card point t2.

- The circuit has shift registers 76 and 77 ( marked SH1 and SH2) and could equally well have more than two portions. Each shift register portion contains part of a secret check number, also referred to as key. A fresh key is entered regularly at the end of a debiting operation ( see also GB 2,057 740 ).

Provision must be made in the circuit design for starting up a card by providing an access path for loading the register with a known factory number for the initial startup cycle. This said access path is then burned up while an unknown new check number is entered for immediate replacement. Thereafter, check numbers remain unknown and undetectable by virtue of the cipher processes to be described.

Each of the shift register portions SH1 and SH2 has a parity counter, FF1 and FF2 respectively with parity outputs PI and Pli.

A programmable counter 79 contributes to the combinatory logic circuit 78 from which the control line "c" is derived. This counter is stepped by clock phase CK1 whenever the output at "C" is at logic level zero. The counter keeps being stepped until a predetermined bit output or the "Carry" output of the counter is reached which feeds into the control logic 78 via output line 79a. A further contribution to the control logic is procured by the data bits contained in data being received or data being read out fom the card. This is done via one-step delay circuits 80 and 81 respectively. As an alternative, not shown in Figure 3, the data entered into a data buffer register 82, may operate another flip flop for parity count and when the buffer is full the parity output is applied.The logic block 137 c admits data bits from exlusive OR 83 altered in dependence of parity output P I or P II and passes them on to terminal 12 whenever line "c" is high, and when the same goes low admits only random data from the random data generator R M G.

The role of the circuit block 79 is to introduce added random data over and above those which would appear if the cipher key number in registers 76 and 77 alone were the controlling factor. For this reason this circuit element may also be called "data bit spacer generator". Its action must of course be repeated in a similar circuit block within the terminal otherwise it would be impossible to decipher the data passed in either direction. For this reason the spacer generator is controlled by a number of bits derived from the key register but modified by data bits already transferred. Dependent on the logic in block 78 different expansion ratios may be procured, that is ratios between the number of data bits transmitted to the data bits contained in the useful data. It is not possible to determine where useful data in the data string begin and where they end.

Nor is it possible to identify any particular bit or groups of bits as belonging to a certain group if data.

The circuit of Figure 4 provides an example for how the just decribed principles may be put into practice. The diagram is confined to the portion which has the boundary points "a", "k", "e" and "c" on the left, and "b", "h" and "c" on the right (bordering on section 22c of Figure 2). The data input "a" corresponds to the data input terminal DIN in Figure 1 A of current patent application GB 2057 740 and the shift registers SH1 and SH2 correspond broadly to shift register S2 in the cited Figure. As in the cited patent application, the contents of these registers are not fixed but may be changed and rotated with others after each transaction, as well as completely changed over periods of weeks. This structure is again used because of the Applicants' opinion that a frequently alterable security key can provide greater security against unforeseen intrusion than a fixed key.As already explained, in the present paper, these keys also serve as encryption keys. - In theory it would be possible to make the key length so great that a computer would take many years to scan through all the possible number combinations. However, in a card context such as here described it is preferable to use much shorter key lengths and rather two scramble them with or dilute them in random numbers.

The effect of the referred to data bit spacer generator is that the effective key length is increased. That means that the scanning of key combinations applied to known clear data and known (recorded) ciphered data would take much longer than would normally correspond to the scanning of key combinations alone. Assume that the scanning time is six months and the period for key change-over only four weeks. Clearly, there would be no point in continuing the search beyond the first four weeks, and since the chance of finding the key number in four weeks is poor, there would be no point in commencing the effort at all.

Concise description of Figure 4 The cipher key is entered serially via point "a" and gate 37 during an (here unspecified) program step PC, and via OR gate 38 to the input of shift register SH1. The flip flop FF1, starting from preset condition, is set and reset dependent on changes of '0's and '1's and its instant state therefore represents the parity for the data bits entered. This is repeated for the other half of the register (SR2) by means of flip flop FF2. "c" is the control output which ciphers or deciphers data. 'c' is high when the bistable FF8 has a high q-output.The bistable FF8 is set at S in three different ways (in this particular example): (o) If both FF1 and FF2 happen to have a high output simultaneously (ss) FF2 has a high output combined with a high or low incoming or out going data bit dependent on the previous state of the flip flop FF5.

(y) if the counter 79 is full at its output QN having been clocked up during 'c' = plperiods via AND gate 63. The number of count pulses, however, for reaching this output is dependent on the program ming input levels at A, B, C, and D which derive from paralell bit outputs K2 K3 K10 and K,2 of register SH1 and alternatively from paralell bit outputs K17, K20,K30 and K31 of register SH2. Whether the first or second set of program inputs is applied depends on theoutput state of the flip flop bistable FF5.

It will be noted that these programming inputs change frequently on account of the fact that the clock input to the said key registers is enabled whenever "c" is high and the AND gate 49 receives a clock spike in time phase CK2. The program inputs to the counter do not change while the counter is being stepped, that is when "c" is at logic zero but is likely to be quite different when "c" becomes zero next time. The state of the bistable flip flop FF5 depends on the combined history of key bits and data bits. (as can readily be seen from the circuit diagram). This circumstance forces the analyser when trying to achieve results by computerized trial and error scanning, to go through all the possible combinations of key bits and data bits (This assumes further, the analyst has full knowledge of the cipher circuit for simulating it in a computer).Even though the clear data bits may be known what remains unknown is the position of the ciphered data bits within the substrate of random bits since the counter 79 introduces quasi-random spacings which again depend on the unknown recirculating key bits. To this comes the uncertainty about where the first data bit begins and the last one ends. The scanning process must therefore cover the entire data string of random plus data bits.

The periodic changing of key numbers is a contributive element to security. Such changes would be initiated from a single area- or regionwide center, mainly during nightly hours via telephone lines when based on a protocoll similar to that described for the card-terminal transfer cycle. The regional center transmits a new valid key-number in encrypted form to a national or local center or bank head quarter in replacement of another key number in the category of "semi-active" numbers. From there, similar replacements would take place to all locations, where money transfer terminals are in operation. The capability of hierarchically passing down new cipher keys in ciphered form on a continual routine basis at irregular intervals has the consequence of simplifying the card chip and increasing the security against encryption intrusion of the money transfer system.The cost of this hierarchic system is extremely low and contributes to a robust, low cost electronic card design.

An example for the arithmetic portion of the card chip is given in Figure 5 ( block diagram ) and Figure 7 ( partial logic diagram ). - In Figure 5, 100 is the arithmetic register containing the memorized values ofthe card. 101 contains security numbers for comparison and the proram counter and associated logic processors. These blocks may also be replaced by a microprocessor. In the simplified version of Figure 7, the block 111 Of Figure 5 represents a counter register which carries a record of the sum of past updating operations (value-add operations) carried out with the card since its acquisition. is is a register containing the unique serial number of the card, and register 114 contains the value by which the card was incremented during the last updating.

The readout of these data is initiated by a code word transmitted by a central computer station concerned to the card and entered therein in register 105 whereupon comparison takes place in circuit group 106 with the contents of register 104. If there is equality, block 104 produces an enabling output on line 108 whereby the said counter 111 is incremented by 1. Thereafter the block 101 causes the consecutive serial readout of the cited three figures which are transmitted to the central computer installation in ciphered form. If the update-enable code entered into register 105 is wrong, the fraud counter 107 is stepped up by one; after a few of such unsuccessful update attempts had been made the said counter reaches output line 109 which finally disables the entire update mechanism of the card.

Figure 7 shows the detailed example for this circuit. Block 147 is the chip program counter, 155 and 155a are a value counter and respectively an image counter of identical build-up. Block 130 is a shift register for receiving an up-date enable code, block 136 is a four bit shift register with paralell bit outputs, block 160 is a four-bit shift register with paralell bit-inputs. It is assumed that the counter prior to a debit operation is in position 5 and position 6 must be reached to obtain a debit function.

According to the present example, the terminal emits a bit sequence equal to 1 0 11 which reaches the chip portion Figure 7 at point "b" and is entered via strobing gate 135 and bistable 164 into the shift register input of register 136. When the entire code is within the register the gates 137 and 138 produce outputs with the consequence that gate 162 is disabled (because a stepping pulse is applied to program counter 147 via or gate 146) and output line 148 therefore remains high enabling gate 149 which now produces a rapid succession of stepping pulses into counters 155, and 155a. The difference between these two counters is, however, that 155 will, as a rule, be loaded with a value number, whereas counter 155a is always reset at the commencement of a transaction.A further difference is that the up/down mode input for 155 is initially high whereas for 155a it is low. Therefore, counter 155 will count down whereas counter 155a will count up. When counter 155 reaches zero the OR gate 156 produces a high-going pulse along line 157 to set the bistable 141. 153 is enabled so that AND gate pulse in phase with CK3 to bistable 141. In the meantime a paralell mode pulse (lasting fom CKl to CK3) had been applied to shift register 160 to insert the a b c d inputs applied to it.

This enables AND gate 151 causing the count directions of the said two counters to be reversed.

When counter 155a reaches zero the value count in 155 has just been restored. At this moment the AND gate 153 is enabled producing a reset pulse to units 136, 140 and 141 causing counter clocking to stop.

Also, the paralell mode input to shift register 160 returns to serial mode so that the inserted binary numbers are now serially transmitted via OR gate 161 to terminal h for encipherment and transfer to the Terminal where it is decoded and recognized to stop the value counter. The resulting count minus 4 represents the double value count for the card. This is displayed on window 12 of Figure 1 a. This is compared with the price set for the goods or services required and the debit cycle is not commenced if the card value is insufficient. If it is sufficient, the terminal emits a pulse synchronous with clock pulse phase CK3 which ( by-passing the cipher sections) reaches AND gate 134 and causes the Program Counter 147 to be stepped from output 6 to output 7.

This enables AND gate 139. After that the Terminal T emits a code 01010101 etc., which is passed through the cipher/decipher sections and reaches gate 135 and register 136.

Every time the high level bit passes output "c" in register 136 AND gate 139 produces a pulse which is inputted to the value counter 155 via OR gate 150 thereby debiting the register with as many basic value units (for example pence) as debit pulses are transmitted by the terminal. After the debit operation is completed the terminal T emits again a pulse in phase with CK3 causing the program counter in the 'card' to advance to position 8. Thereafter the value readout cycle already described is repeated and the result is displayed in the terminal on display window 13 (Figure 1a). The amount debited on the window below is also displayed which reflects the actual debit pulses transmitted as explained. A printout device receives the information from the same sources.

The adding-value cycle (updating proceedure).

For this operation there is no circuitry provided in a debit station. The card holder must go to an authorized mediator point such as post office, bank or licenced supermarket checkout point. Alternatively the operation may be done from one's own home phone. Updating circuitry is contained only in certain central computer banks serving certain regional areas. During a first phase of the add-value transaction the computer goes through the same program steps 0 - 8 which are required for the already described debit transaction without necessarily decrimenting the card. The actual crediting process begins with entry (in ciphered form) of a "secret update number" into the register 130 after first stepping program counter to position 9. This "secret number" is in the case of Figure 7 a fixed number but, as will be shown in Figure 9, it may be a substitutable number as well.Conditional on the acceptance of this number is also that the comparator 169 responsive to a comparison of the first check number or cipher key does not produce an inhibit signal on line 167. If detection in Gate 132 is in order it produces a high output applied to NOR gate 152 thereby enabling counter 155 to count upwards.

Next the central computer produces count pulses 010101010 etc., as already described which pass through the shift register 136 and the gate 139 to the counter 155. As many 'one' pulses pass to this counter as many basic value elements are added to the card.

Finally, the central computer transmits the code which causes the card to read out the new value status, namely 1011 (read from left to right). This process has already been described in connection with the debit operation and need not be repeated here except to state that program counter goes to position 10 and the two counters 155 and 155a go through their readout performance. Further program positions might be provided if found necessary for corrective messages from the computer to the card.

Such details are not shown here. Input q to OR gate 161 is intended to connect to chip section 23c where for example the memory arrays holding the card's serial number, number of update transactions, and latest value add operation details may be held. As already explained, these details are also transmitted at the very beginning of the updating phase, and if these data do not agree with the centrally held record the computer may utilize means provided for sending out a special "Hold Card" signal to the remote update terminal which may cause the card to be captured or, dependent on the nature of the terminal may take other measures to prevent the holder from using the card again unless first presented to an inspection office. (see discussion of FigureS).

An important aspect of dependability of the system is to ensure that a faultfree linkup is established between a terminal and a card before any actual transfer of transaction data begins. To this end a small portion of the cip (section 25 in Figure 2) is devoted to arrying out a pretesting function. This is explained by means of Figure 6. The "linkup" between a terminal and a card can be considered well prepared if a signal - any digital signal - emitted by the terminal, passed through the cipher process, crossing the interface, deciphered in the card, re enciphered in the card, crossing the interface once more, de-ciphered in the terminal, compared with the original signal and this sequence repeated four times without interruption produces every time the correct replica of the original clear signal.Referring to Figure 6, R N G is a random number generator producing a signal having, say, 16 bits.

Block 127 is a two-bit counter with an output after four count steps at FE. Block 126 is a counter counting the number of clock pulses needed to pass a data bit through the random register RNG. Random data are passed at 'm' to the encryption section 21t (Figure 2), then transmitted to the decipher section 21 c of the card and then recirculated four times. The data return to the Figure 6 circuit at point 'n' and then compared in exclusive OR gate 122. If there is a deviation OR gate 121 passes a reset pulse to terminal R of the two-bit counter 127. In this way, a terminal will only start a transaction if an uninterrupted "correct" comparison is achieved in four transmission cycles. F E is thus a "function enable" line which must go high before a debit cycle can begin.

Next a more developped form of card shall be described but to illustrate the difference between a simple "money card" and the more elaborate "money purse" represented in Figure 9, it may be useful to go through the two flow diagrams for the two versions shown in Figures 8 and 10 respectively.

The functional steps are written into the blocks of the flow diagram and are therefore self-explanatory.

Each step is marked with an arabic index number. In Figure 10, the identical steps are marked with identical arabic numbers whereas the added new steps are marked by consecutive roman figures. In this way the added security precautions can easily be recognized. - A card capable of performing the flow diagram Figure 10 is equipped with data entry keys. They are primarily used to enter the owner's personal identifying number (PIN) into a PIN register in the card ('Step I'). ('Ill') is a step that must come before step '2') in the Figure 8 diagram because - as described in greater detail in GB 2,057 740 - the terminal must first select the cipher key, based on a reference number supplied by the card, from a battery of eight key numbers valid at the time. This reference or 'address' is provided by the card in unciphered form (synchronous with CK2 or CK3).

Only after step IV can a ciphered transmission take place since the key number must be the same in terminal and card. In step (2) the effectiveness of the cipher/decipher action is tested (see Figure 6).

The steps (2) to (7) in Figure 10 are identical to those described and represented in Figure 8. Step (V) on the other hand again reflects the greater mobility of the key numbers used since, at this point of the flow diagram, the card receives a new key number and a new address for that key number.

In Figure 8 the dividing line between transactions that can be performed in and debiting terminal and thoe that can only be performed on-line in communication with a central data bank, is marked # - #. A similar dividing line marked ss- ss 13 exists in Figure 10.

The steps 8 & 9 will of course reveal the congruence of card data with centrally kept data as already explained (serial number, sum of update operations, and last update particulars). Steps VI and VII signify that also the "update Enable" check or key number is in the second version of the card not fixed (as in the example of Figures 7 and flow diagram 8), but is made alterable along the same principles as ex plained in GB 2,057,740. Thereafterfollowthe steps (10) to (14) already found in Figure 8 for the execution of crediting operations (value-add). Final ly, in step VIII the secret up-date enable numbers and the associated address number are substituted by other pairs. In steps IX and X the correctness of this substitution process is checked, and if required the proceedure is repeated.

A study of the flow diagram of Figure 10 will facilitate an appreciation of the various elements in the logic diagram of the more advanced 'card' as shown in Figure 9. As in the simpler form, the inductive transfer links connect directly to the cipher/ decipher circuits via terminals 3c,3t, 3"c and 3"t respectively. The cipher action is performed by elements 230 c and 230 t respectively; and 237 c and 237 t respectively. A not necessarily integrated circuit for current supply (252) and a clock pulse generator 253 are provided in the card. The cipher control circuit in the card is enframed and marked Figure 3 or4; inside this frame only a few basic circuit groups are indicated (such as key register 233, data buffer register 236, and random number generator 235).The key here referred to as "secret check number 1", is paired by another block marked "secret check number No. 2".The same is identical with the socalled "secret update enable code" of Figure 10.

The serial comparison of the No. 1 and No.2 secret check numbers occurs via OR gate 237 and Exclusive OR gate 238 and is evaluated by evaluator circuit 239. Unsatisfactory comparisons step up the "fraud counter" 240 which after a preset number of defective tests disables the card and optionally produces a display on the window 248 of the card.

The organisation of the memorized data may of course differ from the form shown in Figure 7. Block 243 may be an electrically alterable ROM circuit or form part of a micro-processor.

The diagram also illustrates the presence of manually operable keys 244 on the card. These act on an internal card register 245, a humanly readable display 248, and via an encoder circuit 249 on a memory selection circuit 242. A prime purpose of the keys is to ensure that only the legitimate holder of the 'card' can use it. This is done by a comparison step carried out by means of a Pin register246and a comparator circuit 247 whose output is one of the enabling inputs into AND gate 241.

Finally, some explanation shall be given about the potential significance of an electronic money purse which may hold a variety of data, for example in section 23c of the card chip shown in Figure 2. This section contains data memory arrays which are accessed conditionally or unconditionally dependent on their nature. One particular aspect can have outstanding significance for the future application of electronic retail consumer purchases. It may become a tool for the fight against inflation and for existing long-term policies for the conservation of energy and, in times of emergency, the temporary rationing of goods in short supply. This significance is given by the possibility of recording in the card the quantity purchased of a definite item over a span of time. As an example may be cited medical or other drugs.If certain drugs could be purchased only with electronic money it would be possible for a drugstore to refuse a customer when it is known that a drug harmful taken in quantities has already been purchased in other stores in excess of a permitted level.

The "electronic money purse" itself would furnish the intelligence to the drugstore cash registerterminal which then would automatically refuse payment from the "purse" unless an override signal (say by the chief drug chemist of the store turning a special key) is released in the terminal. As an alternative to refusal the price chargable may increase with the quantity obtained over a defined past period. Such price inreases, for goods in short supply for example, may be legally prescribed and pre-programmed into the arithmetics of the cash register or card terminal in such a mannerthatthe shop, vending machine owner, or chemist have no influence on the pricing. The calculation would be automatic.

One of the fields of consumption where worldwide agreed policies of Conservation may affect the pricing of goods, is petrol. It is very important for the economy that the basic needs of energy are available at a lowest possible cost since this reflects in prices and since prices determine wage levels, low energy costs appear to be vital for maintaining a non-inflationary economy. On the other hand, the dictates of a world household which has the needs of future generations in mind oblige everyone, including the administrators of economic measures, to accept higher prices for avoidable energy use. The difficulty is to know when somone at a pump buys below or bove his needs. A very closely defined estimation of a person's economic needs for a certain resource is of course impossible but even a course threshold allocation would be useful.If it were possible to arrange that petrol or fuel oil could be bought only with "electronic money", the administrative difficulty could easily be overcome and the cash registers at gasoline stations would automatically calculate agreed increments for preset levels of consumption increases over and above the basic need-norm. Dependent on the world political and economic situation,these increment steps may be only nominal at one time, or may be set at fairly substantial pricing steps at another time. Such practices may be applied to any household item or industrial ingredient at one time or another.The "electronic money purse" would also make it possible to differentiate between goods made in the country and imported goods, in such a manner that a person remains free to buy any item from any country of origin but the only restriction should relate to the ratio of purchases of foreign products to home-made products as evidenced over a period of say the last two months. This ratio would be automatically calculated within the "money purse" based on flags attached to individual purchases.

Governments may prescribe a limit to these ratios dependent on the economic performance of the country and no person would be able to overstep that limit since the cash registers would refuse acceptance of payment for an imported item if the record in the money purse shows a ratio in excess of the official limit. Such customer would then have to look round for a home-made equivalent. - It is clear that it would be a sheer insurmountable problem to keep track of a person's expenditures in order to assess the above named ratio.With the aid of the here indicated electronic cash transfer system a fiarly accurate assessment would be at any moment available and displayed to the user (if he so wishes) on the terminal Display Window upon pushing a button. - The intent for providing the described facility would not at all be to suppress free choice but primarily to raise the awareness of the implications resulting from such free choice. - What the combined efforts of political and economic information systems are today unable to provide, can now become a reality through the provision of a new payment means wherein an individual person's "purse" becomes the carrier of memory available to that person for self-evaluation of the purchaser's actions in the light of broader community-economic issues.A facility of this kind will therefore help to render superfluous crude measures through Government interference or coercion in order to seek to align personal trends with objective needs, and would therefore open a way for improved self-direction of human beings.

An example of the physical realisation of the simpler form of the stored money token (that is in accordance with Figures 4,7 and 8) is shown in Figure 12 wherein the sketch on the right is a cross section x - x of the Figure on the left which is a iongitudinal section of the token. The shell 780 of the component consists of two halves 180A and 180B During assembly, the bottom half (180A) is first used when the functional parts are laid into it and inter connected. After all solder connections are done, the top half B is placed over it and bonded at the flanges to fuse into a single piece.The internal parts are: a bobbin 182 made of ferrite ceramic with coil 191 whose ends are connected to the solder tags of the carrier 182 of the processor chip 190; a spacer disc which may also be a small capacitor (183); another bobbin of ferric ceramic 184 with coil of fine wire 192 whose wires are soldered to tags of component 185.

The part 180 A has longitudinal recesses as the cross section shows, to protect the enammelled connecting wires. Finally, a battery 187 is pressed against the column of internal parts by means of a spring washer 186 and the end cap 181 screwed to the tubular part to seal it off. A hole 181 a would enable the stored-money token to be kept on a key ring. To prevent playful users from unscrewing this end cap, one may bond or weld it to the main part along a seam 181b.The battery 187 which is required for maintaining the memory in the chip 190 may have to exchanged every second year or so. If this were to be done by the owner himself it would be necessary to provide two batteries in paralell in such a mounting configuration that only one of the batteries can be removed at the same time leaving the other in position until the first one is exchanged.By moving a cover flap, the second battery is exposed, removed and exchanged. If only one battery is used, the entire component might be exchanged by the supply organisation against another one, battery renewal being done in the workshops where also performance testing may be done before re-issue.

Anotherform of use would be to make the chip carrier 185 a throw-away component after the value is exhausted. In that case soldered connections cannot be used but the required six galvanic connections must be obtained by merely pushing the replacement chip carrier along grooves into the bottom of the tube to bear against bobbin 184. Some would see an advantage of this arrangement since no up-dating apparatus would be needed; the value component 185 would simply be sold at tobacco shops, stationaries, railway stations etc., etc., and the customers would carry out their own insertions into the permanent component 180.

Finally, a method is to be described for reducing the initial acquisition cost of the stored money token.

Such a reduction would be wellcome to large numbers of potential users who may hesitate to pay $10 or $ 15 for a money token especially during the initial phase of introduction when the possibility of using it may not yet be wide-spread.

This improvement can be implemented in the token circuitry of Figure 7 and requires only a small addition to convert the device into a "pay as you pay" arrangement.

Figure 11 shows a portion of the circuit of Figure 7 in which the reader will recognize the gate 134,146, 150 and 149 as well as the program counter 147, the value register 155 and auxiliary value register 155a.

The additional elements consist of another counter 170 which has a decode section for decoding the, in instalments payable, part of the token acquisition price by means of NAND gate 171. During each debit cycle the counter 147 is stepped twice by means of a CK3-phased pulse. As long as the counter 170 has not reached the necessary value information, output from gate 171 is high. When it is reached, it goes low, disabling gate 172. That means that the value counter 155 will no longer receive the extra two count pulses during each debit cycle:- payment of the token acquisition price is completed.

Figure 13 demonstrates the possibility of producing a data token or "purse" in the form and size of a conventional credit card. 301 is a double sheet of plastic material which has two ring-like areas 302 and 304 into which coiled conductors are imprinted.

These are the inductive pick-up coils for the data and clock pulses. 303 and 305 respectively are rings in the plastic material produced by finely dispersed ferric material; also the centers 306 and 307 respectively are constituted similarly. When the card is introduced into the slot of a terminal these center and ring areas coincide with ferrite pot and center cores with laid-in coils on each side of the card giving good reactive coupling and small stray fields.

The conductors 308 to 311 lead to contactors in the interior of the card which match and engage with contactors on an insertion plate 315. This plate can be inserted from the right edge of the card into a recess in the card body. The plate 315 contains the chip processor316and a display drive and decoder chip 317. An upper and lower plastic protective flap 318 and 318 a respectively which in this example is welded to the plate 315, are drawn over the card and pinned together by plastic rivets or the like 319, 320, 321. Alternatively, a zip-like interlock between flaps and card may be provided. The printed circuit conductors 314 lead to a liquid crystal display window 322.

Figure 14 shows the plate 315 once more, extracted from the card. The marked out area 323 is occupied by battery integral with the plate material.

The same maintains the memory data and may be rechargable. It also provides the voltage for the display window.

Figure 15 is a top elevation A - A of Figure 14 showing the flaps 318 and 318a unfolded, the interupted lines indicating that the flaps may be warped backwards as well.

Figure 16 is a side elevation of Figure 15 including the additional feature of using a continuous plastic interlock edge 324 by means of which the upper and lower flap halves (318 and 318a) may after folding be quasi sealed so as to protect the contactors 1-6 (Figure 17) of the processor plate 315. This configuration can be used independently from card 301 if the terminals have sockets with contactors corresponding to those of 1 - 6 in plate 315. Normally, the liquid crystal display 322 in Figures 16 and 17 would not be functional, to save battery power. However, a switch element is provided in the form of a piezo-electric pressure spot 326which, on being squeezed between thumb and index finger, generates a volage pulse causing a transistor element in chip 316 to pass current for a predetermined span of time permitting inspection of the remaining credit or other information in the data card after which the display would again disappear.

Contactors 1 and 2 on plate 315 connect the circuits to external power when in use, and may also be employed for recharging the battery by means of a simple adaptor.The battery circuit may include a voltage sensor element for detecting the condition when the battery requires recharging, and this may be indicated on the display by a combination of elements of the display patterns.

Claims (16)

1. An electronic money purse system using encrypted fund transfer signals comprising at least one central computer station, a variety of terminals at different locations and a multiplicity of electronically operated value storage carriers (purses) the circuit logic of which includes means for encrypting the data communicated to a terminal, the encrypting means including at least one cipher key register, a random data generator, and additional means for varying the spacing of data bits in a serial mixture of random data and transaction data wherein the data bit spacing is determined in dependence of the logic levels of selected bit positions of the cipher key register as well as of the sequentially appearing data to be transmitted from or being received in the said storage carrier.

2. An electronic money purse system using encrypted fund transfer signals as in Claim 1 wherein the said data bit spacing means are a programmable counter whose paralell preset inputs are connected either to one particular selected set of paralell output positions of the said key register, or, to another particular selected set of paralell output positions of that register, and wherein is provided a flip flop bistable whose instant output condition is dependent on the instant parity level of the key or part of the key in the key register in combination with at least one data bit, whereby the selection of one set of key paralell bit outputs or the other is made dependent on the status of said flip flop circuit.

3. An electronic money purse system using encrypted fund transfer signals as in claim 2 wherein there is provided also a data buffer register and the said data bit is a parity bit for the at any time in the data register present data, and that such data bit or parity bit is suppiied to the encryption logic with a predetermined delay in terms of transferred data bit pulses counted from the first transferred data bit pulse.

4. An electronic money purse system using encrypted fund transfer signals as in claim 1 wherein the, by the encryption circuit controlled, data conversion circuits are connected to means for reactively coupling the value storage carrier to a terminal for transfering and receiving encrypted data.

5. An electronic money purse system using encrypted fund transfer signals as in claim 1 wherein the personal value storage carriers are used as holders of payment value units from which such units can be deducted in debiting operations, and are receptive to a signal from the terminal or the central computer whereby the said storage carrier becomes receptive for value-crediting operations the improvement consisting of the provision of an additional access code register which on being addressed must produce an Enable voltage to the value register circuit before the same can be incremented.

6. An electronic money purse system using encrypted fund transfer signals as in claim 5 in which the separate said access code register is associated with an address register, and means in the terminal to receive the address of said address register in order to selected from a set of available value-add access codes that one which is also contained in the access code register of the personal value storage carrier.

7. An electronic money purse system using encrypted fund transfer signals as in claim 6 wherein the said value-add access code for enabling crediting operations in the value register is also used as a cipher key for encrypting the exchange of transaction data associated with the said crediting operation whereas any subsequent debit operation again utilises the cipher key mention in claim 1.

8. An electronic money purse system as in claim 1 wherein the said cipher key used for debiting operations is also associated with an address register holding the address for said key in the terminal memory circuit, and wherein means are provided in the terminal unit for receiving said address code and for enabling the addressed key memory locations for the consecutive cipher/decipher operations of the transaction data.

9. An electronic money purse system as in claim 1 and dependent claims, wherein the state of operational effectiveness of a data transfer coupling between a personal value storage carrier and a terminal is initially tested by using a random number generator provided in the circuit of the Terminal unit for sending and circulating a random number through the terminal encryption path to the personal data carrier and its decryption circuit to the data buffer register of the said carrier, and from there back through the encryption circuit to the terminal decryption circuit for comparison in a comparator circuit, and means for producing a transaction enablement signal after an uninterruptedly correct repetition of the said signal transfer by a preset number of times.

10. An electronic money purse system as in claims 1,5 & 6 wherein the crediting transaction circuit is organised so as to produce a readout from the memory locations of the personal value storage carrier (a) of the serial number of the data carrier (b) of the total number of update transactions (c) particulars of the most recent update and means in the peripheral or central terminal for holding a record of these data or similar data and further means for receiving the corresponding data transferred from the said storage carrier, and means in the terminal for generating a default signal for sending it to the local terminal and for causing there such action as may be locally determined to prevent the continued use of the value storage carrier by the owner concerned.

11. An electronic money purse system as in claim 10 wherein the features of this claim are implemented prior to the commencement of a debiting operation by the provision of a relay actuable by a signal from a central computer station which detaches the interface connection between card and terminal from the terminal input/output conductors and substitutes its own transmission line for them to take over the debiting functions which normally would have been carried out by the debiting terminal, with the additional inclusion of the in claim 10 listed validity test cycles based on which the central terminal will either accept the card or emit a "card capture" signal to the debiting terminal, and means in the debiting terminal to receive said instruction and to carry it out.

12. An electronic money purse system as in claim 1 wherein the personal data carrier is equipped with push buttons for entering data into a memory location of the data carrier circuit.

13. An electronic money purse system as in claim 1 wherein the personal value storage carrier is equipped with a display window for showing up data entered via said push buttons, or the status of any other preselected register in the data carrier.

14. An electronic money purse system as in claim 1 or any of the dependent claims wherein the electrical memory and processing circuitry is combined with the cipher/decipher circuits on a single semiconductor substrate.

15. An electronic money purse system as in any of the preceding claims wherein the memory section of the personal data carrier comprises locations for holding totals of quantities of goods for which an item code has been entered, and an updating circuit which after each transaction produces a new total relative to a predetermined period counted backwards from the date of use, and means for reading out said totals and for displaying them in the terminal unit.

16. An electronic money purse system as in claim 15 in which the personal data carriercompris- es memory locations into which can be loaded via a terminal data relating to thresholds for various consumption or purchase totals over the said predetermined past period, furthermore associated with each threshold a percentual price increase factor which is read out from the appropriate memory location corresponding to the comparison of the actual purchase total with the exceeded threshold concerned, and means in the terminal to calculate the modified price and to charge it to the money purse, together with means to display the said purchase totals and the associated increment rate.

(9a)= claim 9 developed as an independent claim.

An electronic money purse system comprising a multiplicity of pocketsize personal electronic value storage carriers and at least one terminal for reading out data from any of said storage carriers and for exchanging data between them the terminal as well as the said storage carriers containing electronic registers and data procers which when placed into operative relationship work in synchronism with each other, as well as cipher/decipher circuit groups for the encryption of data, the improvement consisting of the provision of a random data generator in the circuit of the terminal unit for sending test data of a definite bit length a number of times, prior to the transfer of any transaction data, through the encryption path of the terminal, over the interface means to the decipher circuit of a said storage carrier to recover the said test signal in clear form fortransferring it back to the terminal through the corresponding cipher and decipher circuits for comparison with the register holding the initial test signal, and means for producing a transaction circuit enable signal after an uninterrupted correct repetition of the said signal transfer by a preset number of times.

(1-A) An electronic money purse system using encrypted fund transfer signals comprising at least one central computer station, a variety of terminals at different locations and a multiplicity of electronically operated value storage carriers (purses) the circuit logic of which includes means for encrypting the data communicated to a terminal, the encrypting means including at least one cipher key register, a random data generator, and additional means for varying the spacing of data bits in a serial mixture of random data and transaction data wherein the data bit spacing is determined in dependence of the logic levels of preselected bit positions of the cipher key reg ister.

(1-B) An electronic money purse system using encrypted fund transfer signals comprising at least one central computer station, a variety of terminals at different locations and a multiplicity of electronically operated value storage carriers (purses) the circuit logic of which includes means for encrypting the data communicated to a terminal, the encrypting means including at least one cipher key register, a random data generator, and additional means for varying the spacing of data bits in a serial mixture of random data and transaction data wherein the data bit spacing is determined in dependence of the logic levels of the sequentially appearing data bits (save the first one) to be transmitted from or being received in, the said storage carrier.

(l-C) An electronic money purse system using encrypted fund transfer signals comprising at least one central computer station, a variety of terminals at different locations and a multiplicity of electronically operated value storage carriers (purses), the circuit logic of which includes means for encrypting the data communicated to a terminal, the encrypting means including at last one cipher key register, a random data generator, and additional means for varying the spacing of data bits in a serial mixture of random data and transaction data wherein the data bit spacing is determined in dependence of the logic levels of a paritybitappertaining to the data in the said key register at any given time.

(1-D) An electronic money purse system using encrypted fund transfer signals comprising at least one central computer station, a variety of terminals at different locations and a multiplicity of electronically operated value storage carriers (purses), the circuit logic of which includes means for encrypting the data communicated to a terminal, the encrypting means including at last one cipher key register, a random data generator, and additional means for varying the spacing of data bits in a serial mixture of random data and transaction data wherein the data bit spacing is determined in dependence of the logic levels ofa parity bit appertaining to the data in the said key register at any given time, in logic combination with the sequentially appearing data bits (save the first one) to be transmitted from or being received in, the said storage register.