GB2324184A - Card charging systems - Google Patents

Abstract

In a card charging system, especially for public transport services, a host ticket facility is operable by both credit cards usable at a card read/write device and concessionary payment cards usable at a contactless card reader, and a security and transaction device located between the card readers and the host facility stores in separate storage devices full fares and concessionary fares which the host facility is able to calculate.

Description

Title I roved Card Charging Svstems Field of the Invention This invention concerns card charging systems of the type in which a pre-programmed card is read and validated by a suitable card reader and data stored on the card is decremented according to the cost of a purchase and made available to the user after the transaction. The system includes a security device installed in such a system to ensure correct control between the card read/write unit and a transaction recording payment collection system so as to form an integral part of the revenue allocation process.

Background to the Invention It is known to provide coin, token or card operated mechanisms for the collection of payment for goods or services such as bus fare collection systems, pay and display parking devices, prepared food delivery systems and the like. Such devices may be capable of debiting prepaid or credit cards such as the systems currently in use for the provision of telecommunication services and the concept of a prepayment credit card for obtaining bus journeys and tickets for train journeys has already been tried.

According to the invention of our pending U.K. Patent Application No. 2287565, there is provided a security and transaction device for use in connection with a card read/write device comprising: signal transmission means for delivering signals to a host facility to enable a purchase to be made in return for an amount of credit debited from a card after the latter has been read by a card reader, which signals comprise a unique identification number together with signals defining a public key-based security system; a record keeping subsystem adapted to certify a credit debited from the card and identify which one of a plurality of accounts is to receive the debited credit; and signal processing and output means for generating signals indicative of a successful transaction and of an appropriate form and value so that in use the generated signal indicates to the host facility the nature of the transaction completed and the purchase which is now to be made available.

The host facility may be a service providing facility where the purchase involves provision of a service such as transportation, seating in an auditorium or the like.

Alternatively the host facility may be a product providing facility where the purchase involves supply of a product such as foodstuffs, clothing, medication and the like.

Optionally the device includes a smart card reader and further signal processing means, whereby a smart card open payment system may be employed in lieu of a prepayment credit card system, for payment for a service or commodity.

An aim of the present invention is to provide a card charging system including a security and transaction device, more especially but not exclusively as described in the aforesaid patent application.

The Invention First, it is recognised that whilst a stored value card is eminently suitable as a payment device, there exists a demand to offer a service that ensures the correct allocation of revenue in a subsidised payment scheme, such as a subsidised travel scheme. To this end, many urban transit developments plan to use a contact less "smart card" (CICC) for season tickets/concessionary fares.

With this background in mind and the requirement to place the security module directly between the Card Acceptor Device (CAD) and the Host it is proposed in accordance with one aspect of the present invention that a contactless concessionary card reading subsystem be remotely connected to the security module, additional to the standard non-concessionary card reader. At the same time, the option exists of having further contactless card readers attached to the security module interface, in the event that two stream bus boarding is required, where one stream is meant for speedy boarding by free concession holders only.

The contact less card functionality is additional to the payment card system, and acceptance of a payment card or cash is desirably not noticeably affected by simultaneous operation of the contactless integrated circuit card.

The clearing and settlement system described in the aforesaid Patent Application is designed primarily to process value collected by the security modules (TSMs) fitted to each point of sale Transmo pre-paid cards. Its prime function, therefore, is to collect and process value expressed as total value and number of transactions per card issuer from each TSM.

However, it is now proposed that the system be considerably expanded in the following areas: Result file processing Improved TSM assignment handling Flexible report and Query handling Automated settlement file production Concessionary revenue apportionment Card recharging option System service reliability monitoring Card serial number tracking and Hot card determination/handling Figure 1 of the accompanying drawings shows a host facility integrally incorporating a security module (TSM) and credit and payment read/write device (CAD) and also having a contactless card reader (CCD) for use by concession holders interfaced therewith.

Thus, the TSM is now able to handle input from multiple card acceptors at the same time. This parallel operation allows contactless cards mainly used for concessions and other types of payment card to be read at the same time.

For example, as shown in Figure 2, driver A issues a ticket to stored value cardholder B via a card acceptor mounted on a ticket machine, whilst concessionary cardholder C flashes a contactless card at remote card acceptor, if no ticket is required.

Figure 4 of the accompanying drawings shows the clearing and settlement system as information files linked to a shared information data base by a series of functional processes. The areas (Figure 3 of the accompanying drawings) circled signify those functions primarily dealy with in the following description.

In the case of partial concessions, the Transmo Security Module (TSM) obtains the information to deal with revenue apportionment from the host ticket machine. The user informs the driver or operator of the machine of the intended destination. This information is then keyed into the host machine, which calculates the fare due on the basis of the concessionary scheme rules (as defined by the concession scheme operator). The information which the TSM then stores is the difference between the full fare and the fare paid (i.e. the amount of reimbursement due to the operator for the journey undertaken). The user does not have to use a credit card to make payment in addition to using the concessionary contactless card, but could use cash, tokens or E-purse as a means of payment (as would be expected to be the norm). The user is informed of the payment necessary by the operator of the ticket machine, this information being produced by the ticket machine as described above.

It is thus made possible to issue a "multi-class concession" where, for example, the first part of a journey is free and the remainder is part paid. The host machine is able to determine the boundary along a route where a split is made and apply the concessionary rules separately for each part of the journey as illustrated in Figure 3 of the accompanying drawings. For example: - Journey made from A to C Amount paid by user Fare (A to C) - Fare (A to B) x D% (Negative numbers are treated as zero value) Amounts stored in TSM Fare (A to B) - 0 stored in "free fare class" concession group total Fare (A to C) - Fare (A to B) x (100-D)% in Dt class concession group total If the card also carries stored value, then the amount paid by the user is stored in the card issuer total as normal.

The TSM stores the difference between the full fare paid and the actual fare paid in separate "gas meters" for each class of fare. In principle this concept can be extended to any number of splits per journey and any number of classes.

Subsequently the clearly system applies a generation factor to the total collected in each "gas meter" as determined by the issuer of the card. It is this final value that is then apportioned between card issuer and the service provider.

The cards issued for concessionary fares desirably use a scheme developed to allow maximum flexibility in operation. A rule set number is encoded on the card which is used to define the many options that are available for determining the applicability of a concessionary fare. As the conditions that apply to concessions may be altered or periodically added to, the system is able to accept new rule-sets or modifications to existing rule-sets at any time.

The principle adopted in the use of rule-sets is as follows.

The rule set number derived from the card indexes entries in a table of options that is periodically loaded into the host equipment.

For example the following table may be taken as a reference model. "Extra" items are to be decided later; zero entry implies that the item listed is ignored.

The mathematical operations = > < are valid The logical operators + (OR) and * (AND) are also valid The maximum number of logical operators per item is to be determined The maximum number of different rule-sets per host is to be determined The maximum number of classes is 8 (1 - 8) The definitions for classes relating to the same group must not conflict.

In addition to the use of totals held in the TSM for value transfer information, a number of "gas meters" totals are allocated to card scheme health monitoring. Normal transaction clearing systems do not carry any information that allows for the remote monitoring of the performance of the card accepting equipment, whereas the scheme now proposed incorporates basic service performance checks within its value transfer protocol.

For example, each time a card is not read correctly (i.e. data integrity checks have failed) a "card read error" gas meter total in incremented. By virtue of the same mechanism that determines the amount of value to be apportioned by the clearly system the difference between the previous and current value of this gas meter total shows the instances of errors during a period. The following are examples of such "Gas Meters".

For the purposes of monitoring the operation of a card scheme a number of gas meters (which are non volatile) are reserved for carrying performance data back to the control system.

The Issuer identifiers defined for this information and the rules that determine use are as follows: A. Read write performance Rules for use The value filed is incremented by 1 for each instance where a contact less card is unable to be read correctly and incremented by 100 if it is a contact card.

Incorrect reading of a card means that data was obtained from the card but the integrity check on that data failed. (i.e. it does not mean the card could not be authenticated, or failed to make connection or was rejected for other reasons).

The transaction field is incremented by 1 if a read after write check failure is encountered on a contactless card and by 100 for a contact card.

A read after write fail is recorded only if the data is known to be incorrect after any retry attempts have been made (i.e.

if a card loses contact after or whilst being written then no failure is assumed (anti tearing mechanisms are required that allow subsequent recovery)) Use of different increments (in this example 1 and 100) to signal in a single counter the occurrence of differing events, is considered as a convenient way to maximise non volatile storage utilisation and may be extended to multiple events in a single counter providing an appropriate series of increment numbers can be used.

Providing a suitable weighting is applied to the increments that indicate each differing event, (i.e. a smaller increment for events that are most likely to occur) and the difference between current and previous absolute values of the counter are computed regularly (as is the case for a normal clearing cycle), then no confusion will arise between the type of event being recorded.

Other aspects of the card scheme operation that may be recorded are as follows.

B. Power and transmission performance.

Rules for use The value field is incremented by 1 for each instance of transmission failure.

Transmission failure means that data communications between CAD's or Host and the TSM could not be recovered and have "timed out". (i.e. it does not mean the card or host protocols have suffered from, and subsequently recovered from instances of corruption).

The transaction field is incremented by 1 every time the power supply to the TSM is interrupted long enough for an internal TSM reset to Occur. Care is taken to resolve the difference between a TSM used with sleep mode enabled and one that is not.

C. Contact card Usage Rules for use The value field is incremented by 1 for each instance where a contact card is unable to be ejected from the CAD.

This is interpreted by the failure of the Card present signal to de-activate after the energising of the release solenoid or within 1 minute after the card is rejected if no release solenoid is fitted.

The transaction field is incremented by 1 if a contact card is removed from the CAD after it has been authenticated but before it has been ejected by the host.

Other gas meters acting in analogous manner may serve for other checking purposes.

The previously mentioned "Gas meter" protocol is such that signed totals of value, or other information, are sent to the clearing centre for interpretation. The channel by which the information is routed to the clearing centre is immaterial to correct operation of the system providing that revenue is apportioned correctly in a timely manner. The system plan has inbuilt immunity to: Data corruption; The digital signature ensures that intentional or accidental substitution or alteration of the data during its route to the clearing centre is detected.

Differential value; The entire clearing system is based on a system that apportions revenue based on the difference between previous and current values held in the TSM's at every point of purchase this intrinsically makes the system fault tolerant.

Lost data; If value from an individual or group of "gas meters" are lost then recovery takes place automatically the next time data is received.

Duplicate data; If the same data is presented twice to the clearing system then the net result is zero and no revenue apportionment takes place.

Old data; If earlier data is presented to the clearing system then the net result is negative and no revenue apportionment takes place.

This inherent fault tolerance coupled with the ability to detect data that has been tampered with means that the clearing system can function reliably even if an unreliable communications channel is chosen. As a consequence the INTERNET is envisaged as a cost effective global infrastructure that can be used.

It is inevitable that systems using cards that have potentially global acceptance will come under attack from fraudulently created/simulated cards. As part of the potential fraud detection mechanism, the system may be able, where relevant, to adopt transaction tracking. Each card can have a unique serial number which will be stored along with its remaining value in the TSM module. This information is transmitted to the clearing centre (TCC) via the same channel as currently used for the gas meter data (an additional record type is envisaged). The TSM module may be capable, for example, of holding in non-volatile memory details of the last 1,000 transactions carried out through that TSM. It is possible to select whether the latest 100, or 200, etc. in steps of 100 up to the full 1,000 transactions are sent via the host equipment to the clearing centre along with the totals. The tracking information can then be forwarded to the issuer or agent acting on behalf of the issuer to maintain a data base of card usage.

By this means either the operator (host facility) or the issuer will be able to keep a data base of the approximate value remaining on any pre-paid card used in the system. This data base will allow the operator or the issuer the ability to: Refund value on failed cards (assuming the user returns the card and its serial number is visibly printed on the card as is the case for many telephone cards).

Spot the use of cloned cards where either values are reported out of chronological order or appear in multiple geographic locations at the same time.

Transaction tracking also compensates for the loss of visual marking of the remaining balance on the card and previous transaction data recovery, both of which are only economically possible with the current magnetic cards.

As part of the security of the system the allocation of TSM's to service providers may be inextricably linked to the clearing system. Each TSM module is uniquely coded and assigned to a given service provider when installed, this assignment provides the link by which any revenue collected is correctly apportioned to the service providers.

Obviously if this link could be changed at will by the service providers or the operator, then system security would be compromised. In order to minimise the risk of incorrect or fraudulent re-assignment of TSM's, re-assignment can be arranged only to take place in conjunction with the physical presence of the TSM which has to be directly connected to the clearing computer.

Claims (9)

Claims

1. A card charging system comprising a security and transaction device located between a card read/write device for prepaid or credit cards and a host facility to which signals are delivered from the security and transaction device to enable a purchase to be made in return for an amount of credit debited from the card, wherein a contactless concessionary card reading subsystem is connected to the security and transaction device, in addition to the card read/write device for prepaid or credit cards.

2. A card charging system according to claim 1, wherein the card read/write device and the contact less concessionary card reading subsystem are simultaneously operable.

3. A card charging system according to claim 1 or claim 2, for use in a public transport system wherein journeys can be paid for at full and concessionary rates.

4. A card charging system according to claim 3, wherein a host ticket machine is provided at a point of travel purchase, and is capable of calculating fares payable in respect of journeys which are partly concessionary or concessionary at differing rates.

5. A card charging system according to claim 4, wherein the security and transaction device stores the difference between the normal full fare and the concessionary fare payable.

6. A card charging system according to claim 5, wherein, for payment of the fare difference, the purchaser can user a concessionary contactless card and, optionally, the card read/write device.

7. A card charging system according to claim 5 or claim 6, wherein the security and transaction device stores fully paid fares and part concessionary fares in separate storage devics.

8. A card charging system according to any of claims 5 to 7, wherein contactless concessionary cards are encoded to define rules applicable to concessions available with the card, and the host facility is programmable with a table of concessionary options indexed by the card when the card is read to enable calculation of any concessionary fare payable.

9. A card charging system substantially as hereinbefore described with reference to Figures 1 to + of the accompanying drawings.