Value transfer system

• US 5,623,547 A
• Filed: 03/06/1995
• Issued: 04/22/1997
• Est. Priority Date: 04/12/1990
• Status: Expired due to Term

• Current Assignee: Mondex International Ltd. (MasterCard Incorporated)
• Original Assignee: Jonhig Limited
• Inventors: Jones, Timothy L., Higgins, Graham R. L.
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/400,003
• Time in Patent Office: 778 Days
• Field of Search: 380/4, 380/9, 380/23, 380/24, 380/25, 380/28, 380/29, 380/30, 380/49, 380/50, 380/52, 235/379, 235/380, 235/381
• US Class Current: 705/68
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/06 Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3676 Balancing accounts
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A value transfer system which allows value to be transferred between electronic purses comprises computer which controls the loading of purses with value and the redemption of value from purses, a special bulk purse or purses and a value meter securely linked thereto which registers the total net value issued to the bulk purse or purses. Draw-down of value and redemption of value transactions are effected with the bulk purses.

Claims

1. A value transfer system, said system comprising:

a computer system;

a plurality of electronic purses;

exchange devices comprising means for communication between purses to transfer value in transactions which are off-line from the computer system;

draw-down means for loading purses with value under control of the computer system;

redemption means for redeeming value from purses under control of the computer system;

a value meter system; and

one or more of said purses comprising bulk purses having value loaded and redeemed via the value meter system, the value meter system recording at least one float value record containing information of the net value released to the bulk purse or purses, the net value being the difference between the total of values drawn down to the bulk purse or purses and the total of values redeemed from the bulk purse or purses, the float value record being non-specific with regard to individual transactions.

2. A value transfer system as claimed in claim 1 wherein the value meter system has an interface means for adjusting each float value record on command to create or destroy value within the bulk purse or purses.

3. A value transfer system as claimed in claim 1 comprising, in each purse, storage means for storing an accumulative purse value record and, for each purse, a microprocessor, transactions being conducted between purse pairs comprising a sending purse and a receiving purse, the sending purse sends value and the receiving purse receives value, said microprocessor comprising a means for controlling each transaction for the sending and receiving purses and, in each transaction the purse value record in the sending purse is decreased by a chosen and variable transaction value and the purse value record in the receiving purse in increased by the same transaction value.

4. A value transfer system as claimed in claim 3 wherein the microprocessor, in a transaction between members of a purse pair, comprises a means for providing a transaction identifier for the transaction specific to at least one of the purses and unique within that purse.

5. A value transfer system as claimed in claim 4 wherein said transaction identifier is specific to the receiving purse and is unique within the receiving purse by the inclusion of a receiving purse transaction sequence number.

6. A value transfer system as claimed in claim 4 wherein the microprocessor for each transaction, comprises means for sending a request message including the transaction identifier from the receiving purse to the sending purse, incorporating the transaction identifier in a transaction value message sent from the sending purse to the receiving purse and controlling acceptance of the transaction value message in the receiving purse on the basis of the validity of the transaction identifier received.

7. A value transfer system as claimed in claim 1 wherein the microprocessor includes means for implementing an asymmetrical cryptographic system having different public and secret keys and each purse includes means for storing at least a public key of the cryptographic system.

8. A value transfer system as claimed in claim 7 wherein each purse stores in said means for storing data signed in the cryptographic system by the master computer with a global secret encryption key, the signed data thereby being electronically certified, and each transaction includes the steps of checking certified purse data by means of the global public key.

9. A value transfer system as claimed in claim 7 wherein each purse stores in said means for storing its own unique public/secret key pair in the cryptographic system and the transmission of transaction data is encrypted and decrypted using said public/secret key pair.

10. A value transfer system as claimed in claim 9 in which in a transaction the microprocessor associated with a first purse has greater computing power than the microprocessor associated with the second purse, and the transaction includes the steps of sending to the first purse the secret key of the second purse key pair and encrypting data at the second purse using the public key of the second purse key pair.

11. A value transfer system as claimed in claim 7 wherein in a transaction the microprocessor associated with a first purse has greater computer power than the microprocessor associated with the second purse, the second purse includes an encryption key for a symmetrical cryptographic system and the transaction includes the steps of sending to the first purse the symmetrical system key of the second purse and encrypting data at the second purse using the symmetrical system key.

12. A value transfer system as claimed in claim 1 wherein the computer system comprises a plurality of computers and the value meter system comprises a plurality of value meters, each value meter associated with a respective one of said computers.

13. A value transfer system, said system comprising:

a computer system;

a plurality of electronic purses;

exchange devices comprising means for communication between said purses and for transferring value between said purses in transactions which are off-line from the computer system;

draw-down means for loading said purses with a value under control of the computer system;

redemption means for redeeming a value from said purses under control of the computer system;

a value meter system; and

at least one of said purses comprising a bulk purse, said value meter system including means for loading and redeeming value in said bulk purse, the value meter system including means for recording at least one float value record containing information of a net value released to said at least one purse, said net value comprising the difference between a total of values drawn down to said at least one purse and a total of values redeemed from said at least one purse, said at least one float value record comprising non-specific value information with regard to individual transactions.

14. A value transfer system as claimed in claim 13 wherein the value meter system includes an interlace means for adjusting each float value record on command for creating or destroying value within said at least one purse.

15. A value transfer system as claimed in claim 13, wherein each purse includes a storage means for storing an accumulative purse value record, wherein transactions between purse pairs involve a sending purse and a receiving purse, said sending purse sends a value and said receiving purse receives a value, said value transfer system further including a microprocessor in one of a sending purse, a receiving purse and an associated exchange device, said microprocessor comprising a means for controlling each transaction for said sending purse and said receiving purse wherein, in each transaction, a purse value record in the sending purse is decreased by a chosen and variable transaction value and a purse value record in the receiving purse in increased by the same transaction value.

16. A value transfer system as claimed in claim 15 wherein said microprocessor, in a transaction between members of a purse pair, comprises a means for providing a transaction identifier for a transaction specific to at least one of the sending and receiving purses and unique within that purse.

17. A value transfer system as claimed in claim 16 wherein said transaction identifier is specific to the receiving purse and includes a receiving purse transaction sequence number.

18. A value transfer system as claimed in claim 16 wherein said microprocessor, for each transaction, comprises means for (a) sending a request message, including said transaction identifier, from the receiving purse to the sending purse, (b) incorporating the transaction identifier in a transaction value message sent from the sending purse to the receiving purse and (c) controlling acceptance of the transaction value message in the receiving purse on the basis of the validity of the transaction identifier received.

19. A value transfer system as claimed in claim 13 wherein said microprocessor includes means for implementing an asymmetrical cryptographic system having different public and secret keys and each purse includes means for storing at least a public key of the cryptographic system.

20. A value transfer system as claimed in claim 19, wherein each storage means includes means for storing data signed in the cryptographic system, said computer system comprising means for providing a global secret encryption key, for electronically certifying said signed data in said storage means, and for checking each transaction including said certified signed data by means of a global public key.

21. A value transfer system as claimed in claim 19 wherein each of said purse storage means includes a stored unique public/secret key pair in the cryptographic system and said microprocessor includes means, responsive to said public/secret key pair, for encrypting and decrypting the transmission of transaction data.

22. A value transfer system as claimed in claim 21, wherein each purse includes a microprocessor associated therewith and a microprocessor associated with a first purse has greater computing power than a microprocessor associated with a second purse, and the transaction includes the steps of sending to the first purse the secret key of the second purse key pair and encrypting data at the second purse using the public key of the second purse key pair.

23. A value transfer system as claimed in claim 19 wherein each purse includes a microprocessor associated therewith and, in a transaction, a microprocessor associated with a first purse has greater computer power than a microprocessor associated with a second purse, the second purse includes an encryption key for a symmetrical cryptographic system and the transaction includes the steps of sending to the first purse the symmetrical system key of the second purse and encrypting data at the second purse using the symmetrical system key.

24. A value transfer system as claimed in claim 13 wherein the computer system comprises a plurality of computers and the value meter system comprises a plurality of value meters, each value meter associated with a respective one of said computers.

25. A method of transferring a value (V) between a sending purse and a receiving purse, using a cryptographic system with said purses having cryptographic capability, said sending purse and said receiving purse each having a global secret/public key pair (Skg, Pkg), each of said sending and receiving purses including, respectively, a store (SS, RS), a value record in said store (Svr, Rvr), a public key (Pks, Pkr), a secret key (Sks, Skr), and a certified public key data message ([Pks]*Skg, [Pkr]*Skg), said method comprising the steps of:

in said receiving purse, issuing a transaction identification number (R_i) and, transmitting a request message ([Pkr]*Skg+[R]*Skr) to said sending purse;

in said sending purse, checking said request message to authenticate and determine the receiving purse public key (Pkr) and the transaction identification number (R_i);

in the sending purse, decrementing the value to be transferred (V) from the sending purse value record (Svr);

in the sending purse, constructing a transaction message (VR_i), signing the transaction message with the sending purse secret key (Sks), forming a transaction value message ([Pks]*Skg+[VR_i ]*Sks) and sending said transaction value message to said receiving purse;

in the receiving purse, obtaining the sending purse public key (Pks) using the public key (Pkg) and verifying the message ([Pks]*Skg);

in the receiving purse, using the recovered sending purse public key (Pks), recovering the transaction message (VR_r) and determining the recovered value to be transferred (V) and the recovered transaction identification number (R_r);

in the receiving purse, checking to insure that the recovered transaction identification number (R_r) matches the issued transaction identification number (R_i), aborting the transaction without a match and, with a match, incrementing the receiving purse value record (Rvr) by the value to be transferred (V); and

in the receiving purse, providing an acknowledgement to said sending purse.

26. A method of transferring a value (V) between a consumer purse and a retailer purse, using a cryptographic system with said consumer and retailer purses each having a global secret/public key pair (Skg, Pkg), said consumer purse having a store (CS), a cumulative value record (Cvr) in said consumer store, a DES key (DESc) and certified data message ([DESc]*Skg) and said retailer purse having a store (RS), a retailer value record (Rvr) in said retailer store, a public key (Pkr), a secret key (Skr), and a certified public key data message ([Pkr]*Skg), said method comprising the steps of:

in said retailer purse, transmitting said certified public key data message ([Pkr]*Skg) to said consumer purse;

in said consumer purse, checking said certified public key data message ([Pkr]*Skg) to authenticate and determine the retailer purse public key (Pkr);

in said consumer purse, encrypting the certified data message ([DESc]*Skg) and forwarding the encrypted message (E_Pkr [[DESc]*Skg]) to said retailer purse;

in said retailer purse, decrypting said encrypted message to derive the certified data message ([DESc]*Skg) and then derive, using the public key (Pkr), the DES key (DESc);

in said retailer purse, issuing a transaction identification number (R_i), encrypting the transaction identification number (R_i) with the DES key (DESc) and transmitting a resultant request message ([R_i ]*DESc);

in said consumer purse, decrypting said request message ([R_i ]*DESc), deriving the transaction identification number (R_i), and constructing a transaction message (VR_i);

in said consumer purse, decrementing the value (V) from the value record (Cvr) in the consumer store (CS) and sending the modified transaction message ([VR_i ]*DESc); and

in the retailer purse, decrypting the modified transaction message ([VR_i ]*DESc), recovering the transaction identification number (R_r) and checking to insure that the recovered transaction identification number (R_r) matches the issued transaction identification number (R_i) and, aborting the transaction without a match and, with a match, incrementing the retailer value record (Rvr) by the value (V) and sending a transaction acknowledgement to said consumer purse.

27. A method of transferring a value (V) between a sending purse and a receiving purse each having a global secret/public key pair (Skg, Pkg), said sending purse having a reduced computing power as compared to said receiving purse, said sending purse including a store (SS), a value record (Svr), a secret key (Sks) and a signed secret key ([Sks]*Skg) which includes a sending purse public key (Pks), and said receiving purse including a receiver store (RS), a value record (Rvr) in said receiver store, a receiver public key (Pkr), a receiver secret key (Skr), and a certified public key data message ([Pkr]*Skg), said method comprising the steps of:

in said receiving purse, transmitting the certified public key data message ([Pkr]*Skg);

in said sending purse, verifying the certified public key data message ([Pkr]*Skg) with the global public key (Pkg) and recovering the receiver public key (Pkr);

in said sending purse, encrypting the signed secret key ([Sks]*Skg) and transmitting the encrypted signed secret key (E_Pkr [[Sks]*Skg]);

in said receiving purse, decrypting the encrypted signed secret key (E_Pkr [[Sks]*Skg]) with the receiver secret key (Skr) to provide the sending purse signed secret key ([Sks]*Skg), verifying the sending purse signed secret key ([Sks]*Skg) with the public global key (Pkg) and recovering the sending purse secret key (Sks);

in said receiving purse, issuing a transaction identification number (R_i), signing the transaction identification number (R_i) with the sending purse secret key (Sks) to form and transmit the signed transaction identification number ([R_i ]*Sks);

in said sending purse, deriving the transaction identification number (R_i) using the sending purse public key (Pks);

in said sending purse, decrementing the sending purse value record (Svr) by the value (V), creating a transaction message (VR_i), encrypting the transaction message (VR_i) and transmitting the encrypted transaction message (E_Pks [VR_i ]);

in said receiving purse, decrypting said encrypted transaction message (E_Pks [VR_i ]) using the sending purse secret key (Sks) and recovering the value (V) and the transaction identification number (R_r); and

in said receiving purse, checking to insure that the recovered transaction identification number (R_r) matches the issued transaction identification number (R_i) and aborting the transaction without a match and, with a match, incrementing the receiving purse value record (Rvr) by the value (V), discarding the sending purse secret key (Sks) and sending a transaction acknowledgement to said sending purse.