Region Wide Travel Pass System
This invention relates to payment systems and particularly, although not exclusively, to transport payment systems
In transport payment systems, it is generally assumed that the fares charged by public transport agencies can be a weapon for disaffecting the general public from their preference for the private car. Upon closer inspection it turns out that in many cases a patron of public transport would like to interrupt his or her journey in order to explore a shop or a restaurant or a park on the way but is impeded from doing so because this would entail losing the right to use the ticket.
In most transit systems, it requires the modification of current rules against journey interruptions in order to make the superiority of the car less obvious. This applies also to inner city bus and tram lines .
When viewed from a first aspect the present invention provides a fare collection and general payment system comprising: a payment token comprising a memory; at least one public transport provider terminal comprising means for responding to a service-demand for transport, including means for receiving a payment from said payment token; at least one retail terminal comprising means for receiving a payment from said payment token for goods and/services; wherein said transport provider terminal and said retail terminal comprise means for encrypting communication with said payment token using an encryption key; said system further comprising:
a control centre including key generating means, associated with a wireless communication broadcasting system and being arranged to broadcast replacement encryption keys to said transport and retail terminals at predetermined intervals.
Thus is will be seen that in accordance with the present invention a payment system is provided which may be used both for transport and for general retail use. The security if communication between the respective terminals and a payment token is enhanced by means of the use of regularly replaced encryption keys. These keys could, for example, be transmitted via^a cellular telephone network. In a preferred embodiment thereof, a VHF (very high frequency) transmitter/receiver as employed in such a network is utilised.
Preferably, the transport provider terminal is arranged to record into the memory of the payment token journey data comprising a coded starting point and a coded point of arrival, in return for said payment. This is beneficial since if journey data is stored on the payment token, this effectively becomes an electronic ticket which may be repeatedly, but securely, read whilst being difficult to tamper with by virtue of the encrypted communication with the terminals. This facilitates a transport arrangement in which journeys may be broken.
Preferably said payment token comprises means for storing said encryption key and said transport and retail terminals are arranged to interrogate said payment token for the stored encryption key and to compare the key stored on the payment token with a key stored at the terminal. This provides a mechanism for validating payment tokens presented to the terminals. The payment token could, for example, simply store the last used encryption key. The terminals could then store a recent history of used keys to allow validation of payment tokens that had not been used since the last
replacement of encryption keys.
In a preferred embodiment for example, the encryption keys are replaced on a daily basis and the terminals has sufficient memory to store a month's worth of encryption keys. In such a system payment tokens not used for a period long than a month would have to be reactivated or replaced. It is envisaged that previously unused tokens could be provided with a serial number or the like allowing initial manual verification. Preferably the pay token comprises a visual display portion. Preferably the transport terminal is arranged to transmit to said pay token for display on said visual display porion, information on various permissible Alternative routes and transport means. This allows a customer to use alternative routes on his or her way to the designated trip destination before the expiry of the said time limitation, in order to provide the beneficial requisite liberty for taking advantage of shopping opportunities or business visits. The component elements of a preferred embodiment of the system are as follows:
A transmitter/Receiver of VHF (very high frequency) of electromagnetic waves of the type now used in mobile phone communications for the transmission of text passages (see Figure 1)
A multitude of low wattage S/R units for communicating with the above centres in association with smart card controlled vending or access control units (such as turnstiles in a station, see Figure 2) , or cash desks (Fig. 10) . Debit or Credit transfers can be handled within two seconds, whereas the present procedures take about thirty times longer to obtain authorisation.. a data encryption/decryption system which is governed by simultaneous distribution of encryption key numbers from a Centre ( embodied in a Mobile Phone Program Extension Sector, Fig. 1) to numerous public and private points
whereby new keys are issued on a daily, or twice weekly basis, or on some other basis, and wherein two different magnitudes (Kl and K2) constitute together a specific encryption key. (This is NOT the public key system. )
Certain preferred embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings in which: Fig. 1 is a schematic view of a control centre located at a mobile phone service provider;
Fig. 2 is' s schematic diagram showing operation of a transport or retailer terminal;
Fig. 3 is a schematic view of a payment token; Fig 4 is a view of a further embodiment of a payment token; and
Fig. 5 is a view of a retailer terminal. Turning to Fig. 1 there may be seen a mobile phone base station 1 comprising an antenna 2,3. An extension 4 to the basic equipment provides functionality in accordance with the present invention as will be described later. The extension 4 is in data communication with a number of financial institutions 5.
Fig. 2 is a schematic view of the equipment at a public transport station 7. This comprises a number of data readers 6 in data communication with a data processor and storage device in the form a computer 8 and a VHF radio transmitter/receiver 9 by means of a data connection 10 which could, for example, be a coaxial cable or an optical fibre. These elements together constitute a transport provider terminal.
A schematic diagram of a part of the IC hardware of the card chip of a smart card 27 for use in the system is shown in Fig. 3. This includes a display 33, cash resource reserve 34, debit resource reserve 35 and a credit resource reserve 36. Logic 37-40 is provided to regulate modifying the values in these memories 34-36 and for communicating them with an arithmetic logic unit
(ALU ) 41 .
Cash value 34 is an entry obtained against payment of cash to a machine or at a Bank Counter. The user of a plain card without any data entry means will be dependent on finding a terminal with a key board. To pay for a bus ride or a cup of tea, most people will use the CASH reserve of the card, memory 34. Buying a piece of clothing or some drafting gear, the debit account 35 is best. Finally, a credit purchase 36 would be made to buy a motorcycle. Which one is used is determined by the PIN entered.
It would be difficult to remember three six- digit PINs. However, starting with the cash sector with a four digit number, may be X, then the Debit account PIN may be X plus 15, and the Credit Account may be X plus 32. These numbers are less easily forgotten. Changes can be implemented whenever desired if the compared memories 38,38,39 are addressable via a master PIN.
In use a card 27 is brought into the vicinity of a reader terminal 6. A communication protocol based on time division duplex is established between the reader 6 and the card 27. In response to an appropriate interrogation signal from the reader 6, the card 27 transmits an identifying serial number together with the value of an encryption key stored in a memory associated with the ALU 41.
The reader 6, in conjunction with computer 8 receives the serial number and checks it against a blacklist of card numbers supplied by a bank (e.g. those which are lost, stolen, suspended etc.). Assuming that the card 27 is not blacklisted, the computer then compares the encryption key transmitted from the card against a list of stored previous encryption keys. If the key matches the current key, the computer 8 begins to perform the required transaction. However if the key matches a previously used key, the reader 6 is made to transmit the current key to the card 27. This
transmission of the key is itself encrypted using the previously stored key supplied by the pay token.
A typical transaction would comprise transmission by the terminal 6, 8 of codes corresponding to the start and end points of a desired journey and details of the amount of payment required. The card would them respond with conformation that the appropriate reserve 34, 35, 36 had been decremented and the remaining amount.
The transmissions from terminal 6 and card 27 are encrypted using the current encryption key. The encryption system utilised herein is as disclosed in EP- A-1018231 to which reference should be made for further details. New keys are sent from the cellular telephone network switch to the antenna 9 of the terminal on a daily basis. Similarly details of transactions are uploaded by the terminal to the control centre 4 for dissemination to the financial institutions 5.
In the event that there is insufficient value in the chosen reserve 34, 35, 36, the terminal 6, 8 will provide a predetermined increment to allow the transaction to continue. This fact is recorded together with the associated card number for later debiting of the account relating to the card. A small commission will also be added. Wireless transmission is the ideal tool for transmitting encryption keys to of a communication system wherein the keys change relatively very frequently, and this happens to be the case in the security system for the transfer of funds which is here proposed. Such key data can be broadcast to all the service providers simultaneously. A routine can therefore be evolved in the data processor 8 which will ensure that even subscribers with older reference numbers are not left out. This is described further below. Because of the importance of a smoothly running encryption system, the application of mobile phone technology to payment technology has been chosen.
The idea represented by Figs. 1 and 2 is essentially this: For operating a mobile phone system, there are in regional distribution a few main exchange stations 1 equipped with a relatively powerful sending tower 2 having a VHF antenna 3 which receives calls from subscriber telephones and responds to a calling number by connecting the two subscribers, by allotting to both the same time division slot. It is now proposed to associate the Mobile Phone transmitter to an entirely different kind of program. , namely the transmission of encryption keys that originate from the "Extension Program" area 4 to other Service Providers such as for example a Railway Station 7, or a small cafe, or a large supermarket. In the case of a small and isolated cafe shop, the equipment may be limited to a re-configured mobile phone. Where there is an aggregation of service desks, it would be more cost-effective to install a single Send/Receive antenna and dedicated processor system 8 such as illustrated in Figure 2., comprising an antenna 9 and a box 8 containing the encrypt/decrypt processor, several registers, a sequencing program, and two-way coaxial connections 10 to transaction stations 6 throughout the building (s) 7. Using a travel card on City Railways involves the following: waving the card briefly above the Reader Point marked on the turnstile 6; a valid card to be accepted must have at least enough value to cover the minimum fare which is deducted as the turnstile opens allowing the person to enter the so-called 'paid area'. When arriving at the distant station, the exit turnstile reads the entry code from the card and derives from a look-up table in the associated computer what the remaining fare is to the point of exit which is deducted from the card value. If the latter is insufficient, the turnstile will not open but directs the user to an Addfare Machine which, on presentation of the card, will
display the balance to be paid to the machine whereupon the card can be used for exiting through the turnstile. No interruption of the journey is allowed, nor provided for (even though, with a permanent card, it would be easy to make provision for a modified fare system that does permit journey interruptions).
As none of today's smart cards have a value display on the card, the traveller may be left unaware of what its value is, and may easily be taken by surprise when the card is rejected, either at an exit or even when trying to catch a train or bus. We therefore recommend inclusion into the processing system of vending units (cash registers, smart card operated buses, and turnstiles at stations) to use an automatic fixed update arrangement. The same would become operative every time the charge is greater than the residual value of the card. Only legitimately used cards will receive the privilege of automatic updating by a fixed amount. Cards stolen, or abandoned or otherwise on the black list of Banks will be rejected. Card serial numbers which are affected would be identified by banks to the PROGRAM EXTENSION CENTRE next to the mobile phone station (Fig. 1) and from there these will be radiated to all the transaction subscribers. These lists would be updated at least once every 24 hours, preferably in the early morning hours.
When a good card is updated at a vending point, its account-or serial number is read out, and recorded into the local processor box 8. In the early morning hours of the next day, the program of the PROGRAM EXTENSION
ROOM will cause the individual send/receive stations 8 to be called up with a request code ordering them to transmit all the account or serial numbers of those cards that during the preceding day were incremented. These identifying numbers are then passed on to the respective Bank computer stations 5. The convenience which the just described institution
would bring to the travelling public would be worth the extra investment. The public transport authority would have to be willing to accept the small risk element in updating the cards against the certainty that all the banks would honour their obligation from the next day onwards. Strictly speaking the one-day risk investment by the Transport company would justify a small fee, say 0,3% on the fixed update amount. If the fixed update amount were, for example, £25 , this would yield 7.5 p per update. Considering that there may well be about 100,000 updates daily, a daily extra income of £7500 means on an annual basis 2,7 mill £. This may double if the card is beginning to be used among shops and traders.
If a City, by investing in the new system, engages also in the leasing of the equipment items to private trading companies, there may be further financial benefits from such policies. It will appreciated that the use of Personal
Identification Numbers (PINs) to protect the use of plain and smart cards requires each reader to have a keyboard associated therewith. The embodiment of the payment token shown in Fig. 4 however, obviates this need.
It will be seen that the smart card payment token 71 shown in Fig. 4 has a keyboard portion 61 comprising a number of numeric keys 62 and other keys 63, 64. It also has indicating lights 65, 67, 68 and 69. It has display 72 with a display light 74 and a photocell 73 for the derivation of power.
The provision of a keypad 62 means that PIN entry can be done away from the public eye, and that is a decided advantage from the security point of view. In addition, payments can be switched on the spot from being a credit card payment to a debit card payment or a cash card payment, as the occasion requires .• This would
be done in accordance with Fig.3 merely by entering the appropriate access word (PIN) .
Its key board 61 comes in handy for PIN confirmations and money transfers from the card 71 in return for ticketing the smart card for definite trips by air, rail or coach services. This function can be relegated to separate encoding machines at key points such as stations, ' post offices etc.
The card of Figure 4 promises altogether a series of new uses. When a tourist enters a region or a village he has never seen before, he may have a number of questions. Such questions can be coded in terms of 2 - 5 digit numbers. Naturally, the local answers may be quite different from place to place, and also depend on the coincidental timing thereof. Some answers are likely to change from week to week. In anticipation of this possibility, the local telecommunication agency of a village or region will produce computer input for each such question and set up readout terminals at different public places such as hotels, restaurants, bus stops and re-fuelling stations, also in parks and at village entry points. When a card 71 as shown in Fig 4 is introduced into such -coupling terminals (which would have no keyboards or displays, and therefore can be formed out as very robust all-weather devices) the answer to any pre-coded question would appear on the display screen of the card 71. For example, some tourists may wish to know where the nearest botanical garden is, or the nearest library, nearest toilets, chemist, medical adviser, police station, bookshop, stationary, teashop, English restaurant, vegetarian restaurant, etc. Some may wish to know whether there is a debate going on anywhere on any subject, they may ask for the location- of churches and synagogues and the subjects on which these intend to have public talks. What courses are there given nearby admitting also guests and tourists?. Are there any amateur artists
performing plays with tickets left to buy, any football matches, any dances, or nearby sport events. Are there any guide walks into the surrounding nature studying wild life? Which bus connections are to the next village this morning, this afternoon., this evening?
Many tourists do desire to take part in the intellectual efforts of the place they come to but have no way of legitimate approach to them. This method of downloading answers to pre-formulated questions with location details will introduce into travel an improved dimension and also bring into isolated villages an incentive to offer something.
Fig. 5 shows an embodiment of a retailer terminal for any type of trader receiving cash (electronic cash, that is) . The equipment 45 has two separate display screens, 55 and 56. The price for any product or service is indicated, say, on the right window. If the customer accepts the price he/she is asked to confirm by pushing the right button 46. This action causes the price number to be encrypted in the processor 53 and placed into an auxiliary shift register which is not accessible from outside. Next, this register is recirculated and passed through a decryption process with the result being displayed on the left display window 56. The customer 'is expected to compare the price display on the left and right window. If he is satisfied that the two are identical, he / she presses the button on the left, 48, . which has the consequence of recording the encrypted version of the price on the tape recorder 54. The same procedure is of course applied to all transactions. The tape holds a string of data which in the early morning hours of the next day, is transmitted to the Bank where the consecutive items are decrypted (using the decryption keys of teh previous day) and entered into their customer's account as the preceding day's receipts.
It would not be possible to add anything to them or remove anything by manipulation, of any kind. This makes the transfer of the true amounts fool proof, namely the transfer from the consecutive customers cards 51 to the trader's own bank account.
No clearing bank is involved, and the purchasers' personal authorisations are implicit in the procedure.
Thus it will be seen that what has been described herein is a system with the following characteristics: it makes possible without reservation a multiple participation system; it makes possible to display a transaction result on a passive smart card; the first system proposals that are likely to tip the balance in the competition between the private car and public transport; the first smart card system wherein the normal vending terminal can be used for updating the value of the card, that is, at the very moment when the transaction would have to be refused or the card value would go negative, card value is being entered into its value register, (this applies of course only to customers who own a bank account or a credit account; and a public service system that is significantly less likely to be exploited or faulted.