CA2098481C

CA2098481C - Value transfer system

Info

Publication number: CA2098481C
Application number: CA002098481A
Authority: CA
Inventors: Timothy L. Jones; Graham R. L. Higgins
Original assignee: Mondex International Ltd
Current assignee: Mondex International Ltd
Priority date: 1991-10-16
Filing date: 1992-10-16
Publication date: 1999-07-06
Anticipated expiration: 2012-10-16
Also published as: ES2096772T3; RU2137187C1; PL299825A1; EP0567610A1; GR3022528T3; AU2888692A; EP0567610B1; DE69215501D1; CA2098481A1; PL170265B1; US5440634A; NO303893B1; WO1993008545A1; KR0161670B1; MD1402F2; JPH06503913A; JP2853331B2; DE69215501T2; DK0567610T3; KR930703657A

Abstract

2098481 9308545 PCTABS00021 A value transfer system which allows value to be transferred between electronic purses has a transfer message protocol which includes a commitment message to constitute a proof of posting, in the accountancy service. This allows interruption of a transaction before the value message itself is sent. Escrow type payments and batch processing are facilitated.

Description

W093/08545 ~ UJV~ PCT/GB92/0190l ALUE TRANSE'ER 5YSTE~I

The invention relates to a value transfer system.
Electronic value transfer systems ha-~e been propGs~d for transferring value between electronic "purss.s".
These purses rnay ta~e many forms but a convenient .orn, is an integrated clrcuit (IC) sard which includes a mi~ro-processor and memories for at least accumulated value. Such cards may be used in so-callsd cashless transactions where value is transferred to a retailer "purse" in exchanyo for ~oods or services.

Thus, a major application of sush a system is to provide for the transfer of value eq~livalent ~o casll.
Cash has both advantages ancl. llmitat~ons. Ar advantage of cash is that small value individual transactions can be made without spe;ific reconciliation between the payer and the pa~Qe accounts. Not only does this relie~te the system of a considerable data transfer burden, but also anonymity ls conferred in transactions. This is felt to be a sociaL advantage. Many prior proposed electronic cashless value transfer systems have failed to recognise these advalltages of cash and have failed t~
implement them. The system on which the presellt invention is hased is described in published patent specification No. W~-JQ1.'1~l~al ancl provi.des a frame~or~
3~ for 'he transfer OL value betweon electronic pu.rse., in SUCh a wa~ as to allo~ the aforesaid advantagos of cash to be retalned. The system m~ay be surnmarised 1n that there i.s proJided a computsr; a plurality of elsctronic puL~-es; exchanye ~evices whereby pursss may communicate with each other to transfer valuQ ir.

W093/08s45 ~ PC~/GB92/01901 transactlons whlch are off-line frcm the computer;
draw-down means for loadlng purses with value under control of the computer; redemption means for redeemlny value from purses under control of the computer; a value meter; one or more of said purses belng bulk purses which are capable of having value loaded and redeemed via the value meter, the value meter recording one or more float value records whereby the net value released to the bulk purse or purses may be derived, the net value being the difference between the total of values drawn down to the bulk purse or purses and the total of values redeemed from the bulk purse or purses, the float value record beins non-specific with regard to individual draw-downs and redemptions.
The value meter may have an interface whereby the float value record may be adjusted on command so as to create or destroy value within the bulk purse or purses.
Preferably there is provided, in each purse, storage means which stores a purse value record which is accumulative and, in each purse or associated exchange device, a microprocessor, transactions being conducted between purse pairs, one of whlch, the sendillg purse, sends value and the other of which, the receiving purse, receives value, the microprocessors being programmed so that in each off-line transactlon the purse value record in the sending purse is decreased by a chosen and variable transaction value 3~ and the purse va;.ue record in the receiving purse is increased by the same transactlon value.
By providing a float value record which is non-specif1c anonymity is ensured and reconciliation with customer accounts for all subsequent purse to purse transactions is unnecessary.

W0~3/08~ V~ L PCT/GB92/01901 In some sltuations it is necessary to ensure that payment of funds or other value is contingent upon some subsequent event. For example, it may be desirable to transfer value on the basis only that such value is used for a specific purpose. Foreign exchange control may be the reason for this. For exampie, a government may wish to fund an importe~ on the basis that the funds can be applied only to designated goods.

Also, it may be desirable to use the value transfer system in a batch processing mode~ The present invention seeks to provide an improvemer.t whereby contingency and batch payments are possible.

According to the invention there is provided a value transfer sys~em having a computer; a plurality of electronic purses; exchange devices whereby purses may communicate with each other to transfer value in transactions which are off-line from the computer;
and, in each purse or associated exchange device, a microprocessor, transactions being conducted between purse pairs, one of which, the sending purse, sends val~le and the other of which, the recelving purse, receives value, the microprocessors being programmed so that each transaction includes at least the following steps:
~0 A. The receiving purse sends a "reques~ to reccive value" message;

B. The sending purse creats a value message;

C. The sending purse creates and stores, a W093/OX~ PCT/G~92/01901 ~ O ~ q~ i ~

commitment message which signifies commitment of the requested value to the receiving purse;

D. The sending purse sends, between steps C and B, the commitment message; and E. The sendiny purse sends the value message.

Preferably each purse has a store which is a log 0 of transactions, the commitment message being stored in the log of the sending purse on creation and belng stored in the log of the receiving purse on reception.

Before creating the commitment message the sending purse will have created the value message and subtracted the value required from its accumulator this sequence of events means that even if the transaction is terminated after creation of the commitment message it is ensured that the funds required are available in due course to the receiving purse and to that purse only. The same funds are no longer available to the sending purse. However, in order to complete the transaction the escrow amount must be transferred to the receiving purse. If necessary, this may be done by transfer in a series of transactions through one or more intermediaries who may be regarded as hclding the funds subject to the contingency conditions being met.

3~ ~referably the purses have means whereby a transaction between a palr of purses lS given a unique identifier and the microprocessors a e programmed to respond to the identifiers to prevent a given transaction being repeated. No reference is then required to the computer to determine whether the same ,WV g3/08545 ~ V ~ i PCT/GB92/01901 ,~

"electronic cash~ is being used twice. In claiming to redeem value -the computer is accessed and it will be possible to determine whether the same claim is belny made twice, either directly or, since a claim may be simply another transaction, by means of a transaction identifier. The transaction identifier is preferably sent from the transmitting purse to the receiving purse, belng conveniently derived from data identifying the receiving purse and a receivin~ purse transaction sequence number or electronic date/time stamp obtained from the receiving purse in a preliminary "hand-shaking" operation. In this way the receiving purse can moniior the transaction and any attempt to transmit the same value record twice will be foiled.
Security of the system demands that cryptographic techniques be employed to prevent fraud. The most effective cryptographic tech~iques are asymmetrical in that they require different keys to encrypt and decrypt information. The terms "encrypt" and "decrypt"
will be used herein to mean "encypher" and "decypher".
One well-known and sultable cr~Iptographic technique is that attributed to Rivest, Shamir and ~dleman, known as the RSA system. It is envisaged that both purses of a communicating pair may employ the RS~ system equally in a balanced way for algorithmic processing.
~lowever, whereas RSA encryption is straight-forward, relatively powerfui computing facilities are required to e~ecute RSA decryption conventionally ln a sho t time. In order to overcome this difficulty, in the inte.ests of economy and speed, lt is proposed in accordance with a feature of the invention that an unbalanced system be used in which the processins capability required by consumer purses is significantlv less tl1an that required by retailer L ~
W093/085~5 ,,v~u-~i PCT/GB92/019~1 purses.
Each user of an asymmetrical key cryptographic system has a key palr, namely a public key and a secret key. Messages to another are encrypted using the other's (remote) public key which is made available, perhaps by as key exchange procedure.
Received messages are decrypted using the local secret key. Use of a public key is far less demanding of computing power than use of a secret key so that conventionally encryption requires less computing overhead than decryption. Therefore, in implementing an unbalanced system of the kind described it is expedient to remove the requirement that the consumer purse performs conventional RSA decryption.
A first wav of reducing the cryptographic burden in the consumer purse is to provide it with a simpler, symmetrical, cryptographic system. Such a system uses the same key for encryption and decryption. An example is the DES cryptographic system ~Data Encryption Standard - US FIPS 46,1976. Retailer purses retain the full power of the RSA system.
A second method is to use the consumer purse's own public key/secret key system for the interchan~e of data. In an exchange of keys the consumer purse sends its secret key to the retailer purse. In the transmission of data to the retailer purse the consumer purse would encrypt using its own public key and the retailer purse would decrypt using the consumer purse's se~ret key.
3~ Securitv can be enhanced by using electronically certified data, for example digitally signed aata, in the transaction prccess. Each purse on lssue wlll be allocated a characte-istic number and will have that number signed by the secret key of an asymmetrical alobal cryptographic system. The result will be a global signing of the number and this is stored in the purse.
All purses will carry the public key of the global pair so that on receipt of another's globally signed number it will be possible to verify that it is valid. The numbers can be regarded as globally certified. Since transactions will require the exchange of encryption keys it is convenient, although not necessary, to arrange that the globally certified numbers are encryption keys to be exchanged.
In accordance with the present invention there is provided a value transfer comprising: a computer; a plurality of electronic purses; exchange devices associated with the electronic purses through which the purses communicate with each other to transfer value in transactions which are off-line from the computer; and, microprocessors respectively contained in the electronic purses or associated exchange devices said microprocessors being programmed to effect transactions between a pair of purses including a sending purse which sends value and a receiving purse which receives value, wherein each transaction includes at least the microprocessor implemented processes of ta) the receiving purse or an exchange device associated with the receiving purse sending a requested value message denoting a re~uest to receive value, (b) the sending purse or the exchange device associated with the sending purse creating a value message responsive to the re~uested value message sent by the receiving purse or the exchange device associated with receiving purse, (c) the sending purse or the exchange device associated with the sending purse creating and storing a - 7a -commitment message which signifies commitment of the value requested by the request value message sent by the receiving purse or the exchange device associated with the receiving purse, (d) the sending purse or the exchange device associated with the sending purse sending the commitment message to the receiving purse or the exchange device associated with the receiving purse, (e) the sending purse or the exchange device associated with the sending purse sending the value message to the receiving purse or the exchange device associated with the receiving purse, and (f) the receiving purse or the exchange device associated with the receiving purse receiving and processing the value message.
The invention will further be described with reference to the accompanying drawings, of which:
Figure 1 is a schematic drawing of a banking computer system in accordance with the invention;
Figure 2 is a diagram illustrating the value meter;
Figure 3 is a diagram illustrating an example of a value transaction procedure using a full RSA cryptographic system;
Figure 4 is a diagram illustrating an example of a value transaction procedure using a secret key transmission technique; and Figure 5 is a diagram illustrating an example of a value transaction procedure using a mixed RSA/DES cryptographic system.
Referring to Figure 1 there are shown three clearing banks 1, 2 and 3 with respective computers la, 2a and 3a. The computers have files containing account details of the banks' - 7b -consumer and retailer customers. Each computer also has a value meter lb, 2b, 3b which shows a float value record. The actual funds represented by the non-specific float value records may reside in one or more of banks 1, 2 or 3, or elsewhere.

W093/085~5 ~ ~J~ a 1 PCT/GB92/01901 Each bank has a bulk purse 1c, 2c, 3c which is _onnected to the respectlve value meter and which has a memory with a purse value record. Terminals 5 are connected by telephone selectively to computers 1, 2 and 3. Typically terminals S may be home computer termlnals or terminals available in public places.
Consumers have electronic purses in the form of IC
cards 6. These cards have microprocessors and memories. In the memory OI each card is stored a purse value record 7. The cards have contacts 8, whereby the cards can interact with terminals 5 via card readers 9. By making appropriate requests at the keyboard of the terminal, a consumer may be connected to the computer of his bank, 1, 2 or 3 and may reguest a value record to be loaded to his purse. If the bank authorises the request, the bulk purse is instructed to institute a draw-down of value to load purse value record 7 with the value requested. The card is now ready for use.
Further electronic purses are contained in terminals 10, 11 which are equipped with IC card readers 9, located at different points-of-sale. To use his card the consumer presents it to the retailer where it is inserted into reader 9. The required value of the transaction is keyed in and by agreement the total held in the purse value record of the purse 6 is reduced by the amount of the transaction. The purse value record of the purse held within the terminal 10 or 11 is increased by the same transaction 3~ value. The consumer ta~es his goods and lS free to use the card up to the total held in the purse value record of his purse in other re~aiiers' equipment.
Periodically a retailer may redeem value represented by the purse value record held in the purse of his terminal 10 or 11, irrespective of the W093/0~ PCTIGB92/01901 consumers~ ider1tities and without presenting any details of the individual transactions that have given rise to the total accumulated value. This may he done by connectlny the terminal 10 or 11 to the retailer's bank 1, 2 or 3 as appropriate and requesting a redemption of value. The bank's computer then instructs a redemption transaction which accepts value from the termlnal purse. The bank computer sredits the retailer's account with funds. The value meters ; 10 form the basis for allowlng control of the total amount of value ln circuiation in all the purses and for apportioning, on an agreed basis, funds representing the total value.
The bulk purses 1c, 2c, 3c differ from the other purses in being capable of having value loaded and redeemed via the value meter, as well as by purse to purse transactions. In all other respects the purses are technically similar, it being understood in particular that the same cryptographic techniques for bulk purse to other purse transactions (on-line) used are the same as for off-line transactions. Pigure 2 shows the value meter as including an indicator 12 which shows a float value record. This is, in this case, the net value released to the bulk purse 1c, being the difference between the 'otal of values drawn down via the meter and the total of values redeemed via the meter. It will be appreciated that the individual gross draw-down and redeemed values may be indicated as well as or instead of the net value, it 3~ being readily possible ro derive the net value from the gross values even i. nct directly indicated. The link 1~ between the value meter and that of each of its bulk purses is secure. The purse may be ph~sically adjacent to the value meter and security ensured by physical locks etc. Alternatively, the W~93/~5~ vv ~ul PCT/GB92/0190l bul~; purse may be remote from the value meter and security is achieved by cryptographic techniques. I' is important to ensure that the value meter always accurately represents the value released to the bulk purse and no fraudulent alteration can take place.
Each value meter has an lnterface 14 which may be a link to the bank computing facility or a keyboard unit. Authorised personnel may enter values to be added to or subtracted from the float value record, representing a creation or destruction of value to be clrculated. Thus, value to be circulated may be adjusted in bulk, perhaps daily, instead of on demand in response tc individual draw-downs and claims.
Using the float value record in this way allows off-line interchange of value, given suitable terminals, between consumers and retailers, retailers and consumers and consumers anc. consumers, without the need to maintain large numbers of accounts or detailed account to account reconciliations.
Consumers themselves may adjust the purse value records in their purses by person to psrson interchange or by refunds etc from retailers. It is envisaged that purse value records may be transferred to individual accounts by a claiming procedure from the float value record in a similar manner as retailers' ciaims.
Purses may be used on an international basis by loading different currencies in them. It is envisaged that each country or group of countries will hold a 3~ float value ~ecord in the appropriate currency.
Application by a consumer to load his purse wlth a foreign currency may result in his domestic account being debited by the appropriate amount in hls own currency and the respective foreign currency float value recor~ being increased.
.

W0~3/OX54~ PCT/GB92/01901 ~. ,f.~, 1 1 --A purse value record held in a purse may be converted to a different currency on request, the conversion be1ng effected at the appropriate rate and resulting ln a transfer of value from the float value record of one currency to that of another currency and a corresponding conversion of funds between the currencies.
Figure , shows the procedure durlng an off-line transaction ln a first embodiment of the invention.
Both purses have full RSA asymmetrical cryptographic capability. The sending purse has a store 5S which holds an accumulative value record Svr and the following RSA keys: sender public and secret keys Pks and Sks and global public key Pkg. In addition there is a certified data message [Pks]*Skg. This is the sender purse's unique public key signed by the master computer with its global secret key Skg. The public key Pks is thus electronically certified as valid by the system. The receiver purse has a store R5 which holds an accumulative va!ue record Rvr and the receiver purse's own'RSA public and secret keys Pkr,Skr, the global public key Pkg and a certified public key data message [Pkr]~Skg.
The first step of the transaction procedure is for the receivlng purse to issue a transaction identifier number R. Thls is derived from a combination of the receiving purse identity and a transaction sequence number for that purse. Two-way communication between the purses is established, 3~ psrhaps localiy by dlrect connectlon or by infra-red link OL- the like or remo~e'y by modem and telephone.
The followino steps are foilowed:
1. The recei~ing purse transmits a request message which is ;Pkr]*Sky~[R!*Skr.

2. The sendins purse is able to check [Pkr]*Sks ' W0~3/UX5~ ~ V~ PCT/GB92/01~01 by use of the public global key Pkg. This g~ves ths sending purse the authentic key Pkr to verlfy IR]*Skr and hence recover R.

3. The ser.din~ purse constructs a transaction value message VR from value V it wishes to transfer and from the request message R. This is signsd with the sender's secret key to give the following transaction value message which is stors~ ln the sending purse [Pks]*Skg+[VR~*Sks 4. The sending purse creates a commitment message of the form [Pks]*Skg+lPR]*Sks where P lS a combination of a value V to be transferred and a signifier that the message is a commitment message.

5. Th~e value V which is required tc be transferred is decremented from the purse value record Svr.

6. Details of the commitment message are logged in the sending purse log STL.

7. The commitment message is sent to the receiving purse.

8. The receiviny purse obtains the public key Pks by use of the public key Pkg thereby verifying the message [Pks]*Skg.

9, Use of the public key Pks thus found verifies PR~*Sks and hence recovers PR.

10. R is checked to ensure that it carries the identity of the receiving purse and the appropriats transaction number. If not, th~ transaction is 3~ aborted.

11. Th~ receiving purse logs the commitment messaae in its log RTL.

12. Ths sending pu.se transmits the transaction value message. This may be after an inte~ruption in the transaction of any required duration.

~ ~ y ~
w0~3/0~5~ PC~/GB92/0l90l 13. The receiving purse obtalns the public key Pks by use of the public key Pkg thereby verifying the message IPks]*Skg.

14. Uce of the public key Pks thus found ~erifies [VR]*Sks and hence recovers VR.

15. R is checked to ensure that it carries the identity of the receiving purse and the appropriats transaction number. If not, the transaction is aborted.

16. If all is well, the value v is added to the purse value record of t.~e receiving purse.

17. A signed acknowledgement is sent to the sending purse.
RSA encryption and decryption require calculation of the expression xY mod n where y is different for encryption and decryption. In particular the inde.Y y for encryption (embodied in the public key) is small and the corresponding index for decryption (embodied in the secret key) is very much larger. As a consequence, while modest computing power can handle encryption in an acceptably short time the same is not true for decryption. The creation of a certified (eg digitally signed) message has an equivalent processing overhead to decryption, the checking of such a message has an equlvalent processinq overhead to encryption.
The embodiments illustrated in Figures 4 and 5 provide arranyements which allow one of the pair of commul1icating purses to be of lower computing power, and there~ors less expensive, than ths other. In these arrangements some purses of the system ~retailer purses) have full RSA capabillt~ (encryption and decryptloi1 capability) whereas the remainder (consumer purses) include a symmetrical key cryptographic .system for transmittil1g transaction value record messages.
suitable symmetrical key cryptographic system is the W093/0~5~ , PCT/GB92/0190l DES system. This requlres for encryption and decryption a level of computing power similar ~o the power requlred for RSA encryption.
Referring to Fiyure 4 there is illustrated the transaction procedure between two purses where the sendlng purse is a consumer purse and the receiving purse is a retailer purse. The retailer purse has full RSA capability whereas the consumer purse has a lower power computing facility. The sending purse has a store CS which holds an accumulative value record Cvr and the RSA global public key Pkg. In addition there is a DES key DESc and a certified data message [DESc]*Skg whlch is the sendiny purse's unique DES ke~
signed by the master computer with its global secret key Skg. The receiving purse has a store SR which is identical with the store SR of the Figure 3 embodiment, holding Pkr,Skr,Pkg and !Pkr]*Skg.
The first step in the transaction procedure is for the receiving purse to issue a transaction identifier R as in the embodiment of Figure 3. Then the following steps are taken:
1. The receivlng purse transmits its certified public key message [Pkrl*Skg.
2. The sending purse checks the signed message and derives Pkr.
3. The sending purse encrypts its certified message using Pkr. Since the inde~ y of a public key such as Pk~- is small, encryption with it is computationally easy. The ~essage sent to the ; 30 receivilly purse is ~Pkr ~[DESc]*S~g]
4. The recei~.~ing purse decrypts the messayQ
f,rstly with its secret key Skr to derive [DESc]*Skg which itself i5 checked with Pkg to give verification and derive DFSc.

)3/0~ U~ PCT/G8~2/01901 5. The receiving purse transmits the message ~]kDESc whlch is the transaction identirier R
processed with a DES integr~ty algorithm.
6. The receiving p~1rse decrypts the message in 5 DES, derives the transaction identifier R and constructs the value message VR and the commitment message PR in the same way as in the Figure 3 embodiment.
7. The sending purse decrements the value V from its purse value record and sends the message [PR]*DESc to the recelving purse. The commitment message is logged in STL.
~ . The receiving purse decrypts ~PR1*DES and checks that R is correct. If not the transaction is aborted.
9. If all is well the commitment message is stored in log RTL.
10. The sending purse constructs the value message VR and sends the value message [VR] *~ESc to the receiving purse.
11. The recaiving purse processes [VR) *DESc with a DES integrity algorithm and checks that R is correct. I~ not the transactiQn is aborted.
12. The value V is added to the receiving purse's purse value record and an acknowledgement message is sent to the sending purse.

Refsrring now to Figure 5 there is shown a transaction procedure which allows the purses to have u1lbalanced compu~lng power while using the keys of an asymmetrical cryptographic system. In Figure 5 the store RS of the recei~ing purse has ~he same keys a~
in the Figure 3 embodiment. The computins pow~r of the sending DU_Se iS less than tnat of the receiving purse and instead of the signed public key, the ,, W093/085~5 ~ V~ PCT/G~92/01901 sending purse holds an unslaned public key (whlch in this case ls kept secret) and a slgned secret key [Sks]*Skg (whlch also lncorporates Pks).
A transaction procedure has the followlng steps:
1. The receiving purse transmits the signed - message [Pkr]*Sky.
2. The sending purse checks thP signed message with Pkg, verifylng [Pkrl*Skg and hence recoverlng Pkr.
3. The sending purse encrypts lts signed message with Pkr and sends Epkr [[Sks]*Skg].
4. The receivlng purse decrypts the message firstly with the use of lts secret key Skr to glve [Sks~*Skg and then uses the global public key Pkg to verify [Sks]*Skg, thereby recovering Sks.
5. The receiving purse signs the transaction identifier R with Sks and sends [R]*Sks.
6. The sending purse derives R by the use of Pks.
7. The sending purse constructs value message EpkS lVR] and a commitment message EpkS [PR]. The commltment message is logged in STL and is sent to the receiving purse.
8. The receiving purse decrypts the message with the use of Sks to derive P and R. R is checked and if it is incorrect the transaction is aborted.
a, The commitment message is logged in RTL.
10. The sending purse sends the value message Epks [VRI. .
~1. The receiving purse decrypts thP messagP
with the use of Sks to derive V and R. P~ lS checked and ii it is lncorrect the transaction ls abortsd.
12. If all is well the purse value record of the receiving purse is incremented by ~, the key Sks in the receiving purse is discarded and an W093/0~5~ f'CT/GB92/nl901 ~ i,, ,,.~,~

acknowledgement message is sent to the sending purse.
The commltment message can be regarded as a "proof of posting" message in the sense that it is proof that the value has been posted, ln accountancy terms, from the account of the sending purse. Thus, "proof of posting" is proof that the value accumulator in the ssnding purse has heen decremen-ted by the requlred ~alue. Effectively, the commltment message tells the receiving purse tha~ the required value has been irrevocably committed to it. The commitment, or "proof of posting" message takes the form of the value message except that a proof number P takes tne place of value V. However, P contains the value information OL V. Thus, the commitment message has the form [Pks]*Skg~[PR]*Sks. At the same time, details are logged in the sending purse log STL. On receipt of the commitment message the receiving purse enters the details in the log RTL.
By virtue of the logs it is possible to recover financially intact from any transaction which has been interrupted either accidentally or deliberately. In the event of a dispute about the allocation of funds between purses for whatever reason, the purses can be examined and the dispute resolved on the basis of the log informatlon. The transaction may be broken at any tlme after the value and commitment messages have been created and logged.
When the value and commitment messages have been logged, it is possible to interrupt the transaction.
3~ This is illustrated, for example, bv the broken line marked "Interrupt". Interruption at this stage is useful for contingency paymellts slnce the reselvin~
purse will have received confirmation that the required funds are committed to it but will not have received the funds at that time. On satisfaction of W0~3/0~5~5 ~ PCT/GB92/01901 1 ~

~he contingency requirements the transaction can be resumed by the sending purse transmitting the value message in the manner described before. The actual transmission and receipt of the value message arD
logged by the respective purses and the transactlon is completed. It is not necessary that the value message should be transmitted directly from sending purse to receiving purse and various intermediate transactions can be envisaged whereby the value, which can he regarded as being held in escrow, is transferred to intermediate purses. These purses wi-ll not have access to the funds represented by the escrow message which will be destined for and usable by the receiving purse only.
An advantage of interrupted processing of a transaction is that it allows transactions to be batch processed in their suspended state. This, in turn, renders the system applicable to batch processing procedures.
The invention is not restricted ~o the details of the embodiments described above with reference to the drawings. For example, the method of sending and receiving cryptographic keys described may be replaced by a prelimlnary "exchange of keys" protocol step.

3o :.~

Claims

THE EMBODIMENTS OF THE INVENTION IN WHICH AN EXCLUSIVE
PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS:

1. A value transfer comprising:
a computer;
a plurality of electronic purses;
exchange devices associated with the electronic purses through which the purses communicate with each other to transfer value in transactions which are off-line from the computer; and, microprocessors respectively contained in the electronic purses or associated exchange devices said microprocessors being programmed to effect transactions between a pair of purses including a sending purse which sends value and a receiving purse which receives value, wherein each transaction includes at least the microprocessor implemented processes of (a) the receiving purse or an exchange device associated with the receiving purse sending a requested value message denoting a request to receive value, (b) the sending purse or the exchange device associated with the sending purse creating a value message responsive to the requested value message sent by the receiving purse or the exchange device associated with receiving purse, (c) the sending purse or the exchange device associated with the sending purse creating and storing a commitment message which signifies commitment of the value requested by the request value message sent by the receiving purse or the exchange device associated with the receiving purse, (d) the sending purse or the exchange device associated with the sending purse sending the commitment message to the receiving purse or the exchange device associated with the receiving purse, (e) the sending purse or the exchange device associated with the sending purse sending the value message to the receiving purse or the exchange device associated with the receiving purse, and (f) the receiving purse or the exchange device associated with the receiving purse receiving and processing the value message.

2. A value transfer system as claimed in claim 1, wherein each purse has a store which is a log of transactions, the commitment message being stored in the log of the sending purse upon creation and being stored in the log of the receiving purse upon reception.

3. A value transfer system as claimed in claim 2, wherein the microprocessors are programmed to provide each transaction a unique identifier R specific to the receiving purse, wherein the requested value message includes the transaction identifier R, wherein the value message includes information VR including a value V to be transferred and the transaction identifier R, and wherein the commitment message includes information PR where P includes the value V and a signifier which signifies the message as a commitment message.

4. A value transfer system as claimed in claim 3, wherein the microprocessors are programmed to employ an asymmetrical cryptographic system having different public and secret keys and each purse has stored therein at least a public key of the system.

5. A value transfer system as claimed in claim 4, wherein each purse stores data signed in the cryptographic system by the computer with a global secret encryption key, the signed data thereby being electronically certified, and the microprocessors are programmed to effect each transaction by checking certified purse data using the global public key.

6. A value transfer system as claimed in claim 5, wherein in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that microprocessor of the other of the receiving purse and the sending purse, wherein the purse of the second microprocessor includes an encryption key for a symmetrical cryptographic system and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the encryption key of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the encryption key.

7. A value transfer system as claimed in claim 4, wherein each purse has stored therein a unique key pair including a public key and a secret key in the cryptographic system and the microprocessors are programmed to effect transmission of transaction data as encrypted and decrypted data using the key pairs.

8. A value transfer system as claimed in claim 7, in which in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the secret key of the key pair of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the public key of the key pair of the purse of the second microprocessor.

9. A value transfer system as claimed in claim 2, wherein the microprocessors are programmed to employ an asymmetrical cryptographic system having different public and secret keys and each purse has stored therein at least a public key of the system.

10. A value transfer system as claimed in claim 9, wherein each purse stores data signed in the cryptographic system by the computer with a global secret encryption key, the signed data thereby being electronically certified, and the microprocessors are programmed to effect each transaction by checking certified purse data using the global public key.

11. A value transfer system as claimed in claim 10, wherein in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that microprocessor of the other of the receiving purse and the sending purse, wherein the purse of the second microprocessor includes an encryption key for a symmetrical cryptographic system and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the encryption key of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the encryption key.

12. A value transfer system as claimed in claim 9, wherein each purse has stored therein a unique key pair including a public key and a secret key in the cryptographic system and the microprocessors are programmed to effect transmission of transaction data as encrypted and decrypted data using the key pairs.

13. A value transfer system as claimed in claim 12, in which in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the secret key of the key pair of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the public key pair of the purse of the second microprocessor.

14. A value transfer system as claimed in claim 1, wherein the microprocessors are programmed to provide each transaction a unique identifer R specific to the receiving parts, wherein the requested value message includes the transaction identifier R, wherein the value message includes information VR including a value V to be transferred and the transaction identifier R, and wherein the commitment message includes information PR where P includes the value V and a signifier which signifies the message as a commitment message.

15. A value transfer system as claimed in claim 14, wherein the microprocessors are programmed to employ an asymmetrical cryptographic system having different public and secret keys and each purse has stored therein at least a public key of the system.

16. A value transfer system as claimed in claim 15, wherein each purse stores data signed in the cryptographic system by the computer with a global secret encryption key, the signed data thereby being electronically certified, and the microprocessors are programmed to effect each transaction by checking certified purse data using the global public key.

17. A value transfer system as claimed in claim 16, wherein in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that microprocessor of the other of the receiving purse and the sending purse, wherein the purse of the second microprocessor includes an encryption key for a symmetrical cryptographic system and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the encryption key of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the encryption key.

18. A value transfer system as claimed in claim 15, wherein each purse has stored therein a unique key pair including a public key and a secret key in the cryptographic system and the microprocessors are programmed to effect transmission of transaction data as encrypted and decrypted data using the key pairs.

19. A value transfer system as claimed in claim 18, in which in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the secret key of the key pair of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the public key of the key pair of the purse of the second microprocessor.

20. A value transfer system as claimed in claim 1, wherein the microprocessors are programmed to employ an asymmetrical cryptographic system having different public and secret keys and each purse has stored therein at least a public key of the system.

21. A value transfer system as claimed in claim 20, wherein each purse stores data signed in the cryptographic system by the computer with a global secret encryption key, the signed data thereby being electronically certified, and the microprocessors are programmed to effect each transaction by checking certified purse data using the global public key.

22. A value transfer system as claimed in claim 20, wherein each purse has stored therein a unique pair including a public key and a secret key in the cryptographic system and the microprocessors are programmed to effect transmission of transaction data as encrypted and decrypted data using the key pairs.

23. A value transfer system as claimed in claim 22, in which in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the secret key of the key pair of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the public key of the key pair of the purse of the second microprocessor.

24. A value transfer system as claimed in claim 20, wherein in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, wherein the purse of the second microprocessor includes an encryption key for a symmetrical cryptographic system and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the encryption key of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the encryption key.

25. A value transfer system as claimed in claim 20, wherein each purse has stored therein a unique pair including a public key and a secret key in the cryptographic system and the microprocessors are programmed to effect transmission of transaction data as encrypted and decrypted data using the key pairs.

26. A value transfer system as claimed in claim 25, in which in a transaction a first microprocessor of one of the receiving purse and the sending purse has superior computing power compared to that of a second microprocessor of the other of the receiving purse and the sending purse, and the first and second microprocessors are programmed to effect the transaction by sending to the purse of the first microprocessor the secret key of the key pair of the purse of the second microprocessor and encrypting data at the purse of the second microprocessor using the public key of the key pair of the purse of the second microprocessor.