WO2002039252A1

WO2002039252A1 - Means and method of privately storing data

Info

Publication number: WO2002039252A1
Application number: PCT/AU2001/001440
Authority: WO
Inventors: Michael Joseph Manion; Christopher Walter Boucher
Original assignee: Giftspeak Pty Limited
Priority date: 2000-11-08
Filing date: 2001-11-08
Publication date: 2002-05-16
Also published as: AU2002213676A1; AU2002223004A1; WO2002039251A1

Abstract

A system, method and storage device for privately recording audio data for an intended recipient. The audio data such as a personal spoken message is privately recorded into the storage device. The storage device is preferably housed in an appropriate housing such as a heart shaped housing, and may be accompanied by a gift. Prior to delivering the storage device holding the audio data to the intended recipient, the recorded audio data is privately retrieved from the storage device and privately compared with original audio data in order to verify the integrity of the recorded audio data, so as to ensure the audio data is accurately delivered to the recipient while retaining the privacy of the message.

Description

or were common general knowledge in the field relevant to the present invention as it existed before the priority date of each claim of this application.

Summary of the Invention

According to a first aspect the present invention provides a method of privately recording audio data into a storage means for access by an intended recipient, the method comprising the steps of: privately recording the audio data into the storage means; and prior to providing said storage means to the intended recipient, privately retrieving the recorded audio data from the storage means and privately comparing the retrieved recorded audio data with original audio data in order to verify the integrity of the recorded audio data.

Preferably, the step of privately comparing involves a digital comparison of digital audio data, which is preferably carried out by computing means without direct human intervention. Such a comparison may comprise a bit-by-bit comparison, or alternatively may involve a statistical analysis of both the retrieved recorded audio data and the original audio data. For example, the digital comparison may involve employing a statistical method to derive a series of values from the retrieved recorded audio data, for comparison to a series of values derived by the same statistical method from the original audio data. The extent to which the two series of values agree enables the computing means to make a determination as to whether the audio data has been properly recorded in the storage means. In preferred embodiments of the method of the first aspect of the invention, the step of comparing further comprises reaching a determination as to whether the recorded audio data is of sufficient quality. The method of the first aspect of the present invention preferably further comprises, upon a determination that the recorded audio data is of insufficient quality, repeating the step of privately recording. Of course, should the step of privately recording be repeated, it is preferable to repeat the steps of privately retrieving the recorded audio data from the storage means and privately comparing the retrieved recorded audio data with original audio data in order to verify the integrity of the recorded audio data. Furthermore, the method of the first aspect of the present invention preferably comprises the step of testing the functioning of a subsystem of the storage means that provides access to any stored data. That is, testing the functioning of the storage means in recording and replaying audio data. In a preferred embodiment, this step of the method may be performed during the manufacture of the storage means well in advance of the use of the storage means to store private data. This step will preferably also be performed just prior to the transfer of data to the storage means.

According to a second aspect, the present invention provides a storage means for recording audio data for access by an intended recipient, the storage means comprising: means for audible playback of the audio data for the intended recipient; and means for private retrieval of the recorded audio data, to enable a private comparison of retrieved recorded audio data with original audio data in order to verify the integrity of the recorded audio data. Similarly, according to a third aspect, the present invention provides a system for privately passing audio data to an intended recipient, the system comprising: means for privately receiving audio data for an intended recipient; means for privately recording the audio data into a storage means; means for privately retrieving recorded audio data from the storage means; and means for privately comparing retrieved recorded audio data with received audio data in order to verify the integrity of the recorded audio data.

The first, second and third aspects of the invention provide the advantage of determining whether a recorded audio message meant for a recipient has been accurately recorded in the storage means, while at the same time the use of a private comparison ensures that such a determination is carried out without the audio message being heard by persons other than the intended recipient, and therefore maintains a degree of privacy of the audio data. That is, the first, second and third aspects avoid the need for an audible play back of the audio data in order to determine the integrity of the recorded audio data.

In preferred embodiments of the second aspect of the invention, the storage means comprises a bi-directional data interface, enabling a transfer of audio data into the storage means for recordal, and enabling retrieval of recorded audio data out of the storage means for the purposes of private comparison.

According to a fourth aspect, the present invention provides a storage means for recording audio data for access by an intended recipient, the storage means comprising: a first storage space for recording audio data; a second storage space for recording identification data associated with the audio data; and a data interface for transfer of data to and from the storage means, the data interface enabling recordal of audio data into the first storage space of the storage means, and enabling retrieval of recorded identification data from the second storage space without accessing the first storage space.

Preferably, the data interface further enables storage of identification data into the second storage space. According to a fifth aspect, the present invention provides a method of monitoring audio data for an intended recipient, the method comprising the steps of: recording the audio data in a first storage space of a storage means; recording identification data associated with the audio data in a second storage space of the storage means; and prior to delivery of the storage means to the intended recipient, retrieving recorded identification data from the second storage space of the storage means without accessing the first storage space.

According to a sixth aspect, the present invention provides a system for privately delivering audio data to an intended recipient, and for privately monitoring delivery of the audio data, the system comprising: means for recording audio data in a first storage space of a storage means; means for recording identification data associated with the audio data in a second storage space of the storage means; and means for retrieving recorded identification data from the second storage space of the storage means without accessing the first storage space.

By use of separate first and second storage spaces for the audio data and the identification data respectively, the fourth, fifth and sixth aspects of the invention enable identification data, such as the intended recipient's name and address, to be stored in the storage means itself. Therefore, the identification data can be stored in an essentially inseparable manner with the audio data. Importantly, use of distinct first and second storage spaces further maintains a degree of privacy of the audio data, yet enables the identification data to be accessed by, for example, a courier delivery service provider entrusted with delivery of the storage means to the proper recipient. It is envisaged that the fourth, fifth and sixth aspects of the invention will have particular application in assisting appropriate monitoring of an audio message from the point at which the message is recorded, through recordal of the audio data into a storage means, and even subsequently between recordal of the audio data into the storage means and ultimate delivery to the intended recipient. Furthermore, such a monitoring system enables a degree of privacy of the audio data to be maintained throughout.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying an intended date of delivery of the storage means to the intended recipient, or may comprise data identifying an order number.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying accompanying items which are required to be delivered to the intended recipient with the storage means.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data uniquely identifying the storage means, such as a serial number.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying a manufacturer of the storage means. Such embodiments may enable a determination as to whether or not a given storage means has been manufactured by an approved manufacturer.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying a voucher redeemable by the intended recipient. In such embodiments, the method of the present invention preferably further comprises notifying the intended recipient of the voucher at the time of delivery of the storage means to the intended recipient. For example, a courier delivery service provider entrusted with delivery of the storage means to the intended recipient may as a matter of course access the identification data, without accessing the audio data. Upon determining that such voucher information exists, the courier delivery service provider may print out a voucher in accordance with the voucher information for delivery to the intended recipient along with the storage means. In another example, promotional or advertising material may be provided with or on the storage means to indicate that a voucher facility is available to the intended recipient to a nominated currency value. For instance, an indication may be provided that, on presentation of the storage means and some form of personal identification, the voucher may be redeemed at an indicated vendor. The vendor preferably has the facility to access only the second storage space of the storage means and to validate the voucher information contained in the identification data.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying a lottery ticket redeemable by the intended recipient. Again, in such embodiments, the method of the present invention preferably further comprises notifying the intended recipient of the lottery ticket at the time of delivery of the storage means to the intended recipient. For example, a courier delivery service provider entrusted with delivery of the storage means to the intended recipient may routinely access the identification data, and upon determining that such lottery ticket information exists, may print out a lottery ticket in accordance with the lottery ticket information for delivery to the intended recipient along with the storage means. In another example, the storage means could be used as a promotional item that must be presented by the intended recipient to a vendor, said vendor to establish whether or not the storage means contains the winning lottery number or competition details in the identification data.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data may comprise data identifying a time period during which the audio data remains valid. Such embodiments may facilitate "limited time only" advertisements carried by the storage means, such that the audio message can only be played back during the relevant time period. The identification may further comprise information defining a plurality of time periods during which different portions of audio data stored by the storage means are valid. That is, the storage means may be operable to playback only a portion of audio data which is valid for the current period of time. Such embodiments of the invention facilitate "rolling" advertising by use of such a storage means. The plurality of time periods may be sequential or overlapping.

In accordance with the fourth, fifth and sixth aspects of the invention, the identification data can be encoded, or encrypted, before being stored within the second storage space of the storage means to prevent any unauthorised use of the identification data and must be accessed and decoded by a suitable algorithm.

According to a seventh aspect, the present invention provides a method of privately collecting and transferring data into a storage means from a sender for access by an intended recipient, the method comprising the steps of: privately collecting data to be stored from the sender; privately transferring the data to a storage means, said storage means operable to provide access to the stored data; and delivering the storage means to an intended recipient, enabling activation of the storage means by the intended recipient to access the stored data, said activation providing a positive indication that an attempt to access the stored data has occurred.

Preferably, the steps of collecting the data and transferring the data to the storage means occurs in a manner that ensures the data remains private by not allowing access by any person other than the sender. In a preferred embodiment, these steps are performed with no human intervention whatsoever apart from that of the person providing the data (i.e. the sender). In a particularly preferred embodiment, at the point of collecting data from a sender, the data is encrypted and it remains in this form until it is transferred into a storage means.

Transferring data collected from a sender to a storage means without any other human intervention introduces the potential for undetected unreliable transfers. Enabling a human operator, other than a sender, to access transferred data to ensure integrity of the stored data defeats the confidentiality of any transferred data. As a result, it is particularly preferable that the method of the seventh aspect of the present invention comprise a step to check that a reliable transfer of collected data to the storage means has occurred, the check not requiring another party to gain access to the transferred data. Additionally, the method preferably comprises a step to check the functioning of the subsystem of the storage means that provides access to any stored data. In a preferred embodiment, this step of the method is performed during the manufacture of the storage means well in advance of the use of the storage means to store private data and just prior to the transfer of data to the storage means. According to an eighth aspect, the present invention provides a storage means for the storage of data wherein upon accessing data from the storage means an indication of said access is provided.

The positive indication of attempted access to stored data of the storage means is preferably a substantially irreversible or permanent indication such that any subsequent attempt to access the data stored in the storage means clearly indicates to a user a prior attempt to access the data. The positive indication preferably indicates an attempt to access data by any user (e.g. sender, recipient or third party).

Whilst the data of the storage means of the eighth aspect of the present invention may relate to any form of communication, in a particularly preferred embodiment, the data relates to an audio message. Additionally, the storage means of this embodiment comprises a self contained device that is operable to store audio data transferred to it and is also operable to playback the stored audio data by way of a transducer for the conversion of electrical signals to audible sound such as a speaker. The storage means preferably comprises a replaceable energy source to enable repeated playback of the stored message.

The storage means may comprise at least one switch operable to activate playback of the stored audio message. In this instance, it is preferable for the at least one switch to be enclosed by a frangible member such that the frangible member must be broken in order to activate the at least one switch. In this embodiment, the breaking of the frangible member acts as the positive and substantially irreversible indication that an attempt to access the audio message has occurred. As such, privacy of the stored audio message can be ascertained by the recipient, or any user, of the storage means by inspection of the frangible member.

The playback of data stored in the storage means by way of a switch preferably allows the playback of the message to be stopped or re-started by repeated activation of the at least one switch. In addition to the data intended for the recipient, it is preferable that the storage means be operable to also store data including details relating to the intended recipient for use by the service provider in delivering the storage means and any other associated goods to the recipient. Of course, access to this type of data preferably does not require a positive indication that access to the data has occurred and preferably does not allow access to the senders data that is intended only to be accessed by the recipient.

According to a ninth aspect, the present invention provides a system for privately collecting and transferring data into a storage means from a sender for access by an intended recipient, the system comprising: means for privately collecting data to be stored from the sender; means for privately transferring the data to a storage means, said storage means operable to provide access to the stored data; and means for accessing the stored data by an intended recipient upon delivery of the storage means to the intended recipient, wherein said access provides a positive indication that an attempt to access the stored data has occurred.

Preferably, the system comprises means to check the integrity of data transferred to the storage means, the checking means not requiring human access to the data stored in the storage means thus maintaining the privacy of the data. In the instance of the data comprising encoded audio information, to ensure that the audio reproduction sub-system of the storage means is functioning correctly, the system preferably comprises a testing means to input a known audio signal into the storage means and to cause the storage means to audibly replay the known signal. The testing means preferably further comprises a microphone positioned proximal to the storage means in order to detect the audible replay of the known signal by the storage means. A processing algorithm may then be used to establish whether the audio signal replayed by the storage means sufficiently matches the characteristics of the known audio signal, to thereby establish whether correct audio reproduction by the storage means has occurred and thus verify correct operation of the audio sub-system. The testing means is preferably used during manufacture of the storage means, well in advance of the use of the storage means to store private audio data as well as just prior to the transfer of private audio data to the storage means. In this particular embodiment, the audio information may be stored in the storage means in the form of a sequence of analogue voltage levels. 10

In a preferred embodiment, the checking means employs a method to determine a value, or series of values, representative of the data to be transferred and also employs the same method to determine a value, or series of values, representative of the data stored in the storage means. The checking means compares the value, or series of values, for the data both prior and subsequent to transfer in an attempt to determine whether a successful transfer of the data has occurred.

In a preferred embodiment, the storage means may be attached to housings of different size and/or shape, the different housings being distinctive or characteristic of the circumstances relating to the purpose for which the data was sent from the sender to the recipient. Of course, the housing may be the gift itself such as a soft toy or a diary and the storage means may be embodied in the gift.

It is to be understood that the phrase "audio data" and the like as used herein refers to data representing an audio signal, whether or not the data is encrypted, compressed, or in digital or analogue form. Typically, the audio data will represent a verbal message recorded by a giver of a gift.

Further, it is to be appreciated that preferred embodiments of the invention may be in accordance with two or more of the above aspects of the invention.

Brief Description of the Drawings

An example of the invention will now be described with reference to the accompanying drawings in which: Figures la, lb and lc depict a perspective view of a preferred physical embodiment of the upper side of a storage means, the underside of a storage means, and a housing for a storage means respectively;

Figure 2 is a block diagram illustrating the main electrical hardware components of a preferred embodiment of a storage means; Figure 3 is a representation of a physical embodiment of a transfer means;

Figure 4 is a block diagram illustrating the main hardware components of a preferred embodiment of a transfer means;

Figure 5 is a functional diagram illustrating the main components of an order processing and delivery system of a preferred embodiment; 11

Figure 6 is a flowchart illustrating the main decision processes involved in transferring data from a computer to a storage means;

Figure 7 is a flowchart illustrating the main processing steps executed by software resident in a transfer means used in a preferred embodiment to transfer audio data to a storage means;

Figure 8 is a circuit diagram of a preferred embodiment of a storage means;

Figure 9 is a pictorial representation of an order fulfilment system in accordance with the present invention; and Figure 10 is a pictorial representation of a further order fulfilment system in accordance with the present invention.

Detailed Description of the Preferred Embodiments

For the purposes of describing a preferred embodiment of the invention, the term "Message Core" (MC) is used to refer to one particular embodiment of a storage means and the term "Message Assistant" (MA) is used to refer to one particular embodiment of a transfer means.

The present invention is particularly well suited to application in the gift industry whereby gifts are sent to a recipient accompanied by a MC with an audible message recorded by the sender. Upon receipt of the gift and the

MC, the recipient is able to access the audible message from the sender and to establish whether any previous attempt has been made to access the message.

Whilst it is expected that vendors of goods and services in the gift industry are the most likely to provide the additional service of providing facilities for a consumer to record a personal message for a MC, it is not necessarily restricted to supply by gift industry vendors and could equally be provided as a separate service.

With reference to Figure la, the upper side of a preferred physical embodiment of a MC is detailed in perspective view. The MC comprises a body (453) which includes an electronic circuit board within the body (453).

Upon the circuit board is mounted a speaker (not detailed in Fig 1) which is generally aligned with the aperture (450) of the body (453).

The body (453) also includes a removable switch cover (451) which is preferably connected to the body (453) by way of frangible members (not detailed in Fig 1). As such, removal of the switch cover (451) by breaking the frangible members provides a positive and irreversible indication that an 12

attempt has been made to access the audible message of the MC. Once the switch cover (451) is removed, a push button switch (452) is revealed. Depressing the push button (452) activates playback of any audible message that has been transferred to the MC. Figure lb details the underside of a preferred embodiment of a MC body (453) and clearly shows an interface connector (456) and a cover (457) for a user-replaceable battery.

Figure lc provides a perspective view of a MC housing (454) comprising a recess (455) into which the MC body (453) would reside when the MC was ready for delivery. The housing (454) may be of any size and shape and it is envisaged that a number of housing styles may be available to suit different gift giving occasions, all of the housings having a similarly shaped recess (455) to receive a MC body (453). In the preferred embodiment, the MC body (453) includes protuberances (not detailed) on the outer surface (458) of the body (453) that correspond with recesses (not detailed) on the surface of the recess (455) wall such that the MC body (453) is firmly retained within the housing recess (455).

With reference to Figure 2, a block diagram illustrating the main electrical hardware components of a preferred embodiment of a MC is provided. The electrical hardware is contained within the MC body (453) with the interface connector (407) providing for electrical connection to an MA for transfer of an electrically encoded audible message. The MC connector mates with a similar connector on the MA when the MC is placed into the MA cradle recess for programming purposes (refer Figures 3 and 4). All information that may be programmed into a MC (e.g. audible messages, order and checking information) is transferred to the MC from a MA by way of electrical signals coupled by this connector.

The digital storage (404) is used to store any information that is ancillary to the audible message including order information or a digital signature of the audio message. Such information preferably relates to the audio message and: allows tracking of the order throughout a fulfilment process, while maintaining message privacy; allows for checking of each MC unit at dispatch to ensure that purchase order requests such as colour, type of unit, and the like, have been met; allows matching of order information in an order database against unit delivery details; and allows storage of a message time stamp, audio message play-length and vendor details data. Such 13

information in the digital storage (404) can be stored/accessed without the ^■ need to energise or access the main audio message storage (401). Consequently, an audio message stored in the audio storage (401) does not need to be accessed in order to check information of the above type, thereby maintaining a degree of privacy of the audio message.

Further, the digital storage (404), which may comprise an EEPROM or the like, may also store a special encoded sequence of bits that is used by the message assistant to uniquely identify the MC as having been manufactured by an approved manufacturer. This special encoded non-static sequence of bits is stored into the EEPROM at manufacture and must be validated by the MA before any transfer of the audio message (programming) into storage (401) will be allowed to take place, thereby allowing for some protection from "pirate" manufacturers of non-approved MCs.

Additionally, the digital storage (404) may store encrypted voucher information such as lottery ticket information or redeemable voucher information. Storing such information in the MC allows it to be kept essentially inseparable from the audio data, and allows subsequent parties who may handle the MC, such as a courier, to retrieve voucher information without compromising the privacy of the audio data. The audio storage (401) stores the electrically encoded signals that represent the audible message of the sender.

Activation switch logic (405) ensures that the correct timing and voltage levels are transmitted to the audio storage (401) thus enabling a single press of the push button switch (406) to effect the appropriate operation. In the preferred embodiment, the push button switch (406) is used to activate audible play back of any stored audio message in the audio store (401). A user replaceable battery (408) is included as the internal energy source of the MC and provides electrical energy for the playback of audio messages stored in the audio store (401) by way of the speaker (403). The preferred embodiment of the MC also includes speaker control circuitry (402) which acts to amplify the audio signals from the audio store (401) and drive the speaker (403) to an appropriate extent to provide replay of the audio message at a suitable volume. The speaker control circuitry (402) of the preferred embodiment also enables the speaker to be muted as required. The muting function is used when the MA checks the integrity of audio data 14

transferred to a MC and is explained in further detail in the section entitled "Program MC (102)".

Figure 3 provides a representation of a physical embodiment of a MA (549). In the preferred embodiment, the MA effects transfer of an audio message to an MC.

The MA communicates by way of electrical signals with other devices, and in particular with personal computers, by use of an interface cable (556). Power is supplied to the MA by way of the power cable (557).

Similar to the MC housing, the MA includes a recess (555) for receiving a MC. The recess (555) is appropriately dimensioned such that when placed in the recess (555), the electrical connector of an MC is held firmly in contact with the electrical connector (554) of the MA. This provides for the transfer of an electrically coded audio message from the MA to a MC.

The preferred embodiment of the MA includes an internal speaker (550) for producing audible operating messages to a user. The MA also includes an internal microphone (551), various user operable switches (552) and various indicator lights (553) to provide status information to a user.

The MA may be used to transfer encoded audio messages from another system such as a personal computer or may be used directly to capture an audio message from a sender. The user operable switches (552) may include a record switch and a playback switch to allow a user wishing to record a message to speak into the microphone (551) to record an audible message and replay the message through the internal speaker (550) to ensure that the sender is satisfied with the recorded message before transferring it to a MC. In a particularly preferred embodiment, the MC is first placed into the MA and the user activates the "record" function of the MA and speaks into the MA's microphone (551). The audio message is recorded directly into the MC audio storage (401). At this stage, the user may replay the message as stored in the MC by activating the "play" function of the MA. The message is then played through the MC speaker (403) enabling the user to listen to the message as it will be heard by the recipient.

Figure 4 provides a block diagram illustrating the main electrical hardware components of the preferred embodiment of a MA. The MA includes an interface (510), which is preferably a bi-directional interface, to enable communication between the MA micro-processor (508) and other devices. The micro-processor (508) executes a program that controls the 15

operation of the MA and in particular, controls the flow of data to the digital storage (507) and the flow of audio data to the audio decoders and filters (505). The MA software program executing on the micro-processor (508) also controls the audio amplifiers (504), and the sampling of output audio signals from a MC. The program also controls power supply circuits (513), the flow of data to/from the MC by way of the MC interface connector (501), and also provides appropriate responses to any activation of the record push button (511) and play push button (512). Furthermore, the program also controls the flow of data through the communications interface (510). The microprocessor software program resides in the MA as firmware.

The digital storage (507) consists of both volatile and non-volatile memory. The non-volatile memory is used to store sound effects and messages used by the MA. The volatile memory is used as a high speed storage buffer for audio data prior to sending the data to the audio decoder and filters (505). The audio decoders and filters convert digital audio files from a compressed digital format to a non-compressed digital format suitable for conversion to an analogue voltage waveform of audible frequencies. The D/A converter (506) converts sequences of digital numbers representing audio samples into analogue voltage waveforms suitable for storage in a MC. Amplifiers (504) are used to amplify either analogue audio signals to drive a speaker or buffer audio signals for connection to the MC interface connector (501). The MA also includes a speaker (503) which is used to reproduce audio sound effects and messages.

The microphone control (502) is used to capture audio input from a user including messages that the user may wish to send. In this instance, an audio message may be captured and stored into a pre-loaded MC by pressing the "record" button (511) on the MA and speaking into the MA's microphone. The recorded message can then be replayed through the MC speaker by pressing the play button (512). The MC interface connector (501) provides all the electrical connections required for the MA to power, program, check and test the MC electrical hardware.

The power supply control (513) is used to protect the MA from damage should a faulty MC be loaded onto the MA. The power supply control should disconnect power to an MC interface connector (501) upon detecting a short 16

circuit condition. An indication is also provided to the micro-processor (508) of any power supply problems.

Push-button logic (509) is used to detect any activation of the "record" (511) or "play" (512) buttons of the MA. The push-button logic (509) provides an indication to the micro-processor upon detection of any key press.

The record button (511) and recording facility of the MA provides for storage of an audio message to a MC directly without the use of a computer. By pressing the record button (511) and speaking into the MA's microphone, an audio message may be recorded directly to the MC.

The play button (512) and the playback facility of the MA provides for the playback of any message that has been directly stored into the MC (i.e. when the message has not been transferred to the MA by a computer and the message stored in the MC was recorded by use of the record facility of an MA). Pressing the "play" push button a second time acts to cease the playback of any message from an MC.

Figure 5 provides a functional diagram illustrating the main components of an order processing and delivery system. As detailed in Figure 5, a spoken message may be captured from the sender of the gift by various mechanisms including a mobile phone enabled with Wireless

Application Protocol (10), a personal computer (PC) preferably equipped with a sound card and microphone (11), a standard telephone (12), from which a user may place a call to a call centre that is preferably automated and does not require human intervention, a suitably equipped shop front (13) & (15) that is capable of collecting and transferring captured audio data to a storage means, a suitably equipped shop front capable of capturing audio data from a sender and delivering that data to a central processing facility (14), a direct phone call with the audio data being transferred by network delivery (16) and a direct phone call with the audio data being locally delivered (17). In the particular instance of a call centre, a call may initially be answered by a human operator who may establish the order and delivery details prior to switching the call to an automated recording system to capture a message from the sender. Of course, upon switching the call to the recording system, the operator should be prevented from listening to the message as it is dictated by the sender. However, in each instance, the captured audio data is translated into an encoded audio file and transferred to an audio file directory 17

(800). An audio file may be transferred to the audio file directory (800) in one of two ways. Firstly, the file may transferred by way of the telephony application (200) or secondly, by way of the client order and delivery application (700) both of which are described in greater detail below.

Telephony Application (200)

The telephony application executes on a vendor's computer to handle "in-shop" recordings of customer's audio messages. It controls the hardware features of a telephony card that can interface to the vendor's telephone system and a shop-front dedicated phone. This provides the vendor with the ability to capture customer messages from the shop telephone (16 & 17) and from a dedicated phone handset (14 & 15). The dedicated handset will allow customers who physically visit the shop to leave an audio message easily and with a degree of privacy. The telephony application records customer's audio messages and translates them into encoded audio files whilst allowing the customer to review and re-record their audio message (via DTMF control for example) until they are satisfied with the recorded message. The telephony application then stores the encoded audio file in the audio file directory (800) with a reference-name linked to the order details from the client order and delivery application (700).

Client Order and Delivery Application (700) Incoming Local Orders Orders arriving from a shop-front (15) and the shop telephone (17) would be delivered by the vendor locally. All ordering should be processed through the client order and delivery application so that a specific audio file is linked to a given order. For incoming local orders, the client order and delivery application (700) cooperates with the telephony application (200) to create an audio file linked to the order in the audio file directory.

Incoming Network Orders

The Client Order and Delivery Application (700) may also be used by a vendor to collect order details and data from the main order and storage delivery system. The order storage and delivery system is usually located at a remote central facility allowing the retailer to access the order details and 18

data from a networked computer (300) executing the client order and delivery application (700). When a vendor accepts an incoming network order (i.e. an order taken from the order storage and delivery system to be fulfilled by the vendor) and it has an audio attachment with it, the client order and delivery system application collects all the necessary order details and down-loads the audio file into the audio file directory (800) on the vendor's networked computer (300).

Outgoing Network Orders In some organisations, the order flow may originate from the retailer (eg florist shop). In this instance, the client order and delivery application attaches an acquired audio file to the order details and submits the order to the order storage and delivery system. The order can then be fulfilled by another retailer on the network. The audio file is acquired "in-shop" via the telephony application (200) from either a shop-front recording (14) or a direct phone call (16). The file is referenced to the appropriate order and stored temporarily in the audio file directory. When the client order and delivery application is ready to submit the order data, it references the stored audio file in the audio file directory (800) and transfers it to the order storage and delivery system. On acknowledgment that the transfer was successful, the audio file in the audio file directory (800) is deleted.

When an order has been accepted that includes an audio component, it is stored in the audio file directory (800). If the audio file is attached to an outgoing network order, the audio file will be deleted (in due course) when the order is transferred to the order storage and delivery system. If the order is for local delivery by the retailer, the audio file must be collected from the audio file directory and transferred to an MC. This aspect of the process is handled by software executing in the MA (100) in cooperation with the client order and delivery application (700). In the preferred embodiment, the functionality of the MA is partially implemented in a PC with the remainder implemented by a microprocessor under the control of stored firmware in the physical device referred to as the MA. Clearly, the precise division of functionality between the two devices (i.e. PC and MA) may be altered to suit the specific architectures of the two devices and is most likely to be determined by economic considerations. 19

Order information is also stored within the MC and can be read back at a later time to check delivery details if required. This can be used to great advantage by the vendor to ensure the correct MC is delivered to the correct recipient. Of course, access to the recipient data stored in the MC should not provide access to the stored audio message.

Figure 6 is a flowchart illustrating the main processes involved in transferring an audio file from a personal computer, to a MC. Initially, the vendor operator instructs the client order and delivery application (700) that he would like to either program an MC (102) with the present active order or check the details of a pre-loaded MC (117). This would most likely be effected by the user selecting on screen options or by using on screen menu selections. The client order and delivery application (700) then executes MA application software.

Program MC f 102)

Upon selecting the program MC option (102) the client order and delivery application (700) transmits details of any audio files required for transfer. In the preferred embodiment, this is effected by a custom API (Application Program Interface). The MA application software (100) then has the details of the filename and proceeds to check that the audio file exists in the audio file directory (800) and is valid (103). If there is a problem with the audio file then an error message is generated (105). If the audio file is located successfully then it is checked to see if it has been transferred to an MC previously (104). This check maintains the security of the audio message by preventing multiple MCs being programmed.

In the instance of an attempt to transfer an audio file that has previously been transferred, a warning is displayed to inform the user of the potential security breach and an error message is generated (105) indicating to the vendor that the "program MC" command did not execute to completion. An override may be included (7).

If the audio file is valid (103) and has not been transferred to an MC previously, the MA software checks the status of the MA (107). This check includes testing the communications link between the personal computer and the MA and decoding the MA status reply bytes. If there are any problems detected with the MA then an error message will be generated (105), otherwise the MA software checks if an MC is loaded onto the MA (108). 20

This information is established by decoding the MA status bytes. If an MC has not been loaded onto the MA, an error message will be displayed and the entire "program MC" command will be aborted and must be re-started again. If a MC is present on the MA then the MA software interrogates the MA to determine whether or not the MC already contains an audio message (109). If there is no audio message already in the MC then the MC is considered to be new and the MA software progresses to step 113.

If an audio message has previously been transferred into the MC then the order information is retrieved from the digital storage area of the MC. If for some reason the order info cannot be read from the MC (e.g. faulty MC), an error is generated and the vendor is encouraged to discard the MC. If the order information was read correctly then it is displayed to the vendor and the MA software prompts the vendor to determine whether or not they want to erase the audio message and order info in the presently loaded MC (111). At this stage of the process, the vendor may abort the "program MC" command by selecting the option to NOT erase the contents of the MC. Again, an error message will be displayed to the vendor (105) indicating that the "program MC" command failed to complete.

If the vendor is prepared to erase the audio message and order information in the presently loaded MA, then the MA software issues the appropriate command to the MA (112). On completion of the erasure, the MC is checked (113) to ensure that it is functioning correctly. A storage and speaker test is conducted wherein the MA records a "chirp" pulse into the audio storage of the MC and causing the MC to replay the recorded "chirp" pulse immediately through the MCs speaker. At this stage, the vendor is required to acknowledge that a "chirp" pulse was audibly clear. If no chirp pulse is audibly detected, the MC is considered faulty and is discarded. Once an MC test is completed successfully (113), the MA software arranges the transfer and decoding of the audio message from the audio file directory (800) on the vendor's computer to the MC (114). Order information is also transferred into the MC (114). When the audio file and order information have been transferred to the MC, they are checked to ensure they were transferred successfully (115). This involves the MC non-audibly replaying its stored audio message to the MA, which then performs a comparison between the original message (temporarily stored in the MA) and the version stored in the MC and replayed to the MA. If the MC audio message 21

correlates, the message transfer is considered to have been successful. When the MC replays the audio message to the MA, the MA mutes the MC speaker in order to preserve the privacy of the message. In the preferred embodiment, the MC stores an audio message in the form of discrete analogue voltage levels. As such, to determine whether the stored audio data correlates with the audio data captured from the sender, the data stored in the MC is "replayed" thus enabling the MA to monitor the analogue voltage signal output from the MC during playback. The analogue voltage signal is supplied to the MA by way of the interface connector, and upon receipt of the signal the MA digitises the signal for comparison with the audio data that was transferred to the MC. At the same time, the MA activates the muting of the MC speaker. The order information is also retrieved from the MC and checked for correctness. If the transfers were successful, the audio file located in the audio file directory (800) is marked as having been transferred successfully to a MC (116). The audio message will be erased after a prescribed period of time (e.g. 10 days later) according to the vendor's operating policies.

When the "program MC" command has executed successfully by completing step 116, the MA software informs the vendor that the MC can be removed from the MA and be delivered. At this stage, the MA software returns control to the client ordering and delivery application (700) and awaits another command.

Read MC (117) If the "read MC" option is selected, the MA software initially checks the status of the MA (118). This includes testing the communications link and decoding the MA status reply bytes. If there are any problems detected with the MA, an error message will be generated (122), otherwise the MA software checks if an MC is loaded onto the MA (119). This is determined by decoding the MA status bytes. If an MC has not been loaded onto the MA then an error message will be displayed and the "read MC" command will be aborted and must be started again. If an MC is present on the MA, the MA software interrogates the MA to determine whether or not the MC already contains an audio message (120). If there is no audio message in the MC then the MA software informs the vendor and an error message is displayed (122) indicating that the "read MC" command was 22

not successfully completed. However, if an audio message is detected, the order information is retrieved from the digital storage area of the MC and displayed to the vendor (121). If for some reason the order information cannot be read from the MC (e.g. faulty MC), an error is generated and the vendor encouraged to discard the MC. The MA software then returns control to the client ordering and delivery application (700) and awaits another command.

Figure 7 is a flowchart illustrating the main processing steps executed by software resident in a MA used in the preferred embodiment to transfer audio data to an MC. In the preferred embodiment, the software program controlling the operation of the MA resides as firmware stored internally in the MA. The MA implements a command interpreter that regularly checks for instructions from the vendor's computer and also monitors two front panel switches. In the preferred embodiment, the switches are implemented as momentary push buttons.

The MA monitors the input buffer of the communications port (609). If a command from the vendor's computer is not detected (or the MA is not connected to a computer) then it performs internal tests (608) to determine the status of the MA. The status checks include voltage levels, testing short circuit protection circuits and checking environment variables to derive status information. In the event of serious operational problems, a routine within the MA firmware can close down certain sub-systems of the MA to protect sensitive circuitry and operate without outside interaction. For relatively simple problems, the status info (610) is updated and can be captured by way of the communications port of the vendor's computer.

At this stage, the MA determines whether either the "record" (511) or "play"(512) switches have been activated. If there has been no switch activation, the MA again checks for any input on the communications port (609). If the "play" (512) switch is activated, the MA firstly checks whether there is an MC loaded onto the MA (613). If an MC has been detected then the MA checks the digital storage (404) of the MC to verify that the "digital signature" allows the MC to play the stored audio message (614). The digital signature is a security feature that prevents MCs that haven't been programmed by way of a MA from being played. If the "digital signature" allows the MC to be played the MA transmits a control signal to the MC to replay the stored audio message (615). If the "play" (512) switch is activated 23

while the MC is already replaying a message then the MC will cease playback. The MA then returns to check for any traffic input to the communications buffer (609).

If at 612 the MA detects an activation of the "record" (511) switch, the MA firstly checks that an MC has been loaded onto the MA (620). The MA then checks whether an audio message may be recorded onto the presently loaded MC (616). It may be desirable in some instances to NOT allow a recording to occur to avoid accidental erasure of a prior message. To a large extent, the decision at this stage will depend upon the practice of individual vendors, however, only recording to blank MCs or MCs with the appropriate "digital signature" may be the default setting. If the loaded MC is able to have an audio message recorded then an audio message is captured through the microphone on the MA front panel (551) and through the MC interface connector (501). The message will be recorded for as long as the "record" switch (511) on the MA is activated, or 30 seconds has elapsed (or the audio storage is not full), whichever is the shorter. When recording of a message is complete the "digital signature" is updated in the digital storage (404) of the MC (619). The MA then returns to check for any traffic input to the communications buffer (609). If communications traffic has been detected on the MA communications port from the operator's computer, then the MA collects the information in a buffer and checks its format (609). If the format is recognised, the MA replies to the vendor's computer with a byte stream representing the MA operating status (601). The MA then decodes the information into command data and checks that it is valid (602). If the decoded command is not valid then the MA error status is set (605) and the MA sends the MA operating status to the vendor's computer (606) and returns to check for any more traffic input to the communications buffer (609). If the command is decoded as valid at 602, then the MA executes the command (603 & 604). When the command has been executed by the MA, the error status is updated to reflect any problems that may have occurred during the command execution (605). The MA then sends the MA operating status to the vendor's computer (606) and again, returns to check for any more traffic input to the communications buffer (609). Figure 8 is a circuit diagram of a preferred embodiment of an MC. The circuit effects the following functions: 24

stores a 30 second audio message in non-volatile memory; replays a 30 second audio message upon activation of a switch;

- ceases the playback of a stored audible message upon activation of a switch;

- store order tracking information and digital signatures; and

- mute the audio playback.

With reference to Figure 8, the MC circuit operation is controlled through the MC interface connector and push-button. The circuit operation can be sub-divided into the following functions:

Message Playback and Stop (push-button)

If the MC is stand alone, already has a message stored in it and is loaded with a battery then the message can be replayed audibly by pressing the push-button (476). When the push-button (476) is pressed it causes a low going pulse to arrive at pin 23 of the ISD2532 chip (477) via 474 and 471. The ISD2532 is a single chip voice record/playback device that is set up in push-button mode permanently by pulling pins A6, A7 and A8 pins high. Pin 27 of the ISD2532 is also high so that when the low going pulse arrives at pin 23 (CE) it is interpreted as start signal for message playback. The stored audio message is then replayed through the attached speaker (487). At the same time the EOM pin goes high to indicate message playback. If the message finishes then the EOM pin goes low which causes a high going pulse to arrive at pin 24 (PD) via 479, 480 and 481. A high-going pulse at the PD pin is interpreted by the ISD2532 chip as a reset and power down signal. This causes the ISD 2532 chip to reset its address pointer and shut itself down into low power mode to conserve battery power. The ISD 2532 chip will remain dormant until the push-button is pressed again. If the push - button is pressed when the MC is already playing a message then a low going pulse again arrives at pin 23 (pin 27 still high). This time the pulse is interpreted by the ISD2532 as a pause signal and stops playing the audio message. This causes the EOM pin to go low which in turn resets and powers down the ISD2532 via 479, 480 and 481. As such the audio message can be stopped by a second press of the push-button.

Thus the message playback functions described above allow recipients of the stand alone MC to start and stop (with rewind) message playback by a simple toggle push-button switch (476). 25

Message Playback and Stop (via MC interface connector)

If the MC already has a message stored in it then the message can also be replayed via a high going pulse on pin 2 of the MC interface connector. When a high going pulse on pin 2 of the MC interface connector is detected it causes a low going pulse to arrive at pin 23 of the ISD2532 chip (477) via 474 and 471. The ISD2532 is a single chip voice record/playback device that is set up in push-button mode permanently by pulling pins A6, A7 and A8 high. Pin 27 of the ISD2532 is also high so that when the low going pulse arrives at pin 23 (CE) it is interpreted as start signal for message playback. The stored audio message is then replayed through the attached speaker (487). At the same time the EOM pin goes high to indicate message playback. If the message finishes then the EOM pin goes low which causes a high going pulse to arrive at pin 24 (PD) via 479, 480 and 481. A high-going pulse at the PD pin is interpreted by the ISD2532 chip as a reset and power down signal. This causes the ISD 2532 chip to reset its address pointer and shut itself down into low power mode to conserve battery power. The ISD 2532 chip will remain dormant until another high going pulse on pin 2 of the MC interface connector is detected. If a high going pulse on pin 2 of the MC interface connector is detected when the MC is already playing a message then a low going pulse again arrives at pin 23 (pin 27 still high). This time the pulse is interpreted by the ISD2532 as a pause signal and stops playing the audio message. This causes the EOM pin to go low which in turn resets and powers down the ISD2532 via 479, 480 and 481. As such, a second high going pulse on pin 2 of the MC interface connector stops the audio message playback.

Mute (via MC interface connector)

The MC audio playback can be muted by controlling pins 3 and 4 of the MC interface connector. This function is used to ensure that the verification of a successful audio transfer can be undertaken inaudibly.

Record (via MC interface connector)

The MC can be put into record mode by pulling pin 6 of the MC interface connector low. A high going pulse on pin 2 of the MC interface connector will cause a low going pulse to arrive at pin 23 of the ISD2532 26

chip. This low going pulse will be interpreted by the ISD2532 as a start recording signal. Any analogue waveform present on pin 10 of the MC interface connector will then be recorded into the non-volatile memory within the ISD2532 chip. Recording will continue for at least 30 seconds or until a second high going pulse is detected on pin 2 of the MC interface connector. This will be interpreted by the ISD2532 as a stop recording signal. This causes the EOM pin to go low which in turn resets and powers down the ISD2532 via 479, 480 and 481. The audio waveform presented to the MC on pin 10 of the MC interface connector has now been captured by the ISD2532 chip.

Power Supply

The MC can be powered through the MC interface connector. Pin 1 is the power and pin 16 is ground. Capacitor 485 provides power supply decoupling. The MC can also be powered by a battery (490) for stand alone operation. Diode 491 in the circuit diagram is for reverse polarity protection in case the battery is inserted incorrectly.

Microphone pre-amp and AGC The ISD2532 chip has an in-built microphone pre-amp circuit with

AGC that can be accessed through the MC interface connector. This allows for a microphone to be connected directly to the ISD2532 for audio capture. Pin 7 and 8 of the MC interface connector (489) provide access to theses microphone inputs and pin 9 provides access to the AGC (automatic gain control) for controlling the microphone pre-amp gain. Pin 11 of the MC interface connector provides the analogue output from the microphone pre- amp.

Digital Information Storage and Retrieval The MC has an EEPROM digital storage chip (484) that allows digital information to be stored and retrieved via a serial interface. The serial interface is accessible on pins 12 and 13 of the MC interface connector. The EEPROM is also powered from pin 14 of the MC interface connector to conserve battery power and capacitor 482 is used as a decoupling capacitor on the power supply of the EEPROM. 27

In block 114 and 115 of Figure 6 of the flowchart for the MA software, the following steps are undertaken to transfer the message to the MC and then check the transferred message integrity:

(1) Digital audio file down-load to MA via MA Software

The digital audio file nominated by the vendor operator using the client order and delivery application (700) is down-loaded into the MA's digital memory (507) via the communications link between the operator's computer and the MA. This is achieved through a series of command and data transactions controlled by the MA software (see Figure 6) at the vendor's computer end and the MA firmware running at the MA end (Figure 7). Once in the MA's digital memory the audio file's message is ready to be transferred to the MC by the MA.

(2) Audio message transfer MA to MC

An audio message can be stored into the MC from the MA via the MC interface connector (407). Firstly pin 27 (P/R) must be pulled low via MC interface connector pin 6 to put the ISD2532 chip into message record mode. The MA then issues a high going pulse to the pin 2 of the MC interface connector to start the recording process. The MA then recalls the audio data file from its digital storage memory (507) and converts it to an analogue waveform (via 505, 506 and 504) which is then fed into pin 10 of the MC interface connector. Pin 10 of the MC interface connector connects the analogue waveform to the analogue input (pin 20) of the ISD2532 chip. The MA samples the audio waveform being sent to the MC and stores the samples for later comparison. The recording continues until the entire digital audio file has been decoded/decrypted and transferred into the ISD2532 chip. When complete the MA issues another high going pulse on pin 2 of the MC interface connector. This causes the ISD2532 chip to reset and shutdown. The audio message is now safely stored in non-volatile memory inside the ISD2532 chip. The MA then sets pin 6 and pin 14 of the MC interface connector high to put the ISD2532 into playback mode and provide power to the digital EEPROM respectfully. The MA then uses pins 12 and 13 of the MC interface connector to clock serial data into the EEPROM. This data relates to order tracking info and digital signatures 28

(3) Audio message and order data transfer verification Now that the digital audio file in the MA has been converted to an analogue waveform and transferred into the MC in real time, it must be checked to ensure that it has been recorded fully and without error. This is done by firstly muting the MC then replaying the stored message in the MC to the MA. As the audio message from the MC is replayed the MA samples the audio waveform and stores the samples in digital memory (507). When the message in the MC has completed playback (pin 15 on MC interface connector goes low) the MA then compares the digital samples with the original samples taken during the transfer/recording process. A set of standard statistical functions is run over the two sample files to determine their correlation. Based on the results from these functions the MA can accurately determine whether or not the audio message has been transferred correctly from the MA to the MC. The MA then uses pins 12 and 13 on the MC interface connector to clock serial data out of the EEPROM to check that it matches the data sent to the MC as part of the digital audio file down-load process. Any error information is sent to the operator's computer via the MA's communications interface.

Stand Alone MA Recording & Playback Details

If the MA is not connected to a computer network and is operating as a stand alone system, then it is possible for users to record an audio message to the MC loaded on the MA using the internal microphone of the MA.

MC Message Recording via in-built Microphone

The MA firmware is always monitoring the 'record' (511) and the 'play' (512) buttons of the MA for a key-press (612). From Figure 7 of the MA firmware flowchart, audio recording through the MA microphone takes place in block 617. When the 'record' button is pressed and detected by the MA, an MC is loaded (620) and the appropriate clearances have been given (616), the MA firstly sets pin 6 of the MC interface connector low to put the ISD2532 chip into the record mode. The MA then connects the microphone pre-amp output of the ISD2532 chip on pin 11 of the MC interface connector to pin 10 of the MC interface connector. Pin 10 of the MC interface connector connects directly to the analogue input pin on the ISD2532 chip. The MA then issues a high going pulse on pin 2 of the MC interface connector which is 29

interpreted by the ISD2532 chip of the MC to start recording. Pins 7, 8 and 9 of the MC interface connector are always connected to the microphone control circuit (502) thereby providing the necessary biasing for the MA microphone and AGC for the ISD2532 pre-amp. For the AGC to work correctly, a parallel RC circuit (R=470Kohms, C=4.7uF) must be connected to pin 9 of the MC interface connector. The MA circuitry provides these components.

Recording of the audio message from the MA microphone will continue for 30 second or until the "record' button is released. If the 'record' button is released before the 30 second message time limit, the MA issues a second high going pulse on pin 2 of the MC interface connector. This causes the recording process to finish and the MCs ISD2532 chip (477) to reset and enter low power mode.

The MA then installs a "digital signature" into the MCs EEPROM via pins 12 and 13 of the MC interface connector. This is to identify that the audio message now stored in the MCs ISD2532 chip has come from an MA microphone recording.

Hence the MA has provided the necessary control signals and connectivity via the "record" push-button and MC interface connector to allow audio capture directly from the in-built MA microphone to the MCs

ISD2532 speech storage chip (477).

MC Message Playback via MA Play Push -Button

An MC loaded onto an MA will playback a stored audio message through its speaker (i.e. the MC speaker) when the 'play button on the MA (512) has been pressed if the audio message was originally recorded using the in-built MA microphone.

When the 'play^* button is pressed and detected by the firmware running in the MA (Figure 7), it firstly checks to see if there is an MC loaded onto the MA (613). If an MC is present then the "digital signature" in the MC is down-load from the MC EEPROM through pins 12 and 13 of the MC interface connector. The signature is checked by the MA (614) to verify that, if there is an audio message stored in the MC that it was recorded using the MA's in-built microphone. If the signature verifies that the message was recorded by the MA microphone then the MA issues the required sequence of 30

playback signals to the MC through the MC interface connector as described in the Message Playback and Stop (via MC interface connector).

Turning now to Figure 9, a pictorial representation of an order fulfilment system in accordance with the present invention is shown. At 801, a customer telephones a call centre to order a personalised gift message product. After taking the appropriate details, a call centre attendant transfers the customer to an automated voice-mail facility. At 802, the voice-mail facility captures the customer's audio message privately using automated voice-prompts and touch-tone commands. The audio message (an audio file) is then indexed (attached) to the order information. A text message can also be collected for conversion to audio. At 803, customers can also leave their audio message by viewing a web site. A Recording Studio Applet will allow customers to record and replay their audio message from within their browser. When they are happy with their recording they can then submit it with their order.

At 804, the customer's order details and audio file are privately sent to a centralised facility for incorporation into a message core. At 805, the customer's audio message is decoded (or translated into an audio file from a text message) and programmed into a Message Core via the Message Assistant hardware discussed previously. The Programmed Message Core now contains the customer's audio message. The Core is then "snapped-into" the appropriate shell at 806 depending on the customer's order selection(s). The stand-alone personalised gift message product is then ready to be delivered. Figure 10 is a pictorial representation of a further order fulfilment system in accordance with the present invention. At 1001, the customer telephones the call centre to order their gift. After taking the appropriate details the call centre attendant transfers the customer to an automated voice- mail facility. At 1002 the voice-mail facility captures the customer's audio message privately using automated voice-prompts and touch- tone commands. The audio message (an audio file) is then indexed (attached) to the gift order information. At 1003, customers can also leave their audio message by viewing a web site. A Recording Studio Applet will allow customers to record and replay their audio message from within their browser. When they are happy with their recording they can then submit it with their gift order. The order information is collected at 1004 by the dispatch / fulfilment centre. The audio message is also collected from the Order Storage and Processing 31

System. At 1005 the customer's audio message is decoded and programmed into a Message Core via the Message Assistant hardware. The Programmed Message Core contains the customer's audio message. The Core is then at 1006 "snapped-into" the appropriate shell depending on the customer's order selection(s). The personalised audio gift accessory is now ready to be delivered with the customer's selected gift. Of course, the personalised audio gift accessory may be the gift itself.

Throughout this specification the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated element, integer or step, or group of elements, integers or steps, but not the exclusion of any other element, integer or step, or group of elements, integers or steps.

It will be appreciated by persons skilled in the art that numerous variations and/or modifications may be made to the invention as shown in the specific embodiments without departing from the spirit or scope of the invention as broadly described. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

32

CLAIMS:

1. A method of privately recording audio data into a storage means for access by an intended recipient, the method comprising the steps of: privately recording the audio data into the storage means; and prior to providing said storage means to the intended recipient, privately retrieving the recorded audio data from the storage means and privately comparing the retrieved recorded audio data with original audio data in order to verify the integrity of the recorded audio data.

2. The method of claim 1, wherein the step of privately comparing comprises a digital comparison of digital audio data, carried out by computing means without direct human intervention.

3. The method of claim 2 wherein the digital data comparison comprises a statistical analysis of both the retrieved recorded audio data and the original audio data. 4. The method of claim 2, wherein the digital comparison comprises a bit- by-bit comparison.

5. A storage means for recording audio data for access by an intended recipient, the storage means comprising: means for audible playback of the audio data for the intended recipient; and means for private retrieval of the recorded audio data, to enable a private comparison of retrieved recorded audio data with original audio data in order to verify the integrity of the recorded audio data.

6. A storage means in accordance with claim 5, further comprising a bi- directional data interface, enabling a transfer of audio data into the storage means for recordal, and enabling retrieval of recorded audio data out of the storage means for the purposes of private comparison.

7. A system for privately passing audio data to an intended recipient, the system comprising: means for privately receiving audio data for an intended recipient; means for privately recording the audio data into a storage means; means for privately retrieving recorded audio data from the storage means; and means for privately comparing retrieved recorded audio data with received audio data in order to verify the integrity of the recorded audio data.

8. A storage means according to claim 5 or claim 6, further comprising:

Claims

33

a first storage space for recording audio data; a second storage space for recording identification data associated with the audio data; and a data interface for transfer of data to and from the storage means, the data interface enabling recordal of audio data into the first storage space of the storage means, and enabling retrieval of recorded identification data from the second storage space without accessing the first storage space. 9. A storage means in accordance with claim 8 wherein the data interface further enables storage of identification data into the second storage space. 10. A storage means in accordance with claim 8 or claim 9 wherein the identification data recorded in the second storage space is in an encrypted form.

11. A storage means in accordance with any one of claims 8 to 10 wherein the identification data comprises information identifying the intended recipient for delivery of the storage means.

12. A storage means in accordance with any one of claims 8 to 11 wherein the identification data comprises data identifying an intended date of delivery of the storage means to the intended recipient.

13. A storage means in accordance with any one of claims 8 to 12 wherein the identification data comprises data identifying an order number.

14. A storage means in accordance with any one of claims 8 to 13 wherein the identification data comprises data identifying accompanying items which are required to be delivered to the intended recipient with the storage means.

15. A storage means in accordance with any one of claims 8 to 14 wherein the identification data comprises data uniquely identifying the storage means.

16. A storage means in accordance with any one of claims 8 to 15 wherein the identification data comprises data identifying a manufacturer of the storage means.

17. A storage means in accordance with any one of claims 8 to 16 wherein the identification data comprises data identifying a voucher redeemable by the intended recipient.

18. A storage means in accordance with any one of claims 8 to 17 wherein the identification data comprises data identifying a lottery ticket redeemable by the intended recipient. 34

19. A storage means in accordance with any one of claims 8 to 18 wherein the identification data comprises data identifying a time period during which the audio data remains valid.

20. A storage means in accordance with claim 19 wherein the audio data comprises advertisement information valid only for the time period.

21. A storage means in accordance with claim 19 or claim 20, wherein the identification data comprises data identifying a plurality of time periods, and identifying different portions of the audio data which are valid during each time period. 22. A storage means in accordance with claim 21 wherein the different portions of audio data comprise rolling advertisement information. 23. The method of any one of claims 1 to 4, wherein the step of privately recording comprises recording the audio data in a first storage space of the storage means, the method further comprising the steps of: recording identification data associated with the audio data in a second storage space of the storage means; and prior to delivery of the storage means to the intended recipient, retrieving recorded identification data from the second storage space of the storage means without accessing the first storage space. 24. The method of claim 23 wherein the identification data comprises data identifying the intended recipient for delivery of the storage means.

25. The method of claim 23 or claim 24 wherein the identification data recorded in the second storage space is in an encrypted form.

26. The method of any one of claims 23 to 25 wherein the identification data comprises data identifying an intended date of delivery of the storage means to the intended recipient.

27. The method of any one of claims 23 to 26 wherein the identification data comprises data identifying an order number.

28. The method of any one of claims 23 to 28 wherein the identification data comprises data identifying accompanying items which are required to be delivered to the intended recipient with the storage means.

29. The method of any one of claims 23 to 28 wherein the identification data comprises data uniquely identifying the storage means.

30. The method of any one of claims 23 to 29 wherein the identification data comprises data identifying a manufacturer of the storage means. 35

31. The method of claim 30 further comprising the steps of retrieving the identification data, and determining whether the storage means has been manufactured by an approved manufacturer.

32. The method of any one of claims 23 to 31 wherein the identification data comprises data identifying a voucher redeemable by the intended recipient.

33. The method of claim 32 further comprising the step of notifying the intended recipient of the voucher at the time of delivery of the storage means.

34. The method of any one of claims 23 to 33, wherein the identification data comprises data identifying a lottery ticket redeemable by the intended recipient.

35. The method of claim 34 further comprising the step of notifying the intended recipient of the lottery ticket at the time of delivery of the storage means. 36. The method of any one of claims 23 to 35, further comprising the step of accessing the identification data without accessing the audio data, in order to determine delivery requirements of the storage means.

37. The method of any one of claims 23 to 36, wherein the identification data comprises data identifying a time period during which the audio data remains valid.

38. The method of claim 37, wherein the audio data comprises advertisement information valid only for the time period.

39. The method of claim 37 or 38, wherein the identification data comprises data identifying a plurality of time periods, and identifying different portions of the audio data which are valid during each time period.

40. The method of claim 39 wherein the different portions of audio data comprise rolling advertisement information.

41. The system of claim 7 wherein the means for privately recording is operable to record the audio data in a first storage space of the storage means, and wherein the system further comprises: means for recording identification data associated with the audio data in a second storage space of the storage means; and means for retrieving recorded identification data from the second storage space of the storage means without accessing the first storage space. 42. The system of claim 41 wherein the identification data comprises data identifying the intended recipient for delivery of the storage means. 36

43. The system of claim 41 or claim 42 wherein the identification data recorded in the second storage space is in an encrypted form.

44. The system of any one of claims 41 to 43 wherein the identification data comprises data identifying an intended date of delivery of the storage means.

45. The system of any one of claims 41 to 44 wherein the identification data comprises data identifying an order number.

46. The system of any one of claims 41 to 45 wherein the identification data comprises data identifying accompanying items which are required to be delivered to the intended recipient with the storage means.

47. The system of any one of claims 41 to 46 wherein the identification data comprises data uniquely identifying the storage means.

48. The system of any one of claims 41 to 47 wherein the identification data comprises data identifying a manufacturer of the storage means. 49. The system of any one of claims 41 to 48 wherein the identification data comprises data identifying a voucher redeemable by the intended recipient.

50. The system of any one of claims 41 to 49 wherein the identification data comprises data identifying a lottery ticket redeemable by the intended recipient

51. The system of any one of claims 41 to 50 wherein the identification data comprises data identifying a time period during which the audio data remains valid.

52. The system of claim 51, wherein the audio data comprises advertisement information valid only for the time period.

53. The system of claim 51 or 52, wherein the identification data comprises data identifying a plurality of time periods, and identifying different portions of the audio data which are valid during each time period.

54. The system of claim 53 wherein the different portions of audio data comprise rolling advertisement information.

55. The method of any one of claims 1 to 4 and 23 to 40, further comprising the step of enabling activation of the storage means by the intended recipient to access the stored audio data, such that said activation provides a positive indication that an attempt to access the stored audio data has occurred. 37

56. The method of claim 55 wherein the audio data is stored in an encrypted form at a time of collecting the audio data, and remains in the encrypted form until it is transferred into the storage means.

57. The method of any one of claims 1 to 4, 23 to 40, 55 and 56, further comprising the step of testing functioning of the storage means in recording and replaying audio data.

58. The method of claim 57 wherein the step of testing is performed prior to the step of privately recording audio data for an intended recipient into the storage means. 59. The storage means of any one of claims 5, 6 and 8 to 22, wherein upon accessing audio data from the storage means an indication of said access is provided.

60. The storage means of claim 59 wherein the indication is a substantially irreversible indication such that the storage means clearly indicates to a subsequent user a prior attempt to access the data.

61. The storage means of any one of claims 5, 6, 8 to 22, 59 and 60, further comprising a replaceable energy source to enable repeated playback of the stored message.

62. The storage means of claim 59 or 60 further comprising at least one switch operable to activate playback of the audio data, wherein the at least one switch is enclosed by a frangible member such that the frangible member must be broken in order to activate the at least one switch, thereby providing said indication.

63. The system of any one of claims 7 and 41 to 54, further comprising: means for accessing audio data recorded in a storage means, wherein said access provides an indication that an attempt to access the recorded audio data has occurred.

64. The system of any one of claims 7, 41 to 54 and 63, further comprising means for testing functioning of the storage means in recording and replaying audio data, prior to recording the audio data for the intended recipient into the storage means.

65. The system of claim 64 wherein the means for testing is operable to input a known audio signal into the storage means for audible replay by the storage means, enabling the means for testing to electronically validate the audio output of the storage means and thus verify correct operation of the audio sub-system. 38

66. The method of any one of claims 1 to 4, 23 to 40 and 55 to 58, further comprising the step of attaching the storage means to a housing of a size and/or shape being characteristic of the circumstances relating to the purpose for which the data was sent from the sender to the recipient.

1/10

Fig. lc