-
The present invention relates to a device for the controlled supply of products,
comprising control means which are able and adapted to receive payment means and
to record settlement of an amount due in order to then release at least one product for
supply to a user, wherein the payment means comprise an electronically accessible
information carrier which is adapted and able to provide access to a balance of the
user.
-
Such a device provides a complement to counter sales for the sale of products at
locations or times where for various reasons counter sales are not desirable, necessary
or feasible, and will hereafter be designated as machine vending. The term product
must be interpreted broadly here such that it means not only physical articles but also
services which are offered for payment.
-
A known device of the type stated in the preamble comprises a substantially closed
housing with input means for paying an amount owed for the selected product. The
input means may be an input slot for notes or coins, but machines are increasingly
being equipped with a card reader for receiving electronic payment means, which then
allow access to a balance of the user, from which the amount due can be transferred.
With these electronic payment means there are different possibilities. This may
involve a transfer from a balance stored on the payment means themselves, or a
transfer from a balance which is stored on a remote computer system and with which
contact is sought during the transaction. In the former case the payment means will
usually comprise an integrated electronic circuit for carrying out the required
authentication and mutation steps of the transaction process, while in the latter case
simpler payment means suffice, which are based for instance on a magnetic strip on
which are stored data relating to the identity of the user and his account.
-
Although machine vending has many advantages, it also has drawbacks. A significant
drawback is that the sometimes desirable supervision is lacking in machine vending.
This is particularly the case with products whose sale is only permitted, by the
-
Although machine vending has many advantages, it also has drawbacks. A significant
drawback is that the sometimes desirable supervision is lacking in machine vending.
This is particularly the case with products whose sale is only permitted, by the
authorities or others, to persons above a determined minimum age. Here can be
envisaged for instance all sorts of stimulants, such as tobacco products and alcoholic
drinks, which may not be sold to persons below a determined age. Services such as
showing a film or providing a game of chance are also often subject to regulations
where the age of the customer is relevant. Since in a known device of the type
described in the preamble there is no check at all on the age of the consumer, machine
vending of these and other types of product has thus far not been possible when age
restrictions are imposed thereon.
-
The present invention has for its object, among others, to provide a device of the type
stated in the preamble, which obviates this drawback in that a reliable age verification
can be performed thereby.
-
In order to achieve the intended object, a device for the controlled supply of products
of the type stated in the preamble has the feature according to the invention that the
information carrier is provided with programmable memory space for receiving
therein at least one indicator of the age of a user, and that the control means are able
and adapted to read said memory space and to release the at least one product for
supply only when a prescribed age has been established. The age indicator thus read
by the device determines whether or not a product can be obtained from the device.
By making use of electronic payment means, which provide access to a balance of the
user, for the storage of such an age indicator, a user who is of age is prevented to a
significant extent from handing over his card for use by a minor and thus providing
the latter with access to the products, since access to this balance is hereby also
provided. Electronic payment means are furthermore strictly personalized, so that
abuse can be easily traced back to the original user. The age indicator is recorded or
mutated on the payment means by a reliable party within the organisation responsible
for managing and optionally the issue of the payment means. This must be subject to
further safety requirements to be fixed, such as for instance showing identification
documents which adequately show the age of the user. An age-linked sale of products
from machines can thus be achieved which is at least as watertight as counter sales.
-
In respect of the sale of articles such as tobacco products, alcoholic drinks, film
carriers and the like strictly to persons above a determined minimum age, a particular
embodiment of the device according to the invention is characterized in that the
products comprise one or more articles which are received in at least one product
holder, and that the at least one product holder is provided with release means which,
when energized, are adapted to release for supply at least one of the articles from the
product holder and which are coupled to the control means to receive a control signal
therefrom. By thus activating the release means from the control means, which only
generate the required control signal when the minimum age indicator is recorded, it is
avoided that a user can remove the product from the device without having available
an information carrier with the required age information.
-
In a preferred embodiment the device according to the invention is characterized in
that the information carrier comprises a convenient card body provided with an
integrated circuit with said memory space. Such a card body is normally designated as
chip card or smart card and provides the advantage that the entire transaction relating
to the supply of products can be dealt with locally. A telecommunication connection
and telecommunication means for making connection to a remote computer system
can hereby be omitted, which significantly simplifies the placing of new devices and
possible modification of existing ones. In a further preferred embodiment the device
according to the invention has the feature that the information carrier is compatible
with a system for transfer of funds via banks. In this embodiment there is connection
to information carriers for transfer of funds via banks, such as bank cards and credit
cards and the like such as have now been introduced on a large scale and have a high
degree of acceptance among the population. The issue, management and use of such
cards are furthermore protected by the necessary safety procedures, whereby the
device according to the invention also gains in reliability.
-
Although the device according to the invention can remain suitable, either exclusively
or not, for the input of coins and notes, in which case the information carrier is used
solely for the necessary age verification, a further preferred embodiment of the device
according to the invention is characterized in that the control means are able and
adapted to transfer the amount due from a balance of the user which is accessible by
means of the payment means. In this case payment by means of the electronic payment
means is possible in addition to or instead of payment by notes or coins.
-
From a viewpoint of protecting more or less privacy-sensitive personal data, a further
particular embodiment of the device according to the invention has the feature that the
at least one at least age indicator comprises a logical indicator which indicates that a
prescribed age has been reached by a user. In this case it is not the age of the user
which is stored on the card, but only whether or not he/she complies with the set age
limit. When the card is misused, it is therefore only this information which can be
traced. This will usually be an age limit of, typically, between 16 and 21 years of age,
so that in the unlikely event that only such a logical age indicator becomes known,
this does not encroach, or hardly so, on the personal life of the user. For further
protection of the personal data of the user, a further embodiment of the device
according to the invention has the feature that information in the memory space is
stored in encrypted form.
-
The integrity of the device according to the invention greatly depends on the integrity
of the parties charged with the registration and mutation of age indicators on the
payment means. In order to prevent misappropriation in this area, a further particular
embodiment of the device according to the invention has the feature that, in addition
to the at least one age indicator, the memory space also contains an indication of a
point of issue of the information carrier. In the case of misuse, the payment means
used therein for this purpose can thus be traced directly back to the point of issue. By
collecting these data, statistical relationships can thus be made and conclusions drawn
for the purpose of identifying an unreliable point of issue within a short time. This is
possible particularly in a further embodiment of the device according to the invention
which is characterized in that a memory space is provided therein for storage of
transaction data per delivered product. In this case transaction data can be stored
during each transaction and later analysed and read, if desired. These transaction data
comprise for instance data which have been read from the payment means employed,
such as, in addition to an identification of the payment means themselves, for instance
also an identification of the point of issue thereof. For this purpose a further
embodiment of the device according to the invention has the feature that the
transaction data comprise an encryption of an identification of the used information
carrier, of a point of issue thereof and of the control means. Misuse can be traced
more easily using these data. The encryption of the data recorded for this purpose
avoids on the one hand the possibility of privacy-sensitive data relating to the
purchases of a user being retrieved without the required decryption keys and on the
other hand the possibility of the data being manipulated without these keys.
-
The present invention furthermore relates to a programming device for use in
combination with the above described device according to the invention for the
controlled supply of products, comprising input means for receiving the information
carrier, an interface for data exchange with the information carrier and a central
processor unit. According to the invention such a programming device has the feature
that the central processor unit, loaded with software provided for this purpose, is able
to provide access to the memory space of the information carrier and therein mutate
an indicator of the age of the user. In a completely operational system such
programming devices are distributed to one or more locations whose reliability and
integrity are deemed sufficient. Users can go to these locations to provide the
information carrier held by them with an age indicator, or in any case activate it. This
step can be accompanied by the necessary safeguards, such as for instance compulsory
identification with a means of identification which shows the age of the user, so that
deception of the system can be avoided. From this moment the information carrier is
suitable for use in the above described device for the controlled supply of products.
-
The integrity of the system of controlled, age-linked delivery of products intended
with the invention is greatly dependent on the integrity of the people responsible for
operating the programming device. In order to monitor this, a particular embodiment
of the programming device according to the invention has the feature that a memory
space is provided therein for storing transaction data per mutated information carrier,
and more in particular in that the transaction data are stored in encrypted form.
Through the storage of transaction data, including for instance the identity of the
operator and the information carriers programmed by him or her, the source of misuse,
when detected, can be traced relatively easily. The storage of the transaction data in
encrypted form avoids the possibility of the data being manipulated by unauthorized
persons.
-
A further particular embodiment of the programming device has the feature according
to the invention that the programming device is provided with a telecommunication
interface so that it can be coupled to telecommunication means and is able to transmit
the transaction data, optionally periodically, to a remote computer system. This
embodiment provides a centralized storage and a centralized management of the
transaction data, so that when fraud or other misuse has been established, these data
are directly accessible and available.
-
The invention further relates to payment means for application with an above
described device, comprising a convenient, card-like body provided with at least one
integrated electronic circuit with memory space which is allocated for receiving
therein at least one indicator of an age of a card holder.
-
The invention will be further elucidated hereinbelow on the basis of an embodiment
and an associated drawing. In the drawing:
- figure 1
- shows a device for the controlled supply of products according to an
embodiment of the invention;
- figure 2
- shows an embodiment of product release means as applicable in the
device of figure 1; and
- figure 3
- shows an embodiment of programming means for use in combination
with an electronically accessible information carrier according to the
invention.
-
The figures are otherwise purely schematic and not drawn to scale. For the sake of
clarity some dimensions in particular are exaggerated to a greater or lesser extent.
Corresponding parts are designated in the figures as far as possible with the same
reference numeral.
-
Figure 1 shows a device for the controlled supply of products according to an
embodiment of the invention. This is a vending machine for tobacco products. The
device comprises a robust, substantially closed housing 1 in which a number of
product holders 2 are arranged. Product holders 2 serve to receive the products for sale
and in this embodiment each comprise a different type or brand of cigarettes, which
are packaged per twenty in standard-size boxes 3. The boxes of cigarettes thus lie
enclosed in a continuous column in the relevant product holders 2. The device further
comprises input slots 51,52 for coins respectively banknotes in addition to a card
reader 53 for electronic payment means in the form of a card-like, electronically
accessible information carrier 5 which provides access to a balance of the user, from
which the amount due can be transferred. Use is made in this embodiment of a "chip
card" or "smart card". This is a card, normally manufactured from plastic, in which an
electronically integrated circuit is incorporated, the so-called "chip". The chip
comprises a processing unit, an electronically readable memory, in which is stored,
among other things, balance or credit information, and is provided with a number of
electrical contacts for communication with the outside world. The card 5 applied here
is compatible with a public system for electronic transfer of funds via banks and for
this purpose is designed to support cryptographic processes as are applied for safety
reasons in electronic payment transactions. The device is thus able to accept an
amount payable for a product in various ways.
-
Product holders 2 are provided on their outer end with release means 4 enabling
controlled release of a product 3 from the holder. A product is only released if the
payment of an amount due therefor is recorded by control means not further shown
here. Figure 2 further shows an embodiment and the operation of such release means,
although within the scope of the invention many other forms of release means,
assumed to be sufficiently known to the person with ordinary skill in the art, can be
applied instead. In this embodiment use is made of release means in the form of two
sets of holding projections 42,43. In the position of rest shown under A the last and
last but one products 32,33 each rest on a pair of holding projections 42,43
respectively. By energizing the bottom pair of holding projections 43, see B, these
open to release the bottom product 33. The last holding projections 42 but one herein
hold the other products in place. The purchased product 33 is thus withdrawn from
product holder 2 and falls into a delivery compartment 6 of the device. The product
can be removed herefrom by the user. After the product has thus been delivered, the
bottom holding projections close again, see C, and the other pair of holding
projections 42 is then energized to cause the products to shift up one position, see D.
Finally, the last pair of holding projections 42 but one also closes in order to once
again take up the starting position shown under A. An alphanumeric image display
panel 7 provides the user with the necessary information and instructions during the
whole process, while the user can make a product choice by means of a keypad 8
provided for the purpose. Any invalid or otherwise unusable coins and change are
returned to the user via delivery compartment 6.
-
For reasons of public health, governments are increasingly making efforts to reduce
the consumption of tobacco products, particularly among young people. As part of
this, the supply of tobacco products can be subject to special rules so that they are not
sold to people who have not yet reached a determined, prescribed minimum age. The
device according to the invention provides a check of the age of a user, thereby
enabling such age-linked sales. For this purpose the information carrier 5 is provided
with an electronically accessible memory which is suitable for storing therein an
indicator of the age of the user. In this embodiment, wherein use is made as
information carrier of a chip card intended for electronic transfer of funds via banks,
specific memory space is allocated for storage of this age indicator on the same chip
on which the banking data of the user are also stored. The control means in the device,
which ensure the actual payment of the amount of money due for a product, are also
able to read such an age indicator and will only activate the release mechanism
4,42,43 if the prescribed age is indicated therein.
-
Before card 5 can be used as a payment means, the card is personalized. Data relating
to the user are herein loaded into the chip, and encryption keys are loaded which must
prevent unauthorized persons from being able to alter information on the chip. One of
the data loaded is the expiry date which shows the date until which the card is valid.
The present bank cards in circulation have a period of validity of 2 to 5 years after
issue of the card. After thus personalizing the card, it is issued to the user/card holder.
This will usually be done by the bank with which the user has an account. Before
payment can be made with the card, it must first be "loaded", which takes place in a
conventional top-up terminal as placed at diverse locations. The invention does not
intervene in this process, so that it will not be described further here and is assumed to
be sufficiently known. Personalization and crediting with money of the card makes the
card highly personal, whereby the user will not be readily inclined to give the card to
someone else. The invention makes grateful use of this fact. Furthermore, a large
percentage of the eligible part of the population already possesses a bank card, so that
device 1 is generally accessible and usable from the outset.
-
Before card 5 is suitable for use in the device, the age indicator must be set thereon.
The age indicator can comprise the actual age or date of birth of the user but, from the
viewpoint of protecting personal details, it is also possible to suffice with a logical
indicator which indicates that the user has reached the prescribed age of for instance
16 years. In this embodiment this latter option has been chosen. Initially, i.e. upon
issue by the bank, the value of this indicator is 'untrue' and the card is not therefore
suitable for purchasing tobacco products in the device according to the invention. The
user can apply to an agency provided with programming means according to the
invention in order to activate the age indicator, i.e. give it the value 'true'. An example
of such programming means is shown in figure 3.
-
The programming means comprise a terminal 90 with a card reader 93. Card reader 93
provides on the one hand input means for receiving the card 5 of the user and on the
other a physical interface which enables terminal 90 to exchange data with the card.
Terminal 90 is provided with a central processor unit which, loaded with the
necessary software and cryptographic keys, is able to carry out reading and writing
operations in the memory space of card 5 in which the age indicator is stored. The
value of the age indicator, among other things, can thus be mutated. Terminal 90 is
activated from a personal computer 95 or other suitable user interface provided for
this purpose and is controlled by an operator assumed to be reliable. After the age of
the card holder gas been established on the basis of for instance a reliable proof of
identity, and this has shown that the card holder is the rightful owner of the card and
has reached the prescribed age, the age indicator is accordingly arranged on the card.
-
An encryption is herein applied to prevent misuse. Specific transaction data, such as
an identification of the used programming means 90, of the operator and the
transaction date, are also incorporated in this encryption so that when a fraudulent
card is seized it can be traced back directly to programming means 90 and operator.
These transaction data are likewise stored in terminal 90 which has the necessary
memory space for this purpose. These log files, in which the encrypted transaction
data are held, are periodically transferred to a central body which monitors the
integrity of the entire system. For this purpose the terminal is equipped with a
telecommunication interface and coupled to telecommunication means such as a
telephone line or data network for transmitting the log files with some regularity to a
remote computer system. The data are otherwise always inaccessible to an operator of
the terminal.
-
Tobacco products can be purchased in the device of figure 1 only by using bank cards
provided with the thus arranged age indicator. As soon as card 5 is inserted into card
reader 53 of machine 1, an authentication procedure first takes place which determines
whether the bank card is valid. Use is made in this authentication process of
cryptographic keys stored in the card and in a so-called Secure Access Module (SAM)
of device 1. These are the same encryption keys which are used in dealing with
financial transactions using the card and which have thus proven to be reliable. One of
the components of the authentication process is checking the expiry date of the card.
-
If it is established that card 5 is valid, card reader 53 reads the part of the card in
which the age indicator is stored. An invalid card is further refused. The age indicator
is located in a freely readable part of the bank card, but cannot be modified without
the application software and especially the cryptographic keys required for the
purpose. A card without age indicator is always a no-card and will not be able to
provide access to the products in the device. Only if the card contains a correct age
indicator is the device released for carrying out financial transactions and supplying
the product. In the opposite case, not only is the card refused but it will not be
possible to pay in cash either and no supply at all of a product takes place.
-
During electronic payment a balance check is first performed. If a balance is sufficient
the card is debited by the amount payable for the selected product. If cash notes or
coins are used to pay via input slots 51,52, the total amount inserted is determined and
any change is given via delivery compartment 6. During payment with cash, the card
must remain in the card reader during the whole transaction to avoid the age
verification being uncoupled from the supply of the product. Age verification and the
financial transaction are inextricably linked to each other in the device. As soon as a
card is removed while one of the steps involved is being performed, the device is
immediately blocked. If the transaction of an authorized person is ended prematurely,
this for instance prevents a device remaining available for a certain period for
payment and supply of a product to an unauthorized person.
-
If both the age verification and the financial transaction have run successfully, release
means 4,42,43 are activated to release the selected product. The product can then be
removed via delivery compartment 6.
-
A step can optionally be incorporated prior to this, which alerts a user to a card still
inserted in the device and only releases the product after this card has been removed.
The whole transaction is recorded in the sense that transaction information, such as for
instance an identification of the card used, an identification of the device itself, a
designation of the point of issue of the card where the age indicator was arranged
therein and the date of the transaction, is collected by the device during the above
described process. This information is stored as a sort of log file by the device in
memory means provided therein for this purpose. Here too a cryptographic encryption
of the information is applied to make this information inaccessible to third parties.
The thus collected log files are periodically read via a suitable telecommunication
connection, locally or remotely, to be transferred to a remote computer system of a
central body monitoring the integrity of the system.
-
Although the invention has been further elucidated above on the basis of only a single
embodiment, it will be apparent that the invention is by no means limited thereto. On
the contrary, many variations and embodiments are still possible within the scope of
the invention for a person with ordinary skill in the art. As already stated, the device
according to the invention can also be advantageously utilized, as well as for tobacco
products, to supply other stimulants, products and services for which an age
verification of the consumer is desirable or even required. Use can be made here of
the same, common age indicator for the different applications, although it is also
possible to arrange different age indicators on the card, each one for its specific
product group or collection of product groups. For an increased security and as
remedy against misuse of lost and stolen payment means, the use thereof can be made
dependent on the input of a confidential access code, such as for instance a PIN-code.
For this purpose the device must then be embodied with input means and adequate
application software to carry out the necessary validation. Nor is the application of the
invention limited to bank cards provided with an integrated circuit, but the invention
can also be applied in combination with less "intelligent" magnetic cards and credit
cards. It is also possible to deviate from the card format of the information carrier, and
it is possible to choose optionally contactless data exchange with the information
carrier. In all these and more modifications, the invention provides a device for the
controlled supply of products on the basis of a reliable age verification, without
human supervision being required, at least on-site, for this purpose.