Value transfering system

The forerunner of the invention is a method and system for transferring value, especially for cashless transactions.

Currently, several types of services related to non-cash financial transactions are used. These include credit cards and debit cards that customers can use at multiple retailers. Each transaction is accompanied by the customer account details needed to actually transfer the relevant amounts from specific customers to specific sellers.

Another form of a non-cash card is a subscription card, which is purchased before a series of transactions, and the value record stored on it is appropriately reduced with each transaction. An example of a subscription card is a calling card.

169 723 such known systems are inflexible and are essentially unable to replace cash with a large number of transactions with a small nominal value. Various proposals have been made for the exchange of money between electronic wallets. For example, US Patent No. 4,839,504 describes a system in which the user has the option, in communication with his bank, to store a monetary item in an IC card with an integrated circuit, known as a smart card. VI of the bank, the same value is entered into a separate IC block of the user's account. Purchases can be made by transferring money from the IC card to the merchant's equipment, without directly connecting to the bank. Each transaction requires the seller to be handed over to the seller and the details including the buyer's identity to be kept. Finally, when a payment is requested from a bank, the seller presents a list of transaction details and the bills are reconciled to allow the relevant buyer's IC account to be corrected.

The above procedure requires the final reconciliation of accounts after each transaction. There are two drawbacks to these activities. The first is of a practical nature. Remembering, communicating and reconciling details for each customer's transaction causes an unacceptable overload of equipment when all cash-type transactions are taken into account. Efficient processing related to all such transactions is not achievable in an acceptable time, even with the latest equipment. The second objection is of a social nature. The anonymity of cash is lost and there is potentially the possibility of extracting details of the structure of personal expenses.

The second of the above-mentioned reservations was formulated in the publication entitled Controlling your Information with a Card Computer / Concepts Applications Activities /. / Self-control of information using a card computer - concepts, applications, areas of activity /, published by TeleTrust in March 1989. This publication proposes a system of hidden signatures for money items assigned by an authorized institution, for example a bank. This is a way of making it difficult to identify the buyer. However, the problem of the need to detect double payment by the buyer remains. According to the aforementioned publication, the solution tries to remedy these difficulties by including encrypted information about the buyer in the data transferred in a separate transaction (off-line). This information is passed to the bank when the merchant requests a loan and is used by the bank to detect double electronic cash. Thus, each item is signed in the bank in order to finally agree on the payment requests in relation to these items, but without identifying the customer's identity. The problems of remembering, transmitting and processing information about the next transaction remain. Moreover, this known solution introduces an additional complication. This type of system requires that each item in signed electronic cash be treated as a block that is not split. It also means that the system is not suitable for large volumes of transactions with a small nominal value. The security of asset transfer systems requires the use of cryptographic methods to prevent fraud. The most effective cryptographic methods are asymmetric methods, requiring different keys to encrypt and decrypt information. A known and convenient cryptographic method is the Rivest, Shair and Adleman method known as the RSA system. Since RSA encryption is straightforward, it requires relatively extensive processing capabilities to perform conventional RSA decryption in a short time.

The method of transferring values ​​according to the invention is performed between elements of an electronic system provided with a computer in communication with a plurality of electronic wallets, at least one of which is a collective wallet connected to the computer, and exchange devices in communication with the wallets. According to the method, values ​​are transferred between wallets in execution transactions which are carried out in separate mode with the computer. Communication between the wallets is established through at least one of the exchange devices. A method of this type is characterized in that at least one of the aggregate wallets is loaded via the value counter with the desired value under computer control. The requested value is refunded from at least one of the computerized collective portfolios via the value counter. In addition, it saves at least

169 723 one variable value record using a value counter. In doing so, the net value transferred to at least one of the overall portfolios is derived. The net value is the difference between the sum of the values ​​downloaded to at least one of the collective portfolios and the sum of the amounts reimbursed from at least one of the collective portfolios. For individual transactions, a nonspecific variable value record is assumed.

Each variable value record is reconciled on command via the value counter interface and values ​​are created or destroyed in at least one of the aggregate portfolios.

Each portfolio has a portfolio record value that is accumulative and trades between the pair's portfolios. From one sending purse, the desired value is transmitted, and in the other, the receiving purse, the value is acquired. Further, in each transaction, the sending wallet value record is decreased by a predetermined floating transaction value and the receiving wallet value record is decreased by the same transaction value via the microprocessor of each wallet or its associated exchange device.

In transactions between participants in a pair of wallets, the pair is assigned a specific transaction identifier for at least one of the wallets, unique on a portfolio basis, via a microprocessor. A transaction identifier specific to the receiving purse is assumed, unique in the scale of the receiving purse, by including the sequential transaction number of the receiving purse. During the transaction, a request message containing the transaction ID is sent from the wallet¹ to the sending wallet, the transaction identifier is included in the transaction value message sent from the sending wallet to the receiving wallet. In addition, the confirmation of the transaction value message in the receiving purse is checked based on the validity of the received transaction identifier.

Transactions between pair wallets use an asymmetric cryptographic system with different keys, open and secret, and at least the system's public key is remembered in each wallet. Preferably, each wallet stores data signed in the cryptographic system by the host computer using a global secret encryption key. Data signed in this way is confirmed electronically, and during each transaction the certified wallet data is checked using an explicit global key.

Each wallet stores its own unique key pair, open and secret, in a cryptographic system, and the transmission of transaction data is encrypted and decrypted using these keys.

During the transaction, a secret key from the second wallet key pair is sent to the first wallet and the transaction identifier data in the second wallet is encrypted with the non-confidential key from the second wallet key pair via two microprocessors with unequal computing power. The microprocessor associated with the first wallet is assumed to have greater computing power than the microprocessor associated with the second wallet.

In a preferred embodiment of the invention, during a transaction, the symmetric system key of the second wallet is sent to the first wallet and the transaction identifier data in the second wallet is encrypted with the symmetric system key via two microprocessors with unequal computing power. The microprocessor associated with the first wallet is assumed to have greater computing power than the microprocessor associated with the second wallet, and the second wallet is provided with the encryption key of the symmetric cryptographic system.

The system according to the invention used for transmitting values ​​is provided with a computer, a set of electronic wallets, at least one of which is a collective wallet connected to the computer, and exchange devices equipped with means for receiving data from the wallets. The wallets are interconnected to each other for the transfer of values ​​in executive transactions in a machine-disconnected mode. A system of this type is characterized in that it additionally has a value counter connected to at least one of the aggregate portfolios. For at least one of these aggregate portfolios, a value counter and a computer, a value retrieval means is included for loading at least one of the aggregate portfolios with a requested value, under computer control, via the value counter. Also included are measures to refund the value of at least one aggregate wallet, under control

169 723 computer, through the value counter. Moreover, the value counter comprises means for recording at least one non-specific variable value record to derive the net value transferred to at least one aggregate portfolio.

The value meter is provided with an interface reconciling each variable value record on command to create or destroy a value in at least one aggregate portfolio.

Each wallet contains a memory means for storing an accumulative portfolio value record, and furthermore, each wallet or its associated exchange device includes a microprocessor.

The system according to the invention preferably has a set of computers, each of the computers of the set is connected to its own value counter.

The solution according to the invention will be explained in more detail in the drawing, in which Fig. 1 shows a banking computer system, simplified, Fig. 2 - a value counter, in the form of an overview sketch, Fig. 3 - an example of a value transfer procedure, using the complete system cryptographic RSA, in the form of an overview sketch, Fig. 4 an example of a value transfer procedure using the secret key transfer method, in the form of an overview sketch, Fig. 5 - an example of a value transfer procedure using a mixed RSA / DES cryptographic system, in the form of an overview sketch, and Fig. 6

7 show a possible embodiment of a typical device for carrying out the method according to the invention.

Fig. 1 shows four settlement banks 1, 2 and 3 with associated computers 1a, 2a, and 3a. Computers have files containing the account details of both the bank's customers and the seller's customers. Each computer 1a, 2a, 3a is provided with a value counter 1b, 2b, 3b which indicates a variable value record. The real funds represented by floating value records, not specifically assigned, may reside in one or more of banks 1, 2, or 3, or all of them.

Each bank has a collective wallet, 1c, 2c, 3c, which is connected with a corresponding numerator of values ​​1b, 2b, 3b and which is provided with a memory with the contents of the wallet stored therein. The end terminals, constituting the exchange devices 5, are selectively connected by telephone to computers 1a, 2a, and 3a. In general, the exchange devices 5 can be home computers or terminals accessible in public places. Recipients have electronic wallets in the form of IC cards 6. These cards are equipped with microprocessors and memories. A record 7 of the contents of the wallet is stored in the memory of each card. The cards have contacts 8 through which they can interact with the exchange devices 5 via the card readers 9. After selecting the appropriate request on the keypad of the exchange device, the recipient may call his bank 1 or 3, or may request that the value record be loaded into his wallet. If the bank confirms the validity of the request, the aggregate wallet is instructed to fetch a value in order to load the portfolio value record 7 with the requested value. At this point, the card is ready for use.

In the arrangement according to the invention, the value counter comprises means for recording at least one non-specific variable value record, to obtain the net value transferred to at least one aggregate portfolio. The transfer takes place under the control of the computer. The net worth is the difference between the sum of the values ​​downloaded to at least one collective portfolio, but the variable value records do not contain the details specific to each transaction.

Other electronic wallets are located at the end terminals, preferably in the exchange devices 10, 11, and have IC card readers 9 located at the various points of sale. In order to use the card, the user presents it to the merchant, who in turn enters the card into the reader 9. Use the buttons to select the desired transaction value, and after confirmation, the total sum of the portfolio value record 6 is reduced by the transaction amount. The record of the value of the wallet located on the exchange device 10 or 11 is increased by the same transaction value. The customer collects the goods and can continue to use the card in the equipment of other sellers, up to the total amount included in the value record of his portfolio.

169 723

Periodically, the seller may recover the securities represented by the value record of his own exchange device 10 or 11, regardless of the identity of the customers, and without providing any details of separate transactions making up the total accumulated value. This can be done as required by connecting the exchange device 10 or 11 to the merchant bank 1, 2 or 3 and submitting a refund request. The banking computer then instructs to refund the transaction against the value taken from the wallet of the exchange device. The bank computer credits the seller's account with the appropriate funds. Value counters provide the basis for checking the grand total of outstanding amounts across all portfolios and the distribution of funds making up the grand total.

Collective wallets 1c, 2c, 3c differ from other wallets in that they can be recharged and refunded using a value counter as well as through the wallet for money transactions. In other respects, the wallets are technically similar, and in particular, the same cryptographic methods are used for the bulk wallet for other money operations (on-line) as for disjointed (off-line) operations.

Fig. 2 shows a value counter 1b including an index 12, indicating a variable value record. This means in this case that the net value transferred to the aggregate portfolio 1c is the difference between the sum of the values ​​retrieved via the counter and the sum of the values ​​reimbursed via this counter. It is obvious that instead of the net value, the gross value of the collection and the refund can be shown separately, and it is easy to obtain the net value from the gross value, even if it is not indicated on the last day. The link 13 between the numerator of the value of each of the aggregate portfolios is secured. The wallet may be physically adjacent to the value counter, and security may be provided by physical locks etc. In contrast, the aggregate wallet may be away from the 1 numerator of value and the collateral may be realized using cryptographic methods. It is important to ensure that the value counter always accurately shows the values ​​that are being passed to the aggregate wallet and that fraudulent changes cannot be made. Each value counter is provided with an interface 14 which may be a link to banking processing means or a keyboard block. Values ​​added to or subtracted from the variable value record, representing an increase or decrease in value in the circulation, may be entered by authorized personnel. Thus, the circulating value may be adjusted generally, such as daily, rather than ad hoc in response to individual withdrawals and withdrawals.

By using a variable value record in this way, it is possible to exchange values ​​on an off-line basis, using appropriate exchange devices, from customers to sellers, from sellers to customers, and between customers without the need for large numbers of accounts or maintenance. detailed account, and making robbery arrangements.

The customers themselves can also reconcile the value records of their wallets, in person-to-person exchange through refunds from vendors, or the like. It is envisaged that portfolio value records may be transferred to individual accounts through the Variable Value Record Withdrawal Request procedure, in a manner similar to seller requests.

Wallets can be used internationally by loading different currencies into them. It is anticipated that for each country or group of countries a variable value record will be kept in the corresponding currency. A user's request to load his wallet with a foreign currency may result in the domestic account being reduced by an appropriate amount in its own currency, with a corresponding increase in the floating value record for the foreign currency.

A portfolio value record held in a portfolio may be converted to a different currency on demand, with the conversion at a specified rate, with the transfer of values ​​from a variable value record of one currency to such a different currency record, and appropriate conversion of funds between the currencies.

Β

169 723

Wallets preferably have means by which a unique identifier is assigned to transactions between a pair of such wallets, and the microprocessors are programmed to respond to these identifiers to prevent a transaction from being repeated. The computer does not need any information to determine that the same electronic cash is being used a second time. When a seller demands payment of a certain value, the computer is accessed and the possibility, through the transaction identifier, to determine whether the same request is being performed twice, either directly or simply by a request constituting a different transaction. Preferably, the transaction identifier sent from the sending purse to the receiving purse is conveniently extracted from the data identifying the receiving purse and the transaction sequence number of that purse or the date / time stamp obtained from the receiving purse in the initial hand-shake transmission operation. In this way, the receiving wallet can monitor the transaction and track any attempts to duplicate the same value record.

For the security of the system, and in order to prevent fraud, cryptographic methods are used. The preferred solution of the invention uses an unbalanced cryptographic system in which the processing capabilities required for the user's wallets are significantly less than that required for the seller's wallet.

Each user of a cryptographic system with asymmetric keys is provided with a pair of keys, namely a public key and a secret key. The messages for the second party are encrypted using the public key of the other party / remote /, which is constructed as available for example in a key exchange procedure. Received messages are decrypted using the local secret key. The use of public keys is much less dependent on processing power than the use of a secret key, so that conventional encryption is less computationally intensive than decryption. Thus, when using an unbalanced system, it is desirable to eliminate the requirement that the user's wallet performs conventional RSA decryption.

The first way to reduce the crypto congestion in the user's wallet is to provide them with a simpler symmetric cryptographic system. Such an encryption and decryption system uses the same key. An example is the DES / Data Encryption Standard / cryptographic system. The reseller's wallet retains full RSA computing power.

The second way is to use the user's own explicit wallet key and secret when exchanging data. When exchanging keys, the user's wallet sends its secret key to the seller's wallet. When data is transferred to the seller's wallet, the recipient's wallet encrypts it with its own public key, and the seller's wallet decrypts it with the buyer's secret wallet key.

Security is improved by the use of electronically corroborated data in the process, such as digitally signed data. Each wallet at the exit is assigned a specific number and stores this number signed with the secret key of the asymmetric global cryptographic system. The result is the global signing of this number, which is stored in the wallet. All wallets are given the public key of the global pair, so that when accepting the globally signed number of the other party, its validity can be checked. The numbers can be considered as globally certified. Since transactions require the exchange of encryption keys, it is preferable to arrange the structure so that the globally certified numbers are encryption keys for exchange purposes.

Electronic wallets can take many physical forms. These include computer processing capabilities that can be incorporated into IC cards or smart cards made in the form of key fobs, purses, etc., or embedded in electronic equipment such as point of sale equipment, calculators, etc.

Communication with the computer is usually made over the telephone, and wallets can be connected to telephones or modems since it is possible to carry out the desired transactions entirely over the telephone. However, in general a more convenient structure is obtained when using a wallet, preferably in the form of an IC card that is loaded via a modem connection, either by a person specific device or by a countdown machine.

169 723

Wallets can communicate with each other to transfer value through telecommunications equipment. There may be pockets for two wallets or, for example, each of them may communicate with the other via infrared or electromagnetic radiation.

The difficulty of providing high-speed cryptographic capabilities in very small and inexpensive devices such as IC cards has already been mentioned. Of course, it is easier to provide such possibilities in a telecommunications device or modem. Thus, even though customer wallets may be deprived of their full processing power, they may be provided with telecommunications devices accessing the user's wallet memory and public keys. Thus, it is easy to exchange value records between individuals if all wallets have full asymmetric cryptographic capabilities, that is, it is possible if the wallets are simple and if smart telecommunications devices are used.

Usually, at least the seller's equipment has the ability to remember transaction information. This can be in memory, on disk, on another card, or by any other means. In practice, the equipment may include a sending device for transmitting values ​​from the customer's IC card to the vendor's IC card. The storage capacity of the seller's equipment does not have to be large, because it only serves to accumulate the total amount that requires storage, however, it turns out that, apart from the information on transaction values, it is possible to exchange other information, for example about the identity of the recipient and / or seller, in order to enable transaction printout, obtained locally for analytical purposes. It may contain commodity codes.

Like regular point-of-sale terminals, guarded or unguarded, the seller's equipment may also include vending machines, ticket machines, parking machines, toll collection machines, etc. Although the security of using the wallet can be ensured by requesting a PIN code, this is not an essential requirement, and in a preferred embodiment, this requirement is dispensed with for ease of use. However, it is envisaged that each wallet may have both PIN-protected and non-secured memory, the system being in the form of a terminal and allowing, when using a terminal or pocket dd for exchange, to retrieve value records from using a PIN code, from the secured to the unsecured part of the wallet.

As already mentioned, individuals may carry pocket-sized exchange devices with them in order to enable asset transfer transactions between them. It is possible to make appropriate refunds or collect checks by sellers at any equal possbb. Value rkcords can be entered into wallets in selected currencies for use in specific countries. It is envisaged that various federal, national or international institutions may have their own computers with value counters and wounded value records, generic value records representing the total value in circulation / in all portfolios /.

The funds they represent are distributed among the participating institutions in a predetermined manner on the basis of their respective reconciled running registers.

Figure 3 shows a procedure during an off-line transaction in a first embodiment of the present invention. Both wallets have the full asymmetric cryptographic capabilities of the well-known RSA system. The transmitting wallet is provided with an SS memory which maintains an accumulative record in the SSR and RSA keys, i.e. the PKS public key and the secret key SKS of the sender, and the general public key PKG. In addition, there is a certified data message / PKS / * SKG. It is the unique public key of the sender's wallet, signed by the master computer with its general secret key SKG. The public key PKG is therefore electronically confirmed in the system as valid. The receiver's wallet is provided with an RS memory, which maintains a ^ and ^ s ^ s ^ s ^ s ^ s ^ s ^ s ^ s ^ s ^ s ^ s ^ real record of the recipient's wallet, public RSA, and secret keys PKR, SKR, general public key PKG and acknowledged data message / PKR7 * SKG of the key overt.

The first step in the transaction process for the receiving purse is the generation of a transaction ID number R. It is obtained from a combination of a receiving wallet identifier and a transaction sequence number for that loop. f ^^ ł ^ ią ^ there is two-way communication between wallets, either locally, using a direct connection,

1/9 723 infrared link etc .. either remotely via modem or telephone. The stages in which:

1. The receiving purse transmits the request message which is [PKR / * SKG + / 'R / * SKR.

AND

2. The sending wallet can check / PKR / * SKG by using the general public key PKG. This gives the transmitting wallet PKR identification key to check / RHSKR and therefore designate R.

3. The requested value to be reported V rdln-uwl is derived from the SVR of the portfolio value.

4. The sending purse compiles a transaction value VR message based on the V value it is to transmit and based on the request message R. This is signed with the secret key of the sender, and the following message is sent to the receiving purse with the value of the transaction: [PKS / * SKG + / R / * SKS.

5. The receiving purse designates the PKS public key by using the PKG public key to verify the / PKS / * SKG message.

/. The use of the PKS public key determined in this way results in the verification of [R] * SKS and thus causes the reconstruction of VR.

7. An R is checked to ensure that it communicates the identity of the receiving purse and the correct transaction number. If not, the transaction is aborted.

B. If everything is OK, the value of V is added to the value record of the receiving purse.

9. A signed acknowledgment is sent to the sending wallet.

STL and RTL transactional records are stored in the wallet, sending and receiving memories. The records can carry the details that are needed for local transaction analysis, but in the simplest form, the records only carry the records of each transaction that for some reason ended abnormally. This can be used for control in the event of a dispute.

RSA encryption and decryption requires the computation of xy mod n, where n is different for encryption than for decryption. In particular, the exponent V in the case of encryption / performed with the open key / is small, and the corresponding exponent in the case of decryption / performed with the tαnnyml key is much larger. As a result, although modest processing power is sufficient to accomplish encryption in a sufficiently short time, the same cannot be said for decryption. The creation of an authenticated (i.e. digitally signed) message requires an adequate amount of processing for decryption, checking this type of message requires an equivalent amount of processing during encryption.

The embodiments shown in Figs. 4 and 5 are structures that enable one of the pair of communicating wallets to be equipped with significantly less processing power, and thus to make it cheaper than the other. In these structures, some system wallets / merchant wallets / have full RSA capabilities / encryption and decryption /, while others / customer wallets / contain a symmetric cryptographic key system for transmitting transaction value records messages. A suitable system with a symbolic cryptographic key is the DES sytremlm. This requires, for both encryption and decryption, computing power similar to that needed for RSA encryption.

Fig. 4 shows the transaction procedure between two wallets, the sending wallet being a customer's wallet and the receiving wallet being a merchant's wallet. The reseller's wallet has the full capabilities of the RSA system, while the customer's wallet has less privatization. The sending purse has a CS memory that stores the accumulated CVR record and the global public key PKG, according to the RSA system. In addition, there is a key according to the DES - DESc system and the confirmed data message /'DESc.l*SKG. which is the unique DES key of the sending wallet signed by the master with its general secret SKG. The receiving purse has an SR memory that is identical to the SR memory of the Fig. 3 embodiment for storing PKR, SKR, PKG and / PKR7 * SKG.

The first step in the transaction procedure is for the receiving purse to specify the transaction identifier R as in the Figure 3 embodiment. The following steps are then performed:

169 723

1. The dbbi.orcz wallet transfers the value of the t <5 j kmmnumer t with open kiuzze / PK / 7 * SKG.

2. The receiving wallet checks the signed message and issued KKR.

3. Wallet rzyOuuZi swji ottbZrαrzoni komosektt, and KKR potsZoarzosZe. Roiee ^ and the decoSec of a public key, such as PKK, is small, this encryption is easy to process. The message sent to the receiving wallet is as follows: Epeo7 'O) ESc / * SKG /

4. The receiving wallet decrypts the message first with the secret SKK with the receipt of / DESc / ^ SKG, which in turn is first encrypted with the secret key SKK, in order to receive / OESc7 * SKG, which is then itself checked with the PKG to verify and receive the OESc .

5. The receiving purse transmits the message / TK / ^ ESc, which is the transaction identifier K, encrypted with the atomicity algorithm of OES.

6. The receiving wallet decrypts the OES message, extracts the transaction identifier K, and assembles the value transfer message VK in the same manner as in the Fig. 3 embodiment.

7. The sending purse subtracts the V value from the wallet value record and sends the / VK / * DESc message to the receiving purse.

8. The receiving wallet decrypts the / VK / * OES message and checks that K is correct. Unless. then the transaction is aborted.

9. If everything is correct, the value of V is added to the value record of the receiving purse and an acknowledgment message is sent to the sending purse.

Figure 5 shows a transaction procedure that allows wallets to be equipped with unequal computing power when using the keys of an asymmetric cryptographic system.

In Fig. 5, the receiving purse's memory KS has the same keys as in the embodiment of Fig. 3. The processing power of the transmitting purse is less than that of the receiving purse and instead of the signed public key, the transmitting purse stores the signed secret / SKS / * SKG /. which contains oówoSzż / PKS /.

The transaction procedure includes the following steps:

1. The receiving purse transmits a signed P / PKK / * SKG message.

2. The sending purse checks the signed message with the PKG verifying / PKK / * SKG, and extracts the PKK.

3. The sending purse encrypts its signed message with the PKK and sends Epkr / SKS7 * SKG (

4. The receiving wallet decrypts the message first with the secret SKK with the receipt of / SKS / * SKG, and then uses the public global key PKG to verify / SKS / * SKG and thus designate the SKS.

5. The receiving purse signs the transaction identifier K with SKS and sends / K / * SK ^.

6. The transmitting wallet determines K with PKS.

7. The sending purse subtracts the requested V value from the portfolio value record, and collects and sends an Epk message_S./ Vk / values.

8. The receiving purse decrypts the message using SKS to determine V and K. It is checked whether K is correct. If not, the transaction is aborted.

9. If everything is OK, V is added to the receiving purse value record and the SKS in the receiving purse is removed and an acknowledgment message is sent to the transmitting purse.

Fig. 6 shows an embodiment of the invention in the form of a pocket exchange device PED / pocket zKchangz dzvice - PED /. It is ο ^ ι ^ οιΖi EED est i zssIIozd i taterii i or solar cells, and is provided with an LCD 15 liquid crystal screen and a 16 IC card reader. The user card is inserted into the reader, and then it can be viewed using buttons 17 to 21. The buttons 17 allow the user to select the records on the card accessed via the buttons 19 and 20. The buttons 1 B and 2 1 enable the exchange between two cards via intermediate memory inside the terminal.

Figure 7 shows a device that may be at a point of sale. Similar bzz terminals for sales functions can be installed in financial institutions or other public places, allowing users to access their bank accounts in order to charge or unload cards. The device T consists of a point of sale,

169 723 provided with an LCD 22 or other display, and an IC card reader 23. Using the keypad 2A, the totals of the sales transactions are entered into the terminal. The buttons 25 and 26 initiate a transaction with the IC card inserted into the reader 23. Outside of business hours, the merchant may use the terminal to transmit the value to the superior banking terminal by operating the button 27.