The present invention relates to a method for transporting valuable documents from a first location to a second location in a break-in protected case provided with means which, on triggering, acts upon the valuable documents in the case, for instance by dye-disfiguration, triggering being controlled by a timing mechanism in the case, which method comprises that the despatcher at the first location, after putting the valuables in the case, locks it_and activates the timing mechanism to induce triggering after a given transport time in the absence of any deactivation, the case is transported from the first location to the second location, and the recipient at the second location deactivates the timing mechanism in the case and afterwards opens it.

The object of the invention is to improve the known technique so as to provide enhanced flexibility and improved securit .

This object is attained in a method according to the invention having the features defined in the accompanying patent claims.

The underlying concept is the utilization of a break-in protected, computer equipped case with variable locking codes. The code is linked to a "sigil", a number combination created by a sufficiently long sigil key, an algorithm and a number of known ( "open" ) but constantly changing data.

The sigil key, which is a prerequisite for the correct calculation of the opening code, is held by the despatcher and the recipient of the money or valuable documents and

is secret.

The sigil key is advantageously held in a "smart card", a card with a memory function and a certain calculating capacity of its own - i.e. a computer. The information in the card together with the "open" information regarding a case is processed via a computer card reader ( "sigilator" ) and then sent to a computer in the case, the case being opened if the right opening code has been received.

The break-in protected case is provided with various forms of alarm and means which upon activation uses dye to disfigure the money or valuable documents in a consistent fashion so that they become unacceptable as a means of payment, but can still be identified by the authenticated legitimate owner and in the circumstances replaced in the most appropriate manner.

The case is further provided with technical means so that it can determine for itself if the conditions for activation, i.e. dye-disfiguration, are fulfilled. Conditions for dye-disfiguration are, for example, an attempt to break into the case, an electricity supply problem, a technical problem in the case computer, exceeding the despatcher-to-recipient transport time, exceeding the transport time between customer and vehicle, or vice versa.

The case is further provided with additional sigil and sigil key technology in order to identify "safe environments". A safe environment can be created, for example, in a vehicle by a vehicle computer which regularly exchanges transport sigils with the case and in so doing demonstrates to the case that it is located in a safe environment. A safe environment can also be created in the depot with a computer which regularly exchanges

sigils with the case in the same fashion. The sigil keys, which can be the same throughout a district or be individual for each case or vehicle, are held in this case in the vehicle and case computers.

Each case additionally has a "depot sigil" for updating data and changing sigil keys, control information etc. This requires a further secret sigil key with the task of legitimating alterations of the essential information with regard to the case wher it is located in the depot.

All of the secret sigil keys can be quickly_changed throughout a case population, for example if any of the cases are stolen.

The case computer has a mechanism to protect it against unauthorized reading of sigil keys. Immediately prior to dye-disfigurement, all of the sigil keys in the case computer are erased. The same thing applies with a vehicle computer which is subjected to external tampering.

The invention will now be described in further detail through an exemplary embodiment and with reference to the accompanying drawings, in which;

Fig. 1 schematically depicts a valuables transport case with a sigilator connected up;

Fig. 2 schematically depicts the layout of a depot computer system, in block diagrar format; Fig. 3 schematically depicts the layout of a case computer, in block diagram format;

Fig. 4 schematically depicts the layout of a vehicle computer with associated case connection, in block diagram format; and Fig. 5 schematically depicts the layout of a sigilator with associated card, in block diagram format.

A system incorporating the invention comprises, in accordance with Figs. 1 to 5, a number of components to enable conveyance of money by case from one location to another in an entirely safe-from-stealing manner. The case should not be openable by anyone other than the person it is intended for, i.e not even by the person who packed the money in the case.

The system has the following parts.

A case 1 (Fig. 1) is specially equipped to carry money 3. This case contains a computer 5 (Fig. 3)_which can establish whether it is an authorized recipient opening the case. If the case is opened without authority, the money is sprayed with dye which makes it unusable.

An "electronic sigil", ID sigil is used to calculate an opening code with the aim of establishing if a recipient is authorized to open the case. The keys to the sigil algorithm are stored, inter alia, in active cards 9 of the "Smart Card" type (a BULL CP8 card).

A system to forward information to the case is located at the place where the money is packed into it so that the case will be able to establish whether an individual opening the case is authorized. The case is packed, inter alia, at a depot. Located at the depot is a PC-based system which has information on all the customers likely to need money from that depot. The depot computer 2 (Fig. 2) is connected up to the case 1 and forwards opening codes to the case which is subsequently activated.

The case is then transported in a special valuables transport vehicle which has a "vehicle computer" (Fig. 4) to which the case is connected up. The task of this computer is to inform the case computer that the case is in a safe environment.

If the case is not in such an environment and is activated, a clock (timer) within the case operates. When this clock has counted down to zero, the dye cartridges are detonated in the case and the money therein becomes unusable. This clock normally only counts down during "pavement time", i.e. when the case is carried from the vehicle into a bank for example, or vice versa.

The case is carried in to the recipient by a guard who bears a sigilator 7.

As previously mentioned, a sigilator is a computer unit with a reader 11 for cards of the Smart Card type (Fig. 5) . The recipient of the money has such a card containing the key for calculating the electronic sigil. Before the card is "opened", a four digit PIN code must be input by the recipient to the card via the sigilator.

The case computer 5 and the sigilator 7 are connected via a lead through which communication is effected (Fig. 1) The case computer forwards information to the sigilator which calculates a sigil based on this information and the key and forwards this sigil back to the computer.

When the money was packed into the case, a sigil was input to the case computer. The case computer compares these two sigils with each other. If the two sigils correspond, the case computer checks, prior to opening the case, that it is not the same card being used which closed (packed) the case. This ensures that the case can not be opened at the same location at which it was packed.

THE MODES OF THE CASE

A case can assume three different modes. These three are safety-on (open), primed (loaded) and safety-off (closed).

Safety-on ( open )

In safety-on mode, the case can not detonate the dye cartridges. A safety-on case can not be switched to safety-off. It must first receive data regarding the next opening. These data comprise an ID-sigil, input data for the sigil algorithm which has calculated the ID-sigil and a customer number which indicates who stored this information. Following this, the case is in the primed mode.

Primed

A primed case can be switched to safety-off and can also be loaded with new opening information. Closing

(switching to safety-off) of a case is effected by momentarily pressing a switch on the exterior of the case or by the depot computer forwarding a message to this effect.

A primed case is indicated by a green light emitting diode on the exterior.

Safety-off

The lid of a safety-off case can not be opened without detonating a dye cartridge. A timer in the case operates the whole time. When this timer has counted down to zero, the dye cartridge is detonated. When the case is placed in a vehicle, the vehicle computer polls it and all of the other cases. The polling signals contain, inter alia, a transport sigil. If this sigil corresponds to the relevant sigil calculated by the case computer, the timer is reset. If the sigil does not correspond, dye will be sprayed out over the money when the timer has counted down to zero.

A safety-off case can be opened with the right ID-sigil.

This sigil can come from the depot computer or a sigilator. If the sigil received by the case computer is correct, a check is made that the customer number is not the same as that which closed the case. If this check also gives the correct result, the case is "opened".

A closed case indicates this fact with a blinking red light emitting diode located on the exterior. This light emitting diode blinks more intensively as the time remaining before the timer counts down to zero diminishes.

THE DEPOT SYSTEM

The task of the depot system is the management of cases as well as vehicles and customer information. The depot system is PC based and one is situated at each depot. Its general set-up is depicted in Fig. 2. Logging on is effected via a single use password using a PC-connected sigilator 7 and a personal active card 9.

The depot system loads each case computer with the parameters necessary for the case computer to function. The depot computer has further functions for the transfer of information to each case which provide that the case can either regard itself "safe" or be opened or closed.

Special routines to administer follow up, checking and servicing of the cases are built into the depot system.

Each depot has an "c customer collection", e.g. the necessary informatic n its own circle of customers to enable the managemen of their money transportation.

INITIATING ROUTINES

In order to be able to operate a case computer (Fig. 3) or vehicle computer (Fig. 4) in the intended fashion, each

case or vehicle computer must be initiated with certain information. The computers have a defined number of status inputs. Each status input requires a decision as to what measure or measures the computer is to take in relation to changing of the status in question.

A case computer must contain certain fundamental data in order to function within the system. Such information includes the case number, transport key and depot key.

Via the case number, the depot computer can communicate with the case computer and with the assistance of the transport key the preconditions for communication with the vehicle computer during transport are also created (the transport sigil function).

A completely new case at a depot is allocated a case number drawn from a number series for the cases of that depot. Number allotment is conveniently done sequentially using the "next available" principle.

The transport key and the depot key are also transferred to the case computer for storing therein after which the depot system notes that the new case is now in the system.

Additional things which happen with a new case are that its logging space is blanked out, its clock is brought into line with that of the depot computer and the case computer is provided with standard values ( from the system parameter record) regarding transport time and pavement time.

CASE MAINTENANCE

Ths case is the most vital component in the whole concept. Functioning of the case is the wholly deciding factor for the secure money transport. It is therefore of great

importance that the various parts of the case are regularly tested for function and serviced. One task of the depot system is to keep up with the condition of the cases. This is done by storing information for each case regarding case identification, latest computer function test and latest exchange of batteries and dye cartridges.

Every operation on the case, likewise every check, is noted in the log of the depot computer.

VEHICLE MAINTENANCE

As with the case computer, the vehicle computer must be regularly checked if the system is to function without ccLiplaint. It is, of course, the function of the vehicle computer to ensure that the case regards itself safe and to store information on the movements of the case.

THE VEHICLE COMPUTER

The vehicle computer also must have certain information to be able to contribute to the secure transport of valuables. To be able to keep watch over "its" cases, the vehicle computer must have the possibility of identifying itself to all the connected cases. This is done by

"polling". Polling signifies that the computer forwards an enquiry if there are any cases connected up. A case must recognize itself in order to respond to such an enquiry. This is effected with an "exchange" of transport sigils. The sigil must be calculated from a common transport key and one task of the depot system is to provide the vehicle computer with this key. To this end, the vehicle computer is connected up to the depot computer and exchange of information is effected in accordance with communication protocols.

CHANGE OF THE CASE KEY IN THE VEHICLE

This is effected via communication between the depot computer and the vehicle computer in accordance with communication protocols. Authorization in line with authorization gradings is required in order to be able to utilize this function.

CHANGE OF THE TRANSPORT KEY IN THE CASE

From time to time there is occasion to change the transport key in relation to a case. The depot system has a routine to enable changing of the key in the case. Following connecting up of the case to the depot computer, a session is commenced by the depot computer forwarding a "depot enquiry" to the case. The case responds to this enquiry by forwarding information for the calculation of a depot sigil to the depot computer. The depot computer calculates a depot sigil based upon the received information and delivers this to the case. If everything is OK, i.e. if the case computer, after having also calculating a depot sigil, finds that the sigils correspond, communication continues with uptake, via the case number, of the current transport key and the depot computer does a sigil calculation with the new key as a basis. The resulting sigil is forwarded, together with its underlying data (the new key) to the case computer. The case computer verifies the sigil and stores the new key in the case computer.

CLOSING THE CASE

A packed case, before it may leave the depot, should be provided with an electronic as well as a physical lock. The electronic lock consists of an ID sigil for identifying the authorized recipient. The physical lock can consist of a plastic seal which is applied to the case

when the electronic locking is ready.

The depot system has the tasks of ensuring that the case is electronically locked and then can not be opened by anyone other than whom it was intended for.

In order to be able to lock a case in this fashion, the user must be entitled in accordance with authorization rules.

The routine to switch the case to safety-off in the depot is to first connect the case up to the depot computer. The depot computer senses that a case is connected up and sends out a status enquiry to the case which responds with its case number, non-fixed data (time) and other information on its physical state. In the answer form the case, the depot computer can infer what the case computer considers regarding the functioning of its inbuilt equipment. If the function status is not OK, the closing procedure should be immediately broken off.

The depot computer uses the received case number to find the current sigil key to the case and thereafter to calculate a depot sigil for the case based upon the case number and said non-fixed data.

Before the depot computer provides tha case with new opening information, the case is cleared of its logging data and optionally loaded with new information as to time and timing.

The depot computer now questions the user as to information on the customer who is to have the case. This can be the customer number or the name of those who are to have the case. Should the option of the name as identification be selected, a list is shown of the customer entries which correspond with the input key data.

With this list as a starting point, the intended customer can then be "pointed out". The input is verified against the customer register of the depot and thereafter an ID sigil key for the customer is drawn. This sigil key forms the basis for calculation of an ID sigil, a unique identification of a certain recipient. The ID sigil is calculated with TIME as a factor.

The calculated ID sigil, non-fixed base data for the ID sigil and the customer number for those who are to close the case, are forwarded to the case computer. In the depot, the customer number is actually the identity of those who are to have the case but with the category marking "depot". The case computer verifies with its own depot sigil calculation that the information comes from an authorized party, after which the information is stored in the case computer memory.

If the case computer memory is now loaded with the intended information, the depot system requests the operator to switch the case to "safety-off". Input of this command means that the operator acknowledges the case as "safety-off" and ready for delivery. If the operator elects to switch the case to "safety-on", a command sequence should be sent in order to disarm the case computer. If no response is forthcoming at all from the operator or a repeatedly wrong response is given, after a certain amount of time a command sequence is sent to disarm the case computer, i.e. "safety-on" is sent to the case.

The next initiative of the case computer is now to instruct the case computer to switch to "safety-off". This is effected by calculating the depot sigil from the sigil key of the case and TIME, and forwarding it together with sigil data and command codes to the case.

The case verifies with its own calculation of the depot sigil that the command comes from an authorized party after which a function test is initiated. Depending on the outcome of this function test, the response "closed" or "open" is delivered back to the depot computer.

If the depot computer does not receive any response from the case, this should be alerted on the screen of the depot computer so that as much attention as possible is brought to bear.

OPENING THE CASE

A case has two locks, one physical and one electronic when it is to be opened in the depot. The physical lock consists of a simple plastic seal and has the task of preventing opening by mistake. To open the plastic seal a hand grip is required which causes the "opener" to consider and to carry out the various manipulations in the opening routine in the right order.

The electronic lock is based on an ID sigil and keeps the case safety-off. The case sigil enables the case to recognize itself and the ID sigil identifies the authorized recipient. A safety-off case is ready to be

"detonated" as long as it does not receive information to its case computer that it is in a safe environment or information that is adequate to identify an authorized recipient.

The depot system has adequate information to be able to open all of the cases which are freighted to and from the customers of the depot.

Authorization in accordance with the authorization rules is required to gain access to the opening information of the depot system.

The routine for the opening of a safety-off case in the depot is to first connect up the case to the depot system. The depot computer "senses" that a case is connected and sends a status enquiry to the case. The case responds to this status enquiry by reciting information on its case number etc.

The depot computer draws a depot key for calculation of a depot sigil. The depot sigil is calculated on TIME and forwarded to the case together with base data (TIME) in a "give me opening parameters" transaction to the case computer.

The case computer calculates its own depot sigil guided by the data received from the depot computer. The depot sigil is compared with the received depot sigil and if the two correspond, the case computer considers itself safe to communicate further with the depot computer. This communication is effected in the form of a "here are my opening data" message back to the depot computer. This message contains information for sigil calculation (DATE) and information on the customer (customer number) who packed the case.

From the opening data from the case, the depot computer draws the ID sigil key intended for the actual customer. An ID sigil is calculated and forwarded in an "open up" transaction to the case computer.

The case computer compares the thus transferred ID sigil with the sigil which identifies the authorized recipient and if these correspond the case computer "disarms" the destruction device and detectors and advises this, ("open"), to the depot computer.

The depot computer advises the "opener", via its screen,

that it is now appropriate to remove the plastic seal and physically open and empty the case.

During the dialogue between the depot and case computers, the timer of the case computer is operating. In order to keep the timer in check during the opening procedure, it is necessary that the depot computer can retrieve the case number and thereby the transport key in order to calculate the transport sigil.

All transactions from the depot computer to the case computer which are some form of command should contain a depot sigil for verification by the case computer before the case computer takes any action.

If the opening procedure fails in any manner, the case computer becomes unreceptive for around five seconds, before the next opening attempt can be made. This is in order to discourage the possibility of simulating the depot computer and by trial and error arrive at the correct opening information.

THE DEPOT VEHICLE COMPUTER

Many cases are handled at the depot. It is therefore not always certain that a loaded case can be collected just when it is packed and ready. Accordingly, the case is connected up to a "vehicle computer" in the depot while waiting for collection and lading. The vehicle computer polls the whole time to thf connected-up case or cases and thus keeps the case timers in check.

Logging is effected for each newly connected case and when a case no longer responds to polling.

LOGGING

In principle, every event in the system is logged where and when it occurs. The depot system logs events which the depot system has control over, the case computer logs events which lie near to hand and the vehicle computer does likewise in its quarter.

The depot computer logs every event with user identity, time point and function used (requested).

Each case logs itself by storing information on events during loading, transport and opening procedures.

The vehicle computer logs events in its proximity. Each time a case registers itself as "newly entrained", the vehicle computer logs this fact. When the case eventually no longer responds to polling, the vehicle computer notes this in its log.

The case logs are routinely cleared in connection with new packing but his can also be explicitly effected by a special request from the depot computer to the case computer.

The vehicle computer is connected up to the depot computer for clearing of the vehicle computer logs, whereupon log clearing command sequences are sent from depot computer to vehicle computer.

COMPILATION OF LOGGED INFORMATION

The depot system has the capability to compile an event log for a certain case/vehicle/depot or customer. Upon closing of a case, certain information on the case, date, time, customer and transport information are stored. This information can later be retrieved at some convenient

occasion and reconciled with the correponding information from the case and vehicle computers for possible follow-up purposes.

DEPOT COMPUTER - CASE COMPUTER

The communication between the depot and case computers is bidirectional at the initiative of the depot computer.

Each "statement exchange" is verified by the case computer via the depot sigil.

In order for the case computer to take up information, it is necesary that the case must be able to determine that it is communicating with a depot. This is effected by the handshake between the depot computer and case is initiated with the depot enquiring after information upon which to calculate the depot sigil. The case supplies this to the depot computer whereupon the depot sigil is calculated and transferred to the case computer where the sigil is compared with the sigil calculated by the case computer. If the comparison is favourable, the case computer regards itself safe to continue communication.

DEPOT COMPUTER - VEHICLE COMPUTER.

The depot and vehicle computers hold bidirectional communication at the initiative of the depot computer. The communication includes functions for loading of the transport keys and clearing of logs.

Each "statement exchange" is verified by the vehicle computer via a depot sigil following the pattern of communications between depot - case.

TRANSPORT

During the vehicle transport itself (Fig. 4), the case is coupled with a lead to a sealed, vehicle or sigil computer which regularly "polls" e.g. decouples/deactivates the time mechanism. The vehicle computer contains a transport key which can be the same for a given transporter within a whole district and therefore can deactivate all the cases which belong to the district (depot area). The transport sigil does not allow unlocking of the case. It is also possible to time restrict the duration of this coupling.

The case also contains the transport key which is used for verification.

The vehicle computer should be kept activated by deliberate actions of the transporters. For example, the following conditions can be posed in order that the vehicle computer should remain alive and legitimate the cases:

1. Radio in the vehicle switched on.

2. Position information is regularly sent (every 5, 10, 15 minutes)

This can be supplemented with e.g. signalling from central-security to the valuables transport vehicles and "hot keys" which give a silent alarm and disable the vehicle computer. The signalling can include a location sigil which is to be verified by the computer in the vehicle for maintaining continued operation. This can, e.g. be de-pressed by the vehicle personnel when responding to a position call.

Regardless of what is sent, this regular radio traffic gives good assistance in tracking the vehicle, when necessary.

In addition to the above, there can also be an absolute time-out for the vehicle computer in the vehicle. When the running time is finished, the computer must be "tanked up" in order to renew its case legitimation ability.

The recipient's ID sigil (Fig. 5) is required for post- transport unlocking. This is calculated by a sigil computer or sigilator in combination with a smart card which contains the personal ID sigil key while also utilizing open information on e.g. date and loading time of loading the case number.

When a large number of sigil keys are to be managed, e.g. in a depot, an administrative aid, such as a PC with sigil software, encryptation etc, becomes practical.

The one or two authorised persons/officers which are needed, for instance at a bank branch, can each be equipped with a personal "Smart Card" with ID sigil key. The valuables transporter carries a sigilator with communication capability with the case (adjustment only possible when the case is open) with whose help the secret sigil is created and stored in the case. The valuables transporter brings along the open information and someone with the sigil key at the second location can thereby give the right code to the case to open the lock mechanism. In order to be able to also attend to opening and closing without the presence of the transporter the, e.g. bank branch, can be equipped with its own sigilator.