The present invention relates to a method and apparatus for purchasing goods from a vending machine using a chip-type payment card with personal identification means.

Hole in wall cash dispensers, where cash can be withdrawn using a debit or credit card are well established More recently, banks have been issuing so called chip & PIN cards to increase account security. Such cards have a microchip imbedded within and a user enters a four digit personal identification number (PIN) to gain access to an account.

However, chip & PIN verification is at present only used with hole in wall cash dispenser machines and by customers in shops (and other retail outlets); in the latter case under the supervision of a sales person. While credit and debit cards are widely used for purchases made over the telephone and the INTERNET in such cases the CHIP function is not used; hence, there is no check that the card is authentic.

Vending machines that dispense goods to users following cash payment are also well known. Such machines are typically securely fixed free standing units located in public places. Such machines suffer the security drawback of offering attractive targets for potential thieves not least because they contain cash deposited by recent users. This disadvantage is magnified if such machines vend relatively high value goods owing to the larger amount of cash stored in such machines. This in part probably explains why the use of public vending machines has declined somewhat in many countries over the last few years.

Consequently, there is a need to provide an alternative form of payment for vending machines in general and especially for such machines located in a public place that vend relatively high value items.

Another problem with vending machines is timely attendance; particularly to empty machines of cash and charge machines with goods for vending. In addition such machines are often unavailable owing to damage or malfunction.

Consequently, there is also a need to monitor the state of such machines so that timely attendance and maintenance can be scheduled.

An aim of the present invention is to provide a method and system for use with a vending machine that provides a more secure way of payment for vended goods and avoids the use of cash. Another aim is to provide such a system where a user presents personal identification means, the authenticity of which is checked by reference to a remotely located data-bank. Another aim is to produce a system that can be maintained in a more timely manner.

In a first aspect the invention comprises a vending machine system for pre-payment of vending goods for use with payment card with an imbedded microchip comprising; a main processor; a card reader; means for entering personal identification data and means for validating that the correct identification data has been entered; means of communicating with an external database using card reader software and encrypted data flow via a wireless link, in order to obtain authorisation or rejection of the transaction; interface means that allow the main processor to control the vending machine mechanism and thereby vend the selected purchased goods.

Preferably, the main processor controls a vending machine processor by emulating normal vending machine key or touch pad commands. Preferably, the reader software validates the personal identification data by reference to encrypted data contained within said imbedded microchip.

Preferably, the card reader is for reading a credit card or a debit card. The card reader may be for reading a pre-paid type card.

Preferably, the wireless link is a GSM or GPRS type.

Preferably, the personal _. identification data comprises a personal identification number (PIN) or an alpha-numeric code.

Preferably, data flow is encrypted using asymmetric encryption algorithms. More preferably, triple DES encryption, RSA encryption or SHA encryption is used.

Preferably, a user selects specific goods and the user's payment card account is debited correspondingly.

Preferably the card reader comprises a microchip that runs card reader software. Preferably, the microchip also runs interface software to facilitate communication between the card reader software and software on the main processor. Preferably, software running on the main processor controls a touch display or a keypad by means of which a user may select goods to be vended.

In a second aspect the invention comprises a method of vending goods for use with a vending machine using a payment card with an imbedded microchip comprising the following step; (a) presenting a payment card with an imbedded microchip to a card reader, prompting a user to present personal identification data and means of validating the correct personal identification data has been entered; (b) communicating with an external database using card reader software and a wireless link and encrypted data flow, in order to obtain authorisation or rejection of the transaction; and (c) using interface means that allow the main processor to control the vending machine mechanism and thereby vend the selected purchased goods.

Preferably, the interface means allows the main processor to control a vending machine processor by emulating normal vending machine key or touch pad commands.

Preferably, the reader software validates the personal identification data by reference to encrypted data contained within said imbedded microchip.

Preferably the method comprises the further step of ; (d) prompting a user to select goods for purchase using a touch screen or screen and keypad driven by a main processor, calculating the value of the goods and communicating this value to the card reader software.

Preferably, the personal identification data is a PIN and entry of the correct PIN is validated by reading data stored on the imbedded microchip. Preferably, the data flow is encrypted using asymmetric encryption algorithms.

At least part of the purchased item may comprise material produced by a printer that responds to commands from the main processor.

Preferably at least one of; the mechanical state of the vending machine; the amount of stock sold; the inventory of goods for sale, is monitored from a remote site using said wireless link. Said monitored information may be provided by a vending machine controller.

The invention will now be described by reference to. the following diagrammatic figures in which:

Figure 1 schematically presents the main components of a system according to the present invention and also shows links with immediately associated apparatus; and

Tables Ia to Ie present sequential information of events that occur in various modules of the system during a purchase cycle.

A first embodiment of the invention will now be described by reference to Figure 1, which shows a vending machine 10, and in particular the main components of the system and also shows links with immediately associated apparatus.

A user presents a payment card (C), having an imbedded microchip or the like, to card reader device 12. Card reader 12 has a keypad 14 and a LCD display 16. The Card reader device 12 also includes a local microprocessor 18 that runs various software. This software comprises card reader software (CR-S), personal identification means software (PIM-S) and interface software (INTER-S). CR-S includes an encryption module. INTER-S allows communication with a main processor 20. Main processor 20 runs control software (CONT-S) and as necessary allows the card reader software to communicate with a remote databases (B or C) via an interface device 22 such as a modem; preferably a wireless modem. Remote database

B is typically a banking system computer that authorises payment and debits user accounts.

The CR-S communicates with the bank B using encrypted data and thereby handles the payment authorisation process and the CR-S displays messages on card reader display 18.

Main processor 20 also sends instructions to a vending machine controller (VMC). A user selects goods to be vended using a second keypad 24; which preferably takes the form of a

LCD touch screen. A record of a purchase using a payment card is presented to a user by printer 26 connected to main processor 20. A similar record is also printed if a user pays by the alternative means of using coins or cash.

Alternatively, modem 22 may communicate directly with the card reader 12.

In a typical purchase cycle the main steps (a) to (e) are as follows:

(a) Insertion of Chip & PIN card, and invitation to select goods - A user inserts a Chip & PIN card in card reader 12 and touch screen 26 is then activated by CONT-S. The touch screen menus are all stored on the CONT-S. Once the customer has made their selection, the purchase price is calculated.

(b) calculation of purchase price and sending data to CR-S - The VMC stores the price of goods on offer; following selection of goods in step (a) CONT-S requests the price from the VMC and the VMC returns the requested price to the CONT-S. The storing of the prices in the VMC is a legacy requirement of the VMCs system; however, the requesting of prices by the CONT-S distinguishes the present system from the prior-art, and is designed to overcome the limitations of the VMC. The debit amount is then sent to CR-S.

(c) PIN Authorisation and relaying of encrypted data from CR-S to Bank via main processor and modem (both data out and then data in) - CR-S requests the user to enter a personal identification number using keypad 16. CR-S then interrogates the microchip on card C to check that the correct PIN has been entered. If the correct PIN has been entered, the CR-S authorises the transaction with the bank. The authorisation process is handled entirely by an encryption module within CR-S. This encryption module receives card details from the card reader [see step (a)] and the debit amount from CONT-S via INTER-S [see step (b)] and then uses the main processor 20 and modem 22 to contact the bank, and the bank then either authorises or rejects the transaction and returns the result to CR-S. Data sent to and from the bank to CR-S is encrypted using asymmetric encryption algorithms; preferably using triple

DES encryption, RSA encryption or SHA encryption.

(d) Main processor being alerted that transaction is approved by bank - The encryption module and CR-S communicates approval or non approval of the transaction to CONT-S via PIM-S and INTER-S. Following authorisation purchase details including (card number, timestamp etc.) are passed to the CONT-S.

(e) providing user with printed record of transaction and instructing VMC to vend goods -The CONT-S then print a receipt of the transaction using printer 26 and instructs the VMC to vend the purchased goods to the user.

Thus, microprocessor 18 and main computer processor 20 runs CR-S, PIM-S ₅ INTER-S and CONT-S to communicate with the VMC and B and so allow the system to function as described above.

Thus, in summary, when the above system of the invention is used to purchase goods from a vending machine; a user presents a chip & PIN payment card (C) to card reader 12 and the main processor 20 is alerted of the card insertion via local microprocessor 18. Main processor

20 then prompts the user via LCD touch display 24, to make a selection of goods to be purchased. When this data has been entered on the touch-pad the VMC 20 calculates the purchase value and this data is sent via CONT-S and INTER-S to the CR-S. The user is then prompted by the CR-S/PIM-S to enter a personal identification number (PIN) on keypad 16.

Following entry of the correct PIN, encrypted data relating to account details and the debit sum is sent by the CR-S to the remote bank clearing system B. In our system, the modem 22 is connected to the main processor 20, and the data coming from the CR is forwarded to the modem by the CONT-S If the debit is approved by the bank an encrypted signal is returned by the same path to the CR-S. The CR-S then alerts CONT-S that the transaction is approved.

CONT-S then provides the user with a printed record of the transaction using printer 26 and also sends an appropriate signal to the vending machine controller (VMC) instructing it to vend the purchased goods.

Touch display 24 may also be used for advertising; for example, if the machine isn't currently in use, i.e. not processing a credit or coin transaction, it could display advertising screens on the touch screen for people to see as they walk past. It would be comparable to a "screen saver" on which alternating advertising screen shots would be displayed.

Modem 22 preferably communicates with remote database B using GSM ₅ and more preferably using GPRS. The use of GPRS avoids standard mobile call charges the cost of the communication for GPRS being determined by the amount of data sent.

Outline description of VMC logic - The vending machine controller (VMC) is the vending machine's central processor. In a normal vending machine, it provides product selection facilities, stores product prices and locations, gives the signal to vend the product, and detects errors. In the system of the invention product selection facilities are preferably provided by main processor 20 and touch screen 24. When the VMC gets the signal from the CONT-S that an item should be vended, it retrieves stored information as to the item's location; tells a product elevator within the machine to travel up or down to the appropriate shelf, and the conveyor on which the selected product is stored to move forward until the item is moved, for example, onto the product elevator; which is then instructed to travel to the location of the collection window; and using its built-in conveyor the product elevator moves the item into this window. The item is then ready for collection. If the item was successfully vended (e.g. it has not jammed en-route) then a successful vend signal is transmitted from the VMC to the- CONT-S. If it has jammed a negative vend is sent to CONT-S. In that event CONT-S initiates a refund of the customers payment. If payment has been made by cash this is returned to the user. With card payments, the user is asked to reinsert their card, and the bank is contacted (similar steps to payment authorisations) and told to refund the amount to the card. A refund receipt is then printed for the customer.

Outline description of Bank authorisation steps - The customer's credit card details and the sale amount are encrypted by the card reader (CR-S encryption module) and sent to the bank's designated payment gateway via the main processor 20 and modem 22. Once the bank's computer systems receive this information it is decrypted and processed in the same way as any other payment authorisation request from credit/debit card terminal. The bank's system checks that the card hasn't been barred, and that there is sufficient credit in the customer's account for the sale amount to be deducted. If the transaction is successful, the bank's computer system debits the customer's account, credits the account of the merchant, and returns a success message to CR-S. This in turn alerts CONT-S to vend the item. If the bank declines the transaction, it returns a decline message to the CR-S (again via the main processor 20 and modem 22). CR-S then alerts the CONT-S and the item is not vended. CR-S also alerts the customer via a message on the card reader display 18.

General Description of Tables Ia to Ie - Tables Ia to Ie present information that show the sequence of main events for each software module and their relative timings. Thus, events listed in downward order represent the sequence of events. A vending machine display (sticker on machine and/or message on touch screens 16/24) invites a user to either insert money into a slot (not shown) or to insert a Chip & PIN enabled credit or debit card to initiate a purchase cycle. Tables Ia to Ie illustrate the main processes that occur when the user inserts a card.

When the user inserts their card into the card reader, a mechanism in the card reader detects the card and alerts CR-S, which in turn alerts PIM-S which alerts IKTER-S of the card entry. INTER-S checks that the card is one of the types of credit card that is accepted (a "valid" card, e.g. Visa, MasterCard but perhaps not AMEX etc.). If the card is valid, and has not been inserted in order to obtain a refund (discussed later), INTER-S initiates a transaction.

To initiate a transaction INTER-S tells CR-S (via PIM-S) that a transaction will begin. CR- S then waits for the exact price of the item before proceeding. In the meantime, INTER-S sends a dummy value, higher then the highest priced item in the machine, via CONT-S to the VMC. This tricks the VMC into thinking that credit has been inserted into the machine, and it waits for the user's selection.

CONT-S then sends a message containing the VMCs status (e.g. that it's waiting) to CR-S via a serial link between the main processor 20 and the COM port of microprocessor 18. CR- S detects data coming in on the COM port, and passes it to PIM-S, which passes it to INTER- S where the message is read. If the message indicates the VMC is not waiting, the process is cancelled, otherwise it continues. In either case, CONT-S is alerted to the result.

If CONT-S receives a cancellation message, it displays a message on the touch screen 24 saying the process is cancelled, please remove card. If it receives the OK message, it displays the touch-screen menus on display 24 and asks the user to make a selection. The user navigates through the touch screen menus and finally confirms a selection.

Once a selection has been obtained from the user, CONT-S passes the selection to the VMC by emulating the signals it would receive from a vending machine keypad (not shown). This

tricks the VMC into thinking the user has made a selection. CONT-S then "listens" to the VMCs response on the COM port connection. The VMC retrieves the price of the selected goods from its memory and sends this data to CONT-S which then sends the price and a request to vend to INTER-S, which is forwarded via PIM-S to the CR-S and thereby tells CR- S to process the transaction. The CR-S processes the transaction by contacting the bank B via main processor 20 and wireless modem 22 using CONT-S. During this stage CR-S thinks that the card reader is connected directly to a modem, rather than connected to a main processor with an attached modem; the data from the CR-S being relayed to the modem via CONT-S. The result of the payment transaction processing is forwarded to PIM-S, which forwards it to INTER-S. INTER-S then tells CONT-S whether the payment was successful, and if yes it also includes data for the receipt.

If CONT-S is told the transaction was not successful, it tells the VMC not to vend, displays a "transaction declined' message on the touch screen, and the process is aborted. Otherwise, CONT-S tells the VMC to vend. The VMC sends a signal to vend the item and indicates to CONT-S whether or not the vend was successful. If the vend was successful, CONT-S prints the receipt, displays a "transaction complete, thank you" message, and the -transaction is complete.

If the VMC indicates the vend was unsuccessful, a refund process is initiated and CONT-S sends a "failed vend" message to CR-S via the COM port. CR-S picks up this message, passes it via PIM-S to INTER-S. INTER-S sets an internal refund flag, and tells CONT-S that the "insert card for refund" message should be displayed on the touch screen 24 (and also possibly displays the message itself on the card readers display 18). CONT-S displays a message such as "vend failed, reinsert card for refund" on the touch screen.

The user inserts card C for the refund, this is detected by CR-JS, and passed via PIM-S to the INTER-S. INTER-S knows to expect a refund because of its internal flag, so it verifies that the card inserted is the same card as before and passes a refund request and amount to PIM-S, which passes it to CR-S. CR-S then contacts the bank (again, via the main processor 20 and modem 22) and requests the refund be processed. The result of the refund is detected by PIM-S ₃ which forwards it to INTER-S. INTER-S sends the result of the refund and receipt information to CONT-S in order for it to print a refund receipt. CONT-S examines the refund transaction result - if the refund was successful, it prints the refund receipt. If it failed,

CONT-S logs the failed refund and prints a receipt for manual refund, with instructions to call a phone number shown to the user on the touch screen.

The vending machine of the invention may also vend articles printed within the machine; for example telephone top-up cards and the like. Printer 26 connected to the main processor may be used for printing such vended items. Alternatively; for printing special cards and the like a separate dedicated printer, responding to commands from the main processor, may be used,

A remote monitoring system (not shown) may advantageously be used with vending machines according to the invention. Such a system allows the machine operator or maintainer to retrieve sales reports and monitor the machine for technical faults without a technician having to be physically present at the machine. Thus, the VMC may have an auditing port; for example a port originally designed for use by engineers when servicing the machine in-situ with a handheld data terminal. An auditing port of this type can output raw data from the VMC, including sales and fault information. The main processor may be connected to this port via a serial COM connection. At the end of the day, the CONT-S requests data from the VMC via this connection, adds control messages and checksums to the data it receives, and sends the data to a remote server via the wireless modem. In this case the remote server would normally belong to the machine owner or its agent. Format software on that remote server processes and formats and processes the data as appropriate for the machine owner or its agent; for example to generate sales reports, update stock levels, order new stock etc.. This remote monitoring system will normally share modem 22 and so while the auditing data is being sent, modem 22 is temporarily unavailable to the card reader..

The Format software on the remote server typically:

1. Validates data received using a "checksum" requesting resends where necessary.

2. Imports and formats reports into "SQL" server tables.

3. Updates a sales/stock/reporting system with the updated reports.

While the personal identification means used in the present invention will normally require a user to enter an alpha-numeric string using a keypad or touch screen or the like in a further embodiment the invention uses information entered by other means; for example biometric data provided by a user. In such cases validation of the personal identification data may take

place in the remote database. However, in all other respects this embodiment of the invention uses the equipment described above for the main embodiment and follows the method described above for that embodiment.