DE102020121305B4 - Method for anonymously providing digital receipts - Google Patents

Abstract

Method for anonymously providing data packets (10a-10f), in particular digital documents, to selected terminal devices (12), comprising the steps: a) generating a data packet (10a-10f), in particular a digital document, b) linking the data packet ( 10a-10f) with an individual identification (14a-14f) of an output point (16a-16f) and a time stamp, c) storing the data packet (10a-10f) on a storage unit (18) that can be accessed by terminal devices (12), d) reading out an information carrier (20a-20f) assigned to the individual identification (14a-14f) of the issuing point (16a-16f) with a terminal (12), the information carrier (20a-20f) comprising static connection information for retrieving the retrievable storage unit (18). which is assigned to the individual identification (14a-14f) of the issuing point (16a-16f), e) retrieving the retrievable storage unit (18) with the terminal (12) using the read-out static connection information, andf) providing the data packet (10a- 10f) with the individual identification (14a-14f) that matches the retrieval and the most current time stamp from the retrievable storage unit (18) to the retrieving terminal (12).

Description

The invention relates to a method for anonymously providing data packets, in particular digital documents, to selected terminal devices, a system for data processing comprising means for carrying out selected steps of this method and a computer program product. Also disclosed are a computer-readable data carrier and a data carrier signal.

The subject matter of the invention is defined in the appended claims.

The creation of cash receipts is a necessary part of all cash accounting, which not only documents the purchase made to the customer, but also allows taxes or other charges to be shown. Both the customer and the issuing company can document their sales and expenses with appropriate cash receipts, some of which are simply referred to as receipts.

The state of the art in this area that is best known from everyday life is probably the issue of receipts to the customer in printed form. Corresponding receipts can be created automatically by a cash register system and handed over directly to the customer by the cashier. This established method has proven itself in terms of numerous aspects, especially with regard to data and audit security.

However, against the background of growing ecological awareness among the population, the established system of printed receipts is viewed increasingly critically, as large amounts of paper and printer ink are required each year to create conventional receipts, which not only consumes considerable resources, but also costs companies caused.

In addition, traditional printed receipts are often immediately discarded by customers, especially for small amounts that are not tax relevant, generating significant amounts of additional waste each year. These disadvantages are partly exacerbated by the fact that in recent years some countries have increasingly relied on regulations that make it mandatory to create a receipt and hand over the receipt to the customer, even for small amounts, in order to take action against tax fraud.

In view of increasingly scarce resources and the general desire to minimize the amount of waste generated in everyday life, there has been a need for several years to digitalize the creation of receipts and their handover to the customer. However, the major challenge in designing processes for providing such digital receipts is that they must be comparable to the conventional, analogue method of printed receipts, particularly in terms of data security.

In particular, appropriate procedures for providing digital receipts must be designed in such a way that the digital receipt created by the cash register system is reliably and securely provided to the customer, whereby in particular it must be ruled out that unauthorized persons gain access to the digital receipt. In addition, the process must be suitable for providing the digital receipts to the customer immediately, i.e. without any time delay, so that the customer can directly check the correctness of the billing, for example when shopping in the supermarket.

US 2014/0 244 462 A1, for example, discloses a system and a method for generating digital receipts for purchases made using digital wallets or other payment methods. WO 2012/155 081 A1 discloses devices, methods and systems for the management of digital documents.

To solve this problem, some approaches for corresponding digital methods from the prior art rely on the fact that a customer has to identify themselves to the cash register system, for example by having a QR code read from the user's mobile device by the cash register system, whereupon the cash register system is then used on the server side forwards the receipt data to the customer. However, this process regularly requires that the customer and the dealer use the same software system or use compatible or specially coordinated applications. Particularly for companies with frequently changing customers, for example at airports or train stations, this is often perceived as a disadvantage, especially if the coverage of the corresponding application or the willingness of customers to register is low. In addition, it is often perceived as disadvantageous with these procedures that the customer shares his data with the retailer and has only limited influence over which data the retailer reads from the customer's mobile device via the application. In addition, corresponding procedures are usually not completely anonymous, since the receipts can at least be assigned to individual users or their user accounts on the server side. From the company's perspective, it is often perceived as disadvantageous that additional Hardware must be purchased and maintained for communication between the customer's device and the cash register system in order to read the information provided by the customer.

A much-noticed further development compared to the method described above could be realized through a method for providing digital receipts, which had already been successfully placed on the market by the inventors of the present invention. In order to meet the general requirements for methods for providing digital receipts, this solution provides for the receipts created by a cash register to be digitized by a data processing device connected via the printer connection and to be displayed to the customer directly at the cash register via a permanently installed digital display, for example a tablet in order to ensure the immediate verifiability of the document. This process meets the requirement that the customer must be able to take the digital receipt with them by displaying a QR code generated individually for each transaction on the permanently installed digital display together with the digital receipt. This individually generated QR code includes variable connection information, i.e. a connection link to the displayed document on a server system, which is created individually for each document to be issued. The customer who wants to take the digital receipt with them simply has to read the QR code with their device, for example a mobile phone, and is guided via the individually created link to the digital receipt stored on a server, which is then stored on the device, for example Customers can be saved.

This system meets the important need for security by creating a separate link for each digital document generated, which is only displayed to the customer together with the document, which can also be accessed via the corresponding link. A major advantage of this solution, which has already been established by the inventors, is that in principle any commercially available display device, for example a tablet computer, can be used as a display and that the method can also be combined with older cash register systems by using the output of the printer interface.

Despite the success of the system described above, certain aspects are sometimes perceived as disadvantageous. In particular, this method, which is known from the prior art, requires that the company must provide a separate electronic device for displaying the receipts at each individual issuing point, i.e. for example at each cash register or at each waiter's mobile billing device. This can be associated with considerable costs, especially for large companies, and also requires the appropriate devices to be installed at the issuing points in a theft-proof manner. In addition to the additional energy consumption caused by the additional electrical devices, it is also perceived as a disadvantage that the tablets themselves, which are mostly operated via wireless networks, can potentially be vulnerable to unauthorized access if they are not maintained and secured according to regulations.

The method previously presented by the inventors has already proven to be very powerful in practice, especially in comparison with alternative systems that require the installation of a separate application on the customer's device and/or the customer's registration in a separate database . Nevertheless, there was a need to further develop the solutions already known from the prior art.

The overarching object of the present invention was accordingly to provide a method for providing digital receipts which, in terms of performance parameters, is comparable to the established method using printed receipts, but which eliminates or at least reduces the disadvantages of the prior art described above.

In particular, it was the object of the present invention to provide a method with which the consumption of paper and printer ink in the business operations of companies can be reduced and through which the amount of paper waste generated can be reduced.

The procedure to be specified should preferably enable the customer to have access to the document created for him immediately when the invoice is created in order to be able to check the correctness of the document. In addition, it was an important requirement of the present invention that the digital receipt must be made available to the customer to take with them directly at the issuing point, e.g. at the checkout.

An important object of the present invention was to provide a method which, compared to the prior art, places lower demands on the infrastructure to be provided by the company at the issuing point and in particular removes the need for separate electronic display devices.

Particular attention was also paid to the task of specifying the procedure The digital receipts should be provided anonymously, i.e. without the company or other customers being able to obtain information about the customer.

In this context, it was a further object of the invention to design the method in such a way that it is protected not only against the accidental, unwanted delivery of digital documents to unauthorized end devices, but also against malicious access by unauthorized third parties.

It was a requirement that the method to be specified should, if possible, work without the installation and/or use of specific applications on the customer's end devices in order to enable the broadest possible usability and to reduce any barriers to the use of the corresponding method, in particular also The need for a separate user registration in a database should be avoided.

Finally, it was an object of the present invention to provide a system for data processing, which includes means for carrying out the procedural steps required by the cash register system, and to provide an associated computer program product.

The inventors have recognized that the above-mentioned technical problems and tasks can surprisingly be solved by a method for anonymously providing digital receipts, which, unlike the prior art, uses a static information carrier which is arranged in the area of the issuing point and which contains static connection information, which is therefore the same for a large number of customers and does not have to be generated individually for each customer.

A customer who wants to pick up a digital receipt after making a purchase simply has to read the static information carrier, which can be a sticker with a QR code, for example, and receives the digital one using any web browser pre-installed on their device Receipt provided, whereas the subsequent customer only sees his own digital receipt via the same static information carrier and the same static connection information, but not that of the predecessor.

This system not only eliminates the need to install a separate application on the customer's device, but also eliminates the need for the company to provide a separate infrastructure beyond attaching a simple sticker with negligible material value, in particular ensuring the anonymity of the customer The process is guaranteed in a very special way, as the company's cash register system does not have to read out any data from the customer.

This advantageous method is implemented in that the digital document and its retrieval by the terminal are processed in a special way by the system used for data processing in the method according to the invention. An individual identification is created for each issuing point, i.e. for example a cash register or a waiter's mobile billing device. The information carrier arranged at the corresponding issuing point and the static connection information stored therein are linked to the individual identification of the corresponding issuing point. If a digital receipt is to be issued at the corresponding issuing point, the receipt generated by the data processing system is linked to the individual identification and a time stamp and stored on a server in a retrievable manner, whereby a stack of receipts containing all receipts is expediently generated for each individual identification , which were created for individual identification, but of which only the last document, i.e. the document with the most current time stamp, is active and therefore retrievable.

When the customer reads the static connection information from the information carrier, he is connected, for example via a forwarding server, to a retrievable storage unit of the data processing system. The data processing system takes into account the individual identification linked to the request of the terminal device, which depends on the information carrier read, as well as the time of retrieval and generates dynamic connection information from this, which leads the retrieval by the terminal device to the stored digital document. This so-called individual link, which is created individually for each stored digital document only when it is accessed, can be limited in time and/or in the number of views.

The procedure described above using an exemplary method results in an improved method for the anonymous provision of digital documents, which, according to the inventors' knowledge, is fundamentally also suitable for the anonymous provision of other data packets that are to be transmitted to terminal devices in comparable situations, so that the invention In principle, the method is not limited to the provision of digital receipts, even if this intended use is explicitly preferred.

The above-mentioned tasks are solved accordingly by methods for anonymously providing data packets, in particular digital documents, to selected end devices as well as data processing systems and computer program products, as defined in the claims. Preferred embodiments according to the invention result from the subclaims and the following statements.

Such features of methods according to the invention for anonymously providing data packets, in particular digital receipts, to selected terminal devices, which are referred to below as preferred, are combined in particularly preferred embodiments with other features referred to as preferred. Combinations of two or more of the methods described below as particularly preferred are therefore very particularly preferred. Additional features of preferred systems and computer program products according to the invention result from the features of preferred methods.

1. a) Erzeugen eines Datenpakets, insbesondere eines digitalen Belegs,
2. b) Verknüpfen des Datenpakets mit einer individuellen Identifikation einer Ausgabestelle und einem Zeitstempel,
3. c) Speichern des Datenpakets auf einer von Endgeräten abrufbaren Speichereinheit,
4. d) Auslesen eines der individuellen Identifikation der Ausgabestelle zugeordneten Informationsträgers mit einem Endgerät, wobei der Informationsträger eine statische Verbindungsinformation zum Abruf der abrufbaren Speichereinheit umfasst, die der individuellen Identifikation der Ausgabestelle zugeordnet ist,
5. e) Abrufen der abrufbaren Speichereinheit mit dem Endgerät unter Verwendung der ausgelesenen statischen Verbindungsinformation, und
6. f) Bereitstellen des Datenpakets mit der zu dem Abruf passenden individuellen Identifikation und dem aktuellsten Zeitstempel von der abrufbaren Speichereinheit an das abrufende Endgerät.

The invention relates to a method for anonymously providing data packets, in particular digital documents, to selected terminal devices, comprising the steps:

1. a) generating a data packet, in particular a digital document,
2. b) linking the data packet with an individual identification of an issuing point and a time stamp,
3. c) storing the data packet on a storage unit that can be accessed by end devices,
4. d) reading out an information carrier assigned to the individual identification of the issuing point with a terminal, the information carrier comprising static connection information for retrieving the retrievable storage unit, which is assigned to the individual identification of the issuing point,
5. e) retrieving the retrievable storage unit with the terminal using the read out static connection information, and
6. f) Providing the data packet with the individual identification corresponding to the retrieval and the most current time stamp from the retrievable storage unit to the retrieving terminal device.

With the method according to the invention, data packets are provided to selected terminals, whereby the data processing system that can be used in the method does not have to receive any individual information from the selected terminal, so that the provision is made anonymously.

Even if the method according to the invention is fundamentally suitable for providing various data packets, it is particularly preferred that the data packets are digital documents.

A digital receipt is a compilation of data that contains, in particular, payment information and information about the company that created the digital receipt. Digital receipts are intended for distribution to customers and may contain additional information if necessary, such as information about promotional offers and/or voucher programs.

In the method according to the invention, a data packet is first generated, which can in particular be a digital document. The generation is carried out, for example, by a cash register system, which can be a single cash register or a network of several cash registers that are connected to one another in a larger data processing system. A digital receipt can be generated, for example, by a waiter billing for food eaten at the table using a mobile billing device or by a cashier recording purchased goods using a cash register and billing them, whereupon a data processing device creates the digital receipt.

In the context of the present invention, the devices used to record the invoice data, for example the mobile billing device used by a waiter to record the invoice or the cashier's cash register, are referred to as the issuing point because they are usually used in the analog processes with printed receipts at these points The receipt would also be issued to the customer. The device used for billing, i.e. the issuing point, is part of a data processing system either alone or in cooperation with other devices, which is suitable for carrying out the method according to the invention and through which the data packet is provided anonymously to the terminal device.

Each issuing point is assigned an individual identification. This individual identification is usually unique within the data processing system and serves to identify the issuing point in the data processing system. The individual identification can contain additional information about the issuing point or be assigned depending on this, in particular about system parameters of the device used at the point of delivery to create the data packet, as well as other markers such as the responsible employee employee, the number of the table served, the location at the moment of billing or other parameters, regardless of whether these are later included in the digital receipt.

A method according to the invention is therefore preferred, wherein each issuing point is assigned the respective individual identification depending on one or more parameters, in particular depending on the location and/or the area of responsibility and/or the responsible operator.

The data packet generated in step a) is linked to the individual identification of the corresponding issuing point. This means that the generated data packet can be assigned to the corresponding issuing point. In addition, the generated data packet is linked to a timestamp. In the context of the present invention, a timestamp is basically any information that enables a chronological arrangement of the data packets provided with the timestamps.

In the method according to the invention, the generated data packet is stored on a storage unit that can be accessed by terminal devices and which in turn is part of the data processing system. In the method according to the invention, it is irrelevant in which order steps b) and c) are carried out, although simultaneous execution is also possible. For example, the data packet can be linked to the individual identification of the issuing point and the time stamp before, simultaneously with or after the data packet is stored on the storage unit that can be accessed by terminal devices.

According to the invention, the storage unit can be accessed by terminal devices. In the context of the present invention, the term terminal device refers to devices with which the customer retrieves the generated data packet. The terminal device to be used in the method according to the invention therefore does not belong to the data processing system that the company must set up in order to be able to carry out the method according to the invention from its side. The retrievable storage unit must be retrievable in the intended operation of the customer's end devices. The retrieval can take place, for example, via a wireless connection, in particular a wireless Internet connection.

A particularly relevant example in practice of a storage unit that can be accessed by end devices is a server that is connected to the Internet and can be accessed via connection information.

In step d) of the method according to the invention, for example by a customer, an information carrier which is assigned to the individual identification of the issuing point is read out using a terminal. The corresponding information carrier includes static connection information for direct or indirect, i.e. for indirect or immediate, retrieval of the retrievable storage unit, i.e. for example the server, the static connection information being assigned to the same individual identification of the issuing point as the information carrier itself.

A method according to the invention is preferred, wherein the static connection information comprises a link to an object on the retrievable storage unit.

Even if this is usually disadvantageous for practical use, one of the simplest configurations of the information carrier can theoretically be implemented using a described paper on which the static connection information is written out in the form of a link. This link can be read by the terminal device, if necessary with the involvement of the device user, in order to obtain the static connection information for retrieving the retrievable storage unit. The assignment of the static connection information for retrieving the retrievable storage unit to the individual identification of the issuing point is carried out, for example, by assigning the destination on the retrievable storage unit to which the static connection information refers. In the more practically relevant cases, the information carrier assigned to the individual identification of the issuing point is a QR code or an NFC chip, which can be read out casually using commercially available terminal devices, such as cell phones, and enables the static connection information to be read out automatically.

In the context of the present invention, the concretization of the connection information into static connection information means that the information carrier is intended and intended for reading by several terminal devices in the course of providing several different digital documents, the static connection information, i.e. for example the link to the retrievable storage unit , between 2 or more, preferably 10 or more, particularly preferably 100 or more, very particularly preferably 1000 or more, retrieval does not change.

Particular preference is therefore given to a method according to the invention in which steps a) to f) are carried out n times to retrieve data packets by different terminal devices while reading them out of the same information carrier and using the same static connection information, where n = 2 or more, preferably 10 or more, particularly preferably 100 or more, very particularly preferably 1000 or more.

Methods according to the invention are particularly preferred in which the static connection information contained in the information carrier cannot be modified by the issuing point.

The above statements mean that an information carrier with static connection information can be present even if the form of representation is not static in the sense of permanent and unchangeable. A sticker with a printed QR code, which does not change until the sticker is removed manually, is in any case an information carrier with static connection information within the meaning of the present invention. At the same time, however, it could be possible not to implement the corresponding QR code using a sticker, but to display it via a digital display area, even if this solution is explicitly not preferred in view of the additional effort required for electronic infrastructure. In this case, we can speak of static connection information if the displayed QR code is intended for multiple use by end devices and is not regenerated depending on each new digital document to be provided, i.e. not to a new one for each digital document to be provided individual link, i.e. dynamic connection information, is adapted.

In the method according to the invention, in step e) the retrievable storage unit is retrieved by the terminal, using the static connection information read from the information carrier. The corresponding retrieval therefore contains information that can be recognized by the retrievable storage unit about the individual information of the issuing point to which the information carrier is assigned. The retrieval of the retrievable storage unit by the terminal in step e) can be done either directly or indirectly, for example by interposing a further device for data processing, for example a forwarding server, which mediates the retrieval of the retrievable storage unit by the terminal by creating dynamic connection information.

As a result of the retrieval in step e), the method according to the invention provides that every data packet is made available to the retrieving terminal from the retrievable storage unit, which not only matches the individual identification of the issuing point that is associated with the retrieval, but also for the corresponding individual identification has the most current timestamp. In principle, various implementations are conceivable for this step, which can be implemented by the retrievable storage unit. Methods according to the invention are preferred, for example, in which the retrievable storage unit is set up in such a way that, when retrieved by a terminal, it can only provide the data packet with the most current time stamp for each individual identification, and / or in which step c) is carried out in such a way that, at least temporarily, preferably at any time, for a given individual identification, all data packets with the exception of the data packet with the most current time stamp are deactivated and / or archived so that they can no longer be retrieved and / or stored data packets on the retrievable storage unit after a predetermined number of retrievals by a The device must be deactivated and/or archived so that it can no longer be accessed.

Since these methods regularly have a particularly high user acceptance and require a particularly low investment requirement, methods according to the invention are preferred, whereby the terminal device does not include a data processing program specifically tailored to the method and/or where the terminal device is not registered for use in the method, and/or wherein no electronic devices are provided at the issuing point for reproducing variable connection information to the terminal.

Steps a), b), c) and f) of the method according to the invention are the steps that are not carried out by the customer's terminal, but for which the infrastructure is regularly provided by the entrepreneur. Accordingly, these steps are carried out by a data processing system. This data processing system expediently comprises a data processing device with at least one output point, the output point being to be understood as defined above. In addition, the data processing system includes the retrievable storage unit. In the simplest case, which would probably be rare in practice, the data processing system could, for example, be formed by a single cash register or a single mobile billing point. In this case, the corresponding device is both the issuing point and the data processing device that is used to create the digital document, and must also include a storage unit that can be accessed by the terminal device, so that this device, for example because it is linked to the Internet, can also form the retrievable storage unit. In practice it will the data processing system is regularly formed by a central data processing device, for example a cash register system, which is connected to numerous separate issuing points, for example different cash registers, potentially in different branches. In this case, the retrievable storage unit could in principle be formed by the data processing device. However, a system for data processing is particularly preferred, wherein the retrievable storage unit is arranged decentrally and is connected to several devices for data processing.

Methods according to the invention are therefore preferred, with steps a), b), c) and f) being carried out by a data processing system, the data processing system preferably being a data processing device with at least one output point, in particular a cash register system with at least one output point , and the retrievable storage unit, wherein the at least one issuing point is preferably a cash register or a mobile billing point.

Accordingly, a method according to the invention is particularly preferred, wherein the retrievable storage unit is a retrievable server, which is preferably connected to several data processing devices.

In practice, methods according to the invention have proven to be particularly advantageous in which the information carrier is a QR code, an RFID chip or an NFC chip on which the static connection information is stored. Given the widespread use of mobile phones, these information carriers, which are particularly easy and convenient to read, have proven themselves, especially since they are particularly easy to install and inexpensive to provide. The corresponding information carriers can be read with all commercially available mobile devices and save the need to manually enter complex connection information. With regard to the method according to the invention, it has proven to be particularly advantageous to arrange the information carrier at the issuing point or near the issuing point in order to be able to provide the customer with the digital receipt at any location where he is used to using conventional methods is to receive the receipt. Possible examples of the arrangement of the information carrier are, for example, in the goods storage area of the checkout of a supermarket or on the billing device of a waiter.

Methods according to the invention are therefore preferred, wherein the information carrier is a QR code or an RFID chip, preferably a QR code or an NFC chip, wherein the terminal comprises means for reading the information carrier, the information carrier preferably being at the issuing point or in is arranged near the issuing point, and/or wherein the terminal is a mobile terminal, preferably a mobile telephone or a tablet computer.

In particularly preferred methods according to the invention, the information carrier is a sticker or a plaque, in particular a sticker or a plaque with a QR code.

In principle, the method according to the invention can be implemented with any type of time stamp, provided that this time stamp enables a chronological classification of the digital documents generated for each individual identification. However, it has proven to be expedient to provide the timestamp in such a way that it correlates with the time at which the data packet was generated. In a particularly simple embodiment, the timestamp corresponds exactly to the time at which the data packet was generated.

A method according to the invention is therefore preferred, wherein the timestamp includes information that correlates with the time at which the data packet was generated.

With regard to the organization of the retrievable storage unit, it has proven to be expedient to generate so-called stacks of data packets for each individual identification within the retrievable storage unit. This means that the data packets associated with an individual identification are not stored arbitrarily on the retrievable storage unit after generation, but are summarized in the manner of a stack in such a way that only the top data packet of a stack can be retrieved, with the last one generated in each case being retrievable Data packet is stored as the top and therefore retrievable data packet on each stack. Accordingly, a method according to the invention is preferred, wherein the retrievable storage unit comprises a separate stack of data packets for each individual identification.

Even though in principle various solutions are conceivable in order to only provide the data packet with the most current time stamp for a specific individual identification upon retrieval by a terminal device, it has proven to be particularly efficient in practice to carry out the retrieval in such a way that the read out from the Static connection information and the time of retrieval generates dynamic connection information using an appropriate algorithm which includes a link to the corresponding data packet with the individual identification suitable for retrieval and the most current time stamp on the retrievable storage unit.

A method according to the invention is therefore very particularly preferred, wherein the provision in step f) takes place by correlating the static connection information with the time of retrieval in order to generate dynamic connection information that links the data packet to the retrieval individual identification and the most current time stamp on the retrievable storage unit, the dynamic connection information preferably only being generated as a result of a retrieval by a terminal.

Knowing the invention, a corresponding algorithm or a corresponding application that carries out this correlation and creates the dynamic connection information can be programmed by the person skilled in the art based on his specialist knowledge, whereby he can adapt it to the infrastructure and the needs of his respective data processing system.

The preferred method according to the invention described above has proven to be particularly advantageous in particular with regard to the wide range of security options that can be provided and, in the inventors' opinion, is in this respect superior to alternative solution concepts.

The correlation can be done, for example, by the retrievable storage unit or by a computer program product present on it. However, very particularly preferred embodiments are those in which the correlation is carried out by a separate forwarding server, which is connected upstream of the retrievable storage unit. This structure has proven to be particularly effective because the forwarding server, which in this case forms part of the data processing system, can be provided centrally by a provider for several data processing devices, i.e. for example cash register systems, and thereby in particular also central security measures in the area of Forwarding server can be provided. A method according to the invention is therefore preferred, wherein the correlation is preferably carried out by a forwarding server, particularly preferably by a forwarding server which is connected to a plurality of data processing devices, and wherein separate dynamic connection information is preferably generated for each data packet.

To generate the dynamic connection information, the forwarding server ultimately only needs the information about how the data packets are stored on the retrievable storage unit depending on the individual identification and the time stamp or which connection information is assigned to a corresponding data packet on the retrievable storage unit in order to be able to do so as a result of a retrieval by a terminal that includes information about the individual identification, and taking into account the timestamp, to generate the associated dynamic connection information, through which the retrieving terminal is directed to the corresponding data packet on the retrievable storage unit.

As explained above, a major advantage of the method according to the invention and the preferred embodiment is that various protective measures can be provided particularly efficiently in order to make the method particularly safe. This may be necessary in some cases in order to ensure particularly comprehensive protection of potentially sensitive information.

It has proven to be a particularly efficient security measure if the dynamic connection information generated in the preferred method according to the invention, i.e. the connection information generated from the static connection information to the most current data packet, only after a separately issued release, for example by pressing a real or digital button at the issuing point by the cashier, can only be accessed for a predetermined number of calls or for a specific time. For particularly sensitive information, it has proven to be effective to limit the number of retrievals to a single retrieval, although for less critical situations, such as a supermarket checkout, it can be expedient to at least enable a second retrieval, if the first one Retrieval problems occur.

A particular advantage of the preferred embodiment of the method according to the invention via generating the dynamic connection information is that this dynamic connection information can be hidden from the user of the terminal. While the static connection information stored in the information carrier can in principle be accessed by anyone, the connection information that actually leads to the digital document is additionally protected, so that unwanted subsequent access by the user of the retrieving terminal device can also be ruled out.

A preferred method according to the invention is therefore preferred, wherein the dynamic connection information can only be used for a predetermined time after the data packet has been generated and/or only for a predetermined time after release at the output point and/or only for a predetermined number of retrievals, the dynamic Connection information is preferably hidden in such a way that it cannot be accessed separately by the user of the terminal.

As explained above, the basic design of the method according to the invention provides that the data packet with the most current time stamp can be called up for each individual identification. However, particularly with sensitive data, it can be advantageous if deactivation or

Archiving also includes data packets that have the most current timestamp. The benefit of a corresponding device for the expert is particularly apparent when, for example, the last billing transaction of the business day is viewed, which would otherwise lead to the corresponding digital receipt being visible on the server overnight until the next business day, in particular if a Method is selected that does not require the path described above as preferred via the dynamic connection information. In this respect, a method according to the invention is preferred, wherein stored data packets on the retrievable storage unit are deactivated and/or archived after a predetermined time, regardless of retrieval by a terminal or other factors, so that they can no longer be retrievable.

Additionally or alternatively, the retrieval of the retrievable storage unit with the terminal using the static connection information or the dynamic connection information generated from this can be secured with further protective measures, which can advantageously be implemented particularly easily in the method according to the invention. One possibility is to enter a password or a PIN, although in our own experiments it has proven to be particularly practical to provide the invoice amount, for example the last four digits of the invoice amount, as a PIN, since this information is quickly available and at the same time largely variable. in order to identify the authorized customer and their device directly on site.

Additionally or alternatively, a further information carrier can also be provided at the issuing point, which contains additional authentication information, so that authentication according to the public-private-key principle is possible. Here, the information carrier is first scanned as part of the method according to the invention, whereupon the user is asked to read out another information carrier which contains the only locally available key for opening the static connection information and, for example, is only consciously released at the issuing point by the waiter or cashier can be.

It has also proven to be particularly efficient to read out the location information of the terminal device for authentication and to compare this with predetermined location information, namely in particular the location information of the issuing point. In other words, in many scenarios that are relevant in practice, it can be assumed that the customer retrieving the digital receipt is, with a certain tolerance range, standing near the corresponding issuing point or within the spatial area of responsibility of a waiter.

• i) die Eingabe eines Passworts oder eines Pins erfordert, und/oder
• ii) das Auslesen eines weiteren Informationsträgers erfordert, und/oder
• iii) nur erfolgen kann, wenn die Standortinformation des Endgeräts mit einer vorbestimmten Standortinformation, insbesondere der Standortinformation der Ausgabestelle, übereinstimmt.

Methods according to the invention are preferred, wherein retrieving the retrievable storage unit with the terminal using the static connection information

• i) requires the entry of a password or a PIN, and/or
• ii) requires the reading of another information carrier, and/or
• iii) can only take place if the location information of the terminal matches predetermined location information, in particular the location information of the issuing point.

In addition to preventing unwanted access, it can be important to ensure traceability as to whether unauthorized access may have taken place despite the security measures. For corresponding cases, methods according to the invention are preferred, with each retrieval of the data packet being noted by the retrievable storage unit as information in the data packet, which is also transmitted to the terminal device with each further retrieval.

In addition to preventing and documenting unauthorized access, with a view to minimizing further consequential damage, it is often helpful to take measures to prevent a disruptor, once detected, such as a third party accessing the documents without permission, from causing further damage. The inventors have recognized that with the method according to the invention A particularly high level of security is achieved precisely when those terminal devices are blocked that show a certain usage behavior that contradicts the retrieval behavior provided for in the method according to the invention and/or, depending on its identification parameters, does not belong to the group of expected retrieving users End devices count. The latter in particular, if it is provided as a general rule, advantageously also has a fundamental protective effect, for example if, for a company that is only active regionally, retrievals whose identification parameters show that the retrieval is made from abroad are generally blocked. Likewise, in a large number of cases it can be assumed that the digital documents provided will be collected using mobile devices, so it may be expedient for non-mobile devices, such as desktop computers, to be generally blocked from retrieval because this would be misuse is more likely.

The inventors have recognized that the concept of partially blocking terminal devices can also be used in cases where authentication, as described above as preferred, does not succeed immediately or after a certain number of attempts. Suspicious retrieval behavior would be, for example, repeatedly calling up the static and/or dynamic connection information from the same IP address.

A method according to the invention is preferred, wherein a terminal which directs one or more requests to the retrievable storage unit while all stored data packets with the associated individual identification are deactivated and / or archived, and / or while the dynamic connection information generated from the static connection information for cannot be used for retrieval, is blocked at least temporarily, and/or wherein the terminal is blocked from retrieving the data packet based on identification parameters, in particular its location and/or its retrieval behavior, with preferably all non-mobile terminals being blocked from retrieval become.

The inventors have recognized that special security can be achieved in the method according to the invention if the static connection information is changed at predetermined intervals or after predetermined events.

If an NFC chip is used as the information carrier, the static connection information stored from the NFC chip can be deliberately changed, for example after misuse has been observed. It should be noted here that despite the fundamental variability, the connection information provided in the NFC chip is still static, since it is in principle intended and intended for use in many different requests from separate end devices, even if it may be indicated in individual cases. to change the static connection information again after a digital document has been provided, for example because further misuse has been detected.

A method according to the invention is preferred, wherein the information carrier is an NFC chip and wherein the static connection information in the NFC chip is changed at predetermined intervals and / or after predetermined events, the change preferably taking place using encrypted communication with the NFC chip and wherein the changed static connection information can preferably only be read by the terminal when the change process has been completed.

Since, unlike NFC chips, subsequent adjustment of the static connection information is not easily possible with other information carriers, for example stickers with a QR code, the inventors have developed a concept to enable the static connection information to be updated in this case too . Each issuing point is assigned two or more information carriers that can be made available to the company together, for example in the form of several stickers. Of these, a maximum of one of the stored static connection information is active, so that one of the information carriers can perform the role of the information carrier in the method according to the invention. If no static connection information is set as active on the server side, the first static connection information read out and used for retrieval is subsequently set as active and can henceforth be used in the method according to the invention. After a certain criterion has been met, for example a number of connection attempts made, the previously active static connection information can be deactivated, so that one of the remaining static connection information can be activated according to the principle described above, for example after the sticker has been stuck over. In principle, several scenarios are conceivable for the fate of the previously active information carrier; particularly given the reusability of a limited amount of information carriers, it is expedient to use a previously used information carrier only for a certain period of time or even only for its intended purpose the next activated connection information.

A method according to the invention is therefore preferred, wherein the individual identification of the issuing point is assigned two or more information carriers with static connection information, of which a maximum of one piece of static connection information is active, whereby, if no static connection information is active, the first static one read out and used for retrieval Connection information is set as active, so that the remaining static connection information is inactive from this point on.

A preferred method according to the invention is preferred, wherein the active static connection information is deactivated after a certain number of uses and/or after another criterion occurs, so that other static connection information read out following the deactivation and used for retrieval is set as active.

Alternatively, a preferred method according to the invention is also preferred, wherein the active static connection information is deactivated as soon as another information carrier assigned to the individual identification of the issuing point, whose static connection information is not active, is read out, the static connection information of the information carrier last read being set as active .

• i) vollständig, oder
• ii) für eine bestimmte Zeit, oder
• iii) nur für die Bestimmung der jeweils nächsten aktivierten statischen Verbindungsinformation,

gesperrt wird.A preferred method according to the invention is also particularly preferred, wherein the static connection information deactivated after previous activation is available for further use

• i) completely, or
• ii) for a certain time, or
• iii) only for determining the next activated static connection information,

is blocked.

From the above statements it is apparent to those skilled in the art that the invention also relates to a system for data processing comprising means for carrying out steps a), b), c) and f) of the method according to the invention. The corresponding data processing system is not only suitable for carrying out steps a), b), c) and f) of the method according to the invention, but also includes means that were specifically designed to carry out these steps.

Preferred is a system according to the invention for data processing, comprising a device for data processing with at least one output point, in particular a cash register system with at least one output point, and a retrievable storage unit, wherein the at least one output point is preferably a cash register or a mobile billing point, and wherein the retrievable storage unit is preferably a retrievable server, which is preferably connected to a plurality of data processing devices, the retrievable storage unit most preferably being spatially separated from the data processing device.

Very particularly preferred is a data processing system according to the invention additionally comprising a forwarding server, comprising means for correlating the static connection information with the time of retrieval in order to generate dynamic connection information that links to the data packet with the individual identification that matches the retrieval and the most current Timestamp on the retrievable storage unit includes.

Within the scope of the present invention, the information carrier read out in the method according to the invention can also be assigned to the data processing system according to the invention. Accordingly preferred is a system according to the invention for data processing, comprising at least one information carrier, the information carriers preferably being arranged at the associated output points.

It will be apparent to those skilled in the art that the present invention further relates to a computer program product, comprising commands which, when the computer program is executed by a data processing device of a data processing system, preferably a data processing system according to the invention, cause the computer program to carry out steps a), b), c) and f) of the method according to the invention.

Finally, a computer-readable data carrier on which the computer program product according to the invention is stored and a data carrier signal which transmits the computer program product according to the invention are also disclosed.

• 1 eine schematische Darstellung eines erfindungsgemäßen Systems zur Datenverarbeitung in einer bevorzugten Ausführungsform.

A preferred embodiment of the invention is explained and described in more detail below with reference to the accompanying drawing. This shows:

• 1 a schematic representation of a data processing system according to the invention in a preferred embodiment.

1 shows schematically a system for data processing 28 according to the invention, whose The central component is a retrievable storage unit 18. The retrievable storage unit 18 is connected to a forwarding server 24 and, in this example, to two data processing devices 22a, 22b. The first data processing device 22a is assigned three output points 16a, 16b, 16c with the associated individual identifications 14a, 14b, 14c. The second data processing device 22b similarly has three assigned output points 16b, 16e, 16f, which in turn are assigned the corresponding individual identifications 14d, 14e, 14f.

Each of the output points 16a - 16f shown has an information carrier 20a, 20b, 20c, 20d, 20e, 20f assigned to the output point 16a - 16f. A data packet 10a, 10b, 10c, 10d, 10e, 10f, for example a digital document, which is generated at one of the output points 16a - 16f or in the data processing devices 22a, 22b, is stored on the retrievable storage unit 18 together with the data previously generated data packets 10a, 10b, 10c, 10d, 10e, 10f of the corresponding individual identification 14a - 14f are stored, so that stacks 26a, 26b, 26c, 26d, 26e, 26f are formed by data packets, each of which is assigned to an individual identification 14a - 14f and in which only the top data packet 10a - 10f is active. The ordering criterion for the stacks 26a - 26f is the time or the timestamp, which is in 1 is indicated by the ascending arrow and the sketched clock, as well as the respective individual identification 14a - 14f.

In the in 1 In the example shown, the two data processing devices 22a, 22b are to be understood as central data processing devices 22a, 22b of two cash register systems in two spatially separate companies, each of which has three cash registers as issuing points 16a, 16b, 16c or three mobile billing devices for waiters Output points 16d, 16e, 16f are assigned, the respective information carriers 20a - 20f with the static connection information are each attached near the output points.

In 1 is shown schematically how a customer would like to use the terminal 12 to collect the receipt from the issuing point 16a, with the method according to the invention being carried out in a preferred embodiment. In the interaction of the output point 16a and the data processing device 22a, a data packet 10a is generated, which is provided with the corresponding individual identification 14a and a corresponding time stamp, so that the storage on the retrievable storage unit 18 takes place on the associated stack 26a and the generated data packet 10a can be accessed as the most current data packet 10a, while all underlying data packets 10a of the stack 26a are deactivated or archived so that they can no longer be accessed. The customer now uses the terminal 12 to read out the information carrier 20a assigned to the output point 16a in order to read out the static connection information contained in this information carrier 20a for retrieving the retrievable storage unit 18, which is assigned to the individual identification 14a. In the schematically outlined preferred method according to the invention, the retrieval storage unit 18 is retrieved indirectly via an intermediate forwarding server 24, in which the static connection information from the information carrier 20a is correlated with the time of retrieval by the terminal 12 in order to generate dynamic connection information a link to the corresponding data packet 10a with the individual identification 14a matching the retrieval and the most current time stamp, so that the corresponding receipt 10a is provided to the terminal 12 without the data processing system 28 requiring further information from the terminal 12 for this, so that Provision can be made anonymously.

In the in 1 In the example shown, the terminal 12 is a mobile terminal 12, namely a cell phone. In 1 The information carriers 20a - 20f are also each designed as stickers with a QR code, which can be read out via a camera installed in the terminal 12 and evaluated using commercially available pre-installed software.

The data packet 10a accessed by the customer using a terminal 12 can then be displayed and further processed by the customer using a standard web browser, for example stored or sent as an email. If suitable software is installed on the terminal 12, the digitally provided receipt can also be used to digitally instruct a necessary payment.

Reference symbols

10a-10f

Data package

12

End device

14a-14f

Individual identification

16a-16f

Issuing point

18

retrievable storage unit

20a-20f

Information carrier

22a, 22b

Data processing device

24

Forwarding server

26a-26f

stack

28

Data processing system

Claims (9)

Method for anonymously providing data packets (10a-10f), in particular digital documents, to selected terminal devices (12), comprising the steps: a) generating a data packet (10a-10f), in particular a digital document, b) linking the data packet (10a-10f) with an individual identification (14a-14f) of an issuing point (16a-16f) and a time stamp, c) storing the data packet (10a-10f) on a storage unit (18) that can be accessed by terminal devices (12), d) reading out an information carrier (20a-20f) assigned to the individual identification (14a-14f) of the issuing point (16a-16f) with a terminal (12), the information carrier (20a-20f) containing static connection information for retrieving the retrievable storage unit ( 18) which is assigned to the individual identification (14a-14f) of the issuing point (16a-16f), e) retrieving the retrievable storage unit (18) with the terminal (12) using the read static connection information, and f) providing the data packet (10a-10f) with the individual identification (14a-14f) that matches the retrieval and the most current time stamp from the retrievable storage unit (18) to the retrieving terminal (12). Procedure according to Claim 1 , wherein steps a), b), c) and f) are carried out by a data processing system (28), the data processing system (28) preferably having a data processing device (22a, 22b) with at least one output point (16a -16f), in particular a cash register system with at least one issuing point (16a-16f), and the retrievable storage unit (18), wherein the at least one issuing point (16a-16f) is preferably a cash register or a mobile billing point. Procedure according to one of the Claims 1 or 2 , wherein the information carrier (20a-20f) is a QR code or an RFID chip, preferably a QR code or an NFC chip, wherein the terminal (12) comprises means for reading the information carrier (20a-20f), wherein the information carrier (20a-20f) is preferably arranged at the output point (16a-16f) or near the output point (16a-16f). Procedure according to one of the Claims 1 until 3 , wherein the retrievable storage unit (18) comprises a separate stack (26a-26f) of data packets (10a-10f) for each individual identification (14a-14f). Procedure according to one of the Claims 1 until 4 , wherein the provision in step f) is carried out by correlating the static connection information with the time of retrieval in order to generate dynamic connection information that links to the data packet (10a-10f) with the individual identification (10a-10f) that matches the retrieval. 14a-14f) and the most current timestamp on the retrievable storage unit (18), the correlation preferably being carried out by a forwarding server (24). Procedure according to one of the Claims 1 until 5 , wherein the retrievable storage unit (18) is set up so that when retrieved by a terminal (12), it can only provide the data packet (10a-10f) with the most current time stamp for each individual identification (14a-14f). Procedure according to one of the Claims 1 until 6 , wherein step c) is carried out in such a way that at least temporarily, preferably at any time, for a given individual identification (14a-14f), all data packets (10a-10f) with the exception of the data packet (10a-10f) with the most current time stamp are deactivated and / or are archived so that they can no longer be accessed by the terminal (12). Procedure according to one of the Claims 1 until 7 , wherein the terminal (12) does not include a data processing program specifically tailored to the method and/or wherein the terminal (12) is not registered for use in the method, and/or wherein there are no electronic devices for playback at the output point (16a-16f). variable connection information is provided to the terminal (12). Procedure according to one of the Claims 1 until 8th , wherein stored data packets (10a-10f) on the retrievable storage unit (18) are deactivated and/or archived after a predetermined time, regardless of retrieval by a terminal (12) or other factors, so that they can no longer be retrievable. 10. Method according to one of the Claims 1 until 9 ,wherein the retrieval of the retrievable storage unit (18) with the terminal (12) using the static connection information i) requires the entry of a password or a PIN, and/or ii) requires the reading of a further information carrier, and/or iii) only can be done if the location information of the terminal (12) has a predetermined status location information, in particular the location information of the issuing point (16a-16f), matches.

Images