EP0504616A1 - Method of operating a self-service automatic machine and apparatus for carrying out this method - Google Patents

Abstract

In an automatic self-service machine, there is a reader (1), into which a means of identification (10), especially a chip card, is to be inserted by the user. There is a fingerprint reader (2) which measures the fingerprint directly on the user. An identification code is derived from the measured fingerprint. If identification is successful as a result of a comparison of the authenticated identification code on the means of identification with the derived identification code, an individual banknote or an individual consumer product is dispensed, without any further other inputs having to be made by the user. With the means of identification (10) inserted, a plurality of measurements spaced at sufficient time intervals can be carried out, an identification code being derived from each of them and an individual banknote or an individual consumer product being dispensed for each successful identification. <IMAGE>

Description

Technical field

The invention relates to a method for automatically issuing notes or consumer goods from a self-service machine, in which an identification means to be inserted by the user is read by means of a reading device, on which an identification code is stored. The invention also relates to a plant for carrying out the method.

State of the art

In general, there is a tendency in consumer goods transport to replace cash. One possibility is to issue credit cards. The customer can purchase goods on credit and receives an invoice from the bank at the end of the month. The authorization of the user is determined on the basis of the signature, which is on the card on the one hand and on the other hand is to be added to the invoice by the customer in front of the seller. In principle, you can also pay quite small amounts of money with a credit card. However, the administrative effort is disproportionately large.

So-called service cards are one way of replacing small change. However, they are usually limited to a specific service. An example is the cards that are issued by Swiss Post and are suitable for making calls on public telephones. These cards are based on the chip principle. H. they contain a certain number of basic units, e.g. B. 10 centimes that are successively debited from the telephone machine.

Another option that has only recently emerged is payment by terminal. In online operation, the customer can initiate transfers from his bank from home.

Despite all these possibilities of cashless payments, cash still plays a central role. Cash dispensers have therefore been used for a long time to relieve the bank counters and to enable cash withdrawals around the clock. The problem with such machines is to reliably and securely determine the user's authorization automatically. In today's vending machines, the authorization is accepted if the secret personal identification number (PIN) that the user has to enter on a keyboard before withdrawing cash is on the magnetic card stored matches. The advantage of such an identification procedure is that the administration of the PIN is relatively simple, not least because such numbers can be generated automatically by computers and transmitted to the authorized person. The problem, however, is that most people struggle to remember disjointed numbers. For this reason alone, the length of the PIN is usually limited to only four to six digits. Security becomes particularly illusory when people write down the PIN and, what is worse, keep the PIN in the same place as the magnetic card. Additional security barriers must therefore be built into automatic cash withdrawals. So z. B. the transaction prevented and the magnetic card withdrawn if the user incorrectly typed the PIN three times in succession.

Reliable personal identification, which is only a partial aspect of the entire transaction in electronic payment transactions, is the only and central aspect in access control. People control is usually about identifying a narrowly defined group of people with high reliability. Accordingly, such systems also have to meet other requirements and can be associated with greater outlay. Instead of secret codes that have to be entered on a keyboard, biometric features have already been used for identification purposes. So z. B. is known a fingerprint reader that optically scans a finger pressed onto a glass plate and compares it with an authenticated pattern stored in the system. Another possibility of a biometric control is the dynamic recording of signatures or the measurement of the retina. The advantage of biometric features is undoubtedly that the identity of a user can be determined unequivocally. However, the measurement of such features is associated with considerable electronic and device-related effort.

Presentation of the invention

The object of the invention is to provide a method for the automatic dispensing of notes or consumer goods from a self-service machine, in which an identification means to be inserted by the user is read by means of a reading device, on which an identification code is stored, which provides a high degree of security in the identification and at the same time ensures a high level of user friendliness. In particular, the method should enable the machine to be operated easily by the user.

• eine Messvorrichtung unmittelbar am Benutzer ein biometrisches Merkmal liest,
• von diesem Merkmal ein Identifikationscode abgeleitet wird und
• bei erfolgreicher Identifikation aufgrund eines Vergleichs des abgespeicherten, authentifizierten Identifikationscodes mit dem abgeleiteten ein einzelner Wertschein oder ein einzelnes Konsumgut ausgegeben wird, ohne dass irgendwelche weiteren, sonstigen Eingaben vom Benutzer vorzunehmen wären.

According to the invention, the solution is that

• a measuring device reads a biometric feature directly at the user,
• an identification code is derived from this feature and
• in the case of successful identification, on the basis of a comparison of the stored, authenticated identification code with the derived one, a single note or a single consumer good is issued without the user having to make any further, other inputs.

The extremely great ease of use results from the fact that the user only uses his means of identification, e.g. B. needs to insert his chip card and then immediately after performing the biometric identification receives the bill or the consumer good. Identification and command to output z. B. a bill are united from the user's perspective in a single action, namely the identification.

Preferably, after reading the identification means, several measurements are carried out which are sufficiently spaced apart from each other an identification code is derived and for each successful identification a single note or a single consumer good is issued. It is therefore up to the user to have several identifications carried out and to receive a corresponding number of banknotes or consumer goods. The simplification of operation results from the fact that the user does not have to reinsert his identification means (chip card) into the reader for each identification.

The system according to the invention for performing the above-mentioned method has a self-service machine which comprises a reading device for reading an identification means and a control circuit for checking the authorization of the user, and is characterized by a measuring device with which a biometric feature is measured and recorded directly on the user Identification code can be derived. The control circuit is programmed so that the described method according to the invention is carried out.

According to a particularly preferred embodiment, a fingerprint is used as the biometric feature. This type of identification meets the general human need to indicate with the finger. tap what he wants.

An identification means is preferably provided for the system, on which at least two identification codes are stored. One of them is then derived from a fingerprint of a finger of the right hand and another from that of a finger of the left hand. For successful identification, the control circuit is satisfied with checking one of the at least two identification codes. On the other hand, these measures prevent a user from being able to operate the self-service machine due to an injury to a finger or hand.

A chip card with a secured semiconductor memory, in which user-specific data is stored in addition to the at least one authenticated identification code, is particularly suitable as identification means. In this way it is possible to serve a large group of users without the self-service machine being connected to a database, because the chip card contains all the data required for the transaction.

The self-service machine is preferably a cash dispenser, the z. B. is operated so that the chip card is inserted and is tapped with a finger on a reading sensor as often as banknotes are to be issued.

In order to lower the psychological inhibition threshold against an authenticated recording of the fingerprint or generally a biometric feature, it is recommended to provide a network-independent table device into which the blank identification means can be inserted and with which the fingerprint can be inserted, with which the fingerprint can be recorded, the identification code can be derived and saved directly on the identification means can be. The fact that no cable leads away from the tabletop device, through which the fingerprint could be passed on to a central computer device, is intended to make it clear that the fingerprint or another biometric feature is only stored on the user's card and nowhere else.

Further preferred embodiments of the invention result from the dependent patent claims.

Brief description of the drawings

Fig. 1

Ein Blockschaltbild eines erfindungsgemässen Geldausgabeautomaten; und

Fig. 2

ein netzwerkunabhängiges Registriergerät zum authentifizierten Erfassen von Fingerabdrücken.

The invention is to be explained in more detail below on the basis of exemplary embodiments and in connection with the drawings. Show it:

Fig. 1

A block diagram of an automatic teller machine according to the invention; and

Fig. 2

a network-independent registration device for authenticated fingerprinting.

Ways of Carrying Out the Invention

Fig. 1 shows a block diagram of an automated teller machine. It is a self-service machine that can issue a grade of a given national currency. A card reader 1, a fingerprint reader 2, a display means 3 and a keyboard 4 are provided on the user-oriented input page. A chip card 10 can be inserted into the reading device 1. An authenticated identification code and other user-specific data are stored on this. Before a transaction begins, the chip card 10 must be read in by the reader 1 in order to be able to carry out the subsequent identification.

The fingerprint reader 2 known as such has an optical reader and a processor card for processing the recorded data. The fingerprint reader takes a high-resolution electronic image of the fingerprint. The impression is analyzed and reduced to a digital identification code. The derived identification code allows the fingerprint to be clearly identified.

The display means 3 are there to guide the user through the transaction. You can e.g. B. consist of a small television screen on which information texts are displayed. The display means can of course also consist of a board with different texts that are illuminated one after the other.

The keyboard 4 is not required directly for carrying out the method according to the invention, but is preferably provided for reasons of compatibility. Especially when it comes to introducing new technologies to the market, it is important that the new devices are compatible with the previous standards. In this sense, the keyboard can be used, for example, to enter a personal identification code (PIN).

A receipt printer 5 and a note dispenser 6 are arranged on the customer-oriented output side. The optional receipt printer 5 serves z. B. to issue a receipt for the transaction carried out.

All previously described units of the cash dispenser are controlled by a control circuit 7. The control circuit 7 is responsible for carrying out the method according to the invention. It is connected to a journal printer 8 on the supervisor side, with which e.g. B. all transactions of a day can be printed out. Finally, a network connection 9 is also provided. It creates a connection with a central computer of the care organization. The said central computer is e.g. B. responsible for the so-called clearing and usually serves all ATMs of the supervisor organization.

The self-service machine has a housing 17 which meets the usual requirements of a cash register cabinet. He is e.g. B. anchored in a wall breakthrough.

• 1. Der Benutzer (Kunde) führt seine persönliche Chipkarte 10 in das Lesegerät 1 ein. Bei dieser Chipkarte 10 handelt es sich in der Regel um eine speziell für den Geldbezug personalisierte Kundenkarte.
• 2. Die Chipkarte 10 wird gelesen. Bei diesem Datenaustausch zwischen Karte und Automat wird z. B. der Identifikationscode des Benutzers zusammen mit allgemeinen weiteren Daten an die Steuerschaltung 7 übertragen.
• 3. Ueber die Anzeigemittel 3 wird der Benutzer aufgefordert, seinen in der Chipkarte 10 gespeicherten Finger auf den Sensor 18 des Fingerabdrucklesers 2 zu legen.
• 4. Der Benutzer legt (resp. presst) seinen Finger 1-2 Sekunden auf den genannten Sensor 18 und wartet, bis er aufgefordert wird, den Finger wieder wegzunehmen. Unterdessen wird der Fingerabdruck abgetastet und der Identifikationscode abgeleitet. Gleichzeitig wird überprüft, ob es sich um einen echten Finger handelt
• 5. Der abgeleitete Identifikationscode wird mit demjenigen auf der Chipkarte verglichen. Der Vergleich wird anhand eines vorgegebenen Testverfahrens durchgeführt. Wenn mit dem Testverfahren eine hinreichende Identität resp. Aehnlichkeit festgestellt wird, dann gilt die Identifikation als erfolgreich. In der Praxis wird es nämlich in der Regel nicht möglich sein, eine hundertprozentige Identität zu fordern, da dann die Zurückweisungsrate viel zu hoch wäre. Aus der Sicht des in Tat und Wahrheit rechtmässigen Benutzers ist es nämlich höchst unangenehm, die Identifikation mehrmals durchführen zu müssen allein aufgrund messtechnischer Probleme des Fingerabdrucklesers. Selbstverständlich ist bei der Festlegung der Aehnlichkeitsschwelle durch die Betreiberorganisation darauf zu achten, dass möglichst wenig Benutzer fälschlicherweise als berechtigt betrachtet werden. Im Fall einer erfolgreichen Identifikation wird unverzüglich ein einzelner Geldschein in eine Notenschale 19 ausgegeben.
• 6. Der Benutzer wird über die Anzeigemittel 3 angefragt, ob er weitere Geldscheine wünsche. Falls der Kunde dies wünscht, so wird zu Punkt 3. zurückgegangen. Aus Sicherheitsgründen, namentlich um zu verhindern, dass zuviel Geld bezogen wird, wird die Zahl der möglichen Rekursionen beschränkt. Dies kann z. B. aufgrund eines auf der Chipkarte 10 aufgezeichneten maximalen Bezugsbetrags getan werden. Auf Wunsch werden also so viele Banknoten ausgegeben, wie der maximale Bezugsbetrag zulässt. Der aktuelle Saldo kann vor jedem Durchgang mit den Anzeigemitteln angezeigt werden. Zwischen den einzelnen Durchgängen wird jeweils eine kurze Zeit (einige Sekunden) gewartet. Schliesslich soll vermieden werden, dass wegen einer zu langsamen Reaktion des Benutzers mehr Noten als eigentlich gewünscht ausgegeben werden. Wenn keine weiteren Noten gewünscht werden, wird bei Punkt 7. weitergefahren. Das Weitergehen kann z. B. aufgrund eines sogenannten Timeouts erfolgen: Wenn der Kunde seinen Finger nicht innerhalb einer vorgegebenen Zeit auf den Sensor 18 des Fingerabdrucklesers 2 legt, dann wird die Transaktion beendet.
• 7. Ueber den Netzwerkanschluss 9 wird dem zentralen Computer die Transaktion mit ihren Einzelheiten (bezogener Geldbetrag, Kundenidentität, Kontonummer etc.) angezeigt.
• 8. Auf der Chipkarte 10 wird der bezogene Geldbetrag abgespeichert. Auf diese Weise kann sichergestellt werden, dass der Benutzer innerhalb eines vorgegebenen Zeitraums (Tag, Monat) nicht mehr als den zulässigen Gesamtbetrag bezieht.
• 9. Die gewünschten Noten werden aufbereitet und in eine Notenschale 19 ausgegeben.
• 10. Der Benutzer wird aufgefordert, seine Chipkarte 10 zu entnehmen.
• 11. Der Benutzer entnimmt die Chipkarte 10.
• 12. Es wird ein Beleg gedruckt und ebenfalls in die Notenschale 19 ausgegeben (Option).
• 13. Die Türe der Notenschale 19 wird geöffnet, und der Kunde wird aufgefordert, die Noten und gegebenenfalls den Beleg zu entnehmen. Dadurch, dass der Benutzer zunächst die Chipkarte 10 entnehmen muss, bevor er das gewünschte Geld erhält, wird sichergestellt, dass die Chipkarte 10 nicht aus Versehen im Lesegerät 1 steckengelassen wird.
• 14. Der Benutzer entnimmt die Noten und gegebenenfalls den Beleg.
• 15. Die Türe wird geschlossen und über den Journaldrucker 8 wird eine Aufzeichnung über die Transaktion ausgegeben (Option).

In the following, the rough process of a trouble-free cash withdrawal is described.

• 1. The user (customer) inserts his personal chip card 10 into the reading device 1. This chip card 10 is generally a customer card that is specially personalized for withdrawing money.
• 2. The chip card 10 is read. In this data exchange between card and machine z. B. the identification code of the user together with other general data to the control circuit 7.
• 3. Via the display means 3, the user is asked to put his finger stored in the chip card 10 on the sensor 18 of the fingerprint reader 2.
• 4. The user places (or presses) his finger on the said sensor 18 for 1-2 seconds and waits until he is asked to remove the finger again. Meanwhile, the fingerprint is scanned and the identification code is derived. At the same time, it is checked whether it is a real finger
• 5. The derived identification code is compared with that on the chip card. The comparison is carried out using a predetermined test procedure. If with the test procedure a sufficient identity or Similarity is determined, then the identification is considered successful. In practice, it will usually not be possible to demand a 100 percent identity, since the rejection rate would then be far too high. From the point of view of the rightful user in fact and truth, it is extremely unpleasant to have to carry out the identification several times simply because of measurement problems with the fingerprint reader. Of course, when determining the similarity threshold, the operator organization must ensure that as few users as possible are wrongly considered to be authorized. In the event of successful identification, a single bill is immediately issued in a note tray 19.
• 6. The user is asked via the display means 3 whether he would like further banknotes. If the customer so desires, the process returns to point 3. For security reasons, especially to prevent that too much money is drawn limits the number of possible recursions. This can e.g. B. can be done on the basis of a maximum reference amount recorded on the chip card 10. On request, as many banknotes are issued as the maximum reference amount allows. The current balance can be displayed with the display means before each run. There is a short wait (a few seconds) between each run. Finally, it is to be avoided that, due to a slow reaction of the user, more notes than actually desired are output. If no further grades are desired, continue with point 7. Moving on can e.g. B. due to a so-called timeout: If the customer does not put his finger on the sensor 18 of the fingerprint reader 2 within a predetermined time, the transaction is ended.
• 7. Via the network connection 9, the transaction is displayed to the central computer with its details (amount of money drawn, customer identity, account number, etc.).
• 8. The amount of money drawn is stored on the chip card 10. In this way it can be ensured that the user does not receive more than the permitted total amount within a predetermined period (day, month).
• 9. The desired notes are processed and output into a music tray 19.
• 10. The user is asked to remove his chip card 10.
• 11. The user removes the chip card 10.
• 12. A receipt is printed and also issued in the music tray 19 (option).
• 13. The door of the music tray 19 is opened and the customer is asked to remove the notes and, if necessary, the receipt. The fact that the user must first remove the chip card 10 before he receives the desired money ensures that the chip card 10 is not accidentally left in the reader 1.
• 14. The user takes the notes and, if necessary, the receipt.
• 15. The door is closed and a journal of the transaction is output via the journal printer 8 (option).

The procedure just described is not followed if the identification is not successful. In such a case, e.g. B. the user is asked again to make an identification, d. H. to put his finger on the sensor 18 of the fingerprint reader 2. An unsuccessful identification does not necessarily mean that it is an unauthorized user. This is because errors can also occur when the fingerprint is scanned, based solely on the fact that the user held his finger awkwardly on the sensor 18.

Since in practice it should hardly be possible for a user with a stolen chip card and his own finger to be incorrectly considered to be authorized to move, in contrast to identification using a PIN, a large number of unsuccessful identification attempts can easily be allowed. However, even with an operating sequence according to the invention, provision will be made for the chip card 10 to be retained by the self-service machine if the identification attempts are unsuccessful.

In a particularly preferred embodiment, several identification codes are stored on the chip card 10. Each identification code is derived from the imprint of a specific, different finger. In such a case, the control circuit 7 is programmed that the successful verification of one of the several identification codes is sufficient for the receipt of a bill. If the comparison test turns out negative due to a measurement error or another problem, the legitimate user has the option of identifying himself with the other fingers. It should also not be forgotten that the fingers are very often, if only slightly, injured. If only one finger is available for identification and this finger is injured, the legitimate user is unnecessarily prevented from using his chip card.

A special aspect of registration is now explained below. As is known from criminology, every person has a distinctive fingerprint. In principle, the fingerprint is sufficient to uniquely identify a person. With more and more computer and data acquisition devices being networked today, more and more people are reluctant to electronically collect any personal data. It is therefore entirely conceivable that fundamental reservations are made regarding the recording of the fingerprint, as long as it is not ensured that the fingerprint will not be used in an uncontrolled manner in any way. In order to lower the inhibition threshold compared to the essential first authentication, it is proposed to use an independent, network-independent desktop device.

2 shows such a tabletop device 11. It has an electronic recorder 12, display means 13, a fingerprint reader 14 and a control circuit 15. An accumulator 16 supplies the device with the necessary energy.

For the first authentication, the empty chip card is inserted into the recorder 12. Via the display means 13, the user is asked to put his finger on the sensor of the fingerprint reader 14. An identification code is obtained from the fingerprint, which is preferably registered several times in succession, and is only stored on the chip card 10. This is preferably done in a write-once, non-erasable semiconductor memory of the chip card. In order to be able to achieve the intended psychological effect, no cables lead away from the table device 11. This underlines the fact that the fingerprint is not recorded in a central computer. For the same reason, the accumulator 16 is provided, which makes it possible to work independently of the electrical supply network.

The invention is not limited to the automated teller machine as has just been described. Basically, it is suitable for any self-service machine that is suitable for issuing notes (tickets, day tickets, entrance tickets, etc.) or consumer goods. It is also conceivable that different vouchers or consumer goods can be issued, with the choice between the individual notes or. Consumer goods via a separate keyboard or via several scanning sensors, each of which has a specific meaning assigned.

The invention further enables a small, compact, easy-to-use version of the machine with only the card input slot of the reader 1, the sensor 19 and the output 6 and possibly a small display on the user side, that is to say without a keyboard.

In summary, it can be stated that the invention provides a method which is particularly suitable for the sequence control of self-service machines and which enables reliable and simple operation by the user.

Claims (10)

Method for the automatic dispensing of notes or consumer goods from a self-service machine, in which an identification means (10) to be inserted by the user and on which an identification code is stored is read by means of a reading device, characterized in that a measuring device (2) measures a biometric feature directly on the user, - an identification code is derived from this feature and - If identification is successful, a single note of value resp. based on a comparison of the stored, authenticated identification code. a single consumer good is issued without the user having to make any other entries. A method according to claim 1, characterized in that after reading the identification means (10) several sufficiently spaced measurements are carried out, an identification code is derived from each and for each successful identification a single note or. a single consumer good is issued. System for carrying out the method according to claim 1, having a self-service machine which has a reading device (1) for reading an identification means (10) and a control circuit (7) for checking the authorization of a user, characterized in that a measuring device (2) is provided is with the one biometric feature measured directly on the user and an identification code can be derived. System according to claim 3, characterized in that the control circuit (7) is designed such that the measurement of the biometric feature carried out for the purpose of checking the authorization on the user alone, upon successful identification, for issuing a single note or certificate. Leads consumer goods. System according to claim 3, characterized in that the measuring device is a fingerprint reader (2). System according to claim 5, characterized in that it comprises an identification means (10) on which at least one authenticated identification code derived from a fingerprint is stored. System according to claim 6, characterized in that at least two identification codes are stored on the identification means (10), one of which is derived from a fingerprint of a finger of the right hand and another from that of a finger of the left hand, and that the control circuit ( 7) is designed such that checking one of the at least two identification codes is sufficient for successful identification. System according to Claim 6, characterized in that the identification means is a chip card (10) with a semiconductor memory, in which, in addition to the at least one authenticated identification code, user-specific data are also stored. System according to one of claims 3-8, characterized in that the self-service machine is a cash dispenser. System according to claim 3, characterized in that a network-independent table device (11) is provided for authentically recording the biometric feature of the user and for storing the derived identification code on the identification means (10).

Images