EP1504386A1

EP1504386A1 - Data processing system for the organisation of lotteries

Info

Publication number: EP1504386A1
Application number: EP02807334A
Authority: EP
Inventors: Rüdiger KROLL; Oswald RÖMER; Sven Tissot
Original assignee: NKL Nordwestdeutsche Klassenlotterie
Current assignee: NKL Nordwestdeutsche Klassenlotterie
Priority date: 2002-05-03
Filing date: 2002-05-03
Publication date: 2005-02-09
Also published as: CA2484905A1; JP2005524894A; AU2002308070A1; WO2003094061A1; US20050176489A1

Abstract

The data processing system for the organisation of lotteries by means of the internet (3) is characterised in that winning numbers generated by a random number generator (13) are provided with a signature, which can be checked within the system by the playing user such as to be able to securely verify such manipulations.

Description

DATA PROCESSING SYSTEM FOR EVENTING LOTTERIES

The invention relates to a data processing system for organizing lotteries with a first subsystem (front end), which can be accessed from the outside via the Internet, and with a second subsystem (backend), which is connected to the first subsystem with an unauthorized access device and otherwise is complete.

Data processing systems of this type are known in connection with the Internet. An Internet subscriber has access to a first subsystem, where he can enter data, have data displayed, receive general information and, if necessary, be forwarded to other links. However, it does not have direct access to the data in a second subsystem that is connected to the first by a firewall. Rather, the data are only selectively transferred from the second subsystem to the first subsystem, to which the Internet subscriber should have access.

Internet applications are diverse and are enjoying growing popularity. However, certain areas are particularly sensitive. Lotteries have strict regulations so that winnings cannot be manipulated. A system has been proposed (European patent application 00 124 085.2) which enables lotteries to be organized via the Internet. This is characterized in that the second subsystem (backend) has a random generator, storage devices for data of game participants in a lottery including the lot numbers assigned to the players, a winning plan and a computer for allocating winnings on the basis of the numbers generated in the random number generator has lot numbers corresponding to game participants with numbers and that a computer for data exchange with the game participants is provided in the first subsystem and an e-mail device for notifying the winners in the second subsystem.

Such a system offers a high level of security, the particularly security-relevant parts, in particular the random number generator, also being secured by mechanical security devices such as closed housings with lead seals, etc. Nevertheless, increased security is still desirable. In this case, in particular, the possibility should also be created for the game participant to authenticate the random numbers generated, ie. H. to check the winning numbers drawn.

The object of the invention is therefore to create a data processing system in which the security against manipulation is further increased.

In the case of a data processing system mentioned at the outset, the solution according to the invention is that the random number generator is provided with devices for providing the generated numbers with the signature of a private key (private key), which is securely housed together with the random number generator, the signature being verifiable by a public key.

Each random number generated is thus immediately provided with a signature that is generated with the help of a private key. This calculates signature values according to an algorithm dependent on the private key, which are added to the data record of the random number. If the number generated is subsequently changed, the signature for this number is no longer correct. An outsider who does not have the private key cannot therefore generate a changed random number with a suitable signature. The signature can be checked with a public key. It is therefore possible to check at any point within the system in the lottery area whether the signature for the associated randomly generated number matches or whether manipulation has been carried out. It is also possible to provide the game participants with the public key so that they can also check the authenticity of the numbers generated. If the random number generator and the device for generating the signature are reliably sealed off from the outside, for example in a sealed housing, then manipulations of the random number can no longer be carried out without being noticed since the signature does not match the manipulated random number.

Devices for checking the signature of the random numbers generated are expediently already provided in the second subsystem (backend). If this is the case, this part of the second subsystem need not be sealed together with the random number generator. Due to the absolutely secure generation of random numbers that can no longer be manipulated, logging with the help of a printer is no longer necessary. However, such a printer can expediently be provided if one wishes to provide evidence that can also be understood by a person who does not understand the technical structure of the system.

The random number generator, which must be encapsulated particularly securely, does not have to be located in the same room with the computer that allocates the winnings. The random number generator with the device for generating the signature can, for. B. be arranged in a room of the lottery operator while the computer is in a data center that is connected to the Internet. The data transmission between the random number generator and the data center then takes place expediently via an encrypted data connection, e.g. B. a dedicated line or ISDN.

The data processing system expediently has a timer which triggers the generation of final digits and allocation of profits (drawing) at regular time intervals, in particular once a day. This can also be arranged in the data center and then connected to the random number generator via an encrypted data connection, so that only this timer can trigger the generation of random numbers.

Devices for downloading certificates by game participants are advantageously provided, with which the signature of the generated numbers can be checked. This certification The fikat that the game participant can download over the Internet contains on the one hand the public key with which the signature of the generated numbers can be checked. On the other hand, the certificate includes the identification of the lottery operator.

The system is advantageously designed to use XML signatures; the corresponding type of logging and data exchange between the subsystems and the game participant is particularly advantageous for the system.

The system advantageously has a smart card reader for the private key. The corresponding smart card can then be requested from a trust center (e.g. Deutsche Post, Telekom or the like). This smart card is then sealed together with the random number generator.

The winning numbers are generated by the random number generator, which of course must ensure that real random numbers are generated and that certain numbers are not generated significantly more often than other numbers. A random number generator, which determines its numbers with the aid of a physical noise source, for example semiconductor noise, has proven particularly useful. This random number generator can generate any digits (max. 20 digits) final digits (e.g. lot numbers with two final digits, lot numbers with three final digits, etc.), which should result in winnings. This random number generator is of course not accessible from the outside, especially from the first subsystem (front-end system). In the second subsystem (backend system) there are further storage devices (data bank) for data of lottery participants including lot numbers assigned to the players. The data of game participants include names, addresses, bank details and possibly telephone numbers, e-mail addresses and the like. In addition, the lot numbers with which the game participant takes part in the lottery are stored. If we are talking about game participants, this does of course not only mean game participants of male sex, but also those of female sex. The storage devices also include a winning schedule that specifies what the winnings will be for a given generation of random numbers (drawing of final digits) if the lot has the correct ending number, the correct two last ending numbers, etc. The corresponding allocation of the winnings to the lots and thus to the game participants then takes place with the aid of a computer arranged in the second subsystem.

Operation is automatic. In particular, as already mentioned, it can be provided that the data processing system has a timer which triggers the generation of random numbers and allocation of winnings (draw) at regular time intervals, in particular once a day at a predetermined time. Of course, such a drawing can also be provided more than once a day. The participant can find out about the winning numbers over the Internet and possibly even track the generation of these winning numbers. A game participant can also receive other general information. In particular, however, it is also provided that the or a computer of the first subsystem generates a mask for the screen of the game participant, into which the same data is entered can. Here the game participant can register and enter his name, address, bank details and payment method. As soon as the payment has been received by bank transfer or the payment card or the like has been authorized by the credit card institute or the like, which the game participant wants to use, the game participant can choose one or more lot numbers in an advantageous embodiment. The number of tickets the player can choose can be limited.

With the exception of the fact that the game participant has to enter his personal data and the desired lot numbers, the operation is automatic. Winnings are also paid out automatically, to the bank account specified by the game participant. In addition, it can be provided that game participants are granted free participation in one or more draws (bonus lots) as winnings. This can be the case, for example, if the player in the draw in question has the correct final number in his lot number.

It can further be provided that, with the exception of bonus lots, only participation in a predetermined number of draws is possible. For example, in an advantageous embodiment one could have four successive classes

(Weekly draws) with seven draws (one on each day) so that the whole cycle is repeated every 28 days. The fact that a minimum number of draws must be selected increases the attractiveness of the lottery, since there is a greater number of chances of winning. For the purpose of data security, it is advantageously provided that only data of the game player who is currently accessing the system are transferred from the second to the first subsystem and are then transferred or deleted again to the second subsystem after a predetermined time. This ensures the greatest possible data security and the greatest possible protection against data manipulation. It goes without saying that access to the first subsystem is secured by a firewall and that game participants can only access it with a password and is in line with the practice that is common on many other websites.

It is advantageously provided that one or more of the computers carry out an authorization check either in the second subsystem, but advantageously already in the first subsystem. For example, the postcode can be used to check whether the game participant actually lives in an area in which the lottery is being carried out.

Each computer and memory is expediently supplemented by a second one in order to be able to continue operation if the first fails.

As already mentioned, the operation is fully automatic. Of course, only the game participant has to enter his data manually. The verification of authorization for credit cards, incoming payments and the like is done automatically, as is the payment of winnings.

As already mentioned, firewalls ensure that no unauthorized access to the system or components of the system is possible. As particularly advantageous against the Manipulation has proven to be effective if the essential parts of the system are mechanically sealed. For example, the random number generator with the smart card reader could be housed in a sealed, transparent housing so that it cannot be manipulated.

Of course, this housing must be provided with ventilation holes if necessary.

It is expediently also provided that all essential processes, in particular the generation of the final digits, are logged. This can be done in electronic form or by printing on paper, although the latter is no longer necessary due to the signatures.

The invention is based on an advantageous

Embodiment described with reference to the accompanying drawings, for example. Show it:

1: a schematic representation of the structure of part of the data processing system according to the invention;

2: a schematic representation of the overall system; and

Fig. 3: an example of a profit plan.

The data processing system shown in FIG. 1 has three areas, namely the freely accessible Internet area 3, the first subsystem 1 and the second subsystem 2. The first subsystem 1 is separated from the freely accessible Internet area 3 by a firewall 4. Access to data that go beyond general information is only possible with a password. The first subsystem is 1 separated from the second subsystem 2 by a "logical" firewall. The first subsystem has a web server 6 and a data server 7, which is linked to a data structure 8. At 9, a substitute computer is shown which can be used if the computer 6 or 7. A main computer 10 is provided in the second subsystem 2, a spare computer being connected at 11, which can take over the functions of the computer in the event of a failure of the computer 10. The link is made via a database system 8. At 12 there is also a spare drive in which the data are stored in addition to being stored in computers 10 and 11. In the embodiment shown here, the random number generator is accessed by computers 10 and 11. The second subsystem 2 is accessed via the Internet by banks, credit card institutions etc. connected.

Fig. 2 shows the overall system including the random number generators 13, which are enclosed in a closed container 26, which is indicated by dashed lines. The random number generators 13 are provided with smart card readers 14 and corresponding signature generation devices. Normally only one unit 13, 14 works, ie the drawing device 1. Only if this fails, the drawing device 2 takes over its function. The data are then forwarded to internal communication and logging units 15. The power supply is provided by an uninterruptible power supply 16. At 17, a signature check can be carried out, and a log can then be created at a printer 18. The corresponding units 15 to 18 are also provided twice and can be arranged in a separately secured room 19 his. The random numbers with signature are then forwarded via a switching unit 20 and terminals 21, 22 of a data connection, these terminals 21 and 22 encrypting and decrypting the data, so that only encrypted data are sent to a data center, which is indicated at 23. This has a unit 24 for signature verification. Only if the random numbers generated are confirmed as unmanipulated by this unit 24, is the further processing carried out in units 2 (back end) and 1 (front end) and via the Internet 3, as shown in FIG. 1. At 25 it is also indicated that the unit 23 also provides the public key (z. B. can be queried via the Internet so that game participants can check the authenticity of the random numbers generated, ie the winning numbers.

In the backend 2 of FIG. 2, a timer 27 is also indicated, which causes the generation of random numbers at regular intervals, in particular once a day, via encrypted data connections, not shown.

A winning plan is shown in FIG. 3. The lottery extends over four weeks, seven days each. There is a draw every day. For example, participation must take place on 28 consecutive days, but the first day can be any day in the 28-day cycle. Only in the case of a bonus ticket is participation in only one class possible, namely in the first class of the following lottery.

The lottery is handled entirely paperless over the Internet, with the maximum being the numbers of the random number generator or their protocols to be sent to the tax authority as a hard copy.

The game participant dials into the website and can first view general information, in particular an online presentation of the lottery. He can then log in or register again. Passwords are used for this. The ordering of lots, the entry of the data of the game participant including the entry of payment information and the lot selection are carried out through an input mask. However, the ticket will only be activated if the payment has been made by bank transfer or the payment has been authorized by the credit card institute. The generation of the final digits is then displayed on this website. The game participant can also find out here whether he has won. While he or she has accessed the website, personal data is also transferred from the second secure subsystem to the first subsystem. If the game participant disconnects or after a predetermined time in which the game participant was no longer active, this data is transferred back to the secure second subsystem or else deleted. The management of customer accounts, drawing processing, profit notification, administration of master data, etc. takes place in the secure second subsystem. Payment transactions, online validation of payment data, and data transactions with the bank (transfers, credit and direct debits) are also advantageously carried out over the Internet.

At precisely defined intervals, in the example of the

3 once a day at the same time, end digits are generated. As a result, the lots are ner correct end number, with two correct end numbers, etc., which are then assigned a profit based on the profit plan. This win will then be automatically transferred to the bank account specified by the game participant.

For security, it is expediently provided that electronic lots are created which are provided with information about the lot number, customer number, participation period, checking account of the game participant - which are all digitally encrypted - so that the electronic lots are protected against changes.

An Oracle database is expediently used as database 8 in FIG. 1. However, other databases could also be used theoretically, although this should not be primarily based on this.

When checking whether the game participant is even entitled to participate in the game, he must state whether he is over 18 years old, and the local authorization, if there are restrictions, is verified by checking the postcode.

Claims

claims

1. Data processing system for organizing lotteries with a first subsystem (frontend, 1), which can be accessed from the outside via the Internet, and with a second subsystem (backend, 2), which has an unauthorized access-preventing logical device with the first Subsystem (frontend, 1) connected and otherwise complete, where

the second subsystem (backend, 2) has:

a random number generator (13),

Storage means (8, 10, 11, 12) for data of lottery participants including lot numbers assigned to the players and a winning plan,

a computer (10, 11) for allocating winnings based on the numbers generated in the random number generator to game participants with the lot numbers corresponding to the numbers, and

an email facility,

and a computer system (6, 7) is provided in the first subsystem (front end, 1) for data exchange with the game participants and for notifying the winners, characterized in that the random number generator (13) is connected to means (14) for providing the generated numbers with the signature of a private key (private key), which is securely housed (26) together with the random number generator (13), whereby the signature can be checked using a public key.

2. Data processing system according to claim 1, characterized in that in the second subsystem (backend, 2)

Means (17, 24) for checking the signature of the generated numbers are provided.

3. Data processing system according to claim 1 or 2, characterized in that in the second subsystem

(Backend, 2) a printer (18) is provided for logging.

4. Data processing system according to one of claims 1 to 3, characterized in that the random number generator (13) is connected via an encrypted data connection (21, 22) to the computer system (10, 11) which allocates the winnings.

5. Data processing system according to one of claims 1 to 4, characterized in that it has a timer (27) which triggers the generation of final digits and allocation of profits (drawing) at regular time intervals, in particular once a day, and via an encrypted data connection the random number generator (13) is connected.

6. Data processing system according to one of claims 1 to

5, characterized in that it has devices (25) for downloading certificates by game participants with which the signature of the generated numbers can be checked.

7. Data processing system according to one of claims 1 to

6, characterized in that it is designed to use XML signatures.

8. Data processing system according to one of claims 1 to

7, characterized in that it has a smart card reader (14) for the private key.

9. Data processing system according to one of claims 1 to 8, characterized in that the random number generator (13) has a physical noise source.

10. Data processing system according to one of claims 1 to 9, characterized in that the or a computer of the first subsystem (front end, 1) generates a mask for the screen of the game participant, in which the same data can be entered.

11. Data processing system according to claim 10, characterized in that in the mask for the game player input options for one or more lot numbers to be selected by her or him are provided.

12. Data processing system according to one of claims 1 to 11, characterized in that the participation in the lottery is only activated when the payment is received sentence has been made or confirmed.

13. Data processing system according to one of claims 1 to

12, characterized in that winnings are paid out automatically to the bank account specified by the game participant.

14. Data processing system according to one of claims 1 to

13, characterized in that game participants free participation in one or more draws

(Bonusless) can be granted as a profit.

15. Data processing system according to one of claims 1 to

14, characterized in that, with the exception of bonus lots, only participation in a predetermined number of draws is possible.

16. Data processing system according to one of claims 1 to

15, characterized in that only data of the game participant who is currently accessing the system is transmitted from the second to the first subsystem (front end, 1) and there is transmitted back to the second subsystem (backend, 2) after a predetermined time or be deleted.

17. Data processing system according to one of claims 1 to

16, characterized in that one or more of the computers (6, 7, 10, 11) carry out an authorization check.

18. Data processing system according to one of claims 1 to

17, characterized in that each computer and memory rather (6,7,10,11) is supplemented by a second one, which continues to operate if the first one fails.

19. Data processing system according to one of claims 1 to 18, characterized in that the operation takes place fully automatically.

20. Data processing system according to one of claims 1 to

19, characterized in that the essential parts of the random number generator and the devices for providing the signature are mechanically sealed.

21. Data processing system according to one of claims 1 to

20, characterized in that all essential processes are logged.

22. Data processing system according to one of claims 1 to

21, characterized in that it is connected to the Internet.

23. Data processing system according to one of claims 1 to 22, characterized in that the essential elements of the system (7, 9, 10, 11, 13, 14, 15, 17, 18) are provided in duplicate.