EP3074960A1

EP3074960A1 - Secure container for delivery or collection of goods

Info

Publication number: EP3074960A1
Application number: EP14717465.0A
Authority: EP
Inventors: Karl WILLS
Original assignee: Pelipod Ltd
Current assignee: Pelipod Ltd
Priority date: 2013-11-27
Filing date: 2014-04-01
Publication date: 2016-10-05
Also published as: GB201320945D0; WO2015079203A1; GB2520698A

Abstract

There is provided a method of operating a secure apparatus server for the delivery of goods to or the collection of goods from secure apparatus. The method comprises receiving over a communications link from a retailer or a delivery organisation information indicative of a user who has ordered goods or wishes to return goods. The method further comprises transmitting over a communications link a local code to the retailer or a/the delivery organisation that can be provided locally to secure apparatus associated with the user to gain access to the apparatus for delivering the goods to the user or collecting the goods. The method further comprises transmitting over a communications link a remote code to the secure apparatus associated with the user, the remote code corresponding to the local code in a predetermined way such that the secure apparatus can compare the local code with the remote code and allow access to the apparatus for delivery or collection of the goods if the codes correspond in the predetermined way.

Description

DEVICE FOR USE IN ONLINE SHOPPING

FIELD

This disclosure relates to a device for use in online shopping. BACKGROUND

Those wishing to buy goods are increasingly looking to buy goods online - that is over the internet - rather than by visiting a shop in person. This is particularly so with private customers who find greater convenience in buying items such as consumer goods, clothes and food online from merchants with an online presence.

Internet sales in the UK currently account for 14% of all retail sales and are forecast to grow annually at 12% for the next few years. Other European countries are experiencing growth of over 25%.

One drawback, however, with online shopping is the need for a physical courier service to deliver to the customer the goods that have been bought. All other parties involved in the transaction, including the online retailer and the customer, have to rely on the courier delivering the goods carefully and in a trustworthy and timely manner. Another drawback is that, for at least some purchases, the customer must be at the delivery address at the time of delivery. Otherwise the bought item will not be delivered. This is the case for items requiring a signature upon delivery and for items that are too bulky to fit through a letter box.

To address these drawbacks, some retailers are offering alternative services including services by which the customer collects the bought items from a branch of the retailer or from another local store, such as a convenience store. However, this makes the whole process less convenient. Another attempt at a solution is the provision by some companies of a box situated outside the customer's house to which a bought item may be delivered by a courier if the customer is not at home at the time of delivery. These boxes, however, suffer from the drawbacks that they tend to be able to hold only one delivery at a time for security reasons (to stop the second courier tampering with the first delivery), they can be used only for deliveries and not for returning items, and there is no way for the merchant to prove that delivery took place in the event of a dispute with the customer.

It is therefore desirable to find an alternative solution to address the drawbacks of online shopping.

SUMMARY

According to a first aspect of this invention, there is provided a method of operating a secure apparatus server for the delivery of goods to or the collection of goods from secure apparatus, the method comprising the steps of the server: receiving over a communications link from a retailer or a delivery organisation information indicative of a user who has ordered goods or wishes to return goods; transmitting over a communications link a local code to the retailer or a/the delivery organisation that can be provided locally to secure apparatus associated with the user to gain access to the apparatus for delivering the goods to the user or collecting the goods; and transmitting over a communications link a remote code to the secure apparatus associated with the user, the remote code corresponding to the local code in a predetermined way such that the secure apparatus can compare the local code with the remote code and allow access to the apparatus for delivery or collection of the goods if the codes correspond in the predetermined way. The two codes may be deemed by the apparatus to correspond in a predetermined way by matching either other or by being a substantial match. By "substantially match" it is match that the two codes match in substance in a predetermined manner. For example, it may be sufficient for a portion or all of one code to match a portion or all of the other code. In another example, the two codes may be deemed by the apparatus to correspond in a predetermined way by corresponding to one another in a manner determined by an algorithm to which the apparatus has access.

The retailer may be an online retailer. The delivery organisation may comprise a courier organisation able to deliver the goods to or collect the goods from the secure apparatus by courier and/or a delivery management platform able to act as intermediary between one, more, all or any combination of: the secure apparatus server, the retailer and the courier organisation.

The retailer and/or the courier organisation and/or the delivery management platform may be remote from the secure apparatus server. The secure apparatus server may be local to the retailer and/or the courier organisation and/or the delivery management platform.

The step of receiving the information indicative of the user may be followed by the step of checking against a record of users, each of whom is known to have a respective secure apparatus associated with the user; and the step of transmitting the local code may only take place in the event that the user who has ordered the goods or wishes to return the goods is found to have a secure apparatus associated with that user.

The method may comprise the step of the secure apparatus server transmitting to the retailer and/or the delivery organisation delivery or collection information that may comprise one more or any combination of: the name of the user, the address of the user, the location of the secure apparatus. Some or all of the delivery or collection information may be retrieved from the record of users. The method may comprise a registration step of receiving from a new user registration information indicative of the user and of the user having a secure apparatus associated with that user. This information may comprise the user's name and address, and the location of the secure apparatus. The secure apparatus server may store the information received in the registration step. It may be stored in the record of users. The registration information may be received remotely over a communication link from the new user. The registration information may be received via a web interface, which may be hosted by the secure apparatus server, running in a browser on a computer local to the new user.

The secure apparatus server may communicate over a communications link with the user to inform the user of the time and date of delivery or collection. The communications link may be over a cellular telephone network to a mobile phone of the user.

The method of this first aspect may comprise one, more all or any combination of the features of any other aspect.

According to a second aspect of this invention, there is provided a method of operating secure apparatus for receiving a delivery of goods or providing for the return of goods, the method comprising the steps of the secure apparatus: receiving over a communications link a remote code from a remote location; receiving locally at the apparatus a local code; and comparing the local code with the remote code and providing access to the secure apparatus for the delivery or collection of goods in the event that the codes correspond in a predetermined way.

The step of the secure apparatus receiving the remote code from the remote location may be followed by the step of the secure apparatus transmitting over a or the communications link to the remote location confirmation that the remote code has been received. The secure apparatus may maintain a communications link with the secure apparatus server only intermittently. The link may be established periodically. The link may be established several times each day. This helps to save power and allows the secure apparatus to be powered by discrete electricity storage means, such as a battery. The secure apparatus may communicate with the secure apparatus server only when the communications link is established.

The method may also comprise the secure apparatus comparing the local code against an emergency code stored at the secure apparatus and, in the event that the local code and the emergency code correspond in the predetermined way, providing access to the secure apparatus. The secure apparatus may only compare the local code against the emergency code upon receiving from the secure apparatus server a signal to this effect.

The secure apparatus may comprise a container for receiving the goods to be delivered or returned and having a lockable cover for releasably enclosing the goods within the container. Upon sensing that the cover has been opened, the secure apparatus may record locally information indicative of the opening and/or each opening. The apparatus may operate a camera of the apparatus to record an image of the inside of the container, and/or the time and date of the opening. A plurality of images may be recorded at different times during the opening of the container. The secure apparatus may sense the opening of the cover by measuring the amount of light detected by a camera of the apparatus (optionally the same camera that records the images) and/or by an actuator of the apparatus actuated by opening the cover.

The method may also comprise a movement sensor of the apparatus detecting whether or not there is any movement inside the container when the cover is open. In the event that movement is detected, the apparatus makes a record of this and associates it with the opening of the apparatus. The method may also comprise the apparatus recording an image of the inside of the container after the cover has been closed.

The secure apparatus may respond to a user code provided locally at the apparatus by comparing the user code against a local record at the apparatus to see whether or not the user code is recognised. If it is, the secure apparatus provides the user with access to the apparatus. Information indicative of the user having opened the apparatus may be communicated by the apparatus to the secure apparatus server.

Accordingly, the method may comprise the apparatus recording locally information indicative of the and/or each opening, that information comprising one, more, all or any combination of: the time of opening, the time of closing, an image before opening, an image after opening, a record of any movement sensed inside the container between opening and closing.

The method may comprise the secure apparatus transmitting some or all of the information indicative of the opening to the secure apparatus server over the communications link. This may be done in response to an appropriate request from the server.

The method may comprise the apparatus processing one or more recorded images to determine whether or not they indicate that a delivery, a collection or neither was made during the opening. This may comprise comparing an image before or at the opening with an image at or after the closing of the cover.

The method may comprise the apparatus transmitting information indicative of a delivery or a collection having been made in the event that the apparatus determines that that is the case. The method may comprise the apparatus transmitting information indicative of a delivery or collection not having been made, but the apparatus having been opened using the local code or user code, in the event that that is the case. The information indicative of a delivery or collection having or not having been made may be transmitted over the communications link to the secure apparatus server or to the user. The remote code and the local code may be one-time use codes used only for a single delivery. The user code may be used repeatedly.

The method of this second aspect may comprise one, more all or any combination of the features of any other aspect.

According to a third aspect of this invention, there is provided secure apparatus for receiving a delivery of goods, the apparatus comprising a container for receiving goods to be delivered and having a lockable cover for releasably enclosing the goods within the container, the apparatus further comprising remote code-receiving means for receiving a code from a remote location, and local code-receiving means for receiving a code provided locally at the apparatus, the apparatus arranged to receive a remote code via the remote code-receiving means, to receive a local code via the local code-receiving means, to compare the local code with the remote code and to unlock the cover if the codes correspond in a predetermined way.

The remote location may be the secure apparatus server defined in other aspects of the invention.

The secure apparatus may be arranged to carry out one, more or any combination of the steps of the methods defined in other aspects of the invention. The secure apparatus may comprise one, more, all or any combination of the features defined in the other aspects.

The secure apparatus may comprise receiving means for receiving the local code and/or the user code. The receiving means may comprise input means, for example a keypad. The receiving means may comprise wireless receiving means such as a contactless receiver, for example a near field communication (NFC) receiver.

The secure apparatus may comprise locking means by which it can be locked to a fixed object to guard against the apparatus being moved from its desired location. The secure apparatus may comprise a transceiver by with it is arranged to set up the or each communications link. The receiver may be a radio transceiver, for example arranged to operate over a cellular telephone network.

According to a fourth aspect of this invention, there is provided a secure apparatus server programmed and operable to carry out the method of the first aspect.

According to a fifth aspect of this invention, there is provided a record carrier comprising code portions recorded thereon or therein that are executable by a processing means to cause that processing means to carry out the steps of a method according to the first aspect or the second aspect.

According to a sixth aspect, there is provided a computer programme comprising code portions executable by a processing means to cause that processing means to carry out the steps of a method according to the first aspect or the second aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the disclosure will be described below by way of non-limiting example only and with reference to the accompanying drawings, in which:

Figure 1 shows a system for delivery and return of retail goods to and from a secure box; Figure 2 shows the method steps associated with the delivery of retail goods to the secure box within the system shown in Figure 1; and

Figure 3 shows the method steps associated with the collection of retail goods from the secure box within the system shown in Figure 1.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

Figure 1 shows a system 100 for the delivery and return of retail goods using an

embodiment of the present invention. The system 100 will now be described in detail. The system 100 shown in Figure 1 includes a secure box 110, to which retail goods purchased by a customer are delivered, and if necessary, from which retail goods, that are to be returned, are collected. This secure box 110 is made from plastic, and has a hinged lid. The lid is hinged along the rear top edge of the secure box 110, when a user is facing the front of the secure box 110, and the user raises the front edge of the lid of the secure box 110, with the lid then pivoting about the hinge at the rear edge of the secure box 110, to open the secure box 110. The secure box 110 has dimensions 80cm x 50cm x 65cm high. The lid, and hinge arrangement, incorporates a safe closure mechanism, in order that the lid does not fall and catch a customer's fingers. This is similar to the mechanism used for car boots (trunks), where during the final stage of lid closure the lid slowly moves into a closed position abut the top surface edges of the secure box 110, even when the lid is not held during closing the lid of the secure box 110. The skilled person will appreciate that other types of safe closure mechanisms could be used. In other embodiments of the secure box 110, the material of construction is different and the dimensions of the box may be different; for example the secure box 110 may be a metal box and may be larger or smaller than the embodiment shown. The secure box 110 is suitably positioned outside of a customer's dwelling, for example by the side of a garage or by the side of the house or within the garden near to the driveway entrance. The secure box 110 is weather proofed such that rain, for example, does not enter the secure box 110.

As the secure box 110 is arranged to be positioned at any suitable location, this could be in a position at some distance from the user's house and as such the securer box 110 is not in telecommunication contact with the user. In other words the secure box 110, in this described embodiment, does not have an internet connection, and is not required to be connected to the internet to provide for the secure delivery and collection of retail goods.

The secure box 110 has the ability to be locked or clamped in position in order that the secure box 110 is difficult to steal. A locking eye on the secure box 110 (not shown) enables a cable or chain to be attached to the secure box 110, the other end of which is locked to or clamped to an appropriate locking or clamping point, such as another locking eye attached to, for example, a garage outer wall. The locking eye is internal to the secure box 110, however in other embodiments the locking eye is external to the secure box 110. The skilled person will understand that the secure box 110 therefore has locking means 122.

The secure box 110 has a power supply 120, which in the described embodiment is a replaceable battery 120. In other embodiments of the secure box 110, the power supply 120 is through mains 240V AC supply, and in other embodiments power is supplied through solar power, or wind power for example. The power supply 120 provides power to the secure box 120 and the other peripherals associated with the secure box 110, which are described below. The secure box 110 is maintained in a locked state when power is not provided. This helps to prolong the life of the battery 120. A locking mechanism (not shown) is used to lock the secure box 110, where the locking mechanism has an

electronically operated latch mechanism. The locking mechanism is arranged to move from a locked to an unlocked position. Upon receipt of an appropriate signal from the microprocessor 114 the latch mechanism is moved by an actuator from a position associated with the box being locked to the box being unlocked. The latch mechanism is biased such that very little power is required to effect movement from the locked to the unlocked state, for example the charge associated with the charge on an appropriate capacitor circuit is sufficient to enable the secure box to be unlocked. When in the unlocked state the locking mechanism does not draw any power. Upon receipt of an appropriate signal from the microprocessor 114 the latch mechanism is moved by the actuator from the position associated with the locking mechanism holding the box 110 in an un-locked state to a position associated with the secure box 110 being in a locked state. When the locking mechanism is holding the secure box 110 in a locked state, the latch mechanism does not draw any significant power and only draws enough power to maintain the capacitor circuit in a charged configuration thereby enabling the latch mechanism to move the locking mechanism from the locked to the unlocked state. When the charge on the battery 120 drops below a set level, the secure box 110 is maintained in a locked state. This helps to safeguard the contents of the secure box 110. Referring to the embodiment of the secure box 110 shown in figure 1, a keypad 112 is provided. The keypad 112 has a keypad membrane 113 (not shown) covering the keys of the keypad 112. Two terminals 115 (not shown), one a positive terminal 115a and one a negative or ground terminal 115b, are located under the keypad membrane 113, and the secure box 110 is "jump started" into a powered on state, by providing external power to the secure box from an external power supply (not shown). The keypad membrane 113 is pierced and a negative (or ground) terminal from the external power supply is connected to the negative (or ground) terminal 115b and a positive terminal from the external power supply is connected to the positive terminal 115b, and power is provided to the secure box 110. The application of external power activates the microprocessor 114 to allow the secure box 110 to be opened using the correct code into keypad 112. In other embodiments, an "override" code is used input into the keypad to open the secure box 110. This means that the secure box 110 can always be opened, but remains in a state that protects its contents.

Continuing with the embodiment of the secure box 110 shown in Figure 1, as discussed above a keypad 112 is provided. A user uses the keypad 112 to unlock the secure box 110, using a one-time use code.

When entering a code into the keypad 112 a final unlocking key is pressed to unlock the secure box 110, with this final key being the "*" key. In other embodiments a different unlocking key is used.

The length of the key code to be input into the keypad 112 depends upon the user. The owner of the secure box 110 is required to input a 6 digit code. The courier is required to input a 4 or 5 digit code. Personnel from the company operating the secure box server are required to input a 7 or 8 digit code. The skilled person will understand that different numbers of digits can be assigned to different users.

When the courier delivers more than one parcel to the secure box 110 at one time, where each parcel has a one-time code associated with it, the courier uses the keypad to enter all the codes, where each code is separated with a "#". There will then be the need to enter a final "unlocking" key, "*". When any key of the keypad 112 is pressed, the secure box 110 enters a powered "on" state in which it is powered up for use. The secure box 110 includes a microprocessor 114, which is powered up along with the secure box 110. The microprocessor is arranged to receive information from the keypad 112. There is a separate power up circuit, not shown, linking the keypad 112 to the power supply 120, that enables the secure box 110 to be powered without the microprocessor 114 being in a powered state. The microprocessor 114 has access to non-volatile memory, upon which data is stored and retrieved for processing.

The secure box 110 includes a movement sensor 116. The movement sensor 116 is a passive infrared (PI R) sensor. The PIR sensor 116 is always powered up, even when the secure box 110 is powered down and in its "sleep" mode. The movement sensor 116 has a PIR microprocessor. The movement sensor 116 in combination with an appropriate algorithm running on the PIR microprocessor is used to detect movement within the box 110. This allows it to be determined if the lid of the secure box 110 is open or closed, and whether objects are placed in, taken out of, or moved about within the secure box 110. The skilled person will appreciate that other sensors, such as light sensors, accelerometer sensors, weight sensors, and tilt switches can be used to determine if the lid of the secure box 110 has been opened or closed, and whether objects are placed in, taken out of, or moved about within the secure box 110.

The secure box 110 includes a digital camera 118, in the form of a fish eye lens and a charge coupled device (CCD). In other embodiments of the secure box, other forms of camera are used. The CCD camera 118 is powered up along with the secure box 110, and is controlled by the microprocessor 114. The CCD camera has an LED flash (not shown). The CCD camera 118 is arranged to take a number of snap shot pictures during closing of the lid of the secure box 110. An angle detector is coupled to the lid to determine that the lid is closing, and the CCD camera is arranged to take three pictures during closing of the lid of the secure box 110. This helps to overcome problems associated with the view of the CCD camera being obscured by objects placed near to the camera. The skilled person will appreciate that more or less than three snap shot pictures can be taken by the CCD camera(s). The CCD camera is arranged to take snap shot pictures when the lid of the secure box 110 is at an angle of 45 degrees to the top surface of the secure box 110, where snap shots are taken at this angle and before and after this angle to "bracket" the image. The skilled person will appreciate that in other embodiments the CCD camera can be arranged to take snap shot pictures at other closing angles, where for example the angle of the lid at which the CCD camera takes snapshots depends on the viewing angle of the CCD camera in order to get maximum coverage of the interior of the secure box 110.

The microprocessor 114 is arranged to store processed movement data from the movement sensor 116 and captured picture information from the CCD camera 118. If an item has not been delivered, or an item taken out of the secure box 110 when it should not have been taken out, or an item that was to be collected not put in the secure box for collection, then this audit data can be interrogated if necessary to assess what has occurred.

The secure box 110 includes a transceiver system 124. The transceiver system 124 draws its power from the secure box 110 power supply 120. The transceiver system 124 includes a modem and antenna, and contains a SIM. The transceiver system 124 is connected to the microprocessor 114 and is arranged to send and receive General Packet Radio Service (GPRS) data. Transmitted GPRS data includes the position of the secure box 110, which is useful if a thief compromises the locking means 122 and manages to steal the secure box 110. The secure box 110 is powered all the time, however at various times it operates with different levels of activity: 1) in a "sleep" mode, with a timer running checking sensors; 2) in an "awake" state, awaiting input from a user; and 3) awake and communicating over the Wide Area Network link. The secure box 110 is normally in the sleep mode. The secure box 110 is activated and powered up when a user presses a key on the keypad 112 and the secure box 110 is also periodically powered up every 6 hours. In other embodiments the period between powering up of the secure box 110 is greater than 6 hours and in other embodiments the period between powering up of the secure box is less than 6 hours. In other embodiments, the period between powering up the secure box 110 depends on the time of day, where for example the period between powering up is less during usual delivery hours of packages. The transceiver system 124 is powered up along with the secure box 110, and communicates with the secure box server 126 by sending a GPRS message indicating that the secure box is active, following which, if necessary, the secure box server 126 sends appropriate data via GPRS to the secure box 110. The transceiver system 124 is connected to the microprocessor 114, and the microprocessor 114 is arranged to process GPRS data received by transceiver 124 and also to process data that is to be transmitted by the transceiver system as GPRS data. The transceiver system 124 has limited autonomous functionality. For example, in response to a GPRS received signal requesting a status update, where this includes a request for the present location of the secure box 110 to be transmitted, the transceiver system 124 transmits to the secure box server 126 the position information of radio masts in the locality of the secure box 110. The secure box server 126 then determines the position of the secure box 110 through multilateration of signals from the positions of different radio masts.

If the power level of battery 120 falls below a certain level, the microprocessor 114 is arranged to monitor the power level and sends an appropriate message to the secure box server 126 using the secure box transceiver 124. The company operating the secure box server 126 then either arranges to replace the battery, or sends an appropriate message to the customer to replace the battery 120. The secure box 110, is arranged such that data is not lost during replacement of the battery 120. The power level of the battery 120 at which the message is sent to indicate that the battery is required to be replaced is at a higher level than the level at which the secure box 110 enters a locked state due to a low battery level.

Within the system for delivery and return of retail goods 100 as shown in figure, there are other systems, which are now described.

A secure box server 126 is provided as part of the system for secure delivery and return of goods, which is operated by a company associated with the use of secure boxes 110. In the embodiment shown in Figure 1, the secure box server 126 is operated by the company that provides secure boxes 110 to customers or users. The secure box server 126 is in contact with a (or a number of) delivery management platform(s) 132, online retailers 134, a (or a number of) package carrier companies 136. It is envisaged that each of these are remote from each other. There is also provided a secure box server web interface 138. All of these systems communicate with each other via "the cloud" 130 (that is the internet). Therefore, each of the separate systems are arranged to communicate seamlessly one with the other. As part of the system for secure delivery and return of goods, a call centre 139 (not shown) is arranged to communicate with the company operating the secure box server 126, thereby enabling a user, such as a courier delivering or collecting goods, to request help or receive update information. The skilled person will understand that because each of the separate systems are arranged to communicate seamlessly one with the other, required information from across the system for the secure delivery and return of goods can be provided to the user, even though the call centre 139 is only linked to the company operating the secure box server 110. In other embodiments, the call centre 139 is arranged to be in

communication with any one of the delivery management platform(s) 132, online retailers 134, or package carrier companies 136. In other embodiments, the call centre 139 is arranged to be in communication with a number of these separate systems, and in other embodiments a number of call centre(s) 139 are linked to any number of the separate systems. In other embodiments, the call centre 139 is operated by one of the separate systems, for example the call centre 139 is staffed by personnel from the company operating the secure box server 126.

Starting with the secure box server web interface 138, this is an application running on a user's home personal computer. When a user receives a secure box 110 they are able to use the secure box server web interface 138 from their personal computer by accessing a central application held in the cloud. The application is a Software as a Service application (SaaS). The secure box server web interface 138 is used to register the user's details onto the secure server 126. The details provided include the user's name, address, postcode (or zip code), mobile telephone number, landline telephone number, email address, the location of their secure box 110, and other relevant registration information to allow the user to be contacted or identified. The user then receives a password, to access the secure box server 126 through the secure box server web interface 138, and receives a personal identification number (PIN) useable to open their secure box 110. The user can use the secure box server web interface 138 to update the password and/or PIN. User PINs are able to be set to be valid for specific time periods, with a start time and end time, this allows the owner of the secure box 110 to provide a friend or relative with their own unique PIN to be used whilst, for example, the owner is away on holiday. The user can use the secure box server web interface 138 to report malfunctions with the secure box 110, or to interact with the secure box server 126 and hence the company associated with providing the secure boxes 110 for whatever reason is required.

Continuing with the system for the delivery and return of retail goods 100 shown in Figure 1, the secure box server 126 has a transceiver 128 associated with it. The secure box server 126 and transceiver 128 are arranged to transmit and receive GPRS data to and from the customer's secure box 110.

The delivery management platform 132 shown in figure 1, represents a communication server operated by a company who act as intermediaries between retailers and package carriers 136. The delivery management platform 132, dependent upon what has been bought, where it is to be shipped from, where it is to be shipped to, and what time it is to be picked up from the depot and at what time it is scheduled to be delivered, will determine an appropriate carrier 132 to arrange for delivery of the retail goods.

As discussed, the package carrier 136 is the company instructed for delivery of the goods, and they instruct a courier 140 who will actually deliver the goods. A label is attached to the goods to be delivered, and a one-time code is printed on the label. The one-time code is the code that will be used by the courier to open the secure box 110. The courier 140 has a mobile telephone 142. If needing help or support, the courier 140 uses the mobile telephone 142 to talk to personnel from the call centre 139. In another embodiment the courier will talk to personnel of the company operating the secure box server 126. In other embodiments the courier sends and receives Short Message Service (SMS) messages with the call centre 139. The call-centre 139, who are able to communicate with the company operating the secure box server 126, can then provide the courier 140 with the information the courier requires. The online retailer 134 is any one of the businesses who offer the sale of goods over the internet. In the system shown in figure 1, the online retailer 134 has an arrangement with the company operating the secure box server 126, such that when a customer purchases goods from the online retailer 134 a goods delivery option includes that the goods be delivered to a secure box, such as that shown 110. The user when purchasing goods from this online retailer 134, ticks an appropriate box during the purchase process in order that the goods ordered will be delivered to their secure box 110. In other embodiments, in order for goods to be delivered to their secure box 110, the user enters their PIN, that they use to open the secure box, and in other embodiments they enter a unique identifier associated with the secure box 110. The online retailer 134 has an arrangement with the delivery management platform(s) 128, who arrange for delivery of the goods.

It is envisaged that within such a system the interested parties: the online retailer 134; the delivery management platform 132; the package carrier 136; and the courier 140 would pay a small premium to the company operating the secure box server 126, because of the significant benefits to customer's purchasing goods that can be delivered to a secure box 110, and collected from the secure box 110 if necessary. The customer would initially rent the secure box 110, and also would be anticipated to pay a small premium for the convenience and security of delivery involved with delivery to their secure box 110. In other embodiments, the customer has the option to purchase the secure box 110.

The way in which the system for the delivery and return of retail goods 100 works, and how retail goods are delivered to, and if necessary collected from, a secure box 110, will now be described.

Referring to Figure 2, the method 200 for delivery of a package will now be described.

At step 205 the customer orders retails goods with an online retailer 134, during which process the customer either logs on to the online retailer's 134 website or logs on as a guest; however in either case the online retailer 134 will be made aware of the name and address of the customer for delivery purposes or as part of the payment process. During the purchase process the customer indicates that they would like the goods to be delivered to their secure box 110. This is done by ticking a box that appears at the delivery screen during the purchasing process; the skilled person will be aware that other delivery options generally shown are: next day delivery; first class delivery; second class delivery etc.

Delivery to a secure box 110, is presented as a delivery option alongside these other delivery options.

At step 210, the order details and customer details are sent from the online retailer 134 to the secure box server 126. The secure box server 126 identifies the customer on their record system from the information provided by the online retailer 134, and determines the details associated with the customer's secure box 110. If the secure box server 126 cannot identify that the customer has a secure box 110, a message is sent back to the online retailer 134 who interacts with the customer that another delivery option is required. The customer could then use the secure box server web interface 138 to report a problem with delivery with that online retailer 134 to their secure box 110.

At step 215, the secure box sever 126 communicates to the delivery management platform 132 the order details, the customer's details and details of the customer's secure box 110. In this way, the delivery management platform 132 is given the required information to deliver the goods purchased by the customer to the customer's secure box. The delivery management platform 132 determines the package carrier 136 to be used for the delivery, and provides the package carrier 136 with unique identification information associated with the customer's retail purchase. At this time the delivery management platform 132 will know an expected time of delivery of the customer's goods.

At step 220, the delivery management platform 132 communicates with the secure box server 126, providing details of the package carrier 136 being used for the delivery of the customer's goods and the unique identification information being used by the package carrier 136 for delivery of the customer's goods. At the same time the delivery

management platform 132 communicates to the online retailer 134 details regarding the expected time of delivery. The customer logging on the online retailer's website can then view an expected time of delivery of the goods, or alternatively the online retailer 134 could email the customer with expected delivery time details.

At step 225, the secure box server 126 generates a 4 or 5 digit numerical one-time code. This code is the code that will be used by the courier to open the customer's secure box 110. When the secure box 110 periodically enters the powered on state, and sends a GPRS message to the secure box server 126 that indicates that it is in a powered on state, the one-time code is sent from the secure box server 126 via the secure box server transceiver 128 to the secure box 110 and is received by the secure box transceiver 124. The one-time code is also sent from the secure box server 126 to the package carrier 136 along with the unique identification information being used by the package carrier 136 for delivery of the customer's goods in order that the package carrier 136 can correctly associate the one time use code with the customer's secure box 110. The skilled person will appreciate that the code may also be a randomly generated code.

At step 230, the secure box 110 via the secure box transceiver 128 sends a confirm receipt message to the secure box server 126, which is received by the secure box server transceiver 128. The secure box server 126 processes the information, and determines that the secure box 110 has received the one time use code.

At step 235, the package carrier 136 instructs courier 140 to collect the goods from where the online retailer 134 stores their goods, or otherwise from where the goods are to be collected. The courier 140 is given the customer's details, including name and address, and the location of the secure box 110, and the one time use code to be used with this order for opening the secure box 110.

At step 240, the courier 140 arrives at the customer's secure box 110. The courier 140 presses the first key on the keypad 112. The secure box 110 immediately enters the powered "on" state. The transceiver system 124 of the secure box 110, when the secure box 110 was in one of its previous periodic powered on states, transmitted the one-time code to the microprocessor 114. The microprocessor 114 will then only open the secure box 110 if this code is entered into the keypad by the courier 140. It could be that since the last time the secure box 110 was opened the customer has purchased a number of different goods, in which case the secure box 110, via the transceiver system 124, will have received a number of different one-time codes that can be used to open the box, each associated with a different purchase. These one-time codes will have been received within one or more of the periods when the secure box 110 was periodically powered up and these codes at the time or times when the secure box 110 was powered up will have been sent from the transceiver 124 to the microprocessor 114. The microprocessor 114 is then arranged to open the secure box 110 only if one of these one-time codes is now entered into the keypad 112.

At step 245 it is determined if the code entered into the keypad 112 is the, or a, correct onetime code. If yes, the process moves on to step 255.

If no, the process moves on to step 250. Here, the courier uses the mobile telephone 142 to call the call centre 139, via which required information can be provided to the courier from the secure box server 126. In that call the courier provides details associated with the order that is to be delivered to this particular secure box 110. The secure box server 126 previously sent out a GPRS message to the secure box 110 with an "emergency" one-time code to be used to open the secure box, with the secure box transceiver 124 receiving this during one of the secure box periodic powered up periods. At that time the secure box transceiver 124 transmitted the received GPRS message from the secure box server 126 to the microprocessor 114. The emergency code is therefore pre-stored on the secure box 110. During the courier's telephone call, the company operating the secure box server 126, via the call centre 139, provides the emergency one-time code to the courier 140 over the telephone. In other embodiments, the courier receives a call back with the emergency one time code. The microprocessor 114 now awaits input of the emergency code on the keypad. The process then returns to step 240, until a correct code is entered at which time the secure box 110 deletes that emergency one-time code. If after three attempts the code is not correct, an error code is generated and the courier will have to return the goods, and the customer is informed. In other embodiments the courier 140, using his mobile telephone 142, to send an SMS message to the call centre 139, which is relayed to the company operating the secure box server 126, to report an error, and receives an SMS message with the emergency one-time code to be used to open the secure box 110. In other embodiments, the secure box 110 stores more than one emergency one-time code, and in other embodiments when the number of stored emergency one-time codes on the secure box 110 drops below a set number, during periodic power up periods the secure box 110 reports this to the secure box server 126 and the secure box server 126 transmits new additional emergency one-time codes to the secure box 110, and the secure box 110 then stores these along with the existing ones.

At step 255, the courier 140 opens the lid of secure box 110. The lid of the secure box 110 has a trip switch (not shown), that is connected to the microprocessor, and the trip switch and microprocessor are arranged to determine when the lid of the secure box 110 has been opened and when it is then closed. The CCD camera 118 in addition senses a change in light level, and this is additionally used as a second means to determine that the lid of the secure box 110 has been opened. The use of the trip switch ensures that, if the secure box 110 was opened at night, for example when it was pitch black, the secure box 110 can still determine when its lid has been opened. The microprocessor logs the time that the lid of the secure box 110 was opened. The courier 140 places the package into the secure box 110, and closes the lid of the secure box 110. If however he cannot fit the package into the secure box 110 then he uses the courier transceiver to make a telephone call to the personnel of the company operating the secure box server 126 that the package could not be delivered because the secure box 110 was too full. The company operating the secure box server 126 then sends an appropriate message to the customer, through email or SMS that the package could not be delivered due to the secure box 110 being too full. In other embodiments the courier 140 sends an SMS message to the secure box server 126 to indicate that the package could not be delivered, whilst in other embodiments the courier call or sends an SMS message to a call-centre, where the call centre then communicates with the company operating the securer box server 126. Continuing with step 255, if there is enough room inside the secure box 110, the courier 140 places the package into the secure box 110 and closes the lid. The movement sensor 116, in cooperation with the microprocessor 114, determines a movement record associated with the opening and closing of the lid of the secure box 110 and the placing of anything into the secure box 110, and this information is logged by the microprocessor 114. If there is no movement other than that associated with opening and closing of the lid, this will still constitute an active record and it can be determined that nothing has been put into, or taken out of, the secure box. The movement record associated with opening and closing the lid of a secure box, with no items placed within the secure box, is kept as a record by the company operating the secure box server 126, to be used in the event of investigating any questionable activity, such as a claim that no items were deposited. The lid of the secure box 110 is then closed, this is sensed and the time is again logged. Upon the lid closing the CCD camera 118 takes a picture of the contents of the secure box 110 and this is also logged. Therefore, associated with the delivery of a particular item, for which there was a unique one time use code associated with that delivery, the secure box 110 has: a log of the times that the lid of the secure box 110 was opened; a log of a picture of the contents of the secure box 110 both before and after the secure box 110 was opened and closed; and a movement record starting from opening of the secure box 110 to closing of the secure box 110. This record is stored locally. However, in the event of questionable activity associated with the delivery of a package, this data is transmitted as GPRS data to the secure box server 126.

At step 260, the secure box 110 sends an SMS message to the secure box server 126 with details of the one-time code used to open the secure box 110, with the times that the lid of the secure box 110 was opened and closed and a simple indication that a package has been delivered. This data does not comprise the pictures taken by the CCD camera 118 or the movement record acquired by the movement sensor 116, but the picture and movement data is used to provide an auditable record that a package has been delivered to the secure box 110. As part of this process, the microprocessor 114 uses an image analysis program or algorithm, such as subtracting one image from the next to determine any change, and if this indicates that an object has been placed into the secure box 110 then a positive indication is given that the package has been delivered, otherwise a negative indication is given if there is also no associated appropriate movement data.

At step 265 the secure box server 126 sends an SMS and/or email message to the customer that the delivery has been made.

At step 270, the customer enters their PIN to open the secure box 110. Steps 255 and 260 are repeated, except in step 255 the customer replaces the courier 140 and the event being monitored is the collection rather than delivery of the package and in step 260 the SMS message sent to the secure box server 126 provides a positive indication if a package has been removed.

The skilled person will appreciate that during the above process, if the courier does not deliver the package when they claimed to have delivered it, or took out a package rather than delivering one, or placed a package into the secure box 110 and removed another, the secure box 110 will be able to determine these chain of events. Similarly, if the customer takes out a package, but claims that the package was not delivered, or takes out two or more packages when only claiming that one has been delivered, the secure box 110 will be able to determine these chain of events. If there is any requirement to investigate any suspicious behaviour, the company operating the secure box server 126 sends an

appropriate message from the secure box server 126 using the secure box server transceiver 128 to the secure box 110, which is received by the secure box transceiver 124 during one of the secure box's 110 periodic power up periods, in response to the secure box 110 communicating to the secure box server 126 that it is powered up and capable of receiving and transmitting data. The appropriate logging data associated with the event or events in question (the times of opening and closing of the secure box 110 relating to the items of interest, or over a time period of interest if there is a suspicion that the customer has removed packages that they subsequently state not to have received, along with the CCD camera 118 pictures of the contents of the secure box 110 at the open and closing times, with the movement data) is sent from the secure box 110 to the secure box server using the secure box transceiver 124 to send the GPRS data and using the secure box server transceiver 128 to receive the data. The secure box 110 then powers down at the end of its periodic power up period, after transmitting this data. Then the company operating the secure box server 126, or other interested parties such as insurance companies are able to analyse the data to determine whether there has been fraudulent behaviour or other suspicious behaviour.

Referring to Figure 3, the method 300 for collection of a package that is to be returned will now be described. This method would be used when a customer has purchased an item, that has been delivered according to the method 200 for delivery described above, but, for one reason or another, the customer wishes to return the item. For example, the item may not fit in the case of an item of clothing, or the item may be faulty in the case of a consumer good. In other embodiments, the customer can use the secure box 110 for the return of goods that were not delivered to the secure box 110. For example, in these other embodiments, a customer buys goods on the high street from a retailer, where that retailer also has an online sales presence, but arranges to return the goods to the retailer using the secure box 110.

At step 305 the customer interacts with the online retailer 134 from whom they purchased the retail goods. During this process, by way of the customer logging on to the online retailer's website and indicating which goods are at issue, or otherwise providing unique ordering information relating to the goods ordered that are to be returned, the online retailer 134 is able to determine the appropriate details of the customer, such as name and address. The customer then indicates that they wish for the collection of the goods to be from their secure box 110. This is done through ticking an appropriate box within the online retailer's website page or otherwise indicating this to the online retailer 134, such as for example explaining this to a telephone sales assistant.

At step 310, the order collection details and customer details are sent from the online retailer to the secure box server 126. The secure box server 126 identifies the customer on their record system from the information provided by the online retailer 134, and determines the details associated with the customer's secure box 110. If the secure box server 126 cannot identify that the customer has a secure box 110, a message is sent back to the online retailer 134 who interacts with the customer to convey that another collection option is required. The customer is then able to use the secure box server web interface 138 to report a problem with collection with that online retailer 134 to their secure box 110.

At step 315, the secure box sever 126 communicates to the delivery management platform 132, the order collection details from the customer's secure box 110, the customer's details and details of the customer's secure box 110. In this way, the delivery management platform 132 is given the required information to collect the goods from the customer's secure box 110, and to deliver these to where the online retailer 134 requires the package to be delivered. The delivery management platform 132 determines the package carrier 136 to be used for the collection, and provides the package carrier 136 with unique identification information associated with the collection of the customer's goods. At this time the delivery management platform will know an expected time of collection of the customer's goods.

At step 320, the delivery management platform 132 communicates with the secure box server 126, providing details of the package carrier 136 being used for the collection of the customer's goods and the unique identification information being used by the package carrier 136 for collection of the customer's goods. At the same time the delivery

management platform 132 communicates to the online retailer 134 details regarding the expected time of collection. The customer logging on the online retailer's website can then view an expected time of that the goods will be collected, or alternatively the online retailer 134 emails the customer with expected collection time details.

At step 325, the secure box server generates a 4 digit numerical one-time code. This code is the code that will be used by the courier 140 to open the customer's secure box 110. The one-time code is sent via the secure box server transceiver 128 to the secure box 110, during a periodic powered up period for the secure box 110 in response to the secure box 110 communicating to the secure box server 126 that it is powered up and able to receive and transmit, and is received by the secure box transceiver 124. The one-time code is also sent from the secure box server 126 to the package carrier 136 along with the unique identification information being used by the package carrier 136 for collection of the customer's goods in order that the package carrier 136 can correctly associate the one time use code with the customer's secure box 110. At the same time, the secure box server 126 sends, via the secure box server transceiver 128, an SMS message to the customer's mobile phone to indicate when collection is anticipated. This ensures that the customer has the opportunity to place the retail goods into the secure box 110 prior to the courier 140 arriving to collect them. The transceiver system 124 transmits the one-time code that was received, relating to use by the courier 140 for opening the secure box 110, to the microprocessor 114 which will then await use of this same one-time code to open the secure box 110.

At step 330, the secure box transceiver 128, during the periodic powered up period of the secure box 110, sends a confirm receipt message to the secure box server 126, which is received by the secure box server transceiver 128. The secure box server 126 processes the information, and determines that the secure box 110 has received the one time use code.

At step 335, the package carrier 136 instructs courier 140 to collect the goods from the customer's secure box 110 and to deliver these to where the online retailer 134 wishes the goods to be delivered. The courier 140 is given the customer's details, including name and address, and the location of the secure box 110, and the one time use code to be used for opening the secure box 110 in order to collect the goods.

At step 340, the customer enters their PIN to open the secure box 110. The customer presses the first key on the keypad 112. The secure box 110 immediately enters the powered "on" state.

At step 345, the customer opens the lid of the secure box 110. The secure box 110 logs information as described at step 255 above, and the skilled reader will understand that that need not be repeated here. At step 350, the secure box 110 sends an GPRS transmission to the secure box server 126 with details of that the PIN code has been used to open the secure box 110, with the times that the lid of the secure box 110 was opened and closed and a simple indication that a package has been put into the box. The indication is determined as described in step 260 above.

At step 355, the courier types in the one-time code they have been given. The process is as described in step 240 above.

Step 360, is substantially the same as step 245.

Step 365, is substantially the same as step 250.

At step 370, the secure box server 126 sends an SMS message to the customer that the goods have been collected. In other embodiments the secure box server 126 sends an email to the customer that the goods have been collected.

In the same way that suspicious or fraudulent behaviour can be determined during the delivery of goods, the skilled reader will appreciate that the described method also provides for the determination of such behaviour during the collection of goods.

The information the company operating the secure box server 126 obtains, during the process of delivery, and collection, of goods to, and from, customers, can be shared across the network of parties involved in the customer's purchases, including the online retailer 134, the delivery management platform 132, the package carrier 136, and to the courier 140. Each of these parties can use this information to provide improved services, for example providing for improved or more optimum collection times of goods and more optimised and convenient routing between depot collection to delivery at the customer.

The embodiment shown in Figure 1 has been described, with the method of operation described in Figures 2 and 3. Now, alternative embodiments will briefly be described. In an alternative embodiment, the secure box 110 is used for Business-to-business transactions as well as Business-to-Consumer transactions.

In a further alternative embodiment, the secure box 110 is mains powered and is refrigerated to enable food groceries and frozen goods to be delivered to it.

In a further alternative embodiment, when the secure box 110 is in an unlocked state the locking mechanism does draw power

In a further alternative embodiment, the secure box 110 is in communication with the internet. This may be, for example, by way of an internet connection (wired or wireless) between the secure box 110 and the user's house.

In a further alternative embodiment, when the charge on the battery 120 drops below a set level, the secure box 110 is maintained in an unlocked state. This helps to ensure that the secure box 110 can always be opened, for example in the event of battery failure. The skilled person will understand that other fail safe circuitry to enable the secure box to enter an unlocked state could be used.

In a further alternative embodiment, when the locking mechanism is holding the secure box 110 in a locked state, the latch mechanism does not draw any significant power and only draws enough power to maintain the capacitor circuit in a charged configuration thereby enabling the latch mechanism to move the locking mechanism from the locked to the unlocked state if for example connection with the battery 120 was lost.

In a further alternative embodiment, the secure box 110 has a light detector, such as a photodiode or photo-resistor, to determine when the lid of the secure box 110 has been opened and closed. The skilled person will appreciate that other light detectors can be used. In a further alternative embodiment, the PIR sensor is powered up along with the secure box 110.

In a further alternative embodiment, the secure box 110 has a motion sensor, such as an ultrasonic sensor or microwave sensor. This can help determine if items have been placed in or taken out of the secure box 110. The skilled person will appreciate that other motion sensors can be used.

In a further alternative embodiment, the secure box 110 has an accelerometer, such as a Micro-Electro-Mechanical Sensors (MEMS) sensor to determine movement of the secure box 110. This can help determine if items have been placed in or taken out of the secure box 110.

In a further alternative embodiment, the secure box 110 has a tilt switch. This can help to determine if the secure box 110 is being tampered with, for example if someone is attempting to move the secure box 110.

In a further alternative embodiment, the secure box 110 has more than one PIR sensor 116, in order to minimise 'blind' movement areas within the secure box 110.

In a further alternative embodiment, the secure box 110 has more than one CCD camera 118, in order minimise blind spots within the secure box 110.

In a further alternative embodiment, the CCD camera(s) 118 are arranged to take snap shot pictures during the period when the secure box 110 is open, to gain further information relating to what acts were conducted when the secure box 110 was open.

In a further alternative embodiment, a video camera is used instead of a CCD camera(s), and in other embodiments a video camera is used in addition to CCD camera(s).

In a further alternative embodiment, in response to a key of the keypad 112 being pressed, the CCD camera 118 takes a picture. This means that the CCD camera 118 takes a picture of the contents of secure box 110 before the lid of the secure box 110 is open, and therefore before items are placed in or removed from the secure box 110. After the lid of the store box 110 is opened, upon the lid of the secure box being closed the CCD camera 118 is arranged to take another picture of the contents of the store box 110. This allows the contents of the store box 110 before and after it has been open to be correlated to determine, if an item has been deposited or not, and if so what that item was, or at least visual information relating to the item.

In a further alternative embodiment, the pictures are only taken by the CCD camera(s) 118 when the secure box 110 is closed. This means that the picture of the contents of the secure box 110 before being opened corresponds to the picture taken by the CCD camera(s) 118 when the secure box 110 was last closed.

In a further alternative embodiment, the transceiver is arranged to send and receive Global systems for Mobile Communications (GSM) data. The skilled person will appreciate that other wide area network communication technologies could be utilised, where for example the transceiver could operate using Wi-Fi, Whitespace, or Satellite technologies.

In a further alternative embodiment, when the secure box 110 is in the sleep mode the PIR sensor 116, which in this embodiment is always in a powered on state, upon detecting movement within the secure box 110 triggers the secure box 110 to enter the powered on state, and the transceiver system 124 then communicates with the secure box server 126. In other embodiments, other ones of the internal sensors in the secure box 110 are in a powered on state whilst the secure box 110 is in the sleep mode, and upon being triggered are arranged to enable the secure box 110 to enter the powered up state, and communicate with the secure box server 126. These embodiments enable the secure box 110 to communicate with the secure box server 126 if for example a person is attempting to steal the secure box 110 and in doing so triggers the internal sensors of the secure box 110, for example through items moving around within the secure box 110. In a further alternative embodiment, the transceiver system 124 is arranged to be powered up whilst the secure box 110 remains in a sleep mode. In this embodiment the transceiver system 124 is arranged to locally store received GPRS data, and then to provide that data to the microprocessor 114 when the secure box 110 next enters the powered "on" state.

In a further alternative embodiment, in response to a GPRS received signal requesting a status update, where this includes a request for the present location of the secure box 110 to be transmitted, the transceiver system 124 determines its position through

multilateration of signals from different radio masts. The transceiver system 124 then transmits the location of the secure box 110.

In further alternative embodiments, where the transceiver system 124 is powered up separately to the secure box 110, the transceiver system 124 upon request transmits the location of the secure box 110 or the location of the radio masts in its locality from which the secure box server 126 determines the location of the secure box 110, and this receipt of the request and transmission of the location information can occur even when the secure box 110, and hence the microprocessor 114, are in powered off states.

In a further alternative embodiment, the secure box transceiver 124 is arranged, upon receipt of an appropriate GPRS data message, to power up the secure box 110. This means that the secure box 110 has an additional way to enter the powered on state to that when the key pad 112 is pressed.

In a further alternative embodiment, the transceiver 124 includes a GPS unit that is used to determine the current position of the secure box 110. Therefore, if the secure box 110 is stolen and placed in a location without GPRS coverage, such that multilateration position detection is no possible, the position of the secure box 110 can still be determined.

Furthermore, even if there is GPRS coverage the position of the secure box 110 determined from GPS information will be more accurate than that provided by GPRS provided information. In a further alternative embodiment, when a user buys a secure box 110 they install the secure box server web interface 138 on their personal computer.

In a further alternative embodiment, the courier 140 has a transceiver 142, which is arranged to transmit and receive GPRS data to and from the secure box server 126.

In a further alternative embodiment, the courier sends and receives Short Message Service (SMS) messages with the secure box server 126.

In a further alternative embodiment, the secure box 110 has a bottom surface that is arranged to sense the weight of an object placed within the secure box 110, through a scales system linked to the microprocessor 114. This means that the weight of the object placed within the secure box 110 can be checking against the expected weight of the object to be placed within the secure box 110, either as part of the delivery or return process. If the object's weight is not as anticipated then the microprocessor 114 sends an appropriate message via the transceiver system 124 to the secure box server 126, which is picked up by the secure box server transceiver 128. Therefore, in this embodiment there is a greater level of confidence provided that the item placed in, or taken out of, the box as expected. For example, if the courier 140 mistakenly places an incorrect package into the secure box 110, a GPRS message is transmitted from the secure box 110 to the secure box server 126, with the company operating the secure box server 126 then able to contact the courier either directly, or through the delivery management platform 132 or the package carrier 136, or call-centre, to the effect that an incorrect package has been delivered. The courier 140, would then be able to return to the secure box 110.

In a further alternative embodiment, the online retailer 134 does not have an association with the company associated with the secure box server 126, but when instructing a delivery management platform 132 to deliver the goods, the delivery management platform 132 has an association with the company operating the secure box server 126. At the point in the purchase and delivery process, where the delivery management platform 132 becomes involved, the delivery management platform 132 notifies the customer of the potential that delivery to a secure box 110 is available, at which point the customer can indicate that this form of delivery is required. This embodiment may not be used in the long term, because the online retailer has the benefits of the use of delivery to a secure box 110, without having to pay for that service. However, during a trial period a sceptical online retailer could make use of this embodiment, before deciding to sign up for full integrated utilisation.

In a further alternative embodiment, at step 225 the secure box server 126 sends to the secure box 110, other information relating to the goods being purchased. This information includes the weight of the goods, and the size and shape of the packaging. Therefore, the goods being delivery or collected can better be correlated with what is actually delivered or collected.

In a further alternative embodiment, at step 230, the secure box 110 via the secure box transceiver 128, operating autonomously with the secure box 110 itself not in the powered "on" state, sends a confirm receipt message to the secure box server 126, which is received by the secure box server transceiver 128. The secure box server 126 processes the information, and determines that the secure box 110 has received the one time use code.

In a further alternative embodiment, at step 235 when the package carrier 136 instructs the courier 140 to pick up and deliver the retail goods, and passes the appropriate information to the courier, the courier then prints out a label that is stuck onto the package. The label includes an indication such as a bar code or QR code that contains the one time use code. Then, in this alternative embodiment, at step 240 rather than typing the one time use code into the keypad 112 of the secure box 110, the courier scans the bar or QR code with a reader that is connected to his courier transceiver 142, and a GPRS message with the onetime code is sent to the secure box 110 and received by the secure box transceiver 124. The secure box transceiver 124 then powers up the secure box 110. The one time use codes received by the secure box transceiver 124 from the secure box server 126, which were stored on the secure box transceiver 124, are sent to the microprocessor 114. At the same time, the one time use code that has just been received from the courier 140 is sent to the microprocessor. The microprocessor, then determines if the one time use code sent from the courier is the, or a, correct code. And then the other process steps as discussed above are followed. In a further alternative embodiment to this embodiment, the online retailer prints out the label containing information relating to the one time use code to be used to open the customer's secure box 110, and attaches this to the package containing the retail goods. Therefore, the label with this information contained within it is attached to the goods prior to being picked up by the courier. In other embodiments a barcode or QR reader, used by the courier, is connected to the secure box 110.

In a further alternative embodiment, at step 240, the courier 140 arrives at the customer's secure box 110. The courier 140 presses the first key on the keypad 112. The secure box 110 immediately enters the powered "on" state. The transceiver system 124 of the secure box 110 transmits the one-time code to the microprocessor, which then will only open the secure box 110 if this code is entered into the keypad. It could be that since the last time the secure box 110 was opened the customer has purchased a number of different goods, in which case the transceiver system 124 will have received a number of different one-time codes that can be used to open the box, associated each with a different purchase. In such a situation, upon power up of the secure box 110, all of these codes are sent from the transceiver 124 to the microprocessor 114. The microprocessor 114 is then arranged to open the secure box 110 only if one of these one-time codes is now entered into the keypad 112. At the same time the CCD camera 118 takes a picture of the contents of the secure box 110, and the movement sensor 116 becomes active.

In a further alternative embodiment, at step 250, the courier uses the courier transceiver 142 to transmit an automated error SMS message, which is directed to the secure box server 126. The automated SMS contains details associated with the order that is to be delivered to this particular secure box 110.

In a further alternative embodiment, at step 250 the secure box server 126 sends out an SMS message with a new one time use code that will open the secure box 110, to the secure box 110 and to the courier that are received respectively by the secure box transceiver 124 and the courier transceiver 142. The secure box transceiver 124 transmits this to the microprocessor 114, which now awaits input of the new correct code. The process then returns to step 240, until a correct code is entered. If after three attempts the code is not correct, an error code is generated and the courier will have to return the goods, and the customer is informed.

In further alternative embodiment, at step 260 the decision to determine which images to be analysed is carried out by the secure box server 126. In other embodiments, the image analysis program or algorithm, resides on the secure box server 126 and necessary image processing is carried out at the secure box server 126. In other embodiments, not image analysis is performed, where for example a human is used to examine the images.

In further alternative embodiment, at step 260, more complex image analysis is carried out to determine if there has been a change in the contents of the secure box 110. An edge detection algorithm, or alternative other object detection algorithm, is used, to determine the shape or identity of objects within the secure box 110 before and after the lid of the secure box 110 has been opened and closed. This allows for a determination that an object has indeed been left, for example even when the courier had to move objects around within the box in order to fit his package within the secure box 110.

In a further alternative embodiment, at step 340, where the transceiver is always able to receive and store information such as one-time use codes, whilst the secure box 110 remains in a sleep mode, the customer enters their PIN to open the secure box 110. The customer presses the first key on the keypad 112 and the secure box 110 immediately enters the powered "on" state. The transceiver system 124 transmits the one-time code that was received, relating to use by the courier 140 for opening the secure box 110, to the microprocessor 114, which then awaits input of this code to open the secure box 110.

The secure box 110 and the system within which it operates, and the way of using the secure box 110 for both the delivery and collection of goods gives rise to certain

improvements, as set out below. For the customer, there is the convenience of delivery (and collection of goods to be returned) at any time, which is additionally secure and provides for a way for the customer being kept informed of what is happening relating to delivery (and collection). The consumer is provided with an ability to purchase goods from retailers who offer the service of delivering to a secure box 110, ensuring that from click (to buy) to delivery they are ensured security of delivery, in a convenient, informed way. The consumer is also provided with appropriate alerts, to which they can react, if necessary.

For the online retailer, there is virtually guaranteed first time delivery of goods ordered by the customer. This removes delivery as being an impediment to the sale of goods over the internet, and will attract customers to the retailer as offering secure box 110 usage. With goods being delivered first time, the need for time specific services such as re-delivery requirements is reduced, thereby savings costs. There is provided greater flexibility as to when goods can be picked up from their warehouses, with an associated reduction is insurance claims based on proof of delivery. The secure box 110 provides for proof of delivery. Delivery of goods can be at a time that is convenient to the online retailer, and at the same time at a time that is convenient to the customer. The retailer is provided with accurate information on delivery and customer collection, and knowledge that they offer an attractive service that is secure and convenient to the customer allows a small premium to be charged as part of this service.

The costs associated with re-delivery when customers are not at home is virtually eliminated leading to reduced costs and an improved service. Flexibility of delivery time enables the delivery management platform to use a greater variety of carriers, allowing the carrier convenient for the delivery platform to be chosen for the delivery of a particular package. Greater flexibility of routing across the delivery geography, enables optimum routing to be planned based on the position of customers rather than when each is anticipated to be available to receive the goods, enabling carriers to optimise their business and determine the optimum courier to use for the job. Delivery during the late evening or early morning, outside of rush hours or delivery during other quite times within particularly congested areas becomes possible across the delivery enterprise. Insurance claims can also be reduced, as described, for the retailer.

In the above embodiments, the secure box 110 is used for both the delivery of goods purchased from an online retailer to a customer and for the return of goods from the customer to the online retailer. However, in a further alternative embodiment the secure box is used to enable the owner of the secure box 110 to securely and safely deliver goods to another private individual, such as a family member or friend. Using the secure box server web interface, the owner of the secure box 110 provides details of what they wanted to do (put a particular item in the secure box 110 to a picked up from the secure box 110 by a friend). The customer as part of this process provides the mobile telephone number of the friend. The secure box server 126 then generates a one-time code that is sent to the friend to be used to open the secure box 110, and provides relevant information regarding what to do in the event that the code does not work. This means that the friend is given a contact number for the company operating the secure box server 126, thereby enabling the friend in the event of a problem to call the company and obtain an emergency one-time code to open the secure box 110. The process also works in reverse, where the friend leaves an item, such as a laptop, in the secure box 110 to be picked up securely and safely by the owner of the secure box 110. The skilled person will appreciate that the processes followed for both delivery of an item from, and of an item delivery to, the friend share steps that are common to those described above in relation to purchase and deliver from an online retailer and return to the online retailer.

The above invention has been described by way of example only, and modification in the detail is possible within the scope of the invention as would be appreciated by the skilled person.

Claims

1. A method of operating a secure apparatus server for the delivery of goods to or the collection of goods from secure apparatus, the method comprising the steps of the server: receiving over a communications link from a retailer or a delivery organisation information indicative of a user who has ordered goods or wishes to return goods; transmitting over a communications link a local code to the retailer or a/the delivery organisation that can be provided locally to secure apparatus associated with the user to gain access to the apparatus for delivering the goods to the user or collecting the goods; and transmitting over a communications link a remote code to the secure apparatus associated with the user, the remote code corresponding to the local code in a predetermined way such that the secure apparatus can compare the local code with the remote code and allow access to the apparatus for delivery or collection of the goods if the codes correspond in the predetermined way.

2. A method according to claim 1, wherein the step of receiving the information indicative of the user is followed by the step of checking against a record of users, each of whom is known to have a respective secure apparatus associated with the user; the step of transmitting the local code may only taking place in the event that the user who has ordered the goods or wishes to return the goods is found to have a secure apparatus associated with that user.

3. A method according to any preceding claim, wherein the method comprises a registration step of receiving from a new user registration information indicative of the user and of the user having a secure apparatus associated with that user.

4. A method according to claim 3, wherein the registration information is received remotely over a communication link from the new user, optionally via a web interface, which may be hosted by the secure apparatus server, running in a browser on a computer local to the new user.

5. A method according to any preceding claim, wherein the secure apparatus server communicates over a communications link with the user to inform the user of the time and date of delivery or collection.

6. A method of operating secure apparatus for receiving a delivery of goods or providing for the return of goods, the method comprising the steps of the secure apparatus: receiving over a communications link a remote code from a remote location; receiving locally at the apparatus a local code; and comparing the local code with the remote code and providing access to the secure apparatus for the delivery or collection of goods in the event that the codes correspond in a predetermined way.

7. A method according to claim 6, wherein the secure apparatus maintains a

communications link with the secure apparatus server only intermittently.

8. A method according to claim 7, wherein the link is established periodically.

9. A method according to claim 7 or 8, wherein the method also comprises the secure apparatus comparing the local code against an emergency code stored at the secure apparatus and, in the event that the local code and the emergency code correspond in the predetermined way, providing access to the secure apparatus.

10. A method according to claim 9, wherein the secure apparatus only compares the local code against the emergency code upon receiving from the secure apparatus server a signal to this effect.

11. A method according to any of claim 6 to claim 10, wherein the secure apparatus comprises a container for receiving the goods to be delivered or returned and has a lockable cover for releasably enclosing the goods within the container; wherein, upon sensing that the cover has been opened, the secure apparatus records locally information indicative of the opening and/or each opening.

12. A method according to claim 11, wherein the information indicative of the opening or closing comprises one or more image of the inside of the container, the apparatus operating a camera of the apparatus to record the or each image of the inside of the container, optionally together with the time the picture was taken.

13. A method according to claim 12, wherein a plurality of images may be recorded at different times during the opening of the container.

14. A method according to any of claim 6 to claim 13, wherein the method also comprises a movement sensor of the apparatus detecting whether or not there is any movement inside the container when the cover is open.

15. A method according to claim 14, wherein, in the event that movement is detected, the apparatus makes a record of this and associates it with the opening of the apparatus.

16. A method according to any of claim 6 to claim 15, wherein the method comprises the apparatus recording locally information indicative of the and/or each opening, that information comprising one, more, all or any combination of: the time of opening, the time of closing, an image before opening, an image after opening, a record of any movement sensed inside the container between opening and closing.

17. A method according to any of claim 6 to claim 16, wherein the secure apparatus may respond to a user code provided locally at the apparatus by comparing the user code against a local record at the apparatus to see whether or not the user code is recognised; in the event that the code is recognised, the secure apparatus providing the user with access to the apparatus.

18. A method according to any of claim 11 to claim 17, wherein the method comprises the secure apparatus transmitting some or all of the information indicative of the opening to the secure apparatus server over the communications link, optionally in response to an appropriate request from the server.

19. A method according to any of claim 6 to claim 18, wherein the method comprises the apparatus processing one or more recorded images to determine whether or not they indicate that a delivery, a collection or neither was made during the opening.

20. A method according to claim 19, wherein the processing comprises comparing an image before or at the opening with an image at or after the closing of the cover.

21. A method according to any of claim 6 to claim 20, wherein the method comprises the apparatus transmitting information indicative of a delivery or a collection having been made in the event that the apparatus determines that that is the case.

22. A method according to any of claim 17 to 21, wherein the method comprises the apparatus transmitting information indicative of a delivery or collection not having been made, but the apparatus nevertheless having been opened using the local code or user code, in the event that that is the case.

23. Secure apparatus for receiving a delivery of goods, the apparatus comprising a container for receiving goods to be delivered and having a lockable cover for releasably enclosing the goods within the container, the apparatus further comprising remote code-receiving means for receiving a code from a remote location, and local code-receiving means for receiving a code provided locally at the apparatus, the apparatus arranged to receive a remote code via the remote code-receiving means, to receive a local code via the local code-receiving means, to compare the local code with the remote code and to unlock the cover if the codes correspond in a predetermined way.

24. Secure apparatus according to claim 23 and arranged to carry out the steps carried out by the secure apparatus of any of claim 1 to claim 22.

25. A secure apparatus server programmed and operable to carry out a method according to any of claim 1 to claim 5.