WO2016016781A1 - Electronic payment system for fuel - Google Patents

Abstract

The "electronic payment" of fuel is a specific type of "electronic payment". Operators of petrol stations have the interest to encourage supplies in "self-service" mode, and since the customer is already engaged in the refueling operations, it is particularly important to provide a payment process that is as simple as possible. The system disclosed in the present invention provides that a user is identified in a safe manner, then he enables a fully automated "electronic payment" with the aid of a very low cost personal device. With said personal device, the user can emit an appropriate short-range radio signal with a very simple action, as simple as pressing a button dedicated to this task, Said emitting device equipped with such activation button is, as well as economic, very simple and small. It can be easily integrated to any object present in a vehicle such as the car keychain or the car key itself, or the device used for electronic toll systems, or it can be integrated into a gadget to be kept into the car. In order to ensure that all management and payment operations which are necessary for a refueling can be conducted in a safe and correct manner, starting from a simple command as the press of a button by the user, it is necessary to provide for a rather complex system which includes other elements which need to be managed with appropriate procedures, as indicated by the teachings of this invention.

Description

TITLE:

ELECTRONIC PAYMENT SYSTEM FOR FUEL

DESCRIPTION

The field of application of the present invention relates to the "electronic payment" of the refueling at a service station.

The prior art provides a number of tools, methods and systems capable of supporting in various forms the so-called "electronic payments"

Indeed, in principle, all money transactions can be traced updating some records that summarize the availability of money of two or more subjects.

Given a payment, the payer will see updated a register, associated to him, which expresses his own spending capacity, and this spending capacity will be reduced by the amount corresponding to the amount to be paid. Simultaneously, the paid subject will see updated a register, associated to him, which expresses his own spending capacity, and this spending capacity will be increased by the amount corresponding to the received payment.

In an electronic transaction, the physical transfer of money is not necessary, as the bank accounts of those involved in the transaction will be updated accordingly, following appropriate procedures of various types, based on the information associated with the transaction. The transactions that take place in such ways are normally referred with the terms "electronic transactions" or "electronic payments".

It is clear that the management and the maintenance of the information stored and exchanged among the various mentioned above registers must be ensured by intermediary subjects who are able to guarantee maximum reliability both to payer and paid subjects.

The so-called electronic payments are a matter of great importance for the development of economy and trade; with respect to the synthesis of the essential steps of an

"electronic payment" as exposed above, in real cases, it is typically provided a much greater complexity. This greater complexity is generally introduced in order to ensure appropriate security mechanisms also in the presence of "electronic transactions" involving more than one intermediary subject.

What matters for the purposes of the present description is the fact that money transactions performed via "electronic transactions", i.e. without the handling of cash, are widespread, safe and implemented with a plurality of methodologies with different characteristics from each other.

Both cash transactions and "electronic transactions", based on updating of information, require appropriate security measures.

The cash can be protected in a physical way, such as by using a safe for safekeeping, or using services of "valuable transfer" performed by properly trained and equipped personnel.

The information associated to the electronic transactions, however, must be protected with other mechanisms, of an informatics type, in order to prevent the possibility of theft through the manipulation and falsification of information associated with said "electronic transactions".

As mentioned, the so-called "electronic transactions" are quickly spreading and the percentage of payments which are finalized through "electronic transactions" is increasing year by year. The perception that consumers have about the security of these payment methods is good and, in fact, the information of the transaction are typically exchanged protected by appropriate security mechanisms. For example, an electronic transaction, to be finalized, may require the insertion by the payer of a secret code that only the payer knows. Or, the transaction may require, for the execution of the programs which update the registers, the use of a specific hardware, a so-called hardware key, so as to limit the opportunity of finalizing an electronic transaction only to those individuals who are in possession of said hardware key.

Furthermore, that information is exchanged on networks that support robust encryption mechanisms, so that it is particularly difficult to come into possession of secret codes and information generally involving electronic transactions.

It is clear that the security mechanisms that can be devised are of various kinds and may be based on procedures conceived with great flexibility.

In any case, the procedures associated to "electronic payments" require the support of a telecommunications network for the exchange of information associated with the payment and, in general, they require that the payer performs some operations that can be interpreted as a reliable authorization to the execution of a payment.

By contrast, if for safety reasons, a too complex procedure is required to people who must exchange their money, or the need of special devices, uncomfortable to keep, or which may be lost, then the benefits associated with electronic transactions are reduced to the point that they can no more appear as a comfortable and attractive method of payment.

It can be concluded that an electronic payment method is all the more attractive as it is secure against fraud attempts and the more it involves simultaneously a simple procedure by the payer.

Typical examples of "electronic payments" are those that are made by credit card or debit card, or order forms of payment made through the access to suitable sites reachable via the Internet. We often refer to this last type of transaction with the terms "online banking "or" Internet banking ". Recently, there are rapidly spreading the so- called "mobile payments", meaning by this expression a family that includes several types of payment: in general they are known forms of payment (e.g. credit card transaction or an "on-line banking" operation), but they have the peculiarity that the transaction is arranged through an application executed by a mobile terminal.

In the user perspective, the so-called "mobile payments" are particularly interesting for various reasons. In fact the mobile terminal is already a device connected in a telecommunications network, and therefore the payment can take place at any place, and it is not necessary to perform it in front to a specific device, such as occurs in the case of payment by credit card. Moreover, mobile terminals are devices perceived by the user as personal items. We can assume that each user always takes his own mobile terminal with him. And this fact also causes a perception of security, since the user may at any time check to be in possession of his terminal (which can also be defined as the only hardware device enabled to make payments, thus acting as a hardware key) and he can be reasonably comfortable knowing that there are no others who can make payments on its accounts without his knowledge.

This confidence is technically justified by the intrinsic safety of mobile networks that provide a sufficiently reliable authentication of mobile radio terminals connected to the network. Each terminal, in fact, to work in any mobile radio network must be equipped with a personal identification module called SIM (Subscriber Identification Module) that efficiently supports the authentication of a user who operates in any mobile radio network.

Finally, the operations carried out on a mobile network can always be reconstructed with relative ease by the network operator, and therefore any fraud perpetrated using cloned SIM could be retrospectively reconstructed, and this possibility should further discourage any attempt at fraud.

The forecasts on the evolution of the volume of electronic payments show that they are affirming very strongly, so that we can assume a not too distant future in which the cash might even disappear completely being replaced by these forms of payment that no more require physical exchange of money.

Even today, we can say that almost all payments of large sums occur with electronic transactions, while it remains a widespread practice of cash payments only in the case of small payments. However, the advent of the "mobile payments", that allows the provision of a payment at any place, and not just at stores that have a specific terminal for making the payment itself, could lead to a further significant increase in electronic money transactions, including also the transactions of small amounts that today typically take place through the exchange of cash.

Also in the case of payments which take place at the stations of refueling, electronic payments are gradually gaining momentum though, compared to other comparable amounts of payments, still remains a some significant portion of payments made with cash, both for payments of completely self-service supplies, and for payments made to the staff of the station of refueling.

Especially in the case of supply in "self-service" (preferred by operators of filling stations for obvious reasons related to the savings on staff costs), the operations required to the user is already quite complex, since the user must personally refuel his vehicle. Moreover, if the payment would require a procedure articulated, the refueling of a vehicle could be perceived by the customers as something complicated and not very pleasing. Consequently, an element of competition between the operators of the stations of refueling could be identified in offering a filling procedure fast, secure and not complex at all.

An ideal refueling procedure, in "self-service", should be designed as an operation in which the user approaches a dispenser communicates with a gesture as simple as possible the intention to refuel, supplies his vehicle, dates back in the vehicle and leave the station. Actually, there are no service stations in which it is possible to obtain a refuel in such a way. However, it is obvious that the more one manages to approximate a process of this type, and the more one approaches an ideal refueling service.

Processes of this type, even if not widespread at the level of the commercial distribution of the fuel, are however possible by resorting to known techniques: for example, by resorting to the teachings exposed in the Italian patent application VE2013A000042. According to the teachings of VE2013A000042, a vehicle equipped with a DSRC (Dedicated Short Range Communication) to support electronic toll services could refuel as described in the ideal case, being able to automate the payment as it does for payment of motorway tolls.

This process, however, requires that the service stations are equipped with appropriate radio communication devices (as described in VE2013A000042), and consequently the investment cost could represent an element sufficient to put a limit to the spread of methods based on this solution.

Other processes have been proposed in the prior art, which are already turned in commercial proposals, and they stipulate that the payment is performed through a "mobile payments". In this case, all necessary communications would be supported (as normally happens in the case of so-called "mobile payments") from a mobile network. This procedure based on a specific use of the "mobile payments" can, in theory, be articulated so practical enough for the user. However, it assumes that the mobile radio terminal is active, and performs some essential functions, in the vicinity of the fuel dispenser. But, the areas surrounding a fuel dispenser are areas subject to particular restrictions of safety: it is forbidden to use a radio mobile terminal in such areas outside a vehicle. As a result it can be seen an obstacle to marketing a service that foresees an unauthorized use of a mobile radio terminal.

There are commercial applications that implement a "mobile payment" specifically designed for the payment of a refueling: in these cases, the problem of environmental safety is handled quite trivially. Users, who subscribe to the service, are prescribed using their mobile terminal only inside their vehicle. This precaution, however, appears very weak, as it is not generally sufficient to entrust an important safety measure only to the diligence of a user who, moreover, is called to use his own terminal in order to benefit of the service. The main scope of the present invention therefore consists in indicating a system that can support an electronic payment of fuel and that can be done automatically by requiring minimal interaction by the user for payment transactions.

A further scope of the present invention is to indicate a system that can be compatible with the safety standards relating to the use of electronic devices in the vicinity of fuel dispensers.

Again, further scope of the present invention is to indicate a system which limits the necessity of predisposition, in refueling stations, of a specific and expensive

infrastructure, even in terms maintenance, in order to support the processes of electronic payment.

Finally, another scope of the present invention is that of indicating an electronic payment method of the fuel at a refueling station that is sufficiently secure against attempts of fraud and robust with respect to possible errors, which may occur in payment transactions.

These and other aims can be achieved by means of an electronic payment system of fuel at a service station in which is provided a telecommunications network that allows local communication between apparatuses distributed in said service station, among which there is at least a fuel dispenser, and at least one central computer which runs a management program of the station, and said payment system of fuel also includes:

at least one emitting device of a short-range radio signal permanently associated to a single user, even when he is not in the service station, and said emitting device of a short-range radio signal is characterized in that it emits a signal of predefined format carrying a preset message containing at least information that allow unambiguous identification of said emitting device of said short-range radio signal, and the emission of said short-range signal is controlled by a manual or vocal action performed by the user to whom said emitting device is associated and, by this action, said user communicates his intention to make a refueling;

^•S at least one terminal available to said user who intends to make a refueling at said service station, and in said terminal it is installed at least one application for supporting a process of refueling with electronic payment, and said at least one application is started by the reception of at least one short-range radio signal of predefined format and containing a preset message, which allows unambiguous identification of said emitting device of said short-range radio signal

computing means associated with said service station, and on said computing means it is installed at least one application which is started by a command generated by said application for supporting a process of refueling that is installed on said terminal available to said user, and said application which runs on said computing means uses as an input at least the information identifying said user who has communicated his intention to make a refueling;

^•S at least one communication channel that allows the information exchange

between said terminal available to said user who has communicated his intention to make a refueling, and said computing means associated with the service station

The main advantage of the system articulated according to the present invention is in the fact that it allows to fulfill all the purposes for which it was conceived.

This invention also presents other advantages that will be better and further described in the following description, in the appended claims which make up an integral part of the same description and by the illustration of some practical embodiments described as a way of non-limiting examples in the following and in the accompanying drawings on which:

Figure 1 shows a block diagram that summarizes a system for electronic payment of fuel according to the present invention;

- Figure 2 shows a simplified schematization of a communication protocol functional to the implementation of the present invention.

The number 102 in Figure 1 represents an emitting device of a predefined short- range radio signal. Said emitting device 102 is designed to be as simple and economical as possible, and it has the sole function of generating a signal able to activate an application which is installed into another apparatus.

The known art discloses some technologies designed for this purpose. For example, the family of standards known as "Bluetooth" includes the definition of a signal known under the name "eBeacon"; said "eBeacon" signal presents the characteristics necessary to support the inventive principles of the present invention. Said default short-range radio signal is then transmitted to a device on a specific dedicated radio channel that in Figure 1 is indicated with the number 210.

The number 200 in Figure 1 then represents a device arranged to receive on said radio channel 210. Therefore, when said signal, activated by a user through the emitting device 102 that is a personal device, (e.g. a signal "eBeacon") is transmitted on said radio channel 210, said signal is received and interpreted by said device 200 by means of an application, denoted in Figure 1 by the reference number 240.

The presence of a standardization to support a radio technology suited for the practical realization of the present invention, is a factor in favor of the spread of the present invention. In fact the device 200, which must be suitable to receive the radio channel 210, in the case of wide dissemination of the standard, could be a device already spread among the general users of mobile telecommunications services. In particular, the "Bluetooth" technology and, more precisely, the standard that defines the characteristics of said "eBeacon" signal, is predictably a technology that will be present in almost all of the future mobile terminals. Accordingly, the device 200, which must be a device for use by the customer during refueling operations, could coincide with the personal radio mobile terminal of the customer; and, in such case, the application 240 would be one of the various applications installed in the personal radio mobile terminal of the customer.

In any case, both the event in which the device 200 is a personal terminal of the customer, and the event in which said device 200 is a device belonging to the infrastructure of the service station, which is temporarily used by the customer just to support a payment process of the fuel supplied, are two possible embodiment variants of the same inventive principle.

The system taught in the present invention, indeed, is based on the fact that an application for supporting a refueling executes a process personally associated to a particular user uniquely identifiable (who, among other things, must be charged the cost for fuel stocked). It matters little, for the purpose of implementation of the inventive concepts, if such device 200 is permanently for the exclusive use of the customer or if it is temporarily associated to the user just limited to the time required to support his refueling operations. Said identification of the user who is performing the refueling is made possible since the application 240 is activated by a signal, generated by said emitting device 102 that is strictly personal, transmitted on channel 210, and containing an identification code unique for each user.

The involvement of a personal hardware device such as the emitting device 102 is an important factor for identifying the user. However, it is important to observe how, in addition to an identification based on said emitting device 102, other authentication methods can be implemented too. These are made possible in the context of the system provided in the present invention; but such alternatives, which allow to make the identification more sure, will be exhibited in a following part of the present description.

This is because, at this point, it is preferable, for reasons of clarity, to go on with the description of the other elements essential for the operation of the system taught in the present invention. The number 300 of Figure 1 indicates processing means that, in the preferred implementations of the system taught in the present invention, are located in the same service station. And the function of said processing means 300 is to perform some operations essential to the process of refueling of a vehicle and to the related payment of replenished fuel. Among said operations are included the following ones:

- the reception from said device 200 of a notification stating that that a particular user

(identified by a personal code) intends to refuel his vehicle and that he intends to use an automatic payment procedure,

checking that said user is authorized to rely on that service,

- the interaction with the management system of the service station in order to properly enable a dispenser for refueling,

- the management of an electronic transaction (i.e. an electronic payment),

reporting to the user about the transactions that occurred (and in particular the payments).

All the above listed operations can be carried out with different levels of complexity and with some variations that will be better detailed in the following.

The number 400 in Figure 1 indicates the management system of the service station. In fact, typically, the service stations for refueling are managed by means of a management system that allows to control all the devices of the station: said management systems of the station 400 thus constitute legacy systems with which it is essential to interface in order to interact with every other device of the station.

However, we cannot exclude that, in the future, the operations performed by the processing means 300 can be incorporated into evolutionary versions of the

management systems of the station 400. In this case, without departing from the present description of the system according to the invention, the overall system of Figure 1 would be simplified for the unification of the blocks 300 and 400.

Still in Figure 1, with the number 500, it is synthetically represented, with a closed dashed line, the set of systems which are in the of the service station.

The number 350, in Figure 1, indicates a database. Said database 350 is shown in the figure because it contains information about users that are essential to run the operations performed by the processing means 300. Said database 350 may physically reside in the same hardware of the processing means 300, may be in a separate machine, but co-located with the processing means 300, or may be a remote database to which the processing means 300 can access.

Even the management system of the service station 400 may include a user database, indicated in Figure 1 by the reference number 450. As already mentioned, the management system of the station 400 should be considered a legacy element that typically is already present in each station. Therefore, it may be necessary to provide for an interaction between the processing means 300, which control the refueling of a user, and the management system 400 so as to allow the update also any other information eventually stored on other user databases such as, for example, the information about loyalty programs.

Still in Figure 1 , other communication channels necessary to the interaction of the various components described are shown: they are indicated with the numbers 310, 410 and 420.

In particular, the number 310 indicates a communication channel that allows the exchange of information between said device 200 and said processing means 300.

While the number 410 indicates the communication channel between said processing means 300 and said management system of the station 400. Finally, the number 420, indicates a set of channels of communication between said management system of the station 400 and the set of devices 500 of the service station.

It is clear that all of these channels can be implemented by a single network of the service station; however it is also possible that such channels are supported by distinct networks. For example, if the device 200 was the radio mobile terminal of the customer, the channel 310 could be implemented as a connection established on a public or private wireless network (e.g. a Wi-Fi LAN of the station, and the access by said user terminal could be allowed in a controlled mode under the management of the application 240). Moreover, the channel 410 could be a physical cable connecting the processing means

300 to the machine that hosts the management system of the station 400 (it is plausible to imagine that the processing means 300 and the management system of the station 400 are placed in the same room). It is therefore clear that all the possible variants which support the exchange of information between elements of the described system, are equivalent variants of the same system, conceived according to the teachings of the present invention.

Figure 2 gives a representation of an essential part of a communication protocol between the various elements of the system according to the present invention; and said representation of Figure 2 allows to expose in greater detail the process of operation of the whole system and some of its variants.

In Figure 2 the numbers in brackets relate to the elements of the system that send and/or receive messages (the same elements of the system which have already been outlined in the illustration of Figure 1). In particular, the number 102 indicates the emitting device of the short-range radio signal, which can be received only by equipment placed in its vicinity. The number 200 indicates the device for use by a single user, on which is installed an application 240 activated by the reception of a predefined short-range radio signal. The number 300 indicates the processing means that oversee the fueling process and the fuels payment. The number 400 indicates the management system of the service station and the number 500 generally designates the set of the devices present in said service station. Are then presented close the line associated to the processing means 300 two functional blocks indicated with the numbers 341 and 342. These functional blocks represent respectively the functional block for identification, authorization and fueling control (block 341) and the functional block for payment (block 342).

These two functions are activated and determined by a number of circumstances which will be better explained by illustrating the main messages of the protocol of the overall communication among the various elements of the system disclosed by this invention.

The number 211 indicates the activation message transmitted by the emitting device 102 on the short-range radio channel 210. Said activation message 21 1 is predetermined and it is preconfigured in said emitting device 102, so that the user can generate it with a very simple action.

A further important feature of said activation message 21 1 consists in that it contains a unique identifier that allows to identify the emitting device 102 and, consequently, the user to which said emitting device 102 is assigned.

Moreover, being said activation message 21 1 transmitted on a short-range radio channel, the emitting device can be designed so as to be very cheap, small and relatively simple. Ultimately, said emitting device 102 can be integrated in the most varied objects. For example, it can be integrated in the keychain for the key of a vehicle, or in the key itself; or it can be integrated into an OBU (On Board Unit) apparatus supplied to the vehicles to support electronic toll services; or it can be packaged so as to be attractively associated with a vehicle, for example by making a pendant hanging from the rearview mirror.

In short, this emitting device can be designed with wide flexibility in order to be able to place it in such a way that a user who enters a service station driving a car can easily press a button and activate the transmission of the message 211. This can happen by a simple gesture and reaching said emitting device 102 which is to be found at hand. As can be seen from the general representation of Figure 2, the generation of the message 211 may be the only operation which requires the interaction by the user. It is therefore a method of refueling extremely attractive since the user need only press a button present in an object that is at hand (a key chain, a pendant, the OBUs for the tele- toll etc ...) to activate a process of self-service refueling in which the payment takes place automatically. The reception of the message 21 1 by the device 200, allows it to work within the service station as a personal device associated to the user who has identified himself by transmitting the message 211. And it has to be remembered that an appropriate application 240 is installed on the device 200.

As previously mentioned, the device 200 can either be a device owned by the user itself, and therefore the service station does not have to be provided with said device, or a device supplied to the user at the service station.

As preferred implementation it is considered the one in which the device 200 is a device included in the equipment of the service station.

Instead, in the case in which the device 200 is a radio mobile terminal of an individual, some specific variants are possible: they will be exposed separately, explicitly highlighting the fact that they are only applicable to such a case.

In the reference case, in which the device 200 is included in the equipment of the service station, the preferred implementation provides that said device 200 may be associated with each fuel dispenser; then the user must activate the message 21 1 when he is in the vicinity of a dispenser. This behavior is quite natural, as a person who arrives at a service station has to approach a dispenser to refuel.

When the vehicle has approached a dispenser, the user presses the appropriate button (as explained above), transmits the message 211, and with this gesture indicates that he intends to make a refueling. The device 200, due to the reception of the message 21 1 starts the execution of an application that generates a message, which in Figure 2 is indicated with the number 311, addressed to the processing means 300 which, as a consequence, begin to assume the control of the refueling operation.

The message 311 contains at least the unique identifier of the user who generated the original message 211.

Once the message 31 1 is received, the processing means 300 can execute a set of functions which in practice consists in the execution of a computer program,

represented in Figure 2 by the reference number 341.

The reception of the message 31 1 implies that the processing means 300 have at least the information that a particular user (identified through the identification code assigned to his emitting device 102) is located within a service station and that he intends to make a refueling. The first operation that the processing means 300 must complete, it is to authenticate the user. It is therefore necessary to check that the user is enabled to refuel in that station. This operation is easily performed by controlling the presence of that user in a list of registered customers, or by checking that the user is added to a list of banned users (blacklist) from that service.

Once this first inspection is carried out, it should be useful to check some other feedback on the authenticity of identification, since the emitting device may have been stolen to its rightful owner.

A certainly effective check consists in authenticating the license plate of the vehicle that entered the service station. In fact, the processing means 300, by consulting the appropriate database of users authorized to the automatic payment of the refueling, have access to information, about the license plates, which must have been entered at the time of the service subscription.

In Italian patent applications VE2014A000027 and VE2014U00001 1 there are disclosed methods and systems that allow for automatic recognition of the license plate of a vehicle, providing reasonable assurance that the plaque recognized was not grossly counterfeit.

In any case, a particularly recommended embodiment of the system according to the present invention provides that the service station for refueling also includes a system of video coverage that allows the recognition of license plates of vehicles entering into the service station itself. And it possibly allow an identification of the location of the vehicle having the recognized license plate.

The authentication operation performed by functional block 341 may thus include an analysis of a video recording, the automatic recognition of vehicle license plates in the station, and the detection of the presence of a license plate associated with the user identified.

At this point, it is useful to note that the inclusion of a system of video coverage within the service stations is normally already provided for general surveillance purposes, and therefore it is not necessarily a completely additional infrastructure investment for the sole purpose of supporting automatic payment of fuel.

Once said check is positively occurred, the processing means 300 forward an additional message, indicated with the number 41 1, to the management system of the station; said message 411 has the primary purpose to request the unlocking of the dispenser which the vehicle, having the recognized license plate, is closed to.

It is clear that a further important function of the video coverage consists in the confirmation of the dispenser which the vehicle to be refueled is actually closed to, and therefore the integration of the video coverage system appears as a very recommended element for the preferred embodiment of the system according to the invention.

In Figure 2, the numbers 312 and 313 represent two other messages that can be exchanged between said processing means 300 and said device 200 for use by the user. Those messages are not strictly necessary in general, but they may be provided in the case in which the service station does not have a video coverage adequate to perform the automatic recognition of license plates, or in the case in which the device for use by user 200 is a personal radio mobile terminal.

A further way to authenticate a user consists in asking him to entering a secret code (a password or PIN - Personal Identification Number). Said processing means 300, therefore, and especially in the case where there are no other authentication methods implemented, can transmit to the device 200 for use by the user a request of a confirmation code. In addition, in the cases where it is not unequivocally clear which dispenser to unlock for refueling, the processing means 300 can transmit to said device 200 a request relating to the number of the dispenser on which the user wishes to refuel. These cases are typical, for example, if the message 21 1 is received by two devices 200 positioned on two neighboring dispensers, or in the case where the device 200 is a personal terminal and therefore it is not associable to a dispenser.

Then, the message 312 may be a message containing the request to an authentication code or the request to specify the dispenser to unlock, or a message containing both requests.

The response message 313, obviously, will be a message containing the answers to the requests contained in the message 312.

However, the use of these two messages, and in particular of the message 313, is not recommended. In fact an objective of the present invention is to minimize the operations required to the user, and it is highly recommendable not to require the users to make use of their own mobile terminals in a service area for the supply of fuel. It has to be remembered that in such places it is generally not allowed the use of mobile radio terminals (or battery equipped devices) outside the vehicle. However, it is possible to conceive a variant that does not require user interaction in the exchange of messages 312 and 313. In fact, the activation message 21 1 may be received simultaneously both by a device 200 which is part the station equipment and by a personal mobile radio terminal of the user. In this last case, an application, automatically launched on said radio mobile terminal of the user, may automatically generate a response message 313 containing an authentication code pre- configured on said application. Said mechanism would aim to increase the safety of the process as, although not requiring directed operations performed by the user, the refueling would be allowed only in the case in which the user is in possession of both the personal emitting device 102 and his personal terminal with a proper application installed. To be noted that said application may eventually provide other advanced configurations able to further increase the security(e.g. inhibit the refueling at certain times, or inhibit the refueling via commands that can be sent from remote, etc.).

In any case, after all the various possible authentication procedures, and after locating the dispenser in which the supply can take place, it is possible to instruct the management system of the station 400 to unlock a dispenser, and count the amount corresponding to the fuel supplied. These operations are typical and they are already carried out by the management systems of the station 400.

In Figure 2, the exchange of information between management system 400 and the devices 500 present in the service station is summarized in the two messages indicated with the numbers 421 and 422.

The message 421, transmitted from the management system 400, contains at least the unlocking control of a dispenser, while the message 422, which is received by the management system 400, contains at least the information on the amount to charge for refueling.

As mentioned above, the elements 400 and 500 are elements already present in the service stations and therefore they represent a legacy constraint which should be modified the less is possible. This is why the message indicated by the number 412, for said processing means 300, just contains the read of the amount to be charged to the user; in this way a minimal interaction between the processing means 300 and the management system of station 400 is possible. At this point, the processing means 300 will supervise an "electronic transaction" to finalize the payment for the fuel replenished. It is clear that the processing means 300 know all the data which are necessary to finalize said payment. In fact they know the identity of the user (with the appropriate degree of authentication), the amount to be charged and, of course, they know the beneficiary: since this last is the same entity that manages the payments in the service station where the whole system is implemented.

In Figure 2, the software program that implements the payment platform is represented with the functional block indicated with the number 342.

The numbers 413 and 415 indicate two other messages which are not strictly necessary (but very common and normally required for this kind of electronic payments). The message 413 is the request of a guarantee or of a "provisional security deposit" which limits the maximum fuel provision, and the message 415 gives feedback to the management system 400 that the "provisional security deposit" is bound to payment. This mechanism is typically implemented because it is a reliable caution for the manager about the capacity of payment of the user who is preparing to refuel his vehicle.

Finally the number 314 denotes a feedback message on the outcome of payment. Said message 314, in the protocol outlined in Figure 2, is intended for the device 200, however it can be forwarded also to other apparatuses in order to make effective the notification. For example, it can be transmitted to a radio mobile terminal of the user even if this is not used as the device for use by the user 200, or it can be transmitted to the management system of the station 400 in order to propose a visualization of said feedback on the panel of the dispenser or on other monitors eventually available, etc.

As already mentioned, the system taught in this invention lends itself to be implemented with numerous and substantive variations regarding the different various details.

The two most important substantial variations are: the use (or not) of the personal radio mobile terminal of the user as device 200 (essential for the way of functioning of whole the system), and the presence (or not) of a system of video coverage able to make the plate recognition of the vehicles, and to determine their position with respect to the dispensers of the service station.

It is clear that the presence of the system of video coverage, though not essential, is very useful since it allows to implement a method effective for authentication for resolving any ambiguity on the dispenser to enable for the refueling.

In the case of the presence of the system of video coverage, it is convenient to adopt the variant in which the device for use by the user 200 is part of the station equipment. In fact, it is a device that just listen on a radio channel 210 and must then run a very simple program; therefore it is certainly a simple and inexpensive device that does not compromise the economic sustainability of the overall system. This will "lighten" up to the user, he only needs, for accession to service, to adopt an emitting device 102 (which, as said, is also a simple and cheap object) to be kept on board the vehicle.

The solution in which the device for use by user 200 is the personal radio mobile terminal of the user, seems advisable especially in the absence of a system of video coverage. In this case the aid of the personal terminal of the user may be useful for implementing the procedures of authentication and to manage, via a human interaction, the selection of the dispenser to be used for replenishment.

The main contraindication to the use of the personal mobile radio terminal of the user is the fact that it foresees that the user interacts with a device whose utilization is subject to severe restrictions at petrol stations: in particular, it is not permitted its use in outside of the vehicle.

Because of these drawbacks, it is appropriate to provide some arrangement that can be very useful to handle this type of situation.

It is therefore considered the case in which the device 200 coincides with the personal radio mobile terminal of the user, and on said radio mobile terminal 200 a suitable application 240 is installed to support the process of refueling with automatic payment. In this hypothesis, of course, the device 200 must be equipped with a radio interface in reception, and it is able to receive messages on a short-range radio channel 210 having a predefined format.

A first arrangement provides that at the entrance gates of the station some further emitting devices are installed, and they are capable of transmitting a short-range radio signal on said radio channel 210. Said further emitting devices are of the same type of the emitting device 102, but they transmit a different signal and they are not activated by user's will. Therefore, said further emitting devices transmit a first message, different from the message 211 previously described, that can be used to activate a different application. The purpose of which is to configure the settings of the terminal 200 in order to operate only inside the vehicle; in particular the application 240 should be capable of being activated and executed only if the terminal 200 is in specific conditions which ensure that it is located inside the vehicle.

The enforcement of this setting can encourage the use of the terminal only in conditions which comply with the requirements on safety. In particular, some possible settings may be the following:

a. the terminal 200 is configured not to receive calls from the public network, b. the terminal 200 is configured to operate only if it is physically connected to the vehicle by a cable (e.g. only if it is powered by the vehicle),

c. the terminal 200 is configured to work only in "hands-free" and using just voice commands.

The setting indicated in point "c." seems particularly interesting in that it constitutes a particularly attractive profile in user perspective. In fact, while a driver is driving, he should use his terminal in "hands-free". In such a case, the driver entering a petrol station to refuel would be encouraged not to touch his mobile terminal inside to the station, due to the forced configuration of the point "c", otherwise he could not operate (at least as regards the operations associated with the refueling).

Subsequent actions performed by the user would be the same mentioned even earlier: the user should therefore activate the transmission of the message 211 by means of the emitting device 102, and he may manage the operations associated with the messages 312 and 313 by interacting vocally with the terminal.

Indeed the techniques of speech recognition are now extremely efficient, especially if applied to restricted vocabularies such as a set of numbers. It is therefore easily accomplished a communication interface in which the user, inside his vehicle, may, according to an eventual audio request, vocally communicate a secret code for authentication and the dispenser number on which he intends to refuel. Assuming that the terminal 200 is the personal radio mobile terminal of the user, configured to operate only via voice commands, even the signal that starts the application 240 could be replaced by a voice command (instead of being a transmitted signal on a short-range radio channel generated by a suitable emitting device 102). The latter option will become all the more interesting since the technologies of sound processing will evolve; for example, when it will be possible to recognize the voice of an individual with adequate reliability, a voice command will be more reliable than a hardware key.

A voice command, characterized in that it is associable to a specific user, can be an excellent solution to start said application 240 securely. In fact a voice command can be constituted by a fixed or variable secret word (for example it can be a response to a variable question) or it can be a voice command on which a process of voice recognition can be applied.

Ultimately, it can therefore be stated that a voice command, as well as constitute a start command, can certainly allow the identification of a user with a considerable degree of security.

In general, if the device 200 is not a device that is part of the equipment of the service station, but a personal radio mobile terminal, the overall system according to the invention can be enriched with additional functional elements. And these additional functional elements can be designed in order to manage the issues of usability and security which are proper of the operations of automatic payment of a refill.

It is important to highlight as the various alternatives can be implemented together in a real business scenario. For example, some oil companies may choose to equip their stations with devices 200 to be assigned temporarily to the individual customers for the supply and use video coverage systems to support the various phases of the refill.

Other companies might make a different choice and involve the customers through their personal radio mobile terminal, which is suitable to take the role of the device 200. In this case, these companies could equip the entrance gates of their petrol stations with a further emitting station of a short-range radio signal so as to induce a suitable configuration in the personal radio mobile terminal of the user who enters said petrol station, in order to configure said terminal to receive a message 21 1 with which the customer intends to initiate the payment service for the automatic refill.

One of the enabling aspects of the system taught in the present invention, resides in the fact of using technologies of recent standardization, which allow a complex system, composed of several elements, to operate properly. Among these enabling technologies, it is important to highlight the use of transmission technologies that allow short-range radio transmission, and to conceive mechanisms for initiate complex processes, and these technologies are based on low-cost emitting devices which are suitable to be easily integrated into other objects or in other systems.

The fact that the other technologies used in the overall system are quite mature technologies is a further element of advantage of a system such as that described, since it ensures technical feasibility and limited costs.

Therefore, the inventive level associated with the system is not in the use of new or inventive technologies, but the in the architecture with which the various elements of the system interact in order to make possible a method for refueling, in "self-service" mode, with a very smart automatic payment procedure.

Said process constitutes a method which is new and inventive too. And said method, in a preferred implementation, can be summarized in the following steps, some of which may be optional, whereas others are essential.

1) At the entrance of a vehicle in a service station, a first emitting device of a short- range radio signal, which belongs to the infrastructure of said service station, transmits a predefined message.

2) The radio mobile terminal of a passenger of said vehicle receives said predefined message transmitted from said first emitting device of a short-range radio signal and, as a consequence, it executes an application of configuration of said mobile radio terminal.

3) One possible configuration provides that said radio mobile terminal can execute an application of support for the automatic payment of the refueling operations only if the radio mobile terminal is operating in "hands-free".

4) The passenger of the vehicle that come into that service station indicates its

intention to refuel with automatic payment by activating the transmission of a second predefined short-range radio signal using a second emitting device 102 located inside the vehicle.

) The content of said short-range radio signal transmitted by means of said second emitting device 102 is a predefined identification message 211 containing at least a unique identifier of said second personal emitting device 102.

) Said identification message 211 is received by a device 200 available for the user that may either coincide with said radio mobile terminal of the passenger or it may be a personal device temporarily supplied by the service station and made available to the user upon receipt of said identification message 21 1 : in this last case the steps 1) to 3) are not executed.

) Said device 200 receives said identification message 21 1 and, as a consequence, executes an application 240, able to support the refueling.

) Said device 200, because of the execution of the above application 240, activates a transmission of a message 311 towards appropriate processing means 300 which are part of the equipment of the service station. And said message 311 provides to said processing means 300 the information about the intention of a user to make a refueling together with his identity, and said message 311 is also a start command of an application running on the processing means 300.

) Said last application, executed on said processing means 300, also implements a user authentication process that has expressed his intention to refuel.

0) In the case of successful authentication, and positive verification that said user is authorized to benefit of the service of automatic payment of a fuel supply in the service station where he is located, said application, executed on the processing means 300, also supports an exchange of messages with the management system of the station 400 which, among other things, manages and controls the operation of the fuel dispensers, enabling the supply of fuel (in "self-service") the right dispenser which is near to the user who has indicated its intention to refuel.

1) The user performs refueling.

2) Said application, executed on said processing means 300, also implements an

"electronic transaction" for the payment of the fuel supplied, using identification data of the user who made the supply, and by retrieving the data on the retail supply occurred through an exchange of messages with said management system of the station 400. 13) Said application, executed on said processing means 300, notifies to said device 200 or to other personal devices of the user, or to other devices that can be accessed by the user, a response containing the details of the supply (e.g . time and place of supply, quantity and type of fuel replenished etc.) and the confirmation of payment.

Point 9) of this articulated method for performing a supply of fuel in a "self- service" station, provides for a user authentication that can take place in different ways as previously indicated in the illustration of the overall system which supports the method taught in the present invention.

In particular, said authentication process may be limited to a simple verification that the user, identified through the identifier contained in said message 21 1, transmitted through said second emitting device 102 of a short-range radio signal, is included in (or not excluded by) a list to which you can access through said processing means 300 which are part of the equipment of the service station.

Or, said authentication process may provide a further exchange of messages between said processing means 300 which are part of the equipment of the service station (that execute the authentication procedure) and a personal terminal of the user, eventually asking this person to enter a secret safety code.

Or, said authentication process may provide an interaction with a video coverage system, present in the service station, which allows to perform the automatic

recognition of the number plate of the vehicle on which the user intends to carry out the refueling, verifying that said plate is associated to the identity communicated by the user.

In the latter case, also the automatic recognition of the license plate can itself be subjected to an additional authentication process, to counteract, for example, the possibility that a fraudster user illegally takes possession of a emitting device 102 of another user (or reproduce it) and goes to refuel in a service station, counterfeiting even the license plate of his vehicle to reproduce that of the legitimate owner of the emitting device 102 taken illegally.

Indeed the authentication for an automatic recognition of a license plate number is possible by following the teachings set forth in the patent Italian applications

VE2014A000027 and VE2014U00001 1. At the conclusion of this description it is useful to highlight how the method of the present invention is complex just because it is articulated in many phases but, from the user perspective, instead, it is extremely simple and straightforward because the user does not need to do anything complex or unnatural: in its simplest implementations the user just needs to press a button, to refuel and to leave.

Even the system to support this method, although composed of various subsystems, is particularly simple and economic. The emitting device 102 to be provided to all users of the service appears to be a device potentially very cheap and it lends itself to be also distributed on a large scale. Also the use of a possible system of video coverage (which, although not essential, is recommended) should not represent an investment such as to determine a deterrent to the spread of the system at the various service stations. In fact the video coverage is now already widespread in many commercial environments for safety reasons and, in particular, it is already present in virtually all the petrol stations of a certain size.

As already said, but it is useful to repeat once again, the just described invention lends itself to numerous variants that may offer additional advantages compared to those previously mentioned, but these further variants can be made by the man skilled in the art without departing from the invention as it is clear from the present description and in the claims appended hereto.

Furthermore, the invention can be realized in a partial way as well as all the various details described may be replaced with technically equivalent elements or solutions.

Claims

TITLE: ELECTRONIC PAYMENT SYSTEM FOR FUEL CLAIMS

1. Electronic payment system of fuels in a service station in which there are

telecommunications means that support local communications among devices distributed in said service station, among which are included, at least, a fuel dispenser and one central computing system (400) which runs a management program of the station, and said payment system of fuel also includes : a. A plurality of emitting devices (102) of a short-range radio signal, each of these is permanently associated to a single user, even when he is not in the service station, and said emitting device (102) of a short-range radio signal is characterized in that it emits a signal of predefined format carrying a preset message (21 1) containing at least information that allow unambiguous identification of said emitting device (102) of said short-range radio signal, and the emission of said short-range signal is controlled by a manual or vocal action performed by the user to whom said emitting device is associated and, by this action, said user communicates his intention to make a refueling; b. at least one terminal (200) available to said user who intends to make a

refueling at said service station, and in said terminal (200) it is installed at least one application (240) for supporting a process of refueling with electronic payment, and said at least one application (240) is started by the reception of at least one short-range radio signal of predefined format and containing a preset message (21 1), which allows unambiguous identification of said emitting device (102) of said short-range radio signal; c. computing means (300) associated with said service station which interact with said management program of the station in order to control a refueling process, and on said computing means (300) it is installed at least one application (341) which is started by a command generated by said application (240) for supporting a process of refueling that is installed on said terminal (200) available to said user, and said application (340) which run on said computing means (300) uses as an input at least the information identifying said user who has communicated his intention to make a refueling; d. at least one communication channel (310) that allows the information

exchange between said terminal (200) available to said user who has communicated his intention to make a refueling, and said computing means (300) associated with the service station; and said computing means (300), able to support the control of said refueling process, may access to the information contained in an archive (350), which is also part of said system for electronic payment of fuels, and which contains the associations between the unique identifier of each emitting device (102) and the personal information about the user to whom each emitting device (102) is personally associated; furthermore said computing means (300) execute a localization procedure that, based also on the information provided by said terminal (200), which is available to the user who intends to make a refueling, determines the dispenser that must be enabled for performing the required fuel supply.

2. System according to claim 1 wherein said terminal (200) available to the user is a device which is part of the infrastructure of the service station and remains temporarily available to a user starting from when it receives said identification message (21 1) up to the end of the operations provided by the application (240) to support the refueling process made by said user.

3. System according to claim 1 which also includes a subsystem of video coverage of the service station, characterized in that said computing means (300) also interact with said subsystem of video coverage and, through the analysis of the video images taken by said video coverage subsystem, said computing means (300) have real time information about to the plate numbers of the vehicles that are located in a position suitable to perform a refueling.

4. System according to claim 1, wherein said terminal (200) available to the user coincides with the personal mobile radio terminal of the user and said system for electronic payment of fuel also includes a second emitting device of a short-range radio signal and said a second emitting device is part of the infrastructure of the service station and it is characterized in that it is placed at the access ways of said service station to transmit at the entrance of each vehicle in the station a

predetermined signal containing a default message which starts, on said personal mobile radio terminal (200), an user application performing a specific configuration of said personal mobile radio terminal (200) itself.

5. System according to the preceding claim wherein said configuration performed by the application started by said default message transmitted by said second emitting device of a short-range radio signal provides that said personal mobile terminal (200) can execute said application (240) for supporting a refueling process only if said terminal (200) is used in "hands-free" mode and the user interaction takes place by means of voice commands.

6. System as in the preceding claim, with the difference that it is not included said personal emitting device (102) of a short-range radio signal, and said identification message (21 1) emitted by said personal emitting device (102) is replaced by a voice command uttered by said user who communicates in such a way his intention to make the supply of fuel in his vehicle.

7. Method for electronic payment of fuels in a service station, characterized by the following phases: a. at the entrance of a vehicle in a service station a short-range radio signal generated by an emitting device which is part of the infrastructure of the service station itself transmits a default message; b. the personal mobile radio terminal of a passenger of said vehicle receives said default message transmitted by said emitting device of a short-range radio signal and, as a consequence of said reception, it runs an auto-configuration application; said auto-configuration provides that said mobile radio terminal will launch an application to support automatic payment of refueling (240) only if said personal radio mobile terminal operates in a "hands-free" mode; the passenger of the vehicle that is entered in said service station

communicates its intention to carry a fuel supply with automatic payment by activating the transmission of a short-range radio signal through a personal emitting device (102) which is located inside the vehicle; the content of said short-range radio signal transmitted from said personal emitting device (102) is a preset identification message (211) containing at least a unique identifier of said personal emitting device (102); said identification message (211) is received by the passenger's personal mobile radio terminal, on which, due to the reception of said identification message (21 1), an application (240) is running to support the refueling; said personal mobile radio terminal, as an effect of said application (240), generates the transmission of a message (31 1) towards proper computing means (300) which are parts of said service station infrastructure, and said message (311) communicates to these computing means (300) the information about the user's intention to make a refueling and his identity, and said message (31 1) is also a command to start an application (341) executed on said computing means (300); said application (341), executed on said the computing means (300), also implements an authentication process of the user who has communicated his intention to make a refueling; in the case of successful authentication, and verification that said user is authorized to benefit from the service of automatic payment of a fueling at the service station where he is, said application (341), executed on said computing means (300), also supports an exchange of messages with the management system of the service station (400) that, together with other functions, manages and controls the operation of the fuel dispensers, and enables the dispenser which the user is close to when he has expressed his intention to refuel for refueling; said user makes refueling; k. said management system (400) of the service station communicates to said computing means (300) the information about the cost of the refueling performed;

1. a supporting application for "electronic payments" (342), executed on said computing means (300), performs an "electronic transaction" for the payment of the fuel supplied, and uses the identification data of the user who made the refueling; m. said supporting application for "electronic payments" (342), executed on said computing means (300), notifies to said personal mobile radio terminal of the user or to other user's personal devices, or to other devices that can be accessed by the user, a confirmation message containing some details of the refueling and the payment acknowledge.

8. Method for electronic payment of fuels in a service station as in the preceding

claim, with the difference that phases "d.", "e." and "f." are replaced by the following phase:

^•S the passenger of the vehicle that is entered in the said service station

communicates its intention to carry a fuel supply with automatic payment uttering a voice command that activates an application (240) in which it has been preconfigured at least one parameter which is a unique identifier of the user who has uttered the activation voice command, and said voice command is associated with said user or because its content is known only to the user himself, or because such application (240) incorporates a speech recognition tool able to discriminate the voice of the person who uttered said voice command.

9. Method for electronic payment of fuels in a service station, characterized by the following phases: a. a user, who is a passenger of a vehicle that is entered in the said service

station communicates its intention to carry a fuel supply with automatic payment by activating the transmission of a short-range radio signal through a personal emitting device (102) which is located inside the vehicle; b. the content of said short-range radio signal transmitted from said personal emitting device (102) is a preset identification message (21 1) containing at least a unique identifier of said personal emitting device (102); c. said identification message (211) is received by a terminal (200) available to the user which is part of the service station infrastructure; d. on said terminal (200) available to the user, as a consequence of the reception of said identification message (21 1), an application (240) to support the refueling is executed; e. said terminal (200) available to the user, as an effect of said application (240), generates the transmission of a message (311) towards proper computing means (300) which are parts of said service station infrastructure, and said message (311) communicates to these computing means (300) the

information about the user's intention to make a refueling and his identity, and said message (31 1) is also a command to start an application (341) executed on said computing means (300); f. said application (341), executed on said the computing means (300), also implements an authentication process of the user that has communicated his intention to make a refueling; g. in the case of successful authentication, and verification that said user is

authorized to benefit from the service of automatic payment of a fueling at the service station where he is, said application (341), executed on said computing means (300), also supports an exchange of messages with the management system of the service station (400) that, together with other functions, manages and controls the operation of the fuel dispensers, and enables the supply of fuel the dispenser which the user is close to when he has expressed his intention to refuel; h. said user makes refueling; i. said management system (400) of the service station communicates to said computing means (300) the information about the cost of the refueling performed; j. a supporting application for "electronic payments" (342), executed on said computing means (300), performs an "electronic transaction" for the payment of the fuel supplied, and uses the identification data of the user who made the refueling; k. said supporting application for "electronic payments" (342), executed on said computing means (300), notifies to said terminal (200) available to the user, or to other user's personal devices, or to other devices that can be accessed by the user, a confirmation message containing the details of the refueling and the payment acknowledge.

10. Method for electronic payment of fuels in a service station according to claim 7, or claim 8, or claim 9, wherein said authentication process of the user that has expressed the intention to make refueling provides that said computing means (300) interact with a video coverage subsystem which is available in said service station, and that, by means of suitable tools of video analysis, said computing means (300) acquire the plate number of vehicles which entered the service station and verify that the vehicle, on which said user has indicated its intention to make refueling by means of the identification message (211) or by means of a voice command, has a plate number associated with said user who has identified himself.