WO2022034207A1

WO2022034207A1 - Method for anonymously providing digital receipts

Info

Publication number: WO2022034207A1
Application number: PCT/EP2021/072582
Authority: WO
Inventors: Ludwig Heer
Original assignee: GreenBill GmbH
Priority date: 2020-08-13
Filing date: 2021-08-13
Publication date: 2022-02-17
Also published as: DE102020121305B4; DE102020121305A1

Abstract

The invention relates to a method for anonymously providing data packets, in particular digital receipts, to selected terminals, comprising the steps of: a) generating a data packet, in particular a digital receipt, b) linking the data packet to an individual identification of an issuing authority and to a timestamp, c) storing the data packet on a memory unit that can be retrieved by terminals, d) using a terminal to read an information medium associated with the individual identification of the issuing authority, wherein the information medium comprises static connection information relating to the retrieval of the retrievable memory unit that is associated with the individual identification of the issuing authority, e) using the terminal to retrieve the retrievable memory unit by using the read static connection information, and f) providing the data packet containing the individual identification relevant to the retrieval and the most current timestamp from the retrievable memory unit to the retrieving terminal.

Description

Procedure for anonymous provision of digital receipts

description

The invention relates to a method for anonymously providing data packets, in particular digital documents, to selected terminals, a data processing system comprising means for executing selected steps of this method, and a computer program product. A computer-readable data carrier and a data carrier signal are also disclosed.

The subject matter of the invention is defined in the appended claims.

The creation of cash receipts is a necessary part of any cash accounting, which not only documents the purchase made for the customer, but also allows taxes or other levies to be shown. Both the customer and the issuing company can document their sales and expenses with appropriate receipts, some of which are only referred to as receipts.

The state of the art in this area that is best known from everyday life is probably the issue of receipts to the customer in printed form. Corresponding cash receipts can be automatically created by a cash register system and handed over directly to the customer by the cashier. With regard to numerous aspects, especially with regard to data and revision security, this established method has proven itself. Against the background of growing ecological awareness among the population, however, the established system of printed receipts is viewed more and more critically, since the creation of conventional cash register receipts requires large amounts of paper and printer ink every year, which not only consumes considerable resources but also costs the company caused.

In addition, traditional printed receipts are often immediately discarded by customers, especially for small amounts with no tax relevance, generating significant amounts of additional waste each year. These disadvantages are partly increased by the fact that in recent years some countries have increasingly adopted regulations that make it mandatory to create and hand over the receipt to the customer, even for small amounts, in order to take action against tax fraud in this way.

In view of dwindling resources and the general effort to minimize the amount of waste that occurs in everyday life, there has been a need for several years to digitize the creation of receipts and their transfer to the customer. However, the major challenge in designing processes for providing such digital documents is that they must be able to be compared with the conventional, analogue process of printed documents, particularly with regard to data security.

In particular, corresponding procedures for providing digital receipts must be designed in such a way that the digital receipt created by the cash register system is made available to the customer reliably and securely, with it being particularly important to prevent unauthorized persons from gaining access to the digital receipt. In addition, the process must be suitable for making the digital receipts available to the customer immediately, i.e. without a time delay, so that the customer is able to check the correctness of the bill directly, for example when shopping in the supermarket.

To solve this problem, some approaches for corresponding digital methods from the prior art rely on the fact that a customer is opposed to the POS system must identify, for example, by reading a QR code from the user's mobile device by the POS system, whereupon the POS system then forwards the receipt data to the customer on the server side. However, this procedure regularly requires that the customer and the dealer use the same software system or use compatible or specially coordinated applications. In particular in the case of companies with frequently changing customers, for example at airports or train stations, this is regularly felt to be disadvantageous, in particular if the coverage with the corresponding application or the customers' willingness to register is low. In addition, with these methods, it is regularly perceived as a disadvantage that the customer shares his data with the dealer and only has a limited influence on which data the dealer reads from the customer's mobile device via the application. In addition, corresponding procedures are usually not completely anonymous, since the receipts can be assigned to individual users or their user accounts, at least on the server side. From the point of view of the company, it is often felt to be disadvantageous that additional hardware for the communication between the customer's end device and the cash register system has to be purchased and maintained in order to read the information provided by the customer.

A much-noticed further development compared to the method described above was able to be implemented by a method for providing digital receipts, which the inventors of the present invention had previously successfully placed on the market. In order to meet the general requirements for procedures for the provision of digital receipts, this solution provides for digitizing the receipts created by a cash register using a data processing device connected via the printer connection and displaying them directly to the customer at the cash register via a permanently installed digital display, such as a tablet , in order to ensure that the document can be checked immediately. This procedure meets the requirement that the customer must be able to take the digital receipt with him by generating an individual one for each transaction on the permanently installed digital display together with the digital receipt QR code is displayed. This individually generated QR code includes variable connection information, ie a connection link to the displayed document on a server system, which is newly created individually for each document to be issued. The customer who wants to take the digital receipt with him only has to read the QR code with his end device, for example a mobile phone, and is guided via the individually created link to the digital receipt stored on a server, which can then be stored on the end device of the customer, for example customers can be saved.

With this system, the important need for security is met by generating a separate link for each generated digital receipt, which is only displayed to the customer together with the receipt, which can also be called up via the corresponding link. A major advantage of this solution, which has already been established by the inventors, is that in principle any commercially available display device, such as a tablet computer, can be used as a display and that the process can also be combined with older POS systems by using the output of the printer interface.

Despite the success of the system described above, however, certain aspects are sometimes felt to be disadvantageous. In particular, this method known from the prior art requires that the company provide a separate electronic device for displaying the receipts at each individual issuing point, i.e. for example each cash register or each mobile billing device of a waiter. This can be associated with considerable costs, especially for large companies, and also requires theft-proof attachment of the appropriate devices at the issuing points. In addition to the additional energy consumption due to the additional electrical devices, it is also felt to be disadvantageous that the tablets themselves, which are mostly operated via wireless networks, can potentially be susceptible to unauthorized access if they are not properly maintained and secured.

The method previously presented by the inventors has already proven to be very efficient in practice, especially in comparison with such alternative systems that require the installation of a separate application on the customer's end device and/or registration of the customer in a separate database. Nevertheless, there was a need to further develop the solutions already known from the prior art.

Accordingly, the overarching object of the present invention was to specify a method for providing digital documents which is comparable to the established method using printed documents in terms of performance parameters, but which eliminates or at least reduces the disadvantages of the prior art described above.

In particular, it was therefore the object of the present invention to specify a method with which the consumption of paper and printing ink in the business operations of companies can be reduced and by which the amount of paper waste produced can be reduced.

The procedure to be specified should preferably make it possible for the customer to be able to see the document created for him or her immediately when the invoice is created, in order to be able to check the correctness of the document. In addition, it was an important specification of the present invention that the digital receipt must be made available to the customer directly at the point of issue, e.g. at the checkout, to take away.

An important object of the present invention was to specify a method which, compared to the prior art, makes fewer demands on the infrastructure to be provided by the company at the issuing point and, in particular, eliminates the need for separate electronic display devices.

Particular attention was also paid to the task that the procedure to be specified should provide the digital documents anonymously, ie without the company or other customers being able to gain information about the customer. In this context, it was a further object of the invention to design the method in such a way that it is not only protected against the accidental, unwanted delivery of digital documents to unauthorized terminals, but also against malicious access by unauthorized third parties.

One of the requirements here was that the process to be specified should, if possible, do without the installation and/or use of specific applications on the customer's end devices, in order to enable the widest possible range of uses and to remove any obstacles to the use of the corresponding process, whereby in particular the The need for a separate registration of the user in a database should be avoided.

Finally, it was an object of the present invention to specify a system for data processing, which includes means for executing the procedural steps required by the cash register system, and to provide an associated computer program product.

The inventors have recognized that the above-mentioned technical problems and tasks can surprisingly be solved by a method for the anonymous provision of digital documents which, unlike the prior art, uses a static information carrier which is arranged in the area of the issuing office and which contains static connection information that is the same for a large number of customers and does not have to be generated individually for each customer.

A customer who wants to pick up a digital receipt after a purchase only has to read the static information carrier, which can be a sticker with a QR code, for example, and receives the digital one using any web browser preinstalled on their device Document provided, whereas the subsequent customer only gets his own digital document displayed over the same static information carrier and the same static connection information, but not that of the predecessor. This system not only eliminates the need to install a separate application on the customer's end device, but also eliminates the need for the company to provide a separate infrastructure beyond the affixing of a simple sticker of negligible material value, while also preserving the anonymity of the procedure is guaranteed in a very special way, since the company's checkout system does not have to read any data from the customer.

This advantageous method is implemented in that the digital document and its retrieval by the terminal are processed in a special way by the system used for data processing in the method according to the invention. An individual identification is created for each issuing point, i.e. a cash register or a waiter’s mobile billing device, for example. The information carrier arranged at the corresponding issuing point and the static connection information stored therein are linked to the individual identification of the corresponding issuing point. If a digital receipt is to be issued at the corresponding issuing office, the receipt generated by the data processing system is linked to the individual identification and a time stamp and stored on a server so that it can be called up, with a receipt stack containing all receipts being generated for each individual identification , which were created for an individual identification, of which only the last document, ie the document with the most recent time stamp, is active and can therefore be called up.

When the customer reads the static connection information from the information carrier, he is connected to a retrievable storage unit of the system for data processing, for example via a forwarding server. The data processing system takes into account the individual identification linked to the request from the terminal device, which depends on the information carrier read out, as well as the time of retrieval and uses this to generate dynamic connection information, which leads the terminal device to retrieve the stored digital document. This so-called individual link, which is only available for each stored digital document in the If the retrieval is generated individually, it can be limited in time and/or in the number of retrievals.

The method described above using an exemplary method results in an improved method for anonymously providing digital documents, which, according to the inventors, is basically also suitable for anonymously providing other data packets that are to be transmitted to terminals in comparable situations, so that the inventive In principle, the procedure is not limited to the provision of digital documents, even if this purpose is explicitly preferred.

The tasks mentioned above are correspondingly solved by methods for anonymously providing data packets, in particular digital documents, to selected end devices and systems for data processing and computer program products, as defined in the claims. Preferred configurations according to the invention result from the dependent claims and the following statements.

Such features of methods according to the invention for anonymously providing data packets, in particular digital receipts, to selected terminals, which are referred to below as preferred, are combined in particularly preferred embodiments with other features referred to as preferred. Combinations of two or more of the processes described below as being particularly preferred are therefore very particularly preferred. Additional features of preferred systems and computer program products according to the invention result from the features of preferred methods.

The invention relates to a method for anonymously providing data packets, in particular digital receipts, to selected terminals, comprising the steps: a) generating a data packet, in particular a digital receipt, b) linking the data packet with an individual identification of an issuing office and a time stamp, c) storing the data packet on a storage unit that can be called up by end devices, d) reading out an information carrier assigned to the individual identification of the issuing office with a terminal device, the information carrier having static connection information for retrieval of the retrievable storage unit, which is assigned to the individual identification of the issuing office, e) retrieving the retrievable storage unit with the terminal using the static connection information that has been read out, and f) providing the data packet with the individual identification that matches the retrieval and the most recent time stamp from the retrievable storage unit to the retrieving end device.

With the method according to the invention, selected terminals are provided with data packets, with the system for data processing that can be used in the method not having to receive any individual information from the selected terminal, so that the provision is anonymous.

Even if the method according to the invention is fundamentally suitable for providing different data packets, it is particularly preferred that the data packets are digital documents.

A digital receipt is a compilation of data that contains, in particular, payment information and information about the company that created the digital receipt. Digital receipts are intended for distribution to customers and may contain additional information, such as information about promotional offers and/or voucher programs, as required.

In the method according to the invention, a data packet is first generated, which can in particular be a digital document. the It is generated, for example, by a cash register system, which can be a single cash register or a network of several cash registers that are connected to one another in a larger system for data processing. A digital receipt can be generated, for example, by a waiter accounting for food consumed at the table with a mobile accounting device or by a cashier registering purchased goods with a cash register and accounting for them, whereupon a data processing device creates the digital receipt.

In the context of the present invention, the devices used to record the billing data, for example the mobile billing device used by a waiter to record the bill or the cashier's cash register, are referred to as the issuing point because they usually use printed receipts at these points in the analog processes the receipt would also be issued to the customer. The device used for billing, i.e. the issuing office, is part of a data processing system, either alone or in cooperation with other devices, which is suitable for carrying out the method according to the invention and through which the data packet is provided anonymously to the terminal device.

An individual identification is assigned to each issuing point. This individual identification is regularly unique within the data processing system and is used to identify the issuing office in the data processing system. The individual identification can contain additional information about the issuing point or be assigned depending on this, in particular on system parameters of the device used at the point of delivery to create the data packet, as well as other markers such as the responsible employee, the number of the table served, the location at the moment of billing or other parameters, regardless of whether they are later included in the digital receipt.

A method according to the invention is therefore preferred, in which each issuing point receives the respective individual identification as a function of one or more Parameters are assigned, in particular depending on the location and/or the area of responsibility and/or the responsible operator.

The data packet generated in step a) is linked to the individual identification of the corresponding issuing office. As a result, the generated data packet can be assigned to the relevant issuing office. In addition, the generated data packet is linked to a time stamp. In the context of the present invention, a time stamp is basically any information that enables the data packets provided with the time stamps to be arranged chronologically.

In the method according to the invention, the generated data packet is stored on a memory unit which can be called up by terminals and which in turn is part of the data processing system. In the method according to the invention, the order in which steps b) and c) are carried out is irrelevant, although simultaneous execution is also possible. For example, the data packet can be linked to the individual identification of the issuing office and the time stamp before, at the same time as, or after the data packet is stored on the storage unit that can be called up by terminals.

According to the invention, the memory unit can be accessed by terminals. In the context of the present invention, the term terminal designates those devices with which the customer retrieves the generated data packet. The end device to be used in the method according to the invention is therefore not part of the data processing system which the company must set up in order to be able to carry out the method according to the invention from its side. The retrievable storage unit must be retrievable in the intended operation of the customer's end devices. In this case, retrieval can take place, for example, via a wireless connection, in particular a wireless Internet connection.

A particularly relevant example in practice of a memory unit that can be called up by terminals is a server that is connected to the Internet and can be called up via connection information. In step d) of the method according to the invention, an information carrier that is assigned to the individual identification of the issuing office is read out, for example by a customer, with a terminal device. The corresponding information carrier includes static connection information for direct or indirect, i.e. direct or indirect, retrieval of the retrievable storage unit, i.e. for example the server, with the static connection information being assigned to the same individual identification of the issuing office as the information carrier itself.

A method according to the invention is preferred, in which the static connection information includes a link to an object on the retrievable storage unit.

Even if this is usually disadvantageous for practical use, one of the simplest configurations of the information carrier can theoretically be implemented using written paper on which the static connection information is written out in the form of a link. This link can be read out by the end device, if necessary with the involvement of the device user, in order to obtain the static connection information for retrieving the retrievable storage unit. The static connection information for retrieving the retrievable storage unit is assigned to the individual identification of the issuing point, for example, by assigning the destination on the retrievable storage unit to which the static connection information refers. In the practically more relevant cases, the information carrier assigned to the individual identification of the issuing point is a QR code or an NFC chip, which can be read out with standard end devices, such as mobile phones, and enables the static connection information to be read out automatically.

In the context of the present invention, specifying the connection information as static connection information means that the information carrier is intended and determined for reading out by a number of terminals in the course of the provision of a number of different digital receipts where the static connection information, ie for example the link to the retrievable storage unit, does not change between 2 or more, preferably 10 or more, particularly preferably 100 or more, very particularly preferably 1000 or more retrievals.

A method according to the invention is therefore particularly preferred in which steps a) to f) are carried out n times for retrieving data packets by respectively different terminals while reading out the same information carrier and using the same static connection information, where n=2 or more, preferably 10 or more, more preferably 100 or more, most preferably 1000 or more.

Methods according to the invention in which the static connection information contained in the information carrier cannot be modified by the issuing point are particularly preferred.

The above statements mean that an information carrier with static connection information can also exist if the form of representation is not static in the sense of being permanent and unchangeable. A sticker with a printed QR code, which does not change until the sticker is removed manually, is in any case an information carrier with static connection information within the meaning of the present invention. At the same time, however, it could be possible not to implement the corresponding QR code with a sticker, but to display it via a digital display area, even if this solution is explicitly not preferred in view of the additional electronic infrastructure effort involved. In this case, one speaks of static connection information if the displayed QR code is intended for multiple use by end devices and is not regenerated depending on each new digital document to be provided, ie not for each new digital document to be provided individual link, ie dynamic connection information, is adjusted.

In the method according to the invention, in step e) the retrieval of the retrievable storage unit is carried out by the terminal, the data from the Information carrier read out static connection information is used. The corresponding retrieval thus contains information that can be recognized by the retrievable storage unit about individual information from the issuing office to which the information carrier is assigned. The retrieval of the retrievable memory unit by the terminal device in step e) can be done either directly or indirectly, for example by interposing another device for data processing, for example a forwarding server, which mediates the retrieval of the retrievable memory unit by the terminal device by creating dynamic connection information.

As a result of the retrieval in step e), the method according to the invention provides the retrieving end device from the retrievable storage unit with every data packet that not only matches the individual identification of the issuing office that is associated with the retrieval, but also that for the corresponding individual identification has the most recent time stamp. In principle, various implementations are conceivable for this step, which can be implemented by the retrievable storage unit. Methods according to the invention are preferred, for example, in which the retrievable storage unit is set up in such a way that, when it is called up by a terminal, it can only provide the data packet with the most recent time stamp for each individual identification, and/or in which step c) is carried out in such a way that at least temporarily preferably at any time, for a given individual identification, all data packets with the exception of the data packet with the most recent time stamp are deactivated and/or archived so that they can no longer be retrieved and/or wherein stored data packets are stored on the retrievable storage unit after a specified number of retrievals by a end device are deactivated and/or archived so that they can no longer be accessed.

Since these methods regularly have a particularly high level of user acceptance and require a particularly low level of investment, methods according to the invention are preferred in which the terminal device does not include a data processing program specifically tailored to the method and/or wherein the terminal device is not registered for use in the method, and/or wherein no electronic devices are provided at the issuing point for displaying variable connection information on the terminal device.

Steps a), b), c) and f) of the method according to the invention are the steps that are not carried out by the customer's end device, but for which the infrastructure is regularly provided by the entrepreneur. Correspondingly, these steps are carried out by a data processing system. This system for data processing expediently comprises a device for data processing with at least one output point, the output point being to be understood as defined above. In addition, the data processing system includes the retrievable storage unit. In the simplest case, which would probably be rather rare in practice, the system for data processing could be formed, for example, by a single cash register or a single mobile billing office. In this case, the corresponding device is both the issuing point and the device for data processing, which is used to create the digital document, and must also include a memory unit that can be called up by the terminal device, so that this device, for example because it is linked to the Internet, can also form the retrievable storage unit. In practice, the system for data processing is regularly formed by a central device for data processing, for example a cash register system, which is connected to numerous separate issuing points, for example different cash registers, potentially in different branches. In this case, the retrievable storage unit could in principle be formed by the data processing device. However, a system for data processing is very particularly preferred, in which case the retrievable storage unit is arranged in a decentralized manner and is connected to a number of devices for data processing.

Thus, methods according to the invention are preferred, with steps a), b), c) and f) being carried out by a data processing system, the data processing system preferably being a data processing device with at least one output point, in particular a POS system with at least one issuing point, and comprising the retrievable storage unit, wherein the at least one issuing point is preferably a cash register or a mobile billing point.

A method according to the invention is particularly preferred in which the retrievable storage unit is a retrievable server which is preferably connected to a plurality of devices for data processing.

In practice, such methods according to the invention have proven particularly advantageous in which the information carrier is a QR code, an RFID chip or an NFC chip on which the static connection information is stored. In view of the widespread use of cell phones, these information carriers, which can be read out particularly easily and conveniently, have proven their worth, in particular because they are particularly easy to attach and can be provided inexpensively. The corresponding information carriers can be read out with all commercially available mobile end devices and save you having to enter time-consuming connection information manually. With regard to the method according to the invention, it has proven to be particularly advantageous to arrange the information carrier at the issuing point or in the vicinity of the issuing point in order to be able to provide the customer with the digital document at just any point where he is accustomed to with conventional methods is to get the receipt. Possible examples of the arrangement of the information carrier are, for example, in the goods storage area of the cash register of a supermarket or on a waiter's billing device.

Methods according to the invention are therefore preferred in which the information carrier is a QR code or an RFID chip, preferably a QR code or an NFC chip, the end device comprising means for reading the information carrier, the information carrier preferably being stored at the issuing point or in is arranged in the vicinity of the issuing point, and/or wherein the end device is a mobile end device, preferably a mobile phone or a tablet computer. In particularly preferred methods according to the invention, the information carrier is a sticker or a plaque, in particular a sticker or a plaque with a QR code.

In principle, the method according to the invention can be implemented with any type of time stamp, as long as this time stamp enables the digital documents generated for each individual identification to be classified chronologically. However, it has proven to be expedient to provide the time stamp in such a way that it correlates with the time at which the data packet was generated. In a particularly simple embodiment, the time stamp corresponds exactly to the time at which the data packet was generated.

A method according to the invention is therefore preferred, in which the time stamp comprises information which correlates with the time at which the data packet was generated.

With regard to the organization of the memory unit that can be called up, it has proven expedient to generate so-called stacks of data packets for each individual identification within the memory unit that can be called up. This means that the data packets associated with an individual identification are not stored arbitrarily on the retrievable storage unit after they have been generated, but are combined in the manner of a stack in such a way that only the top data packet of a stack can be retrieved, with the last data packet being generated in each case data packet is stored as the topmost and thus retrievable data packet on each stack. Accordingly, a method according to the invention is preferred, wherein the retrievable memory unit comprises a separate stack of data packets for each individual identification.

Even if in principle different solutions are conceivable in order to provide only the data packet with the most recent time stamp for a specific individual identification when called up by a terminal device, it has proven to be particularly efficient in practice to carry out the retrieval in such a way that from the read out Static connection information and the time of retrieval by a corresponding algorithm dynamic Connection information is generated, which includes a link to the corresponding data packet with the individual identification suitable for retrieval and the most recent time stamp on the retrievable storage unit.

A method according to the invention is therefore very particularly preferred, in which the provision in step f) takes place in that the static connection information is correlated with the time of retrieval in order to generate dynamic connection information which has a link to the data packet with the appropriate connection to the retrieval individual identification and the most recent time stamp on the retrievable storage unit, the dynamic connection information preferably being generated only as a result of a retrieval by a terminal device.

Given the knowledge of the invention, an appropriate algorithm or application that performs this correlation and creates the dynamic connection information is programmable for the person skilled in the art on the basis of his specialist knowledge, and he can adapt it to the infrastructure and needs of his particular data processing system.

The preferred method according to the invention described above has proven to be particularly advantageous, in particular with regard to the wide range of security options that can be provided, and in the opinion of the inventors is superior to alternative solution concepts in this respect.

The correlating can be done, for example, by the memory unit that can be called up or by a computer program product that is present on it. However, configurations in which the correlating is carried out by a separate forwarding server which is connected upstream of the retrievable storage unit are particularly preferred. This structure has proven to be particularly effective because the forwarding server, which in this case forms part of the data processing system, can be provided centrally by a provider for several data processing devices, e.g forwarding server can be provided. A method according to the invention is therefore preferred, in which the correlation is preferably carried out by a forwarding server, particularly preferably by a forwarding server which is connected to a number of devices for data processing, and in which separate dynamic connection information is preferably generated for each data packet.

For the generation of the dynamic connection information, the forwarding server ultimately only needs the information on how the data packets are stored on the retrievable storage unit depending on the individual identification and the time stamp or which connection information is assigned to a corresponding data packet on the retrievable storage unit in order to by a terminal, which includes information about the individual identification, and taking into account the time stamp, to generate the associated dynamic connection information, through which the retrieving terminal is directed to the corresponding data packet on the retrievable storage unit.

As explained above, a major advantage of the method according to the invention and the preferred embodiment is that various protective measures can be provided particularly efficiently in order to make the method particularly secure. In some cases, this may be necessary in order to provide particularly comprehensive protection for potentially sensitive information.

It has proven to be a particularly efficient security measure if the dynamic connection information generated in the preferred inventive method, ie the connection information generated from the static connection information for the most recent data packet, only after a separately granted release, for example by pressing a real or digital button at the output point by the cashier, only for a specified number of calls or for a specific time. In the case of particularly sensitive information, it has proven to be expedient to limit the number of calls to a single call In less critical situations, such as a supermarket checkout, it can be expedient to at least enable a second call if problems occur with the first call.

A particular advantage of the preferred embodiment of the method according to the invention for generating the dynamic connection information is that this dynamic connection information can be hidden from the user of the terminal device. While the static connection information stored in the information carrier can in principle be called up by anyone, the connection information actually leading to the digital document is additionally protected so that unwanted later access by the user of the retrieving terminal can also be ruled out.

Preference is therefore given to a preferred method according to the invention, in which the dynamic connection information can only be used for a specified time after the generation of the data packet and/or only for a specified time after release at the output point and/or only for a specified number of retrievals, with the dynamic Connection information is preferably hidden in such a way that it cannot be called up separately by the user of the terminal.

As explained above, the basic embodiment of the method according to the invention provides that the data packet with the most recent time stamp can be called up for each individual identification. In the case of sensitive data in particular, however, it can be advantageous if, after a predetermined time and/or a predetermined number of retrievals and possibly other factors, the data packets that have the most recent time stamp are also automatically deactivated or archived. The benefit of a corresponding device for the person skilled in the art is particularly evident when, for example, the last accounting process of the business day is viewed, which would otherwise lead to the corresponding digital document being visible on the server overnight until the next business day, in particular, if a method is selected that does not use the path via the dynamic connection information referred to above as being preferred. In this respect, a method according to the invention is preferred in which stored data packets are deactivated and/or archived on the retrievable storage unit after a predetermined time, independently of retrieval by a terminal device or other factors, so that they can no longer be retrieved.

Additionally or alternatively, retrieval of the retrievable storage unit with the terminal using the static connection information or the dynamic connection information generated from this can be secured with further protective measures, which can advantageously be implemented particularly easily in the method according to the invention. One option is to enter a password or a PIN, although our own tests have shown it to be particularly practical to provide the invoice amount, e.g. the last four digits of the invoice amount, as a PIN, since this information is readily available and at the same time largely variable. to identify the authorized customer and his end device directly on site.

Additionally or alternatively, a further information carrier can also be provided at the issuing point, which contains additional authentication information, so that authentication according to the public-private key principle is possible. In this case, the information carrier is first scanned as part of the method according to the invention, whereupon the user is prompted to read out another information carrier that contains the only locally available key for opening the static connection information and, for example, at the issuing point by the waiter or cashier only deliberately released can be.

It has also proven to be particularly efficient to read out the location information of the terminal device for authentication and to compare this with predetermined location information, namely in particular the location information of the issuing point. In other words, in many in the In practice-relevant scenarios it can be assumed that the customer retrieving the digital receipt is within a certain tolerance range in the vicinity of the corresponding issuing office or is in the spatial area of responsibility of a waiter.

Preference is given to methods according to the invention, in which retrieval of the retrievable memory unit with the terminal device using the static connection information i) requires the entry of a password or a PIN, and/or ii) requires the reading of another information carrier, and/or ii) only takes place can if the location information of the terminal agrees with a predetermined location information, in particular the location information of the issuing office.

In addition to preventing unwanted calls, it can be important to ensure traceability as to whether unauthorized access may have taken place despite the security measures. Methods according to the invention are preferred for corresponding cases, with each retrieval of the data packet from the retrievable storage unit being noted as information in the data packet, which is also transmitted to the terminal with each further retrieval.

In addition to preventing and documenting unauthorized access, it is often expedient, with a view to minimizing further consequential damage, to provide measures that prevent a disturber who has been detected, such as a third party accessing the documents without permission, from causing further damage. The inventors have recognized that the method according to the invention achieves a particularly high level of security when those end devices are blocked that show a certain usage behavior that runs counter to the retrieval behavior provided in the context of the method according to the invention and/or depends on does not belong to the group of expected retrieving terminals based on its identification parameters. In particular, the latter unfolds provided it is a general rule is provided, advantageously also a fundamental protective effect, for example, if for a company that is only active regionally such retrievals are blocked in principle, the identification parameters of which indicate that the retrieval is made from abroad. It can also be assumed in a large number of cases that the digital documents provided will be collected by mobile devices, so that it may be expedient for non-mobile devices, such as desktop computers, to be blocked from retrieval as a matter of principle because abuse is involved here is more likely.

The inventors have recognized that the concept of partially blocking end devices can also be used in cases where authentication, as described above as preferred, does not succeed immediately or after a certain number of attempts. A suspicious retrieval behavior would be, for example, repeated retrieval of the static and/or dynamic connection information from the same IP address.

Preferred is a method according to the invention, wherein a terminal, which directs one or more retrievals to the retrievable storage unit, while all stored data packets with the associated individual identification are deactivated and / or archived, and / or while the generated from the static connection information dynamic

connection information cannot be used for the retrieval, is blocked at least temporarily, and/or the terminal device is blocked for retrieving the data packet on the basis of identification parameters, in particular its location and/or its retrieval behavior, with preferably all non-mobile terminal devices for the be blocked.

The inventors have recognized that particular security can be achieved in the method according to the invention if the static connection information is changed at predetermined intervals or after predetermined events.

If an NFC chip is used as the information carrier, the static connection information stored from the NFC chip can be deliberately changed, for example after misuse has been observed. Here is to state that, despite the fundamental variability, it is still static connection information that is provided in the NFC chip, since it is in principle intended and intended for use in many different requests from separate end devices, even if it may be indicated in individual cases, the static connection information to change it again after a digital receipt has been made available, for example because renewed misuse has been determined.

A method according to the invention is preferred, in which the information carrier is an NFC chip and in which the static connection information in the NFC chip is changed at predetermined intervals and/or after predetermined events, the change preferably taking place using encrypted communication with the NFC chip and wherein the changed static connection information can preferably only be read out by the terminal when the changing process has been completed.

Since, unlike with NFC chips, it is not easy to subsequently adjust the static connection information for other information carriers, such as stickers with a QR code, the inventors have developed a concept to enable the static connection information to be updated in this case as well . In this case, each issuing point is assigned two or more information carriers that can be made available to the company together, for example in the form of a number of stickers. Of these, at most one of the stored static connection information items is active in each case, so that one of the information carriers can perform the role of information carrier in the method according to the invention. If no static connection information is set as active on the server side, the first static connection information read out and used for retrieval is subsequently set as active and can henceforth be used in the method according to the invention. After a certain criterion has occurred, for example a number of connection attempts made, the previously active static connection information can be deactivated, so that one of the other static connection information can be activated according to the principle described above, for example after the sticker was pasted over. In principle, several scenarios are conceivable for the fate of the previously active information carrier, whereby it is expedient, especially against the background of the reusability of a limited number of information carriers, to use a previously used information carrier only for a certain time or even only to determine the next activated connection information lock out.

A method according to the invention is therefore preferred, in which the individual identification of the issuing point is assigned two or more information carriers with static connection information, of which at most one static connection information is active Connection information is set as active, so that the remaining static connection information is inactive from this point in time.

Preference is given to a preferred method according to the invention, in which the active static connection information is deactivated after a certain number of uses and/or after the occurrence of another criterion, so that another static connection information read out following the deactivation and used for retrieval is set as active.

Alternatively, a preferred method according to the invention is also preferred, in which the active static connection information is deactivated as soon as another information carrier assigned to the individual identification of the issuing point and whose static connection information is not active is read, with the static connection information of the last information carrier read out being set as active .

Also particularly preferred is a preferred method according to the invention, wherein the static connection information deactivated after previous activation for further use i) completely, or ii) for a specific time, or iii) only for the determination of the respectively next activated static connection information is blocked.

It is clear to the person skilled in the art from the above statements that the invention also relates to a system for data processing comprising means for carrying out steps a), b), c) and f) of the method according to the invention. The corresponding system for data processing is not only suitable for carrying out steps a), b), c) and f) of the method according to the invention, but also includes means that were specifically designed for carrying out these steps.

A system for data processing according to the invention is preferred, comprising a device for data processing with at least one issuing point, in particular a cash register system with at least one issuing point, and a retrievable storage unit, wherein the at least one issuing point is preferably a cash register or a mobile billing point, and wherein the retrievable storage unit is preferably a retrievable server which is preferably connected to a plurality of devices for data processing, the retrievable storage unit being very particularly preferably spatially separate from the device for data processing.

A system for data processing according to the invention is very particularly preferred, additionally comprising a forwarding server, comprising means for correlating the static connection information with the time of retrieval in order to generate dynamic connection information which links to the data packet with the individual identification suitable for the retrieval and the most up-to-date Includes time stamp on the retrievable storage unit.

Within the scope of the present invention, the information carrier read out in the method according to the invention can also be assigned to the system for data processing according to the invention. A system for data processing according to the invention is correspondingly preferred, comprising at least one Information carrier, the information carrier are preferably arranged at the associated output points.

It is obvious to the person skilled in the art that the present invention also relates to a computer program product, comprising instructions which, when the computer program is executed by a device for data processing of a data processing system, preferably a data processing system according to the invention, cause the latter to carry out steps a), b), c) and f) of the method according to the invention.

Finally, a computer-readable data medium on which the computer program product according to the invention is stored and a data medium signal which transmits the computer program product according to the invention are also disclosed.

A preferred embodiment of the invention is explained and described in more detail below with reference to the accompanying drawing. It shows:

1 shows a schematic representation of a system for data processing according to the invention in a preferred embodiment.

1 schematically shows a data processing system 28 according to the invention, the central component of which is a memory unit 18 that can be called up. The retrievable storage unit 18 is connected to a forwarding server 24 and, in this example, to two devices for data processing 22a, 22b. The first data processing device 22a is assigned three output points 16a, 16b, 16c with the associated individual identifications 14a, 14b, 14c. The second device for data processing 22b has three assigned output points 16b, 16e, 16f in the same way, which in turn are assigned the corresponding individual identifications 14d, 14e, 14f.

Each of the illustrated issuing points 16a-16f has an information carrier 20a, 20b, 20c, 20d, 20e, 20f assigned to the issuing point 16a-16f. A data package 10a, 10b, 10c, 10d, 10e, 10f, for example a digital receipt, which is generated at one of the output points 16a - 16f or in the devices for data processing 22a, 22b, is stored on the retrievable storage unit 18 together with the previously generated data packets 10a, 10b, 10c, 10d, 10e, 10f of the corresponding individual identification 14a - 14f are stored, so that stacks 26a, 26b, 26c, 26d, 26e, 26f are formed by data packets, each of which is assigned an individual identification 14a-14f and in which only the uppermost data packet 10a-10f is active. The ordering criterion for the stacks 26a-26f is the time or the time stamp, which is indicated in FIG. 1 by the rising arrow and the sketched clock, as well as the respective individual identification 14a-14f.

In the example shown in Fig. 1, the two devices for data processing 22a, 22b are to be understood as central devices for data processing 22a, 22b of two cash register systems in two companies that are physically separate from one another, to which three cash registers are assigned as issuing points 16a, 16b, 16c or three mobile billing devices are assigned by waiters as output points 16d, 16e, 16f, whose respective information carriers 20a - 20f are attached with the static connection information in the vicinity of the output points.

1 shows schematically how a customer would like to use the terminal 12 to pick up the document from the issuing office 16a, with the method according to the invention being run through in a preferred embodiment. In the interaction of the output point 16a and the device for data processing 22a, a data packet 10a is generated, which is provided with the corresponding individual identification 14a and a corresponding time stamp, so that it is stored on the retrievable storage unit 18 on the associated stack 26a and the generated data packet 10a can be called up as the most recent data packet 10a, while all the underlying data packets 10a of the stack 26a are deactivated or archived, so that they can no longer be called up. The customer now uses the terminal 12 to read the information carrier 20a assigned to the issuing point 16a in order to read out the static connection information contained in this information carrier 20a for retrieving the retrievable memory unit 18, which is the individual identification 14a assigned. In the preferred method according to the invention outlined schematically, the retrieval of the retrievable storage unit 18 takes place indirectly via an intermediate forwarding server 24, in which the static connection information from the information carrier 20a is correlated with the time of retrieval by the terminal 12 in order to generate dynamic connection information which includes a link to the corresponding data packet 10a with the individual identification 14a that matches the retrieval and the most recent time stamp, so that the corresponding document 10a is provided to the end device 12 without the data processing system 28 requiring any further information from the end device 12, so that the Provided can be done anonymously.

In the example shown in FIG. 1, the terminal 12 is a mobile terminal 12, namely a cell phone. In FIG. 1, the information carriers 20a - 20f are also each designed as stickers with a QR code, which can be read out via a camera installed in the terminal device 12 and evaluated with commercially available preinstalled software.

The data packet 10a retrieved by the customer using a terminal 12 can then be displayed and further processed by the customer using a standard web browser, for example saved or sent as an e-mail. If suitable software is installed on the terminal 12, the receipt provided digitally can also be used to digitally instruct a necessary payment.

reference sign

10a-10f data packet

12 terminal 14a-14f individual identification

16a-16f issuing office

18 recallable memory unit

20a-20f information carrier

22a, 22b device for data processing 24 forwarding server

26a-26f stack

28 system for data processing

Claims

Claims Method for anonymously providing data packets (10a-10f), in particular digital receipts, to selected terminals (12), comprising the steps of: a) generating a data packet (10a-10f), in particular a digital receipt, b) linking the data packet (10a-10f) with an individual identification (14a-14f) of an issuing point (16a-16f) and a time stamp, c) storage of the data packet (10a-10f) on a storage unit (18) that can be called up by terminals (12), d) Reading out an information carrier (20a-20f) assigned to the individual identification (14a-14f) of the issuing point (16a-16f) with a terminal (12), the information carrier (20a-20f) containing static connection information for retrieving the retrievable storage unit (18) which is assigned to the individual identification (14a-14f) of the issuing point (16a-16f), e) retrieving the retrievable storage unit (18) with the terminal (12) using the static connection information read out ation, and f) providing the data packet (10a-10f) with the individual identification (14a-14f) that matches the retrieval and the most recent time stamp from the retrievable storage unit (18) to the retrieving terminal (12). Method according to Claim 1, in which steps a), b), c) and f) are carried out by a data processing system (28), the data processing system (28) preferably having a data processing device (22a, 22b) with at least an output point (16a-16f), in particular a cash register system with at least one output point (16a-16f), and the retrievable memory unit (18), wherein the at least an issuing point (16a-16f) is preferably a cash register or a mobile billing point. Method according to one of claims 1 or 2, wherein the information carrier (20a-20f) is a QR code or an RFID chip, preferably a QR code or an NFC chip, the terminal device (12) having means for reading the Information carrier (20a-20f), wherein the information carrier (20a-20f) is preferably arranged in the issuing point (16a-16f) or in the vicinity of the issuing point (16a-16f). Method according to one of Claims 1 to 3, the retrievable storage unit (18) comprising a separate stack (26a-26f) of data packets (10a-10f) for each individual identification (14a-14f). Method according to one of Claims 1 to 4, the provision in step f) being effected in that the static connection information is correlated with the time of retrieval in order to generate dynamic connection information which has a link to the data packet (10a-10f). the individual identification (14a-14f) that matches the retrieval and the most recent time stamp on the retrievable storage unit (18), with the correlation preferably being carried out by a forwarding server (24). Method according to one of Claims 1 to 5, the retrievable storage unit (18) being set up in such a way that when it is retrieved by a terminal (12) it only contains the data packet (10a-10f) for each individual identification (14a-14f). can provide the most recent timestamp. Method according to one of claims 1 to 6, wherein step c) is carried out in such a way that at least temporarily, preferably at any time, for a given individual identification (14a-14f) all data packets (10a-10f) with the exception of the data packet (10a-10f) are deactivated and/or archived with the most recent time stamp, so that they can no longer be called up by the terminal (12). Method according to one of Claims 1 to 7, in which the terminal (12) does not include a data processing program specifically tailored to the method and/or in which the terminal (12) is not registered for use in the method and/or in which at the issuing point (16a -16f) no electronic devices for reproducing variable connection information to the terminal (12) are provided. A data processing system (28) comprising means for performing steps a), b), c) and f) of the method of any one of claims 1 to 8. A computer program product comprising instructions used in the execution of the computer program by a data processing apparatus

(22a, 22b) of a system for data processing (28) cause this to carry out steps a), b), c) and f) of the method according to any one of claims 1 to 8.