payment system, the payment terminal of this system, and associated payment method

The present invention relates to a payment system and an electronic payment medium adapted to communicate with the payment terminal, the payment medium having thereon a post having a first residual value, and comprising:

a first rewritable memory, and

- a second fuse memory, comprising a plurality of matched bits to change state each time a single.

Today, payment systems using electronic payment media are multiplying. These payment systems are particularly advantageous because they allow automation of the payment transaction, and thus accelerating it. Electronic payment media used include items as diverse as electronic purses, holders of a fiat currency, payment cards, which allow the flow of a bank account after the remote transmission of a payment order , and prepaid cards, distributed by certain bodies and carriers of a monetary or non-monetary amount (such as conveyor units) representative of an electronic sum of money paid by the card user to the distributor body.

Examples of prepaid cards canteen cards, store cards, rental cards, card payphone or the public transport cards.

These prepaid cards must meet two conflicting objectives: they must firstly have a minimum cost of production and also have sufficient security to prevent tampering of the residual value of the monetary amount stored on the card.

There prepaid cards having a crypto processor, that is to say, a processor optimized for cryptographic tasks, adapted to block access to the memory of the card at unauthorized terminals. However, these cards have high manufacturing cost.

There are supports at reduced cost, such as contactless tickets, simply having means for communication with a terminal, a rewritable memory, and a fuse memory (called OTP memory, for "programmable one time"). In particular, these low-cost carriers do not include processor.

However, use of these materials as prepaid cards is problematic.

Indeed, if the amount is written in the rewritable memory of the support, it is easy for a malicious person to defraud by rewriting the residual value of that amount; the prepaid card security requirement is then not met. Another solution is to match the residual value of the amount loaded onto the card at the bit states of the fuse memory. However, the low number of bits of the fuse memory (typically a few tens) prevents using that memory to develop a monetary equivalent.

therefore an object of the invention to provide a system and method of payment using payment media at low cost and adapted to limit the possibility of fraud. Other objectives are to ensure atomicity and consistency of payment transactions.

To this end, the invention relates to a payment system of the aforementioned type, wherein the payment terminal is programmed to derive the first residual value of the combined reading of the first and second memories.

According to preferred embodiments of the invention, the payment system has one or more of the following features, (s) singly or in any (s) combination (s) technically possible (s):

- the payment medium is a contactless support, adapted to interact remotely with the payment terminal;

- the payment system is programmed to implement a method as defined below.

The invention also relates to a payment terminal of a system as defined above.

The invention further relates to a payment method by means of a payment medium adapted to interact remotely with a terminal for payment, the payment medium having thereon a post and comprising a first and a second rewritable memory fuse memory device comprising a plurality of matched bits to change state each time a single, characterized in that it comprises the following successive steps:

- placing in communication of the payment medium with the payment terminal, the post having a first residual value

reading the first and second memories, and

- deduction of the first residual value from the data read from the first and second memories.

According to preferred embodiments of the invention, the present payment method one or more of the following features, (s) singly or in any (s) combination (s) technically possible (s):

- said payment method comprises the steps of:

- allocation to the amount of a second residual value, lower than the first residual value in place of the first residual value, and

- change of state of at least one bit of the second memory, the or each bit from a first state to a second state, when the difference between the first and second residual values ​​exceeds a threshold value.

- the number of bits changing state is a function of the difference between the first and second residual values;

- an image of the first residual value is stored in the first memory, and the method comprises a step of writing in the first memory an image of the second residual value, replacing the image of the first residual value;

- an image of the first residual value is stored in the first memory, and the method further comprises the steps of:

- determining a range of allowed values ​​for the residual amount, the bit states of the function of the second memory,

- control of the balance between the image of the first residual value and the range of permitted residual value, and

- if the image of the first residual value exceeds the allowed residual value range, denying payment, or change the image of the first residual value to be in the range of allowable residual values;

- if the first residual value is less than the permitted range of residual values, said payment method comprises a step of changing the image of the first residual value to be in the range of allowable residual values;

- the method further comprises a step of writing a value of backup in the first memory,

the method is such that:

- the state change step of the or each bit occurs after the step of writing the image of the second residual value,

- a backup of the amount, having a first backup value is recorded in the first memory when the power to the payment communication carrier with the payment terminal, and in that

- the method comprises a further step of writing a second backup value, equal to the second residual value, replacing the first backup value, this step following the state change step least one bit of the second memory;

- said payment method further comprises the steps of:

- determining a range of allowed values ​​for the residual amount, the bit states of the function of the second memory,

- the adequacy of the image control from the first residual value and the first value of backup with the range of permitted residual value,

- if the image of the first residual value is outside the range of allowable residual values ​​and the first backup value is in the range of allowable residual values, change of the image of the first residual value to be equal the first backup value, or

- if the image of the first residual value is within the range of allowable residual values ​​and the first backup value is outside the range of allowable residual values, change of the first backup value to be equal to the image of the first residual value.

- the range of the determining step of allowable residual values ​​comprises the following steps:

- associating a predetermined range of values ​​for each bit of the second memory,

- identification of the last bit of the second memory have changed state, and

- determining the range of residual values ​​allowed to be equal to the predetermined range associated with the identified bit.

- the range of the determining step of allowable residual values ​​comprises the following steps:

- associating a predetermined range of values ​​at each integer between zero and the number of bits,

- counting the number of bits of the second memory has not changed state, and

- determining the range of residual values ​​allowed to be equal to the predetermined range associated with the number of counted bits. Other features and advantages of the invention will become apparent from reading the description which follows, given as an example only and with reference to the accompanying drawings, wherein:

Figure 1 is a schematic view of a payment system according to the invention, when payment medium of this system has never been used, Figure 2 is a view similar to Figure 1, where an amount which was loaded on the carrier was completely spent,

- Figure 3 is a diagram illustrating a relationship between bits states of a fuse memory of the medium and a range of residual values ​​for the amount according to a first embodiment of the invention, Figure 4 is a diagram illustrating a relationship between bits states of a support fuse memory and a range of residual values ​​for the amount according to a second embodiment of the invention, Figure 5 is a view similar to Figure 1 , following a step of changing an image of the residual value of the amount loaded on the carrier,

Figure 6 is a view similar to Figure 1, following a step change of state of several bits from the fuse memory,

Figure 7 is a view similar to Figure 1, following a step of writing a new amount of the safeguard value in a rewritable memory of the medium,

Figure 8 is a block diagram illustrating a method according to the invention. The payment system 10 according to the invention shown in Figure 1, comprises a payment terminal 12 and a contactless payment support 14, adapted to interact remotely with the payment terminal 12 to perform a payment transaction.

In known manner, the payment terminal 12 includes an antenna 20, a radio module 22 according to ISO 14443, adapted to remotely manage data exchange between the terminal 12 and the support 14, and a module 24 of Administration payment transaction between the terminal 12 and the support 14.

The payment medium 14 comprises an antenna 30, a radio module 32 according to ISO 14443, adapted to remotely manage data exchange between the terminal 12 and the support 14, a first memory 34 rewritable, a second memory 36 Fuse and a serial link 38 providing communication between the radio module 32 with the memories 34, 36. in particular, the payment medium 14 does not include a crypto processor.

Payment of support 14 carries a stud, with a first residual value. The amount is divided into units, itself divided into subdivisions; for example, in the case of a monetary amount in euros, the units are the euro, and the subdivisions are cents. The first residual value is expressed in units and subdivisions.

The amount is preferably a monetary amount. It corresponds to a sum of money paid by the user of the support 14 to a distributor of the support 14 to acquire the support 14. The residual value is equal to the initial value of the amount, which were removed any expenses already incurred by the user of the support 14 through the support 14.

Payment of support 14 is not rechargeable, that is to say, once the full amount spent, it is no longer possible to use the payment medium 14.

The fuse memory 36 comprises a plurality of bits 1, 2, 3, 4, 5, 6, 7, 8, each bit 1, 2, 3, 4, 5, 6, 7, 8 being adapted to be selectively in a first or a second state, and to change a single time condition. In particular, each bit 1, 2, 3, 4, 5, 6, 7, 8 is allowed to switch from the first state to the second state, but it is impossible to return from the second state to the first state.

In the example shown in Figure 1, all bits 1, 2, 3, 4, 5, 6, 7, 8 are in the first state. This corresponds to the configuration of the support 14 when it was acquired by its user. In the example shown in Figure 2, all bits 1, 2, 3, 4, 5, 6, 7, 8 are the second state. This corresponds to the configuration of the support 14 when the full amount has been spent.

The management module 24 is programmed to derive the first residual value of the amount of the combined reading of the first and second memories 34, 36. In particular, the term "joint reading", it is understood that it is necessary to the management module 24 of read these two memories 34, 36 to derive the first residual value, the reading of one of these memories 34, 36 is not sufficient for the deduction of the first residual value. This will be detailed below.

The management module 24 is also programmed to:

- calculating a second residual value of the amount equal to the difference between the first residual value and the price of a purchase made during the payment transaction,

- assigning the second residual value amount, replacing the first residual value, and

- controlling the change of state of at least one bit 6, 7, 8 of the second memory 36, from the first state to the second state when the difference between the first and second residual values ​​exceeds a threshold value. In a first embodiment of the invention, illustrated in Figures 1 to 8, a \ Λ image of the first residual value is stored in the first memory 34. Provided that the last payment transaction in which was involved the support 14 has taken place correctly, this image \ Λ is equal to the first residual value.

A backup M 'amount is also recorded in the first memory 34. This backup M' has a first backup value V /. Provided that the last payment transaction in which was involved the support 14 has proceeded correctly, the first backup value V / is equal to the first residual value.

Referring to Figures 3 and 4, the management module 24 is programmed to determine an authorized T range residuals for the amount depending on the bit states 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36. Thus, a malicious user who attempts to fraudulently change the image of the first residual value \ Λ to increase the value could not go beyond the permitted residual values ​​t range without this being detected by the payment terminal 12. the risks of fraud are reduced.

For this purpose, in a first variant of the invention, illustrated by Figure 3, the management module 24 associates a predetermined range T 0 , T ,, T 8 values at each integer i between zero and the number of bits 1, 2, 3, 4, 5, 6, 7, 8. Each predetermined range, respectively T 0 , T ,, ... T 8 , is bounded by a lower terminal, respectively B 0 , ..., B ,, ... B 8 , and an upper bound, respectively BB i + 1 , ... B 9 . The smallest lower bound B 0 is the value 0, and the largest upper bound B 9 is the initial value of the amount.

Preferably, the terminal is the smallest value immediately greater than 0. Thus, the predetermined range T 0 is limited to the value 0.

The management module 24 is adapted to, for each payment transaction count bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36 which are in the first state, and to determine the range residual value of T authorized as being equal to the predetermined range T 0 , T ,, ... T 8 associated with the number of counted bits. In the example shown in Figure 3, the number of bits 1, 2, 3, 4, 5 which are in the first state is equal to five, the management module 24 determines that the permitted range T of residuals is the predetermined range T 5 .

In a second preferred variant of the invention, illustrated by Figure 4, each predetermined range T 0 , ..., T ,, T 8 is not associated with an integer i, but at a particular bit i-1. To this end, the management module 24 is adapted to identify each bit 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36 specifically. One way to achieve such a specific identification is known to the skilled person and will not be described here.

The management module 24 is also programmed to identify the last bit 1

2, 3, 4, 5, 6, 7, 8 having changed state. This is for example realized by imparting a particular order to the bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36, the bits 1, 2, 3, 4, 5, 6, 7, 8 changing state according to this particular order. The last bit 1, 2, 3, 4, 5, 6, 7, 8 having changed state is easily identifiable as the second bit in the most advanced state in the status change command. In the example shown, bits 1, 2,

3, 4, 5, 6, 7, 8 change state in reverse numerical order, and the last bit to have changed state is bit 6.

The management module 24 is finally programmed to determine the T range residual values allowed to be equal to the predetermined range T 0 , T ,, T 8 associated with the last bit that changed state. In the example shown, the range T is thus equal to the predetermined range associated with the bit 6, namely T 7 .

Note that it is possible, particularly during the first use of the support 14, no bits have yet changed state. The predetermined range T 8 is associated with this case.

The management module 24 is further programmed to perform the following successive operations during a payment transaction using the carrier 14 in which the user of the support 14 makes a purchase at a given price:

- determine the T range of residual values ​​for the amount,

- monitor the adequacy of the image of the first residual value V ! and the first backup value V / with the range permitted residual values of T, that is to say to control the image of the first residual value V ! and the first backup value V / are in the range T, and o refuse payment and terminate the payment transaction if the image of the first residual value V ! is greater than the range T or o to change the image of the first residual value V ! to be equal to the first backup value V / if the image of the first residual value V ! is outside the range T and the safeguard value V / T is in the range, or

o change the first backup value V / to be equal to the image of the residual value \ Λ, if the image of the residual value \ Λ is in the range T and the residual value of backup V / is outside the range T, or

o change the image of the first residual value \ Λ to be equal to the lower bound of the range T, and changing the first backup value V / to be equal to the new first residual value, if the image of the first residual value V ! and the first backup value V / are both outside the range T o or let the image of the first residual value V ! and the first backup value V / unchanged, if they are both in the range T,

authorizing payment,

replace the image of the first residual value V ! by a picture of the second residual value V 2 (Figure 5),

if the second residual value V 2 is not in the range of allowed T residual values, in other words if the price is greater than a value range change threshold, equal to the difference between the first value Vi and infimum B 5 beach T, controlling the change of state of at least one bit 6, 7, 8 of the second memory 36 from the first state to the second state (see Figure 6), the number of bits 6, 7, 8 changes state being a function of the difference between the first and second residual values \ Λ, V 2 ,

- validate the payment,

- replace the first backup value V / second by a backup value V 2 '(Figure 7) equal to the second residual value V 2 , and terminate the payment transaction.

A payment method using the payment system 10 is described in relation to Figure 8. This process occurs when the user wants the support 14 make a purchase at a given price.

During a first step 100, the terminal 12 and the holder 14 are put into communication with each other. This operation is typically performed by placing the carrier 14 at a sufficient distance from the terminal 12 to enable the electromagnetic coupling of the antennas 20, 30 of the terminal 12 and the support 14.

Then, during a first step 102, the management module 24 reads the first and second memories 34, 36. In particular, the terminal 12 retrieves the information stored in the first memory 34, and:

- in the first variant of the invention, counting the bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36 which are in the first state, or

in the second variant of the invention, identifies the last bit of the second memory 36 to have changed state

The first step 102 is followed by a second step 104 of deriving the first residual value.

The second stage 104 comprises a first substep 105 of determining the range of allowed T residuals, in which:

in the first variant of the invention, the management module 24 determines the range T as being equal to the predetermined range T 8 associated with the number of bits 1, 2, 3, 4, 5, 6, 7, 8 counted as in the first state, or - in the second variant of the invention, the management module 24 determines the range T as being equal to the predetermined range T 8 associated with the last bit of the memory 36 have changed state.

Step 105 is followed by a step 1 10 control the adequacy of the image of the first residual value \ T with the permitted range of residual values. During this step 1 10, the management module 24 verifies that the image of the first residual value \ Λ is in the range T. If the image of the first residual value \ Λ is in the range T, the method proceeds to step 120; otherwise, the method proceeds to another step 130.

Steps 120 and 130 are steps of monitoring the adequacy of the first backup value V / T with the permitted range of residual values. During these steps 120, 130, the management module 24 checks whether the first backup value V / T is in the range

If, in step 120, the first backup value V / is in the range T, the method proceeds to step 140; otherwise, the method proceeds to another step 150.

If, in step 130, the first backup value V / is in the range T, the method proceeds to step 160; otherwise, the method proceeds to another step 170.

Step 140 is a step to authorize payment. During this step, the control module 24 concludes that the first residual value is equal to the image of the first residual value \ Λ recorded in the first memory 34. The module

Management 24 then considers the conditions necessary for the effective implementation of payment are met, and shall notify the other modules (not shown) of the payment terminal 12 also involved in the transaction, such a display module.

Step 150 is a step of in accordance with the first backup value V / with the image of the first residual value \ Λ. During this step, the first backup value V / is changed to be equal to the image of the first residual value \. In other words, the first backup value V / is rewritten, the new first backup value V / equal to the image of the first residual value \. Step 150 is followed by step 140.

Step 160 is a step of in accordance with the image of the first residual value V ! with the first backup value V /. During this stage, the image of the first residual value V ! is changed to be equal to the first backup value V /. In other words, the image of the first residual value V ! is rewritten, the new image of the first residual value V ! being equal to the backup value V /. Step 160 is followed by step 140.

Step 170 is a new step of monitoring the adequacy of the image of the first residual value \ Λ T with the permitted range of residual values. During this step, the control management module 24 if the image of the first residual value \ Λ is less than the range T. If the image of the first residual value \ Λ is actually lower than the range T, the method proceeds to step 180; otherwise, the method proceeds to step 190.

Step 180 is a step in accordance of the image of the first residual value \ Λ and the first backup value V /. During this step 180, the image of the first residual value \ Λ and the first backup value V / are changed to be equal to the lower bound of the range T. In other words, the image of the first residual value V ! and the first backup value V / are rewritten, the new image of the first residual value V ! and first backup value V / being equal to the lower bound of the range T. Alternatively, the new image of the first residual value V ! and first backup value V / are equal to another value of the range T. The step 180 is followed by step 140.

Step 190 is a step of denying payment. During this step, the management module 24 notes the failure of the deduction of the first residual amount and concludes that the carrier 14 has been tampered with. He refused as payment, and notify the other modules of the payment terminal 12 also

involved in the transaction. Step 190 is followed by a step 200 for stopping the transaction.

Steps 1 10, 120, 130, 140, 150 160, 170, 180, 190 are sub-steps of the second stage 104.

At the second step 104 is succeeded by a third step 202 a change in the residual amount. During this step 202, the management module 24 operates in the memories 34, 36 of the support 14 to affect the amount a second residual value, lower than the first residual value, replacing the first residual value. In particular, the second residual value is equal to the difference between the first residual value and the purchase price.

The third step 202 follows more particularly to step 140.

The third stage 202 includes a first sub-step 210 to change the image of the residual value of the amount. During this sub-step 210, the management module 24 replaces the image of the first residual value V ! by a picture of the second residual value V 2 equal to the second residual value.

Substep 210 is followed by a step 212 control membership the second residual value at the T allowable value range. If the second residual value does not belong to the range T, the step 212 is followed by a step 220 of change of state of at least one bit 6, 7, 8 of the second memory 36, the first state to the second state. If the second residual value is in the range T, the step 212 is directly followed by a step 230 to validate the payment.

The number of bits 6, 7, 8 changes state during the step 220 is a function of the difference between the first and second residual values. The number of bits 6, 7, 8 changing state is such that the second residual value is within the predetermined range T 0 , T ,, T 8 associated with the number of bits 1, 2, 3, 4, 5 remaining in the first state following the bits of the status change 6, 7, 8 (or associated with the last bit 6 having changed state following the change of state of said bits 6, 7, 8). Step 220 is followed by step 230.

In step 230, the management module 24 notifies the other modules of the terminal 12 also involved in the transaction that the payment was successful. Once this step, the user of the support 14 is free to enjoy his purchase.

A final step 240 to change the backup value M 'follows step 230. In this step, the management module 24 replaces the first backup value V / a second backup value V 2 ' equal to the second residual value. Step 240 is followed by step 200 to stop the transaction.

The steps 212, 220, 230, 240 are sub-steps of the third stage 202.

During step 200, the exchange of data between the terminal 12 and the holder 14 stop. The management module 24 notifies the display unit, indicating that the holder 14 may be remote from terminal 12.

Thanks to the invention, the risk of fraud is reduced. Indeed, a malicious user could trick the system 10 that changing the image of the residual value within the permitted range T residual values. Just choose intermediate terminals B 1; B 8 between predetermined ranges T 1; T 8 at appropriate values for that fraud is not sufficiently benefit the user to be prompted to commit.

In addition, the carrier 14 is inexpensive to produce.

Finally, atomicity and consistency of the payment transaction is assured. Indeed, in case of a sudden and unforeseen interruption of the transaction, the presence of the safeguard value V /, V 2 'and the order of steps of the payment method used to restore the consistency of the data recorded on the media 14 .

Note that, in the example given above, the support payment 14 is usable if the image of the first residual value \ Λ is greater than the T range of permitted residual values. Alternatively, rather than being programmed to refuse payment if the image of the first residual value \ Λ is greater than the T range of permitted residual values, the management module 24 is programmed to change the image of the first residual value \ Λ so that it is equal to the lower bound of the range of allowed T residual values.

In a second embodiment of the invention, not illustrated, the first residual value divided into a first main residual value and a first secondary residual value. Advantageously, the main residual value is made an integer of value units and the secondary residual value is made a whole number of subdivisions of the amount. In the case of a monetary amount in euros, the main residual value is thus equal to a whole number of euros, and the secondary residual value is equal to a whole number of cents.

For example, the main residual value is rounded by the truncation of the first residual value to the lower unit, and the secondary residual value is equal to the difference between the first residual and the main residual value; the first residual value is reconstructed, by adding the main and sub residual values. Alternatively, the main residual value is equal to the rounding of the first residual value to the next unit, and the secondary residual value is equal to the difference between the main residual value and the first residual value; the first residual value is then equal to the difference between the main and sub residual values.

An image of the main residual value is stored in the second memory 36, and an image of the secondary residual value is stored in the first memory 34.

The main residual value is typically equal to the number of bits 1, 2, 3, 4, 5, 6, 7, 8 which are in the first state.

The image of the secondary residual value is typically an integer between 0 and n, where n is the number of subdivisions of each unit amount. For example, in the case of a monetary amount, n is 99.

The management module 24 is programmed to derive the first residual value of the amount of the images of main and sub residual values. Typically, the management module 24 is programmed to:

- counting the number of bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36 which are in the first state, and deduce that the main residual value is equal to the number of counted bits,

- deduct the secondary residual value as being equal to the image of the secondary residual value, multiplied by 1 / (n + 1), and

- deduct the first residual value as being equal to the sum (alternatively the difference) of the main and secondary residual values.

The management module 24 is also programmed to cancel the transaction if the image of the high residual value is strictly greater than n. Alternatively, the management module 24 is programmed to derive a zero value of the secondary residual value if the image of the secondary residual value is strictly greater than n.

As mentioned above, the management module 24 is further programmed to assign a second value to the residual amount, replacing the first residual value, when payment is made by means of the support 14. For this purpose, the module management 24 is programmed to:

- subdivide the second residual value in a second main residual value and a second secondary residual value,

if the second main residual value is different from the first main residual value, controlling the change of state of at least one bit 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36, so that the number of bits remaining in the first state after this change of state is equal to the second main residual value, and

write in the first memory 34 an image of the second secondary residual value, replacing the image of the first secondary residual value.

In this embodiment, the safety support 14 is preserved. Indeed, because of the irreversibility of changes to bits 1, 2, 3, 4, 5, 6, 7, 8, a malicious user could not change the primary value of the residual amount, except to reduce celle- one, which would be against-productive.

The management module 24 also failed to perform cross-checking between the first and second memories 34, 36 to verify the validity of the first data memory 34, unlike the first embodiment. The transaction is faster.

Note that, in the embodiments given above, the second memory 36 includes only eight bits 1, 2, 3, 4, 5, 6, 7, 8. This information is not exhaustive, and the number bits of the second memory 36 may be any. Most often, the second memory 36 include thirty-two bits.

1 . - Procédé de paiement au moyen d'un support de paiement (14) adapté pour dialoguer à distance avec un terminal de paiement (12), le support de paiement (14) étant porteur d'un montant et comprenant une première mémoire (34) réinscriptible et une deuxième mémoire (36) à fusibles, comprenant une pluralité de bits (1 , 2, 3, 4, 5, 6, 7, 8) adaptés pour changer d'état une unique fois chacun, caractérisé en ce qu'il comprend les étapes successives suivantes :

- mise en communication (100) du support de paiement (14) avec le terminal de paiement (12), le montant ayant une première valeur résiduelle

- lecture des première et deuxième mémoires (34, 36), et

- déduction de la première valeur résiduelle à partir des données lues dans les première et deuxième mémoires (34, 36),

et les étapes suivantes :

- affectation (210) au montant d'une deuxième valeur résiduelle, inférieure à la première valeur résiduelle en remplacement de la première valeur résiduelle, et

- changement d'état (220) d'au moins un bit (6, 7, 8) de la deuxième mémoire (36), le ou chaque bit (6, 7, 8) passant d'un premier état à un deuxième état, lorsque la différence entre les première et deuxième valeurs résiduelles est supérieure à une valeur seuil.

2. - Procédé de paiement selon la revendication 1 , caractérisé en ce que le nombre de bits (6, 7, 8) changeant d'état est fonction de la différence entre les première et deuxième valeurs résiduelles.

3. - Procédé de paiement selon la revendication 1 ou 2, caractérisé en ce qu'une image (\Λ) de la première valeur résiduelle est enregistrée dans la première mémoire

(34), et en ce que le procédé comprend une étape (210) d'écriture dans la première mémoire (34) d'une image (V2) de la deuxième valeur résiduelle, en remplacement de l'image de la première valeur résiduelle (\ )

4. - Procédé de paiement selon l'une quelconque des revendications précédentes, caractérisé en ce qu'une image (\ ) de la première valeur résiduelle est enregistrée dans la première mémoire (34), et en ce que le procédé comprend en outre les étapes suivantes :

- détermination (105) d'une plage (T) de valeurs résiduelles autorisées pour le montant, fonction des états des bits (1 , 2, 3, 4, 5, 6, 7, 8) de la deuxième mémoire (36),

- contrôle (1 10, 170) de l'adéquation entre l'image de la première valeur résiduelle (\Λ) et la plage de valeur résiduelles autorisées (T), et

- si l'image de la première valeur résiduelle (\Λ) est supérieure à la plage de valeur résiduelles autorisées (T), refus du paiement (190), ou changement de l'image de la première valeur résiduelle (\Λ) pour qu'elle soit comprise dans la plage de valeurs résiduelles autorisées (T).

5. - Procédé de paiement selon la revendication 4, caractérisé en ce que, si la première valeur résiduelle (\ ) est inférieure à la plage de valeurs résiduelles autorisées (T), il comprend une étape (160, 180) de changement de l'image de la première valeur résiduelle (\ ) pour qu'elle soit comprise dans la plage de valeurs résiduelles autorisées (T).

6. - Procédé de paiement selon la revendication 3, caractérisé en ce que :

- l'étape (220) de changement d'état du ou de chaque bit (6, 7, 8) a lieu après l'étape (210) d'écriture de l'image de la deuxième valeur résiduelle (V2), - une sauvegarde (Μ') du montant, ayant une première valeur de sauvegarde

(V/), est enregistrée dans la première mémoire (34) lors de la mise en communication (100) du support de paiement (14) avec le terminal de paiement (12), et en ce que

- le procédé comprend une étape supplémentaire (240) d'écriture d'une deuxième valeur de sauvegarde (V2'), égale à la deuxième valeur résiduelle, en remplacement de la première valeur de sauvegarde (V/), cette étape faisant suite à l'étape (220) de changement d'état d'au moins un bit (6, 7, 8) de la deuxième mémoire (36).

7. - Procédé de paiement selon la revendication 6, caractérisé en ce qu'il comprend en outre les étapes suivantes :

- détermination (105) d'une plage (T) de valeurs résiduelles autorisées pour le montant, fonction des états des bits (1 , 2, 3, 4, 5, 6, 7, 8) de la deuxième mémoire (36),

- contrôle (1 10, 120, 130, 170) de l'adéquation de l'image de la première valeur résiduelle (\ ) et de la première valeur de sauvegarde (V/) avec la plage de valeur résiduelles autorisées (T), et

- si l'image de la première valeur résiduelle (\ ) est hors de la plage de valeurs résiduelles autorisées (T) et la première valeur de sauvegarde (V/) est dans la plage de valeurs résiduelles autorisées (T), changement (160) de l'image de la première valeur résiduelle (\Λ) pour qu'elle soit égale à la première valeur de sauvegarde (V/), ou

- si l'image de la première valeur résiduelle (\Λ) est dans la plage de valeurs résiduelles autorisées (T) et la première valeur de sauvegarde (V/) est hors de la plage de valeurs résiduelles autorisées (T), changement (150) de la première valeur de sauvegarde (V/) pour qu'elle soit égale à l'image de la première valeur résiduelle (\Λ).

8. - Procédé de paiement selon l'une quelconque des revendications 4, 5 ou 7, caractérisé en ce que l'étape (105) de détermination de la plage de valeurs résiduelles autorisées (T) comprend les étapes suivantes :

- association d'une plage prédéterminée (T0, T,, T8) de valeurs à chaque bit (1 , 2, 3, 4, 5, 6, 7, 8) de la deuxième mémoire (36),

- identification du dernier bit (6) de la deuxième mémoire (36) à avoir changé d'état, et

- détermination de la plage de valeurs résiduelles autorisées (T) comme étant égale à la plage prédéterminée (T0, T,, T8) associée au bit (6) identifié.

9. - Procédé de paiement selon l'une quelconque des revendications 4, 5 ou 7, caractérisé en ce que l'étape (105) de détermination de la plage de valeurs résiduelles autorisées (T) comprend les étapes suivantes :

- association d'une plage prédéterminée (T0, T,, T8) de valeurs à chaque nombre entier compris entre zéro et le nombre de bits (1 , 2, 3, 4, 5, 6, 7, 8),

- décompte du nombre de bits (1 , 2, 3, 4, 5) de la deuxième mémoire (36) n'ayant pas changé d'état, et

- détermination de la plage de valeurs résiduelles autorisées (T) comme étant égale à la plage prédéterminée (T0, T,, T8) associée au nombre de bits décomptés.

10. - Système de paiement (10) comprenant un terminal de paiement (12) et un support de paiement électronique (14) adapté pour dialoguer avec le terminal de paiement (12), le support de paiement (14) étant porteur d'un montant ayant une première valeur résiduelle, et comprenant :

une première mémoire (34) réinscriptible, et

- une deuxième mémoire (36) à fusibles, comprenant une pluralité de bits (1 , 2, 3, 4, 5, 6, 7, 8) adaptés pour changer d'état une unique fois chacun, caractérisé en ce que le terminal de paiement (12) est programmé pour déduire la première valeur résiduelle de la lecture conjointe des première et deuxième mémoires (34, 36), pour affecter au montant une deuxième valeur résiduelle, inférieure à la première valeur résiduelle, en remplacement de la première valeur résiduelle, et pour commander le changement d'état d'au moins un bit (6, 7, 8) de la deuxième mémoire (36) lorsque la différence entre les première et deuxième valeurs résiduelles est supérieure à une valeur seuil.

1 1 . - Système de paiement (10) selon la revendication 10, caractérisé en ce que le support de paiement (14) est un support sans contact, adapté pour dialoguer à distance avec le terminal de paiement (12)

12. - Système de paiement (10) selon la revendication 10 ou 1 1 , caractérisé en ce que le terminal de paiement (12) est programmé pour mettre en œuvre un procédé selon l'une quelconque des revendications 1 à 9.

13. - Terminal de paiement (12) d'un système de paiement (10) selon l'une quelconque des revendications 10 à 12.