Payment System, Payment Terminal for this System, and Associated Method of
Payment
The present invention relates to a payment system and an electronic payment
medium capable of communicating with the payment terminal, the payment medium bearing
5 an amount that carries a first residual value, and comprising :
o a first rewritable memory, and
o a second fuse memory, comprising a plurality of bits each adapted to be able to change
its state one single time.
At the present time, payment systems using electronic payment media continue to
10 multiply. These payment systems are particularly advantageous because they allow
automation of the payment transaction and, therefore enable the acceleration thereof. The
electronic payment media used include objects and items that are as diverse as electronic
purses, media bearing fiduciary money, payment cards, which provide for a bank account to
be debited following the transmission of a payment order and prepaid cards, distributed by
15 certain organisations carrying a monetary or non monetary electronic amount (such as
transportation units) representing a sum of money paid by the user of the card to the card
distributing organisation.
Examples of prepaid cards include canteen cards, store cards, rental - leasing cards,
payphone cards, and public transit cards.
20 These prepaid cards must satisfactorily address two conflicting objectives : on the
one hand they must have a minimal cost of production, and on the other hand they must also
provide sufficient security in order to prevent fraudulent manipulations of the residual value of
the monetary amount stored on the card.
There are prepaid cards in existence having a crypto processor, that is to say a
25 processor optimised for cryptographic tasks that is capable of blocking access to the memory
of the card at unauthorised terminals. However, these cards have a high manufacturing cost.
There are also low cost media, such as contactless tickets, merely comprising the
means for communicating with a terminal, a rewritable memory, and a fuse memory (referred
to as OTP memory, short for "one time programmable"). These low cost media in particular,
30 do not include a processor.
However, the use of such media as prepaid cards is problematic. Indeed, if the
amount is written into the rewritable memory of the medium, it is easy for an ill intentioned
person to defraud the system by rewriting the residual value of that amount ; thus the
security requirement of the prepaid card is then not satisfied. Another solution is to make the
35 residual value of the amount loaded onto the card correspond to the states of the bits of the
fuse memory. However, the low number of bits in the fuse memory (usually there are some
tens of them) prevents this memory from being used to develop a monetary equivalent.
An objective of the invention is therefore to provide a system and a method of
payment using payment media that have low production costs and are designed to limit the
5 possibility of fraud. Other objectives are to ensure the atomicity and consistency of payment
transactions.
To this end, the invention relates to a payment system of the aforementioned type, in
which the payment terminal is programmed so as to derive the first residual value from the
joint reading of the first and second memories.
10 According to the preferred embodiments of the invention, the payment system has
one or more of the following characteristic features, which may be considered individually or
in accordance with all technically possible combinations :
- the payment medium is a contactless medium, which is capable of communicating
remotely with the payment terminal ;
15 - the payment system is programmed so as to implement a method as defined here
below.
The invention also relates to a payment terminal for a system as defined here above.
The invention in addition relates to a method of payment by means of a payment
medium that is capable of communicating remotely with the payment terminal, the payment
20 medium being capable of bearing an amount and including a first rewritable memory and a
second fuse memory, comprising a plurality of bits each adapted to be able to change its
state one single time, characterised in that it comprises the following successive steps :
o placing in communication of the payment medium with the payment terminal, with the
amount having a first residual value
25 o reading of the first and second memories, and
o deducing of the first residual value from the data read from the first and second
memories.
According to the preferred embodiments of the invention, the method of payment has
one or more of the following characteristic features, which may be considered individually or
30 in accordance with all technically possible combinations :
- the said payment method consists of the following steps :
o assigning of a second residual value to the amount, which is lower than the
first residual value, in replacement of the first residual value, and
o changing of the state of at least one bit of the second memory, the or each bit
switching from a first state into a second state, when the difference between
the first and the second residual values is greater than a threshold value.
- the number of bits changing state is a function of the difference between the first
5 and second residual values ;
- an image of the first residual value is stored in the first memory, and the method
includes a step of writing into the first memory an image of the second residual value, in
replacement of the image of the first residual value
- an image of the first residual value is .stored in the first memory, and the method
10 further comprises the following steps :
o determination of a range of permissible residual values for the amount, which is
a function of the states of the bits of the second memory,
o checking and verifying the appropriateness of the image of the first residual
value with respect to the range of permissible residual values, and
o if the image of the first residual value is greater than the range of permissible
residual values, refusal of payment, or changing the image of the first residual
value in order for it to be included within the range of permissible residual
values;
- if the first residual value is lower than the range of permissible residual values, said
20 payment method includes a step of changing the image of the first residual value in order for
it to be included within the range of permissible residual values;
- the method also includes a step of writing of a backup of the amount in the first
memory,
-the method is such that :
o the step of changing of the state of the or each bit takes place after the step of
writing the image of the second residual value,
o a backup of the amount, having a first backup value, is stored in the first
memory during the placing in communication of the payment medium with the
payment terminal, and in that
o the method includes an additional step of writing a second backup value, equal
to the second residual value, in replacement of the first backup value, this step
following the step of changing the state of at least one bit of the second
memory;
- said payment method further comprises the following steps :
o determination of a range of permissible residual values for the amount, which is
dependent upon the states of the bits of the second memory,
o checking and verifying the appropriateness of the image of the first residual
value and the first back up value with respect to the range of permissible
residual values, and
o if the image of the first residual value is outside the range of permissible
residual values and the first backup value is within the range of permissible
residual values, changing the image of the first residual value in order for it to be
equal to the first backup value, or
o if the image of the first residual value is within the range of permissible residual
values and the first backup value is outside the range of permissible residual
values, changing the first backup value in order for it to be equal to the image of
the first residual value.
- the step of determining the range of permissible residual values includes the
15 following steps :
o association of a predetermined range of permissible residual values with each
bit of the second memory,
o identification of the last bit of the second memory which has changed state, and
o determination of the range of permissible residual values as being equal to the
predetermined range associated with the identified bit.
- the step of determining the range of permissible residual values includes the
following steps :
o association of a predetermined range of values with each integer (whole
number) lying between zero and the number of bits,
o counting of the number of bits of the second memory that have not changed
state, and
o determination of the range of permissible residual values as being equal to the
predetermined range associated with the number of bits counted.
Other characteristic features and advantages of the invention will become apparent
30 upon reading the description that follows, provided purely by way of example and with
reference made to the accompanying drawings, in which :
- Figure 1 is a schematic view of a payment system according to the invention,
when a payment medium for this system has never been used,
- Figure 2 is a view that is similar to Figure 1, when the amount that was loaded
onto the medium has been completely spent,
- Figure 3 is a diagram illustrating a link between the states of bits in a fuse
memory of the medium and a range of permissible residual values for the amount,
according to a first embodiment of the invention,
- Figure 4 is a diagram illustrating a link between the states of bits in a fuse
memory of the medium and a range of permissible residual values for the amount,
according to a second embodiment of the invention,
- Figure 5 is a view that is similar to Figure 1, following after the step of changing
an image of the residual value of the amount loaded onto the medium,
- Figure 6 is a view that is similar to Figure 1, following upon a step of changing the
state of several bits of the fuse memory,
- Figure 7 is a view that is similar to Figure 1, following upon a step of writing a new
backup value of the amount in a rewritable memory of the medium,
- Figure 8 is a block diagram illustrating a method according to the invention.
The payment system 10 according to the invention, shown in Figure 1, comprises of a
15 payment terminal 12, and a contactless payment medium 14, capable of communicating
remotely with the payment terminal 12 in order to carry out a payment transaction.
In a known manner, the payment terminal 12 includes an antenna 20, a radio module
22 in accordance with the IS0 14443 standard, suitable for managing the exchange of data
remotely between the terminal 12 and the medium 14, and a module 24 for management of
20 the payment transaction between the terminal 12 and the medium 14.
The payment medium 14 includes an antenna 30, a radio module 32 in accordance
with the IS0 14443 standard, suitable for managing the exchange of data remotely between
the terminal 12 and the meditim 14, a first rewritable memory 34, a second fuse memory 36,
and a serial link 38 placing in communication the radio module 32 with the memories 34, 36.
25 In particular, the payment medium 14 does not include a crypto processor.
The payment medium 14 carries an amount having a first residual value. The amount
is divided into units, which are themselves divided into subdivisions; for example, in the case
of a monetary amount denominated in euros, the units are euros and the subdivisions are
euro cents. The first residual value is denoted in number of units and subdivisions.
30 The amount is preferably a monetary amount. It corresponds to a sum of money paid
by the user of the medium 14 to a distributor of the medium 14 in order to acquire the
medium 14. The residual value is equal to the initial value of the amount, from which have
been withdrawn any eventual expenses already incurred by the user of the medium 14 that
have been paid for by means of the medium 14.
The payment medium 14 is not rechargeable; that is to say that, once the full amount
has been spent, it is no longer possible to use the payment medium 14.
The fuse memory 36 comprises a plurality of bits 1, 2, 3, 4, 5, 6, 7, 8 , each bit 1, 2, 3,
4, 5, 6, 7, 8 being adapted so as to selectively be in a first or a second state, and to be able
5 to change state one single time. In particular, each bit I, 2, 3, 4, 5, 6, 7, 8 is allowed to switch
from the first state to the second state, but it is impossible for it to return from the second
state to the first state.
In the example shown in Figure 1, all the bits 1, 2, 3, 4, 5, 6, 7, 8 are in the first state.
This corresponds to the original configuration of the medium 14 at the time that it was
10 acquired by its user. In the example shown in Figure 2, all the bits I, 2, 3, 4, 5, 6, 7, 8 are in
the second state. This corresponds to the configuration of the medium 14 when the entire
amount has been spent.
The management module 24 is programmed so as to derive the first residual value of
the amount from the joint reading of the first and second memories 34, 36. In particular, the
15 term 'Toint reading" is understood to mean that it is necessary for the management module
24 to read both these two memories 34, 36 in order to derive therefrom the first residual
value, the reading of only one of these memories 34, 36 not being sufficient for deducing of
the first residual value. This point shall be detailed in the following sectionls.
The management module 24 is also programmed so as to carry out the following :
- calculating a second residual value of the amount, equal to the difference
between the first residual value and the price for a purchase paid for during the
payment transaction ,
o assigning the second residual value to the amount, in replacement of the first
residual value, and
- ordering the change of state of at least one bit 6, 7, 8 of the second memory 36,
from the first state to the second state, when the difference between the first and
second residual values is greater than a threshold value.
In a first embodiment of the invention, illustrated in Figures 1 to 8, an image V1 of the
first residual value is stored in the first memory 34. Provided that the most recent payment
30 transaction in which the medium 14 has been involved has been correctly carried out, the
image V1 is equal to the first residual value.
A backup M' of the amount is also stored in the first memory 34. This backup M' has a
first backup value V,'. Provided that the most recent payment transaction in which the
medium 14 has been involved has been correctly carried out, the first backup value V,' is
35 equal to the first residual value.
With reference to Figures 3 and 4, the management module 24 is programmed so as
to determine a range T of permissible residual values for the amount depending upon the
states of the bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36. Thus, an ill intentioned or
unauthorised user who would attempt to fraudulently change the image of the first residual
5 value V, in order to increase the value could not go beyond the range of permissible residual
values T without it being detected by the payment terminal 12. The risks of fraud are
therefore reduced.
To this end, in a first variant of the invention, as illustrated in Figure 3, the
management module 24 associates a predetermined range To, ..., Ti, ..., T8 of values with
10 each integer i lying between zero and the number of bits 1, 2, 3, 4, 5, 6, 7, 8. Each
predetermined range, respectively To, ..., Ti, ... T8 is bounded by a lower limit, respectively Bo,
... , Bi, ... Be, and by an upper limit, respectively. B,, ..., Bi,,, ... Bg . The lowest lower limit Bo
is the value 0, and the highest upper limit B, is the initial value of the amount.
Preferably, the limit B, is the lowest value immediately greater than 0. Thus, the
15 predetermined range To is limited to the value 0.
The management module 24 is capable of, for each payment transaction, counting
the bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36, which are in the first state, and of
determining the range T of permissible residual values as being equal to the predetermined
range To, ..., Ti, ... T8 associated with the number of bits counted. In the example shown in
20 Figure 3, the number of bits 1, 2, 3, 4, 5 which are in the first state being equal to five, the
management module 24 determines that the range T of permissible residual values is the
predetermined range T5.
In a second preferred variant of the invention, as illustrated in Figure 4, each
predetermined range To, ..., Ti, ..., T8 is associated not with an integer i, but with a particular
25 bit i-1. To this end, the management module 24 is capable of identifying each bit 1, 2, 3, 4, 5,
6, 7, 8 of the second memory 36 in a specific manner. One way of carrying out such a
specific identification is known to the person skilled in the art and will not be described here.
The management module 24 is also programmed so as to identify the last bit 1, 2, 3,
4, 5, 6, 7, 8 that has changed state. This is for example accomplished by assigning a
30 particular order to the bits 1, 2, 3, 4, 5, 6, 7, 8 of the second memory 36, with the bits I, 2, 3,
4, 5, 6, 7, 8 changing state according to this particular order. The last bit 1, 2, 3, 4, 5, 6, 7, 8
to have changed state is therefore easily identifiable as being the bit in the second state that
has been assigned the furthest placement in terms of the order of changing its state. In the
example shown, the bits I, 2, 3, 4, 5, 6, 7, 8 change state according to the reverse order of
35 their numbering, and the last bit to have changed its state is the bit 6 .
The management module 24 is finally programmed in order to determine the range T
of permissible residual values as being equal to the predetermined range To, ..., Ti, ..., T8
associated with the last bit to have changed state. In the example shown, the range T is thus
equal to the predetermined range associated with bit 6, namely T7.
5 It should be noted that it is possible, in particular during the first time that the medium
14 is used, that none of the bits has as yet changed state. The predetermined range T8 is
associated with this scenario.
The management module 24 is in addition programmed so as to perform the following
successive operations at the time that a payment transaction is carried out by means of the
10 medium 14 during which the user of the medium 14 pays for a purchase at a given price :
- determining the range T of permissible residual values for the amount,
- checking and verifying the appropriateness of the image of the first residual value
V1 and the first back up value V1' with respect to the range T of permissible
residual values, that is to say, checking and verifying that the image of the first
residual value V1 and first backup value V1' are included within the range T, and
o refusing the payment and terminating the payment transaction if the image
of the first residual value V, is greater than the range T, or
o changing the image of the first residual value V1 in order for it to be equal
to the first backup value V1', if the image of the first residual value V1 is
outside the range T and the backup value V,' is within the range T, or
o changing the first backup value V,' in order for it to be equal to the image
of the residual value V1, if the image of the residual value V1 is within the
range T and the backup residuai vaiue V1' is outside the range T, or
o changing the image of the first residual value V, in order for it to be equal
to the lower limit of the range T, and changing the first backup value V1' in
order for it to be equal to the new first residual value, if the image of the
first residual value V1 and the first backup value V1' are both outside the
range T, or
o leaving the image of the first residual value V1 and the first backup value
V1' unchanged, if they are both within the range T,
- authorising the payment,
- replacing the image of the first residual value V, by an image of the second
residual value V, (Figure 5),
- if the second residual value V2 is not within the range T of permissible residual
values, in other words if the price is higher than a threshold value for the change
in range, equal to the difference between the first value V1 and the lower limit B5
of the range T, ordering the change of state of at least one bit 6, 7, 8 of the
second memory 36 from the first state to the second state (see Figure 6), the
number of bits 6, 7, 8 changing state being a function of the difference between
the first and second residual values V,, V2 ,
- validating the payment,
- replacing the first backup value V,' by a second backup value VZ1 (Figure 7) that is
equal to the second residual value V2 , and
- termination of the payment transaction.
10 A method of payment by means of using the payment system 10 will now be
described, with reference to Figure 8. This method is followed when the user of the medium
14 wishes to make a purchase at a given price.
During a first step 100, the terminal 12 and the medium 14 are placed in
communication with each other. This operation is typically carried out by placing the medium
15 14 at a sufficient distance from the terminal 12 in order to allow the electromagnetic coupling
of the antennas 20, 30 of the terminal 12 and the medium 14.
Then, in a first step 102, the management module 24 reads the first and second
memories 34, 36. In particular, the terminal 12 retrieves the information stored in the first
memory 34, and :
20 - in the first variant of the invention, counts the bits I, 2, 3, 4, 5, 6, 7, 8 of the
second memory 36 that are in the first state, or
- in the second variant of the invention, identifies the last bit of the second memory
36 to have changed state
This first step 102 is followed by a second step 104 of deducing the first residual
25 value.
The second step 104 includes a first sub step 105 of determining the range T of
permissible residual values, during which :
- in the first variant of the invention, the management module 24 determines the
range T as being equal to the predetermined range T8 associated with the number
of bits I , 2, 3, 4, 5, 6, 7, 8 counted as being in the first state, or
- in the second variant of the invention, the management module 24 determines the
range T as being equal to the predetermined range T8 associated with the last bit
of the memory 36 to have changed state.
Step 105 is followed by a step 110 of checking and verifying the appropriateness of
35 the image of the first residual value V, with respect to the range T of permissible residual
values. During this step 110, the management module 24 verifies that the image of the first
residual value V1 is included within the range T. If the image of the first residual value V1 is
indeed within the range T, the method proceeds to a step 120; in the event of the contrary
scenario, the method proceeds to another step 130.
5 The steps 120 and 130 are the steps for checking and verifying the appropriateness
of the first backup value VI1 with respect to the range T of permissible residual values. During
these steps 120, 130, the management module 24 verifies that the first backup value V1 is
included within the range T.
If, during step 120, the first backup value V1' is indeed within the range T, the method
10 proceeds to step 140 ; in the event of the contrary scenario, the method proceeds to another
step 150.
If, during step 130, the first backup value V1' is indeed within the range T, the method
proceeds to step 160 ; in the event of the contrary scenario, the method proceeds to another
step 170.
15 The step 140 is a step for authorisation of the payment. During this step, the
management module 24 deduces that the first residual value is equal to the image of the first
residual value V1 stored in the first memory 34. The management module 24 thus deems that
the conditions necessary for the effective completion of payment have been met, and notifies
this to the other modules (not shown) of the payment terminal 12 that are also involved in the
20 transaction, for example, to a display module.
Step 150 is the step of bringing about conformity of the first backup value V1' with the
image of the first residual value V1. During this step, the first backup value V1' is changed to
be equal to the image of the first residual value V1. In othei words, the first backup value V1'
is rewritten, the new first backup value V1' being equal to the image of the first residual value
25 V1. The step 150 is followed by step 140.
Step 160 is the step of bringing about conformity of the image of the first residual
value V1 with the first backup value V1'. During this step, the image of the first residual value
V1 is changed so as to be equal to the first backup value V1'. In other words, the image of the
first residual value V1 is rewritten, with the new image of the first residual value V1 being
30 equal to the backup value V1'. The step 160 is followed by step 140.
Step 170 is a new step of checking and verifying the appropriateness of the image of
the first residual value V1 with respect to the range T of permissible residual values. During
this step, the management module 24 checks whether the image of the first residual value V1
is lower than the range T. If the image of the first residual value V1 is in fact lower than the
range T, the method proceeds to step 180 ; in the event of the contrary scenario, the method
proceeds to a step 190.
Step 180 is the step of bringing about conformity of the image of the first residual
value V1 and the image of the first backup value V,'. During this step 180, the images of the
5 first residual value V1 and the first backup value V,' are changed so as to be equal to the
lower limit of the range T. In other words, the images of the first residual value V, and the first
backup value V,' are rewritten, with the new images of the first residual value V, and the first
backup value V,', being equal to the lower limit of the range T. By way of a variant, the new
images of the first residual value V, and the first backup value V,' are equal to another value
10 in the range T. Step 180 is followed by step 140.
Step 190 is a step of refusal of the payment. During this step, the management
module 24 notes the failure in deducing the first residual value of the amount and deduces
therefrom that the medium 14 has been tampered with. It refuses the latter as a means of
payment, and notifies this to the other modules of the payment terminal 12 that are also
15 involved in the transaction. The step 190 is followed by a step 200 for stopping the
transaction.
The steps 110, 120, 130, 140, 150 160, 170, 180, 190 are sub steps of the second
step 104.
The second step 104 is followed by a third step 202 of changing the residual value of
20 the amount. During this step 202, the management module 24 acts upon the memories 34,
36 of the medium 14 in order to assign to the amount a second residual value, which is lower
than the first residual value, in replacement of the first residual value. In particular, the
second residua! value is equa! to the difference between the first residual value and the
purchase price.
The third step 202 more particularly follows after step 140.
The third step 202 includes a first sub step 210 of changing the image of the residual
value of the amount. In this sub step 210, the management module 24 replaces the image of
the first residual value V1 by an image of the second residual value V2, which is equal to the
second residual value.
30 Sub step 210 is followed by a step 212 of checking whether the second residual value
belongs to the range T of permissible residual values. If the second residual value does not
belong to the range T, the step 212 is followed by a step 220 of changing the state of at least
one bit 6, 7, 8 of the second memory 36, from the first state to the second state. If the second
residual value belongs to the range T, the step 212 is directly followed by a step 230 of
35 validation of the payment.
The number of bits 6, 7, 8 changing state during the step 220 is a function of the
difference between the first and second residual values. The number of bits 6, 7, 8 changing
state is such that the second residual value is included within the predetermined range To,
..., T,, ..., T8 associated with the number of bits 1, 2, 3, 4, 5 remaining in the first state
5 following the change of state of the bits 6, 7, 8 (or associated with the last bit 6 to have
changed state following the change of state of the said bits 6, 7, 8). Step 220 is followed by
step 230.
During step 230, the management module 24 notifies the other modules of the
terminal 12 that are also involved in the transaction that the payment was successfully
10 carried out. Once this step is completed, the user of the medium 14 is free to enjoy their
purchase.
A final step 240 of changing the value of the backup M' follows after step 230. During
this step, the management module 24 replaces the first backup value V,', with a second
backup value VZ1, which is equal to the second residual value. The step 240 is followed by
15 step 200 for stopping the transaction.
The steps 212, 220, 230, 240 are sub steps of the third step 202.
During step 200, the exchange of data between the terminal 12 and the medium 14
stops. The management module 24 notifies this to the display module, which indicates that
the medium 14 may be removed from the terminal 12.
20 Thanks to the invention, the risks of fraud are reduced. Indeed, an ill intentioned or
unauthorised user could only trick the system 10 by modifying the image of the residual value
within the range T of permissible residual values. It is sufficient to choose intermediate limits
B,, ..., B8 between the predetermined ranges TI, ..., i8having appropriate values in order for
the fraud to not be profitable enough for the user to be induced into the commitment thereof.
In addition, the medium 14 is inexpensive to produce.
Finally, the atomicity and consistency of the payment transaction are ensured.
Indeed, in the event of the unexpected, sudden interruption of the transaction, the presence
of the backup value Vi', V; and the order of the steps of the payment method make it
possible to restore the consistency of the data recorded on the medium 14.
30 It should be noted that in the example given here above, the payment medium 14 is
no longer usable if the image of the first residual value V, is greater than the range T of
permissible residual values. By way of a variant, rather than being programmed to refuse the
payment if the image of the first residual value Vi is greater than the range T of permissible
residual values, the management module 24 is programmed so as to change the image of
the first residual value V, in a manner such that it is equal to the lower limit of the range T of
permissible residual values.
In a second embodiment of the invention, not illustrated, the first residual value is
divided into a first main residual value and a first secondary residual value. Advantageously,
5 the main residual value is denoted in terms of an integer (whole number) of units of the
amount and the secondary residual value is denoted in terms of an integer of subdivisions of
the amount. In the case of a monetary amount denominated in euros, the main residual value
is thus equal to an integer of euros, and the secondary residual value is equal to an integer
of euro cents.
10 For example, the main residual value is equal to the rounding by truncation of the first
residual value to the lower unit, and the secondary residual value is equal to the difference
between the first residual value and the main residual value and the first residual value is
thus reconstructed by adding the primary and secondary residual values. By way of a variant,
the main residual value is equal to the rounding of the first residual value to the higher unit,
15 and the secondary residual value is equal to the difference between the main residual value
and the first residual value ; the first residual value is thus equal to the difference between
the main and secondary residual values.
An image of the main residual value is stored in the second memory 36, and an
image of the secondary residual value is stored in the first memory 34.
20 The main residual value is typically equal to the number of bits 1, 2, 3, 4, 5, 6, 7, 8
that are in the first state.
The image of the secondary residual value is typically an integer occurring between 0
and n, where n is the number of subdivisions of each unit of the amount. For example, in the
case of a monetary amount, n is equal to 99.
25 The management module 24 is programmed in order to deduce the first residual
value of the amount from the images of the main and secondary residual values. Typically,
the management module 24 is programmed in order to perform the following :
- counting the number of bits I , 2, 3, 4, 5, 6, 7, 8 of the second memory 36 which are in
the first state, and deducing therefrom that the main residual value is equal to the
30 number of bits counted,
- deriving the secondary residual value as being equal to the image of the secondary
residual value, multiplied by l/(n +I), and
- deriving the first residual value as being equal to the sum (as a variant, the
difference) of the main and secondary residual values.
The management module 24 is also programmed to be able to cancel the transaction
if the image of the secondary residual value is strictly greater than n. By way of a variant, the
management module 24 is programmed to be able to derive a value of zero for the
secondary residual value if the image of the secondary residual value is strictly greater than
5 n.
As mentioned here above, the management module 24 is furthermore programmed
so as to assign a second residual value to the amount in place of the first residual value,
when a payment is made by means of the medium 14. To this end, the management module
24 is programmed so as to perform the following :
10 - sub dividing the second residual value into a second main residual value and a
second secondary residual value,
- if the second main residual value is different from the first main residual value,
ordering the change of state of at least one bit I, 2, 3, 4, 5, 6, 7, 8 of the second
memory 36, in a manner such that the number of bits remaining in the first state
following this change of state is equal to the second main residual value, and
- writing in the first memory 34 an image of the second secondary residual value, in
replacement of the image of the first secondary residual value.
In this embodiment, the security of the medium 14 is preserved. Indeed, on account of
the irreversibility of the changes brought about in the bits I, 2, 3, 4, 5, 6, 7, 8, an ill
20 intentioned or unauthorised user could not modify the main residual value of the amount,
other than to reduce the latter, which would be counter productive.
The management module 24 in addition does not have to perform cross checks
between the first and second memories 34, 36 in order to check and verify the validity of the
data from the first memory 34, unlike in the first embodiment. The transaction is there much
25 faster.
It should be noted that in the embodiments provided here above, the second memory
36 includes only eight bits 1, 2, 3, 4, 5, 6, 7, 8. This data is by no means limiting in nature,
and there may be any number of bits whatever in the second memory 36. Most often, the
second memory 36 would include thirty two bits.
30

Claims
1. - A method of payment by means of a payment medium (14) that is capable of
communicating remotely with the payment terminal (12), the payment medium (14) being
capable of bearing an amount and including a first rewritable memory (34) and a second fuse
memory (36), comprising a plurality of bits (1, 2, 3, 4, 5, 6, 7, 8) each adapted to be able to
change its state one single time, characterised in that it comprises the following successive
steps :
o placing in communication (100) of the payment medium (14) with the payment terminal
(12), with the amount having a value before payment and an image (V,) of the value
before payment being stored in the first memory (34),
o reading of the first and second memories (34, 36) and
o deducing (104) of the value before payment from the data read from the first and second
memories (34, 36),
and the following steps :
o assigning (210) of a value afler payment to the amount, which is lower than the value
before payment, in replacement of the value before payment, and
o changing of the state (220) of at least one bit (6, 7, 8) of the second memory (36), the or
each bit (6, 7, 8) switching from a first state into a second state, when the difference
between the first and the values before and afler payment is greater than a threshold
value,
the deducing step (104) comprising the following sub steps :
- determination (105) of a range (T) of permissible values for the amount, which is
a function of the states of the bits (1, 2, 3, 4, 5, 6, 7, 8) of the second memory
(36)'
- checking and verifying (110, 170) the appropriateness of the image of the value
before payment (V1) with respect to the range of permissible values (T), and
- if the image of the value before payment (V1) is greater than the range of
permissible values (T), refusal of payment (190), or changing the image of the
value before payment (V,) in order for it to be included within the range of
permissible values (T).
2. - The method of payment according to claim 1, characterised in that the number
of bits (6, 7, 8) changing state is a function of the difference between the values before and
after payment.
3. -The method of payment according to claim I or 2, characterised in that an image
(V,) of the value before payment is stored in the f~rstm emory (34), and in that the method
includes a step (210) of writing of an image (V2) of the value afler payment into the first
memory (34), in replacement of the image of the value before payment (V,).
4. - The method of payment according to any one of the preceding claims,
characterised in that, if the value before payment (V,) is lower than the range of permissible
values (T), it includes a step (160, 180) of changing the image of the value before payment
(V,) in order for it to be included within the range of permissible values ( T).
5. - The method of payment according to any one of the preceding claims,
characterised in that the step (105) of determining the range of permissible values (T)
includes the following steps :
- association of a predetermined range (To, ..., Ti, ..., T8) of values with each bit (1,
2, 3, 4, 5, 6, 7, 8) of the second memory (36),
- identification of the last bit (6) of the second memory (36) which has changed
state, and
- .determination of the range of permissible values (T) as being equal to the
predetermined range (To, . .. , Ti, ... , T8) associated with the identified bit (6).
6. - The method of payment according to any one of the preceding claims,
characterised in that the step (105) of determining the range of permissible values (T)
includes the following steps :
- association of a predetermined range (To, ..., Ti, ..., T8) of values with each
integer lying between zero and the number of bits (1, 2, 3, 4, 5, 6, 7, 8),
- counting of the number of bits (1, 2, 3, 4, 5) of the second memory (36) that have
not changed state, and
- determination of the range of permissible values (T ) as being equal to the
predetermined range (To, . T ..., T,) associated with the number of bits
counted.
7. - A payment system (10) comprising a payment terminal (12) and an electronic
payment medium (14) capable of communicating remotely with the payment terminal (12),
the payment medium (14) bearing an amount that carries a value before payment, and
comprising :
- a first rewritable memory (34), an image of the value before payment being stored
in the first memory (34), and
- a second fuse memory (36), comprising a plurality of bits (1, 2, 3, 4, 5, 6, 7, 8)
each adapted to be able to change its state one single time,
characterised in that the payment terminal (12) is programmed so as to:
- derive the value before payment from the joint reading of the first and second
memories (34, 36);
- determinate a range (T) of permissible values for the amount, which is a function
of the states of the bits (1, 2, 3, 4, 5, 6, 7, 8) of the second memory (36),
- check and verify the appropriateness of the image of the value before payment
(V,) with respect to the range of permissible values (T), and
- refuse the payment, or change the image of the value before payment (V,) in
order for it to be included within the range of permissible values (T), if the image
of the value before payment (V,) is greater than the range of permissible values
(T),
- for assign a value after payment to the amount, which is lower than the value
before payment, in replacement of the value before payment; and
- order the change of state of at least one bit (6, 7, 8) of the second memory (36)
when the difference between the values before and after payment is greater than
a threshold value.
8. -The payment system (10) according to Claim 7, characterised in that the payment
medium (14) is a contactless medium, which is capable of communicating remotely with the
payment terminal (12).
9. - The payment system (10) according to claim 7 or 8, characterised in that the
payment terminal (12) is programmed so as to implement a method according to any one of
claims 1 to 9.
10. - A payment terminal (12) for the payment system (10) according to any one of
claims 7 to 9.
Dated 5Ih day of August, 2014