CA2080452C - Electronic-monetary system - Google Patents

Abstract

An improved monetary system using electronic media to exchange economic value securely and reliably. The invention provides a complete monetary system having electronic money that is interchangeable with conventional paper money comprising (1) issuing banks or financial institutions that are coupled to a money generator device for generating and issuing to subscribing customers electronic money including electronic currency backed by demand deposits, or electronic credit authorizations; (2) correspondent banks that accept and distribute the electronic money; (3) a plurality of transaction devices that are used by subscribers for storing electronic money, for performing money transactions with the on-line systems of the participating banks or for exchanging electronic money with other like transaction devices; (4) teller devices, associated with the issuing and correspondent banks, for process handling and interfacing the transaction devices to the issuing and correspondent banks, and for interfacing between the issuing and correspondent banks themselves; (5) a security arrangement for maintaining the integrity of the system; and (6) reconciliation and clearing processes to monitor and balance the monetary system.

Description

1 Background of t~e Invention 2 The present invention relates to an electronic monetary 3 system for implement~ng el~ctronic money pay~ents a8 _n 4 1 Alternative medium of economic e~change to cash, eh~c~c~ credit 5~ and debit cards, and electronics funds transfer. The ElectroniC-6 Monetary System is ~ hybrid of currency, c~eck, card payment 7 ~ystem~, and electronic funds transfer systems, ~ sessinq many 8 o~ the benefits of t~ese sygtems with few of tbeir limitations.

9 The ~ystem utilizes electronic representations of money which are designed to be universally accepted and eY~nged as economic 11 value by ~-~h6~ribers of the monetary system.
12 ~oday, approximately 350 billion coin and ~ ency 13 transactions occur between individuals and institutions every 14 year. The extensive use of coin and currency transactions has limited the _utomation of individual transactions euch as 16 pur~h~ces, fares, and bank ~cc~ deposits and withdrawals.
17 Individual cash transactions are burdened by the need of having 18 the correct amount or providing ~hAn~e therefor. Furthermore, 19 the handling and managing of p~per cash and coins i5 inconvenient, costly and time consu~ing for both indi~iduals and 21 financial institutions alike.
22 Although checks may be written for any specific amount 23 up to the amount available in the account, r~ck~ have very 24 limited transfera~ility and ~ust ~e ~upplied ~rom a p~ysical 2~ inventory. Paper-based ~h~ç~nq systems do not offer sufficient 26 relief fr~m the limitations of cash transactions, sh~ring many of 27 the inconvenienceQ of hAr\~l ~n~3 cu~cnc~ while a~ 3 the inherent 28 delays associated ~t~ ~ocessing cheo~. To tbis end, economic 29 exch~nge h~s striven for greater eonvenience at a lower cost, while als~ ese~ improved ~ecurity.
31 Automation has achieved some of these qualities for 32 large tran~actions tbrough computerized electronic funds transfer 33 (nEFTr) 6ystems. Electronic funds tran~fer is essentially a 2 0 ~ 2 1 process of value exchange achieved through the ~n~ng system's 2 centralized . ~l~ter transactions. EFT services are a transfer 3 of payments ~tilizing electronic ~h~c~c, ~ which are used 4 primarily by large commercial orgsnization~.
S The Automated Clearing House (ACH) and point of ~ale 6 (POS) 6ystems are examples of electronic funds transfer systems 7 that have he~_ ~ used by retail and commercial organizations on a 8 substantial ba6is in recent years. However, the payments made 9 through t~e~e types of EFT systems i~re limited in t~at they ci~nnot be performed without the h~n~n~ ~ystem. Noreover, ACH
11 transaction6 usually cannot be performed during off ~usiness 12 hours.
13 Home pAn~in~ bill payment services are examples of an 14 electronic funds transfer 6ystem used by indivi~l6 to make 151 payments. Currently, home ~nk~g initiatives have found few 16 customers. Of the banks that have offered services for payments, 17 account transfers and information over the tele~one lines using 18 personal c~ ,u~ers, less than one percent of the bank'~ customer~
19 are using the service. One reason that Home P~nk1~ has not been 20l a successful product is because the customer c_nnot deposit and 21 withdraw money as nee~ed in this type of system.
22 Current EFT ~y6tems, credit card~, or debit cards, 23 which are used with an on-line ~ystem to transfer money between 24 accoun~s, ~uch as between the Acco~-.L of ~ merchant and that of a custo~er, cannot satisfy the need ~or an auto~ated transaction 26 system that provides for the tran~fer of unl~ersally accepted 27 oco~o~ic v~lue out~idQ of the ~ank~n~ ~y~tem.
28 To ~mplement ~n auto~ated, yet more collv~r.ient 29 transaction gy~tem that does not require the ~kt ng system to intermediate the tran~fer, and that can dispense some for~ of 31 econo~ic value, there has been a trend towards off-line 32 electronic funds tran~ f er . For exa~ple, numerous ideas have been 20804~2 1 p~ se~ for some form of ~electronic money" that can be used in 2 cas~less payment transactions as alternatives to the traditional 3 currency ~nd check types of payment syste~s See U S Patent No 4 4,977,595, ent~tled ~ nOD AND APPARATUS FOR IMPII~ ,lNG
ELECTRONIC CASH, and U S Patent No 4,305,059, entitled RMODULAR
6 FUNDS TRANSFER SYSTE~ n 7 The more well known te~n1ques include magnetic stripe 8 cards purrh~ for a given ~mount and from which ~ prepaid value 9 can ~e deducted for speci~ic ~u~oses Upon exhaustion of the economlc value, the card~ are thrown away Other examples 11 include memory cards or so callad smart cards which are capable 12 of repetitively storing information repre6enting value that is 13 likewise deducted for specific ~ os 14 However, these PLOPC5e~ ~ystems suffer from a failure to recognize fully the significance of ban~ deposits ~6 money, 16 and their necescity to bacX any form of universally _ccepted 17 monetary representations that may be issued In the 6y6tems 18 disclosed thus far, representationg of ec~ ic value, whet~er 19 electronic or paper, are ~ e~ without the backing of equal valued li~bilities as the counterpart to their assets 21 None of the paperless payment sy6tems that have been 22 proposed so far are comprehensive enough so as to implement a 23 multi~u~o6e electronic monet~ry ~ystem that include~ not only 24 the automated devices that allow subscribers to transfer electr~nic funds or ~oney between them without any lntermedlating 26 ~ystem, ~ut that alfio encomrA~~ and lncludes ~n ent~re hAn~nq 27 sy~tem for gener~ting the value represented by t~e electronic 28 money and f~r cle_ring and ~ettl~ng t~e electron~c money accourts 29 of the ~anks and financial ~nstitut~ons ~nvolved to maint~in monetary ~1AnCe w~tb~n t~e ~y~tem 31 ~hus, there i~ a need for a system t~at sllows common 32 payor to payee econom~c exc~anges wit~out t~e intermediation of 2~80~2 1 the ban~inq system, and that gives control of the payment process 2 to the individual. ~urthermore, a need exists for providing a 3 ~y6tem of economic ~ .An~e that can be u~ed by large 4 org~nizations for commercial payment~ of any 6ize, that does not have the limitation~ of the current EFT systems.
6 Accordinqly, it i6 an ob~ect of the present invention 7 to provide a complete electron~c monet~ry system which utilizes 8 electronic money ~t ig interchangea~le with traditional cas~
~ and is uni~ersally accepted.
It is another ob~ect of the present invention to 11 provide ~ ~ethod of ~esurely transferrinq economic value 12 including currency and credit ~mong subscriber~, among financial 13 institutions, ~nd between ~llhçcribers ~nd financial institutions.
14 A further ob~ect of the present invention i~ to provide 15j a multipurpose paperless payment system whereby transactions can 16~ be carried out in both ~n on-line and an off-line mode ~e~een 17 subscribers.
1~ It is yet another ob~ect of the present invent ion to 19 provide a payment sy~tem that reduces the cost of central electronic funds transfer ~ystems by off loading much of the 21 payment~ to off-line devices.
22 It i6 ~till another ob~ect of the present invention to 23 provide a 6ystem of ~eYpen~ive electronic transfers to reduce an 24 institution'~ cost o~ managing paper cash, ~heC~ nd coins.
It i6 6till a ~urther o~ect of ~he pre~ent in~ent~on 26 to prov~de ~ user friendly electronic payment ~ystem th~t may be 27 used reliably and securely for real time tran~fers of ~oney 28 ~etween member~ of the general public, between member6 of the 29 gener~l public ~nd com~erclal organizations, ~nd between co~mercial organ~zation6.
31 It i~ 6till another o~ect of the prese ffl invention to 32 prov~e a 8y5tem for depositing and withdrawing economic value 2~809~2 1 which may be inteqrated wit~ a wide variety of data processing 2 and data communication systems including currently available bome 3 banking services.
4 It is ~till a further ob~ect of the ~lE_snt invention to provide ~n electronic monetary system which utilizes 6 electronic money in the form of multiple currencies.
7 It is yet a further ob~ect of the present lnvention to 8 prov$de a system for s~fely transferring econom~c value in 9 transactions of virtually any si~- denomination.
It iB yet another ob~ect of the pre~ent invention to 11 provide a medium of economic ~Y~An~a th~t iff fungible, easily 12 transferable, ~n~en~ably re~e~ -hle, and secure from reuse, 13 duplication, and counterfeiting.
14 The foreqoing objects ~nd advantages of the invention are illustrative of those which can be achieved by the present 16 invention and are not inten~ed to be exhaustive or limiting of 17 the possible advantaqes which can be realized. Thus, these and 18 other objects and advantages of the invention w~ll be apparent 19 fro~ t~e description herein or can be learned from practicing t~e invention, both as ~ ed herein or as modified in ViQW of any 21 variations which may be apparent to those skilled in the art.
22 Accordingly, the present invention resides in the novel methods, 23 arrangements, combinations and improvements herein ~hown and 24 de~cribed.

2~ Summary of ~Yem~larv ~mbodiment 26 To achieve the foregoinq, and other ob~ects, the ~ethod 27 and appar~tus of the present invention employ a preferred 28 embodiment ~n the form of an electronic-monetary sy~tem having 29 ~ anks or financial institutions that are coupled to a money qenerator device for generating and issu~ng to subscribing 31 customers electronic money including electronic currency backed 2080~52 1 by demand deposits and electronic credit authorizations; (2) 2 correspondent banks that accept and distribute the electronic 3 mon~y; (3) a plural~ty of trans~ction devices that are used by 4 ~ubecribers for storing electronic money, for performing money trans~ction6 with the on-line syste~s of the participating banks 6 or for exchanging electronic money with other like transaction 7 devices in off-line tr~sactions; (4) teller devices, associated 8 with t~e ~ nq and co~L~spor,dent banks, ~or ~l oces8 handling 9 and interfacing the transaction devices to the ~5~ ~ng and correspon~e~t banks, and for lnterfacing between the issuing and 11 cG,,~ondent bank~ t~emselves: ~5) a cle~rinq banX for ~lAncing 12 the electronic money ~c~o~n-6 of the different issuing banks; (6) 13 a data com~unications network for providing communications 14, services to all r~ ~onents of the system: and (7) a cecurity 15~ arrangement for maintaining the integrity of the system, and for 16 detecting counterfeiting and tampering within the system.
17 ¦ In the preferred embodiment, the functions of the money 18j, generating device6, ~he transaction devices, and the teller 19I devices will be performed by a combination of tamper-proof c- ~er hardware and application software modules that may be 21 networked together. Information is trsnsmitted in an encrypted 22 form to provide security from unauthorized inspection. The 23 electronic money i~ transmitted with digital ~ignatures to 24 provide authentication, ~nd security from modification or counterfeiting.
26 The electronic money ~chA~ged by these devices ~ay be 27 an electronic representation of currency or credit. Xn i~portant 28 ~spect o~ t~e electron~c ~ en~ is that it is the equivalent of 29 bank notes ~nd i6 ~nterchanqeable wit~ conventional paper money t~rough cla~ms on deposits in an i6suing bank, but can be 31 withdrawn or deposited both ~t an i~suinq bank and ~t a 32 correspondent ~an~. However, only ~he ic6uing banks can generate 208~2 ~ the ~lectronic currency, and will be li~ble Sor it~ redemption.
2 The i~suing banks later utilize inter-bank clearing and 3 ~ettllng proc~see~ to maintain the monetary balance in the 4 banklng ~ystem, as i~ currently practlced by today's ~nk~ng industry.
6 The electronic money representations are fungible, 7 unlversally accepted, and ~n~n~hly redeemable ~rom the ~.~su~ng 8 ban'~s, i.a., t~ey ~ave the c'naracteri~tics of money transactions.
9 To preserve the integrity of the electronic monetary ~y~tem, each ~ch~n~ge of electronic money includes, along with other 11 information, datr. identifying the monetary unit of the credit or 12 ou~ncy, ~i.e., dollar~, yen, etc.) the amount by unit of credit 13lj or currency, the bank i6suing the electronic credit or currency, 1~ and ~everal digital signatures.

~mary of The Invention 16 In accordance with these and other ob~ects of the 17 invention, a brief ~ummary of the present invention iB presented.
18 Some simplificat~ons and omi6sions may be made in the ~ollowing 19 summary, which i~ intended to ~ighlight and introduce ~ome aspects of the present invention, but not to limit its scope.
21 Detailed descriptions of a preferred exemplary e~bodiment 22 ~de~l~te to allow those of ordinary ~kill in the art to make and 23 use t~e inventiv~ C6.~C~ will follow in later ~ection~.
24 According to a broad aspe~t of the invent~on, an electronic monetary ~y6tem provides for tran~actions utilizing 26 electronic money includ~ng electroni~ currency backed by demand 2~ deposits ~n a ba.~k in lieu of cash transactions, and electronic 28 credit authorizat~ons. The invention compri~e~ a money module 29 for generating the electronic ~oney; a money module for ~S~ nq~
distri'Duting, and accepting the electronic money: and a money 31 ~odule for accepting, 6toring, and tran~ferring the electronic 208~

1 money between other accepting ~oney modules and between the 2 accepting money module and the issuing money module.
3 Accordinq to a further aspect of the invention, an 4 ele_L~I,ic Donetary ~yste~ i~ provided for implementing and S ma~nta~ning electron~c money which include5 ele~ ..ic currency 6 that is interchangeable with conventional money through claims on 7 deposit~ in a bank and electronic credit authorizations.
8 The ~ystem includes a plurality of lssuing banks; a g generator module for creat~ng electronic money: teller ~odules coupled to the genex~tor module, for performing teller 11 transactions and for lnterfacing with other teller modules, ~uch 12 tran6action6 including the accepting and the di6tributing of the 13 electronic money: a 6ecurity 6y6tem for providing the overall 14, integr~ty of the electronic monetary ~ystem: a clearing and ~ettling process for balancing the electronic money accour,~s of 16 t~e separate i~suing banks and for clear~ng the electronic money 17 issued by the i~suing banks: and ~ plurality of transaction 18 modules o~ned by authorized users, for transferring the 19 electronic money between t~e transaction modules and between the transaction modules and the teller modules.
21 In accordance with another aspect of the invention, the 22, function~ of the generator modules, the tran6act~0n modules, and 23 the teller module6 will be performed ~y a combination of t 24 proo~ computer hardware and applic~tion ~oftware tbat may ~e networked together.
26 The electronlc money exch~n~ed by these ~odules, which 27 may be an electronic repre~en~ation of cu~.en~ Sac~ed by demand 28 deposit BCCO~.~ at ~he ~6~lin~ bank or cred~t authorizations, may be transm~tted w~th d~gital ~ignature~ to pro~de security fro2 unauthor~zed modification or counterfe~ting. In a preferred 3~ , ho~i ~nt, ~ecur~ty from counterfei~ng and ~ r~nq ~ also 32 provi~ed by requlring the modules and the ~ndividual unitc of 2~80~52 ~ electronic money to be renewed periodic~lly. Offen~in~ modules 2 or counterfeit electronic money can be removed from circulation 3 as soon as t~ey are di~covered.
4 ~riefly, a process in accordance with the invention compri~e6 the steps of 6 (1) providing a generating module to generate 7 electronic representation~ of economic value ~Ac~ by demand 8 deposits or ~y ~ credit line:
9 (2) providing a t-ller ~odule to accept tbe generated electronic repre6entation- of ~conomic v~lue and to icsue t~e 11 electronic represent~tions of economic value;
12 (3) providing tbe autborized u6ers wlth a transacting 13 module for ~ccepting, storing and transferring the electronic 14 representations of economic value to other aut~orized users having the transacting module and to the teller processing 16 module;
17j ~4) accepting and transferring the electronic 18 ll representations of economic v~lue to otber authorized user6 19ll baving 8 transacting module and to the teller module; and 201 ~5) providing a security ~y~tem to ~llow the transfer 21 of electronic repre6ent~tions of economic value in a secure 22 manner between the generat~ng module, the teller module and the 23l transact~ng module.

24 Brief ~escription of the Drawings Otber ob~ects and advantage~ of the pre~ent invention 26 will become more apparent ~y t~e following description wltb 27 reference to ~ccompanying drawings, in ~hicb:
28 Figure 1 ~ a diagram illustrating general aspects of 29 the invention:
Figure 2 i~ a ~chematic diagram of t~e operative 31 arrangement of the ~- ~onent~, according to the invention.

20~S2 1 Figure 3 i8 a perspective diagr~m of ~everal 2 embodiments of external ~ystems that may ~ouse a money module, 3 according to the invention.
4 Figure 4 i~ a block form diagr~m of a Trans~ct~on money module, according to the invention.
6 Figure 5 is a block form diagram of a Teller money 7 module, according to t~e invention.
8 Figure 6 ia a block form diagram of a Money Gener~tor g module, according to the invention.
Figure 7 i6 a block diagram of the network arrangement, 11 according to the invention.
12 Figure 8 i~ a block diagr~m o~ a Network Sever, 13 ~ccording to the invention.
14 Figure 9 is a flow diagram of the ~ecurity gystem, according to the invention.
16 Figure 10 is a block form diagram of a security server, 1~ according to t~e invention.
181 Figure~ 24 are flow di~gra3s of accou-,~ing examples, 19 according to the invention.
Figure 25 ~ flow di~gram of the Transaction 21i Reconciliation Sy~te~, according to the invention.
22 Figure 26 is a flow di~gram of the Clearing Sy~tem, 23 according to the invention.
24 Figure 27 iB a flow di~gram of the Money I~ued 2S Reco~ciliation Sy~tem, ~ccordin~ to the invention.
26 Figure~ 28-50A are flow charts of tr~n~action ex~mples, 27 according to the invention.

28 ~isclosure of the Preferred Embodiment of t~e Inv~ntion 29 The present in~ention contemplates an improved monetary ~ystem using electronic Dedia to securely and reliably exc~ange 31 economic ~alue. The ~ystem can be lmple~ented by integrating 2~8~52 1 novel data processing systems with other procedu,Ls which can be 2 implemented with the current worldwide ~nk~ ng ~ystems.
3 Throughout this description, ~el~,onic money" may 4 al80 be referred to by the abbreviation ~E-M.~ additionally, the term ~bank~ ~8 used ~ereinafter to indicate any ~n~
6 financial institution or the like which is a participant of the 7 present invention.
8 Referring now to the drawings, wherein like numerals 9 refer to like components, there is disclosed in Figure 1, in blocX form, broad aspects of th~ preferr~d ~ ment. In Fig.
11 1, the general relationship among the features of the system i~
12 shown. The ~yste~ ~ncludes Issuing Banks 1 eac~ ~aving a Teller 13l money module S ~nd a Money Generator module 6; CG~Le~ondent 14' Banks 2 each having a Teller money module ~ an eleo~onic money 15l Clearing Bank 3; a Certification Agency 28 and a plurality of 16, Transaction money modules ~ owned by subscribers of the system.
17l Electronic noteC 11, the media for transferring 18 electronic money, are generated by the Money Generator module 6 19l ~or an Is6uing Bank 1. These notes 11 are t~en transferred by a Teller money module 5 to a ~ubscriber utilizing a Transaction 21 money module ~. Electronic notes ~ may be representations of 22l currency or credit authorization6. For ~ecurity re~Qns, all 23 el~ctronic notes ~ will expire ~fter A preset time period. once 24 expired, the notes 11 must be r~e -' ~t a participating bank for updated ones before they can be transferred.
26 An ~ss~ nq Bank ~ ge~rates and di~tributes the 2~ electronic notes 11, and iB liable for their rederption. An 28 Issuing Bank S perfor~s deposits, wit~dr~wal~, payments to loans 29 and inquiries for other money module~.
A Correspond~t Bank 2 i~ ~ participatinq bank wh~c~
31 distributes electronic money throuqh accou,Ls it maint~ins ~t 32 Issuing Banks 1, but does noe generate any electronic money, and 2~8~)~52 1 i~ not li~ble for its ~ ~r ~ t~on. B~caus- it cann~t genera~e ~ny 2 electronic money, the Co~l~syon~ent Bank 2 in the preferred 3 embodiment ~ust make real-time request~ of electronic money from 4 an accoul.~ it maintains at an I6~ui~q ~ank ~ whenever a subscriber wi~hes to wit~draw electronic ~oney at a Correspondent 6 Bank 2.
7 Conver~ely, a Corre~pondent Bank 2 depo6it~ all 8 electronic ~oney deposited by ~hscriber~, to the aCCoUI-~s the 9 Correspcr ~nt BanX 2 ~old~ at Issu~nq Bank~ ~. m ese aCCou~l-6 will be described hereinafter. A Co.~e~yor.de~t Bank 2, like an 11 I~suing Bank ~, will perform deposit~ withdrawal~, payments to 12 loans and ban~ inquiries.
13 Notably, an Issuing Bank l may also be a correspon~Pnt 14 ! Bank 2 for the monetary units that it does not qenerate. For lSI example, an 16suing Bank l for electronic aollar notes ll may be 16 a Correspondent Bank 2 for electronic notes ll of yen, marks, 17 etc., ~sued by other banks.
18, It i8 al60 important to note that the ~y~tem of the l9 invention can function without Correspondent Banks 2. For example, a ~ubscriber can eliminate the use of a Co.Le~c..dent 21 Bank 2 by communicating directly with his/her Issuing Bank l when 22 ~k~ng a deposit, withdr~wal, etc. Co~esl,u~P~t Banks 2 are 23 included ln the preferred embod~ment for the practical purpose of 24 eYr~A~n~ distribution of the ~ystem while reducing the ri~ks that ~re inherent in ~ny ~nk~nq system, ~uch a6 the risks caused 26 by t~e coll~pse of a b~nk i~suing ~oney.
27 The Clearing Bank 3 is utilizQd when mor~ than one banX
as i~ i~suing electronic money. According to t~e invention, it i~
29 anticipa~ed t~at more t~an one ban~ will be ~~ q electronic money. Thu6, the Clearing Bank 3 i8 prov~ded to cl~ar the 31 electronic mo~ey depo~itod and ts balance acco~ts ~t maintains 32 for the I6suing ~ank6 l. The Cle~rinq Bank 3 ~aintains demand 2~8~52 1 accounts f~r each Issuing Bank ~ in t~e sy6tem.
2 The Certification Agency 28, is the centerpiece of the 3 6ystem ~ecurity. It provides a process that ~certifies" the 4 validlty of a money module for a certain per~od of time by i~suing a certificate to each money module. A money module must 6 have a v~lid certificate in order to be able to transact with 7 other money modules ~, S, 6.
8 Before tbe certificate exp~res, ~t must be updated ~o 9 that a ~ubscriber can continue to use hi~/her transaction money module ~. This process makes u~er6 of the ~y~tem establish 11 periodic contact with the C~rtification ~cr.~ 28.
12 Periodic contact allows for faster ~es~or.se when 13, tampering with the money modules of the ~yste~ iB detected. To 14 tbis end, tbe Certification Agency 28 also provides ~ list of offen~ing or compromised money modules to other money modules so 16j that transactions with the bad units may be blocked.
17, The component6 shown in Figure 1 are best understood by 18 referring to the sy~tem's operative arrangement illustrated in 19, Figur¢ 2. As illustrated in Figure 2, th~ preferred embodiment provides for ~upplements to tbe current ~nking systems tbat 21, include the following additional components: a plurality of the 22l ~ransaction money ~odules 4, the Teller money modules S, and the 23 Money Generator modules 6, for creat~ng, transferrinq and ~torlng 24 the electronic notes 11 (money); a ~learinq System ~3 to balance the accour.~s of ~an~s ~su~ ng currency and credit; a security 26 ~y6tem 2~ to maintain the integrity of the ele~o..ic notes 11;
27 tbe current h~k~ ng ~y~tems 20; a network 25 ~exemplified by tbe 28 line~ interconnecting modules and sy~tems) to ~ediate 29 transactions betw~en ~oney moauleg ~,S,6, the participating bank~
1,2,3 of ~yste~ 20 and the security system 2~; a Transaction 31 Reconciliation system 22 to detect money module ~alfunct~ons and 32 insider tampering of the ~y~tem; a Money I~sued Reconciliation 2~8~52 1 System 23 to detect counterfeiting and reuse of electronic money;
2 and a Money Position System 2~ to keep track o~ the electronic 3 money ~n circulation.
4 Playlng ma~or roles ~n the preferred embodiment are three classes of ~money modulesn for creating, storing, and 6 transferring the electronic objects that re~.ese~t ~o~ ;c 7 value. These include the Transaction money modules ~, the Teller 8 money ~odule~ S, and the Money Generator module~ ~. It ~s 9 contemplated that these money modules ~,S,6 will be a ~ombination of ~amper-proof hardware and application software t~at are meant 11 to be components o~ a larger ~ocessing environment.
12 Referring to the top right-hand ~ide of Figure 2, a 13 Transaction money module ~ cont~ining electronic notes la ~tored 14j therein (not shown) may be used to exchange foreign currency or make a payment with another Transaction money module ~, using a 16l secure, encr~pted protocol either by a telephon~c l~nk, or a 171 prox~mate communication link. Because it is contemplated that an 18j electronic note ll will be fungible, i.e., it c~n be broken into 19l any desired A~-~un~, the amount transacted between the Transaction 20i money modules ~ may be of any amount up to the amount 6tored in 21 the payor's Trans~ction money moaule ~.
22 A payee's Transaction money module ~ that has received 23 the electronic notes ~ as a payment may, in turn, be used to 24 transfer all or any amount of the electronic money con~n~
2~ therein to ~nother e~hscrib~r'~ Tran~action ~oney module ~.
26 Alternatively, t~e payee may depo~it the electron~c money ~nto 27 his/her bank a~eou~
28 The Yalue of the electronic money ~tored in t~e 29 Trançaction money module 4 may also be redeemed at any participatlng bank (e.g., Correspondent Bank 2 or Is~n~ng ~an~ l) 31 for paper money by transferring any amount of the electronic 32 ~oney to a bank'~ ~eller money module S, where~y a teller or an 2~8~2 1 Auto~ated Teller Machine (ATM) will return an egual amount of 2 paper ~oney. Naturally, it is anticipated that paper money may 3 a1BO be eY~hAn5~d for equal valued electronic money.
4 AB will be ~ppreciated, the Transaction money module S may be configured to make deposit~, w~thdrawals, loan payments, 6 inqu$ries ~nd exchanges of currencies of electronic notes 11 7 dlrectly through ~ Teller money module 5 at an T~6~ng 1 or 8 Co ~ ondent Ban~ 2 or remotely through a teleF~onic ~on~ection 9 to an ~su~g I or C~ s~ol)dont B~nk 2 Teller money ~odule 5 (thereby providing, among other th~ngs, the transactions not 11 avail~ble in current home ~n~ing ~ystemc). Upon a reguest to 12 tr~nsact with a bAnk, the Teller money module 5 mediates tbe 13 transactions for the subscriber'~ bank accoun~ as well as the 14 ~a~king syste~'~ electronic money acco~ 6.
lS It should be noted that a subscriber will not be 16 reguired to maintain a bank account in order to own and U6e a 17 Transaction money module ~. For in~tance, a ~ub~criber may 18 obtain a stand-alone computing device that contains a Transaction 19 money module ~ ~nd use the device only in off-line peer-to-peer transactions with other devices cont~in1ng ~ Transaction money 21 module ~, such as a merchant's point-of-~ale terminal. Of 22 cour6e, the merchant may then transfer the electronic money to 23 another -~ -rcial orqanization to meet it~ obligations, or $t 24 may deposit the electronic money at it~ own bank.
In the preferred e~bodi~ent, electronic money depo~ited 26 at any I~suing Ban~ 1 other than the original Is~uing B~nk 1 27 itself will ~ sequently be ~ettled for value w~th t~e original 28 Issuing Bank 1 through the eel.t~l clearing and cettling ~.~Ce55 29 per~ormed by t~e Clearing System ~3. It i8 anticipated that tbe clearing and 6ettling processes will ~e ~anaged by the Clearing 31 Bank 3 (Figure 1). Each I66uing Bank 1 Teller money module 5 3~ 6end~ all the electronic notes 11 deposited at its ban~ but 2~8~1~2 l issued from other Issu~ng Banks 1 to the Clearing Bank 3 in order 2 to ~ettle for the value pogted to their customer6' acco?~ts.
3 When a withdrawal, an ~YC~A-,_ for foreign currencies, 4 an ~yrh~n~e of paper cash for el~_~ onic money, or an updating of the electronic money occurs, the Money Generator module 6, Figure 6 2, creates and digitally ~igns electronic objects having econ ic 7 value - either currency or credit notes ~ igure 1) - tbat are 8 to be sent to the Transaction money modules ~ t~rough the 9 p~rticipating bank'~ Teller ~oney ~odules 5 in the form of a packet of electronic note~ 11. As mentioned dbove, the 11 electronic currency note~ al are the equivalent of bank notes 12 that are bacXed by deposits, and can be traded between 13 Transaction money modules ~.
14 During the w~thdrawal tran6action, the Teller money l~ module S and t~e Transaction money ~odule ~ may establlsh a 16 communications lin~ using an encrypted protocol to securely 17 tran~ f er the note6 ll from the Teller money module S to the 18 Transaction ~oney module ~.
19 Records of the notes ll generated and conveyed by the Money Generator module 6 are ~ent to the local bank's Transaction 21 Reconciliation Sy~tem 22 and an I6F1~ing Bank'~ 1 ~oney Issued 22 Reconciliation System 23 for ~aintaining ~tat~st~cal and 23 housekeep~ng functions. Records of the electronic note~ l~
2A cleared and ~ettled at the Clearing aank 3 are also provided to t~e Money I~sued Reconoil~ation Sy~tem 23 . ~rom these 26 compilations, ~ f~nanclal position of the system c n be prod~lce~
27 ~y t~e ~oney Position Sy~tem 2~.
28 Di~crep~ncies and mal~unctions are ~ ed to the 29 Security System 21 which downloads t~e lists of pro~le~ roney modules to all ~oney ~odu~es in the sy~te~ n they are 31 oonne_~ed to the NetworX 25. By carrying ~hi~ t, ~
32 Transacticn money mo~ule ~ will be inhi~ited ~rom transacting 208~52 li with other suspect Tran~action money modules ~.
2 H~ing thus prov$ded in overviQw of the preferred 3 embodiment, there ~ill now follo~ a ~ore detailed description of 4 the individual element6 and the tran~actions between them.

Money ~odules 6 Figure 3 provides ceveral ~ ~ent~ of external 7 sy~tems or device~ for ~ou~ing money modules.
8 In the preferred ~ ment, tbe ~xternal system or 9 device will typically cont~in data di~play mean~, data input means, data processing means, ~emory storage ~e~ns, direct 11 co.~.e~ion or contactless bidirectional communications means, and 12l t~e money ~odule packaged in a tampeL ~roof ~ousing, all 13l interfaced by suitable means for ~nformation transfer, such as 14 are well known in the art.
15l As will ~e understood, a mGney module may be embodied 16 a~ a modular r- ~o~Pnt 0~ any larger proces~ing en~ironment while 17 ~till performing the same functions. For example, Tran~action 18 money ~odules ~ ~ay work as co-proce~sors embedded in personal 19, portable computing devices like t~e Hewlett-Pac~ard 95LX, or as co-processor~ in ~inframe computer~, workstations, point-of-~ale 21 te. in~ls or telep~on~ de~ices Ifixed or portable) c~\-n~ed to a 22 network.
23 A Teller money module S ~ay be ~ ~o~ a8 a CO-24 proce~or in the bank'c financial computer ~y~t~m~. Th~ ~oney Generator module ~ could be a separate proce~sing unit networked 26 to the bank, a co ~oce~sor ~n ~ general purpo~e computer, or lt 27 may ~e co~bined witb an Tss~ling Bank's 1 ~eller money modu~e S in 28 ~ larger proce~60r.
2g, Because it i6 anticipated that a money module will be implemented in a ceparate proce~sing device, it i~ a~sumed t~at 31 corresponding inter~ace circuitry would ~e provided in the host Processing device to provide communication between the processing device and the money module.
Notably, all classes of money modules contemplated by the invention may be implemented programmatically or by direct electrical connection through customized integrated circuits, or a combination of both, using any of the methods known in the industry for providing the functions described below without departing from the teachings of the invention. Those skilled in the art will appreciate that from the disclosure of the invention provided herein, commercial semiconductor integrated circuit technology would suggest numerous alternatives for actual implementation of the inventive functions of the money module that would still be within the scope of the invention.

Transaction Money Module In one embodiment, the Transaction money module 4 may be imbedded in any computer of any size or use, like those serving as general purpose computers or work-stations, to provide functions not limited to E-M transaction use. This latter application will allow for such uses as real-time, off-line payments between personal computing devices, or on-line payments for network services such as information retrieval, telephone calls, or for purchasing airline tickets, theater tickets, etc.
In another embodiment, the Transaction money module 4 may be imbedded in an individual hand-held integrated circuit unit, such as a personalized hand-held computer that may be readily carried by an individual as though it were a wallet. As an illustration, the device of the preferred embodiment may include a keyboard, a pen or stylus, a touch screen or voice recognition circuitry as a data input means, an alphanumeric LCD
dot matrix display as a display means, an infrared optical transceiver as a contactless bidirectional communications means, and an RJ-11 telephone jack coupled to modem circuitry as a telephonic communications means. Additionally, the device may also include various electronic processing and storage means for providing calculator capabilities, for storage and processing data of the owner, etc.
It is important to note that the particular design of the external device is not critical to the invention, and other technologies suitable for accomplishing the foregoing functions may also be used. For example, an LED instead of an LCD display panel may be used; radio, infra red, inductive or capacitive communications methods may be used instead of direct connection;
optical communications methods may be used; etc.
In general, it is anticipated that any Transaction money module 4 owned by a subscriber will be embodied in a self contained, tamper-resistant unit that contains components which are difficult to access, and thus prevent any person from improperly examining, counterfeiting or modifying any of its contents or arrangements. For example, integrated semiconductor circuits, whose contents are difficult to examine, encased in a tamper-resistant package such as that formed by an epoxy or plastic lamination may provide a high degree of physical security while providing the necessary storage, computation, timing, and other data processing functions.
However, the invention is not limited to any particular tamper-resistant means, inasmuch as there are a number of methods known in the industry for providing such security. Such tamper-resistance will also prevent the owner, who can control only some of the internal operations of the Transaction money modules 4, from certain accesses to thereby provide security from abuse to other relevant institutions and individuals.
Each Transaction money module 4 will have a way of ensuring its own association with a particular subscriber, so 2~ 52 1 that its use by other individuals may be l~mited. In addition to 2 the use of Personalized Identlfication Number (PIN) methods that 3 are well known in the art, the Transact~n money module ~ may 4 al60 include means such as a fingerprint reader, voiceprint analyzer, wrltten signature analyzer, or other ~o-called 6 biometrics means, to determine the physical identity of an 7 authorized r~h-criber.
8 Additionally, the Trans~ction money module ~ may 9 utilize personalizQd int~ractiv- proo~ u~ing questions that only a true owner would be ~ble to correctly answer, ~uch a~ the 11 owner'~ ~other'~ maiden name, ~i~/her favorite color, etc. Any 12 such t~oh~iques may provide additional security for 13 organization~, and may al80 be to the advantage of the authorized 14 user ~ince such security can protect the ~h~riber's data from inspection ~nd use by 6_ ~c:,e else _ ~ng into poss~ssion of the 16 Transaction money module ~.
17 Because the Transaction money module ~ can take on a 18 variety of phy~ical .e~e6entations, it will be described by the 19 functions performed ~n addition to the pertinent phy~ical chara~teristic~ of a preferred embodi~ent.
21 Referring now to Fig. 4, a Tran~ction money module 22 is shown diagrammatically in block form. Specifically, a 23 ~ransaction mon~y module ~ has (1) an external interface 30 that 24 interfaces the Transact~on money module ~ to the module's data processing ~eans, the input/ou~pu~ means ~hu~an interf~ce) ~nd 26 t~e co~mun~cations circu~try ~ the extern~l de~ic~; ~2) a 27 ~ession manager 3~ to control and commit (~.e., finalize) or 28 abort a tran~a~tion session; (3) ~ transactor 32 to ~anage 2~ applicaticn function~; and (4) a ~oney ~older 38 to contain and manage the elestronic represent~tion6 of money.
31 According to the invention, the following ~pplication 32 functions ~ay be implemented in the preferred ~ ~o~i~ent of t~e 2~45~

1 pre~ent invention:
2 ~he To Subscri~er application 33 performs the function 3 of comparing the owner identification characteristics, such as a 4 user'6 personal identification nu~ber ~PIN) and biometrics characteri~tic (e.g., fingerprint, voiceprint, etc.), that are 6 stored in the memory of the Transaction money module ~, to those 7 of the individual who i8 attempting to gain access to the 8 ~ransaction money module ~. after the proper ownership $s 9 verif~ed, the Transaction ~oney ~odule ~ ~ay be activated, and the user i5 allowed certain a e~seE to the TrAn~ac~Q~ money 11 module's ~ stored content~. Mes~age~ to the r~ccriber, and 12 subscriber inquiries as to the information con~A~ ned within the 13 Transaction money module ~ are also handled by this application 14 function.
~5 The To ~eller application 3~ interface6 the ~ransaction 16 ~oney ~odule ~ to the Teller money modules 5 for initiating and 17 performing deposit, withdrawal, loan payment transactions, and 18 bank inquiries with ~uch Teller money modules S.
191 The Pay/Exchanae application 35 ~upervises the F~n~in~
and receiving of electronic notes 11 between Transaction money 21l modules ~, managing the process in wh~ch the electronic notQs 11 22! are properly "packaged" as to amount, digital signatures, etc.
23 This application provides that the electronic notes ll are 24 transferred in ~ ~ec~yr.ize~, valid format. ~otably, thi~ is the application that all~ws a money module to perform payme~ts and 26 foreign exchanges. Without ~his applicati on in the preferred 27 - ~oA~ment, a Tr~nsact~on ~oney module ~ cannot ~ake a payment to 2~ anot~er Tran~action money module ~.
29 The Tran Log Mgr~ ~pplication 36 prov~des the management and overceeing of a log that records completed 31 transactions undertaken by t~e money module. For eac~ completed 32 transfer of electronic money, an lllustrative Tran Log records:

20~4~2 1 (1) the type of transfer (i.e., payment, deposit, 2 foreign exchange, etc.), 3 (2) t~e date of transfer, 4 (3) t~e amount of tran~fer, (4) the Issuing Bank 1 identifier 6 (S) the note identifier, 7 ~6) the monetary unit, 8 (7) tbe identifier of the other ~oney module involved 9 ln the tran~action, and for ~ ts, withdrawals and loan payments:
11 (8) the bank ac~our.- number, 12 (9) the bank identifier, and 13 (10) the ~ ,c- ~ of the transaction.

14 In the preferred embodiment, every money module will 15' have an identifier. A money module identifler may be ~ho~ht of 16 as the n~erial number" of the money module and i6 never chanqed.
17 It i~ anticipated t~at a r~h~criber may haYe ~cce~s to 18 ~everal of the field6 of data stored in the Tran ~og application, lg ~uch as ~i~tories of the amount, date, and type of transfer.
Information as to the expiratiDn date of a certificate may also 21 be accesse~ by the sub~criber so that he/~he will be informed as 22 to the need to update or re~alidate the money ~odule's 23 certificate.
24 The Ma~nta~n Securi~Y application ~7 m~nages ~ list of ~sney module identifier6 that are known to have been genera~ly 26 comprom~sed. In part~cular, this ifi a li6t t~at i8 d~str1buted 27 to each money module when it ~ te~ with the N_~oLh 2S, 28 and ls a li~t of ~oney ~odules ~hat h~ve p~c~ an lnvalld or 29 counterfeit electronic note 11 or have performed act6 deemed detr~ment~l to t~e system.
31 When e~ta~ h~n~ a ~ession ~etween ~oney modules, e~cb 2~80~2 1 ~oney module checks its li~t of bad ~oney modul-~ to see if the 2 other i8 an offen~i~g money module. ~f the other ~oney module'~
3 identifier ~ppeAr6 on the list, the ~ ication i6 broken off.
4 Thi~ application also provides the pLoce~ for obt~ntnq the certificate unique to the ~oney ~odule, for 6 6ynchronizing an internal clock, and for managing the creat~on of 7 new cryptoqraphy key6.
8 The Note Directory 39 applicat~on perform~ the function 9 of keeping track of the location, ident$fication and value of the electron~c notes 1~ stored w~thin t~e money module. A note 11, 11 whether it i~ an ele~.onic currency note or an electronic credit 12 note, is the basic unit of electronic money. It ~8 t~e 13 electronic ob~ect repres~nting the ~conomic value, the electYonic 14 bits that contain the a~.~n~, expiration date, note identifier etc. (described in detail below) that get~ digitally ~igned 16 ~de~cribed below) and encrypted w~en being transferred. Both 17 electronic currency notes 11 and electronic credit note~ 11 may ~8 be located by the Note Directory 39.
19 The Note Dir~ctory application 39 update~ 6ummary total~ of the current amount of electronic note~ ~1 (both 21 currency and credit), by monetary unlt after every transfer. A
22 date-of-expiration, a note ~dentification n~her and an I~suing 23 Bank identifier i8 al60 recorded with the location of each note 24 l~.
In 6ummary, the Note Directory 39 keeps track cf t~e 26 note identification nu~ber, the Issuing ~ank 1 identifier, th~
27 ~ate-of-expiration of ~he note 1~, the loc~tion of the note ~1 ~5 28 ~tored in the Tran~act~on money ~odule ~, and the current a ~
29 of the total v~ue of the note- 11 stored for eac~ monet~ry unit.
These rec~rds are ~aintalned for both electronic currency and 31 electronic credit. For a credit note 11, the acc~un~ number of 32 the cred~t line ~s also ma~nt~lned.

20~4~2 1 The Notes application ~0 manages the storage of the 2 representations of the electronic notes 1~ themselves, both 3 currency and credit notes 11. This application also generates 4 the transfer~ when notes ~1 are to be coll~eyed. -The Packet Mana~er application ~1 manages the 6 construction and formatting of a packet of electronic notes 11 7 that are to be transferred to another money ~odule. For example, 8 the Packet Man~ger ~1 will utilize an algorithm 80 that the least 9 nu~er of elec~,onic notes 1~ are u~ed to fulfill the regue~ted amoun~ of transfer, with the earliest d~ted electronic notes 11 11 being used fir~t. Alternatively, when a packet of notes 11 i6 12 transferred to the receiving money module, the Pac~et Manager ~1 13j application ndisassemblesn the packet, verifying the date and 14i separating the data fields that represent the different electronlc notes 11.
16 The formatted packet gets several data fields app~n~e~
17 to it when electronic notes 11 are "assembled. n An identifier 18, dat~ field provides the indicia that identifies it a~ A packet.
19 Additionally, data fields for the total value of the notes ~1, the number of notes 11, and the individual locations of the notes 21 1~ are provided.
22 The Verifier ~pplication ~2 verifie~ that a received 23 pac~et contains valid electronic notes ~ before ~ receiving 24 ~oney ~odule accepts them. ~he Verifier 42 al80 ~ tbat the total amount received i~ equal to the ~um of the ele~onic notes 26 ~ that are to be transferred. If the total ~mount and the 27 ~ndi~du~l electronic notes 11 are ~al~d, ~n acknowledgment is 2~ returned to ~llow for completion of the transfer. Otherwise, an 29 ~in~alld" messaqe 18 ~ent, and the transfer nay be aborted.
~ervices applications that are prov~ded fall under two 31 categor~es: ClocX/Timer ~3 and Cryptoara~y. The Clock/Tim~ ~3 32 provides ~y~ pulses for controllin~ a tran~action ti~eout, 208~52 1 such ~s the time betw~en the ~ending of a message and t~e LoL~
2 of a coLL~onding message.
3 As vill be appreciated, when two money modules are 4 communicating, they may be monitoring a time-out protocol. For S ~x~mple, after a firct noney ~odule ~as sent a mE6~ to ~
6 ~econ~ money module, the Se~slon Manager 31 of the fir~t ~oney 7 module (nAn) may ~et a timer for a reply if the Tran6actor 32 8 ind~cates that a reply i~ reguired. ~he Session Manager 31 may 9 also number the message sent. This number would Arps~r in the reply mess~ge from the Session Manager ~1 o~ t~e ~ocv..~ money 11 module ("B").
12 If the timer expire~ before the me~6age ha~ been 13l received, then Session Manager A 31 will query Se6sion Manager B
14 3~ to determine if the transaction is ~till r~nn~n~ in B. If B
does not reply then Session Manager A 3~ will abort the 16 transaction. If ~ reply i6 received that the transaction i~
17l procee~ , then the ti~er will be reset to a new time. If A
18 queries B a predetermined ~r of time~ without receiving a 19 reply to the original message, then A may abort the transaction.
Separately, this application al~o ~aintains the current 2i date and ti~e, both for user display and for verifying that an 22 electronic note 11 to be received i~ not an expired one, along 23 with other general clock function~ that are commonly used in the 24 industry.
The CrYDto~raDhv application contains a Publ~c Xey 44 2~ operation, a Symmetric ~ey ~5 operation, and a Ra~dom Num~er 27 Generator ~6. While the tamper-res~stance of the Transaction 28 money module ~ ~nd itfi component~ make~ it ~fficult for 8 person 29 to mod~fy the ~tructure of gbe de~ce or its contents, kno~n cryptoy~a~ic techn~que6 are al60 employed to pro~ide ~ecure 3~ commun~cations and p~y~ent tr~nsfer~ between money modules.
32 Public keY cryptoqramhy ~, as is well known in the 2 ~ 2 1 ~rt, ~ay be employed by thi~ application to provide public key 2 diqit~l ~ignatures, w~ich are called ~digital signatures~ or 3 simply ~ignatures~ for brevity. T~e data in electron$c notes 4 11, ~ay be repre~ented by a digital number. The el~_~,onic note~
S 11, are 6igned by digit~l gignatures formed fr~ thi~ number. A
6 digital 6ignature can then be ~a~e~ as co-~ea~o~Ainq to ~
7 part$cular ~ess~ge by snyone kno~ing the cG~.~e3~3.~ public 8 ~ey, which in the preferred embodiment would be ~11 ot~er money 9 ~odules.
$hi8 applica~ion provides each money ~odule with the 11 ability to chsck the digital ~ignature for authenticity. A money 12 ~odule rece$v$ng the digitally ~igned electronic note 1~ can $n 13 turn ~ign and transfer it to others, who could al60 check, sign 14 and distri~ute it.
Because of the none way" nature ~nd computational 16 complexity of public-key digi~al ~ignatures, it $s tho~lght to be 17 infeAsible to decipher and duplicate them within a fea~ble ~8 period of time, making 6uch a ~ecurity 6yste~ resistant to 19 forgery.
Lastly, this application also creates new public and 21 pri~ate keys when ~ee~e~.
22 EYm~etric ~ey crvDto~ra~y ~5 provide~ private key 23 algorit~ms t~at are well known in the art, for lndividual ~es~ion 24 cecurity ~nd privacy between money ~odule6. In ~he preferred embodiment, thi~ ~pplication prov~de~ encryption/decryption mean6 26 in or~er to 6ecure lnfor~ation being exchA~ed between two money 27 moau~es 28 Any well known ~ymmetric key cryptogr~p~y t~c~ique, 29 ~uch a~ the National ~ata ~..c,~ on St~ rd ~DES) ~ystem or ot~er cryptography toc~nique6, may be pro~ided ln thi6 31 application. For exampl~, due to t~e increa~ing intere~t in 32 proYiding cryptogr~phically se~.ed c ~cat~on~, ~anufacturer~

2~80~2 l are providing various semico~ductor integrated circuit devices 2 which perform the encryption and decryption of data. Cylink 3 corporation 1 8 CIDEC data encryption devices are examples of 4 commercially available ~ncryption~decryption circuitry that would be ~uitable in the present invention for this applic~tion. Due 6 to the federally mandated use of the DES algorithm, d~vices such 7 ~8 these ~re widely utilized to implement that algorithm.
8 It is important to note that the details of the 9 particular cryptographic methodology utiliz~d by the money modules are not critical and are not limited to a particular 11 cryptographic t ech~ igue.
12 The Rando~ Number Generator ~6 generate~ random like 13 I~l- her8 for creating new public/private keys for the Public Xey 14 application ~ ~nd new private keys for the Symmetric gey ~5 15! application. This application is utilized to vary in an 1~ unpredictable way the generation of temporary ~ession keys.
17 Circuitry for providing such random number qeneration 18 capability are well known in the art. For instance, a circuit 19 l utilizing a "noisy" diode may provide random values, ~8 is well known ln the industry. Random numbers may also be provided by a 21 pseudorandom n- ~er qenerator circuit which implements a 22 mathematical algorithm, ~uch as the power-residue algorith~, that 23 generates apparently r~ndom values ~rom a ~seed" number. The use 24 of clocks or counters provides anot~er often u6ed ~ource o~
ran~om data. As wlll be understood, the ~and~m Number Generator 26 ~6 may use ~echn~ques that are well known to a person of ordinary 27 ~kill in the art to generate the temporary numbers, ~nd thu~ need 28 not be further descr~bed.
29 It s~oul~ be further under~tood th~t the foregoing functions di6closed ~erein may be performed by known progra~ing 31 ter~igues ~nd/or dedicated hardware and in some cases may be 32 combinat~on of both or shared resources from each. As may be - 2~ -2~804~2 1 appreciated by a person skilled $n the art, ~any changes in form 2 and detail can be made in dep~n~nce on specific application 3 reguire~ents without departing from the ~65'. tial features of the 4 money modules.

Teller ~oney ~odule 6 The h~n~n~ sy8tems 20 of both the I~6utn7 Banks 1 and 7 the Correspondent Bank6 2 interface to the cystem of the ~ invention through a Teller money module S. The Teller money 9 module 5 may be im~edded in ~ny general purpose computer or workstation. The particular de6ign of the Teller money module S, 11 like the Transaction money module ~, may be implemented in 12 readily known programming techn~ ques or dedicated computer 13 hardware, or a combination of both. As will be appreci~ted by a 14 person skilled in the art, various designs of the Teller money module 5 may be employed to implement the functions described 16 herein.
17 The details of one embodiment of the Teller money 181 module S is shown in block form in Figure S. The $eller money 19, module 5 contain~ many of the same component~ and application function~ of the Tran6action money module 4 described above.
21 Therefore, the identical components will only be repeated briefly 22 here, w~ile the distingui~hin~ components will be fully 23 de~cribed. It ~hould be noted that the Teller ~oney module S, 24 like other money ~odules of ~e ~ystem, is a1BO conta~n~ within a tnmper-proo~ enc~osure of the type common in t~e indugtry, 60 26 as to ensure the ne~0~~~ry security ~nvolved.
27 The Teller money module S contains an Fxtern~
28 Interface 30, ~ Session Manager 3~, a Transactor 3~ and a Money 2g ~older 38 th~t perform ~imilar functions to the corr~ol~inq component~ in t~e Trnnsaction money module 4 descri~ed a~ove.
31 Briefly, the External Interface 30 interfaces the 1 Teller money module 5 to ot~er processing and co~unicatlons 2 means with$n the Teller money module S ~ost p~ocesFor; the 3 Session Manager 3~ acts to control and commit ~i.e., finalize) or 4 abort a transaction session between the Teller money module S and another money module; the Money Holder 38 manages the storing and 6 retrieval of electron$c money and the Transactor 32 manages the 7 appllcat$on functlon6 of a To Teller ~4, the Tran ~og ~qr. 36, 8 the Malnt~in Security ~7, the To ~an~ ~7, a To ~oney Generator 9 ~8, and t~e To Transaction ~9.
The following 11st describes ln brief, the applications 1~ contained in the Teller money module S that are ~unctionally 12 identical to the applications found in the Transaction money 13 module 4:

14 - To Teller 3~: Interfaces deposit and withdrawal functions to another Teller money module S .
16 - Tran Log Mgr. 36: Transaction log manager for 17 recording transaction details.
18 - Maintain Security 37: Manages the list of 19 compromised money modules, applies for certificates, synchronizes the clocks, and manages 21 the creation of new digital keys.
22 - Note Directory 39: Keeps track of the location, 23 value and identif$cation of notes 11 by monetary 24 unit. Summary total~ are also maint~ne~.
- Notes ~0: Manages storage for the electronic 26 notes ~ of ~Yc~ge, and creates the transfer~
27 for t~e notes 11.
28 _ Packet MAn~cr 41: ~anages the A~e~ly ~nd 29 disassembly of a packet to be transferred to a different money module.
31 - ~erifier ~2: ~erifies tha~ a received pac~et 32 contain~ valid electronic notes ~.
33 - ClocX/T~mer ~3: Control~ tran~action timeout, 34 expiration of the ~alidity o~ the ole~ nic noteC
3~ 1~, expiration of the cert~fi~ate, and general 36 clock funct~ons.
37 CryptG~a~hy 3~ (i) Public key ~4: used for signatures to 6ign 39 and validate notes 1~ ~nd to ~et up a secure transa~tion ~ession.

2~ 2 1 ~ii) Symmetric key 45: Control~ the ~ecurity of a 2 transaction ~ession.
3 (iii) Random number gener~tor 46: Generates random 4 like number~ for new crypto~a~hic keys.

Some of the di~ting~i6b~ng app7ications are t~e To Bank 6 47 and To Transaction ~ ~pplicat~ons. The To R~n~ application 7 ~7 provides the interfacing mean~ whereby the ~eller money ~odule 8 5 c~ perform eY~ of dat~ for inguiries and ~CGO~
9 postinq~ ~ith the on-line ~ystems of ~ ban~. Thi~ application is al80 utilized for ~&66~hec~in~ the customer'~ ~cc~ number 11 with the ~ooo~nts ana type of transaction ~eing ~6~e_~ea.
12 The To Tr~n~ction appl~cation ~9 perform~ deposits, 13 wit~d~ and payments to loan~. Thi6 appl~cation operates 14 whenever a Teller money ~odule 5 i~ transacting wlth a 15, 6ubscriber'6 Transaction money module 4.
16! As mentioned above, a Teller money module 5 may be 17 associated with an Is6uing Bank 1 or a Co~re~ondent Bank 2.
18 When the Teller money ~odule S i6 a~ociated with a Co~le~ondent 19 B~nk 2, it is utilized for intermediating depos~ts, withdrawals, and payments to loan ac~oul.~s between ~ Transaction money module 21 ~, t~e correspon~nt Bank'~ 2 on-line systems, and an Teller 22 money module S at an I~uing Bank 1.
23 When operating in an Issuing Bank I mode, the Teller 24 money module S i8 used for intermedi~ting depos~t~, w~thdraw~ls, 2~ and payments to loan acco~ etween other money modules and the 26 I~F~ g Bank's ~ on-line ~ystem~. Additionally, w~en t~e ~eller 27 money module 5 i~ performing in ~n ~6--~ng ~ank ~ ~de, a ~Q
2B MoneY G~ or applic~tion ~8 m~y be employed ~en ~ e~ing 29 new note~
Basic~lly, the To ~oney Generator applic~tion ~8 31 performs ~nk~ functions de~llng wit~ request~ for electronlc 32 note6 ~1. It interf~ces ~n Issuing ~ank'6 1 Teller money module 33 S to ~ Money ~enerator Module 6.

2080~52 1 All of the other elements performed in an Iosvtn~
2 Bank's I ~eller money module 5 are ~ ially identical to the 3 ~lmil~rly n~med componcn~s and application functions described 4 above.

Pone~ Generator Module 6 FlgUrQ 6 iB a block diagram illustrating the 7 applic~tion funct~ons of a Money Generator module ~. Money 8 Generator ~odules 6 provide t~e ~ec~Ani6m that S~1ng Ban~s 1 9 utilize to is6ue electronic money. A Money Generator module 6 is 10 al80 enc~e~ ln a tamper-resistant package for the ~me security 11 re~Fo~C ~tated above for other Doney ~odules.

12 A Money Generator module 6 qenerates the elceL~6llic 13 money (in the foro of electronic notes 11, to be described in 141 further detail below), and distributes them to other ~oney 15 ! ~odules through the Teller money module 5 of nn Issuing Bank 1.
16 The Money Generator module 6 includes a unique application not 17 present in other money modules for ,es~o~.A~ to reguests for 18 electronic money. ~his is the MoneY Creator application 50.
19 The MoneY Creator application S0 creates ~nd format~
the electronic objects lepLcsenting value - ~ither currency 21 backed by demand deposits, or credit authorizations - and 22 digitally signs the~e ~electron~c notes Il" u~ing pu~lic Xey 23 cryptography in con~unction with it~ secret key, 80 that it may 24 be sent to ~n Iss~ng Bank'~ Teller money modu~e S.
Notably, 1n a Money Generator module 6 th~ ~o ~Ank 26 application ~7 notifies tAe bank ~y~tems of any irregul~rit~es, 27 ~ff-lo~ds transaction records in the Tran ~og to the Transaction 28 Xeconcil~ation Sy~tem 22 and tr~nsfer6 electronic notes ~ to the 2~ ~oney I~sued R~concil~ation System 23e All o~ the other ~pplications of the Money Generator module 6 are identic~l to the 31 ~imilar~y nn~ed application~ of the money moaules described 2080~52 1 above.

2 The Network 3 According to one ~~r' ~iment of the invention, the 4 individual -- ~r.ents of the present invention may communicate S over a Network 25, as shown in Figure 7. The Network 25 will 6 link together the I~sui~ Banks ~, Co~ y~n~lent Banks 2, the 7 Clearing Bank 3 and the ~ertif~cation Agency 28.
8 Transaction money modules 4 may be coupled to the 9 Network 25 over the tel~ ne ~Y~h~ng- or via ~pe~ term~nal facilities at bank location6 (e.g., additional contactles6 or 11 cable connections at an ATM booth). A communication layer will 12 carry transaction requests (e.g., deposits, withdrawals), packets 13 of notes 11 and new certificates ~ecurely across the Network 25.

14, In the preferred embodiment, the Network 25 will also provide 15!1 directories of financial services, and update the money module 16 cloc~s and the bad money module li~t of all money modules.

17 As will ~e understood, the Network 2S may use well 18 known data link or communications sy6tems and tec~niques that 19 utilize, for example, telop~one lines, fiber-optic land lines, and satellites, and that include co --e~Live, timing ~nd control 21 software and circuitry for allowin~ access and transmitting 22 digital informat~on. The Network 2S may u6e commercially 23 available protocolfi and operating te~hn~ que~ ~uch a~ those 6et 24 forth by the In~ernation~l Standardg Organization ~SO~) for ~S Open Sy~tems Intelco~ect netw~rk standards. It is important to 26 note that the par~icular design of the NetworX 2S i~ not critical ~7 ~nd suitable te~hnologi~ for accompl1e~g t~e ~oregoing data 28 c_ ~ications functions may be used.
29 Each entity ~Banke I and 2, Certifylng Agency 28, or Clearing B~nk 3) i~ also ~s -' to have an individual local 31 networ~ ~6~ 17~ 18 and a gateway to the larger ~ystem Networ~ 2S.

2080~52 1 T~e larger Network ~S will provide directory ~erVicQ~ for the 2 routing of messages to ro~ect to the appropriate local network 3 16, 17, 18. The local network 16, 17, ~- has the ~2 ~sr.sibility 4 of routing mes6ages to the correct money ~odule or a Security Server 27. A Security Server 2~ i6 associated with each 6 participating bank and the Certification Agency 28, and is used 7 for implementing the security of the system.
8 ~igure 7 illustrates thQ preferred embodi~ent of the 9 Network 25 generally, indicating t~at ~oney module~ of a~y participating bank may be intercoupled to the money modules of 11 other bank~ and financial in~titutions, or anot~er r~criber'~
12 Transacti~n Doney module ~ via a communications link directly 13 co~ected into switching and processing centers and alternatively 14, connected to a local network 16, 17, 18 at each entity.
A money ~odule need only identify the local network 16, 16 17, 18 destination (typically a bank subnetwork) for the 17 transmission of most messages. The local network 16, 17, 18 will 18 route the message to an appropriate money module for e~tabli~hing 19 a session. Once a session i~ established, the Network Z5 directs all mes~age~ ba~w~en t~e two money module~. The Network 25 also 21 controls me~sages between money modules and Security Servers 27.
22 Transaction money modules ~ may _-~n~cate over the 23 Network 2S for deposits, withdrawals, payments to loan acco~-lLs, 24 updates or inquiries. The Teller 5 and Money Generator ~odules 6 w~ll si~n on the Network 2S periodically to update security 26 information. The ~ign-on will be initiatad by t~e ~oney module 27 Sess1on Mhnager 31, or by the ~nk Sccurity Server 27 if 28 recertification iB required or if ~here are ~-h~g-s to the bad 29 ~oney ~odule ll~t.
A bank services directory may be available to the money 31 ~odules pr~marily for updating the electronic notes ~1 and 32 performing foreign eY~h~n~e. A list of participating banks for 208~2 1 eitber service will be available from tbe Network 2S
2 In t~e preferred embodiment, the Network 25 will 3 provide time ~ervice~ to tbe individual co~p~en-- of the present 4 inventlon Transaction 4, Teller S and Money Generator modules 6 and Security Server 27 clock~ may be updat-d from ~ Network 6 Server 26 in the Network 2S every time tbat the .e~pec~ive money 7 module acces~e~ the Ne~wo-k 25 8 N~twork Server~ ~ may providQ th- mon-y ~odule 9 services described below, and gateway ~ervices to t~e local network6 16, 17, 18 The application functions of the preferred 11 ~El~o~iment of t~e ~C~Ol~ 8erver 26 are ~hown ln the block 12 diagram of Figure 8 Tbe following application functions are 13 contemplated for the Network Sever 26 14 (1) External Interface S6 - a communications layer which interfaces to tbe Network 2S; and 16l (2) Communication Session Manager S7 - ~anages a 17 co~munication ~ession between money modules, and 18 b~tw-en a money module and the ~e_~lity Server 27 19j ApplicAtion Services ~re provided by (3) Manage Nçtwork Sign-on 5S - ~oJtlols the money 21 module Network ~ign-on process 22 (4) Synchronized Time/Date 59 - keeps money ~odule 23 Clock/Timer ~3 services synchronized to a ~ystem 24 time;
(S) Route ~P~ 0 - directory ~ervice~ for routing 26 mess~ge~, cor~olling ~ e routing dur1ng ~gn-27 on and dur~ng a money ~odule ~e~ion~ and 28 ~6~ Direct to ~ank Service6 61 - provldes 1nformation 29 on services provided ~y participatin~ bAnks A~ will be appreciated by one skilled ~n the art, 31 ~w~t~ g and proce~6~ng center~ t~at are known in the indu~try 32 may be u~ed to enable the networking cooperation between a 2~8~52 1 financial institution and any other that is coupled to the ~ame 2 centers.

3 ~lr~ C ~tes 4 We turn now to ~ further description of the elements of S the electronic notes 11 th~ -olves.
6 An electronic currency note ~1 repre~enting value is 7 essenti~lly an electronic ob~ect created from a transaction ~ t ~deposit or ~ithdrawal) which i8 backed by ~
9 depo~it~ at ~n T~ ng Bank 1. At var$ous time~ ~nd in various po~nts of the ~ystem, the notes may appear in elQctrical or 11 magnetic forms or a~ electromagnetic radiation. The~e notes 11 12 may be transferred over several transactions ~ust l~ke paper 13 money, with the additional property of fungibility that allows 14 the electronic note~ 11 to be commuted and trangferred in amounts less than or egual to the value of the note 11.
16 Notes ll may be split by ~ppendi~ ~ transfer record to 17 the note 1~ and signlng the note 11 using the private 18 cryptographic key of the money module transferring the note 11.
19 Electronic credit note~ 11, however, can only be transferred snce ~n t~e preferred embodi~ent, becau6e it i5 anticipated that its 21 receiver must depo~it the credit note 11 ~o that the loan may be 22 realized.
23 Credit notes Sl, unlike currency notes ll are dr~wn on 24 a ~ubscriber'~ loan accou~t. Each cr~dit note 11 carries the ~c~ num~er lt i8 dr~wn on. The ~cco~ may ~e ~ re~olving 26 credit or credit line on which the not~ drawn, operating 2? ~u~ in the ~me way ~at ~ check or ~ credit card ~co~.L workg 28 in today'~ h~nk~n~ industry. ~redit note~ ~ can repre6ent a 29 part of or all of tbe credit line of the accou~.t.
In the preferred em~odiment, t~e credit note~ 11 can 31 only be transferred to another Transaction money ~odule ~ by the 208~52 1 owner of the ~ccount, and the receiver of a credit note ll c~n 2 only deposit ~t into his or ber accour,- as currency. From there, 3 the credit note 11 i8 cleared wit~ the currency at the Clearing 4 Bank 3. The 6~h~criber~s bank re~o~zes the loan upon receipt S of the cleared credlt note ~1.
6 When credit note~ ll are withdrawn, they do not trigger 7 any aocow~ing trans~ctions in the preferred embodiment. Current 8 credit line processing may to be modi~ied to keep track of the 9 amount ot the credit line in t~e r~hscrlber~6 Transaction money module ~. ~henever the c~h~criber communicate~ with the Tfi~-ing 11 Bank ~ maintaininq the credit line, the amount of the credit line 12 in the Transaction money module ~ is removed and replaced based 13 on any ad~ustments to the credit line in the ~k~ y~tem 20.
14 Total credit notes 1~ plus outst~ g loans must be le~s than or egual to the total amount of the credit line.
16 Electronic note6 11 are compri~ed of three collections 17 of data fields, namely a Body group, a Transfer group, and a 18 Signatures and Certificate group. The Body group of data fields 19 ~ncludes the following infor~tion:

(1) the type of electronlc note 1~, l.e., whether ~t 21 is a currency note 11 or a credit note 11;
22 ~2) t~e l~s~ g Bank'~ 1 identifier;
23 ~3) ~he monetary un~t ldent~fier;
24 ~4) a Note iden~ifier;
(S) it6 date-of-~sue;
26 (6) it~ date-of-expir~tion;
27 (7) the s~h-~ri~er's ac~G~.~ number ~u~Qd only for 28 credit note~
29 (8) ~he ~mount or value of the note S~; and ~9) the ~oney Generator module 5 identifier.

31 The Transfer group of d~t~ fields includes:

32 ~ total o~ the number of times tbat the electronic 1 208~Q52 1 note 1~ was transferred; (provided for currency2 notes ~1 only) 3 (2) a list of transfer records that indicate to whom4 the apportioned note 11 was transferred from, the date-of-tran~fer, t~ a~ount transferred and the 6 ~dentificat~on number of the receiver.

7 The Signature ~nd Certificates group of dat~ fields 8 includes:

9 (1) the digital siqnaturs of the Money Generator module ~:
11 (2) the ~oney Generator nodule 6 certificate:
12 (3) a l~st of payers which contains each payor'6 13 ~ignature and certifioate;
14 (4) the digital ~ignature of the payor: and 151 (5) the payor money module certificate.

16! The notes 11, transfer records, the signature and t~e 17 certi~icate of the chain of the transferred payments constitute 18 the electronic note 11 sent; the remaining amount of the note 11 19 is recorded in the Note Directory 39 of the money module in which 20! ~t i~ stored.

21 It i6 important to note that the authenticity of an 22 electronic note ll is determined by the validity of the d~gital 23 slgnature of the Money Generator mo~ule 6, and the validity of 24 the 6ignature~ of past payors (if present). Any inoo~istencies in this informati~n w~ll cau~e the transfer of any electronic ~6 notes 11 to be ~borted.
27 It ~s also i~portant to note t~at a~ ~ ~ecurity 28 meafiure, a note ~1 will be ~alid for a lim~ted t~me, up to ~ts 29 expiration date. An expired note ~ cannot be transferred, it must ~e updated by tr~n~aeting w~th a partic~pating ~ank. To 31 thi6 end, w~ Trans~ction ~oney module ~ performs any 32 tran~action with a Teller ~oney module 5, all of the electronic 33 notes 1~ s~ored in P Transaction money module ~ w~ll be 34 transferred to the Teller money ~odule S so t~at ~he notes ~ may 2~80452 1 be replaced with updated ones before they expire. This ~ecurity 2 procedure al60 ~elp~ to ~eep offen~ng notes ll from being 3 circulated broadly.
4 As will be understood, every time that a note 11 i6 transferred to ~not~er ~oney module, a digitally signed transfer 6 record $ndicating from whom it ~s transferred i~ arpen~. Thus, 7 the reciplent of an ele~Lu-,ic note 11 will also receive a record 8 of all of the past holders o~ t~e note ~.
9 For example, a $50 olQctronic note 11 may ~e generated, and withdrawn by a Transaction money module ~. Assuming it is 11 transferred to othQr money modules in Slo, Sl~, and S30 12 den~ ~n~tions, the recipient money modules will receive the note 13 11 with the transfer record identifying the flrst Tran~action 14 ~oney module ~. When a recipient of the $10 note 11 transfers SS
of it to a third party, the third party recei~es the note 11 16 along with the record indicating the previous two holders.
17 1 Assuming this S5 note 1~ ~8 then deposited, a record of lt will ~81 be matched with other ~egmentQ of the original S50 note 11 that 19 find there way baok into the ~nki~g ~ystem by the clearing and reconciliation procesaes of the present em~odiment.
21 Only the receiver of the transferred note ~ can either 22 deposit the note ~1 or use it in pay~ent. ~he Verifier ~2 23 application of a money module i~ u~ed to check t~e cignature of 24 each transfer, to de~ermine if tbe note ~ is ~al~d and to ver~fy the identifier in the last transferor as the ~ n~ holder of 26 t~e note 1~. 5~i~ tbwarts the new holder of a note ~ from 27 tryinq to use a value greater than t~at whic~ wa~ tran6ferred.
28 It a~so inhi~its copying notes 1~ for uQe ~n anot~er ~oney module 29 ~ince the ~dentif~ers will not match.
3~ As can be appreeiated, a ~ubscriber may be able to 31 access certain ~nformation about t~e electronic notes 11 ~tored 32 within the ~ransact$on money module ~.

20~4~2 1 In particular, the ~ubscriber may be able to ~elect 2 information on the total amount of the electronic notes 11 3 ~tored, the monetary unit of the notes 11, the type of electronic 4 notes 11, i.e., cu~,~n~ or credit, ~nd the dc - ~nation of each note l~.

6 System SecuritY

7 The ~ecurity of the ~ystem ls ~aint~i~e~ by the 8 participating banks and the Certification Agency 28, which 9 create~ and d$~tributes money module certificate6. a certificate of a money module i6 actually the money module's identifier, its 11 public key, a digital ~ign~ture of the money module~ identifier 12li and public key using the certificatory ~ey (described below), and l3 ! the version of the certificatory key. The certificate is unique 14 in that it ls associated with only one particular money module.
The Certification Agency ~8 provides a 6ecure means for 16 ~money modules to validate each other prior to transacting, first 17 by controlling the mDney module certificate y~es~ and 6e~0n~, 18 by distributing a li~t of bad money module identifier6.
19 In the preferred embodiment, the money module certificate will be initially loaded into the money module by the 21 Certification Agency 2~. The Certification Agency 28 generates 22 the certificate for each m~ney module using a certificatory key 23 ~a private key of the Certificatory Agency 28). It ~ay be 24 changed per~od~cally and di~tributed under version control pro~es~r that are com~only used in tbe indu~try. A~ will be ~6 ~ppreciated, every aoney module will ~tore se~eral versions of 27 t~e certificntory key in order ~o verify certificates created by 2~ an older key. Becaube it i~ anticipated that certificate6 will 29 expire over time, lt is e~ye~ed that only a few ver~ions need be kept.
31 A ~ertificate will only be valid for a limited period _ ~9 _ 2080~2 1j of time ~fter its creat~on. Upon expir~tion of the certificate, 2 the money module will not be allowed to transact with other money 3 ~odules. Any money modules discovered to have been ta~pered with 4 will be limited in the r -unt of damage that they can do to the system 6ince their certificate will not be updated.
6 To b~ocX offending ~odules fro~ tr~nsacting it ls also 7 desirable to have leqitimate money modules receive the latest 8 li~t of offen~ money modules ~oon after the list i8 updated.
9 Naturally, this reguir~s that Transaction money module~ ~ access the Certification Agency 28 on a periodic basi6 to obtain the ll latest list. Placing a time limit on the Transaction money 12 module'~ ~ a~ility to trans~ct ~in addition to the time limit 13 placed on electronic notes ll) will force r-~hs~riber~ to access 141 the Certification Agency 28 through the Network 2S on a perio~ic basis to receive the latest bad money module list along with the 16 a new certificate. Advantageously, the period of the certificate 17j validity can be closely monitored and adjusted according to 18 ~ecurity need~.
19 ~he Certification Agency 2~ distribute~ it~ updated certificatory key and money module certificates on-line through 21 the Security Server 27 (see Figure 9). An important component of 22 the ~ystem'~ ~ecurity is provided by Security Servers 27 at the 23 participating banks and Security Server~ 27 at the Certification 24 Agency 28.
Referring now to Flgure lO, a ~lock diagram of a 26 preferred embodiment of the Security Server 27 1~ ~hown. It i~
27 contemplated that t~e Secur~ty Server 27 at the Certification 28 ~gency 2~ or on ~ bank'~ local network 18 will contain the 29 following applic~tio~ functions:
(1) External Interface S~ - ~ communication6 layer for 31 connectlng to a bank'6 local network 18 or t~e 32 Certification Agency'~ local network 17;

1~ 2080452 1 (2) Session Manager 55 - controls the socurity aspects2 of a transaction ~ession:
3 (3) Create Certificate 50 - certifies a certificate 4 for any of the ~oney ~odules;
(4) Create ~eco~ Profile Sl - certifies and ~igns a 6 bank acc~r.t profile (de~cribed $n detail 7 hereinafter) th~t allow~ a Tr~nsaction money 8 ~odule ~ to access the subscriber's different banX
9 ~ccolr,~;
(S) Distri~ute Certific~tion Keys 52 - distributes the 11 Certification Agency's 28 li~t of valid public 12 keys to the money ~odules:
13 (6) Bad Money Module Control S3 - controls ~nd 14 , distributes the list of bad money modules; and 15 1 (7) &ervices - ~dentical to the cryptographic 16l function~ S, ~6 $n the money modules 17l described above 18 Since certificates will expire over time, ~oney ~odules 191l will be required to apply for new certificates periodically. In order to receive a new certlficate, the money ~odule croates a 21 new public key and private ~ey. The new pu~lic key, the money 22 module ident~fier ~nd the old certificate are ~ nted to the 23 Certification Agency 28 ~fter being digitally signed u~ing the 24 old prlvate key.
The ~ertification Agency 2~ check~ the ~ignature and if 26 it ls Yalid~ signs the new public ~ey and identifier ~nd sends 27 the certificate to the money ~odule with a futur- expiration 28 Bate. ~e Certification Agency's 28 Security Server 2~ also 29 distrib~tes a }ist of b~d money modulec vi~ the Network 25.
3U Initi~lly, e~c~ participating bank's Security Server 27 report~
31 the identifiers of money modules which hold notes ~1 inv~l~dly or 32 that ~re csunter~eit. Those identiflers ~re pAsse~ through the 20804~2 1 Security Server~ 27 and are compiled by the CertificatiOn Agency 2 28.
3 All sucb ldentifiers are distributed to the Teller and 4 Money Generator modules S, 6 ILs~ecLlvely. A money ~odule will not transact with another money module found on the list of bad 6 money modules. Optionally, only t~ose money modules w~ich have 7 demon6trated a flagrant breach of security will be di~tributed to 8 ~ransaction money modules ~.
9 If a Transactlon money module ~ is lost or stolen, the ~hrcriber would report it to hi~her bank or to the 11 Certification Agency 28 ~o that the money module identifier may 12 be placed on the bad money module list to inhibit any further 13 transactions.
14 While the security of the 6y~tem i~ provided by being able to block a money module ~rom transacting, ~ystem ~ecurity is 16 also maintained by providing the expiration date on the 17 electronic notes 1~ in addition to the money module certificate~.
18 A~ mentioned previou~ly, a note ~1 will be valid only 19 for a limited tlme period after it i9 qenerated. Its date-of-expiration i~ a aecurity parameter which may also be monitored 21 and varied as nee~e~. The period of validity of a note 11 can be 22 varied by the value of the note 11. Preferably, a large note 11 23 ~ill expire in a shorter tl~e period t~n a ~maller one. For 24 exa~ple, a Sl,OOO,OOO note may be ~et to expire flve dsys after the date of it6 creation slnce it would provide a significan~
26 incentive ~o counterfeit, while a S50 note ~1 may be ~et to 27 expire after a month ~rom the date of it~ creation.
28 A Tr~nsaction ~oney module ~ ~111 not accept exp~red 29 notes ~ ut it can deposit or e~ch~nge expired notes ~1 it m~y contain for new notec 11. The expiration date~ are çheck~ by 31 the Verifier ~2 nnd Clock/Timer ~3 ~pplications ~n ~ money module 32 before any ele~ol.ic note 11 ifi transferred. Separately, it - 4~ -1, al60 anticipated that if the money module loses power then it 2 will not be able to pay or ~Y~hA~ge no~es ~a after power has been 3! regained until it has communicated again with the Network 2S and 4I has its security parameter~ updated.
5, As ~tated above, a subscriber will typically obtain a 6 Transaction money modulc ~ already loaded with a cert~ficate.
7 Securing the Tran~action money modul~ ~ itself to a hsGriber 8 may be accomplished by asgigning it a unigue PIN, bio~etrics or g ot~er personal 6e__e~ characteri~tics.
BeforQ any personalization of the money module ~ ~ay 11 proceed, the Tran~action money module ~ rhe~c ~f t~ere is a bank 12 ac~oul,~ already stored in the To Teller 3~ application or if the 13 Notes ~0 application contains any electronic notes 11. In either 14 of these cases, the Transaction money module ~ will inhibit the subscriber from securing the module with new ~ecret information.
16 If the Transaction money module ~ has no ~e~o ~
17 "1 ~er~ or no ctored notes 1~, tben the 6-~hscr~er can cecure it 18 by e~t~er entering a PIN, which is reverified by the Transaction 19; money module ~, or by executing a ~ocess in w~ich the ~ransaction money module ~ learns the ~ubscriber's biometrics.
21' Once the personalization has been completed, ~hscriber acc~E to 22! the Transaction ~oney ~odule ~ requires the ~ucces~ful completion 23 of a ~ign-on in which the 6ecret information i5 pre~ented to the 24 Transaction ~oney ~odule ~. If the subscriber can cign on to the 2~ ~ransaction money module ~, then he/~he w~ e permitted to 26 change PIN's or re~nt~u~e biometric~.
27 In ~he 6ituation where a ~ criber ha~ forgotten 28 ~s/~er PIN or had an incident which ha~ affected his/her 29 biometric reading, then the ~ scriber may take h~s/her ~ransaction money module ~ to a partic~pating bank. A ~pecial 31 transaction may be executed which deposits any electronic notes 32 1~ in a holding acco~-~ ~nd de~troys the fitored ban~ account i - 2080~S2 1 n~mber~. Th~ ~ubscriber can now enter new 6~ CL ~lgn-on . 'Ers 2 ~nd characterigtics. Any electronic notes 11 that were removed 3 are returned to the ~ransaction money ~odule ~ ~n~ t~- ban~
4 acoou~t numb-r- may t~-n ~- r-cr--t-~ an~ '~o~J~ ~-low).
It ~hould be noted that it is not a reguirement for a 6 subscriber to identify himself to the ~y~tem when he takes 7 possession of a Transaction money module ~. ~ho~h the identity 8 of t~e money module ~ cont~ned in every transaction, the holder 9 of a Transaction money module ~ can be kept ~ecret. If the relationchip is revealed then one could trace all of the 11 transhctions of a subscriber for the period t~at the relationship 12 can be corroborated. The only tlme a ~ubscriber must reveal hi6 13 identity is lf he/she links the money module to a bank acco~.L or 14 wishes to redeem money lost.
If the ~ubscriber rhoo~ç~ to use the Tran6a~tion money 16 module 4 only for payment~ and ~oreign ~Y~An~ e then he/~he can 17 keep the relat~onsh~p ~ecret. As may be appreciated, the 1~ sub~criber may al~o acguire a plurality of ,~ ction ~oney 19 modules 4 ~nd, for example, link one to bank acCoun~s and maintain the others for anonymous payments. The ot~er 21 Transaction money modules ~ may be loaded wit~ notes ll by 22 ex~An~os with other money moduleg or by eYrh~ng$ng c~sh for 23 electronic notes 11.

24 ~eplacement o~ MoneY Module ~alue If ~ Transaction money ~odule ~ malfunctions or is lo~t 26 or ~tolen, it may be po~sl~le Sor the 6~hscriber to .~e~u~ the 27 v~lue that wa6 ~o~ed in the money module ~t the t$me of the 28 ~ncident. Th~fi would ~ecessitste that the sub~crlber relinquish 29 the option of anonymity for that ~oney module, ~ince upon ~aking a cla~m for the loGt money, he~he would ~a~e to ~erify that 31 he/~he i6 the owner of the Tran~action money module ~.

20~0~52 1 To provide for the replacement of electronic notes 11, 2 the subscriber may first link his/her Transaction money module ~
3I to a bank acco~ or register ownership of the Transaction money 4 module ~ with the Certification Agency 28. After every transaction involving the transfer of electronic notes 1~, the 6 ~ubscriber could save the Tran Log, which identifies the 7 counterparty money module identifier and the note identifier, to 8 ~neYp~n~ive, non-volatile ~torage which i~ removable from the 9 host compu~inq environment. This log may be ~sented by the ~h~criber when making a claim to replac~ value. The log may 11 then be compared to reconciliation files to determine the true 12 value of t~e lost ~lectronic money.
13 An alternative to this procedure would be to refresh 14l the money in the Transaction money module ~ frequently. This would mean that the notes ~1 in the Transaction money ~odule ~
16 would be represented by transaction records at the I~suing Banks 17 ,1 . The existence of the notes ~ could be verified by -c~nn 18 these files.
19 A third alternative would allow the ~ystem to capture a money module's Tran Log when money i5 refreshed. These l~_GL~s 21 would be copied and routed to Tss~ling Banks 1 for ~torage on 22 Itheir tran~action histories. The existence of the notes 11 could 23 t~en be ver~fied as in the previous alternative.

24 Bank Acce~s According to one ~spect of the invention, a customer'~
Z6 Tr~nsaction ~oney module 4 ~ay Acce88 ~is/~er acco~.~ for 27 deposit~, withdrawal~, transfers, etc., at any bank participatin~
28 in the ~ystem ~nd ln part~cular any bank ~old~ng an account with 29 the ~ubscriber. For instance, a typical subscr~ber may have a savings accou~.L an~ a check~n~ accGunL at o~e of the 31 partic~pat~ng banks, while maintaining a so-called ~oney ~arket 2080~2 1 account at a 6eparate financial institution, and perhaps a 2 credit-line account at a third participating bank. It iB
3 ant~cipated that a ~ubscriber'~ Transaction money ~odule ~ will 4 acce6s his/her acco~.Ls for deposits, wit~a~16~ loan payment6 and inguiries at any bank or financial institution which can be 6 accesse~ through the Network 25.
7 If a ~hscriber ~as multiple acco~n~s, the 6~hscriber~s 8 ~ccol~nt relationship~ with a bank will be stored in an acroun~
9 profile in the To $eller 3~ application of the ~r~nsaction money module ~. The ~ultiple ~C0"~-8 can be linked together by t~e 11 personal acc~un~ number (~PANn) associated with the individuai 12 6ubscriber.
13 The accou~.t prof$1e may be created either in person, 14 under the control of a bank 6ubscriber ~ervice ,e~e~entative at a branch, or over the telephone utilizing a ~pecial d~alogue.
16 For example, the ~h~criber may identify h~m6elf by his PAN and 17 PIN. He may then enter each account number he wi~e~ to acce6s 18 from hi~ ~r~nsaction money module ~. The ~ccou~L numbers may be 19 verified in the bank'~ accounL reference files. A cross-reference of accoun-6 to Transaction money module6 4 ~ay be 21 maintained by each bank if they 80 C~OOFe.
22 The compo~ition of an exemplary accoun~ profile may be:
23 ~1) BanX Identifier -- one for e~ch bank;
24 (2) Acco -~ Num~er~;
(3) Pc~o~ Type6 -- e.g., chec~ a~ings, credit;
26 and 27 (4) Security Server'~ 27 ~ignature on t~e ~ist of 28 ~cc~.~.

29 It will be understood t~at the list of accou~,t numbers will be digit~lly signed by the bank Security Server 27. a~
31 further ~ecurity ~easure the ncco~ profile may be re-signed 32 with an updated publ~c key on a periodic basi~. The fundamental - ~6 -208~2 1 ~ccess ~ecurity is provided by t~e digit~l ~ignature of the 2 bank's Security Server 27.

3 Bank~n~ SYstem ~Acc~un~inq architecture) 4 It i~ a notable fQature of the preferred embodiment, that the method oS the ~y tem can parallel the existing and 6 v~rying types o~ accoun~ng met~ods th~t exifit today. The system 7 of the preferred emko~ ~nt fol~ows the various types of 8 acco~ing met~ods pr~cticed ~~ r.~ly in various banks.
9 Howev-r, it iB import~nt to note that unlike the present ~ki ng ~0 cy~tem, in the preferred '-~ment of the lnvention, ~conomic 11 value iB created on demand. Thu6, there is no lnventory of cash 12 or ~ho~ involved electron~c ~UL el~ from demand deposits ~nd 13 electronic credit are created on a real-time basis. This 14 eliminatlon of a paper inventory by u~ing an electronic media of exchange requires certain supplements to t~e commonly practiced 16 ~cco~ ing tec~gue6 to provide the real-timo ~ccoun~ing ne~e~.
17 Accordin~ly, the f~ iment of the ~L~P~nt ~nvention 18 provide~ an accoun~ing structure to supplement tho~e used in the 19 pre~ent ~A~k~n~ systems 20. The improved acco~r.L$ng arrangement may be utilized to monitor the electronic money and each bank's 21 obliqation when a financial transaction between a Transaction 22 money module ~ and a Teller money module S OC~LC~ or when a 23 Clearing Ban~ 3 perform~ any clearing p~ocrs~
24 W~en electronic notes 11 are tran~ferred to or from Teller money module S, in most cases ~c~vu..~ing tran~actions 26 ~ffecting the ~co~d~ of the ~n~in~ ~y~tem 20 ~rs created.
27 Con~ersely, transfer~ between Tr~nsactlon ~on~y module~ ~ do not 2~ involve ~ny ~ormal acoo~-~ing ~occ-~res -- they involve only the 29 tr~nsfer of electron~c notes Sl.
In the ~ystem being described, it i8 anticipated that 31 the followinq arrangements of aCCOUn~S Are to be utilized for 2080~52 1 eac~ type of bank, categorized under eac~ monetary unit:
2 At an ~suing Bank 1-3 (1) Money Issued Aeco~.L: A liability acc~ which 4 reflect~ the money iseued but not cleared.
S (2) Money Due Açco~.L: An asset accoul.- reflecting 6 the money deposited to the bank'~ acco~,~s.
7 (3) Deposited ~t Clearing Bank Accv~ln~: An asset 8 accou~.L reflecting the balance of a cl-aring 9 rcoo~ at a Clearing Bank 3.
(4) Co~s~ol.~ent 8ank Money ~co~ A liability 11 account owned by a Co~4~o~~nt Bank 2 which is 12 drawn upon by the CoL~spo.. ~e~t Bank 2 to di6pense 13 ~lectronic money.
14 15) Money In Tranait ~co~L: A zero-ba~Anoo liability ~ce~ owned by each bank, which ie 16 used to temporarily malntain ele~ ... ic money 17 during _ financial transaction.
18 (6) Foreign Exchange ~co~r.L: A zero-balance 19 liability accoun~ owned by each bank, which is ueed to handle multiple currency ~Y~t~An~es.

21 At a Co.. -~onAent Bank 2 -22 (1) Deposited at I~suing Bank ~co~ : An ~sset 23 ~ccou"~ reflecting the balance of the 24 Co~._syon~t Bank 2 ~ccount at t~e T~ ng Bank ~.
26 t2) Money Due AccounL: An a~set 27 acco~ reflecting the money 28 deposited to the bank'~ accounts.
29 (3) Foreign ~Ych~nqe ~oco~.L: A zero-bAla~e liability acc~un~ owned by each bank, which i5 31 used to handle multiple currency eY~h~nge6.
32 ~4) Money In ~ranslt A~COUnL: A zero-balance 33 liabi}ity accounL owneB ~y e~c~ bank, which is ~4 used to temporarily maintain ol~ o~.ic money dur~ng a ~inancial transaction.
36 At the Clearing Bank 3:
37 t~ s~ti~q Bank Clearinq AccounL: A liability 38 ~cco!~ to net the ~ntount of ~oney cle~rod for ~n 39 Ifisuing Bank 1.

m e acc~ , wlth their ~o~F~o~ ng ~ymbol~, ~re 41 ~ rized below:

208~452 1 Type of Bank Acouu,.~ Name Type owner Sy~bol 2 Is~uing ~oney TFs-~d Li~bility I6s~ng MI
Money Due a6set I66~ng MD
Deposited at Asset ~ESu~ng DC
Clearing Bank CorresponAP~t ~i~bility CO~L ~ on~nt ~M
Bank Money Money In Liability Is~ IT
Tran~it Foreign Liability I~ 7 FX
~Y~'I Ar~~
3 CoL~s~ond~nt Deposited ,t Asset ~G,,~yo.)drnt DI
Issuing 9ank Money Due A~et Co,.~spQ~ent MD
Money ~n Liability Co.,~ ~nt IT
Tr_n~it Foreign ~iability Co.,~e3~c '~ ~ FX
FY~ a nge 4 Cle~ring Clearing Liability Issuing CA
Acc~
Transaction ~oc~ssing, for a transaction such _s a 6 request for a withdrawal from savings, select~ accvun~ing 7 proce~ses ~o tbat the appropriate ~cco~ may be credited and 8 debitQd accordingly. It i~ anticipated that the AccG~ ing 9 procss~E will be using ~of~w~re progr~ms and met~ods that are well known in the art and ~,PEo~tly available; inasmuch a~ ~ny of 11 the programs ~nd methods currently practiced and known for 12 providing the foregoing accoun~$ng proceA~ e~ would be suitable 13 for use in the inYention. ~o better understand the accG~-~ing 14 ~ocesseF of the invention, ~e~eral examples Of typlcal 1~ transaction~ and t~e~r ~sociated acco~ting ~teps will be ~6 de w ribed.
17 Accordlngly, Figure~ 24 illustr~t~ the Aç~o~ ing 18 transaction~ for depo~itE, w~thdrawal~, foreign ~Yr~A~5Eg, lg rece~pt of cle~red ~oney, elc~tLonic money/c~sh ~r~-,e~ and note Sl updatcs. F~gure~ 14 and 19-22 also illustrate the 21 ao o~.ting flows when a Tran~action money module ~ conta~ns notes 22 11 that ~re not ~n~olved in the particular transaction that i8 23 o~ ing. The no~es 1~ th~t are not part o~ t~e transaction ~re 2080~S2 1 r~mov~d ~nd replaced with updated notes as diEct~Q~ in the 2 ~ecurity procedures described above. For example, when a 3 ~uhscriber deposits less electronic ~oney than i~ stored $n 4 his/her Tr~nsaction Money Module ~ and lea~es a balance, the electronic notes ~ esenting the balance are then replaced 6 with electronic notes 11 containing t~e most up-to-date 7 certificates. This latter case i~ indicated in the parenthetical 8 entries on Figures 11-14 ~nd 19-22.
9 Sn an example of th- accoun~ing arral.ye -nt~ according to the invention ($11u~trated by ~igure 11), if a r~h~criber were 11 to deposit SS0.00 out Of Sloo.oo of electronic money contAine~ in 12 his/her Transaction money modules ~ at a Co..es~o~ t Bank'~
13 ~eller money module 5 (Step 1), the entire Sl~~ of electronic 14 money would be extracted of w~ich S50.00 would fir~t be credited to his/her customer acco~nt (herein denoted by nAn), the 16 remaining S50-00 would be credited to the CorrespQn~e~t Bank's 17 Money In-Transit accoun~, and S100 would be debited to the ~oney 18 Due accoun~ at the Col~s~ondent Ban~ 2. See "I~" and "~D" ln 19 F~gure 11.
After ~he $100 of electronic notes 1~ is removed, the 21 notes 1~ are deposited from the Correspondent Teller money module 22 5 to the Teller money ~odule 5 of an Issuing Bank 1 tStep 2). In 23 accomplishing thi~ transfer, the Money Due accounL at tbe 24 Correspondent Bank 2 i8 credited Sloo w~ile it~ Deposited at I6su~ng Bank aoco~-~ i6 de~ited by $100; the S~suing B nk ~
26 cre~its its ~o,,es~o~ t Bank Money ~ccou,.L by S100 and de~1ts 27 it~ Money Due ~oco~ by Sl~~-28 In Step 3, the updated notes 11 are requ~sted. ~us, 29 the Correspondent Bank 2 reguests from t~e Issuing Bank ~ the withdrawal of $50 o~ electronic money cont~n~nq t~e most recent 31 certificate6 from its ~oney Generator ~odule 6. To ~upport this 32 request, $50 ~8 credited to the ~epo6ited at I~s~ing Bank acco~n~

20~0452 l and $50 is debited from itg Money In Transit accoun-. The 2 Issuing BanX 1 then deb~ts S50 from its Col~e~ponaent Bank Money 3 account and credit~ SS~ to it~ Money Issued ~cco~
4 To co~plete t~e transaction, the $S0 i6 then transferred from the Money Gener~tor ~odule 6 to the 6 Correspondent Bank's 2 Teller money module S through the Iss~
7 Bank's l Teller ~oney ~odule 5, and finally to the Transaction 8 ~oney module 4 (stepfi 4-6)~ The net result of all of these 9 transactlons ls that SS0 remains deposited in the -h-oriber'~
accoul.t and SS0 of newly is~ued electronic notes ~ are now ll stored in the Transaction money moaule ~ of the r~ rlber.
12 Alternatively, if a r~hscriber begins with SSO in 13 his/her Transaction money m~dulQ ~ and deposits ~ll of it, the 14 customer acco~..~ would be credited $50 and the ~oney Due acc would be debited by $50 ~Step 1 of Figure ll; parenthetical 16 entries).
17 ~hen there are only S50 of eléctronic notes ll that are 18 removed, the correspondent Bank 2 credits the Money Due ac~oun l9 S50 and the Depo6ited at Issuing Bank aCCoull~ i8 deblted $50 (Step 2, parent~etical entries). This money i~ then deposited at 21 the Issuing Bank l for later clearing, wherein the Co.~e~ondent 22 BanX Money ACOO~L i8 credited by $50 and the Money Due acco~l~
23 is de~ited by $50. Because no updated electronic note~ ~ need 24 be returned in thi8 situat~on, t~e deposit and its co~La~onding ~ccoul,~ing ~ completed at Step 2.
26 The accounting y~OCE550~ of an electronic ~oney ~eposit Z7 at an l~suing Ban~ 1 instead of a Co~DspQr.Aent Bank involve 28 fewer operat~onal ~teps, w~ch are illustrate~ in ~lgure 12.
29 uging the s~me dollar r~ 9 as ~n t~e prev~ous exemplary 30 transac~ion, w~en S50 of $100 in electronic mongy ~tored in the 31 Transaction money module ~ are deposited directly to an I~su~ng 32 Teller ~oney module (Step l), $50 would be credited to the 2080~52 1 customer6 ~ccount (A). Fifty dollarg would 6imult~neol~cly be 2 credited to the Money In Transit acc~un~, and Sloo would be 3 deb~ted to the Money Due account at the I~suing Bank ~.
4 Since the entire $100 6tored in the Tran~action money module ~ i~ removed ~nd transferred to the Iss~ng Ban~'6 Teller 6 money ~odule S, it i8 necessary to return $50 of updated notes to 7 the Transaction money module ~. Accordingly, as shown in Step 2 8 the Teller ~oney ~odule 5 requests S50 from its Money Generator 9 mod~le ~, debiting it~ Money In Tr~nsit ~oc~ by S50 and crediting it~ Money I~sued ccount by S50.
11 In r-sponse, S50 i~ created by the ~oney Generator 12 module 6 and transferred to the Teller money module 5, which in 13 turn trancfer~ this electronic money to t~e Transaction money 14 module ~ (Steps 3-4).
When only S50 i6 stored ~n t~e ~ransaction money module 16 ~ and all of it i~ deposited, the customer'~ accv~n- (A) i~
17 credited SS0, the Money Due acooun~ iB credited S50, and th~t ig 18 the end of it. See parenthetical entries in Step 1 in Figure 12.
1~ In the case of a with-~a~al from a CG~e~yoJ~ent Bank ~ee Figure 13), a withdrawal reguest of $100 by ~ subscriber 21 using a Trans~ction ~oney module ~ at a Correspond?nt Bank 2 will 22 cause t~e ~u~scriber's ~ccv~n~ (A) to be debited by Sloo and the 23 Corre~pondent Bank'~ 2 Money In Tran~it account to be credited ~y 24 $100 ~Step 1). ~he reque6t for the $100 withdrawal 15 forwarded to the ~s~ng Ban~ ~ from t~e Correspondent ~ank 2, and t~e 26 Co~e~v~ Ban~'s Deposited at Iss~nq Bank 8~v~-~ i6 27 credited by $100 wh~le ~ts ~oney ln Tran6it ~ccoun- ~ d~bited by 28 $100 (Step 3).
29 Next, t~e request for $100 i6 ~orwarded ~y t~e lssuing Bank's ~ Teller money module S to the Money Generator module 6.
31 Ackordingly, the Correspondent BanX Money accoul.- gets a Sloo 32 debit while the Noney ~66~e~ accoun~ gets a Sloo credit (Step 4).

208~4S2 1 The Money Generator module 6 then creates the $100 of 2 electronic notes 1~, and tran5fers it to the Traneaction money 3 ~odule 4 via the Issuing Bank~ ~ Teller money module S and the 4 CG L~Ondent Bank'~ 2 Teller money ~odule 5 (Steps 5-6).
W~cn, e.g., the ~ubscriber makes the Sl~~ withdrswal 6 reguest with a Trans~ction Money Module ~ that contains S50 of 7 electronic notes ~1, the notes ~1 are removed and now the Money 8 Due aCC~U11~ iB debited S50, the ~hs~ri~er~ -c-co~r.~ till 9 debited $100, and the Money In Tran6it acco~,~ i~ credited S150 (parenthetical entries, Step 1).
11 The S50 is then depo~ited to an I~s~nq Bank ~, causing 12 the Money Due ~Ocv~ to be credited S50 and t~e Deposited at 13 Issuinq Bank account to be debited by $50. At the Is6uing Bank 14 1, the Correspondent Bank Money accoun~ is credited S50 while the Money Due account i6 debited $50 (Step 2, parenthetic~l entries).
16 Because 550 of notes 11 have been . ~ed, the 17 withdrawal regue~t in Step 3 must be for $150- This re~e 5 -18 causes the Depo6ited at Issuing Bank ac ou.,t to by credited by 19 $150 and the Money In Transit accoun~ to be debited by $150 (Step 3 parenthetical entries).
21 At the Issuing Bank, 5150 is requested from the Money 22 Generator Module 6 and the Correspondent Bank Money aeco~n~ gets 23 a $150 debit while t~e Money Issued a'CC~J~ gets a $150 credit 24 (Step 4 parenthetical entries). A~ above, the money generated by the Mo~ey ~enerator ~odule ~ ~SlSo) get~ conveyod to the 26 Transaction money module 4 ~a the Issuing Bank 1 and 27 CorreD~v.,~cnt ~nk 2 Teller money module~ S ~Steps 5-6, ~8 parenthetical entries).
29 A withdrawal from an Issuinq ~ank 1 ~nvolves fewer accoun~ing ~Oced~es. Referring now to Figure 14, a withdrawal 31 regues~ by a Transaction money module ~ from an ~ssuing 8ank 1, 32 will cause the I~ ing BanX I ~eller money ~odulc S to debit the 208~4~2 1 ~ubscriber' 8 acco~ ~ (A) by Sloo and credit its Money Issuing 2 account by $too (Steps 1-2) 3 A request for an updated $100 1~ then made by the 4 Issuing Bank's 1 Teller ~onsy module 5 to the Money Generator S ~odule ~, which upon its creation will .~ ~., 5100 to the ~F8v~ng 6 Bank's Teller money ~odule S (Step 3) In completinq the 7 transaction, the To5~-~n~ Bank~ 1 Teller money ~odule S ~imply 8 transfer~ this new $100 containing the most recent certificate to 9 the Tran~ction mon~y ~odule ~ ISt-p 4) Alternatively, when the Transaction money module 11 contain~ $50 at the time of the S100 withdrawal, (parenthetical 12 entrieg) the $50 will be removea, the I~s~ing Bank'~ Money In 13 Transit accuu ~ will be credited SS0 and the Money Due acc 14 will be debited S50 t8teP 1).
The I~ ng Bank 1 mu~t now request Slso from the Money 16 Generator module 6 Naturally, the customer~B a~cG~L i8 debited 17 $100 The Money ~sued ac~o~ ~ is credited by Sl50 when the new 18 notes 1l are created, and the Money In Tran~it ~ooo~" ~ i~ debited 19 $50 (Step 2) From there, $150 i~ returned to the ~r2nsaction money module ~ via the I~su~ng ~ank's 1 Teller money module S
21 ~Steps 3-4) 22 ~igure 15 illustrates the case of a foreign ~Y~h~e 23 with an I~s~ g Bank 1. In th~ example, a ~h~criber wishes to 24 eYc~Anqe $100 of ele~v ic money 6tored in his/her Transact~on money module 4 for ~60 of Britlsh ~ rcy The d~posit at the 26 Iecuing ~ank'~ 1 $cllQr money module S Will cau~e the ~QF~ng 27 Bank'~ ~ Foreign ~Y~An5e ~C~ to be credited by ~60, wh~le 28 it~ ~oney Due ~cco~nt would be debited by $100 (Step 1) Here, 29 the ~100 i~ transf~rred fro~ the ~ran6action money ~odule ~ to the Teller money module S, which then reque~ts th~t an electronic 31 note SS represent~ng ~60 be created by the Money Generator module 32 6 (Step 2) 2080~2 1 At the Issu~ng ~ank ~, the foreign exchan~e accou.-t is 2 now debited by ~60 while the Money Issued a~CVt~.~ i8 credited by 3~ ~60. The ~60 electronic note 11 created by the Money Generator 4 module 6 i8 transferred to the Teller ~oney module 5, wh~ch now 6tores both the $100 and t~e ~60 ~Step 3). The ~60 is then 6 transferred from the Teller money ~odule 5 to the Transaction 7 money ~odule ~ re~ulting in a net balance of ~60 in the 8 ~ransaction money module 4 and S100 ~ n~g in the Teller money 9 module 5, completing the tr~nsfer (Step 4).
The acco~.-ing ~.oc~l~..s for a foreign ~ n~e of 11 Sloo for ~60 ~t a Col,r~ollent Bank 2 are shown ln Fig. 16. The 12 Transaction money module ~, in thi~ example, reguest6 that it~
13 $100 be used to "purchasen ~60 from the CoLL~s~-r~nt Ban~'~
14 Teller money module 5, which causes the Co~r~ ol~'t - Bank'~
Foreign ~c~ge acco~'~ to be credited by ~60 while it6 Money 16 Due ac~oul.~ is debited by Sloo (Step 1). The $100 stored ~n the 17 ~ransaction money module ~ is transferred to the C6.Lespo~-dent 18 Bank's 2 leller money module 5, which sends ~ request to the 19 Issuing Bank'6 1 Teller money module S to withdraw ~60, and debits its Foreign ~ychAnqe acco~ by ~60 and credit~ ~ts 21 Deposited ~t Issuing Bank a~co~ by ~60 (Step 2).
22 The corresponding accour,~ transaction ~t the Issuing 23 ~n~ 1 debits the Co~Le6~,0n~Pnt Ban~ Money aCCOUII- by ~60 and 24 credits t~e Money Is~ued aco~ by ~60 (Step 3). ~he I~uin~
Ban~l~ Teller money module 5 then reqyests th~t the Money 26 Generator module 6 cre~te ~60 and transfer it to tb- Tesuing 27 8an~8 Teller money module S, w~ch in turn transfers ~t to t~e 28 Corres~oJJd2nL Bank'~ 2 Teller money module 5 (Steps 4-5). From 29 there, t~e ~60 note 11 18 transferred to the Transaction money ~odule 4, leaving it with a balance of ~60 while the 31 Corres~ndcnt BanX's 2 Teller money module S f~ni~hPs w~t~
32 balance ~f $100 (Step 6).

2~80~

1 The accounting transaction~ for a withdrawal or deposit 2 of credit notes 11 also involves several accou~ing operations, 3 as shown.in Figure 17. When a hr~ribQr wishes to withdraw 4 money from his/~er credit line (Step 1), the proper credit note 11 is 6imply transferred from the Money Generator module 6 to the 6 Transaction money module ~, reducing the cu6tomer's credit line 7 by an equal amount to the amount tran~erred (Steps 2-4).
8 Alternatively, when credit notes ~1 are deposited by a 9 ~u~scr~ber's ~rans~ction money module ~, tbe subscriber~s acco~
is increased by the ~mount depo~ited, and the Money Due ~cco~
11 is debited by an <~ual ~mount (~tep 1).
12 The ac~o~ ing operations involving the T~s~1ng Bank's 13 .1 receipt of cleared electronic money will now be described.
14 Referring to Figure 18, in thi~ example $100 of electronic money and Sloo of credit notes 11 have been cleared by the Clearing 16 Bank 3 to settle the balances among several I6suing Banks 1. The 1~ $100 of electronic money and the Sloo of credit notes are 18 transferrea to the proper Issuing Bank I ~Step 1). Additionally, 19 S50 of electronic note6 1~ that it bas issued are al80 deposited at the Issuing Bank ~. Consequently, the T8~lln~ Bank 1 will 21 debit the ~ubscriber's accoun~ A by Sloo, debit the Issuing 22 Bank'~ Money I6sued ~cco~ by S150, credit the ~oney Due accoun~
23 by S50 ~nd credit t~e Irs~jn~ Bank's Deposited at Cl~aring Bank 24 ao~ou~-~ by S200 to complete the tr~nsactlon.
Turning now to Fig. 19, an accounting example of an 26 ~YchAn~e of ca6h for ~lectron~c notes 1~ at an I~ Bank 1 ~s 27 shown. In t~1~ example, the subscri~er wi~he~ to ~X~hA~,e SS~ ~f 28 cash for S50 of el~L~o~ic notes ~1 to ~dd to the S100 of 29 electronic note~ 11 already stored in hi~/~er Transaction money module ~.
31 In the fir6t transac~ion, the S50 of cash i5 deposited 32 at t~e I~suing Ban~ ~ w~ic~ causes the Money In Transit ~cou~.

2080~2 1 to be credited by $50, while the cash account i~ debited by $50 2 (Step 1).
3 Next, the $100 of electronic notes 11 in the 4 Transaction money modulQ ~ i~ removed, resulting in the Money In S Trans~t account be$ng credited by $100, w~ile t~e Money Due 6 account i~ debited by sloo (Step 2).
7 The Teller money module S will now reque~t S150 of 8 electronic notes a~ from t~e Money Generator module 6 to return 9 slso of electronic notes 11 to t~e subscriber ~Step 3).
Accordingly, the Noney In Transit acco~n~ i~ debited by $150 11 w~ile the Money I6~ued acco~.~ i~ credited by S150.
12 The newly generated $150 of electronic notes 11 $s then 13 transferred from the Money Generator module 6 to the Teller money 14 module S, which $n turn tran~fers the $150 to the ~ub~criber'~
Transaction money module ~ ~Step6 4-5). The completed 16 transaction leaves the ~ubscriber with Sl50 of electronic notes 17 ~1 nnd the I~uing Bank'~ Cash ~coou..~ containinq a sso h~lA~
18 Al~o ~hown parenthetically in Fig. 19 is the case when 19 the subscriber eY~h~nge~ $50 of cash for electronlc notes ~1 when there i~ a zero bal~nce $n hi~/her Transaction money module ~.
21 In Step 1, the $50 of cash is deposited at the Iss~lin~ Bank 1 22 Iwhich causes the Money In Tran6it accoun~ to be credited by $50, 23 while the cash ~ccou..~ i~ debited by S50. Since no notes 11 are 24 re~oved, no Ac~e~ ing 1~ performed in Step 2.
In Step 3, only s5n i~ reguestea from the ~oney 26 6enerator ~o~ule ~, ~nd ~he Money In Tran~it acco~.~ i~ debited 27 by S50 w~i~e the Noney s~Sue~ acc6~ credited by S50. The 28 6ame trans~e~ ~etween money modules Qccurs ~8 in Steps 4-5 of 29 Fiq. 19 described abo~e, u~ing only t~e S50 that was requested.
This wou~d leave the 6~h~criber w~th S50 of electronic notes ~1 31 in lieu of his oriqinal S50 of paper money.
32 In Fig. 20, an exchange of cash for electron$c note~ 11 208~2 1 at a Correspondent BanX 2 i8 8hown. Thi8 example uses the same 2 param~ters a~ in F~gure 19, namely, the ~ubscriber ha~ $50 of 3 cash and S100 of electronic notes 11 in his Transaction money 4 module ~.
When the S50 in cash i~ depo~ited to the Co,.6~0ndent 6 Bank 2, its Money In Transit accou,-- is credi~ed S50 while its 7 Cash accoun~ i8 debited $50 (Step l). The Sloo of ~lectronic 8 notes 11 i8 then transferr-d from the Transaction money module 9 to the Correspon~ent Bank 2 which credit~ it6 Noney In Transit accGul~ by Sloo and debits its Money Due acoG~I-- by Sloo (st-p ll 2).
12 ~rom there, the $100 of electronic notes 11 i~
13 deposited at the Issuing BanX 1, wherein its ~oney Due account 14 debited by $100 while its Co~Le~l,on~nt Bank Money ~c~ou.-~ is credited by Sloo (Step 3). At the Corre6pondent Bank 2, the 16 ~eposited at Issuing Bank accou~t is debited by Sloo while the 17 Money Due ~COUII~ is credited by $100.
18 A withdrawal request 1~ then made by the COL ~ eD~Ondent l9 BanX 2 for Sl50 from the Is~uin~ Bank 1 (Step 4). This reguest results in the Cos~e~or.~e~t Bank 2 debiting its Noney In Transit 21 ac~ou--~ by S150 and crediting its Deposited at IESU~ng BanX
22 accoun~ by $1S0.
23 Correspondingly, the Issu~ng ~ank l Teller ~oney module 24 5 reque~ts S150 of notes 1I from the Money Ge~erator Module 6, deb~ts its COL~ ~s~Grl~Qnt ~ank Money ~ou~.~ by S~50 and credits 26 ~g Money Issued accG~.L by $150 (St~p 5).
27 Fin~lly, the Sl50 of electronic notes ll i~ transferred 2B fro~ the ~oney Gener~tor ~odule t to the ~uing B~nk~s ~ Teller 2g money module 5 w~ich transfers it to the Tran~act~on money module ~ ~fter passlng throug~ the Correspondent BanX'~ 2 Teller money 31 ~odule S ~8tep~ 6-8).
32 Alternat~ely, ~ h-criber ha~ing $50 of cash and no 2080~2 1 notes 11 in his/her Transaction money module ~ is also 6hown in 2 Fig. 20. As in the first case, the S50 in cash is deposited to 3 t~e Correspondent Bank 2, lts Money In Transit acco~ is 4 credited Sso whlle its Cash accoun~ i~ debited $50 ~Step 1).
A S50 withdrawal re~eFt iB thBn made to the I~uing 6 Bank 1, and the Money In Transit account i~ debited by $50 while 7 the Deposited at F~ ing Bank acco~ ic credited SsO (Step 4, 8 parent~etical entry). Thereafter, $50 is regu~sted from the 9 Money Generator Module 6, the CoL,es~Q-~A~nt Bank Money Acco~ is debited $50 and the money i~sued ac~o~,t is credited S50 in Step 11 5 ~parenthetical ~ntry). Here, S50 in electronic note~ ll are 12 transferred through the same money module path ~s Steps 6-8 13 abo~e, to reach t~e ~ransaction ~oney module ~.
14 Figure 21 illustrates the ex~-h~nge of electronic notes 11 for cash at an I~suing Bank 1. Here the ~hsrriber has $100 16 of electronic notes ~1 stored in his/her Transaction money module 17 ~ and w~shes to ~YchAn~e $50 of the electronic notes 11 for S50 18 of paper c_sh.
19 After the Tr~nsaction money module ~ establi~hes 20 ! communications with the I~s~l~n~ Bank'~ 1 Teller money module 5, 21l ~11 $100 o~ the electronic notes 11 is removed from the 22 Transaction money module ~ ~Step 1). This causes the ~oney In 23 Transit account to ~e cred~ted by $1~0 and the Money Due acco~-~24 (at the ~s~n~ Bank 1) to be de~ited by $100.
The Telier money module S then request~ S50 of updated 26 electronic notes ~ fro~ the Money Cenerator module 6, and thi~
27 tran~action requires the ~oney In Transit acco~ to be debited 28 ~y S50 ~nd t~e Money T~U~~ ~c~ L to be credited ~y S50 ~Step 2g 2)~ The newly generated S50 of ele~t~onic notes S~ 18 t~en transferr~d to the ~ransaction money rodule ~ throu~h the Teller 31 money module S. The S50 of paper cash i~ then transferrQd to the 32 ~ubscriber throu~ a ~eller or ATM (Steps 3-5).

2080~2 ~ o 6hown in this figure ~parenthetically) is the 2 sub6criber ~a~in~ the same exchange for cash w~en only $50 is 3 ~tored ln his/her Tran~action Money Module ~. At t~e Issuing 4 Bank, S50 of electronic notes 11 i6 removed for which the Money In Transit accou~.~ is credited SS0 and the Money Due acco~ is 6 deblted ~0. Fifty dollars of paper cash is then .cLuL..ed to the 7 6l~hscriber since he/s~e only deposited SS0 of electronic notes 11 8 (Step 5).
9 Completing this transaction, in both cases t~e Money In Transit acco~,lt i6 deb$ted by S50 while the cash acco~nL at the 11 Issuing 8ank 1 i8 credited by S50. The net reeult 16 that the 12 subscriber ends up with S50 of paper cash and, in the former case 13 only, $50 of updated electronic notes ~1 in his/her Trans~ction 14l money ~odule ~.
15l The e~A~e of electronic notes 11 for paper cash at a 16~ Correspondent Bank 2 is illustrated in Figure 22. As in the 17l~example illustrated in Figure 21, although the ~ubscriber is only 18 lexchanging $50 of electronic note~ 1~, all Sloo of electronic 19 'notes 11 are transferred from the su~scriber's Transaction money module ~ (Step 1).
21 After the notes l~ are transferred, the Co~e~pondent 22 Bank'~ 2 Teller money ~odule S credits its Money In Transit 23 ~ccount by S100 and de~its its Money Due acco~ by $100. This 24 $100 of electronic note6 ~ now deposi~sd at ~n I~sll~ng Bank 25 1, caus~n~ the Co~ayon-1ent Ban~ ~ to cred~t it~ ~oney Due 26 ac~o~.~ by $100 while deb~t~ng lts Deposited at ~r~ ank 27 account by $100 (Step 2).

28 At the Issu~ng Bank 1, $100 i~ cred~ted to the 29 Correfipon~ent Bank Money ~ccount while 5100 i~ debited to the ~oney Due ~c~o~,t. The Correspondent Bank 2 now makes a request 31 to witbdraw S50 o~ electronic notes 11 fro~ the Is~in~ Bank 1 32 tstep 3). Consequently, t~e Deposited at Issuing Bank account i8 - 6~ -2l~80~!~2 1 credited by $50 while the Money In Transit account at the 2 Correspondent BanX 2 i5 debited ~y S50.
3 Now, the I6suing B~nk~s 1 ~eller money module S
4 requests S50 from the Money Generator ~odule 6 and debits lts Correspondent Bank Money accv~ by $50 while crediting it~ Money 6 Issued account by S50 (Step 4). ~he S50 of updated electronic 7 notes 11 is transferred from the Money Generator module 6 t~rough 8 ~suing Bank ~ Teller money module 5 and the Co~ ,o ~le~t Bank 2 9 Teller money module S, back to the Transaction ~oney ~odule ~ in Steps 5-7.
11 Also illustr~ted is thi~ ~ame example with only $50 12 stored in the Transaction money module ~, which i6 deposited at a 13 Correspondent Bank 2, to be ~Y~h~nged for paper money. ~or this 14 deposit, the Money ~n Transit acco~n~ is credited $50, and the Money Due ~cco~n~ i6 debited S50 ~Step 1). The $50 ~s then 16 deposited by the Co~r~pun~ent Bank 2 to its ~coo3~ at the 17 Issuing ~ank 1. At the Correspondent B~nk 2, the Money Due 18 accou~L receive6 a $50 credit, while the Deposited at I~suinq 19 Bank accoun- receives a $50 debit. On the I6s~ng ~ank 1 ~ide, it credits the Correspondent Bank Money acco~l~L by S50 and debits 21 the Money Due acco~..t by $50 after receiving the $50 deposit 22 (Step 2).
23 In both illustrations, fifty dollars of paper cash 18 24 then transferred from tbe Co~.~s~nAent Ban~ 2 to the ~ hscriber, 2~ w~ile the Co~r_~o--~ent Bank 2 deb~ts lts Money In Transit 26 aoco~t by S50 and credits its cash ~cc~r.~ ~y $50 (Step 8). Ihe 27 subscriber i~ now left wit~ S50 of paper cash and, ~n tbe first 28 illustrat~n, S50 cf e~ectronic note~ tored in his/her 29 Transaction money mod~le ~.
Figure 23, t~e aecoul-ting process for clearing the 31 electronic~ ~oney i~sued by different Ifisuing B~nks is shown.
32 Thi~ illustra~ion u es an example ~n wbic~ $100 of electronic 208~452 1 notes 11 i~ued by Bank B ha~ b~en deposited at I~6~ng Bank A, 2 and $150 of electronic notes 11 issued by Bank a have been 3 deposit-d ~t I~s~ Bank B.
4 In Step 1, I6~ g Bank A tran~fers the $100 ~ e~ by Bank B to tbe Cle~rlng Bank 3. It then credits its Money Due 6 accoun~ by Sloo and debits its ~eposited at Clearing Bank accG~.L
7 by the ~ame amount. ~n Step 2, ~6uing Bank B tran~fer~ the S150 8 of Issuing BanX A~ ~oney to the Clearing Bank 3. St~ Honey Due 9 ac-o~.~ iB credited by S150, while its Deposited at Clearing Bank accour.~ i~ debited $150.
11 In cum, 550 i~ due to Bank B. Accordingly, S50 get~
12 debited to the Clearing aoc6~ of Ban~ A, while $S0 gets 13 credited to tbe Clearing acco~r.~ of Bank B (Step 3).
14 In Figure 24, the accouK~ing transactions corresponding to updating electronic notes 11 is shown. Here, $100 of 16 electronic notes 11 are stored in a ~ran~action money module ~
17 and are transferred to an I~suin~ Bank 1, where Sloo i~ credited 18 to t~e ~oney In Transit accounL ~nd S100 i5 debited to the Money 19 Due a~counL (Step 1).
One hundred dollar~ of electronic notes 11 are 21 requested from the Money Generator module 6 causinq tbe Money In 22 Trans~t account to be debited by $100 while the ~oney I~sued 23 accou~ c~edited by $100 ~Step 2). With thi~ ~ccompli6hed, 24 the Sloo of electronic notes 11 is tran~ferred from the Money Generator module 6 to the ~fis~ng Bank's ~ Teller money module S, 26 wh~ch $n turn transfers ~he money to the ~ubscr~ber'~ ~r~nsaction 27 money ~odule ~ (Steps 3-4).

28 Reconciliation ~nd Clearina Syste~

29 Re~erring to Figure 25, the Transaction ~econciliation System 22 is ~hown. It will be understood that the Teller mo~ey 31 ~odules 5, the Money Generator ~odule6 6 and the ~nk~ng ~ystem 208~4S2 1 20 ~ay per~odically pass transaction records to a Transaction 2 Reconciliation System 22 maint~ne~ at each participating bank.
3 These tran~actions will be analyzed and matched to determine if 4 th~r~ is any faulty process occurring ~n the system of the invention.
6 The Transaction Reconciliation System 22, which may be 7 embodied in any appropriately sized and ~uitably programmed 8 general ~UL~ cor, ~er but i~ not ~o l~m~ted, will ensure that 9 all Teller ~oney module S trans~ctions with a financial impact, 10 Q . g., depo~its, ~ithdrawals and paymen~s, ~atch the appropri~te 11 accoun-ing transactions. Any mismatches could indicate 12 incomplete transactions or possible fraudulent actions.
13 ~ransactions reflecting the money ~s6ued by the Money 14 Generator modu~es 6 a160 should correspond to ~eller money module 5 transactions and have the appropriate acco~ ing transactions 16 recorded. Any ~ismatched data may indicate ~nc_ lete pl~e~sing 17 or a security breach. Unmatched accoun-in~ tran~actions may be 18 cau~ed by l nc- , lete transactions or an attempt to t~mper wit~
19 the records of the banking system 20.
In the preferred embodiment, these unmatched 21 transactions may then be transferred to an investigation fiystem 22 12 where the causes of the problems may be determined. on-line 23 dialogue6 may be pro~ided to allow investigatore to review the 24 mi6matches against transaction records and to determine appropriate ~ctions to CG~e~ the situation. Investigators may 26 then take corrective actions ~y ad~usting ~ccou~.~c, deactivating 27 f~ulty ~eller money ~odules S ~nd Money Gener~tor ~odule~ 6, ~nd 2~ notifyinq subscribers of the actions.
29 Attention is now dirocted to Figure 26, ~hich illustrat~s the clearing proc~ss for handling depo~it 31 transactions. Co~e~ondent aanks are not involved ln t~is 32 process ~ecau~e 6ubscri~er deposits ~re deposited to their 2080~52 1 account~ at I~uing B~nks 1 on a real-time basis. At I~ in~
2 Banks, deposits are ayy,s,ated by the Clearing Sy-t-~ 13 to 3 con~olidate all depo~it-d ~lectronic money (~ncluding the 4 depo~it~ from Correspondent Banks) for transmission to the Clearing Bank 3.
6 The Clearing Bank 3 may be implemented in any computer 7 proce~sing facility capable of accommodating the large number of 8 trsnsactions and CO~L ~ ;nq ~mounts of data whic~ the system 9 will typically handle. A high volu~e mainfr~me _ -Ler, a 6uitsbly sized ~inicomputer sy~tem, a number of networked work 11 st~tions ~ving t~e necs~s~ry data ~ essing cspabilities or a 12 combination of the foregoing may also be used. AB Wi11 be ~3 appreci~ted by a person skilled in the art, the particular design 14 of the Clearing Bank hardware system i5 not crltical to the lS invention.
16 It is antioipated that Issuing 8anks ~ may clear money 17 in one of several procedures. In one of these ~ocLdures, 18 electronic money ~ay be deposited on-line from the I-~uing Bank 1 19 to tbe Clearing Bank 3. This could be done on-line ~n a real-time mode when trans~ctions are actually oc~ ing.
21 Alternatively, an Issuing Bank 1 may record the detail~ of 22 transactions being performed during the course of the day for 23 later batch processing. Interbank prsces6ing could occur several 24 t~e~ a dsy.
A~ shown in Figure 26, an l~s~-ing Bank 1 may a6 periodically tran~fer ~t~ el~ctronic money to a dep~slt 27 con601idation ~ile (consolidate deposits) ~bich may be proces~~~
28 and tr~nsmitted to t~e Clearing Bank 3. Tran5action ,~co.ds from 2g thi~ file are al~o colweyed to the ~snk's Trsn6actiDn Reconcili~tion System 22 for ~tati6tical and ~ousekeeping 31 funct~on~.
32 At ~he Clearing Bank 3, the deposit consolidation file~

2~80452 1 ~re processed cre~ting a single debit or cr~dit by ~onet~ry unit 2 for each Issulng BanX~s ~ de~and account. Of course, the 3 appropriate accou..~ing tran6actions for these demand ~cc~ are 4 posted during the clearing proce~6e6. any a~cour-~ which are S overdrawn will be settled via the usual interbank ~ettlement 6 processes that are commonly used ln the i~ld~D~
7 The proce~s~ electronic money tbat is cleared is ~ent 8 back to the Noney ~s~s~ Reoonciliation Syste~ 23 of each of the 9 banks that ~-5UC~ it in order to be l~ccnci~ed and ~t~ked for tamperlng ~nd duplic~tion.
11 additional ~tati~tical and ~o~ e~ing functions are 12 ~mplemented ~n tbe Money Issued ~eoo~ciliation Syste~ 2~, as 13 ~hown in Figure 27. Issuing Bank's ~ provide their own Money 14 ~6ue~ Reconciliation System 23, typically embodied in a general 15j purpose computer but not so limited, for matchi~g tbe electronic 16 money issued to the electronic money cleared at the Clearing Bank 17 3.
18 As indicated in F~gure 27, the electronic ~oney ~s~
19 and electronic money deposited at I~s~ Banks ~, and money cle~red transActions r-ceived from Clearing B~nk 3 are co.-~y~
21 to the Money I~6ued Reconoiliation System 23. The Money Issued 22 Reconciliation Sy~tem 23 generates accoul~ing transactions for 23 the money cleared, and updates ~ master file of all the bank's 24 money issued. Additionally, the Money Is~ued Reconciliation System 23 p~F~r to an investigation ~ubsy~tsm ~3 ~oney which b~s 26 cleared but which was not ~s~ or W~8 poss~bly transferred more 27 ~h~n once.
2a Any unm~tched cases ~ay indlc~te ~ potential breac~ of 29 security. Inve~tigator~ m~y then determine w~ether Money Generator module~ ~ ~re not worklng properly or money ~odules are 31 being tA ered with. Money ~odule identif~ers of f~ulty or 32 abused ~oney ~odules are ~se~ to e~ch b~nk's Seour~ty Server~

1 27 for distribution to the other money modules on the bank's 2 local network ~-. The identlfiers are al~o ~ent to the 3 Certlfication Agency 28 for appropriate distribution throughout 4 the Network 25.
Separately, the Money Issued master fiie is acces~e~ by 6 the Money Position system 2~ which creates ~ file to be 7 transmitted to the Clearing Bank 3 to create a consolidated money 8 pos~tion. It iB contemplated that all Issulng Banks ~ will 9 provide a ~e~Gl~ reflecting their po~ition at the end of a ~pecified period, typically at the end of evQry day. The Money 11 Position Sy~tem 2~ may consolldate tbese ~e~G~ Ls to reflect the 12 amount of ~oney iPs~le' by tbe I~5~nq Bank~ ~ for ~ach monetary 13 unit. The reports will reflect the outst~n~ing position of each 14 Is6uing Bank 1 in order to Aste~P the risk of interbank ~ettlement problems.

16 O~erational Sequences 17j Although some aspects of the preferred e~bodiment may 18 ! be de6cribed in terms of detailod schematic diagrams, the 19 transaction functions are best illustrated by use of ylece s flowch~rts. T~us, to facilltate understAn~ing of the oper~tion 21 of the money modules, ~everal exa~ple~ of tran~actions are ~et 22 forth in the flowchart~ of Figure~ 28-SOA. Referrlng to these 23 figures, a detailed de~cription of the ~ystem proces~e~ and the 24 ~ssoclated ~pplication function~ that incorporate t~o pr~nciples of the preferred embodiment of the present in~ention vill now be 2G described.
27 m rou~ t tbe descriptions of the ~lowchart~ ~except 28 where ~ndicated otherwise), the application functions of the 29 Tr~nsaction ~oney ~odule ~, whether they are imbedded in a b~nd-held un~t or other type of processin~ de~ice, are hereinafter 31 designated wit~ the ~uffix ~An, ~nd the ~eller money m~dula 2080~52 1 applications and its a~ociated bank are h~re~nafter d-~ignated 2 with the 6u~fix ~n. Tn the case wbere a Co.~ c~'~t Bank 2 3 interact~ with an Tss~ g Bank 1, the I8F~nq or CO~Le~C '~r~
4 Bank 1 and its assoc$at-d Teller money module 5 applications are hereinafter designated with a ~C ~
6 Additionally, transition¢ to steps in another figure 7 are indicated by a pent~sor~1 tag having an alphanumeric ~ymbol, 8 and continue on the other figur- with a cirole havinq the ~ame 9 alphanumeric ~ymbol therein Withd~w~l From An T~s~nq BanX

11 In Figure~ 28-35A, a p,c_e~c fl~ rt of a tran¢action 12 bc~wecn a Tran~action money module ~ and a Teller ~oney ~odule 5 13 i¢ shown In this pLCc~s exa~ple, it i~ a¢~umed that the 14 ~ubscriber i6 desirous of completing a monetary tr~n~action with a part$cipating bank; specific~lly, a with~La~al of ~ome amount 16 of el~_-Luric money from hiJ/her aoco~ , to be ~tor-d in his/her 17 Transaction money module ~
18 The process flow to ~et up a withdrawal tran~ction 19 begins at the top of Figure 28 The ~irst flow block i~ a wit~drawal ~et up between a money module A ~nd a bank's Teller 21 money module B S, which i6 described further in Figure 29 Thi~
22 process beginJ with money ~odule A performing a ~ign-on ~o~ss 23 that i~ also descri~ed in further deta~l ~n another fiqure, 24 specifically Figure 31 Subscri~er Slgn-~n 26 ~eferring to the top of ~igure 31, the ~h~ri~er 27 prompts his/~er ~r~nsaction money ~odule ~ to perform a ~ign-on 28 function (Step 10) m e Sess~Qn Manager 31 applic~tion rece~ves 29 the sign-on ~essage (Step 12) and ~h2c~c to see if the Transaction ~oney ~odule 4 ha~ inhibited 6~hAcr~ers from signing 2o8o~s2 1 on (Step 14).
2 Subscriber sign-on ~ay be inhibited lf a user makes 3 several unsu~ces~ful attempt6 to sign-on to the Transaction money 4 module 4. Por ~xa~plQ, the allowablQ attempts to s$gn-on may be limited to three, such that if a per~on makes more than three 6 consecutive unsnocessful attempts to sign-on to the Transaction 7 money module ~, the Ses~ion ~an~gQr 3~ will prohibit ~ny further 8 sign-on attempts. Additionally, th~s ~lock-out~ f-ature ~ay be 9 m~int~ired for any predetermined time per~od, ~uch a- twenty-four hours, for example. Such an arrA~ " - ~ will provide eecurity 11 from use by persons who come into pos~ession of the Transaction 12 ~oney module ~ but who are not properly authorized to access it.
13 It should be noted t~at while this type of an 14 arrangement is anticipated in the preferred pr~ ment of the invention, the invention ~bould not be limited as 6uch, since any 16 of the methods known in the industry for providing security from 17l unauthorized persons would be suitable for u~e herein.
18l When the sign-on is not inhibited, as will typically be 19 the case, ~o Subscriber 33 prompts the subscriber to enter hi~/hQr sign-on ch~racteristic~, such a~ his/her PIN ~nd 21 biometric identifiers ~Step 22). Inputs from the ~ubscriber are 22 forwarded through the Session Manager 31 to the To Subscriber 33 23i application ~Steps 24-28), which responds to the characteristics 24 entered and entitles the c~s~r~ber to operate the Transaction ~oney module ~ if ~e subscriber'~ ident~f~cation characteristics 26 are the correct ones when eo~parQd to tho~e stored ~n the me~ory 27 of the Transactlon ~oncy ~odule 4 ~Step~ 30-323.
28 If the ~h~eri~er'~ identific~tion characteri~tic~ do 29 not ~atch the identifier6 ~tored in memory, the To Sub~criber 33 application not~fies the ~ubscriber of the in~alid ~ign-on 31 condition IStep 34). From there, t~e To Subscr$ber 33 application 32 ~ec~ to fi~e how many ti~es the user has atte~pted to sign-on 2080~52 1 ~Step 36l, and if tne predetermined count n_s not been rea~'~er', 2 the S-6~ion Manager ~ notified ~Step 38) 3 The S-ç~ion ~n~ger 3~ works in con~unction with the ~ Clock/~imer ~3 application to set and to monitor the time that has elapsed betw-en ~ ccessful ~ gn-on attempt~ (Step 40) In 6 one e~bodiment, too many un~ ~e~sful attempt6 within the set 7 time period will cause the Session Manager 3~ to prohibit any 8 further sign-on attempts, effectively ~hutting down the 9 Transaotion money module ~ The Se~sion Man~ger ~I notes that the ~ign on i~ terminated in Step 42 11 Turnin~ back to Step 14 o~ Figure 31, assuming that the 12 Transaction mon~y m~dule ~ 1- lnlibit~d~ the 8~ion Ma~a~er 31 13 cheek~ to ~ee if the predetermined ~ime period has expired (Step 14 16) If the Transaction money module ~ is ~till in the prohibited ~ign-on mode, t7~e To SuDscriber ~3 sends a mes6age to the 16 ~l~hscriber that further acce6s to the Transaction money module 17 is pro~ibited (Steps 18-20) The Session Manager 3~ t~en notes 18 that the sign-on attempt i8 terminated, ag~in in Step ~2 19 Setup Withdrawal Turning to Figure 29, when a proper sign-on is 21 accomplig7~ed, the To Subscriber A 33 prompt6 the Fn'~7~riber for 22 the type of transaction that i8 desired (Stsp 43) As mentioned 23 previously, it is anticipated that a ~7~scriber may trangact with 24 any one of a multitude of acco~ ~s at s~ral differoent participating b~nk~ and financial institutions 26 After selecting t.~e particular baik and acco~nt ~Step 2~ 44), the Tran~action money ~odule ~ ~nitiates a procedure for 28 co~municatin~ wi~ e ~ank t~t was celected, by engaq~ng t~e 29 Network 2S The overall program flow now p~ses to the proeedures illustrated by flowch~rts in Figure 33 In Figure 33, 31 there i~ 6hown the data processinq and flow for implementinq a 20~0~2 1 ~ign-on to the ~etw~rk 2S.

2 Network Sign-On 3 m e illustr~tive Network 2S sign-on method a~out to be 4 described is in general appl$cab1e to any of the money modules ~,S,6 of t~e present embo~i -nt. Thus, in th~s example, ~A"
6 denotes any class of ~oney ~odule.
7 After the b~nk t~t ls to be access~ ~s selected, the 8 money module initiates communication wit~ the NetworX 25 under 9 t~e control of it~ Se~ion Manaqer A 31 ~Step 50). The Nelwo-h Server 26 begins by requesting the certificate of tbe Transaction 11 money module ~ from Session Manaqer A ~1 (Steps 52-54). The 12 Mainta~n Security A appllcation 37 retrieves and sends the 13 certificate to Session Manager A 3~ (Step 56). Session Manager 14 ,A 3~ send& the certificate to the Network Server 26 ~Step 58), 15 Iwhich~ upon rece~p~, route~ it to the Security Server 27 (Step 16 60).
17 The Security Server 27 tests the certificate to check 18 ita validity ~Steps 62-64), and if it iB not valid for any 19 reason, the Security Server 27 will signal the Network Server 26 to deny access (Step 66). ~he Network Server 26 m~y in turn 21 con~ey an access-deni~d message to Ses~ion M~ger A of t~e 22 Transaction ~oney module 4 (Steps 68-70).
23 If the Session Manager A tbat receives the denied 24 ~cce~s -65~gc i~ a Tran6action money ~odule ~, it~ To Subscriber application A will ~nform the ~ubscriber of this condition (Step 26 74~. If it iB ~ Teller money ~odule S or ~oney Generator ~odule 27 ~ t~t ~ tryin~ ~o ~cce~s the Network 2S, the To ~ank A
28 application 47 notifies the bank's ~ystes~s 20 that its acce~:
29 will not be permitted ~Step 76).
Assuming the certificate ~alidity check is ~atlsfied, 31 tbe Security Server ~7 ~ends an upd~ted list of t~e bad money ~80~52 1 1module~, and a new list of certificatory keys to the Session 2 Manager A, ~Step 78, Fig. 33A). The keys are ~igned using the 3 last ~ersion of the certificatory ~ey. This information i6 4 received by Session Hanager A and forwarded to the Maintain Secur~ty A 37 appl~cation, which validates the certificatory ~ey 6 list and t~e b~d money ~odule l~st (Steps 80-82, Fig. 33A).
7 Public Xey A ~4 tests the validity of the ~ignature 8 (Step 84) ~nd if t~e signature is not valid, a mes~age warning of 9 a network security pro~lem i8 ~ent by the ~o Subscriber application A 33 of a Transac~ion money module ~ (Steps 86-90), 11 or alternat~vely, by the To ~ank application A ~7 of a Teller 12 ~oney module 5 or Money Generator module 6, (Steps 86-8~, & 92).
13 Advantageously, all money modules will check the validity of a 14 ~ignature received from even the Security Server 27. ~his helps to ensure the integrity of the o~erall ~ystem.
16~1 In the case of a valid signature, Maintain Security A
17 jupdates t~e bad money module li~t and the certificatory key list.
18 (Step 94). If the certificate i~ to be recertified or the l9 1certificate ~as expired (Steps 96 and 98), the Maint~in Security 20 ! A generates a new certificate (Step 126 of Figure 33CJ while 21 Public Key A generates new keys and ~iqns the certificate usinq 22 the old public key IStep 128). Session Manager A ~end~ the new 23 certificate to the Security Server 27 w~ic~ accepts thc 24 certificate and te~t~ the validity of the siq~ature (Steps 130-25 136).
26 Assu~ing that the signature of the ~ew certificate is 27 not ~alid at this 6tage, Steps 66-76, ~ig. 33, are repeated 80 as 28 to termin~te the ccmmunication link into the Network 25.
29 On the ot~er ~and, ~ valid signature, F~g. 33C, will allow the Security Server 27 to 8ign t~e new certificate and send 31 it back to the money ~odule (Step 13R). Sesslon ~anager A 31 32 receives the new certificate, Step 140, Fig. 33D, and forwards lt 2080~52 1 to its Maintain Security applic~tion A to again validate the 2 certificate through use of the Publ~c Xey ~pplication ~Steps 142-3 146). Here, the money modules will repeat the test of the 4 validity of the certiflcate ~ssue~ from the Security Server 27.
For a valid 6ignature, the Session Manager A 31 ~ends an 6 acknowledg~ent to the Security Server 27 (Step 148) who responds 7 by ,e~,.ing t~e p,.~e~s to Step 78, Fig. 33A.
8 Conversely, if t~e Security Server~s ~ignature on the 9 new certificate generated by Transaction money moduls A proves to be invalid, Fig. 33D, Session Manager A will send an invalid 11 certificate message along wit~ the certificate back to the 12 Security Server 27 ~Step lS0), which will ~gain atte~pt to 13 validate the ~ignature on the certificate (Step 152). A valid 14 ~ignature will return the pr~cess to Step 66, Fig. 33.
Alternatively, an invalid ~ignature will cause the Security 16 Server 27 to A; ~C-~nne~ from the Network 25 (Step 156, ~ig. 33D) 17 and cause the Network Server 26 to notify tbe money module of a lB malfunction (Step 158).
19 Ihe Ses~ion Manager A that receives the mes~age (Step 160) will, in the case of a Transaction money module ~, get the 21 To Subscriber A 33 to inquire of the ffubscriber if they de~ire to 22 retry the whole proces~ of ~igning on to the Networ~ 2S (Step~
23 164 ~ 168). In the c~e of ~ Teller money module 5 or a ~oney 24 Generator ~odulc 6, the To Bank applicat~on A will ~ngulre if t~ere ~ a request to retry the Network 25 ~ign-on ~r~ce~re 26 ~Steps 166 ~ 168).
27 No ~tte~pt~ for a retry wlll, of cour~e, end the 28 com~unication lin~ lnto t~e ~etwor~ 25, ~nd conver~ely, a request 29 for retry of Me~o,~ 2S ~cces~ will return t~e ~-oce~ e ~ac~ to Step 56, Fig. 33, w~erein ~aintain Security A will ag~n re~rieve 31 the ~rans~ction money module'6 certificate for the Network Ser~er 32 2~.

2080~52 1 Back at Step 98, F~g 33A if the certificate doe~ not 2 need to be recertified or ha~ not expired, Se~sion Manager A 3 3 will request t~e date and time (Step 100) from Clock/Timer A
4 (Step 102, Fiq 33B), and forward this data to the Network Server 26 (Step 104) 6 The Network Server ~6 ~eckc the time and datè after 7 receiving it (Step 106) and if it i~ out~ide of an acceptable 8 predetermined par~meter, t~e Network Server 26 will ~end t~e new 9 t~me and date (St-p 110) to Clock/Timer A through 8ession Manager A (Steps 112 ~ 1~4) If Clock/Timer A ~3 c~nnot ad~ust the date 11 and time to be ~ynchronized with the Network 25, the operator of 12 t~e money module for the r~h~cribèr or the bank i~ notified of 13 the clock ~alfunction ~Steps 116-124) 14 In ~ÇS~Q~-e to t~e apparent malfunct~on, the operator ~ay attempt to have the time and date resent from the Network 16 Server 26, Step 124, and the proced~Le reverts b~ck to Step 102 17 in which it attempts to ~end the new date and time to t~e money 18 module Alternatively, an acceptable date and time checX, Step 19 108 allows the Network Server 26 and Session Manager A to 20; exchanqe acknowledgements ~nd note the ~uccessful Network 2S
21 Bign-on ~steps 126-128) 22 Estnbl~ g A Session 23 As shown in Figure 29, after the ~teps of money module 24 sign-on, transact~on ~el-ction and network ~ign-on are completed, se~sions ~re establi~hed between the money module~ Figure 34 26 diaqr~ms the flow ~&~e6~ for establl-~lng a money-module to 27 money-module ses6ion, which, a8 w~ll be understood by one ~llled 2~ in th~ Ar~, w~ll ln general be ~ppllcable ~s well to other 29 8eS~ons e~tabl~hed b~tween the ~nr~ou~ type~ of ~oney ~odules of the present lnvention 31 Referring to the top of Figure 34, the ~ession Manager 2~8~52 1! A will first check to see if t~e 6ubscriber has requested 2l connection to a specific destination in the Network 25 ~Step 3l 190). For instance, where a subscriber is desirou~ of 4I transacting with his/her accou..L at a ~pecific bank, the Network 25 will connect the Transaction money module ~ to the 6elected 6 banX, Steps 192-198. Conver~ely, when a 6~hscriber i~ performing 7 updating functions on the Networ~ 25, there ~ 8 no need to 8 establish a ae~sion with any ~pecific bank, and the Network 9 Server 26 ~ay decide where to route the con~ection, based on Network 25 traffic.
11 If ~ ~pecific destination has been selected by the 12 6ubscriber, Session Manager A conveys the destination information 13 to the Network Server 26 (Step 194). The Network Server 26 14 initiatee a com~unic~tion link to the money module of the selected destination ~Step 196) and 6ends an acknowledgement to 16l Session Manager A 31.
17l After receiving the acknowledgement that the 18 destination money module has been contacted (Step 198), the l9 IMaintain Secur~ty application A will 6end it~ certificate to the Maintain Security ~pplication B through each application's 21 respective Session ~n~r ~St~ps 200-206).
22 It 16 anticipated that the money modules will exchanye 23 certificates to ver~fy that each money module is interacting with 24 another valid money module. To this end (as seen ~n Flg. 34A), the PubliC Xey appl~cat~on B ~ tests t~e certificate of money 26 20dule A by using the public key ~lgorithm an~ t~e public ~ey 27 co~.e6~P~n~ to the prlYate key used by ~oney modula a, to 28 encrypt an~ chec~ A's certificate and ~erify th~t it i6 valid 29 IS~ep 2~83.
If the cert~icate ~ found ~Yal~d, the session 31 Manager B w~ll note tbe 6e~sion i6 terminated (Step ~10). In the 32 case of a Tran action money ~odule ~, the ~o Subscriber ~ inform~

1 the ~ub~cr~ber of the trans~ction termin~tion (St-p 212) 2 Likewise, a Tell-r money ~odule S or Moncy Generator module 6, 3 uses the To Ban~ ~pplication B ~7 to notify the bank of the 4 termination, 8tep 213 It i~ anticipated that the counterparty money module will then timeout to end the eY~hAr 6 In Step 214, Fig 34A, a~suming that the cert$ficate of 7 money ~odule A i~ valid, tho ~aintain S~curlty application B 37 8 ~-heo~ to ~ee if ~oney ~odul~ A is on the list of compromiced 9 money ~odules ~Step 215) If ~oney module A 1~ on that list, the ~,&_e~ flow ~et~,s to St-p 210 ~o that the communication~ can 11 be t-rminated 12 Alt-rnativQly, when money module a i. not on the list 13 of compromi-ed money ~odules, the Random Number C-n~_~tor B 46 14 creates a se~sion key (Step 216) and ~nco~es the ~ession key along with money ~odule B's certificate and a verification 16 message, using money module A's public key ~Step 2~8) This 17 ~n~o~e~ ~6~~ i6, ~ent to money module A by Se6~ion Manager B 31 18 (Step 220) 19 Session MAn~A7er A 31 receive~ the ~es~age from money modul- B ~8tep 222), and uses it~ Public ~ey ~ alqorithms 21 application to ~c~e the mes8aqe (step 224, Fig 34B), and to 22 verify money module B'~ certificate (Step 226) 23 If the test determines that money modul- B'~
24 certiflcate i~ invalid, the operation brAn~h-~ to an ~abort transaction" p~ce~t~re to termln_te the steps taken thu~ far in 26 establ~i~~ a ~ession ~Steps S00-524) Thi~ ~C_t~r~ may be 27 u6ed, for ex~mple, to ~nd the co ~ unication ~e~-ion and to 28 function~lly ~hut off moncy module A, which result~ in the 29 ication link ending ~Steps 500-S24, Figure 32) Abort Transact~on 31 BrA~ to Figure 32, S~e functional ~hut-off of 2~8~452 1 money module through t~e abort transaction ~vc~ro will now be 2 described in d~tail. It will b~ underetood that the ~ollowing 3 process may be u6ed when any two money modules are abnormally 4 terminating the transactions o~curring between them.
Accordingly, the money module6 will be design~ted ~X" and ~Y" to 6 illustrate the generic ~pplicability of the ~.ocess steps.
7 An abort transactlon process initiated by money ~odule 8 X to terminate e~ ~cation~ with ~oney moaule Y b~gins with 9 Se6sion ~anager X 31 capturing and then rev-rsing or rolling back any ~.u~.~mmatic c~g~ that were made to the money module (Step 11 500), and then noting that the 6eseion has been aborted (Step 12 502).
13 In the case w~ere the ~oney module that is initi~ting 14 the termination i~ a Tran6action money module ~, the To Subscriber appl~cation 33 informs the ~ 6criber of the 16 communication termination ~Step 510). Likewise, a Teller money 17 module 5 informc its To ~ank application ~7 of the termination B0 18 that any accGu,.~ing ~h~ngQe m~y be ~ndone ~Step 508). Next, the 19 Seeeion Manaqer X 31 or the terminating money module ~end6 an sncode~ ~ess~ge to the other money module involYed ~Step 512).
21 Briefly referring to ~igure 37, all encrypted messaqe~
22 between module~ will be -Yrh~nq~d by the following ~teps. The 23 6en~i~g money module (here ~1BO refcrred to ~ ~Xn) u~es ite 24 Symmetric Key ~S to ~ the ~Psr-,e to be ~ent to the receiving money ~odule (here al60 r~ferred to ~8 ~Y~) (Step 2).
26 Again, lt will ~e ~ppreciat-d tbat t~ere are a number of known 2? e~ y~l~ion techr~ues which may be utilized.
28 The Seeeion Manager X 3~ ~ends t~e ~ncod-d ~ e to ~g Se~sion Manger Y 3~ which ~n turn ~ ez t~e me~za~e u~lng i~
Sy~metric Rey Y ~S (Steps 4-8).
31 ~ontinuing with Figure 32, t~e Se~s~on ~anger Y
32 ~spo--de to t~e teroination notice eent by ~160 undoing any - ?6 -1 changes it mry have made towards establi~ rg the ~e~ion, ~nd 2 noting the abortod ~es6~0n (Step,~ 514-S16). I~ it i~ a 3, Transaction money module ~ that i~ now 6hutting down, t~e To 4' Subscriber ~pplication 33 alerts the R~h-criber of the condition (Steps 518 ~ 524). Col~spo..dingly, in a Teller money module S, 6 the To i3ank application ~7 will rever~e all ~cco~)tinq 7 transactions tbat have been underta~en (Step~ 518-522).
8 Returning to Figurg, 34B, ~6uming that the money module 9 B certificate i6 valid, in Step 228 Maint~in Security A ~ec'~s to see lf money module 8 ic on the li~t of compromi~e~ ~oney 11 module~. If money module B ~8 on the li~t (Step 230), the 12 session reverts to the abort transaction p~ocel .e, Steps 500-13 S24. Thereafter, t~e communications ~ession i~ di~olved.
14, More typically, money module B will not be on the list of compromised money modules, and the Clock/Timer A 43 will 16; retrieve the date and time (Step 232) and ~end thi6 information 17 to the Maintain Securlty ~pplicF.tion A 37 ~o that tbe 18 verification message may be assem~led with the date and ti~,e 19 (Step 234).
Symm,etric Xey A ~,S then encrypt~ the verificatiDn 21 message with the date and time information, using the random 22, ~ession key provided by money module B (Step 236). Ses~ion 23 Manager A ~1 ~end~ thi~ e.lc~ ed me~6age (Step 238) to Session 24 Manaqer B 31 ~Step 240). From there, the Sym~,etric ~ey ~pplication B 4S ~ ~t~ the message IStep 242) ~nd rA~ lt to 26 the Main~ain Security B 37 ~or mes~ Yerific~tlon ~Step 244, 27 Fig. 34C). An incorrect mes~age w~ll cause the ~ession to ~e 28 ~borted t~roug~ Steps 500-524, while a correct mPs~A~e will 29 advance the proce~re 80 th~t ~ainta~n Security B 37 o~n compare 30 ! tne time and date with that of money mod~e A ~Step 248).

31 ~ock/Timer ~ e,s will ver~y that mc~ney module A'~

32 clock is wltbln a pre~et amount of de~ia~ion from the clock of ~ ~oney module B ~S~ep 250) If the discrepancy between the two 2 clock~ i8 gre~ter than _ predeter~ined amount, the se~sion w~ll 3 be aborted by brA~çh 1 n~ to Steps 500-52~
4 If there i~ no discrepancy that is greater than the perml6sible amount, Session Manager ~ 31 will note it~ ~tart of a 6 ~ession (Step 252), and end an acknowledgement to money module A
7 to ~t~rt the tran6action (Step 2S~) After the ~code~ message 8 i~ ~ent from money module B to Session ~na~er A ~ using 9 proce6s fiteps 2-8, Fiq 37, Ses6ion Nanager A ~ acknowledges the res6age receipt _nd _160 notes the ~tart of session (Step6 256-11 258) 12 Re~ues- Withdrawal 13 After ~ ~ession i~ established between the Transaction 14 money module ~ and Teller money module 5, the Transaction money module 4 ~akes _ withdrawal request from the Teller money module 16 S See Flgure 29 Referring now to Figure 30, ~ ~lo~e6s for 17 requesting a withdrawal will now be described It should be 18 noted that althoug~ the figure denotes the partie~ as ~XN and 19 ~y, n in the proces6 ~teps describe below, they are _pplicable to _ny ~oney module transacting with _ Teller ~on~y module 5 21 To begin, the To Teller X 3~ sends a withdrawal request 22 to the Teller money module 5, requesting a certain _mount of 23 money to be withd,~ ~rom ~ specific A~ In its 24 tran6mis6ion of thc withdrawal r~quest, the A~o~ number and t~e ~CCD~I~ profile w~ e tr~nsm~tted from the request~ng money 26 module to the Teller money module S (Step 700) ~o ~end this 27 regue~t, the pr~cerf 8teps 2-~ are repeated, ~n which the ~essaqe 28 ~6 encryp~ed using ~he pre~iously descr~bed cryptographic 29 tec~igues 20804~2 1 Validate Aoco~t 1~ ~~r 2 once the withdr_wal request and the acco~ L-number and 3 profile are transmitted to th,e Teller money module 5, a ~vcc~ e 4 to validat~ th- rcco~ ~ number i~ initiated (Step~ 7~ 7056) A
flow diagra~ depicting how an ~ccv~ t nu~ber ic validat-d i6 6 ,-hown in Figure 38 7 l In thi- ~L~:~9-, t~- Maintain Security application 37 8 of th- TellQr ~on~y modulQ 5 r-ceives the -c=co~ profil~ ~nd 9 ~ignature and con~yD them to lt~ Fublic Xey application ~ to v-rify t~e profile aignatYre ~St-p~ 7041-7042) Th- ~ignature i6 11 ,tQ6ted using the public key generat~d and di~tri~ut-d by the 12 Bank'a Security Server 27 An invalid cignature ~ F the 13 Maintain Security 37 application to inform the Session Manager 14 that the accGun~ profile is in~alid (Step 7044), whereby Steps 500-524, Fig 32, are Sollowed to ~bort the tran~action between 16 the two money module~
17 If the ~ignature test confirm~ a valid ~lgnature, the 18 procedure ~dvances to tbe To Bank application ~7 which cend~ the 19 account nu~ber it ~as r~cei~ed to the ban~' 8 computer ~ystems (S~ep 7046) An lnactive ~cco~ will cau~e the Maintain 21 Security application ~7 to inform the Ses~ion Mana~er of the 22 inactive Acco~ (Stcp 7048) and have the transaction aborted 23 following ~tep~ 590-524; an aCC~ that ha~ not been inacti~ated 24,~will allow the Maintain Security application ~7 to checX if the 2~ ACCG~ pro~lle need~ to ~e recertified (Step~ 7047-7050) 26, If the ~cco~L pro~le does need to be recertl~ied, the 27l Maintain SecYrity ~pplication 37 will cend the acGo~o t profile to 28! the Security 8arver 27 ~Fig 38a, 8teps 7~51-70523, which will 2~ recertify ~he ~e~ pro~ile and ~end it to the Tell~r ~oney module 5 ~Step 7053) In ~~~01 ~e, the Tell~r money module S
31~ 6end~ it to the ~oney module m~king the withdrawal reque~t (step 32 7054)~

I
., .

2080~52 1 T~Q communicatlon from the Teller money ~odule 5 to the 2 money modul- util~zes the previously described routine for 3 sending messages Steps 2-8. The Maintain Security application 37 4 then updates the accou,.t profile ln the money module and ~Ul..S
an acknowledgement to the Maintain Security applic~tion 37 in the 6 Teller money module S tStep 7055), also using Steps 2-8. The 7 electronic ~es~age i8 received by the Ma~ntain Security 8 application 37 of the Teller money module 5, and acknowledged in 9 Step 70S6.
W~th the accouu.~ ~nformation checked, the ~LOCCSS
~ U~ nS to ~tep 704 of Figure 30. The To aank application ~7 now 12 verifies t~at there are su~ficient funds to support t~e 13 withdrawal request (Step 704). Sufficient funds will prompt the 14 return of an acknowledgement to a Transaction money module ~, utilizing process Steps 2-8 to transmit the ~cknowledgement to 16 its To Teller 3~ application function ~Step~ 706-714). In the 17 case of a ~eller money module 5, ns acknowledgement i~ required.
18 In the case of ~ Tr~nsaction money moduls ~, an 19 insufficient r ~~ of fund~ will cause t~e subscriber to ~e prompted to enter a nQw r - ~ for the withdr~wal (Steps 718-720, 21 Figure 30A). As ~hown by Step 724, the newly entered ~ .un~
22 causes the To Teller ~pplication 3~ to send the new reguest to 23 the To Bank appl~cation ~7 (using Step~ 2-8) of the Teller money 24 module 5 to verify if there are sufficient fund~ to cover the latest requested amount, ~u~..ing to Step 704 of Fig. 30. If 26 the new request i6 still qreater t~an t~e funds on balance at the 27 bank, the ~eller money module S will initiate Step~ 500-524 to Z8 abort t~e transaction betwee~ the to money ~odule~. In the case 29 of a Teller ~oney ~odule S, the t~ansaction i8 ~llowed to ~verdraw the acc~n~.

208~452 1 Transfer Notes 2 Referring back to Figure 29, To Teller A 3~ transfers 3 the total of $ts ~urrency notes 11 to the Teller money module 5 4 (Step 45) If there are no note~ eing held ln the Transaction money module ~ at the time the wit~.awal request i6 6 made, t~e To Teller A application 3~ ~ends a ~-o~, to the 7 Teller money modulo S that there are no notes 11 ~ ent tStep 8 473, using p.~ess Steps 2-8 9 Electronic notes 11 are transferred ~w~n money modules UBing the ~ oc_~ ,e described below (referring now to 11 Figure 39) ~he Note Directory application 39 of the transferor 12 ~oney module ~hoo~es the notes of proper values for the transfer 13 (Step 750), and has the Notes application ~0 create a transfer 14 for each note 11 (Step 752) The Public ~ey appl~cation ~
creates signaturec for all the notes 11 (Step 754) and ~ends the 16 note~ 1~ to the Packet Mana~er application ~1, for a~sembling the 17 note 1~ transfer~ and signature6 into a pac~et to ~e ~ent to the 18 reguesting money module ~Step 756) lg Steps 2-8 are utilized to transfer the packet of electronic note~ 11 to the Packet Manager application ~1 of the 21 reque6ting money module for receipt and ~ re89~bly (Step 758) 22 The Verifier application 42 verifies the transferc Appen~e~ to 23 the certificates, and ~erifies that the total ~mount conforms to 24 the note~ 11 that ~hould be ~ent (Step 760) Any ~n~al~d ~for~at~on ~ill cause ~he transaction 26 between the two money ~odules to be abortad, ~sing t~e ~o~e~u~e 27 outlined in ~t-ps 500-524 ~bove ~St-p 761) ~alid note~ 1~ w~}l 28 have their expir~t~on dates çh~cke~ ~Step 762~ by t~e Verifier 29 application ~2 when lt 18 a Transaction money module~ ~ that has ~onveyed the note 11 (Step 763) Any expired notes 11 ~Step 31 76~) will cause the ~essions to be ~borted using the procedures 32 outlined in Steps 500-524, ~g 32 2~80~2 1; Assuming the notes 11 have not expired, or in the case 2 where a Teller money module S i~ accepting them, the ~ ocess flow 3 refiumes ~t Step 765, Fig. 3sA. In this Step, the Public Rey Y
4 application ~ verifie~ the digital ~ignatures. Invalid ~gnatures invoke the tr~ns~ction abort process of Steps ~00-524.
6 Valid electronic notes 11 are then ~ent to the Notes 7 application ~o (Step 768) and the Note Directory 39 i~ updated 8 w~th the new note locatlons ~nd ~mount ~Step 770).
9 Returning to Figure 28, the To ~ran6action 8 ~9 c~eC~c ~0 if any electronic notes 11 ~ave been tr~nsferred ~Step 772), and 11 if notes 1~ have ~n~ee 7 been transferred from ~ Trans~ction money 12 module ~, acco~ ting transaction~ ~re po~ted to reflect this 13 situation (Step 776: see ~160 Fig. 14, Step 1) by the To Bank 14 application B ~7. Both in the case when no notes 11 have been transferred from the ~oney module and after the later accounting 16 transactions ~re posted in Step 776, a cession i~ established 17 between the Teller money module 5 ~nd the Money Generator module 18 6 using the procedure outlined abo~e in Steps 190-258, Figs. 34, 19 34A-C.
As noteB 11 are requested to ~atisfy the withdrawal, an 21 account posting occurs to re~1ect the request. The To Bank 22 application B ~7 will po~t the proper ~ccoun~ing transactions 2~ ~Step 778, Fig. 28) as also illustrated in Figure 14, Step 2.

24 R~guest Note~

Directing attention to Figure 40, notes ~ may ~e 26 reguested between Teller money ~Ddules 5 ~nd Money Generator 27 ~odules 6 u~lng ~he following ~c~d~_ described below.
28 The To Money Generator application 48 of the reguesting 29 Teller ~oney ~odule S will issue a request for ~ ~pecific amount of electron~c money to be created (Step 7B0). The reque~t will 31 be 6ent using the above described Steps 2-8 for encrypted - ~2 -20804~2 1 transmiss~on, to the To Teller application ~ of the Money 2 Generator module ~ ~o that the Money Creator Oppllcation S0 may 3 be activated (Step 784) to create the electronic notes ~. ~Step 4 786).
After t~e cre~tion of electronic notes 11, they are 6 signed by the Public Xey application 4~ of the Money Generator 7 module ~ (Step 788) and placed in a holder by it~ Notes 8 applicOtion ~0 (Step 790). F~nOlly, the Note Directory 39 ls 9 updated with the ~nformation about the newly created electronic ~0 notes lS (Step 792).
11 The ~-o~es~ flow now .e~ to the p~4Ce~ e~ ~hown in 12 Figure 28. The ~ 9 ~Qd notes ~n the Money Gen~rator module 6 13 are tran~ferred to the Teller money module ~ S using process 14 Steps 750-770 ou~lined above for transferring ele~LLonic notes 11. The notes 11 are then transferred from the Teller money 16 module 8 5 to the TrOnsaction money module ~ using these came 17 process Steps 750-770 for transferring electronic notes ~1.
18 Finally, to ~ucces~fully complete the with~o~l of 19 electr~nic note~ al, the money module6 will ~commit~ to or finalize the transaction by utilizinq the following ~,oc~d~,a.
21 Referrinq now to Figure 41 for a detailed de6cription of this 22 process, the Tran Log Mgr. application 3~ update~ it~ Tran Log to 23 record the transaction that has occurred above (Step 690). W~en 24 it i6 a Tr~n~ction money module ~ that i~ committing to the 25 ~Y~ C (8têp 691) ~ the To Subscriber appl~cati~n wlll notify 26 the ~77hscriber th~t the tronsaction h~ been ~uccessfully 27 completed ~Step 692). Of cour~e, the Sess~on Man~ger OpplicOtion 28 A 31 will note the end of ses6ion ~Step 69 ), and employ ~oces~
29 Steps 2-8 to ~end the ~es~age to the money module it i~
tr~n~acting with.
31 W~h t~ end of ~ession not~ce received, the other 32 ~oney module, in this example ~ Teller money module 5, v~ll use - t3 -2~80~52 1 ~t~ Tran Log Mgr applicat~on ~6 to update its own Tran Log (Step 2 694) Assuming, hrwL~er, the ~con~ ~oney module receiving the 3 end of 6ession notice is not a Teller money module S, ~n 4 additional ~tep of having the To Subscriber application 33 notify the subscriber of the end of the transaction oc~u~.~nce (Step 6 696) will be nec~ss~ry Therea~ter, the Session Nanager 31 of 7 th- ~ 5 _ ~ ~ ~on-y ~odule in both case~ will ~l~o ~ake note of the ~ ~nd of the sess~on (Step 698) 9 Directing attention back to Figure 28, the ~oc~ss to commit i8 initiated fir~t by the Tr~nsact~on money ~odule ~
11 co~mitting ite transaction with the Teller money ~odule B 5 12 (Steps 690-698) The ~ocas~ steps ~re ~1BO ~pplied to commit 13 the transaction between Teller money module B S and the Money 14 Generator module 6 (Steps 690-698) That completes the processing for one complete withdrawal of electronic money from 16 an Is6uing Bank 1 17 Withdrawal From A Correspondent Bank 1~ A withdrawal from a Cu,. ~pondent BanX 2 will now be 19 described, aided by reference to Figure 35 To begin, the previously described Steps 43-48 to ~et up a withdrawal are 21 undertaken by ~ $ransaction money module A 4, ~n con~unction with 22 a Teller money module B S Next, Steps 190-258, used to 23 establifih a session, ~180 described above, are initiated ~etween 24 Teller ~oney module B 5 and ~eller ~oney ~oaule C 5 After the 2S sessions have been ~t~b~i6hed, the To BanX applic~tion B ~ will 26 po~t the ~cco~-Ling transact~on ~G~gyo~ g to the w~thdrawal 2~ that iB going ~o subsequently occur (Step 900 ~ee ~l~o Fig 13, 28 Step 1~.
29 As previously noted, it ~8 contemplated that whenever a ~ransa~tion money module ~ inter~cts with a bank, both Issuing 1 31 and Correspondent 2, all electronic notes 11 th~t are ~tored 20804~2 1 within the Transaction money module ~ are removed and replaced 2 with electronic notes 1~ conta~ning the ~ost recent certificate.
3 ~o perform th~s operat~on, To ~ransaction B ~9 will check to see 4 if there are not-s 11 stored within the money module ~ (S~eps 902-904). If there are notes 1~, To Bank B ~7 will post the 6 appropr~ate accounting transactions (~ee accounLing ~loceJ--~
7 illustrated in Figure 13; Step 2) (Step 906), ~nd perform a 8 deposit reguest fro~ the Teller money module C 5 (~oc~ated with 9 an I~suing Bank 1) to return the note~ that need tQ be replaced.
~or a detailed description for perfo~ ~n~ a deposit 11 reguest, attention wlll be directed to ~igure 44. Here, the To 12 Teller application 3~ sena~ ~ depos~t request meS~J~, the ~mount 13 of the deposit to be ~ent, the accour,~ number and the acco~nL
14 profile of the accou-,~ to which the notes 11 will be deposited (Step 920). This information is transferred to the Teller money 16 module 5 using Steps 2-8 for F~ i n~ messages, and then Steps 17 7041-7056 (see Figure 38) sre performed to val~date the ~coo 18 profile and number~
19 ~n the c~se where the depositor i~ a Tran~action money module ~, the To Transaction application ~9 of t~e Teller money 21 module S will ~end an ac~nowledgement to the Tran6action money 22 ~odule ~ that the transfer of notes ll ic ready to ~.eEd (Step 23 924). Alternatively, ~f it i~ ~nother Teller money module S that ~4 is making the ~eposit, it ig the To Teller ~pplic~t1on 3~ that i~6ue~ the acknowledgement to t~e Teller money module S (Step 26 9263.
27 In e~ther c~se, t~e ~c~now~edgement ~ enc~ted ~nd 2B transmitted U5~ ng ~he ~Loce-l~re outl~ned ln Steps 2-8, whereby it 2g ~ rece~ed ~y ~ ~o Teller ~pplication ~ of the depos~ting money module (Step 928).
31 Referring b~ck to Figure 35, once the deposlt request 32 i5 completed, the notes ~1 are transferred from the Teller money 2~8~452 1 module B 5 to t~e Teller money module C 5 using Steps 750-770, 2 Figs. 39, 39A detailed above for tr~nsferring notes.
3 Accordingly, To B~nk C ~7 post~ the proper aoc~ ing 4 tran~action~ (see Figure 13, Step 2) to reflect this transfer of notes 11 ~Step 908). ~n Teller money ~odu~e C S, the To Teller 6 application ~ acknowledges the depo6it by 6~ g a mes6age back 7 to the To Teller B 3~ applic~tion (Steps 910-912), u6ing Steps 2-8 8. Naturally, the To Bank ~ ~7 will now po~t ac~v~-,-ing 9 tran6~ctions to r-flect the withdr~wal request 1t ~as made to Teller money module C S ~Step 914; ~ee also Fig. 13, Step 3).
11 After ~11 electronic notes ~1 ~ave been ~ d from 12 the Tr~nsaction ~oney module ~ ~nd t~e proper ao~u!~.Ls have been 13 posted, ~ withdrawal i8 requested of a total ~ ~ that includes 14 both the amount originally reguested to be withdr~wn from the 6ubscr~ber's bank _ccoun~ and the amount that was ~ ved from 16 Ithe Transaction money module ~ to be replaced w$th updated 17 lelectronic notes 11.
18 The withdrawal reguest i6 performed beL~aen Teller 19 money module 8 5 and Teller money module C 5 using the ~.ocess Steps 700-724, F~gs. 30, 30A, de6cribed a~ove. Teller money 21 module C S transacts with a Money Generator module 6 to w~thdraw 22 new electronic money ~nd in doing ~o it establishes a ~ession 23 between t~e two modules using the proce~s Step 190-258, F~gs.
24 34, 34A-C.
The electrsnic notes ~1 are requested by t~e Teller 26 money ~odule C S from the Money Generator ~odule 6 using proces~
27 Steps 780-792, ~ig. 40, ~nd the notes 1~ are tran~ferred fro~ t~e 28 Money Generator module 6 to the ~eller ~oney module C S us~ng the 2g Steps 7~0-770, ~igs. 39, 39A.
The To Bank appli~ation C ~7 performs the accounLinq 31 postinqs ~Step 916; 6ee al60 Fig. 13, Step 4). After this, the 32 electronic notes l~ are tr~n~ferred from Teller money module C S

- -20~04S2 1 to Teller money module B 5 u~ing the Steps 750-~70; the notes 11 2 are th~n tr~nsferred to Tran~action money module A ~ al~o using 3 Step~ ~50-770.
4 To finalize the wit~drawal from the Co~,~s~Q-dent Bank 2, each money module must com~it to the transaction it ha~ ~ust 6 had with the co~es~on~ng ~oney module. ~hus, Transaction ~oney 7 module A 4 co,Tit~ to Teller money module B S using Steps 690-8 698, Fig. 41, and t~ereafter T~ller money module B 5 commits to 9 Teller money ~odule C S. Finally, Teller money module C S
commits to the Money G4nerator module 6, u~ng t~e s~me ~ucess 11 Steps 690-698.

12 Deposit To An I~suing Bank 13 Referring to Figure 42 in comhination with Figure 43, 14 an example of a deposit to an Is6uing Bank I will now be lS described ln detail. ~o st~rt the transaction, a deposit ~et up 16 must be done w~ic~ uses the ~,ùccss steps shown in Figure 43.
17 In Step 398 at the top of Figure 43, the 6~h~criber 18 decides to deposit 60me money to a bank. After performing t~e 19 sign on routine for a Tr~nsaction money module 4 (following Steps 10-42, Figs. 31-31A), the To Subscriber A 33 prompts the 21 F~h~cri~er for the transaction deg~red (Step 400).
22 In thi6 example, the ~ubscriber chooses tbe deposit 23 tran~action, t~e ~mount to be deposited, and the bank and accour.L
24 number in which to deposlt the el~cL~onic ~oney (Step 402).
Before ~ny other ~ocefl~-e_, Note Directory A ~g Çht-~ to see i~
26 the ~oney module contains funds sufficient to _ . rQ- ~ the deposit 27 reguest (Step 404).
28 As~uminq there are insufficient funds for the depo~it, 29 To Subccriber A 33 prompts the subscriber for ~ new a~unt (Step 410) and if no new amount iu eelected, ~he Session Manager A
31 informs the eub~criber that the transaction ~ust be terminatod 1 (Step 414). If the subscriber ~nters a new r ~~ ~ Step 412, the 2 process flow returns to Step 404, w~erein the Note Directory 39 3 application again che~R for sufficient funds for the 4 transaction.
Assuming there are adeguate funds within the money 6 module, the process flow advances to the ~etwork 25 ~ign on 7 p~oce~-res outline in Steps 50-168, Figs. 33-33A. A r~cce6sful 8 Natwork 2S sign on then advances the process flow to Steps 190-9 258, for est~bli~ng a sesslon between the Transaction money module A ~ and Teller money module 8 5.
11 Once the ses~lon i6 est~blls~ed between the two money 12 modules, the deposit request steps outlined in p.o~ 6 920-928 13 are followed conveying t~e request from Transaction money module 14 A ~ to the Teller money module B S. The To ~eller A 3~ transfers all of the electronic notes 11 ~tored within the money module to 16 the Teller money module B 5 (Step 408) using the Steps 750-770 17 described above for transferring electronic notes 1~ between two 18 money modules.
19 Continuing with Fiqure 42, t~e To Ban~ B ~7 posts the accoul.~ing transactions ~or the note~ deposited (Step 418, see 21 Fiq. 12 Step 1). In Teller money module B S, the To Transaction 22 application ~ chec~ to see if the ~ deposited i~ less than 23 the total notes a~ that were ~tored in module A and then 24 tran~ferred to the Teller money module S (Step 420). If the deposit is less ~hAn the tot~l amount of transferred notes ~, 2~ updated notes 1I must ~e generated ~n~ sent back to the 27 Transaction money ~odule 4.
28 When all t~e notes t~at ~re cont~ined in the 29 Transaction money module ~ are deposited, i.e., t~ ~mount to be depos~ted is not less t~an t~e tot~l amount of electronic notes 31 11, the To Transaction ~ ~Q will ~end an ncknowledgement to the 32 Transact~on money module ~ (Step 428) using the Steps ~-8 for 2 ~
~ ing mess~ge~ between money modules. The To Teller A 3~
2 receives the ~cknowledgement (Step 430) and initiates the Steps 3 690-698 to co~mit the deposit transaction between the two money 4 modules.
S W~en the ele~L unic notee 11 removed exceed the desired 6 deposit amount, new updated notes 1I must be returned to the 7 Transaction money modulQ ~. To perform thl~, the To Bank 8 application B ~7 of the Teller money ~odule B 5 posts the proper 9 accounting transactions (Step 424; Fig. 12, Step 2). Thereafter, Teller money module B S establi~e~ a eession with the Money 11 Generator module ~ using p,~cess Steps 190-258, and reguests 12 electronic notes ~1 ~ro~ the Money Generator module 6 in the 13 a ~ ~t that should be ~etu~..Gd to t~e ~ransaction money module ~, 14 by performing Steps-780-792.
lS The electronic notes ~ are created by the Money 16 Generator mGdule 6 and transferred to the Teller money module B 5 17 us~ng Steps 750-770. With the electronic note~ 11 in the 18j possQs~ion of the Teller money module B 5, they are transferred 19 to the Tran~action money module A ~ using Steps 750-770.
After Transaction money module A 4 recei~es the 21 electronic notes 11, it must finalize the transaction by 22 co~mitting ~eller money module B 5 to Tran act~on money module A
23 ~ using Steps 690-698. Likewlse, ~eller money ~odule B 5 mu~t 24 commit to the Money Generator module 6 using the eame Steps 690-698.

26 ~eposit To A ~o,Lespon~nt 8ank 27 Figure 45 ~llustrate~ the process flow for a deposit at 28 a Correspondent ~anX. In depositing to a Corre6pondent ~nk 2, 29 the deposit ~et up de~cribed in Steps 398 through 414 are repeated in t~e firet etage of the transaction. From there the 31 To Transaction 8 49 te8t8 t~ eee if t~e deposit i~ le~s t~an the l 2080~52 1 total amount of ~lectronic note~ 1~ t~at ~a~e been withdr~wn ln 2 the depo6it 6et up procedures that were ~ust proces~e~ (Step 3 440)-4 In the case where all the electronic notes ~1 6tored in t~e Tran~action money module ~ ~re egual to the amount of notes 6 11 to be deposited, then To Tr~ns~ction B ~9 sends a deposit 7 ~cknowledgement back to the ~r~nsaction money module ~ (Step 8 444), u~nq ~teps 2-8 to ~end t~ me~sage from the Teller money 9 module B S to Transaction money module A ~.
On the ~r~n6action money module ~ side, t~e To Teller 11 3~ applic~tion receives the ~r~r ~ledgement ~St-p 446) ~nd u~e6 12 Steps 690-698 to commit the tr~nsact$on with ~eller money module 13 B 5. The Tr~nsaction ~oney module 4 i6 now finis~ed ~nd removed 14 from the process. The f~nal~z~tion of the deposit pro~ides for the accoun~ posting tran~actions to be ~ade by the To Bank 16 ~pplication ~7 (Step 448). See Figure 11, Step 1 for t~e 17 ~ccounting tran6actions.
18 A ~e~sion i~ now establi~hed between ~eller money 19 module B 5 ~nd Teller money module C 5 using Steps 190-258.
Teller money module B 5 is6ue6 a request to make ~
21 depo~it, to the Teller money module C S by usinq p.c~eFe Steps 22 780-792. The To Bank B ~7 then post~ the ~cco~ ing transactions 23 (Step 450; see ~l~o Fig. 11, St-p 2).
24 Notes ~1 ~re ~ow tr~nsferred from the Co~ ps~nt Bank B 2 to the Tss~nq ~ank C I using Steps 750-770: the Issuing 26 Bank C 1 posts the cor,e~yo~ g ~cco~.~inq tran~ctions ~Step 27 452; see ~l~o Fig. 11, 8tep 2). The To Teller C 34 ~yo.,~
28 Fen~sg the depos~t ~cknowledgement ~Step ~54) u~inq Steps 2-8, 29 to To Teller application ~ o~ Teller money module B 5 ~ig. 45~, Step 456).
31 Here ag~in, the deposit is ~ecke~ ~o ~ee if it i~ le~s 32 than the ~mount of electronic notes 11 that have been re~o~ed 1 earlier, and w~en lt 1- not, t~e w~t~drawal i~ compl-t~d w1tb tb-2 p~cce~s Steps 690-698, Fig ~1, to commlt Teller money ~odule B S
3 to Tell-r ~oney module C S
4 a depos~t request tbat 1~ less tAan the amount of notes 11 that are withdrawn requires acoou L updating (Step 460; ~ee 6 ~180 Fig 11, Step 3), and new notes ~1 to replace the additional 7 note~ 11 that were ta~en accordingly, a wlt~La~ tl~ t 8 following the ~ es~ Step~ of 920-928 from Teller money module B
9 5 to ~eller ~oney ~odule C 5 i~ made to provide the~- new el-ctronic note~ 1~
11 ~eller ~oney module C S must first establig~ a ~ession 12 witb tbe Money Generator ~odule 6, using the p~OCC~8 Steps 190-~3 258 The new ~lectronic notes ~1 are requ~sted by the Teller 14 money module C 5 from tbe Money Generator module 6 following lS ~ocesg Steps 780-792, w~cb are tben transferred to tbe Teller 16 money module C 5 using 8tep~ 750-770 to transfer notes ~1 Lc~wEen 17 money modules 18 This trangfer of ele~L,6"ic noteg ~1 to the Teller 19 money module C S requires that acc~ ing tran~action~ be posted by tAe ~o Bank applicat~on C ~7 tStep 462, Fig 45B; ~ee al80 21 Fig 11, Step 3) 22 From tbere, tbe notes ~1 are transferred from tbe 23 Issuing Bank'~ 1 Teller money module C S to tbe Co,-~e~ nt 24 Bank'6 2 ~eller money module B 5 ~nd to the Tran~action ~oney modul~ ~ by u~ng 5teps 7S0-770 for tr~n~ferring note~ 1l 26 Thereafter, each money modulc mu~t co~mit to the money module 27 w~th w~ch ~t Aa~ e~t~bl~hed a se~ion Thu~, Transact~on ~oney 28 module A 4 commit6 to Teller money ~odule B S, ~eller money 29 mo~ule 8 S ~ ogYen~ly commit~ to $eller money module C 5, wA~cA
then com~t6 to the Money Generator ~odule 6 All three of the~e 31 commitment tran~actions u6e proces6 Steps 690-698, described 32 aboYe 2~80~52 1 Subscriber To Subscriber Payment 2 Figure 36 illustrates the process flow for a payment 3 tran6action from one Transaction money ~odule ~ to ~not~er and in 4 t~is example of a preferred e~bodiment, Allce ~or a hypothetical payor corporation, i8 denoted ~A~ in Figure 36) will agree to p~y 6 Bob (or ~ hypotbetic~l payee corporation, la denoted ~B~ in 7 F~gure 36) a CpQCi~iC ~mount of ~ onic money (Step 800).
8 ~oth Alice and Bob ~ign on to their .~s~e-tive Tran~ction money 9 module~ ~ u~ing the proce~ Step~ 10-42 described ~bove. ~hrough the To Subscri~er A 33 application, alice direct6 her Transaction 11 money module 4 to ma~e a p~yment (Step6 806 ~ 810), while Bob 12 operates hifi Transaction money module ~ ~uc~ that the To 13 Subscriber B 33 appllc~tion will i~sue an entitlement to r-ceive 14 payment (Steps 8G8 & 812).
In Steps 814 & 816, the Session Managers 31 of both 16 Alice'6 Transaction money module ~ and Bob's Tr~nsaction money 17 module ~ est~bli~h communication~. From there, a ~es~ion i~
18 establis~ed, a8 de~cribed in Step6 190-258 above for tran~acting 19 between any two money modules.
With ~ se66ion established, To Sub6criber A 33 prompts 21 the ~ubscriber to enter the amount of payment t~at she desires to 22 transfer (Step 818), which i8 di~played to the r~scrlber.
23 Alice enters the r--_nt that she wishes to transfer to 24 Bob. Pay/~r~An~a ~ppl~cation A 3S receives the ~ount entered (F~g. 36, Step 820). The amount entered by type (~u~Lcn~y or 26 credit) is now compared by Note Directory A 3~ to the b~l~nce of 27 t~e v~lue of the electronic money stored in the Transaction money 28 module ~, to see ~f t~ere are suff~cient funds a~a~lsble to 29 permit the tran~action to proceed (Step ~22).
~f t~ere are insufficient funds, To Subscri~er A ~3 3~ 6endc the ~ubscriber ~ not~ee t~at t~ere are not 6uff~cient funds 32 to cover t~e transaction desired ~Steps 824-826), ~nd prompts the 2080~2 1 ~ubscriber again for a new ~ount of payment ~Step 827). If the 2 subscriber prefers not to enter a new amount, the ~ort 3 tr~n~action proces6 Steps 500-524 are ~ctivated to terminate the 4 ~ - ications llnk bet~Qen the two Transaction money modules ~.
on the other hand, a newly entered amount will ~e~u,.. the ~oce6s 6 to Step 820, to check for sufflcient fund~ again.
7 When there are sufficient funds ctored in Transaction 8 money module A ~ to procegs the tran6fer, Pay/FY~ge A 3S sends 9 ~ messaqe disclosing the ~mount of the transfer to Bob'~
Tran~action money ~odule ~ (Step 828), using the ~ n~
ll disclo~ed ln Steps 2-8. Se- Fiq. 36A. From there, To Sub6criber 12 B 33 prompt6 the owner to verlfy that the amount to be 13 transferred will be accepted by him ~Step 830). Bob can then 14 decide whet~er to accept or re~ect the -n.L to be transferred (Step 832~.
16 If Bob ,e~onds in the negative, then Pay/Exchange ~ 35 17 ¦will send a me6saye back to Transaction money module A ~ using 18 IStepfi 2-8, that the amount to be transferred is in~o,~e_L (Step 19 834); the ~oce5s again returns to Step 826, Fig. 36, to prompt Alice for a new a~ount to be entered.
21 When Bob respond~ in the ~ffirmat~ve in Step 832, Pay/
22 Exchange ~ 3S will send ~n acknowledgement to Transaction money 23 module A ~ u~ng Steps 2-8 ~Step 835). Back in Tran6action money 24 module A ~, the message will be cG.,~eyed to Pay/~Y~ e A 3S to recei~e t~e acknowledgment sent by ~ransaction money modu~e 8 4 26 (Step 836).
27 Wit~ this acknowledgement received, Pay/~ A~s~ A 3S
28 will ~end the ~mount desired to be tr~nsferred to the Money 29 ~ol~er 3B (Step 83B~ 60 that the electronic note~ ~ may ~e 3Q tran6ferred using Step~ 750-770. With the transfer completed, 31 t~e two Tr~nsac~ion money m~dules ~ must commit to t~e transfer 32 using Step 690-698 described ~bove~ The communicat~on link 1 between the two tr~ns~ction ~odule~ may now be termin~ted.

2 Sub~criber to Subscriber Foreign Exc~ange 3 Referring to ~igure 46, the p ocess flow for an 4 ex~hange of ~oreign ~.encie~ between two ~ran6action ~oney modules ~ will now be illustrated. In t~is exa~ple Alice (or a 6 hypothetical corporation, denoted ~A~ in Figure6 46-46A) agrees 7 to eY~h~e ~ollar~ for ~o--n~C ~it~ ~ob (or a hypot~otical 8 corporation, denoted ~Bn in Figures 46-46A). The ~ n-e rate 9 that they have agreed to ~ill be a ratio of dollar6 to poun~
(Step 300).
11 Alice begins by ~~n~n~ on to ~er Transaction Joney 12 module 4 ~using Steps 10-42 described a~ove) w~ile Bob ~igns on 13 to h~s Transaction money module ~ (u~ing Steps 10-42).
14 Thereafter, the ~o SubQcriber 33 applications of both Transaction money module6 ~ prompt the re~pective u~er~ to ~elect a type of 16 tr~nsaction (Steps 302-303). In thi~ example, Alice and Bo~
17 agree to eY~n~e her doll~r6 ~or his po~n~.
18 By regue~ting the forelgn e-~ch~F-~ tran~action, Se8s~0n 19 Manaqer A ~ will est~bli~h a commun~eation~ linX wit~ Session Manager ~ 31 (Steps 306, 307) ~o that a session may be 21 esta~ hed between the two money modules using Step~ 190-258.
22 Alice i~ then prompted by To Subscriber A 33 for the amount of 23 doll~rs ~he will ~el~, and the ~Y~hAng~ rate that she will u~e ~n 24 the tran~action (Step 308).
Pay/F~rhAn7e A 35 receives the input ~Step 310) and 26 Note ~irectory ~ 39 checks for ~uffic~ent fund~ by co~paring the 27 4mount requested to the amount o~ value conta~ned in the 28 Tran~action money ~odule ~ ~St~p 312). An insufficient funds 29 condition will cause t~e To Sub w riber A 33 to ~end ~n incufficien~ funds me~sage to Alice and prompt the s1~hscriber to 31 ~elect another a ~unL of dollars and exchange rate ~Steps 318-2~g~2 1 320). When new ~ ctions are enterod, ~he process flow ~ 8 2 to Step 312 and continues from there. If Al~ce does not select a 3 new a~ount, the 6ession i~ dissolved using abort transaction 4 Steps S00-524.
W~en the funds are su~lcient to meet the amount 6 reguested, the Pay/FYchAngc A 35 ~ends t~e amount of the dollars 7 and the propo~ed dollar/pound .~ A- j e rate (Step 316) to the To 8 Subscriber applicat~on ~3 of ~rans~ction money module B ~ using 9 the Steps 2-8 ~see Pigure ~6A). At this point, To Sub~criber B

33 prompts Bob with the a - ~ and rate p~ fie~ by Alice, to 11 determine if the values are what Bob will agree to e~c~An~c (Step 12 322).
13 The Pay~FYc~ e B 3S receives the dollar amount and 14 the rate that i8 PY~r &se~ by Alice and if the amount and rate are not agreed to by Bob, Pay/Exchange B 35 will ~end a message 16 indicating th~t the value or exchange rate i8 incorrect ~Step 17 326), through the Steps of 2-8 for 6end~ng messages. ~o ~8 S~hscriber A 33 prompts Al~ce for the dollar amount and exchange 19 rate over ~gain (Step 327). Entry of new values ~e~..s ~he process to Step 310 for continuatlon, ~ee Fig. 46, while the lack 21 of new values entered causes the abort transaction process of 22 S~eps 500-524 to be ~nitiated.
23 I f the ~ and rate are agreed to by Bob, 24 Pay/Exchange B 3S will calculate the equivalent ~mount ln po~n~c, ba~ed on the rate prov~ded ~not 8~0WTI), and then initiate the 26 ~tep of h~ving Note Directory ~ 39 check to ~ee th~t ~r~nsaction 27 money module B ~ conta~ns sufflclent ~und~ to fulfill the 2~ exch~nge ~Step 323). When the funds in Transactlon ~oney mo~ule 29 B ~ ~re lnsuff~cient to meet t~e exc~ng~, Pay/~Y~nqe B 35 sends ~ message to Alice of insuff~cient ~unds (Step 325) using 31 Steps 2-8. The process flow ~e~ s to Step 327.
32 PLoc~e~in~ with the case in which ~ufficient funds do 2080~52 1 'exist in Transaction money module B ~, Pay/Exchange B 35 will 2 eend an acknowlGd~- ent using Steps 2-8 to ~ransact7on money 3 module A ~ (Step 329). After receiving tnis ~ck7-l~ledgement, 4 Pay/Exchange A 35 sends the ~mount of dollars requested to its corresponding Money Holder 38 appl$cation in Step 330. The 6 dollars _re transferred from Alice to ~ob ~ia the Steps 750-770 7 described above for transferring notes ~.
8 P_y~FYchA7l~6 B ~S recei~es the note~ 1~ and then 9 transfers t7ne ~mount of po~n~ to it~ Money Holder 38 application (Step 331). From t~ere, t7ne el~ v-~ic polln~7c _re tr~nsferred to 11 Alice u~ing the transfer notes process described in Stepz 750-12 770. q7O record t~is ~YchAn~e, Transaction money module A ~
13 commits with Tr_nsaction money ~odule B ~ by using process Steps 14 690-698 described above. With a ~atisfactory eYchA7r7ge, the commun~cations linX 7Detween t7ne two transaction money modules may 16 now be terminated.

17 ~oreign FYchAn~ At An I~suing B_nk 18 Turning ~ttention now to ~igure 48, if a ~ hs~riDer 19 were to excnange nis/her dollars for pounds with an Issu~ng Bank 1 instead of with a subscriber, tne following pL~_eS~ i8 21 followed.
22 Sub6cri7Der A sets up tne foreign eYchAnqQ transr7ction 23 by 6ignin~ on to hi~/her Transaction money module ~ (referring 24 now to Fig. 47) using Steps 10-42 de~cribed abo~e. To Subscriber A 33 prompts the e77h-criber for the trans~7ction desired (Step 26 334), and ~n t~is example, the suhscriber r~7~o~F the 27 dollar/pound eYc~7-Anq_, and t~e a~ount of doll~rs the subscriber ~8 will exck~r7~c. It is anticipated that the cholce of the bank to 29 tran~act with may be an ~ption offered to the F~hccr~ber (Step ~36).
31 The Note Directory A 39 checks for ~ sufficient bal~nce - ~6 -2~80~52 1 to complete t~e request tstep 338) An insufficient h~n~e 2 perm~ts the su~scr~ber to again enter the amount he/~he will 3 eY~hA~g~ (Step~ 340-342), whereby Ses6ion ~ ;er A 3~ will 4 terminate th- trans~ction (Step 345~ if no new ~mount i8 entered Entry of a new amount r-turns the ~.ocess to Step 338 to check 6 for ~uffic~ent funds to meet the new request When the funds are 7 sufficient for the ~Ysh~nge r-quest, a Network 2S ~ign-on u~ing 8 Step~ 50-168 i6 commenced 9 After the Ne~L~ 25 ~ign-on, the Network 25 checks ~f a bank or ~nanclal ln~tltution ha~ been ~electQd (Step 346) If 11 a bank or financial in-titution was not c~o~~ earlier, To Tell~r 12 A 3~ ~ust prompt the Network Server 26, through Session ~an~ger A
13 31, for a list of bank~ or ~inancial institutions that will 14 provide the eYr~Ange ~Steps 348-350) The Network Server 2C
~ends the l~t (along with rates) to the subscriber through the 16 To Teller A 34 and the To Subscriber A 33 applic~tions tSteps 17 352-356) 18 After t~e prompting (Steps 357, Fig 47A), the 19 6ubscriber çhoe~eF a bank or ~inancial in~titut~on, or ends the tr~nsaction (Step 359) When a bank or financial in~titution i8 21 rhoEQn, a ~ess~on is est~blished with the Teller money ~odule S
22 r~osen u~ing Steps 190-258 described ~bove After ~ ~e~sion ic 23 establi~ed, ~o Teller A 3~ ~ends the r --nt of doll~r~ to be 24 eY~h~nged for poln~C (Step 360) using Step6 2-8 for ~ncrypting and tr~ns~itting a mes6age 26 To en~~Le ~bat t~e ~hscriber still wants to ~rc_eed 27 with the ~hanqe~ To Tran~action B 49 ~ends the ~Lfent exc~ange 28 rate to t~e - ~h~Gri~er uslnq y~oceC~ Step~ 2-~ IStep 362) At 29 this point, To Subscriber A 33 prompt~ tbe subscriber wit~ the 30 bank ' 8 exchan~e rate ~nd if the subscriber does not wish to 31 proceed, the transaction is aborted by following Steps 500-~24 32 (Step~ 36~-366) If t~e trangaction ic to proceed, the dollar~

2080~2 1 are transferred from Tr~nsaction money module ~ ~ to Teller money 2 ~odule B S u~ing Steps 750-770 described herein 3 Returning to Figure 48, once the set up of the foreign 41 exchange transaction ~s accomplished, the proper accGu"-ing transactions are posted (Step 368; also illustrated in Figure 15, 6 Step 1) to reflect the dollars th~t have ~ust been transferred 7 A cession iB ~stabli6hed between Teller money module B S and a 8 Money Cenerator ~odule 6 via Steps 190-2S8 Tell~r ~oney module 9 ~ 5 requests th- proper pound notes 11 through y~0~6~ Steps 780-792 The notes ~ are returned from the Noney Generator module 6 11 to the Teller money module B 5 using Steps 750-770 12 ThiR latter tr~nsfer of notes ~ reguires ~
13~ col~~spon~ updating of the aOC0~.~5 ~nvolved ~Step 370; ~ee 14 also Fig 15, Step 2) The notes ll are transferred to the Transaction money module A ~ through process Steps 750-770 To 16 complete the exchange, Transaction money module A ~ commits to 17 Teller money module B S who subseguently com~its to the Money 18 Gener_tor module 6 usinq process Steps 690-698 19 Foreign ~rhA~qe At A CG~,espondent B_nk The foreign eYçhA~ge with a Corre~ponA~nt BanX 2 is 21 described with the ~ld of F$gure 49 Initially, th- foreign 22 exchange transaction is set up by repeating process Steps 334-23 366, (Fig~ 47-47A) and updating t~e proper Accv~rl-~ tsee Figure 24 16, Steps 1-2) to re~lect the notes 1~ that ha~e ~ust been transferred from the s~h~ri~er~s ~on~y module ~ to Teller money 26 module a S (Step 372) There~fter, Teller money ~odul- B S will 27 est~blis~ ~ ~e~ion ~ith ~eller money ~odule C S ~t ~n TF~"~ng 28 Bank ~, by performing ~LOC~8 Step~ 190-258 29 A w~thdrawal is reguested by Teller money module B 5 to Teller money ~odule C 5 using process Steps 920-928 described 31 above To ~a~n the notes ~ for the request, Teller money l module C S must get them from a Money Generator ~odule ~
2 Accordingly, a ~es~ion i~ est~blished between the two money 3 nodule~ via Steps 190-2S8, and the notes ~ are reguested 4 following process Steps 780-792 outlined above S The Money Generator rodule ~ ~ill create the notes ll 6 reguested And transfer them to Teller money ~odule C 5 using 7 ~GCa55 Steps 750-770 T~i~ ir ~ollowed by a posting to the 8 proper ~cco~ in the banX C'~ ~ygtemg (St-p 374, ~ee Figure 16, 9 Step 3 for ~ccol ,-ing transaction~) The notes 11 are now tran~ferred fro~ Teller money ~odule C to Transaction ~oney 11 ~odul- A ~ via Teller money ~odule B S using for each transfer 12 the ~rc~esr Steps 750-770 Finally, all the se~ion~ ~ust be 13 committed, and ~ransaction ~oney module A ~ co~mits to Teller 14 money module ~ S who in turn commits to Teller ~oney module C S
using Steps 690-698 Teller money module C S commit~ to the 16 Money Generator ~odule 6 to complete the e~ch~ge of dollarc ~or 17 poln~c 18 Updating Noteg, Certificate l9 As mentioned above, it i8 anticipated that the date of expiration of a note, u6ed a~ a cecurity measure, may ~xp$re 21 while it i5 ~tored in a $ransaction ~oney module ~ If thi~
22 occur6, the holder of ~xpired notes 11 will not be able to 23 transfer them to another Tr~ncaction money ~odule ~, but the 24 holder m~y deposit them or eXchAn9e them for new notes ~ by tr~nsacting ~ith ~ particlpating b~n~ or f~n~no~Al instltution 26 Addition~lly, i~ the certificate a~soc~sted with a ~ particular ~ran~a~t~on ~oncy ~odu~e ~ cxpirQ~, t~Q r~-cr~er 2a must ~iyn on the ~ct ~OL~ ~S to update t~e certificate in order to 29 tran~act wltb another money module ~ The following ~ a description of the ~OC~F,8 flow for updating an expired 31 certificate or exp~red notes 11 _ ~9 _ 2~804~2 1 Beginning at the top of Figure 50, a ~h~Griber signs 2 on to the Transaction money module 4 using the Steps 10-42 3 describ-d above, and 1~ prompted by To Subscriber A 33 to ~elect 4 a transaction (Step 5701. After selecting the transaction for ~updat~ng" (Step 572), a sign-on to the Network 25 i~ performed 6 using Steps 50-168. The ~ign-on to the Network 2S will perforn 7 the updating of ~he certificate, as descr~bed above with 8 reference to Figure 33-33A.
9 For updating the note6 1~, the Session Manager A 3~
~ends tbe update notes reguest to tbe Network 2S (Step 574): The 11 Network Server 26 ~I r~ '~ by ~ the ~elected bank 12 identifier back to the Transaction money module ~ (Step 576).
13 Now, a ses6ion may be establ~shed between the Tran~action money 14 module A ~ and a Teller money module B S of the bank 6elected, using Steps 190-258.
16 Once the session is established, To Teller A 3~ sends 17 the request to update note~ 11 (Step 5~8) using the mes~aqe 18 ~ ing routine ~n Steps 2-8. To ~ransactor 8 32 ,J~n~8, Fig.
19 50A, w~t~ an ac~nowlE~ t (Step 580) sent using Step~ 2-8.
Transaction money module A ~ can now transfer the expixed notes 21 ~1 to ~eller money module B 5 us~nq Steps 750-770. Thereafter, 22 the corresponding accoun~ing (see Figure 24, Step 1) is performed 23 ln t~e b~nk's record~ (Step 582), ~nd a ~ession i~ establi~hed 24 between Teller money module B 5 and the Money Generator module 6 through Steps 190-25R.
2~ ~he reque~t notes rout~ne of Steps 7~0-792 is tben 27 performed. The Money 6ener~tor mod~e 6 6ends the reguested 28 ~ote~ SS via Steps 750-770, and update~ t~e ~CC6~.~ at the b~nk 29 (Step 584; ~ee al~o Fig. 24, Step 2). Teller money modula 8 S
takes the upd~ted notes 1~ ~nd ~AC~S them to Tran6action ~oney 31 module A 4 using the 6ame Steps 750-770.
3~ Now that the notes ~1 have been updated in the 2~8~452 ~ Transaction money module ~, the sessions are completed ~y h~ving 2 Transaction money module A 4 co~mit to Teller money module B S, 3 ~nd having Teller money module B S then com~it the transaction 4 w~th t~e Money Generator module. Finally, both committing S routines are performed using Steps 690-698 described ~bove.
6 The above de~cribed ~Lvcess flows illustrate the 7 capabillty of t~e invention to provide an improved system for 8 exchanging electronic representations of economic value, while 9 ~voiding the inherent limitations of paper ba~ed monetary systems.
11 Operation of the invention has been described primarily 12 with cu~ notes and credit notes th~t can be used by 13 subscribers in the same procesrer. It will be understood t~at 14 the described system can also be ~dapted to other monetary instrument6. For example, personal ~nd corporate checks ~nd bank 16 drafts could be prov~ded by enhancing ~everal of the Transactor ~7 applications. More complicated multiparty payment ~.esses ~uch 18 as letters of credit ~nd h~n~er's acceptA~ces could also be 19 prov$ded with appropriate changes to the cystem. It may also be possible to ~dapt the sy6tem of the invention to provide 21 corpornte financi~l obligat~on~ such as com~ercial paper.
22 Moreover, al~o~h the invention h~s been describQd in 23 detail with particular reference to a preferred embodiment 24 thereof, it 6hould be understood that the in~ention i~ c~pable of other ~nd different e~odi~ent~, and it~ det~ilD are capable of 26 ~odifications in v~riou~ obvious rer~ . As i~ y 27 ~pparent to those skill~d in the art, v~riation~ ~nd 28 modifications can be affected whlle re~ain~ng within the ~pirit 29 and ~cope of the i~vention. Accord~ngly, the forego~ng disclosure, de~cription, and figures ~re for illustrative 31 purpo6es only, and do not in any way limit the in~ention, which 32 is defined only by the clai~s,

Claims (107)

1. An electronic monetary system comprising:
an issuing bank having an on-line accounting system;
electronic representations of currency that are credited in said on-line accounting system as current liabilities of said issuing bank;
a money generator module associated with said issuing bank, for generating said electronic representations of currency;
a teller module associated with said issuing bank, capable of storing said electronic representations of currency, and intermediating banking transactions involving said electronic representations of currency;
a transaction module capable of storing said electronic representations of currency, performing on-line transactions with said issuing bank, and exchanging said electronic representations of currency with other transaction modules in off-line transactions;
where said electronic representations of currency each include an original monetary value generated by said money generator module; and said teller and transaction modules having processors operative, when said modules are functioning as transferor modules transferring one of said electronic representations of currency to a transferee module, to generate and include in said transferred electronic representation of currency a transfer record having a transferred monetary value.

2. The electronic monetary system of claim 1, wherein said transaction module and said teller module each have a note directory for keeping track of a current monetary value for each of said electronic representations of currency stored therein.

3. The electronic monetary system of claim 2, wherein said current monetary value recorded in said note directory of said transferor module, and associated with one of said electronic representations of currency stored therein, is decremented by said transferred monetary value upon transferring said transferred electronic representation of currency to said transferee module.

4. The electronic monetary system of claim 1, where said electronic representations of currency include a money generator digital signature produced by said money generator and a transferor digital signature produced by said transferor module.

5. The electronic monetary system of claim 4, where said electronic representations of currency include certificates corresponding to said money generator digital signature, and said transferor digital signature, where each of said certificates includes a module identifier and a first cryptographic key of said digital signature producer, and where said first cryptographic key is used to validate said corresponding digital signature.

6. The electronic monetary system of claim 5, where said certificates are digitally signed by a security server associated with a Certification Agency, and said certificates may be validated using a second cryptographic key of said security server that is available to said teller module and said transaction module.

7. The electronic monetary system of claim 1, wherein said transfer record further includes an indication of date-of-transfer and a transferee module identifier.

8. The electronic monetary system of claim 1, wherein said electronic representations of currency include transferor module identifiers and transferee module identifiers.

9. The electronic monetary system of claim 8, wherein said transferee module verifies that the most recent of said transferor module identifiers contained in said transferred electronic representation of currency is the same as a module identifier of said transferor module.

10. The electronic monetary system of claim 1, wherein said money generator, teller, and transaction modules are tamper-proof devices that are capable of communicating via cryptographically secure sessions.

11. The electronic monetary system of claim 10, wherein each of said modules is configured to perform as a modular co-processor of an electronic processing device.

12. The electronic monetary system of claim 10, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;

and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

13. An electronic monetary system comprising:
an issuing bank having an on-line accounting system;
electronic representations of currency that are credited in said on-line accounting system as current liabilities of said issuing bank;
a money generator module associated with said issuing bank for generating said electronic representations of currency;
a teller module associated with said issuing bank, capable of storing said electronic representations of currency, and intermediating banking transactions involving said electronic representations of currency;
a transaction module capable of storing said electronic representations of currency, performing on-line transactions with said issuing bank, and exchanging said electronic representations of currency with other transaction modules in off-line transactions;
where said electronic representations of currency include an expiration date;
said other transaction modules having processors adapted to refuse to accept attempted transfers of said electronic representations of currency when said attempted transfers occur after said expiration date of said electronic representations of currency.

14. The electronic monetary system of claim 13, wherein said issuing bank has accounting process means for maintaining appropriate accounts during deposits and withdrawals of said electronic representations of currency.

15. The electronic monetary system of claim 13, wherein said expiration date varies in accordance with a monetary value associated with said electronic representations of currency.

16. The electronic monetary system of claim 13, wherein said electronic representations of currency stored in said transaction module are updated when transacting with said teller module.

17. The electronic monetary system of claim 16, wherein said electronic representations of currency are updated by said transaction module transferring said stored electronic representations of currency to said teller module, said money generator module generating a new replacement electronic representation of currency having a new expiration date, and said teller module transferring said new replacement electronic representation of currency to said transaction module.

18. The electronic monetary system of claim 13, wherein said money generator, teller, and transaction modules are tamperproof devices that are capable of communicating via cryptographically secure sessions.

19. The electronic monetary system of claim 18, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

20. An electronic monetary system comprising:
an issuing bank having a first on-line accounting system;
electronic representations of money that are credited in said first on-line accounting system as current liabilities of said issuing bank;
a money generator module associated with said issuing bank, for generating said electronic representations of money;
a teller module associated with said issuing bank, capable of storing said electronic representations of money, and intermediating banking transactions involving said electronic representations of money;
a transaction module capable of storing said electronic representations of money, performing on-line transactions with said issuing bank, and exchanging said electronic representations of money with other transaction modules in off-line transactions;
a security server used for implementing the security of the electronic monetary system;

where said money generator module, said teller module, and said transaction module are each associated with a unique module identifier contained within a certificate that is digitally signed by said security server, where said certificates are only valid for a limited period of time, after which time said associated module will not be able to transact with other modules until a new certificate is obtained.

21. The electronic monetary system of claim 20, wherein said issuing bank has accounting process means for maintaining appropriate accounts during deposits and withdrawals of said electronic representations of money.

22. The electronic monetary system of claim 20, wherein said security server distributes said new certificate, a bad module list, and a certificatory key, when required.

23. The electronic monetary system of claim 20, wherein said security server digitally signs an account profile having data fields including a bank identifier, an account number, and an indication of account type, where said account profile is used by said transaction module to access a subscriber account identified by said account number.

24. The electronic monetary system of claim 20, wherein said money generator module, teller module, transaction module, and security server are tamper-proof devices capable of communicating via cryptographically secure sessions.

25. The electronic monetary system of claim 24, wherein each said module and said security server may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module and said security server may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

26. An electronic monetary system comprising:
an issuing bank having an on-line accounting system;
an electronic credit authorization that is drawn on a subscriber's loan account in said on-line accounting system so as to reduce said subscriber's available credit line;
a money generator module associated with said issuing bank, for generating said electronic credit authorization;
a teller module associated with said issuing bank, capable of storing said electronic credit authorization, and intermediating banking transactions involving said electronic credit authorization;
a transaction module capable of storing said electronic credit authorization, performing on-line transactions with said issuing bank, and transferring said electronic credit authorization to another transaction module in an off-line transaction; and where said electronic credit authorization includes an account number of said subscriber's loan account, a monetary amount and a digital signature produced by said money generator module; and where, when said electronic credit authorization is deposited, said issuing bank debits said subscriber's loan account by said monetary amount.

27. The electronic monetary system of claim 26, wherein said issuing bank has accounting process means for maintaining appropriate accounts during deposits and withdrawals of said electronic credit authorization.

28. The electronic monetary system of claim 26, wherein said transaction module may only once transfer said electronic credit authorization to another transaction module.

29. The electronic monetary system of claim 26, wherein said money generator, teller, and transaction modules are tamperproof devices capable of communicating via cryptographically secure sessions.

30. The electronic monetary system of claim 29, wherein said electronic credit authorization includes digital signatures produced by said teller and transaction modules upon transferring said electronic credit authorization; and where said money generator module, said teller module, and said transaction module are each associated with an electronic certificate by which other modules may verify their authenticity; whereby said transferring of said electronic credit authorization by said transaction module to said other transaction module may be performed without subscriber identification.

31. The electronic monetary system of claim 29, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

32. The electronic monetary system of claim 26, wherein said transaction module is capable of storing both electronic representations of currency and electronic credit authorizations, and where said transaction module can transfer both said electronic representations of currency and said electronic credit authorizations in a single transaction transfer to said other transaction module via a cryptographically secure session.

33. An electronic monetary system comprising:
an issuing bank having a first on-line accounting system;
electronic representations of money that are credited in said first on-line accounting system as current liabilities of said issuing bank;
a money generator module associated with said issuing bank, for generating said electronic representations of money;
a first teller module associated with said issuing bank, capable of storing said electronic representations of money;

a plurality of correspondent banks, each having a second on-line accounting system and each maintaining an account at said issuing bank;
a plurality of second teller modules, each associated with one of said correspondent banks, each capable of storing said electronic representations of money;
a transaction module capable of storing said electronic representations of money, performing on-line transactions with said plurality of correspondent banks or said issuing bank, and exchanging said electronic representations of money with other transaction modules in off-line transactions;
where said first teller module has a first processor capable of intermediating transactions among said first on-line accounting system, said money generator, said second teller module, and/or said transaction module; and where said second teller module has a second processor capable of intermediating transactions among said second on-line accounting system, said first teller module, and/or said transaction module.

34. The electronic monetary system of claim 33, wherein said issuing bank and said correspondent banks have accounting process means for maintaining appropriate accounts during deposits and withdrawals of said electronic representations of money.

35. The electronic monetary system of claim 33, wherein said money generator, transaction, and first and second teller modules are tamper-proof devices capable of communicating via cryptographically secure sessions.

36. The electronic monetary system of claim 35, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

37. An electronic monetary system comprising:
a plurality of issuing banks having on-line accounting systems;
electronic representations of currency that are credited in said on-line accounting system as current liabilities of said plurality of issuing banks;
a plurality of money generator modules associated with said plurality of issuing banks, for generating said electronic representations of currency;
a plurality of teller modules associated with said plurality of issuing banks, capable of storing said electronic representations of currency;
a clearing bank having a data processing system for clearing said electronic representations of currency, at which each of said plurality of issuing banks has an account;

where each of said electronic representations of currency includes an issuing bank identifier; and where each of said plurality of teller modules sends electronic representations of currency deposited at its issuing bank but issued by another issuing bank to said clearing bank data processing system for balancing said issuing bank accounts and for sending each said electronic representation of currency back to said issuing bank indicated by its issuing bank identifier.

38. The electronic monetary system of claim 37, wherein said plurality of issuing banks and said clearing bank have accounting process means for maintaining appropriate accounts during clearing of said electronic representations of money.

39. The electronic monetary system of claim 37, wherein said money generator modules and said teller modules are tamper-proof devices capable of communicating via cryptographically secure sessions.

40. The electronic monetary system of claim 39, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

41. An electronic monetary system comprising:

a plurality of issuing banks having on-line accounting systems;
electronic credit authorizations that are drawn on subscribers' loan accounts in said on-line accounting system so as to reduce said subscribers' available credit lines;
a plurality of money generator modules associated with said plurality of issuing banks, for generating said electronic credit authorizations;
a plurality of teller modules associated with said plurality of issuing banks, capable of storing said electronic credit authorizations;
a clearing bank having a data processing system for clearing said electronic credit authorizations, at which each of said plurality of issuing banks has an account;
where each of said electronic credit authorizations includes an issuing bank identifier; and where each of said plurality of teller modules sends electronic credit authorizations deposited at its issuing bank but issued by another issuing bank to said clearing bank data processing system for balancing said issuing bank accounts and for sending each said electronic credit authorization back to said issuing bank indicated by its issuing bank identifier.

42. The electronic monetary system of claim 41, wherein said plurality of issuing banks and said cleaning bank have accounting process means for maintaining appropriate accounts during clearing of said electronic credit authorizations.

43. The electronic monetary system of claim 41, wherein said money generator modules and said teller modules are tamperproof devices capable of communicating via cryptographically secure sessions.

44. The electronic monetary system of claim 43, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

45. An electronic monetary system comprising:
an issuing bank having an on-line accounting system and a money issued reconciliation system;
electronic representations of money that are accounted for in said on-line accounting system;
a money generator module associated with said issuing bank, for generating said electronic representations of money;
a teller module associated with said issuing bank, capable of storing said electronic representations of money;
where said electronic representations of money include a note identifier used to uniquely identify each said electronic representation of money;

where said money issued reconciliation system maintains a record of said electronic representations of money that issued from said issuing bank; and where said electronic representations of money that are deposited are sent to said money issued reconciliation system having a processor for matching said record of electronic representations of money that issued to those electronic representations of money deposited; and where unmatched cases may indicate note counterfeiting in said electronic monetary system.

46. The electronic monetary system of claim 45, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

47. An electronic monetary system comprising:
an issuing bank having an on-line accounting system and a transaction reconciliation system;
electronic representations of money that are accounted for in said on-line accounting system;
a money generator module associated with said issuing bank, for generating said electronic representations of money;

a teller module associated with said issuing bank, capable of storing said electronic representations of money;
where transaction records from said money generator module, said teller module, and said on-line accounting system are periodically passed to said transaction reconciliation system;
said transaction reconciliation system having a processor for analyzing said transaction records to ensure that teller transactions match the appropriate accounting transactions and to ensure that money generator transactions match the appropriate teller transactions and accounting transactions; and where any mismatches may indicate incomplete processing or a security breach.

48. The electronic monetary system of claim 47, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

49. A method for a transaction module having a time-limited certificate to update said certificate through interaction with a security server comprising the steps of:
said transaction module generating a new public and private key pair;

said transaction module sending certificate data including said new public key and an identifier associated with said transaction module to said security server, where said data is digitally signed by an old private key of said transaction module;
said security server verifying the validity of said data signed by said old private key;
said security server digitally signing an updated certificate incorporating said certificate data and sending said updated certificate to said transaction module; and said transaction module validating said updated certificate.

50. A method for a subscriber using a transaction module to perform a withdrawal from said subscriber's bank account at an issuing bank having a teller module, a money generator module, and an on-line accounting system, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, said bank account from which to make said withdrawal and a withdrawal amount;
(b) said transaction module establishing a first cryptographically secure session with said teller module;
(c) said transaction module sending a withdrawal request to said teller module, via said first cryptographically secure session, where said withdrawal request includes said withdrawal amount and bank account information corresponding to said bank account;
(d) checking said bank account information to verify its validity;
(e) checking said bank account for sufficient funds;
(f) said teller module establishing a second cryptographically secure session with said money generator module;
(g) said teller module sending a create money request to said money generator module, via said second cryptographically secure session, where said create money request includes a requested note value;
(h) crediting a money issued account in said on-line accounting system by said requested note value;
(i) debiting said bank account in said on-line accounting system by said withdrawal amount;
(j) said money generator module generating a first electronic representation of money of said requested note value;
(k) transferring said first electronic representation of money to said teller module, via said second cryptographically secure session;
(l) transferring said first electronic representation of money from said teller module to said transaction module, via said first cryptographically secure session;

(m) committing said transaction module and said teller module session; and (n) committing said teller module and said money generator module session.

51. The withdrawal method of claim 50, further comprising a step for maintaining appropriate accounts at said issuing bank during said withdrawal transaction.

52. The withdrawal method of claim 50, wherein said bank account information comprises an account profile having a bank account number that is digitally signed by a security server;
where said step of checking the validity of said bank account information includes the step of checking said digital signature on said account profile with a public key of said security server.

53. The withdrawal method of claim 50, wherein said requested note value equals said withdrawal amount.

54. The withdrawal method of claim 50, further comprising the step of:
before step (f), said transaction module transferring a second electronic representation of money to said teller module, via said first cryptographically secure session;
where said second electronic representation of money includes an expiration date and a monetary value;

where said requested note value equals said withdrawal amount added to said monetary value; and where said first electronic representation of money includes an updated expiration date.

55. The withdrawal method of claim 50, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

56. A method for a subscriber using a transaction module to withdraw an electronic representation of money from a correspondent bank, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, a bank account from which to make a withdrawal and a withdrawal amount;
(b) establishing a first cryptographically secure session between said transaction module and a first teller module associated with said correspondent bank;
(c) said transaction module sending a first withdrawal request to said teller module, via said first cryptographically secure session, where said withdrawal request includes said withdrawal amount and bank account information corresponding to said bank account;

(d) checking said bank account information to verify its validity;
(e) checking said bank account for sufficient funds;
(f) establishing a second cryptographically secure session between said first teller module and a second teller module associated with said issuing bank;
(g) debiting said subscriber's bank account by said withdrawal amount in a first on-line accounting system associated with said correspondent bank;
(h) crediting a deposited at issuing bank account in said first on-line accounting system by said withdrawal amount;
(i) said first teller module sending a second withdrawal request to said second teller module, via said second cryptographically secure session, where said second withdrawal request includes said withdrawal amount;
(j) establishing a third cryptographically secure session between said second teller module and said money generator module;
(k) said second teller module sending a create money request to said money generator module, via said third cryptographically secure session, where said create money request includes said withdrawal amount;

(l) said money generator module generating a new electronic representation of money of said withdrawal amount;
(m) transferring said new electronic representation of money to said second teller module, via said third cryptographically secure session;
(n) crediting a money issued account in a second on-line accounting system associated with said issuing bank by said withdrawal amount;
(o) debiting a correspondent bank money account in said second on-line accounting system by said withdrawal amount;
(p) transferring said new electronic representation of money from said second teller module to said first teller module, via said second cryptographically secure session;
(q) transferring said new electronic representation of money from said first teller module to said transaction module, via said first cryptographically secure session;
(r) committing said transaction module and said first teller module session;
(s) committing said first teller module and second teller module session; and (t) committing said second teller module and said money generator module session.

57. The withdrawal method of claim 56, further comprising a step for maintaining appropriate accounts at said issuing bank and correspondent bank during said withdrawal transaction.

58. The withdrawal method of claim 56, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

59. A method for a subscriber using a transaction module to perform a deposit to said subscriber's bank account at an issuing bank having a teller module, a money generator module, and an on-line accounting system, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, a deposit amount and said bank account in which to make said deposit;
(b) checking if said transaction module contains sufficient funds;
(c) said transaction module establishing a first cryptographically secure session with said teller module;
(d) said transaction module sending a deposit request to said teller module, via said first cryptographically secure session, where said deposit request includes said deposit amount and bank account information corresponding to said bank account;
(e) checking said bank account information to verify its validity;
(f) said transaction module transferring a first electronic representation of money to said teller module, via said first cryptographically secure session;
(g) crediting said bank account in said on-line accounting system by said deposit amount; and (h) committing said transaction module and said teller module session.

60. The deposit method of claim 59, further comprising a step for maintaining appropriate accounts at said issuing bank during said deposit transaction.

61. The deposit method of claim 59, wherein said first electronic representation of money comprises all electronic notes stored in said transaction module, where each said electronic note has an individual monetary value and an expiration date, and where said all electronic notes have a total monetary value equalling the sum of said individual monetary values; and further comprising the steps of:
when said total monetary value exceeds said deposit amount, establishing a second cryptographically secure session between said teller module and a money generator module;

said teller module sending a create money request to said money generator module, via said second cryptographically secure session, where said create money request includes a requested note value equalling the difference between said total monetary value and said deposit amount;
crediting a money issued account in said on-line accounting system by said requested note value;
said money generator generating a second electronic representation of money of said requested note value and including an updated expiration date;
transferring said second electronic representation of money to said teller module, via said second cryptographically secure session; and transferring said second electronic representation of money from said teller module to said transaction module, via said first cryptographically secure session.

62. The deposit method of claim 59, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

63. A method for a subscriber using a transaction module to deposit electronic representations of money at a correspondent bank, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, a deposit amount and a bank account in which to make a deposit;
(b) checking if said transaction module contains sufficient funds;
(c) establishing a first cryptographically secure session between said transaction module and a first teller module associated with said correspondent bank;
(d) said transaction module sending a first deposit request to said first teller module, via said first cryptographically secure session, where said deposit request includes said first deposit amount and bank account information corresponding to said bank account;
(e) checking said bank account information to verify its validity;
(f) said transaction module transferring said electronic representations of money to said first teller module, via said first cryptographically secure session;
(g) said first teller module sending a first deposit acknowledgement to said transaction module, via said first cryptographically secure session;

(h) committing said transaction module and said first teller module session;
(i) crediting said subscriber's bank account in a first on-line accounting system associated with said correspondent bank by said deposit amount;
(j) establishing a second cryptographically secure session between said first teller module and said second teller module;
(k) said first teller module sending a second deposit request to said second teller module, via said second cryptographically secure session, where said second deposit request includes said deposit amount;
(l) debiting a deposited at issuing bank account in said first on-line accounting system by said deposit amount;
(m) transferring said electronic representations of money from said first teller module to said second teller module, via said second cryptographically secure session;
(n) crediting a correspondent bank money account in a second on-line accounting system associated with said issuing bank by said deposit amount;
(o) said second teller module sending a second deposit acknowledgement to said first teller module, via said second cryptographically secure session; and (p) committing said first teller module and second teller module session.

64. The deposit method of claim 63, further comprising a step for maintaining appropriate accounts at said issuing bank and said correspondent bank during said deposit transaction.

65. The deposit method of claim 63, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state; and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

66. A method for a subscriber payment using a first transaction module to transfer an electronic representation of money to a second transaction module;
(a) establishing a cryptographically secure session between said first and second transaction modules;
(b) a first subscriber selecting, by way of said first transaction module, a transfer amount;
(c) checking if said first transaction module contains sufficient funds;

(d) said first transaction module sending a first message including said transfer amount to said second transaction module, via said cryptographically secure session;
(e) said second transaction module prompting a second subscriber for verification of said transfer amount;
(f) said second transaction module sending an acknowledgement message to said first transaction module, via said cryptographically secure session;
(g) said first transaction module transferring said electronic representation of money to said second transaction module, via said cryptographically secure session; and (h) committing said first and second transaction module session.

67. The subscriber payment method of claim 66, wherein said electronic representation of money is an electronic representation of currency having an expiration date and a monetary value; where step (g) further comprises the step of:
said first transaction module choosing for transfer a least number of electronic representations of currency and said electronic representations of currency closest to said expiration date.

68. The subscriber payment method of claim 66, wherein said electronic representation of money is an electronic representation of currency having a monetary value and a list of transfer records; where step (g) further comprises the step of:

said first transaction module appending a transfer record to said electronic representation of currency to be transferred, where said transfer record includes a transferred monetary value.

69. The subscriber payment method of claim 66, wherein step (h) further comprises the steps of:
said first transaction module committing by logging said transfer transaction so that said first transaction module can no longer abort said transfer transaction by rolling-back its state;
said second transaction module committing by logging said transfer transaction so that said second transaction module can no longer abort said transfer transaction by rolling-back its state.

70. The subscriber payment method of claim 66, wherein said electronic representation of money includes an indication of one of a plurality of different monetary units;
wherein step (b) further includes the step of said first subscriber selecting an indication of monetary unit; and wherein step (e) further includes the step of prompting said second subscriber for verification of said indication of monetary unit.

71. The subscriber payment method of claim 66, wherein said subscriber may be either a person or an electronic processing device used by said person to control said transaction module.

72. A payment method using a first money module to transfer an electronic representation of money to a second money module, comprising the steps of:

(a) establishing a cryptographically secure session between said first money module and said second money module where said first and second money modules are tamper-proof modules;
(b) said first money module prompting a first subscriber for transaction terms, and said first subscriber supplying said first transaction terms to said first money module;
(c) said first money module sending said transaction terms to said second money module, via said cryptographically secure session;
(d) said second money module prompting a second subscriber to verify said transaction terms, and said second subscriber supplying a verification of said transaction terms;
(e) said first money module transferring said electronic representation of money to said second money module, via said cryptographically secure session;
(f) said first money module committing to said electronic money transfer by logging said electronic money transfer so that said first transaction module can no longer abort said electronic money transfer by rolling-back its state; and (g) said second money module committing by logging said electronic money transfer so that said second money module can no longer abort said electronic money transfer by rolling-back its state.

73. The payment method of claim 72, wherein said subscriber may be either a person or an electronic processing device used by said person to control said money module.

74. The payment method of claim 72, wherein said transaction terms include a monetary value.

75. The payment method of claim 72, wherein said money modules may abort during said electronic money transfer by following an abort routine programmed in said money modules, where control is transferred to said abort routine from other routines including a time-out protocol.

76. A method for a subscriber to exchange an electronic representation of a first foreign currency stored in a first transaction module for an electronic representation of a second foreign currency stored in a second transaction module, comprising the steps of:
(a) establishing a cryptographically secure session between said first transaction module and said second transaction module;
(b) said subscriber selecting, by way of said first transaction module, a first amount of said first foreign currency to be sold and an exchange rate;
(c) checking if said first transaction module has sufficient funds;

(d) said first transaction module sending said first amount and said exchange rate to said second transaction module, via said cryptographically secure session;
(e) said second transaction module prompting its owner to verify said first amount and said exchange rate;
(f) checking if said second transaction module has sufficient funds;
(g) said second transaction module sending an acknowledgement message to said first transaction module, via said cryptographically secure session;
(h) said first transaction module sending said electronic representation of first foreign currency to said second transaction module, in said first amount, via said cryptographically secure session;
(i) said second transaction module sending said electronic representation of said second foreign currency to said first transaction module, in a second amount calculated from said first amount and said exchange rate, via said cryptographically secure session; and (j) committing said first and second transaction module session.

77. The foreign exchange method of claim 76, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

78. A method for a subscriber to exchange an electronic representation of first foreign currency stored in a transaction module for an electronic representation of second foreign currency from an issuing bank having a money generator capable of generating said electronic representation of second foreign currency, a teller module, and an on-line accounting system, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, a first amount of said first foreign currency to be sold;
(b) checking if said transaction module has sufficient funds;
(c) establishing a first cryptographically secure session between said transaction module and said teller module;
(d) said transaction module sending said first amount to said teller module, via said first cryptographically secure session;
(e) said transaction module sending said electronic representation of first foreign currency to said teller module, via said first cryptographically secure session;

(f) establishing a second cryptographically secure session between said teller module and said money generator module;
(g) said teller module sending a create money request to said money generator, via said second cryptographically secure session, where said create money request includes a second amount calculated from said first amount and an exchange rate maintained by said issuing bank;
(h) crediting a money issued account in said on-line accounting system by said second amount;
(i) said money generator generating said electronic representation of second foreign currency of said second amount;
(j) transferring said electronic representation of second foreign currency to said teller module, via said second cryptographically secure session;
(k) transferring said electronic representation of second foreign currency from said teller module to said transaction module, via said first cryptographically secure session;
(l) committing said transaction module and said teller module session; and (m) committing said teller module and said money generator module session.

79. The method of claim 78, further comprising a step for maintaining appropriate accounts at said issuing bank during said foreign exchange transaction.

80. The foreign exchange method of claim 78, further comprising the steps of:
after step (d), said teller module sending said exchange rate to said transaction module, via said first cryptographically secure session; and said transaction module prompting said subscriber to verify said exchange rate.

81. The foreign exchange method of claim 78, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

82. A method for a subscriber to exchange an electronic representation of first foreign currency stored in a transaction module for an electronic representation of second foreign currency from an issuing bank having a money generator module capable of generating said electronic representation of second foreign currency, a second teller module, a second on-line accounting system, received via a correspondent bank having a first teller module and a first on-line accounting system, comprising the steps of:
(a) said subscriber selecting, by way of said transaction module, a first amount of said first foreign currency to be sold;
(b) checking if said transaction module has sufficient funds;
(c) establishing a first cryptographically secure session between said transaction module and said first teller module;
(d) said transaction module sending said first amount to said first teller module, via said first cryptographically secure session;
(e) said transaction module sending said electronic representation of first foreign currency to said first teller module, via said first cryptographically secure session;
(f) establishing a second cryptographically secure session between said first teller module and said second teller module;
(g) said first teller module sending a withdrawal request to said second teller module, via said second cryptographically secure session, where said withdrawal request includes a second amount calculated from said first amount and an established exchange rate;
(h) crediting a deposited at issuing bank account in said first on-line accounting system by said second amount of second foreign currency;
(i) establishing a third cryptographically secure session between said second teller module and said money generator module;
(j) said second teller module sending a create money request to said money generator module, via said third cryptographically secure session, where said create money request includes said second amount;
(k) said money generator generating said electronic representation of second foreign currency of said second amount;
(l) transferring said electronic representation of second foreign currency to said teller module, via said third cryptographically secure session;
(m) crediting a money issued account in said second on-line accounting system by said second amount of second foreign currency;
(n) debiting a correspondent bank money account by said second amount of second foreign currency;

(o) transferring said electronic representation of second foreign currency from said second teller module to said first teller module, via said second cryptographically secure session;
(p) transferring said electronic representation of second foreign currency from said first teller module to said transaction module, via said first cryptographically secure session;
(q) committing said transaction module and said first teller module session;
(r) committing said first teller module and said second teller module session; and (s) committing said second teller module and said money generator module session.

83. The foreign exchange method of claim 82, further comprising a step for maintaining appropriate accounts at said issuing bank and said correspondent bank during said foreign exchange transaction.

84. The foreign exchange method of claim 82, wherein each said module may commit by logging a transaction so that it can no longer abort said transaction by rolling-back its state;
and wherein each said module may abort during said transaction by following a programmed abort routine, where control is transferred to said abort routine from other routines including a time-out protocol.

85. A method for updating an electronic representation of currency having an expiration date and stored in a transaction module with an updated electronic representation of currency, comprising the steps of:
(a) establishing a first cryptographically secure session between said transaction module and a teller module associated with an issuing bank;
(b) said transaction module sending an update request to said teller module, via said first cryptographically secure session;
(c) said teller module sending an acknowledgement message to said transaction module, via said first cryptographically secure session;
(d) said transaction module transferring said electronic representation of currency to said teller module, via said first cryptographically secure session;
(e) establishing a second cryptographically secure session between said teller module and a money generator module;
(f) said teller module sending a create money request to said money generator module, via said second cryptographically secure session, where said create money request includes said first amount;

(g) crediting a money issued account by said first amount in an on-line accounting system associated with said issuing bank;
(h) said money generator module generating said updated electronic representation of currency having a new expiration date;
(i) transferring said updated electronic representation of currency from said money generator module to said teller module, via said second cryptographically secure session;
(j) transferring said updated electronic representation of currency from said teller module to said transaction module, via said first cryptographically secure session;
(k) committing said transaction module and said teller module session; and (l) committing said teller module and said money generator module session.

86. The method of claim 85, further comprising a step for maintaining appropriate accounts at said issuing bank during said updating procedure.

87. A system for transferring electronic notes between processor-based electronic modules comprising:
processor-based electronic modules each capable of creating a cryptographically secure channel and transferring and receiving electronic notes via said cryptographically secure channel, and where each said electronic module has a memory for storing said electronic notes;
wherein each stored electronic note comprises:
a body group of data fields including data indicative of a monetary value of said electronic note;
a transfer group of data fields including a list of transfer records, where each transfer record is generated by a transferor electronic module and appended to said electronic note upon transfer; and a signature and certificate group of data fields including a list of transferors containing each transferor electronic module's digital signature and certificate.

88. The system of claim 87, wherein said body group of data fields further includes a monetary unit identifier, an issuing bank identifier, a note identifier, a date-of-issue, a date-of-expiration, and an identifier of a processor-based electronic money generator module.

89. The system of claim 88, wherein said body group of data fields further includes an indication of type of electronic note and a subscriber's account number when said type of note corresponds to an electronic credit authorization.

90. The electronic monetary system of claim 1, wherein said money generator module and said teller module are embodied in a device having a single processor.

91. The electronic monetary system of claim 13, wherein said money generator module and said teller module are embodied in a device having a single processor.

92. The electronic monetary system of claim 20, wherein said money generator module and said teller module are embodied in a device having a single processor.

93. The electronic monetary system of claim 26, wherein said money generator module and said teller module are embodied in a device having a single processor.

94. The electronic monetary system of claim 33, where said money generator module and said first teller module are embodied in an electronic processing device controlled by said first processor.

95. The electronic monetary system of claim 37, wherein at least one of said money generator modules and one of said teller modules are embodied in a device having a single processor.

96. The electronic monetary system of claim 41, wherein at least one of said money generator modules and one of said teller modules are embodied in a device having a single processor.

97. The electronic monetary system of claim 45, wherein said money generator module and said teller module are embodied in a device having a single processor.

98. The electronic monetary system of claim 47, wherein said money generator module and said teller module are embodied in a device having a single processor.

99. An electronic monetary system comprising:
an issuing bank having a first on-line accounting system;
electronic representations of money that are credited in said first on-line accounting system as current liabilities of said issuing bank;
a money generator module that generates said electronic representations of money;
a first teller module, associated with said issuing bank, that stores said electronic representations of money;
a plurality of correspondent banks, each having a second on-line accounting system and each maintaining an account at said issuing bank;
a plurality of second teller modules, each associated with one of said correspondent banks, that each store said electronic representations of money;
a transaction module that stores said electronic representations of money, performs on-line transactions with said plurality of correspondent banks, and exchanges said electronic representations of money with other transaction modules in off-line transactions;
where said first teller module has a first processor that intermediates transactions among said first on-line accounting system, said money generator module, and said second teller module; and where said second teller module has a second processor that intermediates transactions among said second on-line accounting system, said first teller module, and said transaction module.

100. A time-based transaction module transfer system, comprising:
a plurality of tamper-proof electronic transaction modules each having a memory that stores electronic notes that include an expiration date, a clock that maintains a system time, a processor adapted to provide a cryptographically secure channel for transferring and receiving said electronic notes, where said processor is further adapted not to permit a transfer of said electronic notes between said transaction modules if said transfer would occur after said expiration date of said electronic notes.

101. The system of claim 100, wherein said electronic notes are electronic representations of currency that are credited as current liabilities in an on-line accounting system of an issuing bank.

102. The system of claim 101, wherein said electronic representations of currency stored in said transaction module are updated when transacting with an electronic monetary system including said issuing bank.

103. The system of claim 100, wherein said electronic notes are electronic credit authorizations that are drawn on a subscriber's loan account in an on-line accounting system so as to reduce said subscriber's available credit line.

104. A transaction module transfer system, comprising:
a plurality of tamper-proof electronic transaction modules each having a memory that stores electronic notes that include a transfer record having a transferred monetary value, a processor adapted to provide a cryptographically secure channel for transferring and receiving said electronic notes, where said processor is further adapted to generate said transfer record and append said transfer record to said electronic notes upon transfer.

105. The system of claim 104, wherein said electronic notes are electronic representations of currency that are credited as current liabilities in an on-line accounting system of an issuing bank.

106. The system of claim 104, wherein said electronic notes are electronic credit authorizations that are drawn on a subscriber's loan account in an on-line accounting system so as to reduce said subscriber's available credit line.

107. A transaction module based monetary transaction system, comprising:
a security server that implements the security of said monetary transaction system;
a plurality of tamper-proof electronic transaction modules each having a unique module identifier contained within a time-limited certificate that is digitally signed by said security server, a clock that maintains a system time, a memory that stores electronic representations of money, a processor adapted to provide a cryptographically secure channel for transferring and receiving said electronic representations of money; and wherein said processor is further adapted not to allow a transaction module having an expired certificate to transact with other transaction modules until a new certificate is obtained.