Method, communications system and receiver device for the billing of access controlled programmes and /or data from broadcast transmitters

A method, a communications system and a receiving device are for billing of access-controlled programs and/or data which are broadcast by a broadcast transmitter unidirectionally and encrypted, and are received by at least one receiving device. A monetary value is stored in a data memory of the receiving device. The costs for access to the access-controlled programs and/or data are determined in the receiving device based on received cost data, and decryption of the access-controlled programs and/or data in the receiving device is prevented if the determined costs are greater than the stored monetary value. Billing records are generated in the receiving device for the allocation of credit items to the vendors of the access-controlled programs and/or data, and are transmitted to a billing center via various data channels.

This invention relates to a method, a communications system and a receiving device for the billing of access-controlled programs and/or data, which are encrypted and broadcast unidirectionally by a broadcast transmitter. In particular, this invention relates to a method, a communications system and a receiving device for the billing of access-controlled programs and/or data according to the respective preambles of the independent claims 1, 7 and 13.

Worldwide at the present time broadcast systems with broadcast transmitters and broadcast receivers are being built in which digital audio, or respectively video, programs (television programs), and digital data, for example data for the execution of data services or program-accompanying data relating to the respective programs (Program Associated Data, PAD) are broadcast unidirectionally by the broadcast transmitters, for instance by means of radio waves emitted by terrestrial or satellite-based transmitters, or via broadcast cable networks, and are received by corresponding broadcast receivers. Such broadcast systems are known, for example, by the designation Digital Audio Broadcasting (DAB), or respectively Digital Video Broadcasting (DVB). In particular, access-controlled programs and/or data can also be broadcast by means of these broadcast systems. Access-controlled programs and/or data are broadcast encrypted (scrambled), and can be received and decrypted (descrambled) by means of broadcast receivers by authorized users only. The unidirectional broadcasting feature of these broadcast systems has the drawback, however, that a backward channel is lacking from the broadcast receivers to the broadcast transmitters, or respectively to their operators, in particular with transmission by means of radio waves. Owing to this lacking backward channel, the possibilities for billing of access-controlled programs and/or data is limited. Access-controlled programs and/or data in these broadcast systems are generally billed in that subscriptions for various programs and/or data services are made out to interested users by the vendors, for example the operators of the broadcast transmitters, in exchange for subscription fees, for instance subscriptions to specific themes or programs, which can be purchased for a subscription period. Corresponding to the subscription, paid in advance or subsequently paid, authorization data for the subscribed-to services are loaded for the respective user in the broadcast receiver, for example through direct addressing via the broadcast channel or by means of a data carrier. This type of billing by subscription is particularly disadvantageous for the users when they would like to purchase access-controlled programs and/or data from several vendors, or respectively from several broadcast transmitters, since they have to take out subscriptions with several vendors. Billing by subscription is also disadvantageous for the users because they are not able to purchase spontaneously access-controlled programs and/or data for which they have not taken out any subscription. A further drawback of billing by subscription is that the vendors, or respectively the operators of the broadcast transmitters, receive no direct information about which subscribed-to services are actually availed of by the user. From the viewpoint of the users, billing by subscription moreover does not seem to be a fair billing method since they have to pay for subscriptions regardless of whether they have used the subscribed-to services or not. In particular for operators of smaller broadcast transmitters, or respectively smaller vendors of access-controlled programs and/or data, the expense for administration of such subscriptions and for billing such services is too costly.

In the Patent application EP 314203 A2, a system is described which concern the encryption of television signals based on a pay-TV subscription. According to this document, the end device (set to box) comprises an authorization processor, which comprises a credit register, for which the received credit signal value is stored. According to EP 314203 A2, a debt register is updated according to the cost of the received programs over the network for a corresponding subscription. According to EP 314203 A2, the comparison unit compares the updated cost and the credit, in order to determine if the current subscription allow the decryption of the encrypted television signals. According to D1, the amount of the current cost is sent to the provider through the television network.

It is an object of the present invention to propose a new and better method, a new and better communications system as well as a new and better receiving device which are suitable for the billing of access-controlled programs and/or services, broadcast encrypted and unidirectionally by a broadcast transmitter, and which in particular do not have the above-mentioned drawbacks.

According to the present invention, these objects are achieved in particular through the elements of the independent claims. Further preferred embodiments follow moreover from the dependent claims and from the description.

In particular, these objects are achieved by means of the invention in that for the billing of access-controlled programs and/or data, which are broadcast encrypted and unidirectionally by a broadcast transmitter, a monetary value is stored in a data memory of the receiving device, costs for access to the access-controlled programs and/or data are determined in the mobile receiving device based on received cost data for the access-controlled programs and/or data, the decryption of the access-controlled programs and/or data in the mobile receiving device is prevented if the determined costs are greater than the stored monetary value, and the costs for access to the unencrypted access-controlled programs and/or data are deducted from the stored monetary value, and billing records are generated in the mobile receiving device and stored in a data memory of the receiving device, which billing records comprise the cost amounts and/or cost parameters for calculation of the cost amounts for the access to the unencrypted access-controlled programs and/or data as well as an identification of the vendor of these access-controlled programs and/or data, the generated billing records are transmitted to the billing center (3) via a mobile radio network (4), and the billing center (3) credits credit items to the respective vendors in accordance with the received billing records. Depending upon the embodiment variant, the monetary amount can be a prepaid monetary amount, or it can represent a credit limit, which may not be exceeded. The programs comprise, for example, digital audio and/or video programs. The billing record parameters are for example Start and End time, or time length as well as the cost of time per unit of the received program and/or data. The telecommunication network is for example a GSM (Global System for Mobile Telecommunication) or UMTS network (Universal Mobile telephone System) or other such as satellite based mobile network.

The advantage of this stored monetary value and the continuous deduction from this monetary value of the costs for access to the access-controlled programs and/or data is that a user can purchase spontaneously access-controlled programs and/or data without having to have taken out a subscription beforehand, the purchase of access-controlled programs and/or data continuing to be limited, however, by the prepaid monetary amount, or respectively by the credit limit represented by the monetary value.

The advantage of the generation and storing of billing records is that subsequent bookkeeping and billing of the costs for access to the access-controlled programs and or data is thereby made possible.

The advantage of the transmission of the billing records to a billing center and the assignment by this billing center of credit items to the vendors in accordance with data in the billing records is that spontaneous purchase of access-controlled programs and/or data from a plurality of vendors, or respectively different broadcast transmitters, is thereby made possible, without subscriptions therefore having to be taken out by the users with all these vendors. Based on the transmitted billing records, information about the programs and/or data actually taken by the users can moreover be made available to the vendors. Furthermore the billing via a billing center means a considerable relief for the vendors, or respectively for the operators of the broadcast transmitters, since they do not have to preoccupy themselves with either the administration of subscriptions or with itemized billing of the costs.

The advantage of the transmission of the billing records to a billing center through a mobile communication network is that, the transmission of the billing records to the billing center, and the subsequent crediting of amounts to the various vendors based on these billing records, can be carried out without data carriers, in particular chip cards, having to be removed by the users from the receiving devices and inserted in a data terminal. The transmission of the billing records to the billing center can be carried out automatically in this embodiment variant without initiative or assistance from the users.

Electronically signed billing records are preferably generated in the receiving device.

In one embodiment variant, the monetary value and/or the billing records are stored in a data memory, which is integrated in a chip card that is removable from the receiving device. The advantage of storing the monetary value and/or the billing records in a data memory removable from the receiving device is that, on the one hand, these data can be made accessible to external data processing means outside the receiving device, without the aid of additional communications means in the receiving device, and, on the other hand, that several users can use the same receiving device in a user-specific way in that they insert their own data memory into the receiving device, or in that a user can insert different data carriers for various purposes into the receiving device, e.g. for private or business use or for different themes.

In one embodiment variant, the chip card is removed from the receiving device and is inserted into an external data terminal outside the receiving device, the generated billing records being read by the data terminal and transmitted to the billing center, and the monetary value being reloaded or loaded with a reload amount by the data terminal. The reload amount corresponds, for example, to a prepaid monetary amount determined by the user, which is debited to the user on a bank account, for instance, or a credit card account (credit card number), or which is paid by the user in cash at the data terminal. The advantage of this embodiment variant is that it can be achieved on the basis of numerous, already existing, linked data terminals, e.g. automatic banking machines or ticket machines.

In an other embodiment is the billing amount is updated or loaded through the mobile telecommunication network.

In an embodiment variant, the generated billing records are transmitted by the receiving device via an interface, for example a contact less device interface, e.g. an infrared interface or a radio interface, to an external data terminal outside the receiving device, the generated billing records being transmitted by the data terminal via a communications network to the billing center, a reload amount being received by the receiving device from the data terminal via the interface, and the monetary value being reloaded or loaded with the received reload amount.

One embodiment of the present invention will be described in the following with reference to an example. The example of the embodiment is illustrated by the single attachedFIG. 1, which, shows a schematic block diagram of a communications system in which a broadcast transmitter, a receiving device as well as data terminals linked to a billing center are illustrated.

InFIG. 1, the reference numerals2and2′ refer in each case to a broadcast transmitter which broadcasts programs and/or data unidirectionally, for example by means of radio waves from a terrestrial or satellite-based broadcast transmission antenna21via an air interface24, or via broadcast cable networks22. Designated by the reference numerals2and2′ are also the vendors of these programs and/or data, e.g. digital audio, or respectively video, programs (television programs), and digital data, for example data for the execution of data services or program-accompanying data relating to the respective programs (Program Associated Data, PAD). For better clarity it should be mentioned here, however, that several different vendors can also broadcast their programs and/or data over a common broadcast transmitter2,2′.

The reference numeral1refers to a receiving device with a broadcast receiver11, by means of which the programs and/or data broadcast by the broadcast transmitters2,2′ can be received over broadcast channels, for example over a broadcast cable network22or by means of a receiving antenna as radio waves via an air interface24.

Broadcast systems with such broadcast transmitters and broadcast receivers are known, for example, by the designation Digital Audio Broadcasting (DAB), or respectively Digital Video Broadcasting (DVB).

The standard ETS 300 401, “Radio broadcasting systems; Digital Audio Broadcasting (DAB) to mobile, portable and fixed receivers” was defined by the European Telecommunications Standards Institute (ETSI), F-06921 Sophia Antipolis Cedex, France, for the Digital Audio Broadcasting (DAB) system, which was developed for the transmission of high quality digital audio programs and/or data services for reception by means of mobile, portable and fixed, installed terminals from terrestrial or satellite-based transmitters2,2′, or from broadcast cable networks22. The content of this document ETS 300 401 relating thereto, which was published by the ETSI in the second edition in May 1997, as well as the content of the standard document ETS 300 174 “Network Aspects (NA); Digital coding of component television signals for contribution quality applications in the range 34-45 Mbits/s,” which was published in November 1992 by the ETSI, are hereby incorporated in this text by reference.

Also defined in the above-mentioned ETSI standards is a Fast Information Channel (FIC) by means of which a quicker access to information is made possible for the broadcast receivers11. Multiplex Configuration Information (MCI), for example, and also service information and data for data services are transmitted over the FIC channel.

In order to limit the access to individual services or a plurality of services or service components to authorized users (in connection with DAB these services and service components are audio programs and/or data (services) in connection with DVB video, or respectively television programs, and/or data (services)), mechanisms are defined in the above-mentioned ETSI standards for access-controlled programs and/or data (services), the so-called conditional access. Described in particular in the above-mentioned ETSI standards are scrambling/descrambling procedures (encryption/decryption), parameters for the signaling and synchronization of the conditional access as well as mechanisms for the control and distribution of authorizations (authorization data for users) through the transmission of so-called ECM messages (Entitlement Checking Messages) and EMM messages (Entitlement Management Messages) over broadcast channels (broadcast cable network22or air interface24).

According to the above-mentioned ETSI standards, a conditional access flag and/or conditional access identifier is used for each of the service components transmitted over the broadcast channels22,24in order to indicate to the broadcast receiver11whether the respective service component uses conditional access mechanisms or not, and, if applicable, which type of mechanisms are used. For service components, which are in a controlled access mode and which are designated in this text as access-controlled programs and/or data, the data of the respective service component (which component can relate to the programs and/or data) are encrypted with a control word, this control word being changed regularly, and for its part being transmitted to the broadcast receivers11encrypted through a session key (key) in the ECM messages.

Identified by the conditional access identifier, according to the above-mentioned ETSI standards, is the access control module12, the so-called access control system, used for all service components of a service, which access control system can interpret and process the ECM and EMM messages transmitted by the broadcast transmitter2,2′.

The session key (key) used for encryption of the control words is stored as secret information in the access control system, according to the above-mentioned ETSI standards. Session keys (keys) can be transmitted to the broadcast receivers11in EMM messages, whereby, for the transmission, they are encrypted themselves by a distribution key.

According to the above-mentioned ETSI standards, authorizations (authorization data) are transmitted to the broadcast receivers11in the EMM messages, different kinds of authorizations being defined which correspond to different types of subscriptions: subscriptions for a theme, a level or a class, reservation in advance with payment per program, or spontaneous payment per program, per service or per time unit. According to the above-mentioned ETSI standards, the EMM messages can be transmitted to a specific customer (user) identified through an unambiguous address, to a small group of customers (users) identified by a group address, to a large group of customers (users) identified by a collective address, or to all customers. Since the content of the EMM messages, in particular the authorizations, does not have to be transmitted to the broadcast receivers11in real time, this content can be transmitted to the broadcast receivers11in another way, for example stored on a data carrier, in particular a chip card19, instead of by means of EMM messages.

According to the above-mentioned ETSI standards, the customer addresses are stored in the access control system (access control module12), and are transmitted by the access control system to the EMM receiving module (not shown), responsible for receiving EMM messages, of the broadcast receiver11, so that this EMM receiving module passes on only those EMM messages to the access control system which contain a customer address that coincides with one of the customer addresses received from the access control system.

So as not to overburden the access control system unnecessarily with messages, the broadcast receiver11comprises hardware or software filters, which pass on to the access control system only those messages which can and have to be interpreted and processed by the access control system; for example, messages, as mentioned above, are filtered on the basis of customer address and repeatedly transmitted messages are filtered.

According to the above-mentioned ETSI standards, in addition to secret codes for the decryption (descrambling), the conditions (access conditions data) are transmitted to the broadcast receivers11in the ECM messages, which conditions are to be fulfilled in order to obtain access to conditional access services. The ECM messages contain all information specifying the conditions for access to a service, e.g. an audio program or a data service. Customers with differing authorizations can therefore access a service. According to the above-mentioned ETSI standards, depending upon available service access, the following parameters can be contained in the ECM messages:

Program provider identifier, identifies the vendor who has generated the ECM message.

Broadcast date and program theme/level, if the program, that means the service, is available in the subscription for a theme/level.

Broadcast date and program class, if the program, that means the service, is available in the subscription per link.

Program number, if the program, that means the service, is available with pre-reservation and payment per program.

Program number and program costs, if the program, that means the service, is available for spontaneous payment per program.

Program number and costs per time unit of the program, if the program, that means the service, is available for spontaneous payment per time unit per program.

If the authorizations meet the conditions, which are to be fulfilled to obtain access to conditional access services, the session key (key) of the access control system can be used to decrypt the control word. Then the data of the respective service components can be decrypted with the control word.

According to the present invention, a monetary value is stored in a data memory16, which cannot be written in by the user, of the receiving device1, which monetary value corresponds to a prepaid monetary amount or a credit limit. The data memory16is installed in the receiving device1in a fixed way, or it is located on a data carrier of the receiving device1, for example a chip card19, which data carrier can be removed from the receiving device1by the user. The monetary value is loaded into the data memory16, for example via the broadcast channels22,24or over a communications network4, for instance a mobile radio network, e.g. a GSM or UMTS network or another—e.g. satellite-based—mobile radio network, or a fixed network, for instance an ISDN network, the public switched telephone network, or an IP network (in particular the Internet). If the memory16is located on a chip card19, the monetary amount can be loaded by means of a card reading/writing device51into which the chip card19is inserted.

As mentioned above, cost data can also be transmitted by the broadcast transmitter2,2′ to the broadcast receivers11in the ECM messages, namely program costs for access-controlled programs and/or data, which are available for spontaneous payment per service, and/or costs per time unit for access-controlled programs and/or data which are available for spontaneous payment per time unit and per service. The costs recording module18calculates the costs based on these cost data, which are to be paid for the access to the respective access-controlled programs and/or data. The costs recording module18is, for example, a programmed software module that is implemented on a processor or in hardware.

As illustrated diagrammatically inFIG. 1, the access control module12(access control system) is provided with a supplementary credit control module121. The credit control module121prevents the decryption of access-controlled programs and/or data if the costs to be paid, calculated by the costs recording module18, are greater than the monetary value stored in the data memory16. The comparison operation with respect to the calculated costs and the stored monetary value can thereby be carried out by the credit control module121, or, to lessen the burden upon the access control module12, it can be carried out outside the credit control module121, for example in hardware, so that the credit control module121can be reduced to the function of checking the results of the comparison operation, for example. Functions and operations of the access control module12can be carried out, for example, in parallel (simultaneously) with the functions and operations of the costs recording module18. For example, the costs recording module18can determine the costs for the access to the respective access-controlled programs and/or data on the basis of the cost data received in the ECM messages, and store the result of the comparison operation (for instance, “1” for sufficient credit, “0” for insufficient credit) in a memory location accessible to the access control module12, while the access control module12determines the authorization of the user for access to the respective access-controlled programs and/or data on the basis of the access conditions data received in the ECM messages and the authorization data14stored in the receiving device1, and afterwards, with existing authorization, checks the result of the comparison operation determined by the costs recording module18. If it was determined through the comparison operation that the credit of the user is sufficient, the key13(session key) stored in the receiving device1is released by the access control module12for the decryption of the control word received in the ECM messages, and the decryption of the encrypted access-controlled programs and/or data by the decryption module15is thereby made possible. If it was determined through the comparison operation that the credit of the user is not sufficient, the key13(session key) stored in the receiving device1is not released by the access control module12for the decryption of the control word received in the ECM messages, and the decryption of the encrypted access-controlled programs and/or data by the decryption module15is thereby prevented.

To support various access control modules12with or without supplementary credit control module121, various conditional access identifiers can be defined and used, for example.

In a variant, the credit control can be carried out in such a way that credit condition values, specifying a minimum monetary value for access to access-controlled programs and/or data, are transmitted as access conditions data to the receiving device1in the ECM messages, an authorization amount value, corresponding to a prepaid monetary amount or a credit limit, is stored in the receiving device1as part of the authorization data, and the credit control module121compares received credit condition values with stored authorization amount values before the access to the key (session key) is released for decryption of the access-controlled programs and/or data.

As a further function of the costs recording module18, the costs for successful access to the unencrypted access-controlled programs and/or data are deducted from the monetary amount stored in the memory16. In addition, billing records are generated by the costs recording module18, are signed electronically for authentication purposes, and are stored in a stack17in the receiving device1. The electronic signature verifies, for example, the costs recording module18and/or the receiving device1and/or the respective user of the receiving device1as authentic producer/source of the billing records. The electronic signature is based, for example, on a certificate issued by a certifying unit, for instance a Trusted Third Party (TTP). The billing records contain the cost amounts and/or the cost parameters for calculation of the cost amounts for access to the unencrypted access-controlled programs and/or data. The cost parameters are, e.g., starting and ending time or duration as well as the costs per time unit of the programs and/or data purchased. The billing records can also contain information about respective access-controlled programs and/or data, e.g. program number, indications about the program theme, the program level and/or the program class and/or a currency indication. In connection with the currency indication, it should also be mentioned moreover that not only can various currencies be supported for the monetary values, but points according to a defined point system can also be used and supported for the monetary values, e.g. a loyalty point system, these points being treated like a currency. The billing records contain in addition an indication of the vendor and/or of the broadcast transmitter of the respective access-controlled programs and/or data. The billing records also contain, in a variant, an identification of the user of the receiving device1, which user identification corresponds, for instance, to the above-mentioned unambiguous customer address or which user identification corresponds to another user identification for another system, for instance an International Mobile Subscriber Identity (IMSI), which serves for identification in a mobile radio network, and which user identification is stored, for example, in a chip card, e.g. an SIM card (Subscriber Identification Module).

As will be described later, the generated billing records can be transmitted over various data channels, for example directly over a communications network4, via an interface104-61, to a data terminal6, and from the data terminal6over a communications network31, or by means of a chip card19′, inserted into a data terminal5, via this data terminal5and a communications network32to a billing center3.

Disposed in an overlapping area100, indicated by a rectangle drawn in broken lines inFIG. 1, are various data elements, or respectively the memory and memory locations intended therefore, namely the session key13(key), the authorization data14, the monetary value in the memory16and the stack17with the billing records. Indicated by this diagrammatic overlapping area100should be that, in different embodiment variants of the access control module12and/or of the costs recording module18, the data elements disposed therein, or respectively the memory and memory locations provided therefore, are implemented fixed in the receiving device1and/or on the chip card19, which can be removed from the receiving device1. The advantage of storing these data elements13,14,16,17on the chip card19of the receiving device1are in particular that, through removal of the chip card19from the receiving device1, the receiving device1can be blocked with respect to access by unauthorized users to access-controlled programs and/or data. Moreover a user can remove the chip card19from a first receiving device1, which is implemented, for example, as a mobile (and possibly portable) receiving device1, and insert it in a second receiving device1, which is implemented, for instance, as a fixed, installed receiving device1. It should also be mentioned here that the costs recording module18and/or the access control module12can also be implemented on the chip card19, whereby one skilled in the art understands that the real-time requirements relating thereto for the access control module12have to be taken into consideration. The distribution of executable functions and to-be-stored data elements among fixed, installed memories and processors in the receiving device1, or respectively memories and processors of the chip card19, removable from the receiving device1, can be carried out, for example, taking into consideration the specifications of the Mobile Application Execution Environment (MexE, GSM 02.57 and GSM 03.57). By means of suitable synchronization mechanisms, data elements can be stored on the chip card19, and copied into fixed, installed memory locations in the receiving device1, where they are available for real-time operations, upon insertion each time of the chip card19into the receiving device1. Changed values of the data elements stored in the fixed, installed memory locations can be updated on the chip card19, for example, through a parallel process. One skilled in the art will understand that in particular confidential data exchanged between processes that are distributed among a plurality of processors are transmitted in a protected way in each case for security reasons.

The unencrypted programs, or respectively data, can be reproduced for the user of the receiving device1, for instance via a processing module105, and from there via electro-acoustical converters106, or respectively display units107. Before reproduction for the user, entailing costs, a corresponding confirmation can be optionally requested from the user by the receiving device1(for instance an option that can be configured by the user), for example through a corresponding software module, via a display unit107, for instance giving the costs for the access to the respective access-controlled programs and/or data, and the confirmation can be given by the user via the input elements108.

As shown diagrammatically inFIG. 1, the receiving device1further comprises, in an embodiment variant, a communications module101, or can be connected to a communications module via a device interface. By means of the communications module101, data can be exchanged over the communications network4with external communications units outside the receiving device1. The communications network4is, for example, a mobile radio network, e.g. a GSM or UMTS network, or another—e.g. satellite-based—mobile radio network, or a fixed network, for instance an ISDN network, the public switched telephone network, a TV or radio cable network, or an IP network (Internet Protocol). In particular in receiving devices1designed as mobile devices, the communications module101comprises a mobile radio module for communication via the mobile radio network4. By means of the communications module101, the above-mentioned billing records in particular can be transmitted to the billing center3, e.g. periodically or in each case upon reaching a predefined value for the monetary amount in the memory16. Furthermore a reload amount can be accepted over the communications network4by means of the communications module101, for example directly from the billing center3, for instance together with the confirmation of receipt of the billing records in each case, or from a financial institution, it being possible, for instance, to also check the solvency of the respective user beforehand.

The monetary value stored in the memory16is reloaded or loaded with the received reload amount by the reload module102of the receiving device1. The reload module102is, for example, a programmed software module, which is implemented on a fixed, installed processor of the receiving device1or on a processor of the chip card19of the receiving device1, or is a module achieved in hardware.

It should be mentioned here that, in a variant in which the receiving device1with the communications module101has a backward channel, the billing records can be transmitted in a way similar to CDR records (Call Data Records) as so-called DUR records (DAB/DVB Usage Records) to a billing or clearing system, for example in the billing center3, and that the above-described credit controls, by means of the stored monetary value and the deduction of costs to be paid from this monetary value, are not absolutely necessary. In other words, if the receiving device1is provided with the communications module101, the billing of costs can take place, in a variant, through transmission of the billing records by means of the communications module101to a billing or clearing system, without monetary values having to be stored, checked or debited in the receiving device1.

In a further embodiment variant, the receiving device1comprises an interface104, in particular a device interface, for instance a contact less interface, e.g. an infrared interface, for example a High Speed Infrared (HSIR) interface or an IrDA (Infrared Data Association) interface, an inductive interface, for example a Radio Frequency Identification (RFID) interface, a Home RF (Radio Frequency) interface, a Digital European Cordless Telecommunications (DECT) interface or another Cordless Telecommunications System (CTS) interface, or a high frequency radio interface, for example a so-called “Bluetooth Interface.” Via this interface104, the receiving device1can exchange data with external data terminals6outside the receiving device1, which have a corresponding interface61. In particular, the above-mentioned billing records can be transmitted by the billing module103via the interface104-61to the data terminal6, and sent by the data terminal6via a communications network31to the billing center3. Moreover a reload amount can be received via the interface104-61, for example together with the confirmation of receipt of the billing records in each case, e.g. directly from the billing center3or from an account administration unit7of a financial institution, it being possible, for instance, to also check the solvency of the respective user beforehand. As mentioned above, the monetary amount stored in the memory16can be reloaded or loaded with the received reload amount by the reload module102. The billing module103is, for example, a programmed software module, which is implemented on a processor of the receiving device1or of the chip card19, or is a module achieved in hardware.

If the billing records are stored on the chip card19, they can be read by an external data terminal5outside the receiving device1by inserting the chip card19into the card reading/writing device51of the data terminal5, as indicated in the FIGURE by the chip card19′. The billing records can then be sent by the data terminal to the billing center3via a communications network32. If the memory16for storing the monetary amount is integrated on the chip card19, the monetary value can moreover be reloaded or loaded with a reload amount by the reload module52of the data terminal5, for example directly from the billing center3or from the account administration unit7of a financial institution, for instance together with the confirmation of receipt of the billing records in each case, it being possible, for instance, to also check the solvency of the respective user beforehand. After confirmation of receipt of the billing records, the billing records stored in the receiving device1and/or on the chip card19can be marked as billed. The reload module52can be implemented as a software or hardware module.

The data terminal6, or respectively the data terminal5, is preferably a data terminal accessible to the public, e.g. an automatic banking machine, a ticket machine or a point of sale device.

The billing records are received in the billing center3via the communications networks4,31and32, and the authenticity of the sender, respectively of the producer or the source of the billing records, e.g. the authenticity of the costs recording module18that has generated the billing records, is checked on the basis of the electronic signature on the billing records. For authentic billing records, credit items, based on the cost indications contained therein, are credited to the respective vendors identified by the vendor identifications contained in the billing records. Information concerning the received billing records and/or statistical information relating to the access to access-controlled programs and/or data can be transmitted to the vendors by the billing center3over the communications network23. If the above-mentioned reload amounts are issued in each case directly by the billing center3and/or if reload amounts, issued by financial institutions, are communicated in each case to the billing center3and are debited, the total sum of all the issued reload amounts and monetary values, or of those issued in a specific time period, e.g. one month, can be determined in the billing center3. If it is noted in the billing center3that the monetary values and reload amounts issued, or respectively administrated, by the billing center have not been billed within a predefined time period, e.g. one or more years, through billing records received over the communications networks4,31and32, these monetary values and reload amounts can be allocated to the vendors by the billing center3based on statistical information relating to the access to access-controlled programs and/or data.

The billing center3comprises, for example, one or more communications servers as well as a database for storing the issued monetary values and reload amounts, for storing the received billing records, and for storing information relating to the vendors, or respectively operators of broadcast transmitters2,2′.

The present invention is suitable for achieving prepaid or post-paid variants of the billing for access-controlled programs and/or data, broadcast by broadcast transmitters2,2′. Monetary values, or respectively reload amounts, which are not paid in advance, serve merely as credit limits, so that the actual costs for the access to unencrypted access-controlled programs and/or data can be debited or invoiced to the respective user, identified by a user identification contained in the billing records, only after the transmission of the billing records to the billing center3or to another billing system. Prepaid monetary values, or respectively reload amounts, can be issued, for example, in the form of anonymous prepaid cards, which can be inserted into one of possibly several card insertion locations of the receiving device1, in exchange for direct payment (cash, credit card) or corresponding debiting of an account. Prepaid or invoiced monetary values or reload amounts can be loaded, as described above, in the receiving device1for an identified user and debited from an account or invoiced, for example after completed solvency check.