Method for enhancing franking machines security

0001The invention relates to a method for improving the safety of franking machines, in the specified in the preamble of claim 1 Art.

0002A franking machine usually generates a print in a form agreed with the post office right-justified, parallel to the top edge of the mail starting with the content postage in the postmark, date in the day stamp and stamp imprints for advertising clichés and possibly transmission type in the Wahldruckstempel. The postal value, the date and the type of shipment form the variable information to be entered in accordance with the item of mail.

0003The postage value is usually the forwarding charge prepaid by the sender (Franko), which is taken from a refillable credit register and used to clear the postal consignment. In contrast, in the current account procedure, a register is only counted up and read at regular intervals by a postal inspector, depending on the frankings made with the postage value. Basically, any franking made must be accounted for and any manipulation that leads to an unbilled franking must be prevented.

0004A known franking machine is equipped with at least one input means, an output means, an input / output control module, a program, data and in particular the billing register bearing memory device, a control device and a printer module. In the case of a printer module with a pressure mechanism, measures must also be taken to ensure that the print mechanics can not be misused for uncalculated impressions when switched off.

0005The invention relates to a method for franking machines, which provide a fully electronic impression produced for franking mail including the imprint of an advertising cliché. This has the consequence that only when switched on a non-billed valid franking must be prevented.

0006In a postage meter known from US Pat. No. 4,746,234, fixed and variable information is stored in memory means (ROM, RAM) for reading out by means of a microprocessor when a letter on the transport path before the printing position activates a microswitch and for applying a pressure control signal form. Both are electronically combined to form a printed image and are printed by thermal transfer printing on an envelope to be franked.

0007A method has already been proposed for controlling column-by-column printing of a postage indicia image in a postage meter EP 578 042 A2, which separately combines fixed and variable data converted into graphic pixel image data during column-wise printing. It would therefore be difficult to manipulate the print control signal without great and expensive expense when printing at a high speed.

0008On the other hand, the memory device comprises at least one non-volatile memory module which contains the remaining balance remaining, which results from the fact that the respective postage value to be printed is deducted from a credit that was previously loaded into the postage meter machine. The franking machine blocks when the remaining balance is zero.

0009Known franking machines contain at least one memory three relevant postal registers for consumed sum value (increasing register), remaining balance still available (falling register) and registers for a checksum. The checksum is compared to the sum of the used totals and the available credits. Already so a check for correct billing is possible.

0010In US 4,251,874, a mechanical printing unit that must be preset for printing is used with a detector to monitor the preset. Furthermore, means for detecting errors in data and control signals are provided in the electronic accounting system. If this number of errors reaches a predetermined value, further operation of the franking machine is interrupted. However, the sudden failure of the postage meter machine is disadvantageous to the postage meter user. On the other hand, in the case of a nonmechanical printing principle, hardly such internal errors are to be expected, and in the event of a serious error, the franking machine is anyway to be switched off anyway. In addition, the security against manipulation of the franking machine is hardly increased by the franking machine is switched off after a predetermined number of errors.

0011From US 4 785 417 a postage meter with a program sequence monitoring is known. The correct sequence of a larger program piece is controlled by means of a special code associated with each program part, which is stored in RAM when the program piece is called in a specific memory cell. It is now checked whether the stored in the aforementioned memory cell code is still present in the currently running program part. If during a manipulation the course of a program part is interrupted and another program part is running down, an error can be detected by such a control question. However, the comparison can only be carried out in the main sequence. However, secondary processes, for example safety-relevant calculations which are used by several main processes, can not be monitored by such monitoring for the execution of the program part, because the program control takes place independently of the program sequence. If it is manipulated on the basis of permitted program parts and secondary processes in such a way that secondary processes are additionally integrated into main processes or omitted from later processes or branched to secondary processes, then no error would be detected, since neither the length of the program part can be determined nor determined Program branch how often was passed.

0012In known franking machines, further safety measures, such as breakaway screws and encapsulated shielded safety housings, are already customary for protection against unauthorized opening of the safety housing.

0013A security housing for franking machines, which has internal sensors, is known from DE 41 29 302 A1. The sensors are in this case connected to a battery switches, which are active when opening the security case to delete the residual assets storing memory (falling post register) by interrupting the power supply. It is known, but not predictable, which state a voltage-free memory module occupies when the voltage returns. Thus, an unpaid higher residual balance could arise. On the other hand, can not be excluded that in the above manner, the residual assets at least partially discharged. This would be disadvantageous in an inspection, since the residual value credit, which had been paid by the meter user, must also be reloaded, the amount of this remaining balance, however, by above Influences can be falsified. Finally, the description does not explain how to prevent a manipulator from restoring an unpaid balance.

0014It has already been proposed in US 4 812 965 a remote inspection system for franking machines, which is based on special messages in the imprint of mailpieces that must be sent to the headquarters, or on a remote query via MODEM. Sensors within the franking machine should detect any adulteration action taken, so that a flag can be set in associated memories if the postage meter machine intervened for manipulation purposes. Such intervention could be to load an unpaid balance into the registers.

0015Upon detection of tampering, the postage meter will be disabled during remote inspection via modem by a signal originating from the data center.

0016On the other hand, skilful manipulation could be to return the flag and registers to their original state after making unfilled franking imprints. Such manipulation would not be detectable via remote inspection by the data center if this undone manipulation was prior to the remote inspection. Also, the reception of the postcard from the data center, on which a franking to be carried out for inspection purposes is to be made, allows the manipulator to return the postage meter machine to the original state in sufficient time. Thus, no higher security can be achieved yet.

0017The disadvantage of such a system is that it can not be prevented that a sufficiently skilled manipulator breaking into the franking machine subsequently removes its left-over traces by deleting the flags. In a later remote inspection then no error or manipulation attempt can be determined.

0018Furthermore, in connection with the remote retrieval of register statuses, it is known to transfer a recharge information to a franking machine from a data center via a remote value specification in order to load a credit into the register for the remaining balance (residual value). It goes without saying that suitable security measures must be taken for this, so that the credit stored in the postage meter can not be increased in an unauthorized manner. Protecting the abovementioned solutions against abuse and counterfeiting requires additional material and time expenditure.

0019Also common are keys and a combination lock to complicate access to the franking machine.

0020A corresponding safety measure is also known from US Pat. No. 4,549,281. Here, a comparison is made of an internal fixed combination stored in a non-volatile register with an input external combination, whereby after a number of failed attempts, ie non-identity of the combinations, the franking machine is blocked by means of an escapement electronics.

0021According to US Pat. No. 4,835,697, in order to prevent unauthorized access to the franking machine, a combination can in principle be exchanged.

0022Moreover, in US 4,812,994, unauthorized access to use of the postage meter machine is to be prevented by blocking the postage meter machine if a predetermined password is entered incorrectly. In addition, the franking machine can be set by means of a password and corresponding input via the keyboard so that franking is possible only during a predetermined time interval or times of day.

0023The password can be entered by a personal computer via MODEM, by a smart card or manually in the postage meter. After a positive comparison with a password stored in the franking machine, the franking machine is released. A security module (EPROM) is integrated in the control module of the billing unit. As a further security measure, an encryption module (separate microprocessor or program for FM CPU based on DES or RSA code) is provided which generates a postage value, the subscriber number, a transaction number and the like in the franking stamp. If enough criminal energy but also a password could be explored and brought together with franking machine in the possession of a manipulator.

0024From US 4 864 506 it is known that when the value of the credit in the falling register is below a threshold and a predetermined time has been reached, communication to the remote data center is received by the postage meter. It is envisaged that the data center to receive register data and to control whether the postage meter is still connected to a specific telephone number, the connection with the postage meter receives after a defined period of time and replies the meter only at predetermined times. In addition, it is provided that the identity number of the franking machine and the values ​​in the falling and rising register are queried before the credit card is loaded into the postage meter machine for authorization by the data center.

0025Furthermore, from above Patent discloses that the communication of the data center with the postage meter need not remain limited to mere credit transfer in the postage meter. Rather, in the case of a logoff of the franking machine, the communication of the data center with the franking machine is used to transfer the remaining balance of the franking machine into the data center. The value in the falling post register of the postage meter is then zero, effectively suspending the postage meter.

0026In addition, EP 388 840 A2 discloses a comparable safety technology for setting a franking machine in order to clean it of data without the franking machine having to be transported to the manufacturer. Again, security depends solely on the encryption of the transmitted code.

0027US Pat. No. 5,077,660 also discloses a method for changing the configuration of the franking machine, wherein the franking machine can be switched over from operating mode into a configuration mode by means of a suitable input and a new meter type number can be entered which corresponds to the desired number of features. The franking machine generates a code for communication with the computer of the data center and the input of the identification data and the new meter type number in the aforementioned computer, which also generates a corresponding code for transmission and input to the postage meter, in which both codes are compared. If both codes match, the franking machine is configured and switched to the operating mode. As a result, the data center always has accurate records of the respectively set meter type for the corresponding franking machine. However, security depends solely on the encryption of the transmitted code.

0028It is known from EP 516 403 A2 to regularly transmit the error of the franking machine which has been recorded in the past and stored in a memory to a remote error analysis computer for evaluation. Such a remote inspection allows an early warning of an error occurring and allows further action (service) to be taken.

0029But this alone does not provide a sufficient criterion for manipulation. Even if an additional determination were made in the data center regarding a user of a postage meter that was continued by the user beyond the inspection date, it would not be possible to conclude from this information that the manipulation was intended to be forged if the postage meter machine does not report regularly. One cause of erratic reporting at the data center may also be a fluctuating volume of mail.

0030From US Pat. No. 4,811,234 it is known to encrypt the transactions while interrogating the registers of the franking machine and transmitting the register data to the data center to indicate a temporal reference to the reduction of the authorized amount stored in the register. On the one hand, the postage meter identifies itself at the data center when a presettable threshold is reached by means of its encrypted register content.

0031On the other hand, the data centers modified by appropriate authorization signals the desired franking amount, to which may be franked. Encryption is thus the only security against manipulation of the register statuses. Thus, if a manipulator duly loads always the same amount at equal time intervals, but in the meantime with the manipulated franking machine franked a much higher amount than he has paid, the data center can not detect any manipulation.

0032Secured reloading of a postage meter with a balance has already been linked in US 3 255 439, on the one hand, to automatic signal transmission from the postage meter machine to the data center, whenever a predetermined sum of funds that has been franked or pieces of processed mailpieces or a predetermined time period has been reached.

0033Alternatively, a signal corresponding to the funds amount, quantity or time period can be transmitted. In this case, the communication takes place by means of binary signals via connected via a telephone line converter. The machine receives an equally secure recharge according to the credit balance and blocks in case no credit is re-delivered. For the transmission of data an appropriate encryption is required. An increased need for security against manipulation of the franking machine can not yet be met with this solution alone.

0034According to GB 22 33 937 A and US 5 181 245 the postage meter communicates periodically with the data center. A blocking agent allows the postage meter after expiration of a predetermined time or after a predetermined number of operation cycles, block and provide a warning to the user. For unlocking an encrypted code must be entered from the outside, which is compared with an internally generated encrypted code. In order to prevent incorrect billing data from being delivered to the data center, the billing data is included in the encryption of the aforementioned code. The disadvantage is that the warning occurs simultaneously with the blocking of the postage meter, without the user having a chance to change his behavior in a timely manner and call the data center beforehand.

0035From US Pat. No. 5,243,654 a franking machine is known, where the current time data supplied by the clock / date module is compared with stored shutdown time data. If the stored shutdown time is reached by the current time, the franking machine is deactivated, that is, prevents printing.

0036When connecting to a data center, which reads the billing data from the rising register, the franking machine is transmitted an encrypted combination value and set a new deadline, whereby the franking machine is made operational again. In this case, the amount of consumption sum which sums up the spent postage and is read by the data center is also part of the encrypted transmitted combination value. After the decryption of the combination value, the consumption sum amount is separated and compared with the consumption sum amount stored in the postage meter machine. If the comparison is positive, the lock on the franking machine is automatically canceled.

0037By means of this solution it is achieved that the postage meter machine periodically reports at the data center in order to transmit billing data. However, cases of use are quite conceivable, where the postage to be franked fluctuates (seasonal operation). In these cases, the franking machine would disadvantageously often be blocked unnecessarily.

0038It was the object to overcome the disadvantages of the prior art and to achieve a significant increase in security without an extraordinary on-site inspection.

0039The object is achieved with the features of claim 1.

0040The solution according to the invention further assumes that the funds stored in the franking machine must be protected from unauthorized access. The falsification of data stored in the postage meter data is so far complicated that the effort for a manipulator is no longer worthwhile.

0041Commercially available OTP processors (ONE TIME PROGRAMMABLE) can contain all safety-relevant program parts inside the processor housing, as well as the code for forming the message authentication code (MAC). The latter is an encrypted checksum attached to information. As a crypto algorithm, for example, Data Encryption Standard (DES) is suitable. In this way, MAC information can be attached to the security-relevant register data, thus maximally increasing the difficulty of manipulating the postal registers.

0042These safety-relevant program parts also include program parts for a flow control, which monitors the number of expired program parts. Thus, malfunctions of the microprocessor or tampering with manipulation can be detected. Specific arithmetic operations allow checking which part of the program has been used and how often.

0043The method of enhancing the security of a postage meter capable of communicating with a remote data center and having a microprocessor in a meter controller includes forming a checksum in the OTP processor over the contents of the external program store and comparing the result with a post code OTP processor stored predetermined value before and / or after the end of the franking mode or Operating mode, especially during initialization (ie when the postage meter machine is started), or in times when printing is not done (ie when the postage meter is operating in standby mode). In the event of an error, logging and subsequent blocking of the franking machine takes place.

0044Advantageous developments of the invention are characterized in the subclaims or are presented in more detail below together with the description of the preferred embodiment of the invention with reference to FIGS. Show it:<dl id="dl0001"><dt>FIGS. 1a and 1b,</dt><dd>Block diagram of a franking machine with increased security Figure 1c, circuit diagram of a detector device for determining an opening of the housing</dd><dt>FIG. 2a,</dt><dd>Schedule according to a first variant</dd><dt>FIG. 2b,</dt><dd>Schedule according to a second variant</dd><dt>FIGS. 3a and 3b,</dt><dd>Representation of the safety procedures of the franking machine and data center in communication mode</dd><dt>FIG. 4a,</dt><dd>Schedule for the franking mode according to a first variant</dd><dt>FIG. 4b,</dt><dd>Schedule for the franking mode according to a second variant</dd><dt>FIG. 5,</dt><dd>Schedule for a first sleeping mode variant</dd><dt>FIG. 6,</dt><dd>Schedule for a second sleeping mode variant</dd><dt>FIG. 7,</dt><dd>Schedule for codeword entry</dd></dl>

0045FIGS. 1a and 1b each show a block diagram of the franking machine according to the invention with a printer module 1 for a fully electronically generated franking image, with at least one input element 2 having a plurality of actuating elements, a display unit 3, an opening detection detecting sensor 21 and a communication with a data center producing MODEM 23, which are coupled via an input / output control module 4 with a control device 6 and with a non-volatile memory 5 or 11 for the variable or the constant parts of the franking picture.

0046A character memory 9 supplies the necessary pressure data for a volatile main memory 7. The control device 6 comprises a microprocessor μP connected to the input / output control module 4, the character memory 9, the volatile random access memory 7 and the nonvolatile working memory 5, with a cost center memory 10, with a program memory 11, with the motor of a Transport or Feed device if necessary with strip triggering 12, an encoder (coding disk) 13 and with a clock / date module 8 is in connection. The individual memory can be realized in several physically separate or not shown combined in a few modules, which are secured against removal by at least one additional measure, such as sticking on the circuit board, sealing or casting with epoxy resin.

0047In FIG. 1 a, the sensor 21 acts on a detector device 20, which is loaded via the input / output control module 4 after switching on the franking machine with a code word Y under predetermined conditions, which is read out during operation of the franking machine and checked for validity , As the detector device 20 is loaded with a code word Y, will be explained below with reference to Figure 1c in conjunction with the comments on Figure 2.

0048FIG. 1c shows a circuit diagram of a detector device 20 for determining an opening of the housing. This detector device 20 comprises at least one static memory module 24 (SRAM) for the code word Y, a changeover switch 25 and a primary battery 26, in particular a lithium cell.

0049The switch 25 connects a power supply output voltage <maths id="math0001" num=""><math display="inline"><mrow><msub><mrow><mtext>V</mtext></mrow><mrow><mtext>cc</mtext></mrow></msub><mtext>= + 5V</mtext></mrow></math><img file="EP0660269B1_D0001.tif" /></maths>with the SRAM 24 when the postage meter machine is powered on. If the franking machine is switched off or the power supply is interrupted, the SRAM 24 is supplied from the primary battery 26, preferably with a voltage of + 3V. As a result, the memory content in the SRAM is retained until the supply is set via the sensor 21 or by the primary battery 26.

0050In a preferred variant, such a sensor is an electrically conductive strip which establishes the contact between the long-life battery (lithium battery) and the devices 25 or 24 to be supplied, which is embodied as a memory module (CMOS-SRAM) for the code word Y. A switch 27 is connected to the supply voltage supplied by the switching device 25 via a resistor R and to ground potential.

0051The tap between the resistor R and the switch 27 leads to the reset input of the memory module 24 for the code word Y. The switch 27 may be, for example, an npn transistor, which is connected with its collector at the reset input and with its emitter at ground potential. Its base is connected via an impedance converter with the BC input of the switching device 25, which is connected via the sensor 21 to the + pole of the battery 26. The impedance converter is an inverter in CMOS-3V technology. The switching device 25, for which preferably the module bq 2201 is used, supplies a power supply voltage during the operation of the postage meter machine <maths id="math0002" num=""><math display="inline"><mrow><msub><mrow><mtext>V</mtext></mrow><mrow><mtext>cc</mtext></mrow></msub><mtext> = +5 V</mtext></mrow></math><img file="EP0660269B1_D0002.tif" /></maths>and during non-operation, a battery voltage of +3 V to obtain the memory contents. When the sensor 21 is activated during non-operation, the memory hold-up voltage is absent. However, if the sensor 21 is activated during operation, the memory contents are deleted via the reset input.

0052In a modified variant (not shown in FIG. 1c), another connection can also be interrupted by means of the sensor 21, whereupon the detector device 20 reacts. Such an electrically conductive strip may be laid manually differently for each machine individually. It is essential here that any opening of the housing moves the strip and thus interrupts the aforementioned contact.

0053The strip is initially loosely laid, for example, during assembly and tightened only after assembly or shortly before the final closing of the housing shells, ie the above-mentioned contact is made.

0054An advantageous further sensor variant consists in the formation of the housing shells as a safety capsule.

0055The safety capsule is formed with meander-shaped interconnects through which a low monitor current or charge sustaining current flows for a CMOS RAM. Each opening leads to a power interruption. This information is lost, which can not replace the manipulator. After closing the housing, the system routine prevents the machine from entering the franking mode.

0056FIG. 1 b shows a second variant with device 20 coupled directly to the microprocessor of the control device, which device can likewise be influenced by a sensor 21. The sensor 21 and the detector device can be realized in different ways.

0057Thus, a further variant of the detector device 20 uses a programmable logic array, which can be influenced by the sensor 21. The sensor causes another program branching during the course of the system routine via the device. After closing the housing, the system routine again prevents the machine from entering the franking mode.

0058FIG. 2a shows a flow chart for a franking machine with a security system according to a first variant. A step 210 is always provided during operation and non-operation of the postage meter machine when an opening of the postage meter machine is detected by a sensor 21.

0059After the franking machine has been switched on in step 100, a functional test with subsequent initialization is then carried out within a start routine 101.

0060In the following - several, in detail in the figure 7, substeps 102 to 105 comprising - step, a new code word Y'- but only if, according to step 102 such in another predetermined memory space E of the nonvolatile memory 5 exists - in the memory space of the old codeword Y is copied (step 103) if there is no longer a valid codeword Y stored there. The latter also applies to the case of an authorized and unauthorized opening, because the old codeword Y is deleted each time the housing is opened. If it is not opened, it is not copied, and after step 104, the old code word is retained in the memory 20. Now the system routine 200 is reached at the point s. This comprises several steps 201 to 215 of the security system. In step 201, the current data is called up, which is explained below in more detail in connection with the explanation relating to FIGS. 5 and 6 for the sleeping mode.

0061Subsequently, as shown in FIG. 2a, it is checked in step 202 whether the criteria for entering the sleeping mode have been met. If this is the case, a branch is made to step 203 in order to display at least one warning by means of the display unit 3. In this case, further steps 204 to 206 can be run through before branching to step 207. If this is not the case, the process also branches to step 207. After the above steps, the point t is reached in any case.

0062In step 207, as explained more fully in the European application with the official file reference 93103951.5, at least one register check of the data structure of the postal registers is carried out in order to record the errors. Moreover, in step 208, measures are taken to block the postage meter for register data structure errors.

0063Of course, a fraudster who breaks into the postage meter machine could do such a manipulation to change the mailing register properly. This manipulation could only be uncovered in connection with the data center data at the next remote polling of the registers, if it is not undone beforehand, because a manipulator endeavors to cover his tracks. Therefore, it is provided according to the invention that at least one check is made as to whether a valid code Y is present in the predetermined memory location of the unit 20. If this is not the case, a branch is made to step 208.

0064The checking for valid code Y is carried out, for example, by means of a selected checksum method within a ONE TIME PROGRAMMABLE (OTP) processor which internally contains the corresponding program parts and also the code for forming a MAC (MESSAGE AUTHENTICATION CODE), for which reason the manipulator the checksum method can not understand. Other security-related key data and processes are stored exclusively in the interior of the OTP processor in order to provide MAC protection via the postal registers.

0065Another security variant, which does not require an OTP processor, is to make it more difficult to find the keys by coding them and storing them in different memory areas. Again, MACs are appended to each piece of information in the security-relevant registers. A manipulation of the register data can be detected by control over the MAC. This routine is performed in step 406 in the franking mode shown in Figures 4a, b. Thus, the difficulty of manipulating the postal registers can be maximized.

0066At step 208, the kill mode is reached and the postage meter machine is locked. In step 208, preferably, the postal registers are partially deleted in a predetermined manner. Via step 213, the display mode 215 is reached and then branched back to the system routine. The locking can be done advantageously by the branching on the franking mode 400 is no longer executed.

0067If the test has been carried out in step 207 without relevant deficiencies being detected, the point e, ie the beginning of a communication mode 300 reached and in a - dargestell in the figures 2a, b and 3a queried th - step 301, whether a transaction request exists. If this is not the case, the communication mode 300 is left and the point f, ie the operating mode reaches 290. If relevant data has been transmitted in communication mode, branch to step 213 for data evaluation. Or else, if non-transmission is determined in step 211, step 212 is to be branched. It is then checked whether appropriate inputs have been made to enter test mode 216 at test request 212, otherwise to enter display mode 215 at intended register level check 214. If this is not the case, then automatically the point d, ie the franking mode 400 is reached.

0068It is further provided that in step 213 a statistical and error evaluation is performed in order to obtain further actual data, which are also available after branching to the system routine 200 in step 201.

0069In the case of an opening of the postage meter housing by authorized persons a written possibly By telephone registration in the data center for the authorized opening required, which informs the opening date and time for the approximate start of opening. Before the franking machine can actually be opened, communication with the data center must be received via MODEM to request the opening authority and to load a new future code Y 'which can replace the old one.

0070FIGS. 3 a and 3 b show a representation of the safety sequences of the franking machine in communication mode on the one hand and the safety sequences of the data center in communication mode on the other hand.

0071If the point e, ie the beginning of the communication mode 300 explained below, is reached, a query is made in a step 301 (illustrated in FIGS. 2 and 3a) as to whether a transaction request is present. Such can, for example, to the credit balance, telephone number change, etc. are provided.

0072The user selects the communication or Fernwertvorgabemodus the postage meter machine via the input of the identification number (eight-digit Porto call number). For example, suppose communication is to load a new future code Y 'that can replace the old one. If only such a transaction request is made, the default amount must be changed to zero, because in this case, the credit in the postage meter, of course, must not be increased.

0073In step 302, an input of the identification number (ID No.) and the intended input parameters may be made in the following manner. With the ID no. This may be the serial number of the franking machine, a PIN or PAN (Porto call number) act, which is acknowledged by actuation by means of a predetermined T-key of the input means 2. In the display unit 3, the input parameter (default value) used in the last remote value specification (recharge) appears, which is now overwritten or retained by the input of the desired input parameter. The input parameter is a combination of numbers, which is understood in the data center as a request to submit a new code word Y ', if previously an opening authority has been obtained. If the aforementioned input parameter is entered incorrectly, the display can be cleared by pressing a C key.

0074For example, a change is entered to load a zero credit on a transaction, but no opening authority is previously obtained. Thus, the input parameter serves only as a new default value. However, neither the credit for frankings is increased in value when the input parameter has the value zero, nor loaded a new code word. However, with each communication, a number of S 'can be transmitted.

0075Only by the preceding logging in, for example by means of a separate call to the data center or other communication form, the data center is informed that a new codeword Y 'is to be transmitted to the postage meter machine, if subsequently a transaction for the value within a predetermined period of time by the postage meter Zero is started. The opening request is only deemed to be made if, after the registration of an authorized opening, the postage meter machine enters the communication mode agreed in this way.

0076However, if an arbitrarily different input parameter is previously agreed with the data center, when this input parameter is entered, the reloading of the credit corresponding to the default value entered by the input parameter also takes place - during an additional transaction - the reloading of a new future code Y '.

0077If an input parameter other than the agreed one is entered, this will only result in recharging in the amount of the selected new standard amount.

0078If the desired input parameter is displayed correctly, this is confirmed by re-pressing the predetermined T-key of the input means 2. In the display unit 3 then appears a representation according to an input parameter change or according to the non-change (old default value).

0079By pressing the predetermined T-key, the change of the input parameter via MODEM connection is started. The input is checked (step 303) and the rest of the process is performed automatically, the process being accompanied by a corresponding indication.

0080For this purpose, the franking machine checks whether a MODEM is connected and ready for operation. If this is not the case, a branch is made to step 310 in order to indicate that the transaction request must be repeated. Otherwise, the postage meter machine reads the dialing parameters consisting of the outdialing parameters (main / extension, etc.) and the telephone number from the NVRAM memory area F and sends them to the modem 23 with an election request command. Subsequently, the connection establishment required for the communication takes place via the MODEM 23 with the data center in a step 304.

0081In the figure 3a is also shown on the left half of the parallel sequence in the data center, which is necessary for the communication. In step 501 it is constantly checked whether a call has been made in the data center. If this is the case, and the MODEM 23 has dialed the opposite side, the connection is also established in the data center in step 502. And in step 503 is constantly monitored whether the connection to the data center has been solved. If this is the case, after an error message in step 513, a branch back to step 501.

0082At the same time, the franking machine monitors in step 305 whether communication errors have occurred and if necessary branches back to step 304 in order to reestablish the connection from the postage meter machine. After a predetermined number n inconclusive redial attempts to establish a connection is branched back to the point e via a display step 310. If there was no detectable error in step 305, it is determined in step 306 by the postage meter machine that the connection is established and a transaction is yet to take place, is branched to step 307 to an opening message or to identification, Vorspann- or To send register data. In subsequent step 308, the same check as in step 305 is performed, ie if a communication error has occurred, a branch is made back to step 304. Otherwise, an opening message was sent from the postage meter machine to the data center. This includes ao The postage number for the notice of the caller, ie the postage meter, at the data center included.

0083This opening message is checked for plausibility in the data center in step 504 and further evaluated by subsequently checking again in step 505 whether the data has been transmitted without errors. If this is not the case, a branch back to the error message to step 513. If, on the other hand, the data are error-free and it is recognized in the data center that the postage meter machine has made an opening request and requests a new code word Y ', then in step 506 a reply message is sent to the franking machine as a header. In step 507, it is checked whether the preamble message including preamble end has been sent in step 506. If this is not the case, then branch back to step 513.

0084In the franking machine, it is checked in step 309 whether a header has now been sent by the data center as a reply message. was received. If this is not the case, the program branches back to step 310 and then a transaction request is queried again in step 301. If a header has been received and the postage meter machine has received an OK message, a check of the preamble parameters with respect to a telephone number change takes place in step 311. If an encrypted parameter has been transmitted, there is no telephone number change and a branch is made to step 313 in FIG. 3b.

0085FIG. 3b shows the safety sequences of the franking machine in communication mode and, in parallel, those in the data center.

0086In step 313, a start message is sent in encrypted form from the postage meter machine to the data center. In step 314, the message is checked for communication errors. If there is a communication error, the program branches back to step 304 and another attempt is made to establish the connection to the data center in order to send the start message in encrypted form.

0087From the data center, this encrypted start message is received if in step 506 the header message has been completely sent and in step 507 the header end has been transmitted. In step 508, it is checked in the data center whether it has received the start message and the data is OK. If this is not the case, it is checked in step 509 whether the error can be corrected. If the error can not be corrected, the program branches to step 513. Otherwise, an error handling is performed in step 510 and branched to step 507. If the reception of proper data is detected in step 508, the data center begins to perform a transaction in step 511. In the aforementioned example, a new code word Y 'is transmitted in encrypted form to the franking machine, which receives the transaction data in step 315.

0088In subsequent step 316, the data is checked. If there is an error, branch back to step 310. Otherwise, the system waits for the end message which the data center sends encrypted to the postage meter machine in step 512. Upon receipt of this end message in step 317, the transaction is also performed in the postage meter at step 318. A new code word Y 'is now stored in the franking machine and it is branched back to step 305. If no further transaction takes place, step 310 and then step 301 are reached for display.

0089If now no transaction request is made, it is checked in step 211 whether data has been transmitted. If data has been transmitted, step 213 is reached. According to the input request, the franking machine places the new code word Y ', for example, in the memory area E of the nonvolatile memory 5.

0090If, however, a number combination other than zero is entered as the input parameter in step 302 and the input was correct (step 303), a connection is established (step 304). And if a connection is established without error (step 305) (step 306), an identification and preamble message is sent to the data center. In this opening message is ua again also contain the postage request number PAN for identifying the postage meter machine at the data center. The data center recognizes from the entered combination of numbers, if the data is error-free (step 505), that in the franking machine, for example, a credit increased but no new code word Y 'to be transmitted.

0091If in the meantime the current telephone number of the data center has changed, measures must be taken that it is stored in the franking machine. In step 506, a reply message is then sent, unencrypted, from the data center with the elements of change of telephone number and current telephone number. The postage meter machine receiving this message recognizes in step 311 that the telephone number is to be changed. Now, step 312 is branched to store the current telephone number. Subsequently, branching back to the step 304. If the connection is still established and there is no communication error (305), then in step 306 it is checked whether another transaction should take place. If this is not the case, a branch is made via step 310 to step 301.

0092After the current telephone number has been stored, the franking machine automatically establishes a new connection to the data center with the aid of the new telephone number. The actual, intended by the user transaction, a Fernwertvorgabe the new codeword Y 'or a Nachladeguthabens is thus automatically, ie without any further intervention by the user of the franking machine. A message appears in the display saying that the connection is automatically rebuilt due to the change in the telephone number.

0093It is envisaged that after an opening of the housing, ie after an intervention, the housing of the franking machine is closed and that after closing the housing, the postage meter is controlled in the communication mode 300. The authorized user can also inform the data center of the completed check.

0094Communication may include phone number storage, as well as a credit-recharge. Without interrupting the communication so several transactions can be performed. If the amount of the credit to be reloaded is to remain at the same level as the last credit reload, only one transaction is necessary. This takes place in the same way as when reloading a new code word Y '. However, if you want to change the amount of credit to be reloaded, two transactions are required. Both transactions are carried out in the same way as when reloading the new code word Y '. During a transaction, a message is sent. Each submitted message is individually encrypted. A successful transaction proceeds as follows: The franking machine sends its ID number and a default value for the amount of the desired reload credit together with a MAC to the data center. The latter checks such a transmitted message against the MAC, in order then to send an also MAC-secured OK message to the postage meter machine. The OK message no longer contains the default value.

0095It is envisaged that the transmission of a new code word Y ', a change in the credit-recharge level and a new recharge credit in encrypted form, but the transmission of telephone number in unencrypted form. If it is determined in the data center that the connection to the franking machine has been solved (step 503) or incorrect data (505) or Unrecoverable errors (509) are present or no end of bias has been sent (507), the communication is terminated. After an error message, the communication connection is released, the stored data is stored and evaluated by the data center in step 513.

0096A transaction request leads to a specially secured credit recharge in the franking machine. Preferably, the post registers outside the processor in the cost center memory 10 are also secured during the credit recharge by means of a time control. For example, if the postage meter is being observed with an emulator / debugger, then the communication and billing routines are unlikely to expire within a predetermined time. Is that the case, ie the routines take much longer, changing part of the DES key. The data center may detect this modified key during a communication routine and then report the meter as suspect as soon as a start message is sent in encrypted form according to step 313.

0097In the data center, it is determined in step 509 that the error is not recoverable. The data center can then not perform a transaction (step 511) because it has branched back to step 513. Since no data was received in the meter at step 315, the transaction was not done correctly (step 316). Then, it is then branched back via step 310 to step 301 in order to recheck after an indication whether a transaction request is still made.

0098If this is not the case, the communication mode 300 is left and the point f, ie the operating mode 290, is reached. Thus, in the case discussed above, with modified DES keys, no data could be transmitted (step 211). Also, it is assumed that neither a test request (step 212) nor a register polling (step 214) has been caused to check the remaining balance. But then the franking mode 400 is reached.

0099In another variant, the keys (crypto-keys) relevant for the transmission of the data required for a credit-recharge, which have been stored in the crypto-form memory, are also deleted completely when an unauthorized intervention in the franking machine takes place. As already explained in connection with FIG. 7, after an opening request, the opening authority can be obtained by reloading a new code word Y '. FIG. 7 shows a corresponding flowchart for code word input.

0100Another possibility for implementing the kill mode is the partial deletion of the postal register statuses, which are stored redundantly. In this case, the redundancy is purposefully reduced in a predetermined manner. This reduction in redundancy should be distinguished from other data errors that can be remedied automatically by the postage meter machine, as detailed in copending European application with official file reference 93 103 951.5. There, a method is proposed for memory correction of safety-relevant data in a postage meter machine, wherein redundantly stored data are compared with one another in order to load a memory area with erroneous data again with error-free data. However, this is no longer possible with a sixth error type because all redundantly stored data now have different errors that can not be corrected automatically. Only a service technician could reconstruct the data in a predetermined manner, which then has to be done after each authorized opening prior to re-starting the postage meter.

0101The franking machine hardware is also accessible in a known manner by a closable flap, which must be opened via a security key. Another threshold for a manipulation is the previously to be sealed seal or the seal number to be overcome, which is also stored outside the franking machine in the data center. The data center gives feedback information to the post office or the inspector who visually inspects the seal locally and compares it to the displayed internally stored seal number.

0102The safety presupposes at the authorized opening, the reliability of the authorized person (service, inspector) and the possibility to check their presence. The control of the seal and the control of the registers in an inspection of the franking machine and independent of the data in the data center then provides the verification security. The control of the postage stamped postage including a security imprint provides an additional verification security.

0103The franking machine performs regularly and / or at power on the register check and can thus detect the missing information, if the machine had been opened unauthorized. The franking machine is then blocked. Without the invention in conjunction with a codeword Y, the manipulator would easily overcome the blockage. However, the codeword is lost and it would cost the manipulator too much time and effort to determine the valid codeword by experiments. In the meantime, the franking machine would have long since been registered as suspect in the data center.

0104The potential manipulator of a franking machine must overcome several thresholds, which of course takes a certain amount of time. If there is no connection from the franking machine to the data center at certain intervals, the franking machine is already suspect. It is assumed that the one who commits a manipulation of the franking machine, will hardly report back to the data center.

0105A potential fraudster who for the reasons mentioned above does not get to the stored data is additionally prevented from manipulating the print control signal to the print head. It might be tempted to inject manipulated variable pixel image data into the print control signal during column-wise printing. The franking machine is usually operated at high to maximum printing speed. In a manipulation of the print control signal for the print head results in a changed timing, which could be simulated comparable only at a lower print speed.

0106The printhead is positioned in the postage meter so that it can not be used without a transport device to produce an un-billed postage indicia. Such an arrangement can be seen for example from US 4,705,417. However, other arrangements with printheads which are based on a different printing principle are conceivable, which can not be used without the transport device.

0107Since the printhead without transport device can not be used to produce an unposted franking stamp, the transport speed or monitors the printing speed. If a thermal transfer printer is used, it is sufficient to evaluate the belt speed of the ink ribbon, which is already measured by an encoder. The encoder pulses are counted within a time window which is supplied by the clock / date module 8 or derived from the system clock of the control device 6. The system clock is generated by means of a quartz-controlled clock generator (not shown in FIGS. 1a and 1b). If the number of encoder pulses deviates from a set number, the motor 12 is readjusted accordingly. If the target / actual deviation has increased beyond a permissible level, there is an error. This error is logged and, if necessary, leads to the putting out of operation of the franking machine.

0108In step 202 of the flowchart shown in FIG. 2a, it is then possible to check whether the printing speed is maintained or whether it deviates from the permissible value. If this criterion is fulfilled, a corresponding warning is given in the display which, if not observed, ultimately leads to the blockage of the franking machine.

0109Another variant checks the time sequence for column-by-column printing by comparing the time duration for the pressure of the individual columns in which variable data occurs. In particular, the number of clock pulses of the crystal-controlled clock can be counted between the individual encoder pulses. In a step 207 it can then be checked whether the time schedule has been respected or whether it deviates from the permissible time schedule. If this criterion is satisfied, a measure is taken in a further step 208 to block the franking machine. The printing speed is determined by the required system routine or Duration of time to secure the franking machine in the operating mode hardly reduced.

0110By opening up all time reserves during printing, by the microprocessor of the control device, which carries out the column-by-column embedding of window data, hardly any room or Time for a manipulation. However, the method is not limited to such fast franking machines. Decisive is the monitoring of the printing speed on any caused by manipulation deviations over time to prevent in addition to the other already taken security measures also manipulation of the pressure control signal.

0111The control device 6 has a microprocessor or an OTP. In the OTP, non-volatile memories and other circuits are housed in a common housing in addition to a microprocessor. The internal non-volatile memory includes, for example, program memory and other data memory, in particular the possibility of setting backup bits that prevent the reading of the internal non-volatile memory from the outside. These fuse bits are set in the OTP during the manufacture of the postage meter machine. Observing such security-related routines, such as billing routines, with an emulator / debugger would also result in a changed timing, as determined by the OTP. This also includes a timer / counter circuit for the setting of time intervals or Clock cycles, for example, for the time-out generation or printer control. When a certain time has elapsed and the expected event has not occurred, an interrupt is generated by the clock / counter circuit which notifies the microprocessor of the inconsequential expiration of the period of time, whereupon the microprocessor initiates further action. The clock / counter circuit is used for program runtime monitoring. It is assumed that a known number of clock cycles for the program flow of predetermined program parts. Before the start of the routine, the counter of the timer / counter circuit is preset in a predetermined manner or reset. After the start of the program routine, the count is continuously changed in accordance with the clock pulses of the clock. After processing the critical predetermined program parts of the state of the counter is queried by the microprocessor and compared with the expected value.

0112In the case of a predetermined deviation in the transit time of critical or safety-relevant program parts, a flag is set in a memory, which is queried in step 207. If this query criterion exists, a branch is made to step 208. The franking machine can thus no longer be operated for franking (kill mode 1).

0113In an advantageous further variant of the time control, the codeword Y in the SRAM 24 is deleted via the control line C. This can be done in conjunction with the address line A and the data line D by overwriting with a predetermined other word, for example 0000. The advantage lies in the fact that even without a sensor 21 or if for some reason the sensor 21 was ineffective, the detector device 20 still responds to a manipulation, which of course must be preceded by unauthorized opening.

0114Other variants or a combination with other variants, such as the deletion of a part of the DES key or the redundant register states or Deleting other data or keys that are meaningful to the data center in a transaction is included within the spirit of the invention. It is essential that critical program parts are stored in the OTP and the program runtime monitoring means are software and / or hardware components of the OTP. With these program parts, the critical programs stored externally by the OTP in the program memory PSP 11 can be monitored. The advantage is that the monitoring program itself can not be observed or manipulated because it constantly remains in the OTP and can not be read. In combination with the sensor 21 thus a higher security is achieved.

0115In a disarmed variant, the sensor 21 is saved because the housing is otherwise adequately secured and the monitoring function is taken over in the aforementioned manner by the detector device 20 which is effective in conjunction with a corresponding software. The detector device 20 may - in a variant not shown in FIG. 1b - also be part of the processor (OTP). This device 20 is preferably designed as a non-volatile non-volatile memory from the outside. A suitable processor type is, for example, the TMS 370 C010 from Texas Instruments, which has a 256 bytes E²PROM has. When a manipulator makes an unauthorized intervention, the postage meter machine is effectively disabled by being transferred to the first mode.

0116During an inspection, first the seal of the franking machine is checked for integrity and then the register statuses. If necessary, a test print with the value 0 can be made. In the event of a repair by the on-site service, it may be necessary to intervene in the franking machine. The error registers can be read, for example, with the aid of a special service EPROM, which is plugged into place of the advert EPROM. When this EPROM slot is not accessed by the processor, access to the data lines is usually prevented by special driver circuitry, not shown in Figures 1a and 1b. The data lines, which can be reached here by a sealed housing door, thus can not be contacted without authorization. Another variant is the reading out of error register data by a service computer connected via an interface. To prepare for the intervention, the registers of the franking machine are queried to determine the type of intervention required. Before intervening in the franking machine and the housing is opened, there is a separate call to the data center. If then within a predetermined period of time, the default value is changed to zero and transmitted to the data center in the context of a transaction, ie the type of intervention and the register data have been communicated to the data center, data is transferred from a data center to the franking machine in accordance with a requested authorized intervention in the franking machine, which is logged as a permitted intervention.

0117If, however, within a predetermined period of time the default value is changed to a value other than zero and transmitted to the data center in the course of a transaction, a previously made separate call to the data center remains without consequences, ie an opening request is deemed not made and authorized authorization (opening authority) the franking machine is not issued and consequently no new codeword Y 'is transmitted.

0118The franking machine is capable of to distinguish between requested authorized and unauthorized intervention in the postage meter machine by means of the control unit of the postage meter machine in conjunction with the data transmitted by the data center, wherein in the case of unauthorized intervention in the postage meter machine this procedure is recorded as an error case, but after successful intervention in the franking machine, the original operating state is restored by means of the aforementioned transmitted data.

0119It is also in times in which is not printed (standby mode) provided that a query is made regarding manipulation attempts and / or the checksum of the register states and / or on the contents of the program memory PSP 11 is formed. In order to improve the security against manipulation, the checksum in the OTP is formed for the kill mode 2 via the content of the external program memory PSP 11 and the result is compared with a predetermined value stored in the OTP. This is preferably done in step 101 when the postage meter machine is started or in step 213 when the postage meter machine is operating in standby mode. The standby mode is reached when a predetermined time no input or Print request is made. The latter is the case when a ansich known - not shown - letter sensor determines no next envelope, which should be franked. The step 405 in the franking mode 400, shown in FIG. 4b, therefore comprises a further query for a time lapse or for the number of passes through the program loop, which ultimately leads back to the input routine according to step 401. If the query criterion is met, a standby flag is set in step 408 and branched back directly to the point s to the system routine 200, without the billing and printing routine in step 406 is traversed. The standby flag is retrieved later in step 211 and reset after the checksum check in step 213, if no tampering attempt is detected.

0120The query criterion in step 211 is extended by the question whether the standby flag is set, ie whether the standby mode is reached. In this case, a branch is also made to step 213. A preferred variant is to delete the code word Y in the manner already described, if a manipulation attempt in the standby mode has been determined in the aforementioned manner in step 213. The absence of the codeword Y is detected in step 207 and then branched to step 208. The advantage of this method in conjunction with the first mode is that the manipulation attempt is statistically detected in step 213.

0121In order to further increase the security against manipulations, a flow control (flow control) is used according to the invention, which is explained below. Such flow control is accomplished by changing a count in a memory at at least one point during execution of the program routine. After execution of the program routine, the changed count value is compared with a predetermined count associated with this program routine. If branches are run through during the program execution, then different count values ​​can result. In a subsequent evaluation, a plausibility test is carried out or it can be determined which branches have been traversed. This is possible because the change of the count value is effected by a multiplication with a specific prime number assigned to the respective program part. In a later evaluation then only a prime number decomposition must be performed.

0122In another variant, where only such program parts without branches are taken into account or no traceability of the program branches passed through is required, an incrementing of the count value and final comparison with at least one predetermined numerical value is sufficient.

0123The explanation of the processes according to the franking mode shown in FIG. 4a is made in conjunction with the block diagram shown in FIG. 1a.

0124After switching on, the postal value in the value impression corresponding to the last input before the meter is switched off and the date in the date stamp are given automatically according to the current date and for the impression the variable data in the fixed data for the frame and for all associated data remains unchanged embedded. These variable data of the window contents are hereinafter referred to as window data and all the fixed data for the value stamp, the day stamp and the advertising cliche stamp are referred to as frame data. The frame data can be taken from a first memory area of ​​a read only memory (ROM), which also serves as program memory 11. The window data are taken from a second memory area and correspond to the input in memory areas B._j of the nonvolatile random access memory 5 is stored. They can be removed from this at any time for purposes of assembling into an overall representation of a franking impression. It is provided that the hexadecimal window data in run-length coded form in the respective separate memory areas B₁ till B₄ to transfer the non-volatile random access memory 5 and store there. In addition, the time in the clock / date module continues to run continuously even when the franking machine is switched off. Thus, if step 401 is reached in the franking mode 400, data that has already been stored can also be used without input after switching on the postage meter machine. This setting relates in particular to the last setting of the franking machine with regard to the postage value which is displayed in step 402, before the print data processing takes place in step 403. Here, the current variable pixel image data (date and postage value) are embedded in the fixed frame pixel image data. Subsequently, in step 404, a query of the input means for any further inputs.

0125The data is composed of both memory areas according to a predetermined assignment before printing into a pixel print image. The variable information in the window provided for this purpose can be supplemented and modified later. In order to save time, only the parts of a graphical representation are re-stored in the nonvolatile RAM when they are changed, which are actually changed. In the program memory 11 is a first memory area A (ua for the data of the constant parts of the franking picture and others the advertising cliché frame). The sub-storage areas A_i are provided for i = 1 to m frame or fixed data, wherein an associated index i identifies the respective frame, which is preferably assigned to a particular cost center. The corresponding assignment of the respective cost center to the frame data is automatically requested after switching on. In another variant, the cost center must be reentered in memory area C each time it is switched on during the start routine, while it is retained in the case of short-term operating voltage interruptions.

0126In character memory 9 are all alphanumeric characters or Icons are stored pixel by pixel as binary data. Data for alphanumeric characters or Symbols are stored in non-volatile main memory 5 compressed in the form of a hexadecimal number. Once the number of the cost center entered is stored in the memory area C, the compressed data from the program memory 11 with the help of the character memory 9 converted into a binary pixel data having print image, which is stored in such a decompressed form in the volatile memory 7 (step 403). For explanation, memory 7a, 7b and pixel memory 7c are used below, although physically this is preferably a single memory module.

0127The memory areas in the nonvolatile random access memory 5 may contain a plurality of sub memory areas, under which the respective data are stored in data records. The sub-storage areas B_j are provided for j = 1 to n window data, wherein various associations between the sub memory areas of the various memory areas are predetermined.

0128In each record of a sub-storage area A_i, B_j are alternating successively control code and run-length-coded frame or Window data included. Prior to printing, in step 403, nonvolatile program memory (PSP) 11 stores the respective selected fixed data in registers 100, 110, 120, ..., volatile memory 7a, decoding control codes during the acquisition, and storing them in a separate memory area of the working memory 7b are stored. Likewise, the respective selected window data for the postmark and the postage stamp are loaded into registers 200, 210, 220, .... Preferably, the registers of sub-memory areas are formed in the memory area of ​​the main memory 7a. In another variant, these aforementioned registers are part of the microprocessor control 6. Decompressing converts the run-length encoded hexadecimal data into corresponding binary pixel data.

0129The once called constant parts of the franking image are permanently decoded in the pixel memory area I in the volatile pixel memory 7c available. For a quick change of the window data, a second memory area B exists in the non-volatile main memory 5.

0130The number strings (sTrings), which are input for generating the input data with a keyboard 2 or via an electronic balance 22 which calculates the postage value and is connected to the input / output device 4, are automatically stored in the memory area D of the non-volatile main memory 5. In addition, data sets of the sub-storage areas remain, for example B_j, C, etc., received. This ensures that the last input variables are retained even when the postage meter machine is turned off, so that after switching on, the postage value in the value imprint corresponding to the last input before the franking machine is switched off and the date in the day stamp is set according to the current date. If a balance 22 is connected, the postage value is taken from the storage area D. In step 404, it waits until one is currently stored. In the case of a renewed input request in step 404, branching back to step 401 is again effected. Otherwise, a branch is made to step 405 to await the print output request. By a letter sensor, the letter to be franked is detected and thus triggered a print request. Thus, the billing and printing routine may be branched in step 406. If there is no print output request (step 405), the process branches back to step 401 (point d) or-after a variant shown in FIG. 4b-to step 301 (point e).

0131If, after the alternative variant shown in FIG. 4b, instead of branching back to point e and step 301 is reached, a communication request can be made at any time or another input can be made according to the steps test request 212, register check 214, input routine 401 , There are further steps 401 to 404, as in the variant of Figure 4a, go through. Another query criterion may be queried in subsequent step 405 to set a standby flag in step 408 if there is no print output request after a predetermined time. As already explained above, the standby flag can be interrogated in step 211 following the communication mode 300. This does not branch to the franking mode 400 until the checksum check has given the fullness of all or at least selected programs.

0132If a print output request is detected in step 405, further queries are made in subsequent optional steps 409 and 410 and in step 406. For example, in step 409, the presence of a kill-mode flag set in step 208 (FIG. 2 b), the reaching of a further piece-number criterion in step 410 and / or in step 406 the register data fed in for billing in a known manner are queried. Was the predetermined number of frankings for the previous franking consumed, ie Number of items equal to zero is automatically branched to the point e to enter the communication mode 300 so that a new predetermined number S is again credited by the data center. However, if the predetermined number of items has not yet been consumed, the process branches from step 410 to the billing and printing routine in step 406.

0133The number of printed letters, and the current values ​​in the postal registers are registered according to the entered cost center in the non-volatile memory 10 of the franking machine in a billing routine 406 and are available for later evaluation. A special Sleeping Mode counter is caused to count on a count step during the billing routine immediately before printing.

0134If necessary, the register values ​​can be queried in display mode 215. It is also provided to print the register values ​​with the printhead of the postage meter machine for billing purposes. This can be done, for example, as already explained in more detail in German Patent Application P 42 24 955 A1.

0135In another variant, it is further provided that variable pixel image data are also embedded in the remaining pixel image data during printing. In accordance with the encoder 13 delivered position message on the feed of the mail or Paper strip in relation to the printer module 1, the compressed data are read from the working memory 5 and converted by means of the character memory 9 in a binary pixel data having print image, which is also stored in such a decompressed form in the volatile memory 7. Further details can be taken from the European applications EP 576 113 A2 and EP 578 042 A2.

0136The pixel memory area in the pixel memory 7c is thus provided for the selected decompressed data of the fixed parts of the franking image and for the selected decompressed data of the variable parts of the franking image. After billing, the actual print routine is performed (at step 406).

0137As can be seen from FIGS. 1a and 1b, the main memory 7b and the pixel memory 7c communicate with the printer module 1 via a printer controller 14 having a print register (DR) 15 and an output logic. The pixel memory 7c is connected on the output side to a first input of the printer controller 14, at the other control inputs output signals of the microprocessor control device 6 abut.

0138If all columns of a printed image have been printed, the system routine 200 branches back again.

0139The flowchart for a security system shown in FIG. 2a has steps 201 to 206 for monitoring further criteria. In the event of a violation of one of the security criteria, the franking machine enters a sleeping mode, for example if, after the consumption of a predetermined number of pieces, no connection has been made to the data center. A detail of the flow chart for a first sleeping mode variant will be explained with reference to FIG. Starting from the system routine 200, the franking machine enters a step 201 in which current data S and S_ref be called. The franking machine contains a fixed piece number comparison value S_ref, In accordance with the amount of the credit that has just been reloaded during a communication, inter alia, a sleeping mode number S was calculated internally, which is subsequently decremented for each franking. This continues until the piece count comparison value S_ref is reached. If such is determined in step 202, a warning is issued in step 203, for example "TELESET", in order to request the user of the postage meter machine to communicate with the data center. This display results in a delay t_n in the operation of the franking machine. In the subsequent step 204, the delay for a next display with the time duration t_k However, the piece number comparison value is incremented by the value n decremented before branching to step 207. This ensures that the request to establish communication with the data center becomes more and more urgent because the postage meter lingers more and more in step 203. However, when a communication 300 has been performed, data has been transmitted (step 211) and stored in area G of the postage meter's non-volatile memory 5 during the statistics and error evaluation mode.

0140The franking machine and the data center each agree on a predetermined number S, ie the amount that can be franked until the next connection. If a communication does not come about (quantity control), the franking machine slows down its operation (Sleeping Mode variant 1). The current values ​​in step 201 are thus the reset values ​​t_n or values ​​S and S_ref called. If it is determined in the data center which number of units should be franked until the next connection is established, stored historical data must be stored via the credit recharge or credit card. Franking behavior (number of mail items with average postage) are used. The transmission of a new quantity S 'can then take place in the same way as has already been explained in connection with the transmission of the new code word Y'. In a communication according to FIGS. 3 a and 3 b, a new predetermined number of pieces S 'is then transmitted and decremented as a quantity S while the franking is running. From the new predetermined number S 'is internally the comparison piece number S_ref calculated (step 213).

0141FIG. 6 shows the modified flowchart for a second sleeping mode variant. Steps 100 to 105 and 210 have not been shown. After the call of the transmitted current data in step 201, in step 202, the number of pieces S to be decremented is compared with a comparison piece number. The comparison piece number is determined by dividing a maximum number of pieces S_Max by a number k. If the criterion is met, it returns to a step 203 which briefly displays the warning, for example "CALL FP". Subsequently, in step 204, the new maximum number of pieces S_Max formed over a division with a further number m, which would be required for the next comparison in step 202, if no communication with the data center or no credit balance recharge. This allows work to continue until the next piece count limit without displaying a warning. However, it is possible in ever shorter intervals, ie after a predetermined number of frankings to issue a renewed warning, which thus makes more and more urgent attention to the need for communication with the data center. The franking is not affected. As long as the check in step 205 shows that the number of pieces S is still greater than zero, step 207 is reached. Only the warning appears more often in the display. Otherwise, a branch is made to step 206, wherein, for example, a FLAG is set, which is subsequently queried in step 301 and evaluated as a communication request. In step 206, an additional indication can also be made that the communication now takes place automatically and as long as the franking function is stopped until the communication is successfully completed. Of course, the franking machine user can call the communication mode at any time beforehand.

0142Another variant comes without the step 204 shown in FIG. A permanent warning for an imminent sleeping of the franking function is output in step 203, because it now has to be run continuously in step 202 before the step 205 is reached because of the satisfied query criterion. It is further contemplated that step 203 includes an error statistics sub-step corresponding to the statistics and error evaluation mode 213.

0143The franking machine requires a connection to the data center in the manner known from US Pat. No. 3,255,439. If the connection is established, the data center checks the register statuses. If the recharging can not be carried out, the data center prevents it from being transmitted to the postage meter machine on further operation. If the connection was made shortly after the signaling made by the franking machine and the register statuses are not criticized, the franking machine can be switched back to the operating mode without another extraordinary inspection. For this purpose, new current data for example, for a credit and for the permitted number of pieces transmitted, which can be franked until the next connection.

0144The data center can distinguish between automatically made and normal communication due to the transmitted signaling code. The former will always occur when the user of the franking machine has overlooked or ignored the requests for communication and omits corresponding input actions. In this case, a special inspection can be arranged in case of suspicion of a manipulation.

0145It is envisaged that the current data called up in step 201 immediately after a communication, a calculated or transmitted specific number of pieces S 'as a number S and a maximum number of pieces S_Max include. The comparison piece number S_ref for a first piece number criterion, the calculated or transmitted maximum number of pieces divided by the number k corresponds to S_Max, Upon fulfillment of the first quantity criterion for the second mode queried in step 202, the following step 203 is branched off, which provides a permanent warning for an imminent sleeping of the postage meter function or includes a request to recommunicate with the data center before step 205 of verifying the data is achieved by means of another piece count criterion. If the further item number criterion is not met, a step 206 is executed for the automatic communication request of the postage meter machine. During communication with the data center, the transaction data is transmitted, singly and serially, including at least one decision criterion secured by a MAC, thereby overriding the automatic communication request if the transaction was successfully completed. Previously, in step 306 of the communication mode 300 shown in Figure 3a, it was determined that no further transaction is required and, upon being displayed (step 310), is left at point e. If, therefore, no further transaction request has been entered manually, the process continues from step 301 to operating mode (point f). Thus, in step 301, a distinction can be made between manually and automatically made transaction requests. If the communication has not come about after a predetermined time or, for example, the data center occupied, ie No line is free, this is evaluated in step 305 as a communication error. Then, a branch back to step 304 is made and a redial is made up to a predetermined number. If this predetermined number is reached is branched back from the step 305 via the display step 310 back to the point e. In addition, in step 305, if n redial attempts were unsuccessful, any communication flag set may be reset, so that in step 301, no transaction request is detected. In addition, a standby flag can be set at the same time, which is recognized again in step 211. Thus, the contents of the program memory (PSP) 11 are checked in the above manner in step 213 for statistics and error evaluation using a checksum. Thereafter, the standby flag is reset and branched back to the system routine 200 point s.

0146If, according to FIG. 4b, one works according to the other variant for the franking mode 400, which includes a step 410, then no standby flag need be set. From franking mode, it is then possible to branch back directly to communication mode 300 point e. Thus, other inputs, for example according to the steps test request 212 or register check 214, can also be made. Only if branching is made to the franking mode 400 is it then again determined in step 410 in accordance with the decision criterion whether automatic communication is required. This is preferably the case if the predetermined number of pieces has been used up.

0147If the communication was successful and data were transmitted (queried in step 211), step 213 is also reached. In step 213, the current data is determined or loaded, which are called in step 201 and then needed again in the comparison in step 202. The transmitted decision criterion is preferably the new quantity S '.

0148An alternative variant consists in that the decision criterion is the new credit transferred for franking and in the evaluation mode 213 the new number S 'is determined internally in the franking machine. The communication with the data center in this case no longer includes the new number of pieces S ', but is only required to trigger the calculation in the evaluation mode 213. The calculation takes place internally in the franking machine and at the same time in parallel in the data center according to the same methods on the basis of the transmitted register data.

0149The postage meter can transmit the data central register values ​​before a credit recharge:<ul id="ul0001" list-style="none" compact="compact"><li>R1 (descending register) remaining amount in the franking machine,</li><li>R2 (ascending register) consumption sum amount in the franking machine,</li><li>R3 (total resetting) the previous total of all remote value defaults,</li><li>R4 (piece count Σprinting with value <img file="EP0660269B1_D0003.tif" /> O) number of valid prints,</li><li>R8 (R4 + count Σprinting with value = O) Number of prints</li></ul> it follows:<maths id="math0003" num="(1)"><math display="block"><mrow><mtext>R3 = R2 + R1</mtext></mrow></math><img file="EP0660269B1_D0004.tif" /></maths>

0150For each remote value specification, R1 can be queried and evaluated statistically. If R1 always increases, then the same reloading amount can be reloaded in ever larger reloading periods, or the number of pieces is set smaller, which may be franked until the next communication.

0151The number of pieces can be calculated from the average number of pieces S_O, who has a piece of stock S_x added. The following applies:<maths id="math0004" num="(2)"><math display="block"><mrow><msub><mrow><mtext>S '= S</mtext></mrow><mrow><mtext>O</mtext></mrow></msub><msub><mrow><mtext> + S</mtext></mrow><mrow><mtext>x</mtext></mrow></msub></mrow></math><img file="EP0660269B1_D0005.tif" /></maths> With<maths id="math0005" num="(3)"><math display="block"><mrow><msub><mrow><mtext>S</mtext></mrow><mrow><mtext>O</mtext></mrow></msub><msub><mrow><mtext> = R</mtext></mrow><mrow><mtext>8alt</mtext></mrow></msub><mtext></mtext><mfenced open="[" close="]"><mrow><mtext></mtext><mfrac><mrow><msub><mrow><mtext>R</mtext></mrow><mrow><mtext>2</mtext></mrow></msub><mtext> New</mtext></mrow><mrow><msub><mrow><mtext>R</mtext></mrow><mrow><mtext>2</mtext></mrow></msub><mtext> old</mtext></mrow></mfrac><mtext> -1 </mtext></mrow></mfenced></mrow></math><img file="EP0660269B1_D0006.tif" /></maths> or.<maths id="math0006" num="(4)"><math display="block"><mrow><msub><mrow><mtext>S</mtext></mrow><mrow><mtext>O</mtext></mrow></msub><msub><mrow><mtext> = R</mtext></mrow><mrow><mtext>4alt</mtext></mrow></msub><mtext></mtext><mfenced open="[" close="]"><mrow><mtext></mtext><mfrac><mrow><msub><mrow><mtext>R</mtext></mrow><mrow><mtext>2</mtext></mrow></msub><mtext> New</mtext></mrow><mrow><msub><mrow><mtext>R</mtext></mrow><mrow><mtext>2</mtext></mrow></msub><mtext> old</mtext></mrow></mfrac><mtext> -1 </mtext></mrow></mfenced><mtext></mtext></mrow></math><img file="EP0660269B1_D0007.tif" /></maths>

0152The queried register values ​​are provided with the index "old". A value R taken from the ascending register_2alt corresponds to the current query value. In accordance with a default request, which must be added to the current query value, the future value R results_2neu, The MRP quantity S_x depends on the classification of the franking machine user as an A, B or C customer.

0153In a further variant, the disposition piece number S_x depending on the classification α_x of the franking machine user as an A, B or C customer and additionally determined as a function of his franking behavior:<maths id="math0007" num="(5)"><math display="block"><mrow><msub><mrow><mtext>S</mtext></mrow><mrow><mtext>x</mtext></mrow></msub><msub><mrow><mtext> = α</mtext></mrow><mrow><mtext>x</mtext></mrow></msub><msub><mrow><mtext> * R</mtext></mrow><mrow><mtext>8alt</mtext></mrow></msub><msub><mrow><mtext> * R</mtext></mrow><mrow><mtext>1old</mtext></mrow></msub><msub><mrow><mtext>/ R</mtext></mrow><mrow><mtext>2alt</mtext></mrow></msub></mrow></math><img file="EP0660269B1_D0008.tif" /></maths> or.<maths id="math0008" num="(6)"><math display="block"><mrow><msub><mrow><mtext>S</mtext></mrow><mrow><mtext>x</mtext></mrow></msub><msub><mrow><mtext> = α</mtext></mrow><mrow><mtext>x</mtext></mrow></msub><msub><mrow><mtext> * R</mtext></mrow><mrow><mtext>4alt</mtext></mrow></msub><msub><mrow><mtext> * R</mtext></mrow><mrow><mtext>1old</mtext></mrow></msub><msub><mrow><mtext>/ R</mtext></mrow><mrow><mtext>2alt</mtext></mrow></msub><mtext></mtext></mrow></math><img file="EP0660269B1_D0009.tif" /></maths> The data center monitors the behavior of the postage meter user based on data communicated during communication to detect suspect postage meters. A corresponding suspicious mode can only be activated by the data center, with no direct effects on the postage meter machine.

0154On the basis of the franking machine specific data, a postage meter profile can be created. This franking machine profile provides information on whether a customer was able to carry out the determined number of frankings with the reloading operations carried out. There are two different levels within the suspicious mode:<ul id="ul0002" list-style="none" compact="compact"><li>1. Postage meter is suspicious and</li><li>Second Postage meter machine must have been manipulated.</li></ul>

0155Various franking machine-specific data can be included in the calculation for determining the postage meter profile. In the range between a minimum franking value F_min and a maximum franking value F_Max The postage meter allows valid prints which are registered in register for R4. In addition, a zero value franking can take place. The following formulas are used one after the other:<maths id="math0009" num="(7)"><math display="block"><mrow><msub><mrow><mtext>V</mtext></mrow><mrow><mtext>susp1</mtext></mrow></msub><mtext> = </mtext><mfrac><mrow><mtext>R4</mtext></mrow><mrow><mtext>(R3 - R1)</mtext></mrow></mfrac><msub><mrow><mtext> * F</mtext></mrow><mrow><mtext>min</mtext></mrow></msub><mtext> = </mtext><mfrac><mrow><mtext>R4</mtext></mrow><mrow><mtext> R2</mtext></mrow></mfrac><msub><mrow><mtext> * F</mtext></mrow><mrow><mtext>min</mtext></mrow></msub></mrow></math><img file="EP0660269B1_D0010.tif" /></maths> and moreover, if R1alt <img file="EP0660269B1_D0011.tif" /> R1neu<maths id="math0010" num="(8)"><math display="block"><mrow><msub><mrow><mtext>V</mtext></mrow><mrow><mtext>susp2</mtext></mrow></msub><mtext> = </mtext><mfrac><mrow><mtext>R4new - R4alt</mtext></mrow><mrow><mtext>R1alt - R1new</mtext></mrow></mfrac><msub><mrow><mtext> * F</mtext></mrow><mrow><mtext>min</mtext></mrow></msub></mrow></math><img file="EP0660269B1_D0012.tif" /></maths><dl id="dl0002" compact="compact"><dt>R1_old:</dt><dd>R1 to the nth preset value</dd><dt>R1_New:</dt><dd>R1 in front of n + 1st distance reference</dd><dt>V_susp:</dt><dd>heuristic value that gives information about the state of the franking machine</dd><dt>F_min:</dt><dd>minimal franking value</dd></dl>

0156For a minimum franking value of eg F_min = 20 currency units results in the following case distinction:<dl id="dl0003" compact="compact"><dt>V_susp1 <5</dt><dd>okay (okay)</dd><dt>V_susp1 = 5 .. 100</dt><dd>suspicious</dd><dt>V_susp1 > 100</dt><dd>manipulated</dd></dl>

0157At regular intervals, a plausibility check of all franking machines in use is carried out in the data center. In this procedure, the machines are marked and reported to the postal authority, whose franking behavior has been suspected or manipulated.

0158In the franking machine, if necessary yet another security measure (Error Overflow Mode) provided. This can be performed in the second mode next to or instead of Sleeping Mode variant 1 or Sleeping Mode variant 2. Upon fulfillment of the query criterion in step 202, ie when a predetermined number of errors are exceeded, the reaction time of the postage meter machine slows down in step 203, whereby this status is simultaneously reported to the operator of the franking machine via the display. In the further steps can be proceeded similarly, as already explained in connection with Figures 2 and 5. The postage meter stores both internal and operator errors and manipulation attempts in an error register for protocol purposes, for example up to the number 999. If the state of exceeding the number of errors is not eliminated, for example as part of an inspection by a service or by resetting during communication with the data center, the reaction time can be further increased to make manipulation more difficult. The number of errors will then continue ie again up to a predetermined number, for example logged in step 213.

0159In a first variant, it is provided to increase the reaction time duration, for example the time duration until the beginning of the printing operation, linearly with the number of errors. The execution of the program is thereby neither modified nor prevented, but only delayed. In particular, such uncritical program parts which are not monitored by time supervision (kill mode 1) or flow control are called several times, such as, for example, the error display. Thus, the effect of the program remains essentially unchanged.

0160In a second variant, the reaction time is increased by one level, the stages seconds, minutes, hours, days, ..., etc. may relate.

0161In a modification or in combination with the aforementioned variants, an increase in the reaction time duration can also be provided for each incorrect operation. For this purpose, an electronic time lock is actuated in one embodiment. Preferably, a progressive increase of the reaction time period is provided in the operating program to make manipulation more difficult.

0162It is contemplated that step 213 may be invoked partially or wholly in conjunction with other steps as a sub-step. For example, the statistics and error mode is part of the step 203 and the billing and printing routine according to the step 406 in the franking mode 400, which is shown in more detail in Figures 4a and 4b. If a heavy billing error occurs, the machine is blocked in step 406 or step 208. However, if an error occurs during the initialization phase in step 101, the machine stops displaying a specific error code.

0163FIG. 2b shows a second variant of the flow chart according to the solution according to the invention. In step 207, not only the texture check of the register data is performed, but step 207 also includes a check of the register contents. If it does not conform to the fair condition query criterion, a kill mode flag is set in step 208 to lock the postage meter and then branched to point e. Therefore, even with locked franking machine all the desired inputs, communications with the data center, registers or Tests continue to be carried out.

0164The kill mode flag is only queried in the franking mode - in the manner shown in FIG. 4b - in step 409 before the actual accounting and printing routine (step 406). If the kill mode flag is set, the statistics and error evaluation mode (step 213) and the display mode (step 215) are traversed and then branched back to the system routine (point s).

0165Thus, the postage meter remains locked. On the one hand, the postage meter machine becomes operational again without unlocking, if the error has been eliminated, ie if, for example, a letter jam has been remedied or a credit has been reloaded.

0166On the other hand, there are serious mistakes that can only be lifted on the occasion of the next on-site inspection by a person authorized to do so. Such an error, for example, if the processor can not access the memory, ie can neither read nor change the data content of the RAM, for example, is eliminated by plugging a special RESET EPROM. For this purpose, the seal of the flap and the franking machine must be opened. The RESET-EPROM contains the required data, for example the aforementioned Y-code, and special programs for restoring the postage meter function. For example, such a program can undo a reduction in redundancy. The logging of the errors, which takes place separately during the operation of the franking machine in the statistics and error evaluation mode (step 213) according to types of error, is then checked by the authorized person to see whether a manipulation attempt has been made.

0167The invention is not limited to the present embodiments. Rather, a number of variants within the scope of the claims is conceivable.