A system for recording the initialization and re-initialization of an electronic postage meter

0001The present invention relates to an electronic postage meter system and, more particularly, to the process of re-initialization of an electronic postage meter system.

0002In a conventional electronic postage meter, it is known to provide the postage meter with a microprocessor control system mounted in a secure housing. The microprocessor control system includes a microprocessor, read only program memory and one or more secure non-volatile memories. The non-volatile memories are customarily protected from access by the user through the user interface of the meter or by an external communication device. The meter accounting and funding information is stored in the secure non-volatile memories which is sometimes referred to, in combination with the memory security circuit, as the meter vault. The information customarily stored in the vault is the ascending registers, which provides a historical record of all postage dispensed by the postage meter since the meter was placed in service, descending registers, which account for postage funds available for posting by the meter, a control sum which when combined with the ascending register and descending register reading provide register reconciliation, and a piece count register. Additionally, each meter serial number is stored in the secured memory. Specifically, the descending register can be accessed by the meter user for recharge only after receiving an authorization code from the manufacturer's data center. A known process for remotely resetting the meter descending registers is described in US Patent 3,792,446, entitled Remote Postage Meter Resetting Method, issued to McFiggans et. al. As an additional security measure, the meter control system is housed in a secure housing employing tamper detection, such as, break-off screws, etc., which provide visual evidence if an attempt has been made to gain unauthorized access to the control system.

0003It has been empirically experienced that due to anomalies common to micro control systems or operator error, that a meter is reported inoperable and taken out of service, when in fact, the meter is fully functionable. In order to evaluate the meter's operability, once the meter is taken out of service, it is presently necessary in many instances for the manufacturer's service center to remove the meter cover to gain access to the meter's control system and apply intrusive procedures in order to circumvent the meter's internal vault security. Additionally, it is necessary for the service center to access the vault in order to retrieve the fund resident in the meter secure memory in order to credit the customer or user's account. Also, it is necessary to access the vault of operable but returned rental meters so that the accounting registers and other internal systems may be reinitialized in preparation for redeployment of the meter.

0004It has been empirically experienced that often the service center determines that the returned meter is not defective. As a result, considerable unnecessary expense has been incurred in taking the meter out of customer service and transporting the meter to the service center. Additional expense has been incurred in removing the secure meter housing in order to check the control system since removal of the secure meter housing is destructive to the housing. With respect to rental return meter, again, additional expense is incurred in removing the secure housing in order to reinitialize the control system.

0005It is an objective of the present invention to present a method and apparatus for unlocking and permitting access to the meter serial number without intrusion within the secure meter housing while maintaining system security.

0006It is a further objective of the present invention to present a method and apparatus for providing an audit trail that permits a record of unauthorized access to the meter.

0007It is a still further objective of the present invention to present a method and apparatus for prevent re-initialization of the meter more than a preset number of times.

0008It is a yet further objective of the present invention to present an apparatus and method for allowing the meter to have its registers returned to zero while unlocked, but doing this in a manner which permits the historical postage consumed to be determined at a later date.

0009The postage meter includes a microprocessor based control system housed within a secure housing. The microprocessor control system is comprised of a programmable microprocessor in bus communication with a plurality of memories and an application specific integrated circuit (ASIC). At least one of the memories is non-volatile memory to which access is restricted in accordance to a security program in combination with a memory security module of the ASIC. The security module and micro control system programming restricts writing to or reading from the registers of the non-volatile secure memory except upon specific occurrences. One such occurrence is during the manufacturing process at which time the meter serial number is written and locked to a specific address location in the secure memory, during posting of postage dispensed by the meter and during meter recharge. Use of the term "locked" refers to the process of setting a flag which when set prevents the microprocessor from accessing an associated address location in a memory.

0010Maintained redundantly in the secure memory is an internal table referred to as the "REINIT table". When the meter is first assembled, the secure memory area associated with the respective REINIT tables, preferably in separate secure non-volatile memories, will not have been initialized. As a result, all the entries in the table will either (a) have an invalid CRC (Cycle Redundancy Check) or (b) have an improper "Magic Number" constant or both. The Magic Number is a discrete multi-byte number utilized in calculating the CRC to further reduce the chance of a random false positive in the CRC. If neither the CRC or Magic Number check in the respective REINIT tables, then the meter will conclude that it has never been initialized i.e., by observing that all the entries in both tables are invalid.

0011When the very first initialization of the secure memory is performed on the meter, the meter will sequentially perform: (1) set all the first record header entries in the REINIT table to the "Empty" state; (2) initialize all other areas of the secure memory other than the REINIT tables to appropriate initial values; and (3) overwrite the record header in the first REINIT table record to the "Cold Init" state. Following this, the meter is now in the generic meter state and is unlocked (i.e., manufacturing mode). The next step is to parameterize the meter and lock the memories. If, prior to the lock operation, the registers were set to a value other than that normally associated with the locking process, for example, during meter duplication, a "Register Set" entry is made in the record header of that record in the REINIT table. The data entries for the record now being created are the date and time of data entries, ascending register value, descending register value, piece count, universal piece count and a Delta ascending register value, i.e., the difference between the pre-existing ascending register value and the new value to which the ascending register is being set to.

0012If a second or subsequent Register Set operation takes place, set values will be overwritten within a new record. In this case, however, a Delta AR entry is updated, rather than overwritten, so that the new entry correctly reflects the change in the ascending registers since the cold entry or previous unlock operation. When the meter is locked, the record header overwrites the Register Set entry to a lock header. A new record contains the new appropriate ascending register (AR) value, change in the ascending register value (Delta AR), descending register (DR) value, Piece Count (PC) and piece count offset value (PC offset). The PC offset value is calculated to yield the correct piece count based on the current universal PC (UPC), which represents the number of trip operations which have taken place after the meter was last initialized.

0013Each record contains the register setting at the time of the unlock operation. This provides a permanent record from which the register values at the time of each Unlock operation. Only a fixed number of records are permitted to be made in the REINIT table. As a result, the opportunity for "burnout backup" will not be presented. Should either of the secure memories develop a random byte failure in this area, as evidenced by a write failure, the meter will fatal. In order to access the REINIT table subsequent to the manufacture of the meter, an access combination must be obtained from the manufacturer. As a result, the manufacturer has a record of all authorized entries into the REINIT table which can be used to verify the REINIT table records if fraud is suspected.

0014Fig. 1 is a schematic of a micro control system in accordance with the present invention.

0015Fig. 2 is a schematic representation of a secure memory map in accordance with the present invention.

0016Fig. 3 is a logic chart for the access procedure to the REINIT of the secure memories in accordance with the present invention.

0017The postage meter (not shown) includes a microprocessor based control system 11 housed within a secure housing 13. The microprocessor control system 11 is comprised of a programmable microprocessor 15 in bus communication with a plurality of memory units 17, 19, 21 and 23 and an application specific integrated circuit (ASIC) 25. The secure memories 21 and 23 are preferably non-volatile memories. Also, in bus communication with the ASIC 25, are a keyboard 26, a communication port 28 and a digital printer 29. Access to the non-volatile memories, as well as the program memory 17 and working memory 19, are restricted in accordance with the state logic of security module 27 of the ASIC 25. Of specific interest, the security module 27 in combination with the control system programming prevents writing to or reading from the registers of the secure memories 21 and 23 except upon specific occurrences. One such occurrence is during the manufacturing process at which time the meter serial number is written and locked to a specific address location in the meter, during posting of postage dispensed by the meter and during meter recharge. A more detailed description of the state logic of the meter security module 27 is presented in US Patent No. 5,377,264 entitled "Memory Access Protection Circuit With Encryption Key" and European Patent Application Serial No. 94119490.4 entitled "Memory Monitoring Circuit For Detecting Unauthorized Memory Access", both here incorporated by reference.

0018Referring to Fig. 2, each of the secure memory units 21 and 23 are mapped to have an ascending register addressable area 30, a descending register addressable area 32 and a piece count register addressable area 34. Also stored in a locked address area 36 is a table referred to as the REINIT table 38. Each table 38 record 1-6 will preferably having a record header which is one of the following: "Empty", "Cold Init", "Register Set", "Lock", or "Unlock". The record entries are: Date and time of REINIT try; AR value to which the AR register is set by this reset operation; DR to which the DC register is being set by this reset operation; Universal PC value at time this record is created; Delta AR since previous reset operation; and CRC for the entire record. Also, recorded in the current record is a PC offset value which is used to convert UPC into "external" PC and a "Magic Number" constant. The use of the Magic Number constant is intended to help prevent the 1-in-256 chance that the (random) CRC byte might match the random data. By using a multi-byte Magic Number as part of the record, and by choosing the Magic Number to be a value unlikely to appear in a random memory, the odds that a truly randomized entry will be erroneously seen as valid can be made as small as desired.

0019Referring to Fig. 3, when the meter is first assembled, the secure memory address area associated with REINIT table 38 will not have been initialized. As a result, all the entries in the table will either have an invalid CRC or have an improper "Magic number" constant or both. In this manner, the meter will determine that it has never been initialized by observing that all the entries in both tables are invalid. Specifically, upon meter power-up at logic setup 100, a check is performed at logic step 102. This check involves determining the CRC for the record and retrieving the Magic Number associated with the REINIT table 38 in each of the secure memories 21 and 23. A comparison is then performed between the respective CRC's and Magic Number of the respective REINIT table at logic step 104. If, at logic step 106, none of the entries match, then the meter is ready for a first initialization at logic step 108.

0020Then the very first initialize operation of the secure memories 21 and 23 is performed, at logic step 110; all the record headers and entries in the REINIT table are set to the "Empty" state; the remaining memory area, other than the REINIT tables is initialized to appropriate initial values; and the record header of the first record in the REINIT table is set to the "Cold Init" state.

0021Following this, the meter is now in the "Generic Meter" state, and is unlocked (in manufacturing mode). The next step is to parameterize the meter, at logic step 112, and then lock the motor, at logic step 114. If, at logic step 106, prior to the lock operation, the registers were set to a value other than that normally associated with the locking process, for example, during meter duplication then at logic step 116, a test is performed to determine whether an access combination has been entered and verified. If, at logic step 116, a combination has not been entered and verified, then the meter performs a check and verification between the respective REINIT table at logic step 122. If the verification is accomplished, then, at logic step 128, the meter is set to its posting or general operational mode. If, at logic step 116, an access code combination for the re-initialization operation has been entered and approved by any suitable process, such as, illustrated in US Patent No. 3,792,446 to McFiggans, then the meter is unlocked, at logic step 117, and is then placed in a mode to perform a register set operation and create a new REINIT record at logic step 118. At the time the record header is overwritten to a "Register Set" entry.

0022At logic step 119 the entries of the new record are entered. The Delta AR since previous log entry would be updated to reflect the change in the AR since the previous record. The meter is locked at logic step 120 and a check and verification is performed at logic step 122. If verified, the meter is placed in a posting mode at logic step 128. If at logic step 122, the verification is unsuccessful, the meter is locked up, at logic step 126, and will not operate.

0023When the meter is locked, the "Lock" entry overwrites the Register Set entry in the record header. If a lock operation is performed immediately after the meter is parameterized, without an intervening "Set Registers" operation, as part of the locking process, the record header entry is overwritten with a lock entry after the appropriate AR, DR and PC offset value has been written to the record. The PC offset value is calculated to yield the correct "reported" PC, that is, the piece count representative of the number of meter position operations since last initialization based on the current universal PC (UPC) less the PC offset value.

0024The REINIT table can accommodate six records which provide a permanent record of the register values at the time of unlock operation. If one attempted an unauthorized entry of the meter in the field in order to fraudulently reset the registers, a record of this operation would be in the REINIT table, as would any record of any modification of the registers. If the registers were modified, the amount of postage that was fraudulently issued can be determined by observing the "Delta AR" entry, plus the difference between the current AP/DR and the AR/DR at the time the registers were last reset and comparing to the records maintained by the manufacturer based upon information obtained when an authorized access code was last requested. A sufficiently knowledgeable user might attempt to return the meter to "original" status by unlocking the meter and then destroying the REINIT table. To prevent this, the meter would refuse to allow externally-requested writes to any locked recorder, unless a second input means were provided, to authorise this, such as installation of a Manufacturing Mode jumper. Utilization of the Manufacturing Mode Jumper requires the meter to be physically opened, leaving evidence of tampering. If the meter observes that either copy of the REINIT table is not valid at logic step 122, it will assume that it has been initialized. In this circumstance, the checks would be performed on each entry in both memory devices as part of the verification.

0025The afore description illustrates the preferred embodiment of the present invention and should not be viewed as limiting. The scope of the invention is defined by the appended claims.