Method for changing data charged in memory cells of an electronic franking machine

p0001The invention relates to a method of altering the charged in the memory cell data of an electronic machine, according to the type in the preamble of claim 1 and 9 below. This method improves the accessibility to the individual modules of the electronics, in particular a franking machine, without compromising their security.

p0002In one known from US 4,746,234 meter fixed and variable information is stored in memory means (ROM, RAM). If a letter on the conveyor path before the printing position activates a microswitch, this information is read out by means of a microprocessor to form a pressure control signal. Both are then assembled electronically to a print image and can be printed by thermal transfer printing means to an article to be franked envelope.

p0003For such postage meters, which provide a fully electronic generated impression for franking postal matter including imprint of advertising slogan, a non abgerechnetes valid franking must be prevented in the on state.

p0004Known franking machines included in at least one memory three relevant post Register for the spent sum value (ascending register), still available remaining credit (falling register) and register for a checksum. The checksum is compared with the sum of the spent sum value and from available credit. Already making it possible to check for correct billing.

p0005Basically, any action taken Franking is settled and any manipulation which leads to nichtabgerechneten Franking must be prevented.

p0006It has been suggested a remote inspection system for franking machines already in the US 4,812,965, which is based on specific messages in the impression of mailpieces which must be sent to the central office, or on a remote access via MODEM. Sensors within the meter to detect any falsification offense for in associated memories, a flag may be set, if it has been engaged in the meter for manipulation purposes. Such an intervention could be to invite not pay credit to the register.

p0007Upon detection of a manipulation, the meter is disabled during remote inspection via modem by an outgoing signal from the data center. A clever manipulation might on the other hand consist after making unbilled franking printing, return the flag and the registry to the original state. Such manipulation would not be recognizable on remote inspection by the data center, if this undone manipulation was before remote inspection. The reception of the card from the data center to which one to be carried out for inspection purposes Franking is to take place, allows the manipulator, the franking machine in sufficient time restore to the original state. So order is no greater safety distance.

p0008In EP 660 269 measures for greater security against manipulation in connection with an OTP processor (one time programmable) have been proposed without a special mechanical encapsulation of the safety components or a sensor for detecting the opened package is required. In particular, an OTP processor is proposed with internal non-volatile memory (NV-RAM). Data security can be increased by manipulation is detected by checking routines. However, such a special OTP processor will be available for purchase only at a higher price. Also, such a special OTP processor can not alone ensure data security, if not the entire program code required in the internal OTP-ROM is present stored. This is not to be expected in an extensive program code.

p0009In EP 660 269 is still starting from a meter that has a closable and sealed flap that only permits access to the underlying hardware (EPROM socket) a limited specifically trusted persons. Here could be assumed, that is done by these people no manipulation of the meter.

p0010The current approach to the basic setting of the franking machine in the manufacturing process foresaw the machine parameters through a reset software, which was made of the machine accessible by a reset EPROM and has been processed by the machine's own processor set. For this purpose, the reset EPROM was inserted into the external plate-base, and released the functionality by actuation of the default button.

p0011The fact that a program branch is performed by pressing the default key in the code area of ​​the external EPROM socket, making manipulation of the machine software by foreign EPROMs possible. Manipulation by the end customer would this indeed require the destruction of post closure, which technically capable manipulator with fraudulent intent but little can hinder to perform this step if he comes into possession of such a reset EPROM. For the custom changing some machine parameters, which are essential for the rental of franking machines, the trusted circle would have to be greatly expanded to persons who want to open the door post.

p0012This possibility of manipulation is not acceptable, since apart from the change of register states also the reading of the otherwise protected OTP own memory cells would allow. Furthermore, would the mail flap that protects the default button and the external EPROM socket through the post closure against established illegal access, legally accessible to a wider audience. Thus there is a higher probability of undetected manipulation. A partially opened postal flap would on the other hand the advantage that the user has access to the cliché-EPROM socket and can change the cliché EPROM independently. This service costs could be saved or limited to what is necessary at the postage meter. This base is connected to the microprocessor, that is a manipulation could take place so that a manipulator using a manipulated program EPROM, which takes over the control of the microprocessor system as a RESET EPROM, thus changing money values, messages or safety messages in the meter targeted or that a manipulated cliché EPROM uses that modified print data of the value stamp contains (location of the sender, postal code of the sender) and a manipulation of the value stamp impression would result.

p0013But in case a solution for a franking machine requires having a partially opened postal flap with which the security can still be maintained, additional measures for an external storage means (RESET EPROM or Service EPROM) must be taken that the in memory cells loaded data (for example, in NVRAM's) can change an electronic postage meter.

p0014It was to solve the problem of overcoming the disadvantages of the prior art and to achieve a significant increase in security of the franking machine. Within the meter, the safety-related parts of the program are to be saved, for those functions to be executed in service mode. The security cabinet is to be replaced by a housing improves access to individual components of the electronics for the service technician. Here, a processor without an internal NV-RAM to be used. Another object is to improve the security of data in the postage meter machine that are changed or entered in an action by the service technician or craftsman using an external storage means. Here are future program components are loaded, expand the original program and you want to run in service mode.

p0015The object is solved with the features of claims 1 and 9. FIG.

p0016The invention relates to a method of altering the charged in the memory cell data of an electronic franking machine, with a bus and a microprocessor in a control unit of the franking machine for executing steps for a routine that is controlled by an external storage medium, with call of a test routine, which takes place in a secure internal area of ​​an electronic postage meter, to determine the validity of data based on an authentication method comprising, a<ul><li>a1) providing a special EPROM having a key for the access authorization and is plugged into an associated EPROM socket, which prevent specific driver circuits (Buffer), which are connected between the bus and EPROM socket, the reading of postage meter data to the outside and wherein with the special EPROM via the EPROM socket a data structure from the outside is applied, which contributes under the action of a corresponding stored in the franking machine or an internal interpreter routine program for changing the Frankiermaschinenzustandes,</li><li>a2) entering a special mode for a check of access authorization of the electronic postage meter based on a plugged-in external suitably programmed read-only memory chip (EPROM) saved access key to enter into the special mode, the change of the loaded in memory cells of the electronic postage meter data permitted, the appropriately programmed pluggable read only memory chip (EPROM) contains an interpretable program</li><li>a3) loading of the program to be interpreted from the external plugged-read-only memory chip (EPROM), in the franking machine for controlling a routine in the electronic postage meter</li><li>b, to determine the validity of interpretable loaded program which instructions and / or data containing the predetermined space, wherein the determination of validity is based) calling a test routine that runs in a secure internal area of ​​an electronic postage meter to an authentication method and</li><li>c) modification of data in the meter when validity of the means of authentication method checked to interpret program loaded with calling for a step of initializing an interpreter routine steps an interpreter routine to change the data in the postage meter, the interpreter as a special routine, is stored in the postage meter machine program memory is activated by a via the external EPROM socket applied from outside, and copied into the franking machine data structure, and cooperating with the operating parts of the program stored in the postage meter machine program memory in order to interpret data by a plausibility check is carried out on the copy , with one access key provides access to the respective special mode and the aforementioned data structure includes information that is processed by the interpreter and wherein the aforementioned processor executes operations exclusively located in the code area of ​​the operating program in the postage meter program memory, or leaving the test routine of the postage meter if the interpretable loaded program is invalid, and said steps take place, to prevent further program execution for manipulation or a leading of the electronic postage meter to external program branching.</li></ul>

p0017The interpreter routine is before the existing system once and run a second time after the program part of the dealer functions. Accordingly, the data / program areas that are read for this purpose from the external storage medium, called the prologue and epilogue.

p0018It is envisaged that after the triggered for example by pressing a preset button start and after the entry into the special mode, which involves an examination of an access authorization, in one step first a copy of the prologue and epilogue in the internal data area of ​​the internal OTP-RAM is performed, a MAC checksum in another step by (DES) encryption of (CRC) checksum is formed over the PROLOG and EPILOGUE code area and the following test step a MAC comparison with or in the preparation programming of the special EPROM formed and stored in the special EPROM MAC checksum is performed on the PROLOG or EPILOG code area, and that, after steps for performing a plausibility check enclosing interpreter routine, another verification step is provided, of which one during processing program errors cases or cases that result in the termination of the interpretation process, notes or branches back for further verification step to execute other commands.

p0019The invention is preferably made of a processor that can be programmed only once (one time programmable). Increased security can be achieved for example with a mask-programmed microprocessor having outwardly ports and an internal bus structure, an internal ROM, internal RAM for security-related processes. security-related data and routines are baked during production in the internal Rome.

p0020Another preferred variant starts from a franking machine with microprocessor, the microprocessor includes an internal ROM that does not allow a reading of the code contained therein. This may be a commercially available OTP processor (one time programmable), the one set for the programming operation / burn a read lock in such a state displaced.

p0021The meter can also be equipped with an OTP type, which allows a reading of sensitive data and programs in an encrypted form (Encryption Table). This has the advantage that a control over is possible if the data has been stored properly.

p0022The invention is also applicable for secured otherwise microprocessor systems.

p0023The invention has the advantage to affect the program flow, which is predetermined by the internal operating software of the machine through an external storage medium, for which purpose any program branching of the CPU in the memory areas of the external memory medium, and thus no unintentional control of the processor becomes possible. To protect so the program flow can be integrated through external media program sequences of manipulation, prologue and epilogue are each secured by a MAC.

p0024As long as no program branch occurs in external storage means, there is a safe protection against fraudulent manipulation. In an advantageous manner with the parts of the program that are executed in the internal OTP-ROM, and a guard also externally stored program parts enables the present example, stored in an EPROM.

p0025It should be mentioned as an advantage that the cliché-EPROM must not only be only plugged or replaced by a service technician, but also integrates seamlessly with any other authorized person in the socket. Special driving circuits (Buffer) which is connected between bus and EPROM socket (Fig. 2), prevent the reading of postage meter data to the outside. On the other hand, can be entered via the base data in the franking machine at any time.

p0026The inventive method comprises the steps of:<ul><li>Press a preset button and checking an access authorization based on a plugged-in external read-only memory chip (EPROM) saved access key to enter into the special mode, and load the interpretable program from external plugged read-only memory chip (EPROM) in the meter,</li><li>Forming a first MAC checksum in the processor of the electronic postage meter via a first interpretable content (PROLOG) the contents of that external memory, wherein a first MAC (message authentification code) is assigned,</li><li>Comparison of formed in the aforementioned manner MAC checksum in the aforementioned processor with the data stored in external memory average value of the first MAC,</li><li>Performing a processing routine for processing the transmitted first memory content (PROLOGUE) in the aforementioned processor according to the interpretation of the charged interpretable program or exiting the test routine of the franking machine when the data is invalid and steps to prevent further program execution for manipulation or an the aforementioned processor externally leading program branch,</li><li>Conducting internal dealer routines the- modify data in memory cells of the franking machine,</li><li>Loading a further interpretable program from external plugged read-only memory module (EPROM) in the meter,</li><li>Forming a second MAC checksum in the aforementioned processor via a second interpretable loaded content (Epilogue) the contents of that external memory, wherein a second MAC is assigned (message authentification code)</li><li>Comparison of formed in the aforementioned manner MAC checksum in the aforementioned processor with the data stored in external memory average value of the second MAC,</li><li>Performing a processing routine for processing the transmitted first memory content (EPILOG) in the above-mentioned processor in case of equality of the aforementioned MAC's according to the interpretation of the loaded interpretable program and ending the processing routine EPILOG or preventing the carrying out of the check routine if an error is detected.</li></ul>

p0027The open service door allowed by a special EPROM via the external EPROM socket to create a data structure from the outside, which contributes to the change in the Frankiermaschinenzustandes under the action of an internal interpreter, for example, after pressing the hidden means of a sealed postal flap and thus protected preset button.

p0028It is contemplated that the interpreter cooperates as a special routine stored in the postage meter machine program memory is activated by a voltage applied via the external EPROM socket from the outside data structure, and with the operating parts of the program stored in the postage meter machine program memory to interpret data. In each case, an access key provides access to the respective special mode in which the aforementioned data structure includes information that is processed by the interpreter and wherein the aforementioned processor to perform operations that are located exclusively in the code area of ​​the operating program in the postage meter program memory.

p0029Interpreter routines can in principle also run in retail mode. It is envisaged that several areas are provided in the external storage medium containing code to be interpreted, the individual areas are protected by MAC. It is a mode for execution of service functions with execution of interpreter routines within the routines for service functions provided when these interpretable code routines are called from the keyboard, which assigned when pressing an on a Frankiermaschinentastatur key of this key area of ​​the external storage medium is loaded into the franking machine, authenticated and interpreted in accordance or else, if not to interpretive code that is assigned to key that will then continue with the normal processing of the keystroke.

p0030In a further embodiment, the method is characterized by the steps<ul><li>Transmitting a predetermined externally stored MAC value into the OTP RAM for volatile storage and forming of a first MAC checksum in the OTP processor via a first (PROLOG) the contents of that memory, wherein a first MAC is assigned to</li><li>Entry into the mode for execution of service functions and performing routines for service functions with interpreter routines and exit the mode for execution of service functions</li><li>Transmitting a predetermined externally stored MAC value in the OTP-RAM for permanent storage and forming a second MAC checksum in the OTP processor via a second (Epilogue) the contents of that memory, which a second MAC is assigned.</li></ul>

p0031Advantageous developments of the invention are characterized in the dependent claims and described in more detail below together with the description of the preferred embodiments of the invention with reference to FIGS. Show it:<dl id="dl0001" compact="compact"><dt>Figure 1,</dt><dd>Block diagram of a postage meter,</dd><dt>Figure 2,</dt><dd>Variant with OTP in the control device of the franking machine,</dd><dt>Figure 3,</dt><dd>Building a data set which can be processed by the interpreter, </dd><dt>Figure 4,</dt><dd>Flow diagram for the schematic configuration of and data flow of the interpreter,</dd><dt>Figure 5,</dt><dd>Flowchart for the logical integration of the interpreter in the internal service functionality.</dd><dt>Figure 6,</dt><dd>Flowchart for a merchant mode with interpretation on key press</dd></dl>

p00321 shows a block diagram of an electronic postage meter with inventively enhanced security is shown. The invention is based on a franking machine with a microprocessor that includes an internal OTP-ROM that does not allow readout of the program code contained therein. In addition, security-related data in the internal OTP-ROM is stored. To prevent the reading by an external intervention corresponding security bits can be set during manufacture of the meter in the microprocessor. This may be a commercially available OTP processor, the one set for the programming operation / burn a read lock in such a state displaced or is this may be a microprocessor with mask programmable ROM, which is no longer allowed by the manufacturing process, a reading of the code, or just a reading the program code and the data allowed in encrypted form.

p00331 shows a block diagram of the inventive postage meter machine with a printer module 1 for a fully electronically generated franking, with at least one more actuators having input means 2, a display unit 3, a communication producing a data center modem 23, further input means 21 or scale 22 which over an input / output control module 4 are coupled to a control device 6, and with non-volatile memories 5a, 5b, 9, 10 and 11 for data or programs which include the variable or constant parts of the franking impression.

p0034A character memory 9 supplies the necessary print data for the variable parts of the franking to a volatile memory 7. The controller 6 comprises a microprocessor uP, of the I / O control module 4, the character memory 9, the volatile main memory 7 and with non-volatile main memories 5a, 5b, comprising a cost center memory, a program memory 11, with the motor of a transport or feed device optionally with stripes tripping 12, an encoder (encoder) 13 and a clock / date module 8 communicates. The individual memory can be realized summarized in several physically separated or in a manner not shown in a few blocks. The one memory module, which includes the non-volatile memory 5b may be an EEPROM, for example, the. By at least one additional measure, for example, glue on the circuit board, sealing or potting with epoxy resin, is secured against removal

p0035In the figure 2 shows a detail of the block diagram of the electronic franking machine for a variant with OTP is shown in the control device. With this basic arrangement in Figure 2, such as the encoder shown in Figure 1 and 13 motor 12 Sensors and actuators can be connected either directly or via I / O ports with the OTP.

p0036A preferred variant of a microprocessor is an 8051 processor with 16kB on-chip EPROM (Philips 87C51FB) Such OTP type (One Time Programmable) can not be erased by ultraviolet light, because this does not have to UV light through suitable window , Therefore, an OTP can be programmed only once. The internal OTP-RAM has a memory area of ​​256 bytes.

p0037The invention further assumes that security-relevant data and program components that are present stored in the internal OTP-ROM, include an interpreter.

p0038The interpreter is a special routine stored in the internal OTP ROM, is activated by a voltage applied via the external EPROM socket from the outside data structure that interacts with the operating parts of the program stored in the internal OTP ROM in order to interpret data.

p0039It is envisaged that a respective enrollment key enables access to appropriate special mode that the aforementioned data structure includes information that is processed by the interpreter and that the OTP internal CPU performs operations that in exclusively in the code area of ​​the operating program internal OTP-ROM are.

p0040The interpreter has been integrated in the operating software and processes defined data structures of the external EPROM respectively at the beginning and end of the merchant mode. This is achieved according to a selective modification of memory cells of the machine allows. Thus, additional operations can be performed without changing the software ourselves and without allowing the acquisition of program control by branching in the external code area by an update of the external service EPROM.

p0041In another - in the figure 6 shown in detail - Description of performed in retail mode step also includes 35 (Figure 5) a one execution of interpreter routines (steps 3717, 3727, 3737). These multiple areas A, B, C are provided in the external service EPROM containing interpretable code, the individual areas are covered again by MAC. Thus, in the meter subsequently functionality are introduced, which was not previously available. For a method for performing interpreter routines within the routines for traders functions can interpretable code routines using the keys a, b, c of the keyboard 2 called. So may be present in the external service EPROM in the field A space for your own routine, which is called by an actuating or input means, for example by an on the Frankiermaschinentastatur a button. This is checked in step 3711 and then branched to a verification step 3712 to check at which button is pushed a whether a corresponding code in EPROM area A exists. Is not to interpretive code available, the process continues with the normal processing of the keystroke using the standard functions that are stored within the postage meter machine in step 3713th Otherwise the interpretable code is loaded from the external service EPROM in the postage meter machine in step 3714, authenticated at step 3715 and interpreted in determined in step 3716 match in step 3717th An error occurring in the machine routine can thus be replaced or supplemented. For a query of the operation of b or c or an appropriate response to steps of 3721-3727 or 3731-3737.

p0042According to the software for the Merchant and reset mode in the interior has been (that is, in the internal EPROM and / or internal OTP-ROM) moved the machine, so that in these modes do not jump branch in the code area of ​​the external memory, with where the memory cells can be altered, is performed. The further external reset and employed service or merchant EPROMs included to each a 64-bit key, which only allows access to the respective modes. The CPU therefore only operations that are in the code range of the machine software, which is also protected from tampering by a cyclic MAC check. In order not to invoke the functions of reset mode, which thus are located in each machine to manipulate the functionality of this mode is limited such that no increase in the amount of money or a change of telepostage parameters is made possible.

p0043By an external memory medium, the franking machine is put into a special operating state in which the data state of memory cells can be changed. Data or program code to be transferred from an external storage device that is connected to the meter by the machine-internal microprocessor in a memory of the postage meter. The data / program area includes a MAC that is authenticating the area. The verification of the validity is performed by the microprocessor of the machine to the copy. Are the data / code plausible, they are either processed directly by the microprocessor as a program code, or interpreted by an interpreter software that controls the microprocessor. Not factor authenticated data / program areas are not further processed. The processing of external information supplied is used for altering the machine's internal memory cells. Since the external data / program areas are not processed directly by the processor, but always the internal copy is based on, the CPU can not be controlled by external, malicious program areas.

p0044The function of the interpreter is explained in detail with reference to the Figures 3 to fifth

p0045In the figure 3, the construction of a data set is shown, which can be processed by the interpreter. The information that can be processed by the interpreter is formed by a series of instructions, which basically consist of a record with three components. A first component OPERATION features to be executed by the respective instruction operation. A second component TYPE indicates the type of the value, which has been given in a third component VALUE.

p0046The TYPE specifies some instructions on how the value of the program line or the stack or the addressed memory area is to be typed. If no type specification required for the instruction, the type is specified as T_None.

p0047An interpretable information contained in the Service EPROM consists of n lines. The lines of the program are numbered in ascending order from 0 and can be addressed for the execution of jump instructions. Each program line has the aforementioned structure: OPERATION; TYPE; VALUE. In another variant, also unary operators (no TYPE, no VALUE) are permitted.

p0048The instructions refer to a 12-stage stack memory and allow for example the reading of memory cells, the execution of logic and arithmetic operations on the stack and the stack storage of entries in the memory cells of the machine. It can code, and all the memory cells of the machine are addressed. To control the program flow during the interpretation is a logical comparison operation with the associated, conditional and unconditional jump commands.

p0049The flow chart shown in Figure 4 shows the schematic configuration of and data flow of the interpreter. The interpretable data structure in the external EPROM must of course be protected from possible manipulation by appropriate measures, as are access and to manipulate all data storage areas of the machine by the interpreter. In the service EPROM are two interpretable storage areas. They are, in relation to the timing of their interpretation, as a prologue (block 91) and epilogue (block 93), respectively. Each area is protected by a MAC checksum (block 90 and 92). Before the data structure is processed in the steps 35 and 42, the interpreter creates a copy of the structure and MACs (steps 31 and 38) in the internal RAM of the machine and then transferred to the copy of a plausibility check (steps 33 and 40) through. Working on an internal copy of this prevents the external manipulation of the program during its interpretation.

p0050When working above contained in the prologue to interpretive code words are interpreted step by step until it reaches the end (or an error has occurred). Basically, prologue and epilogue differ only by the date on which they are running. So data, this data can be restored thereafter again in the prologue be saved before starting the machine-internal Dealer routine and in the epilogue.

p0051The flow chart shown in Figure 5 shows the logical embedding of the interpreter in the internal service or dealer functionality.

p0052The structure in the service EPROM is formed by a table in which each line consists of the components operation, the data type of the value or the operation and the value. In addition, the structure shown in Figure 3 a set of data which can be processed by the interpreter, each row may include a fourth component for the description of the command. The table is processed line by line by the interpreter. The order of execution can be influenced by Jump operations.

p0053After the start in step 30, which is triggered by the actuation of the default button is made in step 31, a copy of the prologue in the internal data area of ​​the internal OTP RAM. A MAC checksum is formed in step 32 by DES encryption of the CRC checksum of the prolog code area. When creating and programming the EPROM a MAC checksum of the prolog code area has already been created and stored in the EPROM. To authenticate the data in the prologue code area of ​​the external EPROM used is carried out in step 33, a comparison of the permanently stored in the internal OTP-RAM MAC's with the MAC permanently stored in the external service EPROM. When a mismatch of both MAC's to step 37 is branched. In an agreement between the two MAC's is otherwise branches to initialize the interpreter to step 34th In the subsequent step 35, a command is read out and processed from the internal data area of ​​the internal OTP ROM. In step 36 it is checked whether an error or the end of the command execution has been reached. If an error or end of instruction execution to step 37 is branched. Otherwise, the method branches back to step 35th

p0054First, the instruction pointer points to the first to be processed codeword. In step 35, the code words are successively loaded into a processor register. Approved code words are then processed by a special routine for processed. After each code word of the instruction pointer is increased. Requires an instruction and data, they are also loaded and the instruction pointer is increased (eg. As the target of a branch after a comparison or an address). Certain interpretable code words used for branching the program; then the instruction pointer is set to a different location and processing continues at this point. If an error occurs or the end code is detected, the processing is terminated.

p0055In step 37 internal service or dealer functions are performed, which are present stored in the internal OTP-ROM as a program code. Among them are appropriate entries for example via the Frankiermaschinentastatur or comparable operating or input means to understand which are to be made to, for example:<ul><li>changing customer number</li><li>enter new PAN</li><li>To change phone number</li><li>Limit warning to change.</li></ul>

p0056is from step 37 to step 38 then advanced further to process the epilogue accordingly. Copying is carried out in the epilogue in step 38 into the internal data area of ​​the internal OTP RAM. A MAC checksum is formed in step 39 by DES encryption of the CRC checksum of the epilogue code area. In manufacturing or programming of the EPROM a MAC checksum of the epilogue code area has already been created and stored in the EPROM. To authenticate the data in the epilogue code area of ​​the external EPROM used is carried out in step 40, a comparison of the permanently stored in the internal OTP-RAM MAC's with the MAC permanently stored in the external service EPROM. When a mismatch of both MAC's to step 44 is branched. In an agreement between the two MAC's is otherwise branches to initialize the interpreter to step 41st In the subsequent step 42, a command is read out and processed from the internal data area of ​​the internal OTP ROM. In step 43 it is checked whether an error or the end of the command execution has been reached. If an error or end of instruction execution to step 44 is branched. Otherwise, the method branches back to step 42nd In step 44, the process is terminated.

p0057When a program is executed the following error cases may arise which result in the termination of the interpretation process:<ul><li>Stack capacity is insufficient, or the stack does not contain enough entries for the requested operation.</li><li>Violation of data type restrictions surgery</li><li>Interpretation of an unknown operation.</li><li>Leaving the program area by an invalid jump destination.</li></ul>

p0058The interpreter has a limited stack (set depth: 12 items). On the stack, the values ​​are stored as a structure of long value (32 bits) and data type.

p0059One such settings based on initialization of the franking machine is effected before assembly of the franking machine by means of a reset or master EPROMs. The setting example of a serial number of the postage meter or a customer number or other settings can be made at any time by means of a repeated service EPROM. When a Service EPROM has the service flap, which releases the EPROM socket, are open. In this state, with the inserted service EPROM, a normal operation of the franking machine is not possible. After checking the appropriate 64-bit access key and the authenticity of the data by the test routine, the access permission is granted and invoked the associated program, for example, to change the serial number. Using the keyboard 2 modem 23 or other input means 21 (for example, smart card reader / writer) of the franking machine can enter a number or alphanumeric characters can be entered, which are displayed in the display unit 3 data, it carried out specific next steps to perform to remove the machine number or re-enter or change.

p0060It can be made not only customer numbers or other settings that are related to the service or merchant mode. In principle, serious mistakes at the next on-site inspection may be superseded by an authorized person. Such an error, for example if the processor can not access the main memory, that is, the data content of the RAM can not read or change can be eliminated, for example by inserting a special SERVICE EPROM. To this end may have a sealing of postal flap eliminates the Default key and the service door be opened for external EPROM socket. The meter is thus at least partially opened and ensures accessibility to the individual components of the electronics from the outside. The SERVICE-EPROM contains the required data, such as the appropriate key, and special programs for the restoration of Frankiermaschinenfunktion. For example, such a program can make a reduction was made redundant or incorrect stores undo. If a subroutine is called to change, for example, the values ​​in the registers, carried out specific next steps to perform to remove the registry entry or re-enter or change.

p0061For example, results in the following scenario: The routine for the manual input of the postage call number, which is located in the internal operating software of the machine turns out in the field as being defective by, for example, the serial number of the machine incorrectly overwrites. Since this feature is in the internal EPROM of the machine, it can only be corrected by an update of the operating software, which means the opening of the machine and changing the internal EPROM, and possibly of the OTP processor. Aside from the hassle the dealer, these operations are not allowed.

p0062The integrated interpreter now offers the following option: The machine developer sends an update of the service EPROM to dealers. It contains a prologue, which copies the memory contents of the serial number in a free, temporary storage of the machine. Although the merchant function to change the postage call number destroyed to continue the serial number, it can now, however, by an appropriate epilogue, which is called at the end of the dealer functionalities are restored from the copy of the prologue.

p0063The method for changing the loaded data in memory cells is also suitable for other electronic equipment which are equipped with a microprocessor in a control unit for executing steps for a routine that is controlled by an external storage medium. The following steps are provided,<ul><li>a) entering a special mode, which allows variation in the loaded memory cell of the electronic engine data,</li><li>b) calling a test routine that runs in a secure internal area of ​​an electronic postage meter, to determine the validity of a program code and / or data in the predetermined space based on an authentication method and</li><li>c) plausibility check and modification of data in the memory cell of the electronic machine in validity of verified means of authentication method program codes and / or data and their plausibility or leaving the testing or checking routine of the electronic machine when the data is invalid or not plausible and steps to prevent further program execution for manipulation or a leading from the electronic machine according to externally program branching.</li></ul>

p0064The method uses an interpreter as a special routine stored in the internal OTP ROM, is activated by a voltage applied via the external EPROM socket from the outside data structure, and cooperating with the operating parts of the program stored in the internal OTP ROM in order data to interpret, in each case, an access key provides access to the respective special mode and the aforementioned data structure includes information that is processed by the interpreter and the OTP internal CPU performs operations that are exclusively in the code area of ​​the operating program in the internal OTP ROM are.

p0065The interpretation of the prologue and epilogue data structures according to the invention used for processors with strict separation of program and data memory.

p0066In modern processors this separation no longer exists, so that the data structure in this case also, by the processor directly processed machine instructions can be formed, the first copied into the machine and, after passing the examination, can be called as a subroutine. Thus, the functionality would no longer be limited to the operations of the interpreter language, but would correspond to the full power of a programming language.

p0067The invention is not limited to the present embodiments. Rather, a number of variants are conceivable, which make use of the described solution even for basically different configurations.