EP0660270B1 - Method and device for generating and checking security imprints - Google Patents

Description

The invention relates to a method for generating and checking a security imprint, which is applied to a postal matter by the printing device of a franking machine in franking printing in addition to the postage and daily stamp.

In particular, franking machines are considered that deliver a fully electronic impression for franking mail, including an advertising slogan and a mark. The franking machine is equipped with at least one input means, one output means, one input / output control module, with storage means, a control device and a printer module.

A franking machine generally creates an imprint in a form agreed with the post right-aligned, parallel to the upper edge of the mail item, beginning with the content of the postage value in the postmark, the date in the day stamp and stamp imprints for advertising slogans and, if applicable, the type of shipment in the election print stamp. The post value, the date and the type of shipment form the variable information to be entered according to the piece of mail.

The postage value is usually the transport fee paid in advance by the sender, which is taken from a refillable credit register and used to clear the postal item.

The date is a current date or a future date in a postmark. While the current date is automatically provided by a clock / date module, the desired future date must be set in the case of manual pre-dating. Pre-dating is interesting in all cases where the volume of mail is processed and franked very early, but has to be dispatched on a certain date. The variable data for the date can be embedded in the day stamp as well as when the postal value is printed.

The approved advertising clichés can contain a wide variety of messages, in particular the address, the company logo, the mailbox and / or any other message. The advertising cliché is additional information in the postal sense that must be agreed with the postal authority.

From US 4,580,144 an electronic franking machine with two thermal printing devices is known, with the first the fixed printed image part (postal code and picture frame) and the second the variable printed image part (postage and date) being printed one after the other. The printing speed can be increased by this division and separate treatment of the variable and constant data. However, due to the missing "fingerprint", there is no security imprint in itself.

DE 38 23 719, on the one hand, discloses a security system with a character printing authorization device. A computer of the franking machine is assigned a memory for the data to be loaded, the graphic change and the data of the associated date. When the user searches for a change in funds, the computer of the franking machine accesses an external dialing device via a connection device (modem) which selects a character pattern to be printed. The disadvantage here is that the user of the franking machine is not given freedom of choice for the selection of the character pattern. It is envisaged that the printed character pattern will be used to check the security of the authorization of the franking machine. Here, however, the entire printed image having that special character pattern is to be evaluated by the postal authority, which is only possible with great effort.

For franking machine printing, on the other hand, it has already been proposed to apply certain hidden or cryptified characters, bar code, to the mail item as visible or invisible markings with several print heads in order to be able to identify forgeries.

• a. Generieren einer Kombinationszahl, wobei eine stetig monoton veränderbare Größe und eine den aufzudruckenden Portowert repräsentierende Größe zur Bildung der Kombinationszahl zur Verfügung gestellt werden;
• b. Verschlüsseln der Kombinationszahl zu einer Kryptozahl;
• c. Drucken der Kryptozahl als Sicherheitsabdruck mittels eines vorgegebenen Satzes von Symbolen in mindestens eine Reihe von visuell und maschinell auswertbaren Markierungssymbolen.

US-A-4,775,246 discloses a method for generating a security imprint which is applied to a postal item by the printing device of a franking machine in franking printing in addition to the postage and daily stamp, a step being carried out by the microprocessor of the control device of the franking machine prior to a printing request, the following sub-steps include:

• a. Generating a combination number, whereby a constantly monotonically variable variable and a variable representing the postage value to be printed are provided to form the combination number;
• b. Encrypting the combination number into a crypto number;
• c. Printing the crypto number as a security imprint using a predefined set of symbols in at least one row of marking symbols that can be evaluated visually and by machine.

In US 4 934 846 (ALCATEL) a machine-readable bar code is printed in a separate field next to the postage stamp, but this disadvantageously reduces the available printing area for the postmark and / or the advertising slogan.

Such a bar code by means of a separate printer is known from US Pat. No. 4,660,221 and US Pat. No. 4,829,568, the latter patent also printing a character with offset elements, the offset of which contains the relevant security information. The printing device is supplied with variable data from a storage device on the one hand and data from an encryption circuit on the other hand by means of a selection device. In the field provided for the variable data, alphanumeric characters with mixed-in areas (SPECKLE) are generated and printed on the print medium. According to US Pat. No. 4,641,346, the evaluation is carried out by reading such a character column by column and comparing it with stored characters column by column in order to recover the security information. In this case, the data originating from the encryption circuit are separated again, for which a further device is required. The evaluation is accordingly complicated and can only be accomplished using complex equipment and qualified postal authorities.

For a batch mail processing with a service device, according to US 4,760,532, by means of which each item of mail does not have to be franked individually, but instead a postage and an additional passport are printed, a postal code in bar code format has already been proposed to print the postal matter. You can work with a fast, relatively inexpensive, unsecured printer, which also prints the recipient address. If there is evidence of tampering with the accounting unit of the service device, an incorrect postal code is printed in the form of a bar code. The data listed on the passport with a secured printer about the batch of mail is electronically transmitted from the service device to the central station after each batch has been processed. In this way, the post office can, if necessary, compare the data printed on the passport with the data stored electronically in the central station if a mail marked as manipulated is found. This invalid manipulated mail marked in this way can only be sorted out in the post office if the entire post is checked continuously in the post office. In terms of the result, this effort is far too high, especially since only one manipulation on the service device but other manipulations on the post on the way to the post office cannot be determined.

EP 540 291 A discloses a device for analyzing post meter use for counterfeiting purposes, which is based on a post-calculation system. The functioning of the system is also dependent on the scanning of the entire mail flow. The individual franked values are scanned, summed and then with the reload amount for the corresponding one Franking machine compared. Although data is automatically entered here with an OCR reader (Optical Character Recognition) and complex computer technology is used, this type of data acquisition is relatively unsafe and too slow for a post office, especially since the entire mail would have to be evaluated in this way.

Crypted data is printed in the address field in accordance with US Pat. No. 4,725,718. It is also known to carry out a comparison of plain text data with the crypted representation of this data, including the address data, for evaluation. Although a relatively large amount of space is used for the crypted data in the address field and the generation of the crypted data also has to be complex and using a special encryption module, this system is not completely forgery-proof, because an encrypted text composed of segments is generated from the individual output data related to the aforementioned segments, which could be explored through long-term observation. This also applies if it is printed as a barcode or in another machine-readable form. This solution is unsuitable for franking machines without address printing - since it is not possible to include the address data in the encryption. Franking machines with a non-mechanical printing principle that are already in operation cannot be used to generate a marking for a security imprint due to the additional special encryption module required. Finally, the problem remains that the display of additional information, especially in the form of a bar or bar code, requires a relatively large amount of space.

A security system known from US Pat. No. 4,949,381 uses imprints in the form of bitmaps in a separate one Marking field under the franking machine stamp imprint. Although the bitmaps are packed particularly densely there, the required relatively large marking field reduces the height of the stamp image by the height of the marking field. This means that much of the space that can be used for an advertising slogan is lost. Another disadvantage is the necessary high-resolution recognition device for evaluating the marking with the two-dimensional barcode, which is unacceptable for smaller post offices, which cannot drive the effort for an automatic evaluation. Thus, the disadvantage remains that such codes can only be checked automatically, ie no longer manually.

According to US 44 61 028 (DE 31 41 017), a check is carried out with the aid of reference samples which have already been used when checking a predecessor stamp. This method is unsuitable if variable data is printed in encrypted form with every printout and if the evaluation must take place in real time.

Another security system uses imprints in the form of a diagram (US Pat. No. 5,075,862) within the franking machine stamp imprint. However, if individual print elements have failed, dots are missing in the print image, which can signal an alleged forgery. Such markings in diagram form within the franking machine stamp imprint are therefore not so secure. Mechanical evaluation is difficult even with an error-free print, since the entire printed image must always be evaluated.

Furthermore, DE 40 03 006 A1 has proposed a method for identifying mail to enable franking machines to be identified, a multi-digit crypto number including the date, the machine parameters, the post value and the advertising slogan being formed and cached separately becomes. The crypto number is additionally inserted into the print pattern during printing via a printer control which sets the printer means. Thus, a counterfeit or any imitation of the franking machine stamp can be identified by means of the crypto number by means of a postage imprint that has not been billed. Even with a large number of users of a single franking machine, the user who manipulated the postage value can easily be found out. However, this is neither a fully electronically generated print image for an impact-less printer, nor can such a print image be evaluated electronically in a simple manner.

For security reasons, it has already been proposed in DE 40 34 292 for a fully electronically generated print image to store only a constant part of the franking image in the franking machine and to send the other associated variable part from the data center to the franking machine in order to assemble the final printed image , In this solution, the fully electronically generated advertising cliché is just as much a part of the constant data of the franking image as the frame arrangement of the value and day stamp with location and, if applicable, the postcode.

For the compilation of print data, communication of the terminal device containing a franking module with a central office is necessary for each franking. This delays printing, which also makes this solution unsuitable for mass franking of large volumes of mail.

In the case of a franking machine known from US Pat. No. 4,746,234, fixed and variable information is stored in storage means (ROM, RAM), so that when a letter actuates a microswitch on the transport path before the printing position, by means of a microprocessor read out and to form a pressure control signal. Both are then electronically assembled into a print image and can be printed on an envelope to be franked using thermal printing media. With a large number of variable window print image data to be integrated, the formation of the print control signal is delayed accordingly. The maximum print speed that can be achieved with the same postal data is limited in particular by the time required for the formation of the print control signal. An additional material effort would have to be made or the reduction in printing speed would have to be accepted if a crypto number was to be calculated from the data in order to generate a marking for a security print. In both cases, such a machine (high price and / or too slow) would ultimately result in a lack of customer acceptance.
The advantage of such a marking lies in the fact that a franking stamp printed by a franking machine could not be changed by a manipulator without a corresponding change in the marking, because a franking stamp with a not applicable marking that has been changed with a forgery can basically be recognized. On the other hand, it would be necessary to determine the manipulated franking machine, the function of which was interfered with for manipulation purposes.

A remote inspection system for franking machines has already been proposed in US Pat. No. 4,812,965, which is based on special messages in the printing of mail pieces which have to be sent to the central office. Sensors within the postage meter machine are intended to detect any counterfeiting act that has been carried out, so that a flag can be set in associated memories if the postage meter machine has been tampered with for manipulation purposes. Such an intervention could be done to load unpaid credit into the registers. Such a system cannot disadvantageously prevent a sufficiently qualified manipulator, which breaks into the postage meter machine, from subsequently removing its traces by deleting the flags. It also cannot prevent the impression itself from being manipulated, which is produced by a properly operated machine. In known machines there is the possibility of producing impressions with the postage value zero. Zero frankings of this type are required for test purposes and could also be falsified subsequently by simulating a postage value greater than zero.

The task was to solve the disadvantages of the prior art and to achieve a significant increase in safety without an extraordinary inspection on site. With a security imprint, an evaluation is to be made in an uncomplicated manner as to whether manipulation of the mail piece or the franking machine has been carried out.

The object is achieved by a method for generating a security imprint according to claim 1 or by a method for checking a security imprint according to claim 20.

An arrangement for generating and checking a security imprint consists of a franking machine with a microprocessor in a control device, which encrypts the marking pixel image data and inserts it into the other fixed and variable pixel image data during printing.

Advantageous refinements of the method according to the invention are specified in the subclaims.

An arrangement for checking has a marker reading device, consisting of a CCD line scan camera, D / A converter, comparator and encoder, which are connected to an input means via an input / output unit. In order to evaluate marking data by means of a computer, storage and output means, the input means is connected to the data center.

A first variant of the verification of a security imprint with a row of marking symbols begins with the transmission of information from the data center to the postal authority regarding those franking machines that have not loaded any credit for a long time or have not reported to the data center and therefore appear suspect.

The solution according to the invention is based on the knowledge that only data stored centrally in a data center can be adequately protected against manipulation. Corresponding register values are queried during communication, for example in the context of a remote value specification of a reload credit.

The inflated credit amounts, which add up in the franking machine, are ultimately used up during franking. Thus, in a calculation by the data center, the average credit inflow is compared with the outflow of credit (postage consumption) in order to analyze the previous use of the franking machine and to predict future user behavior.

The franking machine, which receives a regular credit reload or reports regularly to a data center, can be classified as unsuspicious. However, the franking machine that continues to operate beyond a predicted reloading date without reloading does not necessarily have to be manipulated. Rather, the volume of mail to be processed by the franking machine may have decreased above average. So if there is still sufficient residual credit available in the franking machine, a user must of course be allowed to continue franking. In this case, only an extraordinary inspection on site could clarify whether there was any manipulation. However, a franking machine user with irregular franking and credit reloading behavior can postpone this inspection if he reports to the data center as soon as he receives the information that his franking machine is considered suspect. The data center then carries out a remote inspection. For security, it is proposed according to the invention to use both measures, i.e. a remote inspection of the franking machine by the data center and a check of the mail items in the post office or an institute commissioned to do so.

The invention is based on the one hand on the consideration that the user who manipulated would either have to bear increased effort if he tried to undo his manipulation in order to report in time to the data center, which queried the register values, or else would only report irregularly or no longer. At the same time, it is provided that intervention in the franking machine function for manipulation purposes is also made as difficult as possible by the safety design of the franking machine by means of a sensor and detector device. This means that there is a significant increase in safety without an extraordinary inspection on site.

On the other hand, a security imprint with separate areas for the marking information is made by the franking machine on the item of mail. The inspection of the franking machine on site can be replaced by checking a row of marking symbols by a responsible body, preferably at the post office. Only in justified cases (manipulation) would an inspector or person authorized to perform an on-site inspection have a direct inspection of the franking machine on site.

Because only a separate area that exclusively contains the marking information is to be evaluated, the postal authority can differentiate between the manipulated with the intention of forgery from such unmanipulated franking machine imprints in an uncomplicated manner and relatively easily. With the row of symbols used as marking information, an evaluation is easily possible, also with regard to a reference to a machine that has been mimicked by the manipulator or that has been manipulated and with regard to a reference to the machine that the user continued to operate after the remote inspection date.

In its compressed representation, the row of marking symbols also printed for security purposes is based on an encrypted combination number, the digits of which are predetermined for an assignment of evaluable quantities. A series of marking symbols can be generated via a routine by the microprocessor of the postage meter machine without using an additional encryption circuit. Different variants of marking information are possible, which can be recovered from a series of marking symbols.

• augenblicklicher Summenwert an Frankierungen
• augenblicklicher Summenwert an Frankierungen seit dem letzten Nachladedatum
• noch vorhandener Guthaben-Restwert, der zum Frankieren verbraucht werden kann
• augenblickliche Datums/Zeitdaten
• augenblickliche Datums/Zeitdaten seit dem letzten Nachladedatum
• Stückzahl der frankierten Poststüche oder ihr komplement.

In addition to the postage value actually to be checked, which forms one size, one is essential monotonously continuously variable size. A certain monotonously continuously variable size and further sizes form certain marking information variants. The following sizes are possible for the monotonously continuously variable size:

• current total value of frankings
• Current total value of frankings since the last reload date
• remaining credit balance that can be used for franking
• current date / time data
• current date / time data since the last reload date
• Number of franked mail pieces or their complement.

• Datum des letzten Nachladezeitpunktes
• Guthabennachladedaten zum Datum des letzten Nachladezeitpunktes
• eine bestimmte physikalische Größe, welche zum Datum des letzten Nachladezeitpunktes gemessen wurde und nur der Frankiermaschine und der Datenzentrale bekannt ist.

The representation of this monotonously continuously variable quantity takes the form of a first number, to which a second number can optionally be added for certain sensible combinations, regarding:

• Date of the last reload time
• Credit reload data on the date of the last reload time
• a certain physical quantity, which was measured on the date of the last reload time and is only known to the franking machine and the data center.

Each digit or each number formed by predetermined digits within the combination number is assigned a meaning in terms of content. In this way, the information relevant for further evaluation can be separated later during an evaluation.

Due to the monotonously continuously variable size, the marking changes with each print, which makes such a franked mail piece unmistakable, and at the same time provides information about the previous credit consumption and the last credit reload data at the time of the last credit reload or via certain additional data, such as the last reload date / time etc.

The aforementioned information about further data can also be requested by the post office or the institute commissioned with the check by the data center. In this case, if the corresponding quantity forming a second number is stored in the data center, the monotonically variable quantity only needs to be included partially to form the combination number, but only the part of maximum change is then included to form a first number.

Another predetermined number assigned to the combination number corresponds to the size of the postage value. A fourth number corresponds to the information about the corresponding franking machine identification number (serial number). The information can be printed in the franking stamp additionally or exclusively as a barcode. Such information can also be the checksum or another number derived in a suitable manner from the identification number, since it is only a matter of checking the franking stamp on the mail piece or indirectly the franking machine by means of the imprint for manipulation. If tampering is detected, it must also be possible to open the mail piece to determine the true sender.

• die Frankiermaschine übermittelt ihre Registerwerte an die Datenzentrale zwecks Überprüfung,
• Ermitteln des Zeitpunktes der nächsten Kommunikation durch die Datenzentrale und/oder Frankiermaschine.
• die Datenzentrale prüft die Verdachtsmomente und meldet dies der Frankiermaschine oder löst eine außerplanmäßige Überprüfung der Frankiermaschine vor Ort aus,
• durch das zuständige Postamt oder ein damit beauftragtes Prüfinstitut wird der Sicherheitsabdruck auf Basis einer Stichprobenkontrolle oder auf Basis einer Information von der Datenzentrale, daß die Frankiermaschine als verdächtig eingestuft wird, überprüft,
• Auswertung der zusätzlich im Sicherheitsabdruck enthaltenen speziellen Zeichen, oder des Fehlens solcher speziellen Zeichen, falls die Frankiermaschine selbst eine Manipulation feststellt,
• Ermittlung des wahren Absenders im Falle einer Manipulation.

A check of a franking machine or its user therefore includes the following steps:

• the franking machine transmits its register values to the data center for the purpose of checking,
• Determination of the time of the next communication by the data center and / or franking machine.
• the data center checks the suspicions and reports this to the franking machine or triggers an unscheduled check of the franking machine on site,
• The security imprint is checked by the responsible post office or a test institute commissioned with it on the basis of a random check or on the basis of information from the data center that the franking machine is classified as suspicious.
• Evaluation of the special characters additionally contained in the security imprint, or the absence of such special characters if the franking machine itself detects manipulation,
• Finding the true sender in the event of tampering.

The microprocessor of the postage meter machine is used for the time-critical generation of the marking data, in order to form at least one combination number from the predetermined sizes after the completion of all the inputs and in order to encrypt this according to an encryption algorithm to a crypto number, which is then converted into a marking symbol row. To check a security imprint, random or centrally initiated control of mail items is provided in order to retrieve the individual information from the printed marking of a security imprint in a postal authority or similar institution and to compare it with the information printed open on the mail item.

According to a second variant, the checking of the marking symbol series by the postal authority is based exclusively on random samples. During the sample check, the imprint of any arbitrarily selected piece of mail is examined for manipulation, without there being any other indications of manipulation or suspicions.

After all symbols of a symbol series have been recorded and converted into data, the corresponding DES key can be used to decrypt them. The result is the COMBI number from which the sizes, in particular the sum of all franking values and the current postage value, are split off. The split postage value is compared to the openly printed postage value.

The value of a split off current size, for example the total value of all franking values that have been carried out since the last reload, is subjected to a monotony check using data of the last recorded value of this size. This rules out the possibility that, for example, fraudulent copying of the franking imprint by means of a color copier creates seemingly real copies that could not be distinguished from the original. There must be a difference of at least the amount of the postage between the actual size actually encoded in the marking and the last size recorded. In the aforementioned case, the last size recorded is the total value of all frankings made so far, which was stored in the data center when the register status was last remotely queried. Likewise, if the corresponding size has been separated from the COMBI number after decryption, the counterfeiting of the franking machine serial number can be identified by means of the marking by means of a comparison.

If no tampering could be identified with regard to the identification of the serial number of the franking machine, the postal authority or the institute commissioned with the test transmits the associated franking machine serial number to the data center. With this information, the mail pieces (letters) could be checked indirectly in cooperation with the data center.

If it has been proven beyond any doubt that the imprint has been tampered with, the sender stated on the mail piece is checked. The serial number of the franking machine, which is also printed on, can be used for this if it is possible to identify the sender or, if available, the sender printed on the envelope in plain text. If such information is missing or the franking machine serial number has been manipulated, the letter can be opened legally to determine the sender.

The aforementioned marking is preferably printed in the form of a series of symbols in a field of the franking machine image simultaneously with this by the single printer module. The shape of the symbols with their orthogonal edges enables pattern recognition with minimal computational effort.

An integral measurement of the degree of blackening with a simple optoelectronic sensor (e.g. phototransistor) and a downstream A / D converter enables particularly simple and quick machine readability. For this purpose, the symbols were designed in such a way that they clearly differ in their integral degree of blackening (share of the printed area in the area of the drawing field). Each symbol therefore corresponds to a specific value at the output of the A / D converter. With the row of symbols, a higher information density is achieved compared to the bar code, thus saving space in the franking machine print image. On the other hand, more information can be coded using the graphic symbols.

Another advantage over a bar code is the good readability of the individual symbols in the marking field, which is due to the symbolic nature of the image content, and the possibility Linguistically capture the image content for manual evaluation. The symbolism in addition to the mechanical one also enables a visual evaluation by a trained examiner who evaluates the form and the conceptual content of the symbols in the post office.

On the one hand, there was a machine-readable, as well as a manually readable and decodable form of marking, which can be visibly applied to the mail piece or the franking strip together with the franking imprint, and, on the other hand, a solution for compiling constant and quickly editable data for franking machines and for controlling their printing for a column-wise printing of a franking image. The aforementioned solutions to the prior art are either too expensive to achieve a high printing speed or have multiple printers or are unsuitable for time-optimized combination of constant and variable data to form a print control signal for a single printer.

The invention is based on the fact that after the franking machine is switched on, the postage value in the value print is automatically specified in accordance with the last entry before the franking machine was switched off and the date in the day stamp is specified in accordance with the current date, and that the variable data for the printout are in the fixed data for the frame and for all associated data that remain unchanged are electronically embedded. These variable data of the window contents are hereinafter referred to briefly as window data and all fixed data for the value stamp, the day stamp and the advertising slogan stamp as framework data. The frame data is a first memory area of a read-only memory (ROM), which also serves as program memory, can be removed. The window data are taken from a second memory area and stored in accordance with the input in a non-volatile working memory and can be removed at any time for the purpose of composing them into an overall representation of a franking image.

It is proposed to transfer hexadecimal window data in run-length-coded form to the respective separate memory areas of a non-volatile working memory and to store them there. If no new input is made, the data is transferred to a volatile pixel memory and the window data is classified according to the predetermined assignment in the frame data. Here, however, it is possible through the invention to work in a time-optimized manner, so that the printing speed becomes high. According to the invention, the data from the two memory areas are combined according to a predetermined assignment before printing to form a pixel print image and are completed during printing to form a column of the entire franking machine print image. Those variable data which are embedded in the printing column during printing comprise at least the marking data. The time required for the previous assembly of the entire pixel image with the remaining data is reduced accordingly. The previous composition is similar to the date in the postmark and as with the postage in the value print, whereby the variable information can be subsequently added and modified in the window provided. In order to save time, only those parts of a graphical representation that are actually changed are saved in the non-volatile working memory when a change is made.

Figur 1,

Blockschaltbild einer zur Durchführung des erfindungsgemäßen Verfahrens geeigneten ersten Variante einer Frankiermaschine,

Figur 2,

Kommunikation bei einer Auswertung eines Sicherheitsabdruckes

Figur 3a,

Darstellung eines Sicherheitsabdruckes mit einem Markierungsfeld

Figur 3b

bis 3e, Weitere Varianten der Anordnung von Markierungsfeldern für Sicherheitsabdruck

Figur 3f,

Darstellung eines Satzes an Symbolen für ein Markierungsfeld im Werbeklischee

Figur 4a,

Aufbau einer Kombinationszahl,

Figur 4b,

Sicherheitsabdruck-Auswerteschaltung,

Figur 4c,

Teilschritt zur Markierungssymbol-Erkennung,

Figur 4d,

Sicherheitsabdruck-Auswerteverfahren,

Figur 5,

Ablaufplan für die Drückbilderstellung für die erste Variante der Frankiermaschine mit zwei Pixelspeicherbereichen,

Figur 6,

Ablaufplan für eine zweite zur Durchführung des erfindungsgemäßen Verfahrens geeigneten ersten Variante einer Frankiermaschine mit einem Pixelspeicherbereich,

Figur 7,

Postwertzeichenbild mit zugeordneten Druckspalten,

Figur 8,

Darstellung der auf ein Pixelspeicherbild bezogenen und davon getrennt gespeicherten Fensterkennwerte,

Figur 9a,

Dekodierung des Steuercode, Dekomprimierung und Laden der festen Rahmendaten sowie Bildung und Speicherung der Fensterkennwerte,

Figur 9b,

Einbettung von dekomprimierten aktuellen Fensterdaten vom Typ 1 in die dekomprimierten Rahmendaten nach dem Start der Frankiermaschine bzw. nach dem Editieren von Rahmendaten,

Figur 9c,

Einbettung von dekomprimierten variablen Fensterdaten vom Typ 1 in die dekomprimierten Rahmendaten nach dem Editieren dieser Fensterdaten vom Typ 1,

Figur 10,

Bildung neuer kodierter Fensterdaten vom Typ 2 für ein Markierungsbild,

Figur 11,

Dekodierung von Steuercode und Umsetzung in dekomprimierte binäre Fensterdaten vom Typ 2,

Figur 12,

Druckroutine für das Zusammensetzen von Daten aus den Pixelspeicherbereichen I und II,

Figur 13,

Druckroutine für das Zusammensetzen aus einem Pixelspeicherbereich I und Arbeitsspeicherbereichen entnommenen Daten,

Advantageous developments of the invention are shown below together with the description of the preferred embodiment of the invention with reference to the figures. Show it:

Figure 1,

Block diagram of a first variant of a franking machine suitable for carrying out the method according to the invention,

Figure 2,

Communication when evaluating a security imprint

Figure 3a,

Representation of a security imprint with a check box

Figure 3b

to 3e, further variants of the arrangement of marking fields for security imprint

Figure 3f,

Representation of a set of symbols for a marking field in the advertising cliché

Figure 4a,

Building a combination number,

Figure 4b,

Security imprint evaluation circuit,

Figure 4c,

Partial step for marking symbol recognition,

Figure 4d,

Security imprint evaluation methods,

Figure 5,

Flow chart for the creation of print images for the first variant of the franking machine with two pixel memory areas,

Figure 6,

Flow chart for a second first variant of a franking machine with a pixel memory area suitable for carrying out the method according to the invention,

Figure 7,

Postage stamp image with assigned printing columns,

Figure 8,

Representation of the window parameters relating to a pixel memory image and stored separately therefrom,

Figure 9a,

Decoding of the control code, decompression and loading of the fixed frame data as well as formation and storage of the window parameters,

Figure 9b,

Embedding of decompressed current window data of type 1 in the decompressed frame data after starting the franking machine or after editing frame data,

Figure 9c,

Embedding decompressed variable window data of type 1 in the decompressed frame data after editing this window data of type 1,

Figure 10,

Formation of new coded window data of type 2 for a marking image,

Figure 11,

Decoding of control code and conversion into decompressed binary window data of type 2,

Figure 12,

Print routine for the compilation of data from the pixel memory areas I and II,

Figure 13,

Print routine for the compilation of data taken from a pixel memory area I and working memory areas,

FIG. 1 shows a block diagram of a franking machine with a printer module 1 for a fully electronically generated franking image Contains advertising cliché and / or a marking for a security imprint, with at least one input means 2 having actuating elements, and with a display unit 3, both of which are coupled via an input / output control module 4, a non-volatile memory 5 for at least the constant parts of the franking image and with a control device 6. A character memory 9 supplies the necessary print data for the volatile working memory 7. The control device 6 has a microprocessor μP which is connected to the input / output control module 4, to the character memory 9, to the volatile working memory 7 and to the non-volatile working memory 5, with a cost center memory 10, with a program memory 11, with a transport or feed device, possibly with a strip release 12, an encoder (coding disk) 13 and with a continuously operating clock / date module 8.

An additionally developed method for improving the security of franking machines according to the German application P 43 44 476.8 is based on the consideration of making the falsification of data stored in the franking machine so difficult that the effort for a manipulator is no longer worthwhile. In connection with this method, a sensor 21 with a detector device 20 can be connected to the input / output control module 4 in the manner shown in FIG. 1. In another variant, however, a corresponding safety device can also be provided on the microprocessor directly or within the microprocessor, in a manner not shown in FIG. 1.

The preferred arrangement for generating a security imprint for franking machines has a first memory area A in the program memory 11 (inter alia for the data of the constant parts of the franking image including the advertising cliché frame). The sub-memory areas Ai are provided for i = 1 to m frame or fixed data, an assigned indication i identifying the respective frame, which is preferably assigned to a specific cost center. A cost center number is usually entered in order to select the advertising cliché. However, an advantageous method for user-oriented billing has already been proposed, in which the selected cliché is examined in order to automatically determine the cost center under which billing is to be carried out.

All alphanumeric characters or symbols are stored in pixel memory 9 as binary data. Data for alphanumeric characters or symbols are stored in compressed form in the non-volatile working memory 5 in the form of a hexadecimal number. As soon as the number of the cost center is entered or stored in the memory area C, the compressed data from the program memory 11 are converted with the aid of the character memory 9 into a print image having binary pixel data, which is stored in such a decompressed form in the volatile main memory 7.

Corresponding to the position report provided by the encoder 13 about the advance of the postal matter or paper strip in relation to the printer module 1, the compressed data are read from the working memory 5 and converted with the aid of the character memory 9 into a printed image having binary pixel data, which is also in such a decompressed form in the volatile memory 7 is stored. Working memories 7a, 7b and pixel memory 7c are used below to explain the invention, although this is physically preferably a single memory chip.

The working memory 7b and the pixel memory 7c are connected to the printer module 1 via a printer controller 14 having a print register (DR) 15 and an output logic. The pixel memory 7c is connected on the output side to a first input of the printer controller 14, at whose further control inputs there are output signals from the microprocessor control device 6.

Once called up, the constant parts of the franking image and advertising clichés are continuously decoded in the pixel memory area I in the volatile pixel memory 7c. For a quick change of the window data, there is a second memory area B in the non-volatile working memory 5. The pixel memory area I in the pixel memory 7c is also provided for the selected decompressed data of the variable parts of the franking image, which are identified by the indication j. The second pixel memory area II in the pixel memory 7c is provided for the selected decompressed data of the variable parts of the franking image, which are identified by the indication k. These are the marking data that were formed just before the security imprint was printed.

It has already been proposed to use only one microprocessor and one printing module of a franking machine to create a method and an arrangement for the rapid generation of a security imprint (EP 576 113). The printing data of the marking information is preferably embedded in the remaining printing data while the respective column is being printed.

By means of the fully electronically generated print image, the variable data of the marking can be implemented in one or more windows within a fixed through the franking machine print image in order to implement the security impression embedded frame during column-by-column printing. A major reason why the printing speed is not reduced by the time required for the formation of the marking data lies in the fact that the microprocessor of the control device, which carries out the column-wise embedding of window data, taps into a time reserve during printing.

The memory areas B to ST in the non-volatile working memory 5 can contain a large number of sub-memory areas, under which the respective data are stored in data records. The sub-memory areas B _j are provided for j = 1 to n semi-variable window data and B _k for k = 1 to p variable window data, various assignments between the sub-memory areas of the different memory areas being selectable and / or stored in a predetermined manner.

The strings of numbers that are entered for the generation of the input data with a keyboard 2 or via an electronic scale 22 connected to the input / output device 4 and calculating the postage value are automatically stored in the memory area ST of the non-volatile working memory 5. In addition, data records of the sub memory areas, for example B _j , C etc., are also retained. This ensures that the last input values are retained even when the franking machine is switched off, so that after switching on the postage value in the value print is automatically specified in accordance with the last entry before the franking machine was switched off and the date in the day stamp in accordance with the current date.

It is provided that the program memory 11 is connected to the control device 6, the data for the constant parts of the franking image which relate to at least one advertising slogan frame, are stored in a first memory area A _i and an assigned name identifies the advertising slogan frame. It is further provided that the non-volatile working memory 5 is connected to the control device 6, the data for the semi-variable parts of the franking image being stored in a second memory area B _j and an assigned name identifying the semi-variable part, a first assignment of the names of the there are semi-variable parts to the names of the constant parts. A second assignment can be made in the franking machine in accordance with the cost center number stored in a third memory area C, so that an advertising slogan is optionally assigned to each cost center KST.

The corresponding assignment of the respective cost center to the basic data is automatically queried after switching on. In another variant, the cost center must be re-entered into the memory area C each time it is switched on during the start routine, while it is retained in the event of brief interruptions in the operating voltage. The number of printed letters with the respective above The setting of the advertising cliché via the cost center is registered in the franking machine for later evaluation.

In each data record of a sub memory area A _i , B _j or B _k , control code and run length-coded frame or window data are alternately contained one after the other.

Before the first printing, the respective selected common frame data for the advertising slogan stamp, for the postmark and the postage stamp are transferred from the non-volatile program memory 11 into the registers 100, 110, 120, ..., of a volatile working memory 7a, with control code during the transfer can be decoded and stored in a separate memory area of the working memory 7b. The respective selected window data are also loaded into registers 200, 210, 220, .... The registers of sub-memory areas are preferably formed in the memory area of the main memory 7a. In another variant, these aforementioned registers and / or the volatile working memory 7 are part of the microprocessor control 6.

Decompression converts the run length-encoded hexadecimal data into corresponding binary pixel data. The decompressed binary pixel data, which can remain unchanged over a longer period of time, are transferred to a first pixel memory area I and the binary pixel data, which relate to the marking data that changes constantly with each print, into the second pixel memory area II. FIG. 1 shows a block diagram for such a first variant of the solution according to the invention.

The (semi-variable) window data, which can be changed less in time, is referred to below as window data of type 1. In contrast, type 2 window data is used to refer to the constantly changing (variable) window data.

New frame and / or window data of type 1 can be selected as long as there is a need for this after inserting and storing binary pixel data in the first pixel memory area I. If this is not the case, an automatic generation of window data of type 2 with subsequent decompression follows and their storage as binary pixel data in the second pixel memory area II. In another variant, not shown, the above-mentioned steps can be repeated, if still none There is a print request. The combination with the other binary pixel data stored in the pixel memory area I is preferably carried out after a print request has been made during a print routine.

The data in the memory areas C, D and E can be changed by means of the input means 2 and the control device 6. The same microprocessor of the control device 6, which also executes the billing routine and the printing routine, is preferably used here. The data from the memory areas are put together in accordance with a predetermined (freely selectable within certain limits) assignment during printing to form an overall representation of a security imprint. For example, fourth and fifth memory areas D and E of the non-volatile working memory 5 are used here. A name is stored in the fourth memory area D of the non-volatile memory 5, which identifies the currently set frame of an advertising slogan, while in a fifth memory area E data is stored for a further selectable assignment of at least one advertising slogan part to a frame of the advertising slogan corresponding to the aforementioned name are. It is envisaged that the data from the memory areas are combined according to a predetermined (freely selectable within certain limits) assignment during printing to form an overall representation of a security imprint.

A franking machine is usually identified by means of an 8-digit serial number, which, however, only needs to be included in part in the row of marking symbols in order to enable the serial number printed in plain text to be checked. In a simple variant, this can be, for example, the checksum from the serial number. In more complicated other variants, other data go to education a preferably at least 2-digit information that allows the serial number to be checked.

In particular, in a modification of the solution shown in DE 40 03 006 A1, marking of postal items on the basis of a crypto number can be carried out without difficulty to enable identification of franking machines if the multi-digit crypto number is not including the data values stored as a hexadecimal number of the entire cliché, but only with the inclusion of selected data values from the cliché frame and other data such as how the machine parameters of the value setting and the date are formed and temporarily stored. With the method according to the invention, not only numerical or numerical values, such as the number of the advertising cliché used, but also data values of the image information can be used to form the encrypted information. In contrast to DE-PS 40 03 006, any area of the advertising slogan to which separate data in a data record are assigned can be used to form the crypto number. For this purpose, individual data are selected from this data set. It is advantageous that the end of the column is identified as a control code for each column to be printed, which follows the hexadecimal data encoded with run length. The run-length-coded hexadecimal data at the first position in the data record can preferably be used.

Due to a size that is present and / or generated in the machine, in particular the current date, the associated data of the columnar regional image information are selected from the data set in order to extract at least a number of data (hexadecimal numbers).

Furthermore, several can be added to each advertising slogan number Data records can be assigned, each data record having the data relating to a partial area of the advertising cliché. In this case, the data set with the associated data of the columnar regional image information is selected on the basis of an existing and / or generated size in the machine in order to extract at least a number of data (hexadecimal numbers).

Preferably, those run length-coded hexadecimal data corresponding to a predetermined print column are combined with at least some of the data of the machine parameters (serial number, monotonously variable size, time data, inspection data, such as the number of prints during the last inspection, or suspicious variable) and the postage value in in a special way - explained in connection with FIG. 10 - combined and encrypted. When new, coded window data is formed before it is stored in the second memory area II, the DES algorithm (Data Encryption Standard) for encryption and additionally a conversion into a special graphic character set can be used for a high security standard. This enables the encryption of at least a first, third and fourth number of combination numbers in an 8-byte data record.

The character memory 9 converts a crypto number into a symbol-containing identifier. In particular, a list selected by a further size, advantageously by the postage value, which assigns graphic symbols to the individual crypto numbers, is used. The encrypted hexadecimal data is decompressed by means of the character memory in order to print the identifier formed from the symbols to be printed. This is also a machine-readable marking.

However, other encryption methods and methods for converting the crypto number into a marking are also suitable.

It is particularly advantageous if the type 2 window data for the security markings is accommodated in a separate window in the postage stamp or in the day stamp or between the two stamps. Then the entire franking imprint is not enlarged (which is also not permitted by post) or an additional printing unit that prints elsewhere in the letter is not required.

In addition, specially generated, encrypted marking data stored in a sixth memory area F can be used for marking, for example the franking machine serial number. Another possibility is the machine-readable but unencrypted message of the franking machine serial number printed as a bar code, the data of which is taken either from the memory area F of the non-volatile working memory 5 or from the program memory 11 to be included in the franking image - as shown, for example, with reference to FIG. 3e. insert. A notification of the sender address to be provided by means of a separate printer by means of a bar code can be promoted by a discount. According to the invention, these above-mentioned messages can reduce the inspection effort for mail items because they allow a targeted machine inspection of certain senders or franking machines. In a second variant, it is provided that the data center determines suspicious franking machines and transmits the serial numbers to the postal authority or an institute commissioned with the verification.

Newer franking machines are by means of a remote value specification FWV loaded from a data center with a new reload credit. The data center stores for each franking machine user the credit amounts and the dates on which these credit balances were transferred to the franking machine. On the basis of this data stored in the data center, further security checks for checking the regular use of the franking machine are possible.

FIG. 2 shows which communication is required when evaluating the security imprint according to the invention. On the one hand, a data connection line L is required for reloading credit. At the same time, the data center receives information about the respective franking machine with each communication via the data connection line L. It is provided that a dialing parameter and / or telephone number is stored in a further memory area N in order to be able to establish the communication connection to the data center DZ, which at least queries the postal register in the non-volatile cost center memory 10. After their evaluation, the data center establishes, if necessary, a data connection via a line H to the evaluation device 29 in the post office or in the institute commissioned with the evaluation of the franking stamps of the mail pieces.

In the first check variant, provided that a franking machine is considered suspect, the postal authority controls the mail pieces. The postal authority receives the information from the data center via the data connection line H together with the serial number. The data connection line H must also be used for inquiries on the part of the post office, depending on the type of evaluation. On the other hand, the data connection line L is provided for inquiries from the franking machine to the data center.

In such a centrally initialized first check variant, the data center determines an average postage consumption P _K on the basis of the user-specific historical data of a certain past time period. It is assumed that the average credit inflow also corresponds to the average credit outflow, ie the average postage consumption. This is thus equal to the ratio of the sum of the credits G transferred in the period under consideration and the sum of the periods t between the reloads:

On the basis of this average postage consumption P _{K of} the franking machine user K and on the basis of his last credit reload G _{K, n} , the expected time period t _{K, n + 1} until the next credit reload can be calculated: $${\text{t}}_{\text{K, n + 1}}\text{=}\frac{{\text{G}}_{\text{K, n}}}{{\text{P}}_{\text{K}}}\text{* (1 + 1 / β)}$$

• R1 (descending register) vorrätige Restbetrag in der Frankiermaschine,
• R2 (ascending register) Verbrauchssummenbetrag in der Frankiermaschine,
• R3 (total resetting) die bisherige Gesamtvorgabesumme aller Fernwertvorgaben,
• R4 (piece count Σprinting with value ≠ O) Anzahl gültiger Drucke,
• R8 (R4 + piece count Σprinting with value =O) Anzahl aller Drucke

The term (1 + 1 / β) serves to compensate for normal fluctuations in postage consumption. Therefore a surcharge 1 / β (in this example preferably 10%, ie 1 / β = 1/10) is charged for G _{K, n} .
The franking machine can transmit register values to the data center before reloading the credit:

• R1 (descending register) remaining amount in the franking machine,
• R2 (ascending register) amount of consumption in the franking machine,
• R3 (total resetting) the previous total amount all remote values,
• R4 (piece count Σprinting with value ≠ O) number of valid prints,
• R8 (R4 + piece count Σprinting with value = O) Number of all prints

Taking into account the total stored in the rising register (amount of consumption R2) of all previously loaded (used) reloading credits, the following also applies:

A value R2 taken from the ascending register corresponds to the current query value. According to the default _request , which should lead to a reload _credit G _{K.n + 1} , which must be added to the current query value R2, the future value R _{2 new results} . The following applies: $${\text{R2}}_{\text{New}}{\text{- R2 = G}}_{\text{K, n + 1}}$$

The following also applies: $$\text{R3 = R2 + R1}$$

Taking into account a still available postage credit (remaining amount R1) stored in the falling register of the cost center memory 10, the following total value can therefore be used for franking: $${\text{R1}}_{\text{New}}{\text{= R1 + G}}_{\text{K, n + 1}}$$

With each remote value specification, the remaining amount R1 can be queried and statistically evaluated. If the remaining amount R1 becomes larger and larger, the same reloading amount can be reloaded in ever larger reloading periods, or the number of pieces that can be franked until the next communication is set. From this consideration and because customary reloading amounts are often requested in the same amount, the expected time t _{K, n + 1} until next credit reload determined using the following formula: $${\text{t}}_{\text{K, n + 1}}{\text{= (G}}_{\text{K, n + 1}}{\text{+ R1 * α}}_{\text{x}}{\text{) * 1 / P}}_{\text{K}}$$

The disposition factor α _x depends on the classification of the franking machine user as an A, B or C customer.

On the basis of the average postage consumption determined for the user K P _K disposition factor α _K is assigned to one of for example three consumption classes A, B and C: $${\text{P}}_{\text{K}}{\text{≤ P}}_{\text{FROM}}{\text{→ α}}_{\text{A}}$$ $${\text{P}}_{\text{FROM}}{\text{<P}}_{\text{K}}{\text{≤ P}}_{\text{B / C}}{\text{→ α}}_{\text{B}}$$ $${\text{P}}_{\text{K}}{\text{> P}}_{\text{B / C}}{\text{→ α}}_{\text{C}}$$

Each of these consumption classes is assigned a typical disposition factor α _A , α _B , α _C , which means that the longest time (t _A ) is reached per time interval according to equation (6) for consumption class A, i.e. the class with the lowest consumption, and at of consumption class C the shortest time (t _C ).

A simplification of this calculation scheme can be achieved in that the individual variables α _K and t _{K, n + 1} are no longer recalculated for each user K, but instead a classification is carried out. On the basis of the determined for the user K average postage consumption P _K of this is classified into one of for example three consumption classes A, B and C. $${\text{P}}_{\text{K}}{\text{≤ P}}_{\text{FROM}}\text{→ A}$$ $${\text{P}}_{\text{FROM}}{\text{<P}}_{\text{n}}{\text{≤ P}}_{\text{B / C}}\text{→ B}$$ $${\text{P}}_{\text{K}}{\text{> P}}_{\text{B / C}}\text{→ C}$$

Each of these consumption classes is assigned a typical consumption time t _A , t _B , t _C , whereby the longest time (t _A ) is assigned to the consumption class A, i.e. the class with the smallest consumption, and the shortest time (t _C ).

• a) Die Datenzentrale nimmt Kontakt zur K-ten Frankiermaschine FM_K auf. Bei Vorhandensein eines Modemanschlusses kann dies automatisch geschehen. Im Fall der sogenannten voice controll ist ein Telefonanruf beim FM_K-Kunden erforderlich.
  In jedem Fall wird der Kunde bzw. die Frankiermaschine aufgefordert, die überfällige Kommunikation durchzuführen. Bei einer Kommunikation können von der Datenzentrale die aktuellen Registerstände angefordert werden, um die Größe des Restguthabens zu überprüfen oder weitere statistische Daten über die Benutzung der K-ten Frankiermaschine FM_K zu erhalten. Diese Übertragung ist aus Sicherheitsgründen in gleicher Weise zu schützen wie die Fernwertvorgabe selbst. Dazu dient beispielsweise die Verschlüsselung der Nachricht mit dem DES-Schlüssel. Die Datenzentrale kann dann ggf. an die K-te Frankiermaschine FM_K die Nachricht übertragen, daß sie nicht mehr verdächtig ist. Anderenfalls geht die K-te Frankiermaschine FM_K in den Verdachtsmodus über. Dies bedeutet, daß sie innerhalb einer begrenzten Zeit vor Ort zu überprüfen ist, wenn anschließend keine Kommunikation zwischen der Datenzentrale und der Frankiermaschine durchgeführt wird.
  Von der Datenzentrale wird das Verhalten des Frankiermaschinenbenutzers auch auf der Basis von während der Kommunikation übermittelten weiteren Daten überwacht, um verdächtige Frankiermaschinen festzustellen. In die Berechnung zur Ermittlung des Frankiermaschinen-Profils können auch solche frankiermaschinenspezifischen Daten, wie die Stückzahl an vorgenommenen Frankierungen oder aller Drucke (Registerwerte R4 oder R8) einfließen. Vorteilhaft sind folgende Formeln nacheinander anzuwenden: $${\text{V}}_{\text{susp1}}\text{=}\frac{\text{R4}}{\text{(R3 - R1)}}{\text{* F}}_{\text{min}}\text{=}\frac{\text{R4}}{\text{R2}}{\text{* F}}_{\text{min}}$$ und falls R1alt ≠ R1, um die Änderung zu überprüfen, außerdem: $${\text{V}}_{\text{susp2}}\text{=}\frac{\text{R4 - R4alt}}{\text{R1alt - R1}}{\text{* F}}_{\text{min}}$$ mit

  R1 :

  R1 Abfragewert bei der n-ten Fernwertvorgabe

  R1_neu:

  R1 Abfragewert vor der (n+1)-ten Fernwertvorgabe eines Nachladeguthabens

  V_susp:

  heuristischer Wert, der Auskunft über den Zustand der Frankiermaschine gibt

  F_min:

  minimaler Frankierwert

  
  Bei einem Mindestfrankierwert von z.B. F_min = 20 Cent ergibt sich folgende Fallunterscheidung: $${\text{V}}_{\text{susp1}}\text{< 5\hspace{1em}\hspace{1em}\hspace{1em}okay}$$ $${\text{V}}_{\text{susp1}}\text{= 5..100\hspace{1em}\hspace{1em}\hspace{1em}suspicous}$$ $${\text{V}}_{\text{susp1}}\text{> 100\hspace{1em}\hspace{1em}\hspace{1em}manipulated}$$
  Anhand der frankiermaschinenspezifischen Daten läßt sich so ein Frankiermaschinen-Profil erstellen. Dieses Frankiermaschinen-Profil gibt darüber Auskunft, ob ein Kunde mit den durchgeführten Nachladevorgängen in der Lage war, die ermittelte Anzahl an Frankierungen durchzuführen. Es sind innerhalb des Suspicious Mode zwei Stufen zu unterscheiden:
  • Stufe 1: Frankiermaschine ist verdächtig oder
  • Stufe 2: Frankiermaschine ist manipuliert worden.
  
  Ein entsprechender Suspicious Mode kann nur von der Datenzentrale aktiviert werden, wobei keine direkten Auswirkungen auf die Frankiermaschine stattfinden.
• b) Ebenso wie in der Datenzentrale kann auch die K-te Frankiermaschine FM_K die Nachricht selbsttätig ermitteln und anzeigen, daß sie verdächtig ist. Die K-te Frankiermaschine FM_K geht mit Anzeige der Nachricht in den Verdachtsmodus. Dies bedeutet, daß die Datenzentrale innerhalb einer begrenzten Zeit vor Ort eine Überprüfung veranlaßt, wenn anschließend keine Kommunikation zwischen der Datenzentrale und der Frankiermaschine durchgeführt wird. Eine solche Kommunikation kann beispielsweise zum Zwecke einer Fernwertvorgabe eines Guthabens vorgenommen werden.
  Bei der Fernwertvorgabe eines Guthabens werden die einzelnen Transaktionen mit verschlüsselten Meldungen nacheinander durchgeführt. Nach Eingabe der Identifikations-Nummer (ID-Nr.) und der beabsichtigten Eingabeparameter prüft die Frankiermaschine, ob ein MODEM angeschlossen und betriebsbereit ist. Ist das nicht der Fall, wird angezeigt, daß das Transaktionsersuchen wiederholt werden muß. Anderenfalls liest die Frankiermaschine die Wahlparameter, bestehend aus den Herauswahlparametern (Haupt-/Nebenstelle, usw.) und der Telefonnummer aus dem NVRAM-Speicherbereich N und sendet diese mit einem Wahlaufforderungskommando an das Modem 23. Anschließend erfolgt der für die Kommunikation erforderliche Verbindungsaufbau über das MODEM 23 mit der Datenzentrale.
  Nach dem Verbindungsaufbau erfolgt die Übermittlung der verschlüsselten Eröffnungsnachricht an die Datenzentrale. Darin ist u.a. die Portoabrufnummer zur Bekanntmachung des Anrufenden, d.h. der Frankiermaschine, bei der Datenzentrale enthalten. Außerdem erfolgt die Übermittlung der verschlüsselten Registerdaten an die Datenzentrale.
  Diese Eröffnungsnachricht wird in der Datenzentrale im auf Plausibilität überprüft, die Frankiermaschine identifiziert und auf Fehler ausgewertet. Von der Datenzentrale wird erkannt, welches Ersuchen die Frankiermaschine gestellt hat und eine Erwiderungsnachricht zur Frankiermaschine als Vorspann gesendet.
  Wurde ein Vorspann empfangen, d.h. die Frankiermaschine hat eine OK-Meldung erhalten, erfolgt eine Überprüfung der Vorspannparameter hinsichtlich einer Telefonnummeränderung. Wenn ein verschlüsselter Parameter übermittelt wurde, liegt keine Telefonnummernänderung vor und es wird von der Frankiermaschine an die Datenzentrale eine Beginnmeldung verschlüsselt gesendet. Wird dort der Empfang ordnungsgemäßer Daten festgestellt, beginnt die Datenzentrale eine Transaktion durchzuführen. Im vorgenannten Beispiel werden neue Nachladeguthabendaten verschlüsselt zur Frankiermaschine übertragen, die diese Transaktionsdaten empfängt und speichert. Dabei ist in einer anderen Variante vorgesehen, daß die Frankiermaschine bei jeder erfolgreichen Kommunikation aus dem Verdachtsmodus in den Normalmodus zurück überführt wird.
  Gleichzeitig wird in der Datenzentrale aufgrund der neuen übertragenen Registerwerte wieder der Status der Frankiermaschine ermittelt.
• c) In dieser ersten Überprüfungsvariante kann zusätzlich zu den Reaktionen a) oder b) eine Mitteilung an die Postbehörde gesandt werden, die für die Prüfung der K-ten Frankiermaschine FM_K zuständig ist. Diese Postbehörde kann dann beispielsweise eine zielgerichtete Überprüfung der Frankierung der Poststücke und ggf. eine Inspektion vor Ort einleiten, wenn die vorgenommenen Ermittlungen ergeben haben, daß die Frankiermaschine manipuliert worden sein muß.
  Wurde von der Datenzentrale ermittelt, daß die Frankiermaschine verdächtig ist, wird der Postbehörde bzw. dem mit der Prüfung beauftragten Institut die zugehörige Frankiermaschinenseriennummer übermittelt. Somit kann u.a. das Vorkommen der von dieser suspekten Frankiermaschine frankierten Briefe bzw. Poststücke überwacht werden, wenn die Briefe bzw. Poststücke eine maschinenlesbare Adresse des Absenders bzw. die Frankiermaschinenseriennummer aufweisen. Das Vorkommen der von dieser suspekten Frankiermaschine frankierten Briefe wird überwacht, indem deren Anzahl und/oder Wertsumme im Zeitintervall beispielsweise von 90 Tagen gezählt und mit dem Guthabenwert, welcher in der Frankiermaschine vorhanden war seit der letzten Nachladung, verglichen werden.
• d) Unabhängig oder in Kombination mit den Reaktionen a) bis c) wird nach Annahme des Verdachtsmoduses durch die K-te Frankiermaschine FM_K ein spezielles Zeichen aktiviert und an vorbestimmter Stelle im Frankierabdruck mit abgedruckt. Dieses Zeichen kann im einfachsten Fall ein Cluster aus gedruckten Bildpunkten oder ein Strichcode sein, der z.B. rechts des Feldes FE9 (Figur 3a) gedruckt wird. Bei der Überprüfung des Frankierabdruckes erhält die Postbehörde sofort den Hinweis, daß diese Frankiermaschine verdächtig ist. Die Postbehörde kann daraufhin eine Überprüfung der Frankierung des Poststücks und bei Erhärtung des Verdachtes beispielsweise eine Inspektion der K-te Frankiermaschine FM_K vor Ort durchführen.

If the time t _{K, n + 1} or t _A , t _B or t _{C is} exceeded, the K th franking machine FM _{K in question} is considered suspicious in principle. A plausibility check of all franking machines in use is carried out in the data center at regular intervals. In this process, the machines are identified and reported to the postal authority whose franking behavior seems suspicious or which has obviously been manipulated. Upon entering this suspicious mode, several reactions involving several steps are now possible:

• a) The data center contacts the K-th franking machine FM _K. If there is a modem connection, this can be done automatically. In the case of the so-called voice controll, a phone call to the FM _K customer is required.
  In any case, the customer or the franking machine is requested to carry out the overdue communication. In the case of communication, the current register status can be requested from the data center in order to check the size of the remaining credit or to obtain further statistical data on the use of the K-th franking machine FM _K. For security reasons, this transmission must be protected in the same way as the remote value specification itself. This is done, for example, by encrypting the message with the DES key. The data center can then transmit the message to the K-th franking machine FM _K that it is no longer suspicious. Otherwise, the K-th franking machine FM _K goes into suspicious mode. This means that it must be checked on site within a limited period of time if there is no subsequent communication between the data center and the franking machine.
  The behavior of the franking machine user is also monitored by the data center on the basis of further data transmitted during the communication in order to identify suspicious franking machines. Data such as the number of frankings made or all prints (register values R4 or R8) can also be included in the calculation for determining the franking machine profile. The following formulas are advantageous to use one after the other: $${\text{V}}_{\text{susp1}}\text{=}\frac{\text{R4}}{\text{(R3 - R1)}}{\text{* F}}_{\text{min}}\text{=}\frac{\text{R4}}{\text{R2}}{\text{* F}}_{\text{min}}$$ and if R1alt ≠ R1 to check the change, also: $${\text{V}}_{\text{susp2}}\text{=}\frac{\text{R4 - R4 old}}{\text{R1alt - R1}}{\text{* F}}_{\text{min}}$$ With

  R1:

  R1 query value for the nth remote value specification

  R1 _new :

  R1 query value before the (n + 1) -th remote value specification of a reload credit

  V _susp :

  heuristic value that provides information about the state of the franking machine

  F _min :

  minimum franking value

  
  With a minimum franking value of e.g. F _min = 20 cents, the following case distinction results: $${\text{V}}_{\text{susp1}}\text{<5 okay}$$ $${\text{V}}_{\text{susp1}}\text{= 5..100 suspicous}$$ $${\text{V}}_{\text{susp1}}\text{> 100 manipulated}$$
  A franking machine profile can be created using the franking machine-specific data. This franking machine profile provides information as to whether a customer was able to carry out the determined number of frankings with the reloading processes carried out. There are two levels within Suspicious Mode:
  • Level 1: Franking machine is suspicious or
  • Level 2: Franking machine has been manipulated.
  
  A corresponding suspicious mode can only be activated by the data center, with no direct effects on the franking machine.
• b) Just as in the data center, the K-th franking machine FM _K can automatically determine the message and indicate that it is suspicious. The K-th postage meter FM _K goes into suspect mode when the message is displayed. This means that the data center initiates a check on site within a limited time if no communication is subsequently carried out between the data center and the franking machine. Such communication can be carried out, for example, for the purpose of specifying a remote value for a credit.
  When specifying a remote value for a credit, the individual transactions are carried out one after the other with encrypted messages. After entering the identification number (ID number) and the intended input parameters, the franking machine checks whether a MODEM is connected and ready for operation. If this is not the case, it is indicated that the transaction request must be repeated. Otherwise, the franking machine reads the dialing parameters, consisting of the selection parameters (main / extension, etc.) and the Telephone number from the NVRAM memory area N and sends it to the modem 23 with a dial request command. The connection required for communication is then established via the MODEM 23 with the data center.
  After the connection is established, the encrypted opening message is sent to the data center. This includes, among other things, the postage call number for the announcement of the caller, ie the franking machine, at the data center. In addition, the encrypted register data is transmitted to the data center.
  This opening message is checked for plausibility in the data center, the franking machine is identified and evaluated for errors. The data center recognizes which request the franking machine has made and sends a reply message to the franking machine as the leader.
  If a header has been received, ie the franking machine has received an OK message, the header parameters are checked for a change in telephone number. If an encrypted parameter has been transmitted, there is no change in the telephone number and the franking machine sends an encrypted start message to the data center. If the receipt of proper data is determined there, the data center starts a transaction. In the above example, new reload credit data is encrypted and transmitted to the franking machine, which receives and stores this transaction data. In another variant, it is provided that the franking machine is switched from the suspected mode back to the normal mode with each successful communication.
  At the same time, the status of the franking machine is determined again in the data center on the basis of the new transferred register values.
• c) In this first verification variant, in addition to reactions a) or b), a message can be sent to the postal authority which is responsible for checking the K-th franking machine FM _K. This postal authority can then, for example, initiate a targeted check of the franking of the mail items and, if necessary, an on-site inspection if the investigations carried out have shown that the franking machine must have been manipulated.
  If it has been determined by the data center that the franking machine is suspicious, the postal authority or the institute commissioned with the test is sent the associated franking machine serial number. Thus, among other things, the occurrence of the letters or mail pieces franked by this suspect franking machine can be monitored if the letters or mail pieces have a machine-readable address of the sender or the franking machine serial number. The occurrence of the letters franked by this suspect franking machine is monitored by counting their number and / or value sum in the time interval, for example of 90 days, and comparing them with the credit value that has been present in the franking machine since the last reloading.
• d) Independently or in combination with reactions a) to c), a special character is activated by the K-th franking machine FM _K after acceptance of the suspected mode and is also printed at a predetermined position in the franking imprint. In the simplest case, this character can be a cluster of printed pixels or a bar code, for example to the right of the field FE9 (Figure 3a) is printed. When checking the franking imprint, the postal authority is immediately informed that this franking machine is suspicious. The postal authority can then check the franking of the item of mail and, if the suspicion has hardened, for example carry out an inspection of the K-th franking machine FM _K on site.

If the manipulator of the K-th franking machine FM _K knows the imprint of such suspicious signs according to d), he can try to remove this imprint. This is rendered ineffective by additionally printing the information about the suspected mode in cryptified form. A further digit is sufficient for this, which is cryptified together with the other sizes (postage value, date and, if applicable, franking machine number) and printed out in a suitable form, for example the symbol row according to FIGS. 3a-3e. In another variant, without requiring the space for a further digit for a Suspiciusvariable SV _v , a fourth number in the combination number, which allows the serial number to be checked, is set to a special value which cannot normally occur.

In the reactions according to the first verification variant, was the verification of the correct handling of a franking machine essentially carried out by the remote value specification center, i.e. If the data center initiates, or at least makes it comprehensible, this initiative is based on the franking machine itself in the reaction according to a second verification variant via the security imprint and its verification by the responsible authority or institution, and ultimately by the franking machine itself, whereby the data center and the post office or Review institute only controls the reaction afterwards.

In the second check variant, is for random selected mailpieces or senders carried out a random check. The security imprint is evaluated in cooperation with the data center. Via the data connection H, franking machine data are queried which are stored in the data center and are not openly printed on the mail piece.

During the sample check, the imprint of any arbitrarily selected mail item is examined for manipulation. After all symbols of a symbol series have been recorded and converted into data, the corresponding DES key can be used to decrypt them. The result is the COMBI number from which the sizes, in particular the sum of all franking values and the current postage value, are split off. The split postage value G3 is compared with the actually printed postage value G3 '.
The split size G4, ie the total value of all franking values carried out since the last reload, is subjected to a monotony check using data of the last detected size G4 '. There must be a difference of at least the amount of the postage value between the size G4 actually encoded in the marking and the last size G4 'recorded. In the simplest case, the size G4 'last recorded is the total value of all frankings made so far, which was stored in the data center during the last remote query of the register readings. Likewise, the counterfeiting of the franking machine serial number can be identified by means of the marking, in that, after decoding, the size G0 is separated from the COMBI number and checked.

If it has been proven beyond any doubt that the imprint has been tampered with, the sender stated on the mail piece is checked. You can also use the serial number printed on it serve the franking machine, by means of which the sender can be identified or, if available, the sender printed in plain text on the envelope. If such information is missing or the franking machine serial number has been manipulated, the letter can be opened legally to determine the sender.

The franking machine accumulates the used postage values since the last credit reloading or forms a residual value by subtracting the sum of the used postage values from the previously loaded credit. This value is updated with every franking. It is combined with other security-relevant data (postage value, date, franking machine serial number) and cryptified for security against forgery and finally printed in the manner described above. After capturing the security imprint and decrypting and separating the individual data, as in the above The evaluation is carried out as already described. The comparison of postage values and the monotony check can be carried out as in the above. Way. The information about the postage values W that have been used since the last credit reloading is now compared with the data relating to this franking machine stored at the testing center.

In the simplest case, the value W is compared with a fixed threshold value, which is not exceeded during normal use of the franking machine. If it is exceeded, suspicion is obvious.

In an improved version, W is compared with a threshold value SW _n , which corresponds to the respective postage consumption class. These postage consumption classes can be defined once for the use of the respective franking machine. But they can also come from a statistic, which for this franking machine was led. These statistics can be kept by the verifying postal authority or the statistical data that the data center creates anyway and which are then transferred to the postal authority are used.

A further refinement of the check results from the fact that, according to a first marking information variant, the date of the last credit reload t _{L is also} included as a second number in the combination number and is also printed with the other data in cryptified form. The postal authority is then able to check to what extent certain specified maximum time periods between two credit reloads have been exceeded, which has made the franking machine in question suspicious. In addition, the postal authority would be able to determine the current postage consumption P since the time t _{L of} the last credit reload with t _A for the current date, according to equation (16): $$\text{P =}\frac{\text{W}}{{\text{t}}_{\text{A}}{\text{- t}}_{\text{L}}}$$

The same criteria can be used for checking P as has already been described in connection with the first checking variant.

1.

Datum der letzten Guthabennachladung

2.

absolute Zeitzählung zwischen den Guthabennachladungen mit Rücksetzung.

For example, in another marking information variant, the date / time data form a monotonously growing quantity. In order not to require additional space in the security imprint for the imprint of the date of the last credit recharge, this variant can be combined with the absolute time count in this variant. The latter is necessary in order to identify counterfeits in the form of copies by means of a monotony check after a first evaluation variant - explained in FIG. 4c. The time data is then made up of two components:

1.

Date of the last credit reload

Second

absolute time count between credit reloads with reset.

The question of how this information can be recorded visually / manually or else automatically together with the plain text information is discussed below in connection with the explanations relating to FIGS. 4a to 4c.

The serial number can also be printed out as a barcode. However, all other information is displayed in a different way, because a barcode in the franking machine print image, depending on the amount of information coded, may take up considerable space or force the franking machine imprint to enlarge, or it may not be possible to reproduce all information in the barcode imprint.

According to the invention, a particularly compact print consisting of special graphic symbols is used. A label, for example formed from symbols to be printed, can be placed in front of, behind, under u./o. be printed over a field within the actual franking stamp imprint. This is a human-readable and machine-readable marking.

A letter envelope 17 transported under the printer module 1 is printed with a franking machine stamp image. In this case, the marking field is located in a line which is advantageous for evaluation in a line below the fields for the value stamp, for the day stamp, for the advertising slogan and, if appropriate, in the field for the optional print addition of the franking machine stamp image.

From a representation of a first example of the security imprint, shown in FIG. 3a, it can be seen that there is good readability for manual evaluation and machine readability with good recognition reliability.

The marking field is located in a window FE 6 arranged within the franking machine print image under the day stamp. The value stamp containing the postage value in a first window FE 1 and the machine serial number in a second and third window FE 2 and FE 3 may have a reference field in a Window FE 7 and, if applicable, the number of the advertising cliché in a window FE 9. The reference field is used for pre-synchronization for reading the graphic character string and for obtaining a reference value for the light / dark threshold in the case of a machine evaluation. A pre-synchronization for reading the graphic character string is also achieved by and / or in connection with the frame, in particular the postage stamp or value stamp.

The fourth window FE 4 in the day stamp contains the current date or the predated date entered in special cases. Below that is an eighth window FE 8 for a compressed precise time indication, especially for high-performance franking machines with tenths of a second. This ensures that no print is similar to another print, which makes it possible to detect a forgery by copying the print using a color copying machine.

A fifth window FE 5 is provided in the advertising cliché for an editable advertising cliché text part.

FIG. 3b shows the representation of a security imprint with a marking field in the columns between the value stamp and the day stamp, whereby the upstream vertical part of the frame of the value stamp serves for pre-synchronization and, if necessary, as a reference field. A separate window FE7 is therefore not necessary. In this variant, the marking data can be acquired almost simultaneously with a vertical arrangement of the symbol row in a shorter time.

It is also possible to save additional windows for the open, unencrypted imprint compared to the windows shown in FIG. 3a. On the other hand, the printing speed can be increased because fewer windows have to be embedded in the frame data before printing and the formation of marking data can therefore begin earlier. In order to achieve simple copy protection, the cryptified print using marking symbols is sufficient, without an open, unencrypted print of the absolute time in a window FE8. In the marking field FE 6, the marking data, which are generated on the basis of at least the post value and such a time count, are already sufficient, as will be explained below with reference to FIG. 10.

In a third example of the security imprint - shown in FIG. 3c - in addition to the variant shown in FIG. 3b, a further marking field is arranged in the postmark under the window FE 1 for the postage value. Here, further information, for example about the number of the selected advertising cliché, can be communicated unencrypted but in a machine-readable form.

In FIG. 3d, in a fourth example for the security imprint, two further marking fields are arranged in the postmark below and above the window FE 1 for the postage value.

In FIG. 3e, in a fifth example for the security imprint, two further marking fields are arranged in the postmark below and above the window FE 1 for the postage value. The marking field, which is arranged in the postmark above the window FE 1 for the postage value, has a barcode. In this way, for example, the postage value can be communicated unencrypted but in a machine-readable form. A comparison of the encrypted and unencrypted information can be carried out fully automatically since both are machine-readable.

With a smaller number of available symbols, more symbol fields have to be printed for the same information. Then a row of symbols can be made either in two lines or in the form of a combination of the variants shown in FIGS. 3a to 3e.

The form of marking is freely compatible with any postal authority. Any general change of the marking image or the arrangement of the marking field is possible without any problems due to the electronic printing principle.

The arrangement for the rapid generation of a security imprint for franking machines allows a fully electronically generated franking image, which was formed by the microprocessor-controlled printing process from fixed data and current data, to be set.

The data for the constant parts of the franking image, which relate to at least part of the fixed data, are stored in a first memory area A _i and by an assigned address and the data for the variable parts of the franking image are in a second memory area B _j or for marking data stored in a memory area B _k and identified by an assigned address.

At predetermined intervals, for example regularly with each inspection of the franking machine, the set of symbols - shown in FIG. 3f - can also be changed or exchanged in order to further increase the security against forgery.

FIG. 3f shows a representation of a set of symbols for a marking field, the symbols being suitably shaped so that both mechanical and visual evaluation by trained personnel in the postal authority is made possible.

To increase the security against counterfeiting, a set of symbols is used that is not included in the standard character set of conventional printing devices.

Basically, the very high number of variations also enables a variant that uses several symbol sets for the marking.

According to the invention, space is saved when printing the symbols with a higher information density than a bar code. It is sufficient to distinguish between 10 degrees of blackening, for example to achieve a length of approximately three times shorter in the representation of the information than the ZIP CODE. This results in ten symbols, with the degree of blackening differing by 10% in each case. With a reduction to five symbols, the degree of blackening can differ by 20%, but it is necessary to significantly increase the number of symbol fields to be printed if the same information as the symbol set shown in FIG. 3f is to be reproduced. A sentence with a higher number of symbols is also conceivable. Then the row or rows of symbols is shortened accordingly, but the recognition reliability is also reduced accordingly, so that then suitable evaluation devices of digital image processing, for example those with edge detection, are required. Due to the continuous use of orthogonal edges and the omission of curves, sufficient detection reliability is achieved with simple algorithms of digital image processing. Such detection systems use, for example, commercially available CCD line cameras and commercially available personal computer-supported image processing programs.

4a shows the structure of a combination number KOZ in an advantageous variant with a first number (sum of all postage values since the last reload date), third number (postage value) and a fourth number (generated from a serial number).

A corresponding security print evaluation device 29 - shown in FIG. 4b - for manual identification has a computer 26 with a suitable program in the memory 28, input and output means 25 and 27. The evaluation device 29 used by the respective postal authority is connected to a data center DZ shown in FIG. 2 via a communication line H.

FIG. 4c shows a sub-step for marking symbol recognition, which is necessary for automatic input, in accordance with a security imprint evaluation method, which is explained in more detail in FIG. 4d.

In the preferred variant, the marking field is arranged at least under or in a field of the franking machine stamp image and a series of such symbols is printed below the franking stamp imprint and simultaneously with it. However, the check box can also be different - such as in the 3b shown - be arranged, with corresponding transport devices for the mail piece being provided if the image recorder, for example the CCD line camera, is arranged immovably. A marking reading device 24 shown in FIG. 4b can also be designed, for example, as a reading pen guided in a guide. The device preferably comprises a CCD line camera 241, a comparator 242 connected to the CCD line camera 241 and to a D / A converter 243, and an encoder 244 for detecting the stepwise movement. The data input of the D / A converter 243 for digital data and the outputs of the comparator 242 and encoder 244 are connected to an input / output unit 245. This is a standard interface to the input means 25 of the security imprint evaluation device 29.

The mechanical identification of the symbols in the license plate can be done in two variants: a) via the integrally measured degree of blackening of each symbol or b) via edge detection for symbols.

The orthogonal edges of the symbol set according to FIG. 3 allow a particularly simple and easy to implement automatic detection method. The detection device contains a CCD line camera of medium resolution, for example 256 pixels. With a suitable lens, the height of the row of symbols is imaged on the 256 pixels of the line scan camera. The respective symbol field is now scanned column by column starting from the left to the right, starting with the right column. The line camera is preferably arranged stationary and the letter is guided under the line camera by a uniform motor drive. Since the row of symbols is always positioned in the same place within the franking imprint in accordance with an agreement once made, and the Franking imprint is in turn positioned on the envelope by already existing postal regulations, the guidance of the envelope on a fixed edge of the recognition device is sufficient.

The CCD line scan camera determines the contrast value of the pixels belonging to the column for each column. The output of the CCD line scan camera is connected to a comparator which uses binary value comparison to assign the binary data 1 and 0 to the pixels. Even with constant artificial lighting conditions, it will be necessary to adapt the threshold value to the very different light reflection factors of the different types of paper used for envelopes. For this purpose, the threshold value is guided according to a reference field FE 7, which consists of a series of bars and is arranged at the level of the symbol row and in front of it. The threshold value is determined as the mean value of the light-dark stripes of the reference field. The reference field is scanned either with an additional sensor (e.g. a photo transistor) or with the CCD line scan camera itself. In the latter case, the measured values of the line camera A / D have to be converted, the threshold value has to be formed from them in a computer connected via a standard interface and these have to be fed to the comparator via a D / A converter. Newer CCD line scan cameras have integrated the comparator, whereby its threshold value can be controlled directly by the computer with a digital value.

The binary data supplied by the line scan camera, including the comparator, are stored in columns and lines in an image memory in a computer-strengthened evaluation device. A simple and fast-running evaluation program examines the change in the binary data contents from 1 to 0 or 0 to 1 in each column of a symbol field, as is shown in FIG. 4c has been shown. For example, if the program begins to examine a column of a symbol field with the top (white) edge, the binary content of this first pixel data = 0. After m1 points in this column, the 1st change to binary content 1 (printed) takes place. The address of this 1st binary change and also the address m2 of the following binary change (1st unprinted) pixel is stored in a feature memory. In the symbol set shown in FIG. 3f, these two contours are already sufficient if the process is repeated for all columns of a symbol field. If a symbol field has n columns, then, after its detection, there are 2n data in the assigned feature memory, which, by comparison with the data sets of the pattern symbols stored in a pattern memory, enable an unambiguous assignment. Due to its simplicity, this method is real-time capable and has a high level of redundancy in relation to individual printing or sensor errors.

The quantized difference in degree of blackening between the symbols enables simple mechanical evaluation without complex pattern recognition. For this purpose, a suitably focused photo detector is arranged in a reading device.

This simple machine evaluation is possible even with different colored envelopes. A reference value is derived from the reference field to compensate for different measured values obtained, the differences between which are based on the different printing conditions or paper types. The reference value is used to evaluate the degree of blackening. With this reference value obtained, relative insensitivity to failed printing elements, for example a thermal bar 16 in the printer module 1, can advantageously be achieved.

The security imprint evaluation method according to FIG. 4d shows how this security information printed in the franking field is evaluated in an advantageous manner. It is necessary to enter individual sizes manually and / or automatically. In this case, the symbol row is arranged vertically between the value and the date stamp. It contains, in cryptified form, information about the printed postage value, a monotonously variable size (for example the date or an absolute time count) and the information about the serial number or whether the suspected mode is present. This information is recorded together with the plain text information visually / manually or automatically.

A first evaluation variant - according to FIG. 4d - consists in recovering the individual information from the printed marking and comparing it with the information openly printed on the mail piece. The symbol row detected in step 71 is converted into a corresponding crypto number in step 72. This unambiguous assignment can take place via a table stored in the memory of the evaluation device, use being made particularly advantageously of the symbol set in FIG. 3f, in which case each symbol field corresponds to one digit of the crypto number. The crypto number determined in this way is decrypted in step 73 with the aid of the crypto key stored in the evaluation device.

If the crypto numbers for the marking were generated according to a symmetrical algorithm (for example the DES algorithm), then after step 73 of the first evaluation variant, the initial number can be generated again from each crypto number. The starting number is a combination number KOZ and contains the number combination of at least two sizes, one size being the upper digits of the combination number KOZ and the other size is represented by the lower digits of the KOZ. The part of the number combination (for example the postage value) that is to be evaluated is separated and displayed in step 74.

Each digit of the initial number obtained after decryptification is assigned a meaning in terms of content. In this way, the information relevant for further evaluation can be separated. In addition to the postage value that is actually to be checked, which forms a size, it is essential a monotonously continuously variable size. A certain monotonously continuously variable size and further sizes form certain marking information variants.

Based on this consideration, in a first marking information variant, the total value of frankings stored in a franking machine register forms at least one first number assigned to the predetermined digits of the combination number. This aforementioned first number is a monotonously continuously variable. As a result, the marking changes with each print, which makes such a franked item of mail unmistakable and at the same time provides information about the current credit consumption. This information about the credit consumption is checked at regular intervals for plausibility on the basis of known credit consumption and credit reloading data stored in the data center. Since the last reload date, the total value of franking values preferably forms at least one first number assigned to the predetermined digits of the combination number. A second number, which is placed at predetermined positions in the combination number, is formed, for example, by the last reload date.

In a second marking information variant, this aforementioned first number forms in accordance with the total value on franking together with the second number, relating to the credit reload data at the time of the last reload, a monotonously continuously variable quantity.

In a third marking information variant, this aforementioned first number, in accordance with the total value of frankings, together with the second number, relating to the piece number data at the time of the last reload, forms a monotonously continuously variable quantity.

A corresponding number of alternative variants results if the residual value is now used to form the marking information instead of the total value of frankings (postage values used since the last credit reloading). The residual value is obtained by subtracting the sum of the used postage values from the previously loaded credit.

A corresponding number of further alternative variants are obtained if current date / time data in total or since the last reload date, total number of items or since the last reload date or other physical but temporally determined data (for example battery voltage) are included to form the marking information.

• a) Der aus dem Sicherheitsabdruck extrahierte tatsächliche abgerechnete Portowert PW_v wird mit dem im Schritt 70 ermittelten, als Klartext im Wertstempel abgedruckten Portowert PW_k im Schritt 75 verglichen. Stimmen beide nicht überein, wurde offensichtlich der abgedruckte Wertstempel manipuliert. Im Schritt 76 wird das Erfordernis einer Inspektion der Frankiermaschine vor Ort festgestellt und angezeigt.
• b) Der im Schritt 74 extrahierte Zeitpunkt t_n ist nun die aus dem Sicherheitsabdruck abgetrennte Monotonievariable MV_v und kennzeichnet in eindeutiger Weise den Zeitpunkt der Abbuchung des Portowertes bzw. der Ausführung der Frankierung. Diese Daten können bestehen aus dem Datum und der Uhrzeit. Wobei letztere nur so weit aufgelöst wird, daß die nächstfolgende Frankierung sich mit ihrem Zeitpunkt t_n vom vorigen Zeitpunkt t_n-1 unterscheidet. Diese Daten können auch eine fiktive Zeitzählung beginnend mit einem Fixdatum = 0 darstellen. Letzteres kann zum Beispiel den Beginn der Inbetriebnahme der Frankiermaschine betreffen.
  Jeder im Schritt 74 als Monotonievariable MV_v abgetrennter Zeitpunkt kennzeichnet also in eindeutiger Weise einen einzelnen Frankierabdruck dieser Frankiermaschine und macht diesen somit zum Unikat. Jede Frankiermaschine wird durch ihre Seriennummer charakterisiert, welche im Schritt 77 erfaßt wird. Durch einen Vergleich im Schritt 80 mit einem oder mehreren früheren Abdrucken dieser Frankiermaschine, wobei eine zur Seriennummmer zugeordnet gespeicherte vorhergehende Monotonievariable MV_k-1 im Schritt 79 abgerufen wird kann die o.g. Einmaligkeit überprüft werden. In vorteilhafter Weise bildet die Folge der Zeitpunkte ... t_n-1, t_n einer Frankiermaschine eine monotone Reihe. Es ist dann lediglich die Monotonie an Hand des letzten gespeicherten Zeitpunktes t_n-1 dieser Frankiermaschine zu überprüfen. Ist die Monotonie nicht gegeben, liegt eine Kopie von einem früheren Abdruck dieser Frankiermaschine vor, was im Schritt 76 angezeigt wird.
• c) Zur Prüfung, ob sich die Frankiermaschine während des Druckens im Verdachtsmodus befand, ist lediglich eine Susspiciosvariable SV_v im Schritt 81 auszuwerten. Nimmt das entsprechende Digit einen speziellen Wert an oder ist beispielsweise ungerade, so bedeutet dies, das diese Frankiermaschine überfällig zur Guthabenladung war. Die Feststellung des Verdachtsmodus im Schritt 81 und die Prüfung der Richtigkeit der Seriennummer im Schritt 78 können dabei auf einer abgespaltenen vierten zweistelligen Zahl basieren, welche im Normalfall aus der Seriennummer abgeleitet wird, d.h. wenn sich die Frankiermaschine nicht im Verdachtsmodus befindet. Im Schritt 76 erfolgt zur Anzeige eine Oderverknüpfung der Informationen aus den Schritten 75, 78, 80 und 81.

In the following exemplary embodiment, the current date / time data form a monotonously continuously variable variable for a monotony variable MV _v , which is separated from the combination number in step 74. The evaluation variant then comprises the following steps:

• a) The actual billed postage value PW _v extracted from the security imprint is with the value determined in step 70 as plain text in the value stamp printed postage value PW _k compared in step 75. If the two do not match, the printed value stamp was obviously manipulated. In step 76, the need for an inspection of the franking machine is determined and displayed on site.
• b) The time t _n extracted in step 74 is now the monotony variable MV _v separated from the security imprint and uniquely identifies the time when the postage value was debited or the franking was carried out. This data can consist of the date and time. The latter is only resolved to such an extent that the subsequent franking differs with its time t _n from the previous time t _n-1 . This data can also represent a fictitious time count starting with a fixed date = 0. The latter can relate, for example, to the start of commissioning of the franking machine.
  Each point in time separated in step 74 as a monotony variable MV _v thus uniquely identifies an individual franking imprint of this franking machine and thus makes it unique. Each franking machine is characterized by its serial number, which is recorded in step 77. The above _- mentioned uniqueness can be checked by comparing in step 80 with one or more previous impressions of this franking machine, with a previous monotony variable MV _k-1 stored in association with the serial number being called up in step 79. The sequence of times ... t _n-1 , t _{n of} a franking machine advantageously forms a monotonous row. It is then only necessary to check the monotony on the basis of the last stored time t _{n-1 of} this franking machine. If the monotony is not present, there is a copy of an earlier impression of this franking machine, which is displayed in step 76.
• c) To check whether the franking machine during of the printing was in the suspected mode, only a sweet picios variable SV _{v has to be} evaluated in step 81. If the corresponding digit takes on a special value or is, for example, odd, this means that this franking machine was overdue for credit loading. The determination of the suspected mode in step 81 and the checking of the correctness of the serial number in step 78 can be based on a split fourth two-digit number which is normally derived from the serial number, ie if the franking machine is not in the suspected mode. In step 76, the information from steps 75, 78, 80 and 81 is ORed for display.

A device equipped with an appropriate program (laptop) is sufficient for evaluation. In this case, variables G1, possibly G4 and at least one quantity G5 known only to the franking machine manufacturer and / or the data center and communicated to the postal authority and not communicable from the franking machine stamp image can also be encrypted. These are also recovered from the marking by decryption and can then be compared with the user-specific saved values. The lists stored in the memory 28 can be updated via a connection to the data center 21.

The lists created for each serial number or each user, preferably stored in databases of the data center for all franking machines, contain data values for each variable, which are used to check the authenticity of a franking. Thus, on the one hand, the assignment of the symbols to the listed valences and, on the other hand, in the case of another set of symbols (not shown in FIG. 3f), the assignment of meaning and degree of blackening can be defined differently for different users.

The advantage of a set of symbols of the type specified is that, depending on the requirements of the respective national postal authority, an authentic franking stamp can be identified in a simple manner mechanically (for example by integrally measuring the degree of blackening of the symbols) and / or manually using the conceptual contents of the symbols ,

In a second evaluation variant (not shown in FIG. 4d), the operator enters manually or automatically unencrypted variables G0, G2, G3 and G4 into the evaluation device 29 by means of a reading device in order to use the same key and encryption algorithm as that in FIG the franking machine is used to first derive a crypto number and then a row of marking symbols. Further details are given in connection with step 45, shown in FIG. 10, of forming new coded window data of "type 2" for a marking image. A marking generated from this is displayed and compared by the operator with the marking printed on the postal matter (envelope). The comparison to be made by the operator is matched by the symbolism of the markings shown in the output means 25 and printed on the postal matter.

In a third evaluation variant - also not shown - in a first step, the trained examiner automatically enters the graphic symbols one after the other into the input means 25 manually or by means of a suitable reading device 24 in order to convert the marking printed on the mail item (letter) into at least one convert the first crypto number KRZ1 back. Here, the actuating elements, in particular the keyboard, of the input device can be identified with the symbols in order to facilitate manual input. In a second step, the openly printed sizes from the franking machine stamp image, in particular G0 for the serial number SN of the franking machine, G1 for the advertising slogan frame number WRN, G2 for the date DAT and G3 for the postage value PW, G4 for non-repeating time data TIME and from at least one size G5 INS known only to the franking machine manufacturer and / or the data center and communicated to the postal authority in order to form at least one comparison crypto number VKRZ1. The verification is carried out in a third step by comparing two crypto numbers KRZ1 with VKRZ1 in the computer 26 of the evaluation device 29, a signal for authorization in the case of equality or the non-authorization in the event of a negative comparison result (inequality) being emitted.

In the exemplary embodiment explained below, an evaluation according to the second or third evaluation variant is explained in more detail.

The first size G1 is the advertising slogan frame number WRN, which the inspector recognizes from the franking stamp image. In addition to the user, this first size is also known to the franking machine manufacturer and / or data center and is communicated to the postal authority. In a variant, preferably with a data connection to the data center, the advertising slogan frames WR _n belonging to the serial number SN of the respective franking machine with assigned numbers WRN _n are displayed on a screen of the data output device 27. The comparison with the advertising slogan frame WR _b used on the letter is made by the examiner, who enters the number WRN _n determined in this way.

The stored lists transferred from the data center into the memory 28 contain the current one Assignment of the parts of the advertising slogan frame WRNT to a second size G2 (for example the date DAT) and on the other hand the assignment of symbol lists to a third size G3 (for example the post value PW). In addition, a list of parts SNT of the serial number SN selected by the first size G1, in particular the advertising slogan frame number WRN, can be present. User-specific information, such as, for example, the advertising slogan frame number WRN, can be used for random manual evaluation of the marking, in that decoding lists can be selected on the basis of the user-specific information and contain the corresponding data records. The size G2 (DAT) is then used to determine the byte from the data record which is used when generating the combination number.

In the preferred variant, a monotony test is used on the one hand to check the unmistakability of the impression. The examiner takes the serial number SN from the windows FE2 and FE3 of the impression and ascertains the franking machine user. The advertising slogan number can also be used here, since these are usually assigned to certain cost centers if the same machine is used by different users. In the above Lists are data from the last check, among others. also data from the last inspection entered. Such data are, for example, the number of pieces if the machine has an absolute piece count, or the absolute time data if the machine has an absolute time count.

In the first test step, the correctness of the printed postal value is checked in accordance with the valid regulations of the postal authority. Subsequent manipulation of the value print can be detected with fraudulent intent. In the second test step, the monotony of the data, in particular which checked in window FE8. This allows copies of a franking imprint to be identified. Manipulation for the purpose of forgery is therefore not promising, since this data is additionally printed in the form of a cryptified row of symbols in at least one marking field. In the case of an absolute time or piece count, the number given in window FE8 must have increased since the last check. In the FE8 window, nine digits are shown, which allows the display of a period of approximately 30 years with a resolution of seconds. Only after this time would the counter overflow. These sizes can be recovered from the marking in order to compare them with the open, unencrypted sizes. In a third optional test step, the manipulation can also be used to check and determine the other variables, in particular the serial number SN of the franking machine, and, if necessary, the cost center of the user. The information, like the advertising slogan frame number WRN, on the other hand, can be indicated by a predetermined window FE9. The associated window data are of type 1, ie they are changed less often than window data of type 2, such as the TIME data in window FE8 and the marking data in window FE6.

In a further embodiment variant, the data of the windows FE8 and FE9 are not printed openly unencrypted, but are only used for encryption. Therefore, the windows FE8 and FE9 shown in FIG. 3a are missing in the franking machine print images - shown in FIGS. 3b to 3e - in order to clarify these variants.

In a preferred input variant for the test, the temporarily variable variables to be entered, for example the advertising slogan frame number WRN, are The date DAT, the postage value PW, the time data TIME and the serial number SN are automatically detected and read by means of a reader 24 from the corresponding field of the franking machine stamp image. The arrangement of the windows in the franking machine imprint must be observed in a predetermined manner.

Other temporarily variable sizes assigned to the respective serial number SN are only known to the franking machine manufacturer and / or data center and are communicated to the postal authority. For example, the defined number of frankings achieved during the last inspection serves as a fifth size G5.

All sizes to be entered, except for sizes G1, G4 and G5, must be evident from the individual windows FE _{j of} the franking machine stamp image. The size G5 forms, for example, the key for the encryption, which is changed at predetermined time intervals, ie after each inspection of the franking machine. These time intervals are so dimensioned that even when using modern analysis methods, for example differential cryptanalysis, it is certainly not possible to reconstruct the original information from the markings in the marking field in order to subsequently produce counterfeit stamp images.

For example, size G1 corresponds to an advertising cliché frame number. Corresponding number strings (sTrings) for window or frame input data are stored in the sub-memory areas ST _i , ST _{j of} the working memory 5 of the franking machine.

The sizes G0, G2 and G3 correspond, for example, to the window data stored in the sub-memory areas ST _{j of} the non-volatile main memory 5 of the postage meter machine, the size G0 in the windows FE2 and FE3 from the sub-storage areas ST ₂ and ST ₃ , the size G2 in the window FE4 comes from the sub-storage area ST ₄ and the size G3 in the window FE1 from the sub-storage area ST ₁ .

In the sub-memory areas B ₅ B ₆ and B _{7 of} the working memory 5 of the franking machine, the stored window data for an advertising slogan text part, a marking field and possibly for a reference field are available. It should be noted that in some of the sub-memory areas of the main memory 5 of the franking machine identified as B _k , the window data are written and / or read out more often than in other sub-memory areas. If the non-volatile working memory is an EEPROM, a special storage method can be used to ensure that it remains safely below the limit number of storage cycles that is permitted for it. On the other hand, a battery-backed RAM can also be used for the non-volatile working memory 5.

FIG. 5 shows a flowchart of the solution according to the invention, the method being based on the presence of two pixel memory areas shown in FIG. 1.

According to the frequency of change of data, decoded binary frame and window data are stored in two pixel storage areas before printing. The (semi-variable) type 1 window data, such as the date, serial number of the franking machine and the cliché text part that is not to be changed continuously, can be decompressed together with the frame data in binary data before printing and combined to form a pixel image stored in the pixel memory area I. In contrast, constantly changing (variable) window data of type 2 are decompressed and as binary window data in the second pixel memory area II saved before printing. Type 2 window data are, for example, the mail value and transport-dependent post value to be printed and / or the constantly changing marking. After a print request, the binary pixel data from the pixel memory areas I and II are combined to form a print column control signal for each column of the print image during the course of a print routine.

A franking machine can run through several states (communication mode, test mode, franking mode and other modes) after it has been switched on and initialized, which was described in more detail, for example, in application P 43 44 476.8, which is described in more detail in DE 42 17 830 A1 and DE 42 17 830 A1 , After the start step 40 of the franking mode, the input of the cost center in step 41 results in an automatic entry of the window and frame data that was last saved and in step 42 a corresponding display. Relevant memory areas C, D, E of the non-volatile working memory 5 are also queried with regard to a set assignment of window and frame data or cost center. According to the aforementioned or in another manner, for example in the manner described in DE 42 21 270 A1, a cliché text part which is assigned to a specific advertising cliché can also be specified automatically.

In step 43, frame data in register 100, 110, 120,... Of the volatile working memory 7a are adopted and control code is detected and stored in the volatile working memory 7b. The remaining frame data are decompressed and stored in the volatile pixel memory 7c as binary pixel data. Likewise, the window data are loaded into registers 200, 210, 220,... Of the volatile working memory 7a, and control code is detected and stored in the volatile working memory 7b, and the remaining window data after it has been decompressed correspondingly stored in columns in volatile pixel memory 7c.

In Figure 9a, the decoding of the control code, decompression and loading of the fixed frame data as well as the formation and storage of the window parameters and in Figure 9b the embedding of decompressed current window data of type 1 in the decompressed frame data after the start of the franking machine or shown in detail after editing frame data.

In step 44, either the decompressed frame and window data of type I are stored as binary pixel data in the pixel memory area I and can be processed further in step 45, or frame and / or window data is re-entered. In the latter case, a branch is made to step 51.

In step 51 the microprocessor determines whether an input has been made via the input means 2 in order to replace window data, for example for the postage value, with a new one or to replace or edit window data, for example for a cliché text line. If such an entry has been made, the necessary sub-steps for the entries are carried out in step 52, i.e. a finished other data record is selected (cliché text parts) and / or a new data record is generated which contains the data for the individual characters (numbers and / or letters) of the input size.

In step 53, corresponding data records are called up for a display for checking the input data and are provided for the subsequent step 54 for reloading the pixel memory area I with the window data of type 1.

FIG. 9c shows step 54 in detail for embedding decompressed semi-variable window data of type 1 in the decompressed frame data after a new entry or after editing this window data of type 1. The data from data records called up in accordance with the input are evaluated in order to detect control codes for a “color change” or a “column end” which are required for embedding the newly entered window data. Then, those data that are not control codes are decompressed into binary window pixel data and embedded in the pixel memory area I in columns.

On the other hand, if it was determined in step 51 that no window data should be selected or edited, a branch is made to step 55. In step 55, the possibility of changing the fixed advertising slogan or frame data leads to a step 56 in order to carry out the input of the currently selected frame data sets together with the window data sets. Otherwise, the process branches to step 44.

If a new input of selected special sizes is to take place, a flag is set in step 44 and taken into account in the subsequent step 45 for the formation of data for a new series of marking symbols if a step 45b is to be processed here according to a second variant.

The new coded window data of type 2 is formed in step 45. The marking data for a window FE6 are preferably generated here, preceding steps for encrypting data to generate a crypto number being included. In this step 45, a shape as a bar code and / or symbol chain is also provided. The formation of new, coded type 2 window data for a marking image is explained in two variants with reference to FIG.

In a first variant, a monotonously variable size is processed in a step 45a, so that ultimately each print is unmistakable due to the printed symbol row. In a second variant, other sizes are processed in a step 45b before step 45a.

The correspondingly formed data record for the marking data is then loaded into an area F and / or at least in a sub-memory area B _{6 of} the non-volatile working memory 5 and thereby overwrites the previously saved data record, for which window characteristic values have already been determined or are predetermined and are only now in the volatile working memory 7b are stored. The sub-memory area B ₁₀ is preferably provided for a data record which leads to the printing of a second row of marking symbols, as is shown in FIGS. 3c and 3d. In addition, double rows of symbols can also be printed side by side - in a manner not shown in FIG. 3b. The area F is preferably provided for a data record which leads to the printing of a bar code, as is shown in FIG. 3e.

In step 46, the data of the data record is transferred byte by byte for marking in registers in the volatile working memory 7a and the control characters "color change" and "column end" are detected, in order then to decode the remaining data in the data record and to decode the binary window pixel data of the type 2 to load into the pixel memory area II of the volatile working memory 7c. FIG. 11 shows the decoding of the control code and conversion into decompressed binary window data of type 2 in detail. Such type 2 window data are identified in particular by the index k and relate to the data for the window FE6, possibly FE10 for marking data and possibly FE8 for the TIME data of the absolute time count. Just the time data represent a monotonically changeable, since time-dependent, increasing quantity. First, BCD-packed time data delivered from the clock / date module 8 are, if appropriate, converted into a suitable data record containing time data with run-length-coded hexadecimal data. Now they can also be stored in a memory area B ₈ for window data FE8 of type 2 and / or loaded immediately in step 46 into register 200 of the working memory 7a or into the print register 15 in columns.

In step 47, if a print request has been made, the step 48 containing a print routine is waited for and if the print request has not yet taken place, the print request is waited in a waiting loop. In one embodiment, the waiting loop - as shown in FIGS. 5 and 6 - is directly traced back to the beginning of step 47. In another embodiment, the waiting loop is - in a manner not shown in FIGS. 5 and 6 - returned to the beginning of step 44 or 45.

The print routine - shown in detail in FIG. 12 - carried out in step 48 for the compilation of print column data from the pixel memory areas I and II takes place while the print register (DR) 15 is being loaded. The printer controller (DS) 14 effects immediately after loading the Print register (DR) 15 a print of the loaded print column. It is then checked in step 50 whether all columns for a franking machine print image are printed by comparing the current address Z with the stored end address Z _end . If the printing routine has been carried out for a piece of mail, a branch is made to step 57. Otherwise, the process branches back to step 48 in order to generate and print the next print column until the print routine has ended.

In step 57 it is checked whether further mail pieces are to be franked. If this is not the case and the printing routine is ended, step 60 is reached and the franking is thus ended. Otherwise the end of printing has not yet been reached and the process branches back to step 51.

FIG. 6 shows a fourth variant of the solution according to the invention, in which, in deviation from the block diagram according to FIG. 1, only one pixel memory area I is used. Decoded binary frame data and window data of type 1 are assembled and stored in this pixel memory area I before printing. The steps are identical except for step 46, which is saved here in this variant according to FIG. 6, and step 48, which is replaced here by step 49. Up to step 46, there is essentially the same sequence in the sequence.

In FIG. 13, the printing routine for compiling data taken from a pixel memory area I and working memory areas is discussed in more detail. The constantly changing type 2 window data is decompressed in step 49 during the printing of each column and, together with the binary pixel data to be printed column by column, is combined from the pixel memory area I to form a printing column control signal. Type 2 window data are, for example, the postage and transport-dependent postage value to be printed and / or the constantly changing marking.

Using a postage stamp image shown in FIG. 7 and the data of the print control signal assigned to a print column, its generation from the frame and window data is explained.
A letter envelope 17 is placed under the print module 1 of an electronic franking machine at speed v moved in the direction of the arrow and, starting with column s ₁ , printed in columns with the postage stamp image shown. The printer module 1 has, for example, a print bar 16 with a number of print elements d1 to d240. The ink-jet or a thermal transfer printing principle, for example the ETR printing principle (Electroresistive Termal Transfer Ribbon), can be used for printing.

A column s _f to be printed has a printing pattern 30 to be printed, which consists of colored printing dots and non-colored printing dots. A colored printing dot is printed by a printing element. In contrast, the non-colored printing dots are not printed. The first two printing dots in the printing column s _f are colored in order to print the frame 18 of the postage stamp image 30. Then alternate 15 non-colored (ie not active) and 3 colored (ie active) printing dots until a first window FE1 is reached, in which the postage (postage) is to be inserted. This is followed by a range from 104 non-colored pressure dots to the end of the column. Such run length coding is implemented in the data set using hexadecimal numbers. The space requirement is minimized by having all the data in such a compressed form.

With "QQ" hexadecimal data, 256 bits can be generated. If the required control code bits are subtracted from this, less than 256 bits remain for driving the dots generating means. However, if additional control characters "00" causing a color change are used, even more than 256 dots can be controlled, but more memory space is now required in the sub-memory area A _{i of} the main memory 5. The exemplary embodiments according to FIGS. 9, 11, 12 and 13 are designed for such a high-resolution printer module.

Control characters "00" are provided for color changes. This means that a subsequent hexadecimal number is still considered colored (f: = 1), which would otherwise be considered non-colored. A reset color flip-flop (f: = 0) is set when the color changes (f: = 1) and switched again the next time the color changes (f: = 0). With this principle, 256 dots or more can be addressed. The register 15 in the print controller 14 is loaded bit by bit from the pixel memory (e.g. for a print column with N = 240 dots).

Other control characters are "FE" for the end of the column, "FF" for the end of the image, "F1" for the start of the window of the first window FE1, etc.

In the following example chosen to explain FIG. 7, less memory space is required in the ROM compared to a print column to be controlled with more than 240 dots, since the control characters are placed favorably. For hexadecimal data "01", "02", ..., "QQ", ... "F0", 1 to 240 dot ("F0" = [F * 16 ¹ ] + [0 * 16 ⁰ ] = [ 15 * 16] + [0 * 1] = 240) can be controlled.

The control code "00" for color changes can theoretically be omitted here, since with a single hexadecimal number "F0" an entire print column of 240 dots with the same coloring can be completely defined. Nevertheless, if there is only an imperceptible additional memory requirement, a color change can also make sense for several windows in one column.

According to this method, a data record for the pressure column s _f results in the form shown in sections:
... "2", "0D", "02", "4F", "F1", "68", "FE", ..., ...

When transferring to a register 100 of the µP control 6, control characters are detected from hexadecimal numbers "QQ" and evaluated in the course of a step 43.

In this evaluation, window characteristic values Z _j , T _j , Y _j or Z _k , T _k , Y _{k are also} generated and together with defined values for the start address Z ₀ , end address Z _end and the total run length R, ie the number of each printing column required binary data, stored in volatile memory RAM 7b.

A maximum of 13 windows could be called for the 13 control characters "F1" to "FD" and the start addresses determined. For example, with "F6" for the start of a window of type FE6 window FE6, a start address Z ₆ can be determined and saved as a window parameter.

FIG. 8 shows the window characteristic values relating to a pixel memory image and stored separately therefrom for a first window FE1. The window has a window column run length Y ₁ = 40 pixels and a column number of approx. 120, which is stored as window column variable T ₁ . If for this purpose the window start address Z ₁ is stored as the destination address, the position of the window FE1 in the binary pixel image can be reconstructed at any time.

Binary data converted from the registers 100, 200 are read bit by bit into the volatile pixel memory RAM 7c, with an address being assigned to each bit. If the hexadecimal number loaded in the register is a detected control character "F2", the window characteristic value Z _{j is determined} for a start address of the window of number j = 2 with a total of n windows. This means that window data can later be inserted into the frame data at this point identified by the address. It is the window column run _length Y _j <R total run length of the print column. Out addition with R the new address can be created in the same row but in the next column.

FIG. 9a shows the decoding of the control code, decompression and loading of the fixed frame data as well as the formation and storage of the window characteristic values. A control code "color change" was taken into account when considering the creation of very high-resolution prints. A color flip-flop 1 must therefore be reset to f: = 0 in a first sub-step 4310. The source address Hi for finding the frame data is initially H _i : = H _i - 1 and the destination address Z: = Z ₀ .

For the window data of type 1, the window column variable T _j : = 0 is set in sub-step 4311, for j = 1 to n windows and for the window data type 2, the window column variable T _k : = 0 for k = 1 to p windows. In sub-step 4312, the source address H _i for frame data is incremented and a color change is carried out so that the initial data byte is evaluated as colored, for example, which later leads to correspondingly activated printing elements.

The above-mentioned byte, which is a run-length-coded hexadecimal number for frame data, is now transferred in sub-step 4313 from the area A _{i of} the non-volatile memory 5 which is automatically selected by the cost center KST to a register 100 of the volatile memory 7a. Control characters are detected and a run length variable X is reset to zero.

A control character "00" for a color change is recognized in sub-step 4314, which, after branching back to sub-step 4312, leads to a color change, ie the next run length-coded hexadecimal number inactivates the printing elements in accordance with Run length. Otherwise, it is determined in sub-step 4315 whether there is a control character "FF" for the end of the image. If one is recognized, point d has been reached in accordance with FIGS. 5 or 6 and step 43 has been processed.

Otherwise, if such a control character "FF" for end of image is not recognized in sub-step 4315, it is checked in sub-step 4316 whether there is a control character "FE" for an end of column. If one is recognized, the color flip-flop 1 is reset in sub-step 4319 and a branch is made to sub-step 4312, in order then to load the byte for the next printing column in sub-step 4313. If there is no end of column, it is determined in sub-step 4317 whether there is a control character for a window of type 2. If one has been recognized, a branch is made to sub-step 4322. Otherwise, it is examined in sub-step 4318 whether there is a control character for type 1 windows. If this is the case, a point c _{1 is} reached at which a step 43b - shown in FIG. 9b - is carried out.

If no control character for window data of type 1 is recognized in sub-step 4318, then the run-length-coded frame data are present in the called byte, which are decoded in sub-step 4320 and converted into binary frame pixel data and stored in the pixel memory area I of the pixel memory 7 c under the set address Z. In the following sub-step 4321, the column run length variable X is determined in accordance with the number of bits converted and then the target address for the pixel memory area I is increased by this variable X. A point b has thus been reached and in order to call a new byte, the process branches back to sub-step 4312.

In step 4322, if a control character for Window data of type 2 exist, the storage of window parameters T _k determined. If a window characteristic, in this case the window column run variable T _{k is} still at the initial value zero, the window start address Z _k corresponding to the address Z is determined in a sub-step 4323 and stored in the volatile working memory 7b. Otherwise, a branch is made to a sub-step 4324. Sub-step 4323 is also followed by sub-step 4324, in which the window characteristic value of the window column variable T _{k is} incremented. In the subsequent sub-step 4325, the previous window column variable T _k stored in the volatile main memory 7b is overwritten with the current value, and the point b is reached.

The window parameters are thus loaded for k = 1 to p windows, in particular FE6 and possibly FE10 or FE8. The method then branches back to sub-step 4312 in order to load a new byte in sub-step 4313. The bits (dot = 1) converted from the hexadecimal data are therefore transferred in byte-by-byte to the pixel memory area I of the volatile pixel memory 7c in step 43a - shown in FIG. 9a and are stored one after the other as binary data.

FIG. 9b shows the embedding of decompressed current window data of type 1 in the decompressed frame data after the start of the franking machine or after editing frame data. Assuming a control character for windows of type 1 was recognized in sub-step 4318, point c ₁ and thus the beginning of step 43b are reached.

In step 4330, the storage of window parameters T _{j is} determined. If a window characteristic, in this case the window column run variable T _{j is} still at the initial value zero, the window start address Z _{j will} correspond in a sub-step 4331 the address Z is determined and stored in the volatile working memory 7b. Otherwise, a branch is made to a sub-step 4332. Sub-step 4331 is also followed by sub-step 4332, in which the window characteristic of the window column run length Y _j and the window column run length variable W _j to an initial value of zero, and the window source address U _j to the initial value U _oj -1 and the second color flip-flop for windows "Print in non-color" can be set.

In the subsequent sub-step 4333, the previous window source address U _{j is} incremented and a color change is carried out, so that any window bytes that are loaded in the subsequent sub-step 4334 are evaluated as colored, which subsequently leads to activated printing elements during printing.

In sub-step 4334, a byte from the sub-memory areas B _j in the non-volatile main memory 5 is loaded into register 200 of the volatile main memory 7 a and is thereby detected for control characters.

In sub-step 4335, the window column run length Y _j is incremented by the value of the window column run length variable W _j . In sub-step 4336 it is determined whether there is a control character "00" for color changes. If one has been recognized, the process branches back to sub-step 4333. Otherwise, it is examined in sub-step 4337 whether there is a control character "FE" for the end of the column. If this is not the case, window data is available. In a sub-step 4338, the content of the register 200 is decoded with the help of the character memory 9 and the binary window pixel data corresponding to this byte is stored in the pixel memory area I of the pixel memory 7c.

Then in a sub-step 4339 the window column run length variable W _{j is} determined to increment the address Z by the value of the variable W _j . The new address is thus available for a new byte of the data record to be converted, and a branch is made back to sub-step 4333, in which the new source address for a byte of the data record for window FEj is also generated.

If a control character "FE" for the end of a column was recognized in sub-step 4337, a branch is made to sub-step 4340, in which the window column variable T _{j is} incremented and the volatile working memory 7b stored window column variable T _j and the window column run length Y _{j are} overwritten with the current value. A color change is then carried out in sub-step 4341 and point b has been reached.

This completes step 43b and new frame data could be implemented in step 43a if a next window is not recognized or point d has been reached.

FIG. 9c shows the embedding of decompressed variable window data of type 1 in the decompressed frame data after editing this window data of type 1. As has already been shown, pixel memory data and window characteristics have already been stored before the start of step 54. The sub-step 5440 begins with the determination of the number n 'of windows for which the data has been changed and a determination of the associated window start address Z _j and window column variable T _j for each window FEj. A window counter variable q is also set to zero.

In sub-step 5441 it is determined whether the value of the window counter variable q has already reached the value of the number of window changes n '. With zero changes, ie n '= 0 the comparison is positive and point d is reached. Otherwise, a branch is made to sub-step 5442, the window start address Z _j and the window column variable T _{j being taken} from the volatile working memory 6b for a first window FEj whose data has been changed. In addition, the source address U _{j is set} to an initial value U _oj -1, the target address Z _{j is used} to address the pixel memory area I, a window column counter P _j and the second color flip-flop are reset to the initial value zero.

In the following sub-step 5443, the source address is incremented and a color change is carried out before the sub-step 5444 is reached. In sub-step 5444, a byte of the changed data record is called up in the non-volatile memory and transferred to the register 200 of the volatile memory 7a, control characters being detected. If a control character "00" for color change is branched back to sub-step 5443 in sub-step 5445. Otherwise, branch to sub-step 5446 to look for control characters "FE" for the end of a column. However, if such a control character is not present, the content of register 200 can be decoded in the following sub-step 5447 with the cooperation of character memory 9 and converted into binary pixel data for the window to be changed. These now replace the previous pixel data stored in area I of the pixel memory 7c from the position predetermined by the window start address Z _j . The bits converted are counted as window run length variables W _j , with which the target address V _{j is} incremented in sub-step 5448. The method then branches back to sub-step 5443 in order to load the next byte in sub-step 5444.

However, if a control character "FE" for the end of the column is recognized in sub-step 5446, then sub-step 5449 is followed branches in which the window _column counter P _{j is} incremented.

In sub-step 5450 it is examined whether the window characteristic value for the associated window column variable T _{j has been} reached by the window column counter P _j . Then, for a first changed window, all change data would be loaded into the pixel memory area I and branching back to the sub-step 5453 and from there to the sub-step 5441 in order to transfer change data into the pixel memory area I for a possibly second window. For this purpose, the window counter variable q is incremented in sub-step 5453 and the subsequent window start address Z _{j + 1} and the subsequent window column variable T _{j + 1 are} determined.

Otherwise, if the window column variable T _j has not yet been reached by the window column counter P _j in sub-step 5450, a branch is made back to sub-step 5443 via sub-steps 5451 and 5452 in order to overwrite a further window column in the pixel memory area until the old binary window pixel memory data is replaced by the new one have been completely replaced. For this purpose, the target address for the data in the pixel memory area I is incremented by the frame total column length R in sub-step 5451. The target address V _j is thus set to the next column for binary pixel data of the window in the pixel memory area I. In sub-step 5452, the color flip-flop is reset to zero, so that the conversion begins with pixel data that is rated as color.

If no further new entry is found in step 44, new coded window data of type 2 can now be formed in step 45 for a marking image, in particular according to a first variant with step 45a.

Step 45 comprises further sub-steps, shown in FIG. 10, for forming new, coded window data of type 2 for a marking image.

While there is already decompressed binary pixel data in the pixel memory area I, after step 44 in step 45 the output data for the data records containing the compressed data for the windows FEj and possibly for the frame data are required again in order to generate new coded window data of type 2 for one To form a series of marking symbols. The individual output data (or input data) are stored in the memory areas ST _w as a BCD-packed number in accordance with the respective sizes G _w . In addition to the data records stored non-volatile in the sub-memory areas A _i and B _j, the data for a data record for window FEk of type 2 are now compiled in several steps and stored non-volatile in a sub-memory area B _k .

The method for the rapid generation of a security imprint comprises, after provision of quantities, a sub-step 45a carried out by the microprocessor of the control device 6 of the franking machine before a print request (step 47).

In a first variant 1, a row of marking symbols is generated in step 45a. Due to the amount of information from sizes G0 to G5, which are only supposed to be partially printed open and unencrypted in the franking machine stamp image, at least some of the sizes are used in the postage meter machine to form a single number combination (sub-step 45i), which results in a single one Encrypted crypto number (sub-step 452) and then converted into a marking to be printed on the postal matter (sub-step 453). The data record to be generated for the marking in a window FE6 can be stored in a final sub-step 454. Then point c _{3 is} reached. This first variant, executed in partial step 45a, saves the time that would otherwise be required in the franking machine for generating further crypto numbers.

As has already been explained in more detail, it is advantageous if the control device 6 provides part of a quantity G0, G1 which characterizes the user of the franking machine in order to form third contiguous digits of the combination number KOZ1.

In sub-step 451, the upper 10 digits of the combination number KOZ1 for the TIME data (size G4) and the lower 4 digits for the postal value (size G3) are preferably provided from the memory areas ST _w . This results in a combination number with 14 digits, which would then have to be encrypted. When using the DES algorithm, a maximum of 8 bytes, ie 16 digits, can be encrypted at once. This means that the combination number KOZ1 can be supplemented by a further size in the direction of the least significant digits. For example, the supplementary part can be a part of the serial number SN or the number WRN of the advertising slogan frame or the byte that is selected from the data record of the advertising slogan frame depending on a further size.

This combination number KOZ1 can be encoded in a sub-step 452 in about 210 ms into a crypto number KRZ1, a number of further steps known per se taking place here. Then, in sub-step 453, the crypto number KRZ1 is to be converted into a corresponding symbol row on the basis of a predetermined marking list stored in the memory areas M of the non-volatile working memory 5. Here, in particular the increased density of information that is so advantageous for later printing.

Even if a set of 10 symbols - shown in Figure 3f - i.e. If an increase in the information density compared to the crypto number KRZ1 is used, but two rows of markings (next to each other or one below the other) were printed, further symbols could be left with which further information could be displayed unencrypted or encrypted. In this case, it is preferably information that does not change or changes only slightly, and only needs to be encrypted once and converted into a symbol row. This is preferably size G5, i.e. Inspection data (INS), for example the date of the last inspection or the rest of the serial number SN or SN and the byte of the data record of the advertising slogan frame, which was not included in the first combination number KOZ1, or selected predetermined parts thereof. In FIG. 3c, a row with a total of 20 symbols is depicted in windows FE6 and FE10, arranged here orthogonally to one another, with which, for example, the total of 8 bytes, i.e. 16 digits, the crypto number KRZ1 and other information may be reproduced unencrypted or otherwise encrypted.

A second variant with a step 45b in addition to step 45a differs from the first variant in other output or input variables which have to be considered in the same way. In the second variant, a row of marking symbols is generated in succession in two steps 45b and 45a, step 45b being carried out analogously to step 45a.

In a first sub-step 450 of the step 45 carried out by the control device 6, it is checked whether a flag has been set in order to carry out the test of sub-steps 45b and / or 45a to cause that in sub-step 45b a second combination number KOZ2 having at least the other part of the size G0, G1 characterizing the user of the franking machine is formed, then encrypted to a second crypto number KRZ2 and then in at least a second row of marking symbols MSR2 is implemented using a second set of SSY2 symbols.

In sub-step 455, a combination number KOZ2 is formed compared to sub-step 451, with the sizes for other parts of the serial number, for advertising cliché (frame) number, among others, being shown here. Sizes. As in sub-step 452, a crypto number KOZ2 is formed in sub-step 456. In sub-step 457, the transformation into a series of marking symbols then takes place, which is temporarily stored in non-volatile manner in sub-step 458.

This is followed by sub-step 45a, which comprises sub-steps 451 to 453. If necessary, this can be completed by a sub-step 454. Then point c _{3 is} reached.

In spite of twice using the DES algorithm, time is saved because an evaluation is carried out in a first sub-step 450 to determine whether the selected quantities required for forming the series of marking symbols in sub-step 45b have been changed by an input. In the case of new input of selected special sizes, a flag would be set in step 44 and taken into account in the subsequent formation of data for a new series of marking symbols in order to process step 45b here. If this is not the case, then it is possible to fall back on marking symbol rows which have been formed earlier and are stored in a non-volatile manner in a memory area 458 or parts of the marking symbol row become.

In one embodiment variant, an encryption algorithm other than the DES is used in sub-step 456 to save time.

In an advantageous embodiment variant, a transformation is carried out in sub-step 453 of the first variant or in sub-step 457 of the second variant in order to additionally increase the information density of the marking symbol series compared to the crypto number KRZ1 or KRZ2. For example, in the case of a crypto number with 16 digits, a set of 22 symbols is now used in order to represent the information using only 12 digits - in the manner shown in FIG. 3b. The row of marking symbols shown there must be doubled for two crypto numbers. This can be done by means of a further marking symbol row lying parallel to the marking symbol row shown in FIG. 3b.

Correspondingly, it can further be shown that only a symbol set comprising 14 symbols is required for a row of marking symbols of 14 digits. The previously described check in the postal authority of mail items having such marking symbol rows can consequently - after the second evaluation variant - by transforming the marking symbol row back into crypto numbers KRZ1 or KRZ2, the subsequent decoding of them into combination numbers KOZ1 and possibly KOZ2, the individual sizes of which correspond to those on the Postage in the franking image are compared to printed sizes.

A row of marking symbols - as has been shown in FIG. 3a - is designed for 10 digits and can represent a crypto number KRZ1 if the symbol set has 40 symbols. Here is a fully automated input and evaluation - if only subjective errors of the Avoiding the inspector when recognizing the symbols makes sense.

In a step following step 45, the data of a data record for the marking symbol row are then embedded in the remaining pixel data after their decompression. According to the invention, two different options are provided for this. One possibility is explained in more detail with reference to FIG. 11, another with reference to FIG. 13.

FIG. 11 explains step 46 in FIG. 5 in particular. In a sub-step 4660, window parameters Z _k and T _{k are} specified for changed window data, the window change number p ′ is determined and a window count variable q is set to zero. A sub-step 4661 evaluates whether window count variable q is equal to the window change number p '. Then point d ₃ and thus the next step 47 would already have been reached. However, this path is not regularly followed at the beginning, since the monotonously increasing size constantly creates new marker symbol rows for each print.

Otherwise, if a change has been made, the process branches to sub-step 4662 in order to enter window characteristic values corresponding to the changed windows and to set initial conditions.

In a sub-step 4663 a new source address for the data of the data record of the window FEk just processed is generated in order to load a byte of the coded window data of type 2 from the memory area B _k into registers of the non-volatile memory 7 a and to detect control characters in the next sub-step 4664 ,

In a sub-step 4665, the window column run length Y _k is then increased by the window column run length variable W _k incremented, which is still zero here. Then a check is carried out for control characters for color changes (sub-step 4666) and, if appropriate, a branch is returned to sub-step 4663 or a search is carried out for control characters for the end of the column (sub-step 4667). If successful, branch is made to sub-step 4669 and the window column counter P _{k is} increased. Otherwise, the next sub-step 4668 is to decode the control code and convert the called byte into decompressed binary window pixel data of type 2.

In sub-step 4670 it is then checked whether all columns of the window have been processed. If this is the case, the process branches to sub-step 4671 and the column run length Y _{k of} the window FEk is stored in memory 7b and branched back to sub-step 4673. If it is recognized in sub-step 4670 that all of the columns have not yet been processed, the sub-step 4672 branches back to sub-step 4663, with the window characteristic value Y _k and the color flip-flop being reset to zero. In the next sub-step 4668, a decoding of the control code and a conversion of the called byte into decompressed binary window pixel data of type 2 must then be carried out again.

After sub-step 4673, where the characteristic values of the next changed window are called, a branch is made back to sub-step 4661. When all change windows have been processed, point d _{3 is} reached.

The print routine shown in FIG. 12 for assembling data from the pixel memory areas I and II runs when a print request is recognized in step 47 and data has been loaded in a sub-step 471 (not shown in FIG. 5).

In sub-step 471 the end address Z _{end is} loaded, the current address Z (running variable) to the value of Source address Z ₀ in area I of pixel memory 7c, the window column counter P _k to the respective value corresponding to the stored window column variable T _k , the window bit count lengths X _k to the respective value corresponding to the stored window column run length Y _k and the target addresses Z _k for k = p windows and the total run length R for a printing column s _k loaded. The printing column has N printing elements.

Then, when point e _{1 is reached} at the beginning of step 48, several sub-steps take place. First, in a sub-step 481, the register 15 of the printer controller 14 is loaded serially bit by bit from the area I of the pixel memory 7c with binary print column data which are called up with the address Z, and the window counter h is set to a number which is the number of windows increased by one p corresponds. In sub-step 482 a window counter h is decremented, which outputs window numbers k one after the other, whereupon in sub-step 483 the address Z reached in the pixel memory is compared with the window start address Z _{k of} the window FE _k . If the comparison is positive and a window start address is reached, a branch is made to sub-step 489, which in turn consists of sub-steps 4891 to 4895. Otherwise, branch to sub-step 484.

In sub-step 4891, a first bit from the area II of the pixel memory 7c for the window FE _k, the binary window pixel data is loaded into the register 15, the address Z and the bit count variable l being incremented in sub-step 4892 and the window bit count length X _{k being} decremented. In a sub-step 4893, if not all bits corresponding to the window column run length Y _{k have been} loaded yet, further bits from area II are loaded. Otherwise, a branch is made to sub-step 4894, the window start address Z _k for the addressing of the next one Window column is increased accordingly by the total length R and the window column counter P _{k is} decremented. At the same time, the original window bit count length X _k is restored in accordance with the window column run length Y _k .

Sub-step 4895 then checks whether all the window columns have been processed. If this is the case, then the start address Z _k for the corresponding window FE _{k is set} to zero or an address which lies outside the pixel memory area I. Otherwise, and after sub-step 4896, a branch is made to point e ₁ .

In sub-step 484, it is checked whether all window start addresses have been queried. If this has taken place, a branch is made to sub-step 485 in order to increment the current address Z. If this has not yet taken place, a branch is made back to sub-step 481 in order to continue to decrement window counter h until the next window start address has been found or until window counter h becomes zero in sub-step 484.

In sub-step 486, it is checked whether all data for column s _k to be printed are loaded in register 15. If this is not yet the case, the bit count variable l is incremented in sub-step 488 to return to point e ₁ and then (in sub-step 481) to load the next bit addressed with the address Z from the pixel memory area into register 15.

However, if register 15 is full, the column is printed out in sub-step 487. Then, in a step 50 - already shown in FIG. 5 - it is determined whether all the pixel data of the pixel memory areas I and II have been printed out, that is to say the item of mail has been franked completely. If this is the case, then point f _{1 is} reached. Otherwise, the sub-step 501 branches and the bit count variable 1 is reset to zero, in order to then branch back to the point e ₁ . Now the next print column can be created.

The printing routine for the compilation of data taken from only one pixel memory area I and working memory areas is explained in more detail with reference to FIG. 13. After the pressure request, which is determined in step 47 shown in FIG. 6, a sub-step 471 takes place immediately, as already explained in connection with FIG. 12, in order to reach point e ₂ . Step 49, which is now beginning - already shown in FIG. 6 - comprises sub-steps 491 to 497 and sub-steps 4990 to 4999. Sub-steps 491 to 497 run with the same result in the same order as sub-steps 481 to 487 have already been explained in connection with FIG. Merely in sub-step 493, a branch is made to sub-step 4990 in order to reset a color flip-flop to g: = 0, whereupon the process of decompressing the coded window data of type 2 in print column-wise fashion, explained in connection with FIG. 6, is initiated with sub-step 4991 becomes. Here there is a color change already explained - in connection with FIG. 7 - when evaluating the type 2 window pixel data to be converted, so that the first hexadecimal data of the data set called up are evaluated as colored, for example. The source address is incremented. Then the compressed window data for the windows FE _k of type 2, in particular for the marking data, are loaded from the predetermined data record (stored in the corresponding sub-memory areas B _j ) into the registers 200 of the volatile main memory 7a in sub-step 4992. A hexadecimal number "QQ "corresponds to one byte.

The control code is also detected here. Is a window column to be printed which is printed with non-colored, i.e. pixels that are not to be printed, a "color change" control code would be in the first place in the data record. In step 4993, the process branches back to step 4991 in order to carry out the color change. Otherwise, branch to sub-step 4994. In sub-step 4994, it is determined whether there is a "column end" control code. If this is not yet the case, the register content must be decoded and thus decompressed. For each runtime-coded hexadecimal numerical value, there is a series of binary pixel data in the character memory (CSP) 9, which can be called up accordingly on the basis of the hexadecimal number loaded in the volatile main memory 7a. This is done in sub-step 4995, after which the decompressed window pixel data for a column of the type 2 window FEj are loaded serially into the print register 15 of the printer controller 14.

In step 4996, the address is then incremented and a corresponding next hexadecimal number is selected in the data record, which is stored in the non-volatile working memory 5 in subarea B ₅ , and the bits converted during the decoding of the run length coding are determined in order to form a window column run length variable W _j with which the destination address is incremented. The new destination address for reading is thus generated. and branching back to sub-step 4991.

When the end of the column has been reached, sub-steps 4997 to 4999 follow in order to then branch back to point e ₂ . The sub-steps 4998 and 4999 run similarly to the sub-steps 4895 and 4894 shown in FIG.

In sub-step 497, the print column that has been loaded is printed. The sub-steps 491 to 497 run similarly to the sub-steps 481 to 487 shown in FIG.

In addition to less mechanical effort, there is a high printing speed with a large number of variable print image data to be embedded in a stored fixed print image.

In a further variant of the method for generating a security imprint for franking machines, a printer module applies a fully electronically generated franking image to a mail piece, corresponding to the current inputs or data made via an input means and an input / output control module, which can be checked with a display unit , It is provided that the data for the constant parts of the franking image, which relate to at least the frame of an advertising slogan, are stored in a first memory area Ai of the program memory 11, that the non-volatile memory 5 has a plurality of memory areas and that the data for the variable or semi-variable parts of the franking image are stored in second memory areas B _k or B _{j of} the non-volatile memory 5. The selectable cost center numbers for the cost centers can be assigned the names of the advertising slogan frames in a third memory area C of the non-volatile memory 5. The names of the advertising slogan frames correspond to advertising slogan frame numbers WRN.

With the microprocessor-controlled printing process and the printer control, the print pattern is generated from fixed data and current data. It is provided that according to the name or the advertising slogan frame number WRN, which are stored in memory areas of the non-volatile memory 5, and which are current mark the set frame of an advertising cliché. Frame data are taken from the first memory area of the program memory 11, decompressed and stored in a first area I of a pixel memory 7C. Semivariable window data from the second memory area B _j are subsequently embedded in the aforementioned constant data. Before printing, in the event of a print request 47, billing is carried out in a sub-step 470 under the aforementioned cost center number in the cost center memory 10 and then variable window data from the second memory area B _k for the marking data are embedded during printing, the embedding being carried out while the print register 15 is being loaded he follows.

In particular, the advantageous variants have been explained in more detail, although it is entirely possible with faster hardware to change the sequence of the method steps in order to also quickly generate a security imprint.

In step 47, if a print request has been made, steps 48 and 49, which contain a print routine, and if a print request has not yet been made, the print request is waited for in a waiting loop by - in the manner shown in FIGS. 5 and 6 - the beginning of the step 47 is decreased directly, this has a further temporal advantage according to the invention, since crypto numbers do not have to be continuously generated again according to the DES algorithm. The next recordable point in time after generation of the marking symbol row can already trigger printing. However, as already mentioned, other branches are possible. Step 47 can be preceded by an additional step 61 in order to branch to a standby mode (step 62), for example at the current time, if a missing print request is found in step 61 and / or to display the date and / or to carry out error checks automatically. From the standby mode 62, the process branches back to the start step 40 directly or indirectly via further steps or modes.

Likewise, in another variant, step 45 can be placed between steps 53 and 54. In step 54 following step 45, the data of a data record for the row of marking symbols after their decompression are embedded in the remaining pixel data of the pixel memory area I. A further pixel memory area is then not required.

Another opposite variant stores only the frame pixel data in the pixel memory area and embeds all window pixel data immediately in the corresponding columns read into the print register 15, without the need for a pixel memory for window data in between.

In one variant, without the automatic editing of cliché parts, memory areas D and E can be omitted. Instead, the unchangeable image information for a finished cliché is stored in a read-only memory (ROM), e.g. in the program memory 11. When the unchangeable image information is decoded, the ONLY read memory 11 is accessed, it being possible to dispense with the intermediate storage of cliché parts.

The program memory 11 is connected to the control device 6, the data for the constant parts of the franking image, which relate to at least one advertising slogan frame, being stored in a first memory area A _i . An assigned name identifies the advertising slogan frame. The non-volatile working memory 5 is connected to the control device 6, the data for the semi-variable parts of the Franking image are stored in the second memory area Bj and an assigned name identifies the semi-variable part. A first assignment of the names of the semi-variable parts to the names of the constant parts exists according to the saved program. A second assignment is made in accordance with the cost center number stored in a third memory area C, so that an advertising cliché is optionally assigned to each cost center KST. A microprocessor is provided in the control device 6 in order to encrypt the marker pixel image data before it is embedded in columns in the remaining pixel image data. A volatile working memory 7 is therefore connected to the microprocessor, a printer controller 14 is connected to print register 15, with which the marker pixel image data are inserted into the remaining fixed and variable pixel image data during printing under the control of the microprocessor in accordance with a program stored in the program memory 11.

The invention is not limited to the present embodiment. Rather, a number of variants are conceivable that fall under the following claims.

Claims (21)

1. A process for generating a security imprint which is applied onto an item of mail in the franking print in addition to the postage stamp and date stamp by the printing device (1) of a franking machine, wherein prior to a print request (step 47) a step (45a, 45) is implemented by the microprocessor of the control device (6) of the franking machine, said step comprising the following substeps:

   a. generating a combination number (KOZ1), whereby a continuously monotonically variable quantity (G4) for creating first coherent digits and at least one quantity (G3) representing the postage value to be overprinted for creating second coherent digits of the combination number (KOZ1) are made available;

   b. encrypting the combination number (KOZ1) into a cryptonumber (KRZ1);

   c. converting the cryptonumber (KRZ1) by means of a predetermined set (SSY1) of symbols into at least one series of marking symbols (MSR1) that are capable of being evaluated visually and by machine.
2. Process according to Claim 1, characterised in that the monotonically changing quantity is a machine parameter ascending or descending in value during the operating life of the franking machine.
3. Process according to Claim 2, characterised in that the machine parameter is time-dependent.
4. Process according to one of Claims 1 to 3, characterised in that the following quantities find application for the monotonically changing quantity:

   - instantaneous cumulative value of franking operations;

   - instantaneous cumulative value of franking operations since the date of the last recharge;

   - residual credit-balance value still present, which may be used up for the purpose of franking;

   - instantaneous date/time data;

   - instantaneous date/time data since the last recharge-date;

   - number of franked postal items or its complement.
5. Process according to one of Claims 1 to 3, characterised in that the monotonically changing quantity is a decreasing numerical value corresponding to the period of time until the next inspection date.
6. Process according to one of Claims 1 to 5, characterised in that the monotonically changing quantity is represented in the form of a first number that is capable of being combined with a second number that represents one of the following quantities:

   - date of the last recharge,

   - credit-balance recharge data at the date of the last recharge,

   - a certain physical quantity that was measured at the date of the last recharge and that is known only to the franking machine and to the data-processing centre.
7. Process according to Claim 6, characterised in that a quantity constituting the second number is present in the data-processing centre stored in queryable form and in that only the maximally changing part of the monotonically changing quantity is drawn upon for the purpose of creating the first number.
8. Process according to one of Claims 1 to 7, characterised in that a further number is included in the creation of the combination number (KOZ), said further number containing information about the identification number (serial number) of the franking machine in question.
9. Process according to Claim 8, characterised in that the information to be examined concerning the serial number is imprinted in the franking print additionally or exclusively in the form of a bar code.
10. Process according to one of Claims 1 to 9, characterised in that the printing device (15) of the franking machine applies a franking image which has been generated in fully electronic manner onto a postal item by a microprocessor-controlled printing process in accordance with the current inputs or data that have been put into effect via an input means and via an input/output control module and that are capable of being examined on a display unit, whereby a printer control unit (14) generates the print design from fixed data and current data, in that the data for the constant parts of the franking image, which relate to at least the frame of an advertising block, are stored in a first memory area (A_i) of a program memory (11), in that a non-volatile memory (5) having several memory areas is provided, the data for variable or semi-variable parts of the franking image being stored in second memory areas (B_k) and (B_j), respectively, of the non-volatile memory (5), in that the names of the advertising-block frames can be assigned to the selectable cost-centre numbers for cost centres in a third memory area (C) of the non-volatile memory (5), in that advertising-block frame numbers (WRN) correspond to the names of the advertising-block frames, in that in accordance with the names of the advertising-block frame numbers (WRN), which are stored in memory areas of the non-volatile memory (5) and which characterise the currently set frame of an advertising block, frame data are taken from the first memory area of the program memory (11), are decompressed and are stored in a first area (I) of a pixel memory (7c), semi-variable window data from the second memory area (B_j) subsequently being embedded into the aforementioned constant data, in that in the case of a print request a deduction under the particular cost-centre number is performed in the cost-centre memory (10) prior to printing and in that variable window data from the second memory area (B_k) are subsequently embedded during the charging of the printing register for the creation of the marking data.
11. Process according to Claim 10, characterised in that in a fourth memory area (D) of the non-volatile memory (5) a name is stored which characterises the currently set advertising-block frame, in that in a fifth memory area (E) data for a further.selectable assignment of at least one advertising-block part to a frame of the advertising block are stored corresponding to the aforementioned name and in that in a sixth memory area (F) data for the generation of additional bar-code window data from a combination number, a quantity or a cryptonumber are present which are used for the creation of marking data, and in that the data from the memory areas corresponding to a previously established assignment which is freely selectable within certain limits are combined during the printing into an overall representation of a security imprint, whereby the data in the third, fourth and fifth memory areas (C, D and E) can be changed by means of the input means (2) and the control device (6).
12. Process according to Claim 10 or 11, characterised in that in a seventh memory area (G) of the non-volatile memory (5) the data ascertained in the course of an inspection, which comprise inter alia the total number of franking operations and/or the next inspection date, are stored with the input means (2), in that these data are included in the creation of the combination number (KOZ) and in that after an encryption of the combination number (KOZ) into a cryptonumber (KRZ) variable window data for the conversion into marking symbols are created and are stored in the second memory area (B_k).
13. Process according to one of Claims 10 to 12,
    characterised in that in an eighth memory area (K) of the non-volatile memory (5) a cryptonumber (KRZ2) is stored temporarily and is used for the creation of marking data.
14. Process according to one of Claims 10 to 13, characterised in that for the creation of marking data at least one set (SSY) of marking symbols is stored in a ninth memory area (M) of the non-volatile memory (5).
15. Process according to Claim 14, characterised in that marking symbols are used which in each given case differ by a predetermined amount of their degree of blackness and which are each bounded by edges orthogonal to one another.
16. Process according to one of Claims 10 to 15, characterised in that in a tenth memory area (S) of the non-volatile memory (5) at least one key (Key 1, Key 2) for an encryption algorithm and also the encryption algorithm itself are stored.
17. Process according to one of Claims 10 to 16, characterised in that the data for all the input quantities, exhibiting numeric chains (strings), are stored in an eleventh memory area (ST) of the non-volatile memory (5) and in that the current advertising-block frame number (WRN), which is stored in the eleventh memory area (ST), is included for the purpose of creating the marking data.
18. Process according to one of Claims 10 to 17, characterised in that in a twelfth memory area (VA) of the non-volatile memory (5) a compression algorithm is stored which transforms the BCD-packed numeric representation for the numeric base 10 into a differently packed numeric representation for a numeric base greater than 10, in order to represent at least one cryptonumber (KRZ1) for information compression by means of a series of marking symbols (MSR1).
19. Process according to one of Claims 10 to 18, characterised in that security means which are intended for interacting with the input means (2) and which are present in the form of a physical key and/or in the form of a chip card permit access to the seventh, ninth, tenth and twelfth memory areas (GSM and VA, respectively) in the course of an inspection of the franking machine, so that a new key, a set of marking symbols (SSY), an encryption algorithm or a compression algorithm can be loaded via the input means 2 in the course of an inspection of the franking machine.
20. A process for examining a security imprint within a franking print by a spot check or centrally initiated check in a postal authority or in a similar authorised institution, in order to recover the individual items of information from the imprinted marking of a security imprint and to compare them with the information openly imprinted on the postal item, comprising the following steps:

    - recording a series of marking symbols (step 71);

    - transforming the series of marking symbols into a cryptonumber (step 72);

    - decrypting (step 73) the ascertained cryptonumber with the aid of a cryptokey stored in an evaluating instrument (29) and transforming into a combination number (KOZ) which contains a numeric combination of at least two quantities, the one quantity being represented by the upper digits of the combination number (KOZ), and the other quantity being represented by the lower digits of the combination number (KOZ), whereby a continuously monotonically variable quantity represents first coherent digits and at least one quantity representing the postage value to be overprinted represents second coherent digits of the combination number;

    - evaluating the marking of the security imprint in conjunction with the clear data of the security imprint.
21. Process according to Claim 20, characterised in that the binary data supplied by a line camera in the course of reading the security imprint are saved, column-by-column and line-by-line, in an image memory (28a) in a computer-assisted evaluating instrument (29), in that in each column of a symbol field the reversals of the binary data contents from one to zero or from zero to one are recorded by means of an evaluating program and the address of the first binary reversal and of the following binary reversal (first unprinted image-point) are stored in a feature memory (28b), in that the operation is repeated for all the columns of a symbol field and in that the 2n data in the feature memory (28b) for each symbol field with n columns are compared with the data sets of the design symbols stored in a design memory (28c), in order to enable an unambiguous assignment.