EP0996097A9 - Method for improving the security of franking machines during the credit transfer - Google Patents

Abstract

The invention relates to a method for improving the security of franking machines in the credit transfer, with at least two modes. As a result of monitoring an authorized action on the postage meter, the system routine (200) is entered in a step (209). Security flag X deleted and in its absence, the franking machine in a first mode transferred (step 409), so as to effectively put them out of operation. Otherwise, in a special mode, negative remote value specification is entered by setting a special flag N when the predetermined operator action for page entry into the special mode is made when switching on. The communication (300) with the data center proceeds under temporal and conditional (flags) supervision by the control unit of the postage meter until the completion of the transaction. From the data center, the behavior of the postage meter user is monitored based on data transmitted during communication.

Description

The invention relates to a method for improvement the security of franking machines in the credit transfer, especially in the case of fund redemption to Data center, according to the preamble of claim 1 or 3 specified type.

A postage meter usually generates a print in a form agreed with the post office, right-justified, Starting parallel to the top edge of the mail with the content postal value in the postmark, date in Daily stamps and stamps for advertising clichés and if necessary, shipment type in the optional cancellation stamp. The postal value, the The date and the type of shipment are the corresponding ones variable information to be entered in the mail piece.

The postage is usually the one from the sender prepaid transport fee (Franko), the one taken from the refillable credit register and the Freeing the mail item is used. In contrast For this purpose, a register is created in the current account procedure Dependence on those made with the postage value Frankings only counted up and in regular Intervals, read by a postal inspector.

In principle, every completed franking must be settled and any manipulation that leads to a non-settled Franking leads, must be prevented.

A known postage meter is with at least one Input means, an output means, an input / output control module, a program, data and in particular the billing register bearing storage device, a control device and a printer module equipped. For a printer module with print mechanics must also measures are taken so that in the off Condition the print mechanics not for unbilled Imprints can be misused.

The invention relates to a method for franking machines, which produced a fully electronic impression for franking mail including an imprint Deliver advertising clichés. This has the consequence that only in the switched on state a not billed valid Franking must be prevented.

In a franking machine known from US Pat. No. 4,746,234 be fixed and variable information in Storage means (ROM, RAM) stored in order then, if a letter on the transport path before the print position a microswitch actuated by means of a Microprocessor read and a pressure control signal to build. Both are then electronically to one Printed image composed and can by thermal transfer printing means on a to be franked Envelope will be printed.

There has already been a procedure for controlling the Columnwise printing a postage stamp image in a postage meter proposed EP 578 042 A2, which separated into graphic Pixel image data converted fixed and variable data during column-wise printing. It would therefore be difficult, without big and expensive effort to manipulate the pressure control signal, if printing at a high speed he follows.

On the other hand, the memory device comprises at least a non-volatile memory device that is the current contains remaining credit balance resulting from that from one earlier into the franking machine loaded credit the respective postage value to be printed is deducted. The franking machine blocks, if the balance is zero.

Known franking machines contain at least one Store three relevant postal registers for consumed sum value (rising register), still available balance (falling register) and Register for a checksum. The checksum is with the sum of the used sum value and off available credit. Already with that is one Check for correct billing possible.

Furthermore, it is also possible from a data center via a Fernwertvorgabe a recharge information to transfer the franking machine to enter the Residual Balance Tab (Residual Value) a credit balance reload. It goes without saying that for this appropriate safety measures must be taken, thus the credit stored in the franking machine not be increased in an unauthorized manner can. The aforementioned solutions against abuse and Protecting counterfeiting requires one additional material and time effort.

From US 48 64 506 it is known that when the value of Balance in the falling register below a threshold is and a predetermined time is reached, a Communication to the remote data center of the Postage meter is added.

Off o. Patent is also known that the data center to receive register data and to check, whether the postage meter still has a specific one Phone number is connected - the connection with the franking machine after a defined period of time picks up and the franking machine only to predetermined Times answers.

It is after o.g. Patent also provided before Credit debit in the franking machine, to Authorization by the data center Identification number of the franking machine and the values in the to query falling and rising registers.

Furthermore, from o.g. Patent known that the Communication of the data center with the franking machine not on mere transfer of credit in the Postage meter machine needs to be limited. Much more in the case of cancellation of the franking machine, the Communication of the data center with the franking machine for transferring the remaining credit of the franking machine used in the data center. The value in falling Postage register of the franking machine is then zero, which effectively puts the franking machine out of service.

A security housing for franking machines, which has internal sensors, is known from DE 41 29 302 A1 known. The sensors are in particular with a battery connected switches, which when opening the security case become active to clear the balance storing memory (falling post register) by interrupting the energy supply too Clear. It is known, but not predictable, which state a voltage-free memory module when the voltage returns. Thus could also an unpaid higher remaining balance arise. On the other hand, it can not be ruled out that in the above-mentioned way, the residual value credit at least partially discharges. But that would be at one Inspection disadvantageous, since the residual value credit, which paid by the meter user, too must be reloaded, the amount of this remaining balance however by o.g. Influences be distorted can. Finally, the description is not removable, how can a manipulator be prevented restores an unpaid balance.

In known franking machines FM are already more Safety measures such as breakaway screws and capsuled Shielded security housing known. Common are also keys and a combination lock for access to complicate the postage meter.

In US 4 812 994 an unauthorized access is intended a use of the franking machine beyond by blocking the franking machine in case of incorrect entry a predetermined password can be prevented. In addition, the franking machine by means of password and corresponding input via keyboard so set be franking only during one predetermined time interval or times of day possible is.

The password can be transmitted through a personal computer MODEM, by a smart card or manually in the Postage meter be entered. After positive Comparison with one in the franking machine stored password is the postage meter Approved. In the control module of the billing unit is a safety module (EPROM) integrated. As another Security measure is an encryption module (separate microprocessor or program for FM CPU based on DES or RSA code), which provides a the postage value, the subscriber number, a transaction number and similar comprehensive identification number generated in the franking stamp. If enough But criminal energy could also be a password researched and including franking machine in the possession of a manipulator.

It is already in the US 4,812,965 a remote inspection system been proposed for franking machines, which on special messages in the imprint of Mail items to be sent to headquarters or based on a remote query via MODEM. sensors within the franking machine, each made Detect adulteration action, thus in associated Save a flag can be set if in the Franking machine intervened for manipulation purposes has been. Such an intervention could be done to one to load unpaid balance into the registers.

Upon detection of tampering, the postage meter will during remote inspection via modem a signal coming from the data center is blocked. A clever manipulation could, however, on the other hand consist in the production of unbilled Franking imprints, the flag and the registers to return to the original state. A Such manipulation would be via remote inspection by the Data center not recognizable if this undo made manipulation before the remote inspection. Also the receipt of the postcard from the data center, on which is a postage to be made for inspection purposes should allow the manipulator the Postage meter in sufficient time in the original Restore condition. So that is still no higher security achievable.

The disadvantage of such a system is that can not be prevented that a sufficiently qualified Manipulator, which in the postage meter breaks in, his left traces later eliminated by deleting the flags. Also can so as not to prevent the impression itself which is manipulated by a duly operated machine is produced. At acquaintances Machinery is possible to manufacture of impressions with the postage value zero. such Zero ratings are needed for testing, and could also be subsequently falsified by a Postage value greater than zero is faked.

A security print according to the FP's own European patent application EP 576 113 A2 provides symbols in a marking field in the franking stamp, which contain a cryptified information. This allows the postal authority, which interacts with the data center, to detect a manipulation of the franking machine at any time from the respective security print. Although a running control of such item of mail provided with a security imprint ^{n ting} via appropriate security markings in the stamp image is technically possible, but this means an extra effort in the post office. In a sample-based control, however, a manipulation is usually detected late.

On the other hand, in the data center an additional evaluation with regard to a user of a franking machine, by the user beyond the inspection date was continued. However, so far this information is not yet a forgery intention concluded manipulation.

In US 4,251,874 is a mechanical printing unit, which must be preset for printing, with a Detector device used to preset monitor. Furthermore, in the electronic billing system Means of detecting errors in data and data Control signals provided. Reached this number of errors a predetermined value, the further operation of the Postage meter machine interrupted. The sudden failure the franking machine is for the franking machine user disadvantageous. In a non-mechanical On the other hand, pressure principles are hardly such internal ones Error is expected and a serious mistake is anyway, shut off the postage meter anyway anyway. In addition, the security against one Manipulation of the franking machine hardly larger, by the postage meter after a predetermined Error number is switched off.

From US 4,785,417 a franking machine with a program sequence monitoring known. The correct one Expiration of a larger program piece is by means of a each program part assigned special codes controlled when calling the program piece in a particular memory cell is stored in RAM. It is now checked if the in the above Memory cell stored code in the currently running Program part is still present. Would at one Manipulation of the course of a program part interrupted and another program part runs off, can by a such control question an error can be detected. The comparison can only be done in the main process become. Secondary processes, such as security-relevant Calculations, which of several main courses can be used by such monitoring but not checked for execution of the program part because the program control is independent of Program sequence takes place. Is allowed on the basis of Program parts and ancillary processes so manipulated, ancillary processes are additionally integrated into main processes or omitted from last or on ancillary processes is branched, then no error would be detected because neither the length of the program part found, nor can it be determined which Program branch how often was passed.

Another type of expected manipulation is that Reloading the postage meter registers with a not billed value. This results in the requirement a secured recharge. An additional Safety measure is the comparison according to US 4 549 281 an internal one in a non-volatile register stored fixed combination with an entered external combination, whereby after a number of failed attempts, i.e. Non-identity of the combinations that Franking machine by means of an escapement electronics is locked. According to US 4,835,697 can be used to prevent an unauthorized access to the franking machine the combination basically be changed.

From US 5,077,660 is also a method for Changing the configuration of the franking machine known wherein the franking machine by means of a suitable input via a keyboard from the operating mode into a configuration mode switched and a new meter type number can be entered, which of the desired number corresponds to characteristics. The franking machine generates a code for communicating with the computer the Data center and the input of identification data and the new meter type number in the aforementioned computer, which also has a corresponding code for transmission and input to the postage meter machine generated in the two codes are compared. With agreement both codes will configure the postage meter and switched to the operating mode. The data center has from the set meter type for the corresponding franking machine always accurate records. However, security is just about encryption depending on the transmitted code.

In addition, from EP 388 840 A2 a comparable Safety technology for putting a Postage meter known to receive this data clean, without the franking machine to the manufacturer must be transported. Again, this is the Security solely from the encryption of the transmitted Code dependent.

The secure reloading of a franking machine with a balance was in US 3,255,439 on the one hand already with an automatic signal transmission from the franking machine connected to the data center, if always a predetermined sum of funds, which franked or pieces of processed mailpieces or a predetermined period of time has been reached. alternative can be one of the funds amount, quantity or time period corresponding signal to be transmitted. there the communication takes place by means of binary signals connected to each other via a telephone line Converter. The machine receives an equally secured Reload according to the credit balance and blocked in the case when no credit is re-delivered.

US 4 811 234 discloses the transactions encrypted and doing the registers of To query franking machine and the register data of the Data center to submit to a temporal reference the reduction of the person entitled to vote in the register Amount display. On the one hand identified the franking machine at the data center, when a presettable threshold is reached is, by means of their encrypted register content. On the other hand, the data center is modified by appropriate ones Authorization signals the desired franking amount, up to which may be franked. The encryption is thus the only security against a manipulation of the register states. So if a manipulator Although always the same amount properly loads in equal time intervals, but in the meantime with the manipulated franking machine one franked much higher than he has paid can the data center does not detect any tampering.

From EP 516 403 A2 it is known that in the past logged and stored in memory Error of the franking machine regularly to one remote fault analysis computer for evaluation transfer. Such a remote inspection allows one early warning of an error occurring and allows to take further measures (service). But this alone does not provide a sufficient criterion for a manipulation.

According to GB 22 33 937 A and US 5,181,245 the postage meter machine periodically with the data center. A blocking agent allows the postage meter to Expiration of a predetermined time or after a predetermined Number of operation cycles to block and provides a warning to the user. To unlock must be entered from the outside an encrypted code which is encrypted with an internally generated Code is compared. To prevent wrong billing data delivered to the data center Become in the encryption of the above Codes include the billing data. adversely is that the warning coincides with the blocking of the Franking machine is done without the user a Possibility to adjust his behavior on time to change.

From US 5 243 654 a franking machine is known, where the current delivered by clock / date module Time data compared with stored shutdown time data become. Is the stored shutdown time achieved by the current time, the Postage meter deactivated, that is a print prevented. When connecting to a Data center, which the billing data from the reading from the rising register becomes the franking machine transmitted an encrypted combination value and set a new deadline, reducing the postage meter is made operational again. It is the Consumption amount, which is the used postage contains summed and read by the data center is also part of the encrypted transmitted Combination value. After decryption of the combination value becomes the consumption sum amount separated and stored with the in the postage meter Consumption amount compared. Is the Comparison positive, is the lock of the postage meter automatically canceled. This solution will achieved that the franking machine at the Data Center periodically reports to billing data to transfer. However, there are cases of use quite conceivable, where the postage to be franked fluctuates (Seasonal operation). In these cases would be disadvantageous Way the franking machine unnecessarily often blocked become.

From US 4,760,532 is a post-treatment system with Postal value transfer and billing capability known. This information is sent to the data center via Telephone by means of touch-tone, which is widely used in the USA Process transmitted. By pressing a corresponding key of the phone can be the operator to transmit a number. Information from the data center be sent by computer voice to the operator which transfers the transferred values into the Must enter postage meter. For fund redemption is the transfer of a negative postal Funds to a mailing device in a first step to Establishment of communication with a central station intended. The central station monitors the Total amount of post (residual balance) in the Mail device is stored. In a second step the supply of the aforementioned central station takes place with information related to a desired change, to reduce the total amount of postage, which is available in the aforementioned postal device, and with a clear identification of the above Post device. A third step involves one, Received from the central station and entering a first unique codes in the aforementioned postal device, wherein the inputting is operated to the total amount Postal values stored in the postal device to reduce in accordance with the aforementioned desire. And in the fourth step is generating one second unique codes provided in the mailing device, when the first unique code is entered into the postal device where the second unique code is a Indication such that the aforementioned postal value, which is available for printing the mail, has been reduced in the aforementioned postal device. However, if the transmission is disturbed or interrupted, then the data center will not get a first code and the fund would remain in the franking machine unchanged, while in the data center already a Chargeback has been made. For checking Of course, the register statuses of the franking machine could be queried to those with in the Data center stored to compare. It's closed fear that a potential manipulator latter would refrain. In US 4,760,532 is as concluding Process step, the transfer of the aforementioned second unique codes to the central station intended. Under the conditions of touch-tone Procedure is again pressing numeric buttons required, which is awkward with multi-digit code and usually not free from input errors expires. It is also planned, on the part of Data center to generate a third unique code to transfer the balance back to another Transfer franking machine. Thus, the responsible Authority by mistake during the transfer be damaged. This occurs in the positive as negative remote value default the same question, namely then, as in a simple way, a synchronicity the data in the central office and franking machine can be reached.

It was the task to solve a procedure for Improve the safety of franking machines too create a significant increase in security to ensure the credit transfer.

It should be between authorized action (service technician) and unauthorized action (manipulation intention) distinguished and the manipulation security increase. Another task is the Security when communicating with the data center to improve when data in both directions be transmitted.

The object is achieved with the features of claim 1 or 3 solved.

The solution according to the invention is based on the one hand on the Realization that only centrally in a data center stored data before manipulation sufficient can be protected. A significant increase Security and synchronicity in the stored data is determined by a data reporting before each predetermined Action on the franking machine achieved. Likewise increases this in more or less large intervals reporting, in particular for reloading a Balance in connection with the o.g. logging the security against a possible manipulation. The data to be stored centrally include at least Date, time, identification number of the franking machine (ID number or PIN) and the type of data (e.g. Register values, parameters) when the postage meter establishes communication with the data center. For the purpose of pre-synchronization of the data of the franking machine with the data of the data center can be a certain default request for a first transaction be used.

On the other hand, to increase the security Distinguishing between authorized action (service technician) and unauthorized action (manipulation intention) by means of the control unit of the franking machine in connection with steps for the execution of a negative remote value default for the retransfer of a Credit value in the data center, where by the Franking machine a default request to the data center transmitted and there and in the franking machine is stored.

It is from the control unit of the franking machine tested, whether with predetermined actuating means a defined procedure for page entry into the Special mode for negative remote value specification made and a predetermined timing during the negative Distance value specification has been respected, and if applicable further steps for automatic execution the communication must be done to the To complete retransmission if the previous ones Steps to execute a negative distance value specification interrupted or faulty to the franking machine encrypted data was transmitted.

According to the invention, a communication takes place between Postage meter machine and data center at least with encrypted Messages, preferably the DES algorithm is used.

To solve the problem thus has the franking machine at least two special modes on. A first fashion is provided for in fraudulent actions or in Intended to manipulate the franking machine at the franking with postage values to prevent (kill mode). This inhibition can on the occasion of the next on-site inspection of a person authorized to do so. The Postage meter has another mode to at Fulfillment of selected criteria the franking machine if necessary for automatic communication with the To initiate data center. In such a Another fashion according to the invention is the Special mode negative remote value transmission or by one second (Sleeping) mode. After completing the special mode is for checking the postage meter only still a limited number of zero-frankings possible. If the intended number of pieces is used up, forcibly an automatic communication with the Data center triggered, which is thus informed and relevant register data experiences. The franking machine is inhibited in the sleeping mode. By the interaction of at least two of the aforementioned modes will ensure the security of handling credit, which are loaded into or from the postage meter Data center to be retransmitted, opposite increased fraudulent manipulation.

However, other than the predetermined Operating sequence during the switching on of the franking machine for a page entry into the special mode negative remote value preset selected, which is prohibited Switches the franking machine in the above first fashion to the franking machine for a franking with a postage value to lock (kill mode).

If necessary, in order to increase the security against manipulation an already earlier authorized Operator (service technician) from the data center notified page entry into the special mode negative Remote value setting changed. The future valid Operation can be combined with at least one Transaction during a positive or negative Fernwertvorgabe least partially transmitted.

An authorized operator of the postage meter, preferably the service technician, leads to the page entry in the special mode negative remote value default one predetermined operator action, which except the Service technician only known the data center is. Here, a special flag is set, which as special transaction request.

A monitoring by the control unit of the franking machine while executing a transaction in the Special mode ensures that when left unfinished Transaction the transactions in special mode negative Remote value specification to be carried out to the end. at completed transaction in special mode becomes the special flag reset.

In addition, there is a time monitoring by the control unit the franking machine during the execution of a Transaction in special mode, which when timed out or with an unfinished transaction take effect to complete the transaction.

A time monitoring is also carried out by the Data center when a transaction in special mode negative remote value default is made. The Register data of the franking machine are central verifiable when reconnecting to the Carrying out a remote value specification takes place, for example to recharge a credit. Either takes if the transaction remained unfinished, the franking machine automatically reconnect to the Transaction completion or authorized Service technician hands over the data center by End of day a message about the current state the franking machine for the purpose of canceling the im Special mode negative remote mode transmitted data. Otherwise, the time monitoring results from the Data center after expiration of the predetermined period of time, a recognition of the negative mode in special mode Remote value specification transmitted data.

In a preferred variant, the security is through a check of the operation for conformity with a predetermined operation in the franking machine and by checking the default request in the data center to match with a stored there Code for a predetermined default elevated. It is possible to control the operation time-dependent to change, being in the data center and in the Postage meter the same calculation algorithm is used to a current operation determine. A transmission of a valid operating procedure from the data center to the franking machine becomes superfluous.

In another variant, the security is through a combination of a number of measures increased. In A first transaction is a distinct one Log in to the data center. This transmits in Reaction to this a new security flag X and / or a predetermined operation for a page entry in the special mode negative remote value default to Postage meter, when the meter is turned on normally was and the communication link receives, wherein in a first transaction a predetermined Default request in the data center and in the postage meter was stored. In the data center a check is made as to whether the transmitted default request corresponds to a predetermined default request. In the first transaction, for example, a new Codeword or security flag and / or operating procedure transmitted to the franking machine and in a second Transaction, the registered transaction is performed and according to the default request a default value in the corresponding memory of the franking machine and in order to verify the transaction also in one corresponding memory of the data center added.

For a page entry into the special mode negative Remote value specification must be performed by the service technician while turning on the postage meter as it was transmitted by the data center, be carried out, i. at the same time as switching on is to press a specific key combination.

The second transaction reloads the Postage meter - according to the corresponding default value - with a negative balance, so that in the Result returns a residual value of zero.

The solution according to the invention furthermore assumes that the funds stored in the franking machine funds protected against unauthorized access have to. The adulteration of in the franking machine stored data is so difficult that the effort for a manipulator is no longer worthwhile.

Commercially available OTP processors (ONE TIME PROGRAMMABLE) All security relevant program parts in the Inside the processor housing, in addition to the Code for forming the message authentication code (MAC). The latter is an encrypted checksum, which is attached to an information. As a crypto-algorithm is for example Data Encryption Standard (DES) suitable. This allows for MAC information the relevant security and special flags or on attach the register data and thus the difficulty the manipulation of the aforementioned flags or Increase postregisters maximally.

The method for improving the safety of a Postage meter, which is used for communication with a remote data center is capable and a microprocessor in a control device of the franking machine Also includes forming a Checksum in the OTP processor about the contents of the external Program memory and comparison of the result with a predetermined value stored in the OTP processor before and / or after expiry of the franking mode or operating mode, especially during initialization (i.e., when the postage meter machine is started), or in times not printed (i.e., when the postage meter is operated in standby mode). In the event of an error then a logging and subsequent blocking of the franking machine.

To improve the security of franking machines against manipulation a distinction is made between unmanipulated and manipulated operation of a Postage meter by means of the control device, by during an operating mode, monitoring of the time duration the sequence of programs, program parts or safety-relevant routines is made and by one after expiration of programs, program parts or security-relevant routines subsequent comparison the measured running time with a predetermined Running time. Even while communicating with it a fraudulent manipulation is thwarted, in particular by a made in the communication mode Monitoring compliance with a given Timeout in special mode Negative remote value setting. It will be the time from sending a third encrypted message from the postage meter until the reception of the data center to the Postage meter sent fourth encrypted Message in the franking machine, which at verification triggers a zeroing of the credit value, supervised. It is envisaged that a decremental Counter or an incremental counter is used to exceeding the time t1 in the special mode as a safe indication of an unsuccessful transfer to detect and that a special Unterprogrammm is called, which is a re-implementation of the Special mode prepared negative remote value preset and automatically triggers, so that the first and second Transaction to be repeated automatically.

In an optional variant, the security is through an additional input safety agent increases, which brought into contact with the franking machine is to have a remaining balance from an authorized one Transfer person back to the data center.

Figur 1,

Blockschaltbild einer Frankiermaschine,

Figur 2,

Ablaufplan nach der erfindungsgemäßen Lösung,

Figur 3a und 3b,

Darstellung der Sicherheitsabläufe der im Kommunikationsmodus befindlichen Frankiermaschine und Datenzentrum,

Figur 4,

Ablaufplan für den Frankiermodus nach einer bevorzugten Variante,

Figur 5,

allgemene Blockdarstellung eines Ablaufes mit zwei Transaktionen für das Nachladen mit einem Null-Guthabenwert,

Figur 6,

Blockdarstellung eines Ablaufes mit zwei Transaktionen für das Nachladen mit einem negativen-Guthabenwert,

Figur 7,

Ablaufplan zur Einspeicherung eines Sicherheits-Flags bzw. Codewortes nach der erfindungsgemäßen Lösung

Advantageous developments of the invention are characterized in the subclaims or are presented in more detail below together with the description of the preferred embodiment of the invention with reference to FIGS. Show it:

FIG. 1,

Block diagram of a franking machine,

FIG. 2,

Schedule according to the solution according to the invention,

FIGS. 3a and 3b,

Representation of the safety procedures of the franking machine and data center in communication mode,

FIG. 4,

Schedule for the franking mode according to a preferred variant,

FIG. 5,

general block diagram of a transaction with two transactions for reloading with a zero credit value,

FIG. 6,

Block diagram of a transaction with two transactions for reloading with a negative credit value,

FIG. 7,

Flowchart for the storage of a security flag or codeword according to the inventive solution

FIG. 1 shows a block diagram of each Postage meter according to the invention with a printer module 1 for a fully electronically generated franking picture, with at least one multiple actuators having input means 2, a display unit 3, and one communicating with a data center producing MODEM 23, which via an input / output control module 4 coupled to a control device 6 are and with a non-volatile memory 5 and 11, respectively for the variable or the constant parts of the Franking.

A character memory 9 provides the necessary print data for a volatile working memory 7. The control device 6 has a microprocessor μP, the with the input / output control module 4, with the character memory 9, with the volatile memory 7 and with the non-volatile working memory 5, with a Cost center memory 10, with a program memory 11, with the engine of a transport or feed device if necessary with strip release 12, an encoder (Coding disc) 13 and with a clock / date module 8 communicates. The individual memories can be in several physically separated or in not shown way summarized in a few blocks be realized, which by at least one additional measure, such as sticking on the Printed circuit board, sealing or casting with epoxy resin, secured against removal.

FIG. 2 shows a flowchart for a franking machine with a security system according to a preferred Variant of the solution according to the invention shown.

After switching on the postage meter in step Start 100 will then be within a startup routine 101 a functional test followed by Initialization made.

This step also includes several - in the figure 7 shown in detail - sub-steps 102 to 105 for Storage of a security flag or codeword. With step 103, if in step 102, a new security flag X'in another predetermined Memory E of the nonvolatile memory 5 exists, this new security flag X 'in the Memory space of the old security flag X copied, if there is no valid security flag X anymore stored exists. The latter applies equally the case of an authorized as well as unauthorized Intervention, because with each intervention the old Security flag X is deleted. Likewise, at a other unauthorized offense the security flag X be deleted (kill mode). If not valid Security flag X is more present, can be stored in the Franking mode 400 no postage value can be printed anymore. In case of non-intervention, no new code word is transmitted Service. In this case will not be copied and after Step 104 remains the old security flag X in Memory received. Finally, with point s the System routine 200 reached.

The system routine 200 comprises a plurality of steps 201 to 220 of the security system. In step 201, the Calling up current data, what's below with the invention for a second mode, namely for the sleeping mode is executed. As in FIG. 2 is shown in step 202 checks whether the Criteria for entering the sleeping mode met are. If this is the case, a branch is made to step 203, by at least one warning by means of the display unit 3 display. After the o.g. Steps will definitely work the point t reached.

Upon detection of a prohibited page decline (Step 217), the aforementioned security flag X becomes deleted. It may be the security flag X also a MAC secured security flag, as well as an encrypted code. The verification for example, validity of the security flag X becomes in step 409 of a franking mode 400 by means of a selected checksum method within a OTP processor (ONE TIME PROGRAMMABLE) performed, internally the corresponding program parts and also the code for forming a MAC (MESSAGE AUTHENTIFICATION CODE) contains, which is why the Manipulator the type of checksum method not can understand. Also more security relevant Key data and procedures are exclusively in the Stored inside the OTP processor, for example to enter key data with that of the data center Postage meter assigned new key complement, so with the key data so supplemented an encryption of messages are made which can be transmitted to the data center. On the other hand, the same security-relevant ones allow Key data or processes a hedge over to put the post registers.

Another backup variant, which without OTP processor gets along, is the aggravating of the finding the key through its coding and partial filing in different storage areas. Again MAC are attached to any information in the security relevant Attached to registers. A manipulation of Register data can be detected by controlling the MAC become. This routine occurs in step 406 in FIG Franking mode, which is shown in FIG. This allows for the difficulty of manipulation increase the maximum number of post offices.

Upon examination in step 217, wherein a relevant defect detected and the safety flag X was deleted in step 209, the point e, i. the beginning of a communication mode 300 is reached and in a - shown in Figures 2 and 3a - Step 301 queried if a transaction request is present. If that is not the case, the Leave communication mode 300 and point f, i. the operating mode reaches 290. Were relevant data transmitted in communication mode, then is to Data branching to step 213 branch. Or otherwise, if in step 211 the non-transmission is determined, is the step 212 to branch. Now it is checked if appropriate Entries have been made to test request 212 in the test mode 216, otherwise at intended register check 214 in a Display mode 215 to arrive. Is not that the case, automatically the point d, i. the franking mode 400 reached.

In case of a manipulation, the step 213 becomes Statistics and error evaluation achieved. On the Step 213, the display mode 215 is reached and then branched back to the system routine. The lock can thus advantageously done by the branching no longer run on the franking mode 400 becomes. According to the invention it is further provided that in Step 213 performed a statistics and error evaluation will be to gain more current data, which after branching to the system routine 200 in Step 201 are also invoked, for example for an aforementioned second mode or another Special fashion.

Between points s and t of system routine 200 can do a lot of other queries after Fulfillment of further criteria for further modes lie. Further details regarding a query for a first mode, which for preventing the printing or is used to lock the postage meter, are the German application P 43 44 476.8, method for Improve the safety of postage meters, too remove. In the case of an opening of the postage meter housing by authorized persons is one written, if necessary, telephone registration in the data center been proposed for authorized opening, which the opening date and time for the approximate start of opening informs. Before then the Franking machine can actually be opened, must via MODEM a communication with the data center to request the opening authority and load a new future code Y 'containing the old can replace.

In contrast, however, the presence of the Safety flags X not between points s and t but only in step 409 in franking mode queried. This allows the service technician through Loading the new security flag X 'but also after a deletion of the aforementioned flag then the restore full functionality of the franking machine. This allows, for example, a Check to see if an unauthorized Actually to delete the security flag or code word leads, or whether the deletion by Manipulation has been prevented.

In the case of authorized operation, the - in 2, step 217 recognizes that no Prohibited page entry. On allowed page entry, that for another input has been performed is not closer in Figure 2 been presented. However, such a removal criterion is also provided, for example, in Step 212 to recognize if an operator action was made to enter a test mode. At the allowed side entry, which is not the right one Side entry for the special mode of a negative Defaults for the purpose of fund repatriation from the Franking machine to the data center is, becomes the point e system routine 200 branches. Otherwise it will at the correct page entry to step 220 branches to a special flag for entry into the To set special mode. It is in a further embodiment possibly another query step 219 before Step 220 provided with a further criterion the security against unauthorized call of the Special mode continues to increase, failing to comply of the criterion to the point e of the system routine 200 is branched. For example, in FIG Query step 219 shown such another Check criterion whether the identification number (ID no. or PIN). Through the side entrance is the security already high enough, so for the sake of easier operation such additional additional queries queries also can be waived. Another possibility in the In the Figure 2 shown query step 219 such query another criterion, if at least n times the same predetermined default request made and a corresponding default value added to the credit balance was is also optional and therefore dashed lines drawn in the figure 2. It can do this are a NULL default request to the Transmission of a NULL default value leads to and Residual value can be added without affecting the height stored credit is changed.

To further increase security against manipulation, it is provided that the set in step 220 special flag N for the special mode also a MAC-secured Flag N is.

The security is additionally checked by a review in the data center increases, whether a predetermined Default request transmitted from the franking machine has been. It is envisaged that the transmitted Default request in the data center evaluated as a code will do a very specific transaction. The transmitted default request can be in the data center be considered a code to fund redemption to allow. Otherwise, the transmitted Default request in the data center as code be evaluated, a transmission for a security flag X or for an X codeword to allow.

FIGS. 3 a and 3 b show a representation of FIG Safety procedures of the communication mode Franking machine on the one hand and the safety procedures the data center in communication mode on the other hand.

If the point e, i. the beginning of the following explained Communication mode 300 is reached, in a - shown in Figures 2 and 3a - step 301 queried whether a transaction request exists. Such can, for example, for the credit Telephone number change u.a. be put.

The user selects the communication or remote value default mode the franking machine via the input of Identification number (eight-digit postage code number) on. It is now assumed, for example, it should be the Fund reverse transfer equal to that in the franking machine Remaining residual value. in this connection first a register query of the Descending-register takes place R1, which contains the residual value stored. After switching off the postage meter is at Restart a page entry into the special mode performed. After entering the identification number will input with the teleset button confirmed and the default request in the amount of the previous entered residual value. Through the side entrance the default is automatically considered as too subtracting default value. The default wish is activated by pressing the Teleset button (T button) approved. As with every communication from the Data center also the residual value is queried, can so that a comparison in the data center of both, i. of residual value and default request. Otherwise, can in special mode the above inputs for a preferred variant also automatically from the Franking machine be executed to the operation too simplify.

Otherwise, for example, a communication to load a new safety flag X ', which can replace the old security flag X Will only If such a transaction request is made, the Default amount must be changed, because in this case must the credit in the franking machine of course not be increased. On the other hand, another can Value other than zero can be agreed, in particular one Value that corresponds to only a minimal amount to the the descending register value would have to be increased.

In FIG. 3a, that part of the communication becomes a transaction presented with unencrypted Messages is made. Nevertheless, these can Messages contain data that is MAC secured, for example, the identification number of the franking machine.

In step 302, an input of the identification number (ID No.) and the intended input parameter done in the following way. With the ID no. it can about the serial number of the postage meter, about a PIN or PAN (postage code) act by pressing by means of a predetermined T-key of the input means 2 is acknowledged. In the display unit 3 appears at the last remote value specification (recharge) used input parameter (default value), which now by overwrite the input of the desired input parameter or maintained. At the input parameter it is a combination of numbers, which in the data center is understood as an invitation, For example, a new security flag or code word X 'to transmit, if previously an intervention authority has been obtained. In case of incorrect entry of the aforementioned Input parameters can be displayed by pressing a C key.

For example, a change is entered at to load a transaction with the value zero for a transaction, but no power of intervention is obtained beforehand. Thus, the input parameter only serves as a new one Default. But neither the credit for Franking increases in value when the input parameter has the value zero, another new security flag loaded. However, every communication can have one Quantity S 'are transmitted, as well as the German application P 43 44 476.8, method for Improve the safety of postage meters, too can be found.

Only by the previous notification, for example by means of a separate call to the data center or any other form of communication, becomes the data center informed that a new security flag X ' is to be transmitted to the franking machine, if subsequently within a predetermined period of time on the part of the franking machine a transaction for the Value zero is started. The request for intervention is valid only then as posed, if after signing a authorized intervention the franking machine in the so agreed communication mode occurs.

But before this is any other input parameter agreed with the data center, takes place when entering this input parameter except the transmission of a new safety flags X 'according to the pre-agreed Codes by the predetermined default is also formed a recharge of the credit according to the entered default value in the result a second transaction.

Will be another input parameter than agreed entered, this results in the result only Recharge in the amount of the selected new standard amount, where at, unlike the other transaction data however, the default amount is not for the franking machine needs to be transmitted. Rather, the fact is that a valid transaction has been verified for the Postage meter sufficient, an increase or Reduction of Descending Register Content by Default amount according to the stored default request make.

If the desired input parameter is displayed correctly, this is done by re-pressing the predetermined T-key the input means 2 confirmed. In the display unit 3 then a representation appears accordingly an input parameter change or according to the Non-change (old default value).

By pressing the predetermined T-key is the Change of the input parameter via MODEM connection started. The entry is checked (step 303) and the further process runs automatically, whereby the expiration accompanied by a corresponding advertisement.

To do this, the postage meter checks to see if a MODEM is connected and is ready. Is not that the Case, branching is made to step 310 to indicate that the transaction request will be repeated got to. Otherwise, the franking machine reads the election parameters, consisting of the selection parameters (Main / extension, etc.) and the telephone number the NVRAM memory area F and sends them with a Dial request command to the modem 23. Then the connection establishment required for the communication takes place via the MODEM 23 with the data center in a step 304.

In the figure 3a is on the left half also the shown in parallel in the data center, which is necessary for the communication. in the Step 501 is constantly checking to see if there is a call in the Data center is done. Is that the case, and that MODEM 23 has dialed the far side, takes place in Step 502 parallel the connection establishment also in the Data center. And in step 503 is constantly monitored whether the connection to the data center is solved has been. If this is the case, an error message occurs in step 513, branch back to the step Five hundred and first

Parallel to this, in the franking machine in step 305 monitors for communication errors and optionally branched back to step 304 to on the part of the franking machine the connection again build. After a predetermined number n inconclusive Redial attempts to establish a connection via a display step 310 to the point e branches back. Was not detectable in step 305 Error is in step 306 by the postage meter found that the connection is established and a transaction is yet to take place, is on Step 307 branches to an opening message or to identification, preload or register data to send. In subsequent step 308, the same check as performed in step 305, i.e. when a communication error occurs branched back to step 304. Otherwise it was an opening message from the franking machine sent the data center. In it is u.a. the Postage code for the notice of the caller, i.e. the postage meter, at the data center included.

This opening message will be in the data center in Step 504 checked for plausibility and continue evaluated by then in step 505 again It checks whether the data is transmitted without errors have been. If this is not the case, a Return branch to the error message at step 513. On the other hand, the data is error-free and in the data center it is recognized that the franking machine a Has asked for reimbursement, then in step 506 a reply message to the franking machine as a header Posted. In step 507 it is checked whether in Step 506 includes the preamble message Header end has been sent. Is not that If so, then branch back to step 513.

In the franking machine, it is checked in step 309 whether from the data center meanwhile a header as Reply message was sent or received. is If not, it will be displayed on the step 310 branches back and then again Transaction request queried in step 301. Has been received a header and has the postage meter receive an OK message, in step 311 a Verification of the preload parameters with regard to a Telephone number change. If an encrypted parameter has been transmitted, there is no telephone number change and it is on the step 313 in the Figure 3b branches.

In the figure 3b is a representation of the safety procedures in communication mode Franking machine and parallel to those in the Data center.

In step 313, from the postage meter to the Data center sent a start message encrypted. In step 314, the message becomes communication error checked. Is there a communication error , it is branched back to step 304 and it another attempt is made to connect to the data center build up to the beginning message encrypted to send.

From the data center is this encrypted start message received when in step 506 the preamble message had been completely sent and in step 507 the header end has been transmitted. in the Step 508 checks in the data center whether this has received the start message and the data in Order are. If this is not the case, in step 509 checks if the error is recoverable. Is the Error not recoverable, is moved to step 513 branches out after receiving an error message from the Data central DZ to the franking machine FM in step 511 was transmitted. Otherwise, in step 510 performed an error handling and on the step 507 branches. In step 508, the reception becomes more proper Data is detected, the data center begins to perform a transaction in step 511. in the above example, at least the identification number by means of an encrypted message to Postage meter, which in step 315 the Receives transaction data.

In subsequent step 316, the data is checked. If there is an error, branch back to step 310. Otherwise, the data center is in the Step 512 is a storage of the same ones mentioned above Data, as in the franking machine. In step 318 So in the franking machine the transaction with the Data storage completed. Subsequently, the Step 305 branches back. Should no further Transaction will be displayed to step 310 and then reached step 301.

If no transaction request is made, then in step 211 according to FIG. 2 checks whether data have been transmitted. If data has been transmitted, it will reached step 213. According to the input request the franking machine places the current one Default request or the new codeword Y 'or other Transaction data, for example, in memory area E the nonvolatile memory 5.

Is used as an input parameter in step 302 but a other number combination entered as zero and the Input was OK (step 303), a connection is established (Step 304). And if without mistakes (Step 305) a connection is established (Step 306), an identification and preamble message sent to the data center. In this Opening message is again u.a. also the postage code PAN for identification of the franking machine included in the data center. The data center recognizes from the entered number combination, if the data is error free (step 505) that in the Franking machine, for example, a credit with a Default value should be increased.

Has become the current phone number of the Data center changed, action must be taken be stored in the franking machine becomes. In step 506 is then from the data center a reply message with the elements change the phone number and current phone number unencrypted Posted. The franking machine, this one Message receives, in step 311 that the phone number to be changed. Now it becomes a step 312 branches to the current phone number to save. Subsequently, the step 304 branches back. Is the connection still established and a communication error is not present (305), is in Step 306 then checked if another Transaction should take place. If that is not the case, is branched via step 310 to step 301. The transmission of the telephone number can also be MAC-secured respectively.

After saving the current telephone number the franking machine automatically builds a new one Connection to the data center with the help of the new phone number. The actual, from the user intended transaction, a remote value default of the new security flag X 'or a submission of a for verification suitable encrypted message for reloading the residual value credit corresponding to one Preset-request is thus automatically, i. without one further intervention by the user of the franking machine, carried out. The display will show a appropriate communication that due to the Phone number change the connection automatically is built.

It is envisaged that after an intervention, the franking machine controlled in the communication mode 300 becomes. The authorized person can also use the data center then notify completed verification. A Communication can be a phone number storage, as also a credit recharge or fund redemption include. Without interruption of communication can so several transactions are performed.

Should the amount of the credit to be reloaded in the remain the same height as the last Credit recharge, only one transaction is necessary.

Should the amount of the credit to be reloaded, however changed, two transactions are required. Both transactions are done in a similar way.

A successful transaction runs as follows: The franking machine sends its ID number and one Default value for the height of the desired Reload credit if applicable together with a MAC to the Data center. This checks such transmitted Message against the MAC, then a likewise MAC-secured OK message to the franking machine too send. The OK message does not contain the default value more.

It is envisaged that the transmission of a new Safety flags X 'or relevant data for one Change of the credit amount in the franking machine in encrypted form, but the transmission of Telephone number in unencrypted form. however is a MAC-hedge additionally possible. Is in the data center found that the connection to the Postage meter has been solved (step 503) or faulty data (505) or unrecoverable errors (509) or no end of bias has been sent (507), the communication is finished. After a Error message occurs the release of the communication connection, saving the transmitted data and their evaluation in step 513 on the part of the data center.

During a first transaction, at least one encrypted message to the data center as well as to Postage meter transmitted. The default is only in the encrypted message of the first transaction contain. Each message sent, which is security relevant Transaction data is encrypted. As encryption algorithm for the encrypted messages is for example the DES algorithm intended.

A transaction request results in the postage meter machine for a specially secured credit recharge. Preferably a fuse is taken out of the processor in the cost center memory 10 present postal register also during the credit recharge by means of a time control. Will the postage meter For example, with an emulator / debugger observed, then it is likely that the communication and Billing routines not within a predetermined Time running out. If that is the case, i. need the routines Significantly more time will be part of the DES key changed. The data center, this can modified key during a communication routine determine with register query and then report the postage meter as suspect as soon as Step 313 sent a start message encrypted becomes.

In the data center, it is determined in step 509, that the error can not be corrected. The data center then can not perform a transaction (step 511) because branching back to step 513. Because in the Postage meter received in step 315 no data were, the transaction was not done correctly (Step 316). Then, then, via step 310 branched back to step 301 to look for an indication to re-examine whether a transaction request continues is provided.

If this is not the case, the communication mode becomes 300 and the point f, i. the operating mode Reached 290. Thus, in the case discussed above, with modified DES key, no data transmitted (step 211). It is also assumed that neither a test request (step 212) another register call (step 214) was initiated, to check the remaining balance. But then he will Franking mode 400 reached.

Safety begins with an authorized intervention advance, the reliability of the authorized person (Service, inspector) and the possibility of their presence to check. The control of the seal and the control of the register status during an inspection the franking machine and regardless of the data in the data center then gives the verification security. The control of the franked mail under Inclusion of a security impression provides a additional verification security.

The franking machine performs regularly and / or at Turn on the register check and can thus the Detect missing information if in the machine unauthorized intervention or if unauthorized had been served. The franking machine will then blocked. Without the invention in connection with a security flag X would the manipulator the Overcome blocking easily. That's how it works Security flag X lost and it would Manipulator too much time and effort cost, the valid MAC-secured security flag X or codeword Attempts to determine. In the meantime, that would be Franking machine long ago in the data center as Suspicious registered.

Other variants or a combination with others Variants, such as deleting a part the DES key or the redundant register states or delete other data or keys, which for the data center in a transaction meaning have are included by the inventive idea. It is essential that critical program parts stored in the OTP and the program runtime monitoring means software and / or hardware Components of the OTP are. So that can be done with these Program parts that are external to the OTP in program memory PSP 11 monitored critical programs monitored become. The advantage is that the monitoring program even not under surveillance or manipulated can be, because it stays in OTP all the time, too can not be read.

A suitable processor type is, for example, the TMS 370 C010 from Texas Instruments, which has a 256 bytes E ² PROM. Thus, security-relevant data (keys, flags, etc.) can be stored tamper-proof in the processor.

If a manipulator takes an unauthorized intervention before, the franking machine is transformed by transferring into the first mode is effective at franking with a Postage value hindered.

The potential manipulator of a franking machine must overcome several thresholds, which of course a certain Time required. Occurs at certain intervals no connection from the franking machine to the data center, is the postage meter already suspect. It is assumed that the one who manipulates the postage meter commits to barely getting back to the data center will report.

During an inspection, first the seal of the Postage meter on integrity and then the Registry status checked. If necessary, a trial print be made with the value 0. At a Repair by the local service may have to be done in the postage meter be intervened. The error registers are for example with the help of a special Service EPROM readable, which replaces the Advert EPROM is plugged. If on this EPROM slot will not be accessed by the processor usually accessing the data lines through special - not shown in the figure 1 - Driver circuits prevented. The data lines, which can be reached through a sealed door can not be contacted without authorization become. Another variant is the reading of Error register data through one via an interface connected service computer. To prepare for Engage the registers of the franking machine asked for the type of intervention required determine. Before intervening in the postage meter and the housing is opened, a separate takes place Call at the data center. Will then be within a predetermined period of time, the default value to zero changed and the data center as part of a transaction transmitted, i. the nature of the procedure and the Register data was communicated to the data center a transmission of data from a data center to the franking machine according to a requested Authorized intervention in the franking machine, which logged as a permitted intervention.

Will within a predetermined period of time but the Default value to a value other than zero changed and the data center under a Transaction, remains a previously made separate call to the data center without consequences, i. on Request for intervention is considered as not filed and one Authorization to authorize the postage meter is not granted and therefore not a new one Safety flag or code word X 'transmitted.

The franking machine is capable of distinguishing between requested authorized and unauthorized Engaging in the franking machine by means of the control unit the franking machine in conjunction with the the data center transmitted data, with unauthorized Engaging in the postage meter this intervention is logged as an error case, but after Authorized intervention in the franking machine the original operating state by means of the aforementioned transmitted data is restored.

The explanation of the processes after the - in the figure 4 - Franking mode is shown in connection with the - Flowchart shown in the figure 2. It is also in times in which is not printed (Standby mode) provided that a query with regard to manipulation attempts and / or the check sum of the register statuses and / or over the Content of the program memory PSP 11 is formed. The the aforementioned checksum is from the franking machine manufacturer MAC secured in nonvolatile memory 5 (Memory area E of the NV-RAM). For checking of the contents of the program memory PSP 11 becomes the Checksum recalculated and using a stored unchanged key MAC formed. The aforementioned key is a tamper-proof (non-readable) Subkey. Now the old MAC-secured loaded from the NV-RAM 5 and with the newly determined MAC-secured checksum compared in OTP. For improvement Tampering security is in one another variant for a kill mode 2 the checksum in the processor about the contents of the external program memory PSP 11 formed and the result with an im Processor stored predetermined value compared. This is preferably done in step 101 when the Franking machine is started, or in step 213, when the postage meter is operating in standby mode becomes. The standby mode is reached when a predetermined time no input or print request he follows. The latter is the case if a ansich known - not shown - letter sensor no next envelope determined, which to be franked. The - shown in Figure 4 - Step 405 in franking mode 400 therefore still includes one further inquiry after a time expiration or after the Number of passes through the program loop, which finally back to the input routine according to Step 401 leads. If the query criterion is met, At step 408, a standby flag is set and directly branched back to system routine 200 at point s, without the billing and printing routine in step 406 is passed. The standby flag will appear later in the Step 211 queried and after the checksum check reset in step 213 if no manipulation attempt is recognized.

The query criterion in step 211 is added to the Question expands whether the standby flag is set, i. whether the standby mode is reached. In this case will also branched to step 213. A preferred variant consists in already described Way to clear the security flag X when a Manipulation attempt in standby mode on the aforementioned Way has been determined in step 213. The specially secured special flag N can also be found in the Step 213 will be checked, especially if it is MAC-secured is by changing the flag content with the MAC content is compared. The absence of the security flag X will detected in query step 409 and then on the step 213 branches. The advantage of this method in Connection with the first mode is that the Manipulation attempt statistically detected in step 213 becomes.

FIG. 4 shows the flow chart for the franking mode according to a preferred variant. The invention works assume that after switching automatically the Postal value in the value impression corresponding to the last one Input before turning off the franking machine and the date in the day stamp according to the current one Date are given, that for the impression the variable data in the fixed data for the frame and for all unchanged data embedded electronically.

The number strings (sTrings) used to generate the Input data with a keyboard 2 or via a connected to the input / output device 4, the Postage value calculating electronic balance 22 entered are automatically stored in memory area D of the nonvolatile random access memory 5 stored. also remain also records of sub-storage areas, for example, Bj, C, etc., received. This is assured that the last input sizes even when you turn off the Postage meter will be preserved, so that after switching automatically the postage value in the value impression accordingly the last entry before switching off the Franking machine and the date in the day stamp accordingly the current date is given. If a scale 22 is connected, the postage value is canceled taken from the memory area D. In step 404 waited until one is currently stored. Upon a renewed input request in step 404 is branched back to the step 401 again. Otherwise, branching is made to step 405 to obtain the To wait for print output request. Through a letter sensor the letter to be franked is detected and to trigger a print request. Thus, can up the billing and printing routine in step 406 be branched. There is no print output request (Step 405), it goes to Step 301 (Point e) branches back.

Since according to the - shown in Figure 4 - variant branched back to point e and step 301 can be reached at any time a communication request or another input according to the Steps test request 212, register check 214, Input routine 401 are made.

Another query criterion may be in step 405 to request a standby flag in step 408 set if no after a predetermined time Print output request is present. As already above explained, the standby flag in the communication mode 300 following step 211 are queried. This is not branched to the franking mode 400, before not the checksum check the completeness all or at least selected programs Has.

If a print output request in step 405 will be recognized, further queries in the following Steps 409 and 410 and in step 406 made. For example, in step 409, the Presence of a valid safety flag X resp. a corresponding MAC-secured flag X, the Achieving a further quantity criterion and / or im Step 406 in the known manner for billing retrieved registered register data. Was that to Franking predetermined amount in the previous Franking consumed, i. Quantity equal Zero is automatically branched to the point e to enter the Communication mode 300 to enter from the Data Center a new predetermined number S again is credited. Was however the predetermined number of pieces not yet consumed, from step 410 to the Billing and printing routine branches in step 406.

The number of printed letters, and the current ones Values in the postal registers are calculated according to the entered cost center in non-volatile memory 10 of the franking machine in a billing routine 406 registered and stand for a later evaluation to disposal. A special Sleeping Mode counter will be during the immediately before printing Billing routine causes counting on a counting step.

If necessary, the register values can be displayed in display mode 215 be queried. It is also envisaged that Register values with the print head of the franking machine too To print billing purposes. That can for example as well as that already in the German Laid-open patent P 42 24 955 A1 explained in more detail becomes.

It is also provided in another variant, that also variable pixel image data during printing embedded in the remaining pixel image data. Corresponding the position message supplied by the encoder 13 about the advance of the mail or Paper strip in relation to the printer module 1 the compressed data from the main memory 5 read and with the help of the character memory 9 in a converted to binary pixel data containing print image, which also in such a decompressed form in volatile memory 7 is stored. details Designs are the European applications EP 576 113 A2 and EP 578 042 A2 can be removed.

The pixel memory area in the pixel memory 7c is thus for the selected decompressed data of the fixed Parts of the franking image and for the selected decompressed ones Data of the variable parts of the franking picture intended. After billing, the actual takes place Print routine (in step 406). Like from the Figure 1 shows, stand the memory 7b and the pixel memory 7c with the printer module 1 via a a print register (DR) 15 and an output logic having printer controller 14 in conjunction. The Pixel memory 7c is the output side to a first Input of the printer controller 14 connected to the further control inputs output signals of the microprocessor control device 6 abut. Are all columns a printed image has been printed, is back to System routine 200 branches back.

The transmission of a new quantity S 'can then take place in the same way as has already been explained in connection with the transmission of the new security flag X'. In a communication according to FIGS. 3 a and 3 b, a new predetermined number of pieces S 'is then transmitted and decremented as a quantity S while the franking is running. The comparison piece number S _ref is internally calculated from the new predetermined number of pieces S '(step 213). Thus, in step 203, a warning "CALL FP" can be issued before reaching the number zero. The user of the franking machine is thus requested to carry out communication with the data center in order to carry out at least one ZERO remote value specification for the subsequent accreditation of at least the number of pieces S.

In Figure 5, the flow is two transactions for reloading with a credit value, preferably simplified with a zero credit value. Such a ZERO remote value specification always comprises two Transactions.

The first transaction of communication with the Data Center DZ includes the message of a predetermined default wish. To the consistency of Register statuses between the data center DZ and the Making a franking machine FM is a NULL default request suitable. Such leads during a second transaction to a NULL default value of the Descending register value can be added without the Value of the remaining balance to change.

For a normal entry into communication mode after the start of the franking machine in step 218 the system routine 200 shown in FIG queried whether the user has a correct page entry was carried out. If that is not the case becomes Point e of the system routine 200 branches. On the The display will show a message about the opening of the Communication, if an input of the PIN and pressing the teleset key (T key) takes place. In addition will the previous default value indicated by the new default request NULL can be overridden. After the zero entry, the T key is pressed again. Now there is a transaction request and the Communication can be done.

The first step during a first transaction includes after entering the communication mode (positive remote value default or Teleset mode) one Sub-step 301 for checking for a posed Transaction request and further sub-steps 302 to 308 for entering the identification and other Data to establish the communication link and to communicate with unencrypted data to at least identification and transaction type data to transfer to the data center.

It is envisaged that a first step of the first Transaction sub-steps 301 to 308 of the franking machine includes to establish the connection for communication with unencrypted data and at least Identification, transaction type and other data to transfer to the data center. The transaction type data (1 byte), includes the message to the data center DZ below the Teleset mode for a desired positive remote value specification with the identified To perform franking machine.

A second step of the first transaction comprises Sub-steps 501 to 506 in the data center, for Receiving the data and checking the identification the franking machine and for the transmission of a unencrypted o.K. Message to postage meter. The second step of the first transaction also includes Sub-steps to erroneous unencrypted messages 505 via a sub-step 513 to Error message on a resting state point q in the sub-step Branch 501 in the data center until the Communication on the part of a franking machine again is recorded.

A third step of the first transaction involves Sub-steps 309 to 314 of the franking machine, for Formation of a first encrypted message crypto cv by means of a stored in the postage meter first key Kn and for transmission of encrypted Data center data, including at least the default, identification and postregister data. In a further embodiment of the security measures Includes this encrypted message too Data in the form of CRC data (cyclic redundancy check data). The default request, the identification, Postal register and other data, such as a Checksum (CRC data) will be in one with the DES algorithm encrypted message transmitted;

A fourth step of the first transaction, the sub-steps 507 to 511 in the data center is to receive and decrypt the first encrypted Communication. An examination on Decryptivity is by means of a in the Data center stored key performed. If successful, a calculation is made in the data center to make a second key Kn + 1, corresponding to that used by the postage meter Key. Subsequently, a second encrypted Message crypto Cv + 1 made which at least the aforementioned second key Kn + 1, the Contains identification and transaction data, where for encryption again the DES algorithm is being used. Finally, a transfer of the second encrypted message crypto Cv + 1 to Franking machine provided.

Further sub-steps are used to determine irrecoverably incorrect encrypted messages in sub-step 509 via a sub-step 513 to Error message on a hibernation 501 in the Data center branch until the communication is resumed by a franking machine. Substeps are still provided to be included in the Sub-step 509 detected erroneous encrypted Messages but with recoverable errors, up a sub-step 510 to cancel the previous one Transaction and then to the sub-step 511 in the Branch data center. This sub-step is used for forming a second key Kn + 1 which belongs to Franking machine should be transmitted encrypted, for forming a second encrypted message crypto Cv + 1 and to transfer the encrypted Message about postage meter. In addition, the closes fourth step of the first transaction a sub-step 512 of the data center for storing the default request from which the first sub-step 701 of the second Step of the second transaction is branched to the first key Kn as the predecessor key and the second key Kn + 1 as successor key too to save.

A fifth step of the first transaction, comprising sub-steps 315-318 of the postage meter, is for receiving and decrypting the second encrypted message, extracting at least the identification data and the transmitted second key Kn + 1 _{Cv + 1} , and verifying the received encrypted _ones Message based on the extracted identification data. Upon verification, the transmitted second key Kn + 1 _{Cv + 1} and the default _request are stored in the postage meter machine. Otherwise, if not verified, the first step of the first transaction is branched back.

After this pre-synchronization of the data center through the franking machine starts a second transaction, which preferably by an additional manual Input in step 602 is triggered. In the result This time-limited entry is triggered the second transaction or leaving the second transaction in communication mode when the Input time is exceeded. Preferably, the T key must be pressed within 30 sec or the Entry time is exceeded and it becomes the first Step of the first transaction branched back. The Communication can now refrain as needed or be repeated.

A first step of the second transaction comprises sub-steps 602 to 608 of the franking machine for communication with unencrypted data to the connection build up and at least identify and Transmit transaction type data to the data center.

A second step of the second transaction, the sub-steps 701 to 706 of the data center is to Receiving the data and checking the identification the franking machine and for the transmission of a unencrypted o.K. Message to postage meter intended. It is further envisaged that the second Step of the second transaction sub-steps to for faulty unencrypted messages 705 via a sub-step 513 to the error message to a Hibernate state 501 in the data center until the communication from a franking machine again is recorded.

A third step of the second transaction comprises sub-steps 609-614 of the franking machine for formation a third encrypted message crypto cv + 2 by means of the aforementioned in the franking machine stored second key Kn + 1 and to Transmission of the third encrypted message crypto cv + 2 to the data center, comprising at least Identification and post register data, but without Data for a default value.

A fourth step of the second transaction, the sub-steps 707 to 711 the data center for reception and for decryptification of the third encrypted Message contains crypto Cv + 2, performs their check on Decryptivity by means of one in the data center stored key through. Then there is a Forming a third key Kn + 2, which to Franking machine should be transmitted encrypted, forming a fourth encrypted message crypto Cv + 3, which at least the aforementioned third Key Kn + 2, the identification and the Contains transaction data and transferring the fourth encrypted message crypto Cv + 3 to Franking machine.

The fourth step of the second transaction closes Sub-steps to in case of irrecoverably faulty ones encrypted messages (sub-step 709) a sub-step 513 for the error message to a Hibernate state 501 in the data center until the communication from a franking machine again is recorded. Detected in step 709 with incorrect encrypted messages A recoverable error is made to a step 710 Cancellation of the previous transaction branches. This is then done in the data center in sub-step 711 forming a third key Kn + 2 which belongs to Postage meter machine should be transmitted encrypted. To make a fourth encrypted message crypto Cv + 3 again uses the DES algorithm. Subsequently, a transfer of the encrypted Message about postage meter.

It is also envisaged that the fourth step of the second transaction to store the default value a sub-step 712 of the data center, the on the first sub-step 501 of the second step of first transaction branches to the second key Kn + 1 as predecessor key Kn-1 and the third Key Kn + 2 as successor key Kn for more store first and second transactions.

A fifth step of the second transaction, comprising sub-steps 615-618 of the postage meter, is for receiving and decrypting the fourth encrypted message, extracting at least the identification data and the transmitted third key Kn + 2 _{Cv + 3,} and the transaction data, as well as for verification the received encrypted message based on the extracted identification data. Upon verification, the transmitted second key Kn + 2 _{Cv + 3} and the default value in the meter are added in accordance with the descending register value R1 and the resulting balance stored or otherwise, if not _{verified, is branched} back to the first step of the first transaction.

Either you go back to the first step, to further trigger the transactions too effect, or in the fifth step of the second Transaction will request the aforementioned transaction lifted again.

From this NULL distance preset in communication mode differs a negative distance value default in Special mode especially by special tamper-proof Flags and a time monitoring. Such tamper-proof Flags are in particular a MAC-secured Security Flag X and a MAC-secured Special flag N.

In Figure 6, the flow is two transactions for reloading with a negative credit value, i. a negative fair value default for fund redemption presented to the data center. Such a negative Remote value specification comprises at least two transactions.

The first transaction of communication with the Data Center DZ includes the message of a predetermined default wish, preferably one Null-Vorgabe-Wunsches, to the consistency of the Register statuses between the data center DZ and the Franking machine FM produce.

The first step during a first transaction includes after a defined page entry into the Special mode negative remote value preset compared to one normal entry into the communication mode (Teleset mode) after the start of the franking machine a Sub-step 301 for checking for a posed Transaction request and further sub-steps 302 to 308 for entering the identification and other Data to establish the communication link and for communication with an unencrypted message, at least identification and transaction type data to transfer to the data center. A Securing individual data in the message can again by a MAC or CRC data in the be achieved above.

The defined page entry is achieved by pressing a secret predetermined key combination while turning on the postage meter. According to the invention, the control unit of the franking machine, in conjunction with the data previously transmitted by the data center, and an input procedure between authorized action (service technician) and unauthorized action (intent to manipulate) may differ.
In the case of authorized action, a special flag N is set in step 220, because if the franking machine FM is switched off, the continuation of the transactions must be ensured after the franking machine has been switched on again. To protect against possible manipulation, the special flag N is also stored non-volatile MAC-secured.

If an unsuccessful attempt is made or another key combination is entered for the page entry, this is deemed to be unauthorized action or manipulation intent (error message) and stored, and a step 209 is initiated to prevent further franking.
It is envisaged that a predetermined combination of keys for each franking machine will be stored in the data center and communicated only to the authorized person (service technician) in order to achieve a specific operation in the postage meter machine. The correct page entry causes a message on the display about opening the communication.

To transfer the franking machine in a special mode becomes a tamper resistant flag N im Step 220 set if a specific criterion fulfilled, the specific criterion for the special mode negative remote value default at least the Use of the predetermined key combination for Side entry into special mode during power up the franking machine comprises.

In one variant takes place, as with the positive one Remote value input, enter the PIN and press the Teleset button (T button), then zero entry and press the T key before the communication is performed.

Communication with the data center includes at least two transactions, which in case of error be repeated, and after interruption the communication automatically resumes and / or as long as the aforesaid Special flag N is set for the special mode, by that made an automatic transaction request is to complete the retransfer of the credit.

It is envisaged that a first step of the first Transaction sub-steps 301 to 308 of the franking machine includes to establish the connection for communication with unencrypted data and at least Identification, transaction type and other data to transfer to the data center. The transaction type data (1 byte), includes the message to the data center DZ below the special mode of a desired negative remote value specification with the identified To perform franking machine.

A second step of the first transaction comprises Sub-steps 501 to 506 in the data center, for Receiving the data and checking the identification the franking machine and for the transmission of a unencrypted o.K. message to the franking machine. The second step of the first transaction also includes Sub-steps to erroneous unencrypted messages 505 via a sub-step 513 to Error message on a hibernation 501 in the Data center branch until the communication is resumed by a franking machine.

A third step of the first transaction involves Sub-steps 309 to 314 of the franking machine, for Formation of a first encrypted message crypto cv by means of a stored in the postage meter first key Kn and for transmission of encrypted Data center data, including at least the default, identification and postregister data. In a further embodiment of the security measures Includes this encrypted message in Form of CRC (Cyclic Redundancyy Check Data) data Communication to the data center DZ following the Special mode of a desired negative distance value specification perform. In the two-byte Cyclic Redundancey Check is a checksum the one manipulation to the individual to the checksum processed data. This checksum can individual data or the components of all messages (Transaction type) on the part of the franking machine. The default request, the identification, Postregister and the CRC data are in one with the DES algorithm encrypted message transfer. Thus, it is not necessary to data in the first Step MAC-secured or encrypted to the data center transferred to.

A fourth step of the first transaction, the sub-steps 507 to 511 in the data center is to receive and decrypt the first encrypted Notification or examination for decryptivity by means of one in the data center stored key, to form a second Key Kn + 1 corresponding to that of the franking machine used keys, to make a second one crypto Cv + 1 encrypted message which at least the aforementioned second key Kn + 1, the Identification and the transaction data contains and for transmitting the second encrypted message crypto Cv + 1 provided for franking machine.

It is envisaged that the fourth step of the first Transaction also includes sub-steps to be irrecoverable erroneous encrypted messages 509 via a sub-step 513 for the error message to a Hibernate state 501 in the data center until the communication from a franking machine again is recorded. They are still sub-steps provided to encrypted in case of faulty Messages 509 with recoverable errors, to one Step 510 to cancel the previous transaction and then to the sub-step 511 in the Branch data center. This sub-step is used for forming a second or third key Kn + 1, which transmits encrypted to the franking machine should be, to form a second encrypted Message crypto Cv + 1 and to transfer the encrypted message to postage meter. also concludes the fourth step of the first transaction a sub-step 512 of the data center for storage of the default request from which the first sub-step 701 of the second step of the second transaction is branched to the first key Kn as Predecessor key and the second key Kn + 1 as Successor key to save.

A fifth step of the first transaction, comprising sub-steps 315-318 of the postage meter, is for receiving and decrypting the second encrypted message, extracting at least the identification data and the transmitted second key Kn + 1 _{Cv + 1} , and verifying the received encrypted _ones Message based on the extracted identification data. Upon verification, the transmitted second key Kn + 1 _{Cv + 1} and the default _request are stored in the postage meter machine. Otherwise, if not verified, the first step of the first transaction is branched back.

After this pre-synchronization of the data center through the franking machine is a second transaction. A first step of the second transaction comprises Sub-steps 602 to 608 of the franking machine for Communication with unencrypted data to the Establish connection and at least identification and transaction type data to the data center transferred to.

A second step of the second transaction, the sub-steps 701 to 706 of the data center is to Receiving the data and checking the identification the franking machine and for the transmission of a unencrypted o.K. message to the franking machine intended. It is further envisaged that the second Step of the second transaction sub-steps to for faulty unencrypted messages 705 via a sub-step 513 to the error message to a Hibernate state 501 in the data center until the communication from a franking machine again is recorded.

A third step of the second transaction comprises sub-steps 609-614 of the franking machine for formation a third encrypted message crypto cv + 2 by means of the aforementioned in the franking machine stored second key Kn + 1 and to Transmission of the third encrypted message crypto cv + 2 to the data center, comprising at least Identification and post register data, but without Data for a default value.

A fourth step of the second transaction, the sub-steps 707 to 711 the data center for reception and for decryptification of the third encrypted Message contains crypto Cv + 2, performs their check on Decryptivity by means of one in the data center stored key through. Then there is a Forming a third key Kn + 2, which to the franking machine encrypted is to be transmitted Making a fourth encrypted message crypto Cv + 3, the at least the aforementioned third key Kn + 2, the identification and the transaction data contains and transmitting the fourth encrypted Message crypto Cv + 3 to the postage meter.

The fourth step of the second transaction closes Sub-steps to in case of irrecoverably faulty ones encrypted messages 709 via a sub-step 513 to the error message on a sleep state 501 in the Data center branch until the communication is resumed by a franking machine. At faulty detected in a step 709 encrypted messages with recoverable errors to a step 710 to cancel the previous one Transaction branches. After that takes place in the data center in sub-step 711, forming a third one Key Kn + 2, which encrypts the postage meter should be transmitted. To form a fourth encrypted Message crypto Cv + 3 will be back DES algorithm used. Subsequently, a Transferring the encrypted message to Franking machine.

It is also envisaged that the fourth step of the second transaction to store the default value a sub-step 712 of the data center, the on the first sub-step 501 of the second step of first transaction branches to the second key Kn + 1 as predecessor key Kn-1 and the third Key Kn + 2 as successor key Kn for more store first and second transactions.

A fifth step of the second transaction, comprising sub-steps 615-618 of the postage meter, is for receiving and decrypting the fourth encrypted message, extracting at least the identification data and the transmitted third key Kn + 2 _{Cv + 3,} and the transaction data, as well as for verification the received encrypted message based on the extracted identification data. The aforementioned step has to identify the completed implementation in contrast to the positive remote value default on another query criterion. Within a predetermined time, from the sending of the third crypto message, the fourth crypto message is to be received by the franking machine FM. If the connection was uninterrupted, the reception would take place in the predetermined time t1.

In the preferred embodiment, therefore, the last and especially critical section of the second transaction monitored for exceeding time t1. In order to the possible manipulation time is severely limited. This is to be transmitted during the penultimate Message, from the sending of the third crypto message in the processor (control unit 6) of the franking machine started a time counting. This is preferably so solved that the corresponding program section a Routine activated, which sets a counter, the in turn by the system clock or its multiple is decremented. For a longer period of time, for example, in the order of 10 seconds, too monitor several meters are cascaded. Reached now within the critical period the fourth Crypto message from the data center the franking machine, the counter is deactivated. Stay that way the last crypto message, on the other hand, becomes the set one Counter further decrements. At the zero crossing of the Counter is a program interrupt signal (interrupt) triggered. This signal causes the call a special subroutine, which is a renewed Prepared transaction and triggers. Part of this again transaction is again the transmission of the Post register contents. One in the data center Consistency check then leads to the result that an unfinished transaction in special mode negative Preceding the remote value. The inconsistent records are corrected and the negative distance value preset will be completed.

Another variant of the invention results when an incremental instead of a decremental counter is used. It must after each count clock the Comparison can be done with the number given to the monitored period corresponds.

Exceeding the time t1 is a sure indication for a failed transfer and causes the call a special subprogram, which is a renewed Execution of the special mode negative remote value default prepared and automatically triggered. The first and second transaction will be automatic in this case repeated with key Kn + 2.

After successful retrieval or verification in the fifth step of the second transaction, the transmitted second key Kn + 2 _{Cv + 3} and the default value in the postage meter are added according to Descendingregisterwert R1 and the resulting balance stored or otherwise in the case of non-verification or timeout is the first step of branched back to the first transaction.

The fifth step of the second transaction closes a sub-step (620) of the postage meter for Resetting the aforementioned special flag N or Return to the normal mode of the franking machine, whereby the aforementioned automatic transaction request is canceled again when carrying out the second transaction has been completed.

The present service technician secures the further one disturbance-free process until the completion of the negative Telesetting.

Is the completion due to a longer or permanent Interruption of connection between postage meter and data center not possible, the Service technician the postage meter machine in the dealer office take away and continue the completion from there. Otherwise, a credit balance in the Postage meter revealed, which for information in the data center is already considered retransmitted. The successful completion of the negative distance value specification, i.e. the fund retransfer, is by a query the register states R1 = 0 or R2 = R3 and R3 = R2 + R1 verifiable.

R1 (descending register) vorrätige Restbetrag in der Frankiermaschine,

R2 (ascending register) Verbrauchssummenbetrag in der Frankiermaschine,

R3 (total resetting) die bisherige Gesamtvorgabesumme aller Fernwertvorgaben,

R4 (piece count õprinting with value Ï O) Anzahl gültiger Drucke,

R8 (R4 + piece count õprinting with value = O) Anzahl aller Drucke

The postage meter machine may transmit the data central register values, for example, before reloading with a NULL default value. Here are:

R1 (descending register) remaining amount in the franking machine,

R2 (ascending register) consumption sum amount in the franking machine,

R3 (total resetting) the previous total of all remote value defaults,

R4 (piece count õprinting with value Ï O) Number of valid prints,

R8 (R4 + count õprinting with value = O) Number of prints

At each remote value default can be at least R1 query and statistically evaluate.

The data center is at the end of the day on the Validity of fund redemption as a result of Special mode negative remote value setting decided. If no incident is reported by the service technician that, for example, the negative Fernwertvorgabe not was feasible, or if by the same franking machine no request to reload a positive one Credit, the validity is assumed.

The negative remote value default when entering the special mode set special flag N was successful at Transaction reset. The franking machine prevents all frankings with values greater than zero, because no more credit is loaded. The franking machine is still zero for frankings with values and other modes are operational as long as they are do not require credit or as long as there is no postage franked and the quantity limit is not reached.

Either, as in the one variant, by the predetermined page entry a trigger the Transactions in special mode causes or it is in another variant at least one manual step 302 in special mode negative remote value preset after one Page entry to enter an identification number (PIN) and to enter the predetermined default as provided for the positive distance value specification, which is queried in step 303. Through a additional manual step to temporary Input, which is queried in step 603 takes place a triggering of the second transaction and a Exit or repeat the first transaction in communication mode or in special mode, if the Input time is exceeded. Preferably, the T key must be pressed within 30 sec or the Entry time is exceeded.

There are still a number of variants with different Security level feasible. So can in the data center a check for transmission performed a predetermined default become. In the simplest case, the default request - similar to that in display mode 215 interrogatable in Descendingregister still in stock balance R1 - entered and transmitted to the data center. There to the data center automatically with each transaction the Postregister contents, but at least R1 transmitted becomes a negative remittance default for fund redemption if the specified amount is the same achieved with the balance.

In a second variant comes with the data center Any default request agreed as a code. Preferably, a NULL default request is agreed. Will now within a certain time after the Agreement of special mode negative distance value specification called and entered the NULL default request or confirmed as a default, is in the franking machine automatically the balance R1 to zero reset. A corresponding query step 219 according to such a further specific criterion for the franking machine has been dashed in FIG shown. From this is the step 220 for Setting the special flag N branched. In further Embodiment, the operation can be simplified if a ZERO default is the last transaction already done. Then only the To perform operation for the page entry, to the negative remote value default fully automatically or to a zero residual value R1 = 0 to to reach.

By starting a time monitoring from the Sub-step 613 of sending the third crypto message to the data center until the reception of the fourth crypto message from the postage meter a manipulation is limited in time. If the fourth crypto message not within one a predetermined time t1 could be received called special subprogram, which is a renewed execution of the special mode negative remote value default prepared and automatically triggered. By further sub-steps 615, 616, 301 for automatic Resumption of communication after interruption of the Communication link between data center and Franking machine or after switching off and on again the franking machine will last as long as that aforementioned special flag N is set, the communication continued. That as a transaction request rated special flag N is non-volatile and against Manipulation MAC-saved saved. Only after Completion of the retransfer of the credit becomes the Special flag N reset in step 620.

In a third variant, safety is increased by a combination of different measures. Regardless of the franking machine, a first communication connection between the authorized user and the data center for storing a code for registering an authorized action on the postage meter machine is established by a later-transmitted default request. Now a turning on the postage meter for making an authorized predetermined operation can be done to enter via a page entry into a special mode negative Fernwertvorgabe. Then, a second communication connection between postage meter and the data center and input of a default request is made. In a first transaction, a distinctive log on to the data center occurs when the submitted default request matches a corresponding code. In the first transaction, for example, a new code word or security flag and / or operating sequence is transmitted to the franking machine. By carrying out at least one further transaction and automatically carrying out the aforementioned communication, the security-relevant data are transmitted and their storage in the postage meter machine is completed. According to the default request, the default value in the corresponding memory of the franking machine and for the purpose of checking the transaction is also added to the remaining balance in a corresponding memory of the data center.
Otherwise, an execution of a step 209 for deleting a tamper-proof stored security flag X as a result of at least one unauthorized deviation from the predetermined operation or because it was intervened in the postage meter provided. Thus, the postage meter machine is placed in a first mode to effectively disable it for franking (franking mode 400) (step 409) as opposed to the authorized action.

A transmission of a valid operating procedure from the data center to the franking machine becomes superfluous if the operating sequence is changed over time. In the data center and in the franking machine, the same calculation algorithm is used to determine a current operating procedure. Another variant is based on the storage of the current operating procedure in the franking machine by means of a special reset E ² PROM by the service technician.

In another variant, the safety of an authorized person by means of an additional Input security increases, which with the Franking machine is brought into contact with a Transfer remaining credit back to the data center. First of all, the data center becomes up to date produced by the register states by means of a Zero-distance value preset to be reported. Subsequently, will as input security by the service technician Reset read only memory device in a predetermined Base of the at least partially open franking machine used. After switching on or one Page entry into the program of the franking machine a check is made as to whether a read-only memory is reset (Refunds EPROM) was used. That can be beneficial in - shown in Figure 2 - step 219 to verification of another criterion. On correct page entry with no existing Refunds EPROM leads to the point e or in a not shown Variant one step to abort the routine. For example, step 209 may be for deletion of a flag X, which in step 409 of FIG Franking mode (Figure 4) would be noticed and the statistics and error evaluation or registration in step 213 leads. Otherwise, the correct page entry and when Refunds EPROM is inserted, a special flag N set what happens automatically in communication mode Return the remaining balance to the data center triggers.

In a sub-variant, steps 218 and 219 according to Figure 2 run in their order reversed, so that only with regard to the inserted Refunds EPROM and only then after the right side entry is asked. Such a sub-variant has the advantage that information about the correct page entry can also be stored in the Refunds EPROM, instead of in the franking machine. This will be the Security against tampering with manipulation further increased.

In the data center, the state of the Postage meter (out of service) saved. The authorized person removes the input security from the socket and closes the case of the Franking machine. In the data center will be like in the postage register registering the credits of the franking machine for available balance R1, consumption sum amount R2 and total amount R3 are set to zero (R1 = 0, R2 = 0, R3 = R1 + R2 = 0).

In an existing in the franking machine chip card read / write unit can the input security Of course, also be realized as a chip card.

The invention is not limited to the present embodiments limited. Rather, a number of Variants within the scope of the claims conceivable.

Claims (2)

A method of enhancing the security of postage meter microprocessor manipulators in a franking machine control unit to perform steps for a start and initialization routine and a subsequent system routine with the ability to enter a communication mode with a remote data center to load or load a credit value Data center back to transfer and other input steps to enter a franking mode, which is branched back into the system routine after execution of a billing and printing routine, characterized by distinguishing between non-manipulated and manipulated operation of a postage meter by means of the control device (6), during an operating mode (290) a monitoring of the duration of the sequence of programs, program parts or security-related routines is made and by a after the end of programs, program parts or comparing relevantness of the measured transit time with a predetermined transit time and / or by monitoring during a communication in the communication mode (300) monitoring compliance with a certain timeout in the special mode negative remote value specification, in particular the time from sending a third encrypted message from the postage meter to the reception the fourth encrypted message sent from the data center to the postage meter machine in the postage meter machine, which upon verification triggers a zeroing of the credit value. A method according to claim 1, characterized in that a decremental counter or an incremental counter is used to detect an exceeding of the time t1 in the special mode as a secure indication of an unsuccessful transmission and that a special subprogram is called, which is a re-execution prepares and automatically triggers the negative remittance default mode so that the first and second transactions are automatically repeated.

Images