CA2165102C - Method for identifying a metering accounting vault to digital printer - Google Patents
Method for identifying a metering accounting vault to digital printer Download PDFInfo
- Publication number
- CA2165102C CA2165102C CA002165102A CA2165102A CA2165102C CA 2165102 C CA2165102 C CA 2165102C CA 002165102 A CA002165102 A CA 002165102A CA 2165102 A CA2165102 A CA 2165102A CA 2165102 C CA2165102 C CA 2165102C
- Authority
- CA
- Canada
- Prior art keywords
- encryption key
- digital printer
- postage
- encryption
- meter
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
- G07B17/00—Franking apparatus
- G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
- G07B17/00314—Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
- G07B17/00—Franking apparatus
- G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
- G07B17/00193—Constructional details of apparatus in a franking system
- G07B2017/00241—Modular design
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
- G07B17/00—Franking apparatus
- G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
- G07B17/00314—Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
- G07B2017/00322—Communication between components/modules/parts, e.g. printer, printhead, keyboard, conveyor or central unit
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
- G07B17/00—Franking apparatus
- G07B17/00733—Cryptography or similar special procedures in a franking system
- G07B2017/00846—Key management
- G07B2017/00854—Key generation
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Devices For Checking Fares Or Tickets At Control Points (AREA)
- Accessory Devices And Overall Control Thereof (AREA)
- Record Information Processing For Printing (AREA)
Abstract
The method for preventing monitoring of postage indicia data which is sent from a postage metering vault to a remotely located digital printer over a communication link between the meter vault and the digital printer. The meter is provided with an encryption engine for encrypting postage indicia data utilizing a encryption key. The digital printer includes a decryption engine for decrypting postage data received from said meter utilizing the same encryption key and then prints a postage indicia pursuant to the decrypted postage indicia data. The postage meter also includes a key manager for generating new encryption key pursuant to a token which is either randomly generated or generated pursuant to an algorithm by a similar encryption key manager located in the digital printer which token is also used to generate the decryption key for the decryption engine. As a result, the encryption keys are the same. Upon power-up of the system or at such other preselected times, the print controller module of the digital printer sends out an encrypted message to the meter. The message consist of a random number. The encryption/decryption engine of the vault decrypts the message. The vault then returns an encrypted new message to the print controller which includes an encoded representation of the relationship of the two messages. Upon receiving the new message from the vault, the print controller decrypts the new message and verifies the relationship. The print controller is then enabled to print a postage indicia.
Description
METHOD FOR IDENTIFYING A METERING
ACCOUNTING VAULT TO DIGITAL PRINTER
Background of the Invention The present invention relates to a postage metering system using digital printing and, more particularly, to a postage metering system wherein the postage accounting system is remotely located from the postage printer.
A conventional postage meter is comprised of a secure account system, also known as a vault, and an impact printing mechanism housed in a secure housing having tamper detection. The vault is physically secured and operationally interlocked to the printing mechanism. For example, it is now known to use postage meters employing digital printing techniques. In such systems, the vault and digital printer remain secure within the secure housing and printing can only occur after postage has been accounted for.
It is also know to employ a postage meter in combination with an inserting system for the processing of a mail stream. It has been determined that it would be beneficial to configure a postage metering system which employs an inserter and digital printer in combination with a remotely located vault. However, it has also been determined, as a security step to be beneficial to provide a means to assure that an authorized vault is driving the digital printers in order to insure proper postal accounting between the system user and postal services. Further, such systems may be equipped with remote funds resetting capability; therefore, it is necessary that the accounting records of the user, postal service and operator of the remote funds reset center be reconcilable with regard to an identifiable combination of vault and digital printing systems.
Summary of the Invention It is an object of the present invention to present a method of preventing the operation of a digital printer to print a postage indicia unless the digital printer is in electronic communication with a specific vault system.
A new metering system includes a meter in bus communication with a digital printer for enabling the meter to be located remote from the digital printer.
The meter includes a vault which is comprised of a micro controller in bus communication with an application specific integrated circuit (ASIC) and a plurality of memory units secured in a tamper resistant housing. The ASIC
_2_ includes a plurality of control modules, some of which are an accounting memory security module, a printer controller module and an encryption module. The digital printer includes a decoder/encoder ASIC sealed to the print head of the digital printer. The decoder/encoder ASIC communicates to the printer controller module via a printer bus. Communication between the printer controller and the print head decoder/encoder ASIC interface is accomplished through a printer bus which communications are encrypted by any suitable known technique, for example, using a data encryption standard (DES) algorithm. By encrypting the output of the printer controller module along the printer bus any unauthorized probing of the output of the printer controller to acquire and store the signals used to produce a valid postage print are prevented. If the electrical signals are probed, the data cannot easily be reconstructed into an indicia image by virtue of the encryption. The print head decoder consists of a custom integrated circuit located in proximity to the printing elements. It receives the output from the printer controller, decrypts the data, and reformats the data as necessary for application to the printing elements.
The printer controller and print head controller contain encryption key manager functional units. The encryption key manager is used to periodically change the encryption key used to send print data to the print head. The actual keys are not sent over the interface, rather, a token representing a specific key is passed.
The key can be updated every time the printer controller clears the print head decoder, after a particular number of print cycles, or after a particular number of state machine clock cycles. By increasing the number of encryption keys, the probability that the system will be compromised diminishes.
In order to assure full and accurate accounting for the particular digital printer, upon power-up of the system or at such other preselected condition, the print controller module of the digital printer sends out an encrypted message to the meter.
This message consists of an encrypted random number. The encryptionldecryption engine of the postage meter decrypts the message. The meter then returns an encrypted new message to the print controller which includes an encoded representation of the relationship of the two messages. Upon receiving the new message from the vault, the print controller decrypts the new message and verifies the relationship. The print controller is then enabled to print a postage indicia.
Brief Description of the Drawings Fig. 1 is a diagrammatic representation of a postage meter in combination with a remote printing mechanism in accordance with the present invention.
Fig. 2 is a diagrammatic representation of the postage meter micro control and printer micro control systems in accordance with the present invention.
Detailed Description Of The Preferred Embodiment Referring to Fig. 1, the postage meter control system 11 is comprised of a micro controller 13 in bus communication with a memory unit 15 and ASIC 17.
The printing mechanism 21 is generally comprised of a print controller 23 which controls the operation of a plurality of print elements 27. Data is communicated between the meter control system 11 and the print mechanism over a bus C11. Generally, print data is first encrypted by an encryption module 18 and presented to the printer controller 23 through a printer controller module 19 of the ASIC 17. The data received by the print controller 23 is decrypted by a decryption module 25 in the print mechanism 21 after which the print controller 23 drives the print elements 27 in accordance with the received data. The data exchanged between the two devices is subject to interception and possible tampering since the electrical interconnects are not physically secured. Utilizing encryption to electrically secure the interface between the printing controller and print head reduces the ability of an external intrusion of data to the print mechanism 21 to drive unaccounted for posting by the printing mechanism 21. If the electrical signals are probed, the data cannot easily be reconstructed into an indicia image by virtue of the encryption. The print head mechanism 21 consists of a custom integrated circuit ASIC, more particularly described subsequently, located in proximity to the printing elements to allow physical security, such as by epoxy sealing, of the ASIC to the print head substrate utilizing any suitable known process.
Referring to Fig. 2, the meter control system 11 is secured within a secure housing 10. More specifically, the micro controller 13 electrically communicates with an address bus A11, a data bus D11, a read control line RD, a write control line WR, a data request control line DR and a data acknowledge control line DA. The memory unit 15 is also in electrical communication with the buses A11 and D11, and control lines RD and WR. An address decoder module 30 electrically communicates with the address bus A11.
The output from the address decoder 30 is directed to a data controller 33, timing controller 35, encryption/decryption engine 37, encryption key manager 39 and shift register 41. The output of the address controller 30 operates in a conventional manner to enable and disable the data controller 33, timing controller 35, encryption engine 37, encryption key manager 39 and shift register 41 in response to a respective address generated by the micro controller 13.
The data controller 33 electrically communicates with the address bus and data bus A11 and D11, respectively, and also with the read and write control lines RD and WR, respectively. In addition, the data controller 33 electrically communicates with the data request DR and data acknowledge DA control lines.
The output from the data controller 33 is directed to an encryption/decryption engine 37 where the output data from the data controller 33 is encrypted using any one of severs! know encryption techniques, for example, the DES encryption algorithm.
The output from the encryption engine 37 is directed to the shift register 41. The timing controller 35 electrically communicates with the data controller 33, the encryption/decryption engine 37 and shift register 41 for providing synchronized timing signals to the data controller 33, the encryption/decryption engine 37 and shift register 41. The timing controller 35 receives an input clock signal from a state machine clock 43. In the most preferred configuration, an encryption key manager 39 is in electrical communication with the encryption/decryption engine 37 for the purpose of providing added system security in a manner subsequently described.
The printer mechanism 21 control ASIC includes a shift register 51, decryption/encryption engine 53 and a print head format converter 55. The output from the shift register 51 is directed to the input of the decryption/encryption engine 53. The output of the decryption/encryption engine 53 is directed to the print head format converter 55. The timing controller 56 electrically communicates with the shift register 51, the decryption/encryption engine 53, and the print head format converter 55 for providing synchronized timing signals to the data controller 33, the encryption/decryption engine 37 and shift register 41. The timing controller receives an input clock signal from a state machine clock 59. !n the most preferred configuration, an encryption key manager 61 is in electrical communication with the encryption/decryption engine 53 for the purpose of providing added system security and communicating with the encryption key manager 39 of the meter control system 11. The printer control ASIC
electronically communicates with the print elements 63. Also provided is a verification circuit 66 which receives data from the shift register 41 only during system power-up and outputs data to the decryption/encryption engine 53.
In operation, upon power-up of the system or at such other selected times, the verification circuit in response to a power-up print command (Print Cmmd) from the meter control system 11 outputs a random number message to the decryption/encryption engine 37 which encrypts the message in response to the power-up print command. The encrypted message is sent out to the meter. The encryption/decryption engine 37 of the vault decrypts the message in response to the print command. The micro controller then returns an encrypted new message to the print controller which includes the encoded representation of the relationship of the two messages. Upon receiving the new message from the vault, the print controller decrypts the new message and verifies the relationship in response to a new print command. The print controller is then enabled to print a postage indicia. The print controller is now enabled resulting in the engine 37 being set in an encryption mode and engine 53 being set in a decryption mode.
Upon initiation of a print cycle, the micro controller 13 generates the appropriate address and generates an active write signal. The less significant bits (LBS) of the generated address is directed to the address decoder 30 and the most significant bits (MBS) are directed to the data controller 33. In response, the address decoder 30 generates the enabling signals for the data controller 33, timing controller 35, encryption engine 37 and shift register 41. The data controller 33 then generates a data request which then is received by the micro controller 13. The micro controller 13 then generates a read enable signal which enables the micro controller 13 to read the image data from the memory unit 15 and place the appropriate data on the data bus D11. That data is read by the data controller 33 which reformats the 32-bit data messages into 64-bit data messages and passes the 64-bit data messages to the encryption engine 37. The encryption engine 37 then encrypts the data using any suitable encryption algorithm and the encryption key supplied by the encryption key manager 39. The encrypted data is then passed to the shift register 41 for serial communication of the encrypted data to the printer 21. The operation of the data controller 33, encryption engine 37 and shift register 41 is synchronized by the timing controller 35 which receives a clocking signal from the state machine clock 43.
Over a communication bus C11, the encrypted serial data output from the shift register 41 is directed to the shift register 51 of the printer 21. Also carried over the bus C11 are the appropriate clock signals for clocking the data into the shift register 51 and a print command (Print Cmmd). When the whole of the encrypted information has been transmitted, a clear signal is generated over the bus C11. The shift registers 51 of the printer 21 reformat the encrypted data back into fi4-bit parallel form and transfers the 64-bit data messages to the decryption engine 53 which decrypts the data using the same key used to encrypt the data which is provided by the encryption key manager 61. The decrypted data is then received by the print format converter 55 for delivery to the print head driver which enables the appropriate printing elements. It should now be appreciated that the process described is particularly suitable for any form of digital printer, such as, ink jet or thermal. Once the printing process has been completed a ready signal is sent to the meter over the bus C11.
The function of the encryption key manager in both printer controller and print head controller is to periodically change the encryption key used to send print data to the print head. The actual keys are not sent over the intertace, rather, a token representing a specific key is passed. This token may be the product of an algorithm which represents any desired compilation of the data passed between the meter and the printer over some predetermined period. The token is then sent to the encryption key manager 39 which generates an identical key based on the token. For example, the key can be updated every time the printer controller clears the print head decoder, after a particular number of print cycles, or after a particular number of state machine clock cycles. By increasing the number of encryption keys, the probability that the system will be compromised diminishes. Preferably, the selection of the encryption key is a function of the print head decoder. This is done because if one key is discovered, the print head decoder could still be made to print by instructing the decoder to use only the known (compromised) key. The print head decoder can be made to randomly select a key and force the printer controller to comply.
Once the data is decrypted, it is vunerable to monitoring or tampering. By sealing the decoder to the print head and using any suitable known tamper protection techniques, the data can be protected. Such techniques include incorporating the decoder on the same silicon substrate as the printing elements control, utilizing chip-on-board and encapsulation techniques to make the signals inaccessible, constructing a hybrid circuit in which the decoder and printing elements controls are in the same package, utilizing the inner routing layers of a multi-
ACCOUNTING VAULT TO DIGITAL PRINTER
Background of the Invention The present invention relates to a postage metering system using digital printing and, more particularly, to a postage metering system wherein the postage accounting system is remotely located from the postage printer.
A conventional postage meter is comprised of a secure account system, also known as a vault, and an impact printing mechanism housed in a secure housing having tamper detection. The vault is physically secured and operationally interlocked to the printing mechanism. For example, it is now known to use postage meters employing digital printing techniques. In such systems, the vault and digital printer remain secure within the secure housing and printing can only occur after postage has been accounted for.
It is also know to employ a postage meter in combination with an inserting system for the processing of a mail stream. It has been determined that it would be beneficial to configure a postage metering system which employs an inserter and digital printer in combination with a remotely located vault. However, it has also been determined, as a security step to be beneficial to provide a means to assure that an authorized vault is driving the digital printers in order to insure proper postal accounting between the system user and postal services. Further, such systems may be equipped with remote funds resetting capability; therefore, it is necessary that the accounting records of the user, postal service and operator of the remote funds reset center be reconcilable with regard to an identifiable combination of vault and digital printing systems.
Summary of the Invention It is an object of the present invention to present a method of preventing the operation of a digital printer to print a postage indicia unless the digital printer is in electronic communication with a specific vault system.
A new metering system includes a meter in bus communication with a digital printer for enabling the meter to be located remote from the digital printer.
The meter includes a vault which is comprised of a micro controller in bus communication with an application specific integrated circuit (ASIC) and a plurality of memory units secured in a tamper resistant housing. The ASIC
_2_ includes a plurality of control modules, some of which are an accounting memory security module, a printer controller module and an encryption module. The digital printer includes a decoder/encoder ASIC sealed to the print head of the digital printer. The decoder/encoder ASIC communicates to the printer controller module via a printer bus. Communication between the printer controller and the print head decoder/encoder ASIC interface is accomplished through a printer bus which communications are encrypted by any suitable known technique, for example, using a data encryption standard (DES) algorithm. By encrypting the output of the printer controller module along the printer bus any unauthorized probing of the output of the printer controller to acquire and store the signals used to produce a valid postage print are prevented. If the electrical signals are probed, the data cannot easily be reconstructed into an indicia image by virtue of the encryption. The print head decoder consists of a custom integrated circuit located in proximity to the printing elements. It receives the output from the printer controller, decrypts the data, and reformats the data as necessary for application to the printing elements.
The printer controller and print head controller contain encryption key manager functional units. The encryption key manager is used to periodically change the encryption key used to send print data to the print head. The actual keys are not sent over the interface, rather, a token representing a specific key is passed.
The key can be updated every time the printer controller clears the print head decoder, after a particular number of print cycles, or after a particular number of state machine clock cycles. By increasing the number of encryption keys, the probability that the system will be compromised diminishes.
In order to assure full and accurate accounting for the particular digital printer, upon power-up of the system or at such other preselected condition, the print controller module of the digital printer sends out an encrypted message to the meter.
This message consists of an encrypted random number. The encryptionldecryption engine of the postage meter decrypts the message. The meter then returns an encrypted new message to the print controller which includes an encoded representation of the relationship of the two messages. Upon receiving the new message from the vault, the print controller decrypts the new message and verifies the relationship. The print controller is then enabled to print a postage indicia.
Brief Description of the Drawings Fig. 1 is a diagrammatic representation of a postage meter in combination with a remote printing mechanism in accordance with the present invention.
Fig. 2 is a diagrammatic representation of the postage meter micro control and printer micro control systems in accordance with the present invention.
Detailed Description Of The Preferred Embodiment Referring to Fig. 1, the postage meter control system 11 is comprised of a micro controller 13 in bus communication with a memory unit 15 and ASIC 17.
The printing mechanism 21 is generally comprised of a print controller 23 which controls the operation of a plurality of print elements 27. Data is communicated between the meter control system 11 and the print mechanism over a bus C11. Generally, print data is first encrypted by an encryption module 18 and presented to the printer controller 23 through a printer controller module 19 of the ASIC 17. The data received by the print controller 23 is decrypted by a decryption module 25 in the print mechanism 21 after which the print controller 23 drives the print elements 27 in accordance with the received data. The data exchanged between the two devices is subject to interception and possible tampering since the electrical interconnects are not physically secured. Utilizing encryption to electrically secure the interface between the printing controller and print head reduces the ability of an external intrusion of data to the print mechanism 21 to drive unaccounted for posting by the printing mechanism 21. If the electrical signals are probed, the data cannot easily be reconstructed into an indicia image by virtue of the encryption. The print head mechanism 21 consists of a custom integrated circuit ASIC, more particularly described subsequently, located in proximity to the printing elements to allow physical security, such as by epoxy sealing, of the ASIC to the print head substrate utilizing any suitable known process.
Referring to Fig. 2, the meter control system 11 is secured within a secure housing 10. More specifically, the micro controller 13 electrically communicates with an address bus A11, a data bus D11, a read control line RD, a write control line WR, a data request control line DR and a data acknowledge control line DA. The memory unit 15 is also in electrical communication with the buses A11 and D11, and control lines RD and WR. An address decoder module 30 electrically communicates with the address bus A11.
The output from the address decoder 30 is directed to a data controller 33, timing controller 35, encryption/decryption engine 37, encryption key manager 39 and shift register 41. The output of the address controller 30 operates in a conventional manner to enable and disable the data controller 33, timing controller 35, encryption engine 37, encryption key manager 39 and shift register 41 in response to a respective address generated by the micro controller 13.
The data controller 33 electrically communicates with the address bus and data bus A11 and D11, respectively, and also with the read and write control lines RD and WR, respectively. In addition, the data controller 33 electrically communicates with the data request DR and data acknowledge DA control lines.
The output from the data controller 33 is directed to an encryption/decryption engine 37 where the output data from the data controller 33 is encrypted using any one of severs! know encryption techniques, for example, the DES encryption algorithm.
The output from the encryption engine 37 is directed to the shift register 41. The timing controller 35 electrically communicates with the data controller 33, the encryption/decryption engine 37 and shift register 41 for providing synchronized timing signals to the data controller 33, the encryption/decryption engine 37 and shift register 41. The timing controller 35 receives an input clock signal from a state machine clock 43. In the most preferred configuration, an encryption key manager 39 is in electrical communication with the encryption/decryption engine 37 for the purpose of providing added system security in a manner subsequently described.
The printer mechanism 21 control ASIC includes a shift register 51, decryption/encryption engine 53 and a print head format converter 55. The output from the shift register 51 is directed to the input of the decryption/encryption engine 53. The output of the decryption/encryption engine 53 is directed to the print head format converter 55. The timing controller 56 electrically communicates with the shift register 51, the decryption/encryption engine 53, and the print head format converter 55 for providing synchronized timing signals to the data controller 33, the encryption/decryption engine 37 and shift register 41. The timing controller receives an input clock signal from a state machine clock 59. !n the most preferred configuration, an encryption key manager 61 is in electrical communication with the encryption/decryption engine 53 for the purpose of providing added system security and communicating with the encryption key manager 39 of the meter control system 11. The printer control ASIC
electronically communicates with the print elements 63. Also provided is a verification circuit 66 which receives data from the shift register 41 only during system power-up and outputs data to the decryption/encryption engine 53.
In operation, upon power-up of the system or at such other selected times, the verification circuit in response to a power-up print command (Print Cmmd) from the meter control system 11 outputs a random number message to the decryption/encryption engine 37 which encrypts the message in response to the power-up print command. The encrypted message is sent out to the meter. The encryption/decryption engine 37 of the vault decrypts the message in response to the print command. The micro controller then returns an encrypted new message to the print controller which includes the encoded representation of the relationship of the two messages. Upon receiving the new message from the vault, the print controller decrypts the new message and verifies the relationship in response to a new print command. The print controller is then enabled to print a postage indicia. The print controller is now enabled resulting in the engine 37 being set in an encryption mode and engine 53 being set in a decryption mode.
Upon initiation of a print cycle, the micro controller 13 generates the appropriate address and generates an active write signal. The less significant bits (LBS) of the generated address is directed to the address decoder 30 and the most significant bits (MBS) are directed to the data controller 33. In response, the address decoder 30 generates the enabling signals for the data controller 33, timing controller 35, encryption engine 37 and shift register 41. The data controller 33 then generates a data request which then is received by the micro controller 13. The micro controller 13 then generates a read enable signal which enables the micro controller 13 to read the image data from the memory unit 15 and place the appropriate data on the data bus D11. That data is read by the data controller 33 which reformats the 32-bit data messages into 64-bit data messages and passes the 64-bit data messages to the encryption engine 37. The encryption engine 37 then encrypts the data using any suitable encryption algorithm and the encryption key supplied by the encryption key manager 39. The encrypted data is then passed to the shift register 41 for serial communication of the encrypted data to the printer 21. The operation of the data controller 33, encryption engine 37 and shift register 41 is synchronized by the timing controller 35 which receives a clocking signal from the state machine clock 43.
Over a communication bus C11, the encrypted serial data output from the shift register 41 is directed to the shift register 51 of the printer 21. Also carried over the bus C11 are the appropriate clock signals for clocking the data into the shift register 51 and a print command (Print Cmmd). When the whole of the encrypted information has been transmitted, a clear signal is generated over the bus C11. The shift registers 51 of the printer 21 reformat the encrypted data back into fi4-bit parallel form and transfers the 64-bit data messages to the decryption engine 53 which decrypts the data using the same key used to encrypt the data which is provided by the encryption key manager 61. The decrypted data is then received by the print format converter 55 for delivery to the print head driver which enables the appropriate printing elements. It should now be appreciated that the process described is particularly suitable for any form of digital printer, such as, ink jet or thermal. Once the printing process has been completed a ready signal is sent to the meter over the bus C11.
The function of the encryption key manager in both printer controller and print head controller is to periodically change the encryption key used to send print data to the print head. The actual keys are not sent over the intertace, rather, a token representing a specific key is passed. This token may be the product of an algorithm which represents any desired compilation of the data passed between the meter and the printer over some predetermined period. The token is then sent to the encryption key manager 39 which generates an identical key based on the token. For example, the key can be updated every time the printer controller clears the print head decoder, after a particular number of print cycles, or after a particular number of state machine clock cycles. By increasing the number of encryption keys, the probability that the system will be compromised diminishes. Preferably, the selection of the encryption key is a function of the print head decoder. This is done because if one key is discovered, the print head decoder could still be made to print by instructing the decoder to use only the known (compromised) key. The print head decoder can be made to randomly select a key and force the printer controller to comply.
Once the data is decrypted, it is vunerable to monitoring or tampering. By sealing the decoder to the print head and using any suitable known tamper protection techniques, the data can be protected. Such techniques include incorporating the decoder on the same silicon substrate as the printing elements control, utilizing chip-on-board and encapsulation techniques to make the signals inaccessible, constructing a hybrid circuit in which the decoder and printing elements controls are in the same package, utilizing the inner routing layers of a multi-
Claims (5)
1. A method for verifying a specific operable combination of postage metering controller to a remotely located digital printer over a communication link between the meter controller and the digital printer comprising the steps of:
providing a meter with means for encrypting/decrypting data utilizing a encryption key;
providing said digital printer with means for encrypting/decrypting postage data utilizing said encryption key;
generating a random number and encrypting said random number at said digital printer;
transmitting said encrypted random number to said meter;
decrypting of said random number and re-encrypting said random number in such a way to have a known relationship to said original random number;
transmitting said re-encrypted random number and known relationship to said digital printer;
decrypting said re-encrypted random number and known relationship and verifying said relationship; and enabling said digital printer upon verification.
providing a meter with means for encrypting/decrypting data utilizing a encryption key;
providing said digital printer with means for encrypting/decrypting postage data utilizing said encryption key;
generating a random number and encrypting said random number at said digital printer;
transmitting said encrypted random number to said meter;
decrypting of said random number and re-encrypting said random number in such a way to have a known relationship to said original random number;
transmitting said re-encrypted random number and known relationship to said digital printer;
decrypting said re-encrypted random number and known relationship and verifying said relationship; and enabling said digital printer upon verification.
2. A method for verifying a specific operable combination of postage metering controller to a remotely located digital printer over a communication link between the meter controller and the digital printer as claim in claim 1, further comprising the steps of:
providing a postage metering vault with an encryption key manager for generating an encryption key pursuant to a token;
providing said digital printer with means of generating said token;
communicating said token to said postage meter vault; and generating a encryption key by said encryption key manager in said postage meter vault pursuant to said token such that said encryption key of both of said encryption key managers are identical.
providing a postage metering vault with an encryption key manager for generating an encryption key pursuant to a token;
providing said digital printer with means of generating said token;
communicating said token to said postage meter vault; and generating a encryption key by said encryption key manager in said postage meter vault pursuant to said token such that said encryption key of both of said encryption key managers are identical.
3. A postage metering system having a postage meter remote from a digital printer used to print postage indicia, comprising:
said postage meter having a micro controller and encryption-decryption means for encrypting and decrypting data pursuant to a encryption key in response to command signals from said micro controller;
said digital printer having decrypting-encryption means for encrypting and decrypting data pursuant to a encryption key in response to command signals from said micro controller;
communication means for communicating data between said postage meter and said digital printer;
said digital printer having means for generating a random number and causing said random number to be encrypted and causing said communication means to communicate said random number to said encryption-decryption means of said meter, said micro controller having means for causing said encryption-decryption means to decrypt said random number and encode said random number in a desired relationship to said random number and causing said encryption-decryption means to encrypt said encoded random number and numeric relationship and cause said communication means to communicate encoded random number and said relationship to said decryption-encryption means; and said printer decryption-encryption means having verification means for verifying said decrypted encoded random number and said relationship and enable said digital printer if verification is successful.
said postage meter having a micro controller and encryption-decryption means for encrypting and decrypting data pursuant to a encryption key in response to command signals from said micro controller;
said digital printer having decrypting-encryption means for encrypting and decrypting data pursuant to a encryption key in response to command signals from said micro controller;
communication means for communicating data between said postage meter and said digital printer;
said digital printer having means for generating a random number and causing said random number to be encrypted and causing said communication means to communicate said random number to said encryption-decryption means of said meter, said micro controller having means for causing said encryption-decryption means to decrypt said random number and encode said random number in a desired relationship to said random number and causing said encryption-decryption means to encrypt said encoded random number and numeric relationship and cause said communication means to communicate encoded random number and said relationship to said decryption-encryption means; and said printer decryption-encryption means having verification means for verifying said decrypted encoded random number and said relationship and enable said digital printer if verification is successful.
4. A postage metering system having a postage meter remote from a digital printer used to print postage indicia as claimed in claim 3, further comprising:
said postage meter having a encryption key manager means for generating an encryption key in response to a token;
said digital printer having a encryption key manager means for generating a new encryption key, when desired, as a function of said decrypted data, and generating said token as a function of said decrypted data; and communication means for electronically communicating said token to said postage meter encryption key manager.
said postage meter having a encryption key manager means for generating an encryption key in response to a token;
said digital printer having a encryption key manager means for generating a new encryption key, when desired, as a function of said decrypted data, and generating said token as a function of said decrypted data; and communication means for electronically communicating said token to said postage meter encryption key manager.
5. A postage metering system having a postage meter remote from a digital printer used to print postage indicia as claimed in claim 3, further comprising:
said postage meter having a encryption key manager means for generating an encryption key in response to a token;
said digital printer having a encryption key manager means for generating a new encryption key, when desired, as a function of a randomly generated token;
and communication means for electronically communicating said token to said postage meter encryption key manager.
said postage meter having a encryption key manager means for generating an encryption key in response to a token;
said digital printer having a encryption key manager means for generating a new encryption key, when desired, as a function of a randomly generated token;
and communication means for electronically communicating said token to said postage meter encryption key manager.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US08/361,409 US5606613A (en) | 1994-12-22 | 1994-12-22 | Method for identifying a metering accounting vault to digital printer |
| US08/361,409 | 1994-12-22 |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2165102A1 CA2165102A1 (en) | 1996-06-23 |
| CA2165102C true CA2165102C (en) | 2002-12-10 |
Family
ID=23421927
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002165102A Expired - Fee Related CA2165102C (en) | 1994-12-22 | 1995-12-13 | Method for identifying a metering accounting vault to digital printer |
Country Status (5)
| Country | Link |
|---|---|
| US (1) | US5606613A (en) |
| EP (1) | EP0718803A3 (en) |
| JP (1) | JPH08273011A (en) |
| CN (1) | CN1097902C (en) |
| CA (1) | CA2165102C (en) |
Families Citing this family (73)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5812991A (en) * | 1994-01-03 | 1998-09-22 | E-Stamp Corporation | System and method for retrieving postage credit contained within a portable memory over a computer network |
| US7036019B1 (en) * | 1994-04-01 | 2006-04-25 | Intarsia Software Llc | Method for controlling database copyrights |
| US6744894B1 (en) * | 1994-04-01 | 2004-06-01 | Mitsubishi Corporation | Data management system |
| JPH07271865A (en) * | 1994-04-01 | 1995-10-20 | Mitsubishi Corp | Method for managing copyright of data base |
| US7302415B1 (en) * | 1994-09-30 | 2007-11-27 | Intarsia Llc | Data copyright management system |
| DE69532434T2 (en) * | 1994-10-27 | 2004-11-11 | Mitsubishi Corp. | Device for file copyright management system |
| US6424715B1 (en) | 1994-10-27 | 2002-07-23 | Mitsubishi Corporation | Digital content management system and apparatus |
| EP1691315A1 (en) | 1994-10-27 | 2006-08-16 | Intarsia Software LLC | Data copyright management system |
| US8595502B2 (en) * | 1995-09-29 | 2013-11-26 | Intarsia Software Llc | Data management system |
| US7801817B2 (en) * | 1995-10-27 | 2010-09-21 | Makoto Saito | Digital content management system and apparatus |
| US6151590A (en) * | 1995-12-19 | 2000-11-21 | Pitney Bowes Inc. | Network open metering system |
| US6157919A (en) * | 1995-12-19 | 2000-12-05 | Pitney Bowes Inc. | PC-based open metering system and method |
| US5799290A (en) * | 1995-12-27 | 1998-08-25 | Pitney Bowes Inc. | Method and apparatus for securely authorizing performance of a function in a distributed system such as a postage meter |
| US5923762A (en) * | 1995-12-27 | 1999-07-13 | Pitney Bowes Inc. | Method and apparatus for ensuring debiting in a postage meter prior to its printing a postal indicia |
| WO1998008325A1 (en) * | 1996-08-20 | 1998-02-26 | Ascom Hasler Mailing Systems Inc. | Printing postage with cryptographic clocking security |
| US5745887A (en) * | 1996-08-23 | 1998-04-28 | Pitney Bowes Inc. | Method and apparatus for remotely changing security features of a postage meter |
| US6889214B1 (en) * | 1996-10-02 | 2005-05-03 | Stamps.Com Inc. | Virtual security device |
| US5822739A (en) * | 1996-10-02 | 1998-10-13 | E-Stamp Corporation | System and method for remote postage metering |
| US6260144B1 (en) * | 1996-11-21 | 2001-07-10 | Pitney Bowes Inc. | Method for verifying the expected postal security device in a postage metering system |
| US6397328B1 (en) * | 1996-11-21 | 2002-05-28 | Pitney Bowes Inc. | Method for verifying the expected postage security device and an authorized host system |
| US5826246A (en) * | 1996-12-31 | 1998-10-20 | Pitney Bowes Inc. | Secure postage meter in an ATM application |
| US6005945A (en) * | 1997-03-20 | 1999-12-21 | Psi Systems, Inc. | System and method for dispensing postage based on telephonic or web milli-transactions |
| GB9709050D0 (en) * | 1997-05-02 | 1997-06-25 | Neopost Ltd | Postage meter with removable print head |
| US6064989A (en) * | 1997-05-29 | 2000-05-16 | Pitney Bowes Inc. | Synchronization of cryptographic keys between two modules of a distributed system |
| US6029137A (en) * | 1997-05-29 | 2000-02-22 | Pitney Bowes Inc. | Updating domains in a postage evidencing system |
| US6073125A (en) * | 1997-06-26 | 2000-06-06 | Pitney Bowes Inc. | Token key distribution system controlled acceptance mail payment and evidencing system |
| JPH11205738A (en) | 1998-01-09 | 1999-07-30 | Canon Inc | Image input device, its method and storage medium |
| GB9801744D0 (en) * | 1998-01-28 | 1998-03-25 | Neopost Ltd | Postage meter with digital print head |
| US6233565B1 (en) | 1998-02-13 | 2001-05-15 | Saranac Software, Inc. | Methods and apparatus for internet based financial transactions with evidence of payment |
| US6144950A (en) * | 1998-02-27 | 2000-11-07 | Pitney Bowes Inc. | Postage printing system including prevention of tampering with print data sent from a postage meter to a printer |
| JP4763866B2 (en) | 1998-10-15 | 2011-08-31 | インターシア ソフトウェア エルエルシー | Method and apparatus for protecting digital data by double re-encryption |
| US6938023B1 (en) * | 1998-12-24 | 2005-08-30 | Pitney Bowes Inc. | Method of limiting key usage in a postage metering system that produces cryptographically secured indicium |
| US6795813B2 (en) | 1998-12-30 | 2004-09-21 | Pitney Bowes Inc. | System and method for linking an indicium with address information of a mailpiece in a closed system postage meter |
| US7003667B1 (en) | 1999-10-04 | 2006-02-21 | Canon Kabushiki Kaisha | Targeted secure printing |
| US6862583B1 (en) * | 1999-10-04 | 2005-03-01 | Canon Kabushiki Kaisha | Authenticated secure printing |
| EP1240624A4 (en) * | 1999-11-12 | 2004-04-28 | Ascom Hasler Mailing Sys Inc | Proof of postage digital franking |
| US20010037462A1 (en) * | 2000-05-01 | 2001-11-01 | Bengtson Michael B. | Method and apparatus for obtaining a printed copy of a document via the internet |
| US6820064B1 (en) | 2000-08-31 | 2004-11-16 | Hewlett-Packard Development Company, L.P. | E-commerce consumables |
| DE10051818A1 (en) * | 2000-10-18 | 2002-06-20 | Deutsche Post Ag | Procedure for checking franking marks applied to mail items |
| US6876986B1 (en) | 2000-10-30 | 2005-04-05 | Hewlett-Packard Development Company, L.P. | Transaction payment system |
| US7454796B2 (en) * | 2000-12-22 | 2008-11-18 | Canon Kabushiki Kaisha | Obtaining temporary exclusive control of a printing device |
| US7260820B1 (en) | 2001-04-26 | 2007-08-21 | Vm Ware, Inc. | Undefeatable transformation for virtual machine I/O operations |
| US7428636B1 (en) * | 2001-04-26 | 2008-09-23 | Vmware, Inc. | Selective encryption system and method for I/O operations |
| DE10131254A1 (en) * | 2001-07-01 | 2003-01-23 | Deutsche Post Ag | Procedure for checking the validity of digital postage indicia |
| US7113299B2 (en) * | 2001-07-12 | 2006-09-26 | Canon Development Americas, Inc. | Printing with credit card as identification |
| US20030040571A1 (en) * | 2001-07-30 | 2003-02-27 | Feng Qian Jane | Clear silicone microemulsions formed spontaneously |
| US7284061B2 (en) * | 2001-11-13 | 2007-10-16 | Canon Kabushiki Kaisha | Obtaining temporary exclusive control of a device |
| US7831518B2 (en) * | 2001-11-20 | 2010-11-09 | Psi Systems, Inc. | Systems and methods for detecting postage fraud using an indexed lookup procedure |
| US8463716B2 (en) * | 2001-11-20 | 2013-06-11 | Psi Systems, Inc. | Auditable and secure systems and methods for issuing refunds for misprints of mail pieces |
| US20030101143A1 (en) * | 2001-11-20 | 2003-05-29 | Psi Systems, Inc. | Systems and methods for detecting postage fraud using a unique mail piece indicium |
| US7315824B2 (en) * | 2001-12-04 | 2008-01-01 | Canon Development Americas, Inc. | Internet printing by hotel guests |
| US20040170274A1 (en) * | 2003-02-28 | 2004-09-02 | Kabushiki Kaisha Toshiba | Image forming apparatus and method for inputting encryption key setting |
| US7319989B2 (en) * | 2003-03-04 | 2008-01-15 | Pitney Bowes Inc. | Method and system for protection against replay of an indicium message in a closed system meter |
| US20040177049A1 (en) * | 2003-03-04 | 2004-09-09 | Pitney Bowes Incorporated | Method and system for protection against parallel printing of an indicium message in a closed system meter |
| EP1463003A1 (en) | 2003-03-25 | 2004-09-29 | Secap | Secured franking machine |
| US20040260655A1 (en) * | 2003-05-13 | 2004-12-23 | Mark Ferraro | Secure postal metering device |
| DE10332850A1 (en) * | 2003-07-18 | 2005-02-17 | OCé PRINTING SYSTEMS GMBH | Method and device for printing sensitive data |
| US11037151B1 (en) | 2003-08-19 | 2021-06-15 | Stamps.Com Inc. | System and method for dynamically partitioning a postage evidencing system |
| US20050152543A1 (en) * | 2003-11-04 | 2005-07-14 | Toshihiro Shima | Printer and print system |
| FR2865830B1 (en) * | 2004-01-30 | 2006-05-19 | Neopost Ind | SECURED EXTERNAL PRINT MODE MAIL POSTAGE SYSTEM |
| US8775331B1 (en) | 2006-12-27 | 2014-07-08 | Stamps.Com Inc | Postage metering with accumulated postage |
| US8612361B1 (en) | 2006-12-27 | 2013-12-17 | Stamps.Com Inc. | System and method for handling payment errors with respect to delivery services |
| US10373398B1 (en) | 2008-02-13 | 2019-08-06 | Stamps.Com Inc. | Systems and methods for distributed activation of postage |
| US9978185B1 (en) | 2008-04-15 | 2018-05-22 | Stamps.Com Inc. | Systems and methods for activation of postage indicia at point of sale |
| US9911246B1 (en) | 2008-12-24 | 2018-03-06 | Stamps.Com Inc. | Systems and methods utilizing gravity feed for postage metering |
| US9842308B1 (en) | 2010-02-25 | 2017-12-12 | Stamps.Com Inc. | Systems and methods for rules based shipping |
| US10089797B1 (en) | 2010-02-25 | 2018-10-02 | Stamps.Com Inc. | Systems and methods for providing localized functionality in browser based postage transactions |
| US10713634B1 (en) | 2011-05-18 | 2020-07-14 | Stamps.Com Inc. | Systems and methods using mobile communication handsets for providing postage |
| US10846650B1 (en) | 2011-11-01 | 2020-11-24 | Stamps.Com Inc. | Perpetual value bearing shipping labels |
| US10922641B1 (en) | 2012-01-24 | 2021-02-16 | Stamps.Com Inc. | Systems and methods providing known shipper information for shipping indicia |
| US9721225B1 (en) | 2013-10-16 | 2017-08-01 | Stamps.Com Inc. | Systems and methods facilitating shipping services rate resale |
| US10417728B1 (en) | 2014-04-17 | 2019-09-17 | Stamps.Com Inc. | Single secure environment session generating multiple indicia |
| US10521754B2 (en) | 2016-03-08 | 2019-12-31 | Auctane, LLC | Concatenated shipping documentation processing spawning intelligent generation subprocesses |
Family Cites Families (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US4253158A (en) * | 1979-03-28 | 1981-02-24 | Pitney Bowes Inc. | System for securing postage printing transactions |
| US4605820A (en) * | 1983-11-10 | 1986-08-12 | Visa U.S.A. Inc. | Key management system for on-line communication |
| DE3782780T2 (en) * | 1986-08-22 | 1993-06-09 | Nec Corp | KEY DISTRIBUTION PROCEDURE. |
| US4864618A (en) * | 1986-11-26 | 1989-09-05 | Wright Technologies, L.P. | Automated transaction system with modular printhead having print authentication feature |
| US4853962A (en) * | 1987-12-07 | 1989-08-01 | Universal Computer Consulting, Inc. | Encryption system |
| US4935961A (en) * | 1988-07-27 | 1990-06-19 | Gargiulo Joseph L | Method and apparatus for the generation and synchronization of cryptographic keys |
| GB8908391D0 (en) * | 1989-04-13 | 1989-06-01 | Alcatel Business Systems | Detachable meter module |
| DE4034292A1 (en) * | 1990-10-25 | 1992-04-30 | Francotyp Postalia Gmbh | METHOD FOR MAILING POSTAGE AND ARRANGEMENT FOR CARRYING IT OUT |
| GB9114694D0 (en) * | 1991-07-08 | 1991-08-28 | Alcatel Business Machines Limi | Franking machine with digital printer |
| US5201000A (en) * | 1991-09-27 | 1993-04-06 | International Business Machines Corporation | Method for generating public and private key pairs without using a passphrase |
| FR2699300B1 (en) * | 1992-12-15 | 1995-03-10 | Mireille Campana | Method of authenticating a computer assembly by another computer assembly. |
| US5390251A (en) * | 1993-10-08 | 1995-02-14 | Pitney Bowes Inc. | Mail processing system including data center verification for mailpieces |
| US5455862A (en) * | 1993-12-02 | 1995-10-03 | Crest Industries, Inc. | Apparatus and method for encrypting communications without exchanging an encryption key |
-
1994
- 1994-12-22 US US08/361,409 patent/US5606613A/en not_active Expired - Fee Related
-
1995
- 1995-12-13 CA CA002165102A patent/CA2165102C/en not_active Expired - Fee Related
- 1995-12-21 JP JP7333683A patent/JPH08273011A/en active Pending
- 1995-12-22 EP EP95120424A patent/EP0718803A3/en not_active Ceased
- 1995-12-22 CN CN95121346A patent/CN1097902C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| EP0718803A3 (en) | 1999-10-27 |
| EP0718803A2 (en) | 1996-06-26 |
| CA2165102A1 (en) | 1996-06-23 |
| JPH08273011A (en) | 1996-10-18 |
| US5606613A (en) | 1997-02-25 |
| CN1131851A (en) | 1996-09-25 |
| CN1097902C (en) | 2003-01-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2165102C (en) | Method for identifying a metering accounting vault to digital printer | |
| CA2165103C (en) | Method for preventing monitoring of data remotely sent from a metering accounting vault to digital printer | |
| CA1259704A (en) | System for detecting unaccounted for printing in a value printing system | |
| US5696829A (en) | Digital postage meter system | |
| US4831555A (en) | Unsecured postage applying system | |
| US4813912A (en) | Secured printer for a value printing system | |
| ES2335328T3 (en) | SYNCHRONIZATION OF CRYPTOGRAPHIC KEYS BETWEEN TWO MODULES OF A DISTRIBUTED SYSTEM. | |
| CA2263071C (en) | Postage printing system including prevention of tampering with print data sent from a postage meter to a printer | |
| JPH0695352B2 (en) | Data center for remote variable recharge | |
| EP0522809B2 (en) | Franking machine with digital printer | |
| CA2238589C (en) | Updating domains in a postage evidencing system | |
| CA2677458C (en) | Method and system for securing communications in a metering device | |
| US7039185B2 (en) | Method and system for securing a printhead in a closed system metering device | |
| GB2173741A (en) | Unsecured postage applying system | |
| US5684949A (en) | Method and system for securing operation of a printing module | |
| EP0811955A2 (en) | Secure apparatus and method for printing value with a value printer | |
| CN1094619C (en) | Method for preventing monitoring of data remotely sent from metering accounting vault to digital printer |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| MKLA | Lapsed |