EP0390731A2 - Method for recharging the funding register of a postage meter and postage meter for carrying out the method - Google Patents

Abstract

For recharging the funding register (20) of a franking machine, a return code is released from the read-only memory (21) of the latter, which must be notified, along with the amount to be recharged, to an authorising control centre in order to obtain from this control centre an input code enabling the funding register to be recharged with this amount. Numerous information pairs consisting of an input code and a return code are stored in tabular form in the control centre and in the read-only memory (21) of the franking machine. These codes consist of real random numbers. Once the input code has been entered in the franking machine, a search is performed in the read-only memory (21) of the franking machine, on the basis of a program of a central electronic control unit of the franking machine, to identify the position in the table in which an identical real random number occurs. Once this identity has been established, the funding register (20) is recharged by a prespecified amount according to the table and the new return code is issued which is required for future recharging and is allocated to the last input code according to the table. <IMAGE>

Description

The invention relates to a method for filling the value memory of a franking machine, the functional sequence of which is controlled by a central electronic control unit, with a coded information exchange between an authoritative, remote central office and the user of the franking machine, with the control unit of the franking machine making a suitable assignment between the exchanged Information is checked as well as a franking machine for carrying out this method, with an electronic control unit having a computer and memory, which is connected to a number of input keys and a display field, one of the memories being a preset value memory for amounts of value to be used by franking.

According to known methods of this type, for example in accordance with US-A-4,097,923, the required pair-forming information is calculated according to a rule that is uniformly prescribed for all franking machines, ie according to an algorithm, both in the central office and in the franking machine, and according to the Exchange of information with the head office compared with regard to the possible pair formation in the franking machine. This results in a pair of information that is valid for filling up the value memory when the comparator of the franking machine has determined that both individual pieces of information of the pair have been calculated according to the same rule. This rule thus forms an access key for the purchase of new ones in the Frankierma seemingly consumable quantities.

These known methods have the disadvantage of limited security against unauthorized replenishment of default values, because the key to the security system valid for all franking machines, i.e. the algorithm on which this is based can be determined relatively easily by trial and error with the help of conventional computers. The random number generators, which are sometimes used in known methods, also contain a calculation rule and therefore do not supply any real random numbers, so that they likewise only provide limited security.

The invention has for its object to find a method of the type mentioned, which ensures significantly improved security against unauthorized filling of the value storage without increased equipment.

This object is achieved according to the invention in that the creation of the coded information and its mutual assignment to provide information pairs is carried out in the form of real random numbers and randomly and the information and assignments that are valid only for the franking machine in question both at the central office and in a memory of the postage meter machine is stored, the filling of the default memory of the postage meter machine taking place after it has been determined on the basis of a program of the control unit that the information received from the control center and entered into the postage meter machine as an input code for filling up the default value memory is stored in an identical wording in the Postage meter machine already exists and a pair of information consists of this input code and a return code to be communicated for further refilling of the control center.

As a result of this method, both the individual information and its pairing assignment are completely random, that is to say, according to true random characteristics for each franking machine are dependent and are only legible at the head office, there is a very high level of security against misuse.

Security can be further increased in that the pairs of information are provided in table form in the memory of the franking machine and correspondingly in the central office and can only be called up in the order of the table-like arrangement for filling up the default value memory.

There can be several control centers, e.g. are located at the postal directorate of a specific postal district and are each responsible for the franking machines available in this postal district. The technical effort can e.g. At individual smaller post offices, it can be reduced that the pairs of information, or their tables, are only stored in the headquarters in the form of signed, signed sheets, instead of storing them electronically in a computer system.

• Fig.1 ein Schaltpult einer Frankiermaschine,
• Fig.1A das Hauptanzeigefeld zu dem Schaltpult nach Fig.1 mit dem Ziffernfeld für die Informationseingabe,
• Fig.1B das Hauptanzeigefeld der Fig.1B, mit sieben Ziffern einer achtziffrigen Eingabeeinformation,
• Fig.2 einen Teil eines vereinfachten Blockschemas der zentra­len elektronischen Steuereinheit der Frankiermaschine,
• Fig.3A den oberen Teil eines Flussdiagrammes des Programmab­laufs für die Auffüllung des Wertvorgabespeichers,
• Fig.3B den unteren Teil zu dem Flussdiagramm nach Fig.3A,
• Fig.4 ein Blockschema der verketteten Datenfelder (Pointer) eines nichtflüchtigen RAM-Registers sowie der die Informationspaare enthaltenden Codetabellen eines Festwertspeichers (ROM) und
• Fig.5 ein Abbildung von schriftlichen Codetabellen.

Further advantageous embodiments of the invention result from the following description with reference to the drawings. It shows:

• 1 shows a control panel of a franking machine,
• 1A the main display field for the control panel according to FIG. 1 with the numeric field for the information input,
• 1B shows the main display field of FIG. 1B, with seven digits of eight-digit input information,
• 2 shows a part of a simplified block diagram of the central electronic control unit of the franking machine,
• 3A shows the upper part of a flowchart of the program sequence for filling up the value memory,
• 3A shows the lower part of the flowchart according to FIG. 3A,
• 4 shows a block diagram of the linked data fields (pointer) of a non-volatile RAM register and of the code tables of a read-only memory (ROM) containing the information pairs
• 5 shows an illustration of written code tables.

The control desk 1 shown in FIG. 1 is provided, for example, on the housing of a postage meter machine, the details of which regarding its electronically controlled, electromechanical drive and the function of the control desk elements in CH-PS 669 056 (US Serial No. 256,070 and US-PS 4,520,725) as well as described in CH applications No. 853/89 and 854/89. As mentioned there, the input buttons 2-6 of the control panel 1, which are located below the display panel 7, can be used, depending on the selection of a corresponding program by means of the D-SET button 8, either for the input and for the electromechanical setting of predetermined franking values according to the assigned label 9 or for incrementally passing on individual decimal digits of a franking value. The introduction of a zero key 10 into the key receptacle 11 of the control panel 1 and the subsequent actuation of the D-SET key 8 gives these input keys 2-6 a further function in accordance with the program diagram of FIGS. 3A, B, by using keys on a numeric keypad for entering code digits. The five other keys of the numeric keypad result from the change in function of the function keys 13-17 arranged symmetrically to the input keys 2-6 above the display field 7. After this function switchover, the numerical values 0-9 assigned to the respective keys 2-6 and 13-17 are shown next to the corresponding keys on the display panel 7, as shown in FIGS. 1A and 1B.

The switchable first function of the "CRED LEFT" function key 13 is used to query the default value that is still available for franking. A red light-emitting diode 18 arranged above this labeled function key lights up when a value entered for franking exceeds the remaining default value. At this moment, the franking machine can no longer be used for franking until the preset value memory 20 (FIG. 2) is refilled.

The block diagram of the central control unit according to FIG. 2 shows the peripheral elements already mentioned as blocks "KEYBORD" 8.2-6, 13-17, "INDICATOR LAMPS" 18, "DISPLAYS" 7, "KEY" 10. The signals of the function keys 8, 2-6, 13-17 and the key 10 are converted into binary word signals by ENCODER 22 and fed to a BUSCONTROLLER and MULTIPLEXER 24. This periodically or spontaneously operates the peripheral elements mentioned, separates inputs and outputs and brings or reads the information in sequential form to or from the peripheral bus 25. It can be designed as a separate microprocessor. The display panel 7 and the indicator lamps (18) of the control panel 1 are each operated via a DECODER / DRIVER 23 in order to be controlled with the required electrical power based on binary information. The "CLOCK" element 26 is used for time control for the date display on the second display 27 of the control panel 1. The central computer bus 28 is connected to the BUS CONTROLLER and MULTIPLEXER 24 via a bus port 29 and a bus isolator 30. The bus isolator 30 effects a separation of the signals so that no disturbances reach the computer bus 28. The bus port 29 converts the signals from the fast computer bus 28 to the slow peripheral bus 25.

The central computer CPU 32 and a plurality of memories 20, 21, 33, 34 are connected to the computer bus 28. The non-volatile data memory RAM 20, which is designed, for example, as a RAM with a battery, as a NOVRAM, EEPROM or EAROM, stores intermediate results and contains the value specification that can be used by franking and the chain fields (POINTERS) (FIG. 4) for querying those in the read-only memory ROM 21 contained code tables (Fig.4). This read-only memory 21 is enclosed in the sealed housing of the franking machine or is also fastened in a sealed manner. It can be replaced by a person authorized by the post office, for example if the code tables provided or a have been consumed by them. This can take place at the same time as the machine revision which is due due to the correspondingly long operating time of the franking machine. The consumption is signaled, for example, on the display 7 by a suitable written information ("out of order") after the LAST POINTER has arrived at the end of one of the stored code tables 38 according to the register 36 of the block diagram in FIG. Furthermore, a program memory 33 designed as a ROM, PROM or EPROM is provided for the various function programs of the franking machine, as described in more detail in the aforementioned CH applications 853/89 and 854/89, among others. Finally, a data memory RAM 34 is provided for temporary storage. It goes without saying that different memories of the same characteristic can also be present as memory fields in a uniform memory chip.

In order to make it possible to fill up the default value memory 20 only after obtaining prior approval from the post office, e.g. After an amount corresponding to the desired default value has been transferred to the relevant post office account, a coded information exchange must take place between the franking machine and the authorizing post office. For this information exchange, the post office must be informed of a return code number stored in the read-only memory (ROM) 21 of the franking machine and the desired amount to be refilled. The authorizing input code number subsequently supplied by the post office forms the key number for filling up the default value memory RAM 20 of the franking machine. This exchange of information, e.g. in the form of an eight-digit number, can be done in any way, e.g. orally or by modem over a telephone connection or in writing.

The required return code is always released by the franking machine in response, ie in "return", for the input of an entry code number authorizing the filling from the otherwise inaccessible read-only memory ROM 21 and can be called up as often as desired on the display 7 of the control panel 1, if the zero key 10 in the key holder 11 of the franking machine machine is plugged. The first return code is thus made available to the user of the franking machine for later filling by the franking machine from its read-only memory ROM 21 after he has entered the first input code number for the first use of the franking machine. This first input code number is supplied to the buyer when the franking machine is purchased, for example, or was entered before the sale for a first replenishment paid for with the purchase.

The information required for each replenishment in the form of two eight-digit code numbers results from the return code communicated to the post office, e.g. corresponding to the combination of numbers "21379432" shown on the display 7, together with the specified desired replenishment amount of e.g. 500, - and the new input code number, which corresponds to the desired replenishment amount and is taken from the post office of the table according to Fig. 5 relevant for the franking machine in question. According to this table, the input code number required for replenishment by CHF 500 is equal to the number combination "134411 76˝. The new return code number, which will be automatically displayed by the franking machine for subsequent subsequent replenishment after this replenishment, 5 corresponds to the number combination "23490039" in accordance with this table according to Fig. 5. This return code number is used for comparison with the return code number released by the franking machine, or for identification if the user subsequently requests a further refill amount for his franking machine and generally becomes not communicated by the post office.

In the following, the program sequence of the central electronic control unit (FIG. 2) when filling up its default value memory is explained in more detail using the flow chart of FIGS. 3A, B. The program path via a transition point represented by a circle 40 takes place in each case when the statement associated with the respective branch, e.g. "Key No. = 0", does not apply.

The complete program sets according to the flow chart pass according to branch 41 first of all the presence of the key 10 with the number "0" beforehand, ie this must be signaled via the key receptacle 11 of the control panel 1 of the control unit according to FIG. According to branch 42, the "PENALTY" timer should have the value zero, because according to the bottom part of the flowchart it only comes into operation after a complete incorrect entry of a code entry number. By doubling the timing of incorrect entries, it is intended to prevent numerous entries from being tried. According to function fields 43, 44, the last pointer position Pw in a table Nw is taken from the register "LETZTER POINTER" (FIG. 4) in order to display the old return code required for obtaining an authoritative input code according to function field 45, such as is shown in Fig.1.

In order to be able to enter the input code received from the post office, the code input function is activated after inserting key No. 0 according to function fields 46 to 51. The result of this is that, according to function fields 49 to 51, ten flashing arrows 52 with the value numbers 53 on the numeric keypad 2-6, 14-17 and eight dashes "--------" appear on the display 7, indicating the free spaces mark for the code numbers to be entered. The line 54 provided on the left outside in the line of lines also flashes, as indicated in FIG. 1A, B by line lines. This means that the program is ready to start entering the code at this point.

For each of the eight code tables Nw = 0 to Nw = 7, a pointer Pw is stored in the pointer register (FIG. 4) of the non-volatile RAM memory 20, which pointer points to the next code line 55 with the pointer that has not yet been used for filling -Numbers 0, 1,2, 3, ... shows. The pointer registers are each called with the number Nw of the code table. The lines 55 contained in each of the code tables Nw each have a return code and a primary code. The latter can be found by program-wise searching of all stored tables Nw and compared with the input code until at the branch 56 the primary code stored in the code register matches this Input code and then according to function field 57 the value 58 corresponding to the relevant code table Nw can be added to the value specification register 20.

The input code number begins with the number "1" because each input code number has a "1" as the first digit, while each return code number begins with a "2". To do this, press the button 13 of the control panel 1 located next to the "1" shown in the display 7. Then the table number Nw corresponding to the desired replenishment amount is entered. According to the table in Fig. 5, the number "1" must be entered for the refill amount of CHF 100. Then enter the number sequence "445378" following this table. Fig. 1B shows the display 7 before entering the last number "8" of this example. The line "-" flashes at the point to be completed. The branch 61 corresponds to the program position at which an input key 2-6, 13-17 is to be pressed. According to function field 62, the key value is entered in the code input register and, in the subsequent function field 63, the reduced number of free number spaces "-" is correspondingly reduced in a number counter. The branch 64 causes the program to continue along the returning program loop 65 and via the function fields 50, 51, 61-64 in the same way until there is no free number space "-" and consequently eight numbers "11445378" have been entered .

After the input code has been completely entered, the code tables Nw are searched in accordance with function field 73 for the primary code having the same number. According to function field 66, this begins with table Nw = 0. If the primary code was not found in the relevant table Nw and the condition "code register = primary code" of branch 56 was not met, then the next table Nw becomes function field 67 "increment Nw" fetched to be searched. This continues according to branch 68 and the returning program loop 69 until the table Nw = 8 has been searched without the condition of branch 56 having been fulfilled, or without finding the appropriate primary code. In this case there is an incorrect entry and the entry program is interrupted for a certain time by the PENALTY timer taking effect according to function fields 70 to 72. After approval, the previous return code appears again on display 7 and the entry can be started again. If the entered eight-digit number is again not found as the primary code number in a table Nw of the read-only memory 21, the interruption or penalty time increases twice.

If the identity between the entered code number "11445378" and the primary code number has been determined at the branch 56, the PENALTY timer according to function fields 74, 75 is reset to zero after any previous incorrect entry. Furthermore, the pointer number (Po) is increased by a value (field 76) and saved as a new pointer in register 36 "LAST POINTER" together with the associated table number (Nw = 0) (field 77), so that the same code number is not repeated can be used for filling. Finally, the default value 58 of the table Nw is added to the default value register (20) and the new return code to be used for later replenishments appears on the display 7 as long as the key with the number "0" remains in the key holder 11 of the control panel 1. Another key is used for franking, of which there may be several depending on the number of users. The execution of these keys is described in more detail in US-A-4,788,623.

If the CE key 80 is pressed on the branch 61 instead of an input key 2-6, 13-17, the number entered disappears at the relevant number place by again overwriting a space "-" there according to function field 81. The changed number of numbers still to be entered is registered in the numerical counter at the function field 82. However, if, according to the previous branch 83, eight number spaces "--------" are already free, the program is returned to the functional field 50.

Claims (10)

1. Method for filling up the value memory of a franking machine, the functional sequence of which is controlled by a central electronic control unit, with a coded information exchange between an authoritative, remote central office and the user of the franking machine, whereby a suitable assignment between the exchanged information is checked by means of the control unit of the franking machine is characterized in that the creation of the coded information and their mutual allocation to provide pairs of information is carried out in the form of real random numbers and randomly and that the information and assignments that are valid for the franking machine in question are used both at the central office and in a memory the franking machine can be stored, the filling of the value memory of the franking machine by a predetermined amount of value takes place after a program of the control unit f It has been established that the information received from the control center and entered in the franking machine as an input code to fill up the value memory is already stored in the franking machine in an identical wording and a pair of information consists of this input code and a return code to be communicated for further filling up of the control center . 2. The method according to claim 1, characterized in that the information and their mutual assignment in pairs consisting of the input code and the return code are stored in a tabular arrangement at the central office, a separate table being available for each predetermined, fillable value set. 3. The method according to claim 2, characterized in that only the input code of the information pair can be used for filling, which follows the information pair used for the previous filling in the table. 4. The method according to any one of claims 1 to 4, characterized in that the coded information to be supplied to the user of the franking machine from the central office is read from a table which is available in writing and contains the information pairs. 5. The method according to any one of claims 1 to 4, characterized in that the information consists of a sequence of numbers, the number provided at a predetermined decimal place being indicative of one of several possible sets of values predetermined for the filling. 6. The method according to any one of claims 1 to 5, characterized in that the number of a sequence of numbers provided at a predetermined decimal place identifies the respective information part of the information pair. 7. franking machine for carrying out the method according to claim 1, with a computer (32) and memory (20,21,33,34) having electronic control unit (Fig.2), which with a number of input keys (2-6,13- 17,8) and a display field (7), one of the memories being a default memory (RAM, 20) for quantities of value to be used by franking, characterized in that the electronic control unit (FIG. 2) of the franking machine has a read-only memory (ROM , 21) in which a plurality of predefined information pairs consisting of an input code and a return code are stored. 8. Postage meter machine according to claim 7, characterized in that the pairs of information are present in a table-like, predetermined order in the read-only memory (ROM, 21) and can only be called up in this order to fill up the value preset memory (RAM, 20). 9. Franking machine according to claim 8, characterized in that the pairs of information are stored in several tables (38) are, with a (38) table being available for different predetermined amounts of value (58) to be filled. 10. Franking machine according to one of claims 7 to 9, characterized in that at least ten keys (2-6, 13-17) are arranged along the display field (7), which have a multiple function for the command input to the central electronic control unit (Fig .2), at least one command input means (10, 8) being present, for initiating a program of the control unit (Fig. 2) for filling up the value memory (20) and for changing the function of the keys (2-6, 13 -17) so that they form a numeric keypad for entering coded information in the form of a multi-digit code number, the key value (0-9) being shown next to the respective key on the display panel (7).

Images