EP0689170A2 - Method for adapting the datafile between an electronic franking machine and a data center - Google Patents

Abstract

A value changing mode is set up in the franking machine (12). In a first transaction between the franking machine and data centre (18) contg. the exchange of code numbers a specification value entered into the franking machine is passed to the data centre and stored in specification value memories (28,45) in the franking machine and in the data centre. A recharging mode is then set up. In a second transaction involving an exchange of code numbers between the franking machine and data centre the stored specification values are added to the values stored in a balance memory (26) in the franking machine and a deduction memory (46) in the data centre.

Description

The invention relates to a method for coordinating the data stock in the data processing device of an electronic franking machine comprising a credit memory for a postage credit and the billing unit of a data center comprising a billing memory for the franking machine as well as a franking machine suitable for carrying out the above-mentioned method.

In the past, franking machines had to be taken to the post office after the postage credit stored in the franking machine had been used up, where a post office official could replenish the credit memory against payment of the corresponding fees. In order to save the user of the franking machine from having to go to the post office, it has also been known for a long time to recharge the credit in the franking machine via a so-called remote value specification by exchanging data between a user station comprising the franking machine and a data center. It must be ensured that the amount loaded in the franking machine is also recorded in the data center so that it can be calculated for the user of the franking machine. It must be reliably prevented that the user fills the postage credit in his franking machine unnoticed by the data center or that the amount of reload entered into the franking machine differs from the amount transmitted to the data center.

From US-A-3 792 446 a remote value specification method is known in which the data exchange between the user station and the data center includes the transmission of a key number from the data center to the user station. With this key number, the user can unlock a lock on the franking machine for a one-time reloading process with a fixed predetermined reloading amount. Since the reload amount or default amount is fixed and cannot be changed, it is sufficient for billing to enter the number of reload processes in the data center.

For various reasons, it can be advantageous for the user of the franking machine if he can determine the amount of the reload amount from case to case at least within certain limits. For this purpose, a remote value specification method with a variable reload amount has already been proposed in DE-C-28 20 658. The correspondence of the reloading amount added to the remaining credit in the franking machine with the reloading amount accounted for in the data center is thereby ensured that the freely selectable reloading amount is included in the calculation of combination characteristic values which takes place independently of one another in the franking machine and the data center. Verification of the combination characteristic in the franking machine transmitted from the data center to the franking machine and including the variable credit value is only possible if both the franking machine and the data center have calculated with the same reload amount. Upon successful verification of the transmitted combination value in the franking machine, this reloading amount is automatically added to the remaining credit in the credit memory of the franking machine, without the user being able to intervene in the reloading procedure.

The invention is based on the object of specifying a method of the type mentioned at the outset, with which data can be reconciled between a postage meter machine and a data center assigned to it in a manner which is convenient and even more secure for the user and which enables the postage meter machine to be reloaded in a convenient manner enables.

This object is achieved in that a value change mode is set on the franking machine, that in a first transaction involving the exchange of code numbers between the franking machine and the data center, a default value entered into the franking machine is transmitted to the data center and in a respective default value memory of the franking machine and of the data center is stored, that a reload mode is set and that in a second transaction comprising the exchange of code numbers between the franking machine and the data center, the default value stored in the respective default value memory is added to the value stored in the credit memory of the franking machine and the value stored in the billing memory of the data center.

The inventive division of the method for reconciling the accounting data in the postage meter machine and the data center into two self-contained transactions has a number of advantages. First, the first transaction can be omitted if the default value is not to be changed. In this case, the postage credit is replenished with the value stored in the default value memory. This results in a simplified procedure in the event that the user does not want to change the default value at all. However, if the user wishes to change the default value, this value can be changed separately from the reloading process. On the one hand, this offers the possibility of first completing and checking the change in the default value. This increases the certainty that the postage credit is actually topped up with the desired reload amount. On the other hand, there is the option of building up a user hierarchy for changing the default value and reloading. For example, it can be provided that the employees in a company's post office may carry out the remote value specification procedure with a specific target amount, but that this target amount may only be changed by certain persons in the company. This can be ensured, for example, by the fact that the changes authorized person must identify the default value by means of an identity number known only to him or a suitable password, which must be entered in the franking machine in order to change the default value. This identification step can be preceded by the actual value change process, for example by the value change mode only being able to be initiated after the identification step. However, it can also be incorporated into the value change procedure.

The first transaction can, for example, take place in such a way that an identity number that characterizes the franking machine is entered into the franking machine and that a first code number, the identity number, is formed during the first transaction in the franking machine using the identity number, the entered default value and additional information by means of a key , the desired default value and the additional information are transmitted to the data center together with the first code number, the first code number is verified in the data center and the desired default value is stored in the default memory of the data center, in the data center using the identity number and the additional information using a key a second code number is formed and transmitted to the postage meter machine and the second code number is verified in the postage meter machine, whereupon the desired specification if the second code number is successfully verified ewert is stored in the default value memory of the franking machine. The method can be ended after the first transaction and the franking machine can be switched to the franking mode. However, the method can also be continued, wherein during the second transaction in the franking machine using the identity number and additional information by means of a key, a third code number is formed and transmitted to the data center, the third code number is verified in the data center and, if the verification in the default value memory of the Default value stored in the data center is added to the value stored in the billing memory of the data center, a fourth code number is formed in the data center using the identity number and the additional information by means of a key and transmitted to the franking machine, and the fourth code number is verified in the franking machine, after which it is successful Verification of the default value stored in the default value memory of the postage meter machine is added to the value stored in the credit memory of the postage meter machine. The second transaction thus includes the actual reloading process, which is carried out with a preset value that is permanently stored in the franking machine. This second transaction can also be carried out at any time without changing the default value.

The security against manipulation is ensured by the secrecy of the keys used. Any known encryption method can be used for encryption, for example the DES method. In order to increase security, it is expedient if a key used to determine the code numbers is changed after each completed transaction. The code number formed in the franking machine is expediently calculated during each transaction by means of a key that is available after the previous transaction has been completed. The code number formed in the data center is calculated using the same key. The franking machine is informed of the new key as part of the code number transmitted by the data center and, after verification of these code numbers, is stored in the franking machine for the next transaction. At the same time, the new key is also saved in the data center for the next transaction.

In the event that a code number transmitted from the franking machine to the data center cannot be verified in the data center, the data center has the option of repeating the verification by means of the key used before the last key change. If the code number can be verified with this key, this is a sign that the previous transaction in the postage meter machine was not or not completely carried out. This therefore gives the possibility of canceling, repeating or correcting transactions which are not or not completely completed in the postage meter machine and which lead to the data stocks in the postage meter machine and the data center no longer being congruent.

The data exchange between the franking machine and the data center can take place both via modem (hereinafter referred to as the modem method) and via telephone communication between the user of the franking machine and an operator in the data center (hereinafter referred to as the voice method).

In any case, the information to be transmitted to the data center (register values, postage call number or personal identification number etc.) is encrypted in the franking machine by means of a first function. A common encryption method is used here, preferably the Data Encryption Standard (DES). After the formation of an encrypted message or crypto message using the DES algorithm, a code number is formed in the voice method using a second secret function. The execution of the secret first function requires a secret number referred to as a key and a program sequence (encryption code) which verifies information by means of the key can encrypt or decrypt. However, the execution of the second secret function does not require a key.

The data exchange now takes place in the voice method using the code numbers in the manner already explained above. By forming the code numbers, it is possible to reduce the number of digits to be transmitted in comparison to the crypto message initially formed. This is useful in order to simplify the transmission of the information between the user of the franking machine and the operator in the data center.

In contrast to this, the data exchange in the modem process takes place by means of the crypto messages analogous to the procedure described above. Since the data exchange is automatic with the modem method, significantly longer encrypted messages can be exchanged without errors compared to the voice method. The formation of code numbers can therefore be avoided with the modem method.

Nevertheless, both methods are compatible with regard to the common data center. This is particularly important when the operator in the data center is replaced by an automatic device.

The invention further relates to an electronic franking machine for carrying out the above-described method, comprising an electronic data processing device with a credit memory for storing a postage credit and a default value memory for storing a default value by which the postage credit can be changed, and a printing device for printing connected to the data processing device of postage values, a data display device, an input device for inputting postage values to be printed and a device for setting a credit reloading mode in which, after input and verification of a reload key number, the preset value stored in the preset value memory is added to the postage credit. A franking machine of this type further comprises, according to the invention, a device for setting a value change mode in which, after input and verification of a value change key number, the default value in the default value memory can be replaced by a changed default value entered in the franking machine.

The electronic franking machine according to the invention enables the change in the default value and the reloading process to be treated separately from one another with the advantages described above.

The value change mode can be set, for example, by entering an identity number that characterizes the franking machine and pressing a first special key. A second special key can be provided for converting the franking machine from the value change mode to the franking mode. A after the completion of the change in value or without a change in value, i.e. without executing the first transaction, the reloading process immediately following the setting of the value change mode is preferably initiated by pressing the first special keys again.

According to the invention, it is possible to select the type of communication method between the franking machine and the data center by pressing at least one selection key provided on the franking machine after entering the identity or postage number, i.e. to make the choice whether the value change and / or reloading process should be carried out using the voice process or the modern process.

Two alternatives are possible. According to a first variant, after entering the postage call number or identity number, an option or special key is pressed in order to reach a selection menu which is displayed to the user of the franking machine in the display field thereof. By actuating a predetermined actuating element, for example a suitable numeric key, the display changes and shows the currently valid default value, which can then be confirmed or changed.

According to a further variant, two selection or special keys are provided, by pressing which the voice method or the modem method can be selected directly.

The invention further relates to a method for the secure storage of variable data, in particular the data that can change during a remote value specification.

A power failure can lead to a data record being incorrectly stored in a memory. To operate a data processing system, it is therefore already known to provide a second memory for an identical data record and a status memory for a status identifier, the latter indicating whether the data record should be read out of the first or the second memory when the voltage returns.

Errors in the status identifier can be rendered ineffective by storing the status identifier redundantly. However, the most common status identifier in a majority check does not always have to be the correct status identifier. It is only most likely that the most common state identifier is the correct one. An additional plausibility check also only checks the membership of a valid range of values, but does not provide a clear statement as to whether the status identifier is correct or not. With the method described above, an error that is most frequently stored is not recognized thereby lies in the valid range of values.

It is a further object of the invention to increase security in redundant storage with simple means and to eliminate any errors that may occur.

To solve this problem, it is proposed that a first data record is determined as a current, unchangeable data record by means of a pointer, the data of which are available for a query, that when data is changed, this change takes place in the non-current second data record, that subsequently using the The second data record is determined to be the current data record and that the data from the current second data record is copied into the non-current first data record.

These method steps described above are carried out both when initializing the memory, i.e. executed when saving the initial data as well as during operation. The current data set is always unchangeable. Even in the event of a power failure, its data is not endangered, since a power failure can usually only lead to errors in current write processes. The method according to the invention works independently of the detection of a power failure during the storage process. An essential step of the method according to the invention is to check the consistency of the stored data and the equality of the data stored in the two data records and, if necessary, to restore them, as will be described in more detail below.

• Fig. 1 eine schematische Darstellung einer Frankiermaschine und eines Datenzentrums,
• Fig. 2a und 2b eine schematische Darstellung eines Fernwertvorgabeverfahrens mit Änderung eines Vorgabewertes für das Voice-Verfahren,
• Fig. 3a und 3b eine schematische Darstellung eines Fernwertvorgabeverfahrens mit Änderung eines Vorgabewertes im Modem-Verfahren,
• Fig. 4 die Aufteilung eines Speichers für die gesicherte Speicherung von Daten in Form zweier Datensätze,
• Fig. 5 ein Flußdiagramm zur Erläuterung der Initialisierung der Daten in den beiden Datensätzen,
• Fig. 6 ein Flußdiagramm zur Erläuterung der Speicherung von Daten im laufenden Betrieb und
• Fig. 7 ein Flußdiagramm zur Erläuterung der Prüfung und Korrektur von Daten in den beiden Datensätzen.

Further features and advantages of the invention emerge from the further subclaims and the following description, which in connection with the accompanying drawings explains the invention using an exemplary embodiment. Show it:

• 1 is a schematic representation of a franking machine and a data center,
• 2a and 2b is a schematic representation of a remote value specification method with a change of a default value for the voice method,
• 3a and 3b is a schematic representation of a remote value specification method with changing a default value in the modem method,
• 4 shows the division of a memory for the secure storage of data in the form of two data records,
• 5 shows a flowchart to explain the initialization of the data in the two data records,
• Fig. 6 is a flow chart for explaining the storage of data during operation and
• Fig. 7 is a flow chart for explaining the checking and correction of data in the two data sets.

In Figure 1, 10 denotes a user station, which comprises a franking machine 12 and a telephone 14. This telephone or communication terminal, e.g. a modem, is connected via a telephone line 15 to a telephone or communication terminal 16 in a data center 18, which also contains a billing device 20.

The franking machine 12 comprises a data processing device, generally designated 22, with a CPU 24, a credit memory 26, a default value memory 28 and a cryptographic device 30, which contains a key memory 12. The data processing device 22 naturally also includes other parts, memories and registers, which are not shown here, however, since they are not required for the description of the method according to the invention. In an advantageous variant, software means or program memory means of the CPU 24 can be used in conjunction with the non-volatile key memory 32 instead of the separate device 30 in order to carry out the encryption. In the case of automatic data exchange (modem method), the data processing device 22 is connected via a line 23 to the communication terminal modem 14, which then replaces the telephone 14. An input device 34, for example a keyboard, a display device 36 and a printing device 38, is also connected to the data processing device 22.

The billing device 20 in the data center 18 comprises an input device 40 and a data processing device 42 with a CPU 44, a default value memory 45, a billing memory 46 and a cryptographic device 48 with a key memory 50. Here too, encryption can be carried out in connection with the device instead of in the device 48 CPU 44 and the non-volatile key memory using software. For the modem method, the data processing device 42 is connected to the modem via a line 51, which in this case replaces the telephone 16.

In the voice process, the data exchange between the user station 10 and the data center 18 takes place via the telephones 14 and 16, and preferably by telephone exchange between the user of the franking machine 12 and an operator in the data center 18. This takes place with the course of the remote value specification process in the franking machine and The essential processes connected to the data center will now be explained with reference to FIGS. 2a and 2b, which show the processes in the user station or franking machine (FM) on the left and the processes in the data center (DZ) on the right.

The value change and remote value specification method shown in FIG. 2 begins by entering an identity number (PAN) (S1) in the input device 34 of the franking machine 12, which is confirmed by a special key 52 (FIG. 1). The preset value stored in the preset value memory 28 appears in the display. In the event that this value is to be changed, the program of the data processing device branches off the routine (S2) corresponding to the "change in value" transaction. The desired default value is then entered into the data processing device by means of the input device 34 and confirmed by pressing the special key 52.

The user now calls the operator in the data center 18 (S4) and informs him of the identity number (PAN). The operator enters the identity number into the input device 40 of the billing device 20 in order to identify the caller and the franking machine 12 of the user station 10. The verification of the identity number is shown at S6. If the check is negative, the process is terminated and repeated if necessary. If, on the other hand, the franking machine can be identified, the method is continued. The operator is informed of the user's default request and, if applicable, further information about the franking machine, in particular values in the billing registers.

In order to continue the method in the franking machine, a first code number is calculated (S7) from the identity number, the default request and additional information, for example a further register value, using a key K1, which code code is displayed in the display device 36 of the franking machine 12 and is displayed by the user to the operator Data center 18 is transmitted. In step S8, this code number is checked in the data center 18 with the aid of the key K1 stored in the data center. If the result of the check is negative, the check is repeated with the key used in the previous transaction. If the verification is successful now, it means that the previous transaction in the postage meter machine was not carried out or was not carried out completely and correctly. The previous transaction is therefore canceled and the process continues. If the code number cannot be verified with the previous key, the process is terminated. If, on the other hand, the first code number can be successfully verified, the default value is stored in the memory 45 of the data center and the data processing device 42 in the data center 18 calculates a second code number from the identity number, the additional information and the key K1. A second key K2 (S9) is also calculated. This second code number, in which the new key K2 is integrated, is communicated to the user, who enters it into the input device 34 of the franking machine. The cryptrographic device 30 in the franking machine verifies the second code number, extracts the key K2 from the transmitted second code number and stores it in place of the key K1. If the result is negative, the process is terminated; if the result is positive, the inputted default request is stored in the default value memory 28, the previous default value being deleted (S11).

This completes the first transaction and changes the default value. The user now has the option of ending the method and returning the franking machine 12 to the franking mode by pressing a further special key 54 or initiating the reloading process by pressing the first special key 52 again (S12). If the latter happens, a third code number is calculated in the postage meter machine using the identity number and the additional information by means of the stored key K2, which code number is communicated to the data center (S13). The third code number is verified in the data center (S14). If the result is negative, the method is terminated; if the result is positive, the data center uses the identity number, the additional information and the key K2 to calculate a fourth code number (S15), which is transmitted to the franking machine together with a new key K3. As in the first transaction, the fourth code number is verified in the franking machine (S16) and the new key K3 is extracted from the fourth code number and stored, as was done in the first transaction with the key K2. The old and new keys are stored in the data center. If the result is negative, the process is terminated. If the result is positive, the value stored in the default value memory 28 of the franking machine is added to the remaining credit in the credit memory 26 of the franking machine and the value stored in the default value memory 45 of the accounting device 20 is added to the remaining credit in the accounting memory 46 of the data center 18 (S17). This completes the second transaction, that is, the remote value specification with a changed default value. The franking machine automatically returns to the franking mode.

If a change in the default value is not desired, the default value stored in the default value memory 28 is confirmed by actuating the special key 52 or also an optionally provided third special key and the method goes from step S2 directly to step 4 'in FIG. 2b. The user calls the data center and informs the operator of the identity number (PAN) and possibly further information (S5 '). If the identity number is correct (S6 '), the remote value setting process then proceeds from step S13 to step S17 as described above.

It goes without saying that the operator has further data on the franking machine, in particular further data can query gisterstands to check the correctness of all accounting data in the franking machine and the data center. It is also possible to include further information and additional subkeys in the calculation of the code number if this appears to make sense to increase security. If a code number transmitted by the franking machine is checked in the data center in step S14 and the result is negative, the check is always repeated again with the key used in the franking machine in the immediately preceding transaction. This detects a case in which a transaction in the postage meter machine was not completed correctly without the data center being aware of this. In this case, the new key transmitted by the data center would not be stored in the franking machine and the franking machine therefore encrypts with the old key. This gives the opportunity to cancel or correct the last transaction and thus avoid damage to the user or the data center.

The flow chart according to FIGS. 3a and 3b shows the value change and reloading process in the event that the communication between the franking machine and the data center takes place automatically via modem. Since the steps of the method are essentially the same as in the method according to FIGS. 2a and 2b, the individual steps are also provided with the same reference numbers, increased by the number 20.

As in the method described with reference to FIGS. 2a and 2b, the user of the franking machine enters the postage call number or identity number PAN after switching on the same and confirms this input by pressing the special key 52. The stored default value is now displayed. The user either confirms this value by pressing the special key 52 or overwrites it with a new default value which is also confirmed by pressing the special key 52. All further steps now take place automatically without the user of the franking machine having to do anything between the franking machine and the data center, in the same way as was explained in the voice method described with reference to FIGS. 2a and 2b. The only difference is that with the modem method between the franking machine and the data center only the crypto messages, i.e. the encrypted messages and not the shortened code numbers obtained from them are exchanged.

A method for storing security-relevant data, in particular during remote value specification, will now be described with reference to FIGS. 4 to 7.

FIG. 4 shows schematically the division of the storage space in a non-volatile memory, for example an NVRAM, which is present in the franking machine and possibly also in the data center. The memory must have space for storing two data sets, namely set 1 and set 2 and for storing a pointer. Each data record contains a variable set "var", which can consist of any number of bytes. Furthermore, each data record includes a counter variable "nr updates", which indicates the number of changes to the data record, ie is increased by 1 each time the data of a record is changed or renewed. Finally, a checksum "checksum" is also part of a data record, which includes at least inclusion a part of variable data of the data record is determined.

The "Act Pointer" pointer can only have two permissible values that indicate which of the two data records is currently considered to be the current data record. The values 0 and 1 are not saved, since no bit error can be detected with these values. Rather, the values 0 x A5 or 0 x 5A are used, where 0 x indicates that the values are noted in hexadecimal. With this number, which is constructed symmetrically in binary representation, bit errors can be recognized from the number itself.

• 1. Initialisierung des Speichers für das Speicherverfahren;
• 2. Abspeichern von Variablen im laufenden Betrieb und
• 3. Überprüfung der Variablen auf Konsistenz und ggf. Korrektur.

The entire process is divided into three steps:

• 1. Initialization of the memory for the storage process;
• 2. Save variables during operation and
• 3. Check the variables for consistency and correct them if necessary.

• Zunächst wird der Zeiger auf Satz 1 gesetzt (Schritt S50). Das bedeutet, daß der Satz 1 als aktueller Speicher betrachtet wird, dessen Daten unveränderlich sind. Dann werden im Schritt S51 die Variablen des Datensatzes 2 auf ihre Anfangswerte gesetzt. Der Zählwert nr Updates in Datensatz 2 erhält den Wert 0 (S52). Anschließend wird die Prüfsumme unter Verwendung mindestens eines Teiles der variablen Werte des Datensatzes 2 erzeugt und an den hierfür vorgesehenen Platz des Datensatzes 2 abgespeichert (S53, S54). Nun wird der Zeiger auf den zweiten Datensatz gesetzt, d.h. der zweite Datensatz wird zum aktuellen Datensatz bestimmt (S55), auf dessen Daten nun als zuverlässige und unveränderliche Daten zurückgegriffen werden kann. Abschließend wird in Schritt S56 der gesamte Inhalt des Datensatzes 2 in den Datensatz 1 kopiert, so daß beide Datensätze identische Daten enthalten.

According to FIG. 5, the initialization of the memory comprises the following steps:

• First, the pointer is set to set 1 (step S50). This means that sentence 1 is considered to be current memory, the data of which cannot be changed. Then, the variables of data record 2 are set to their initial values in step S51. The count nr updates in data record 2 receives the value 0 (S52). The checksum is then generated using at least some of the variable values of data record 2 and stored in the space provided for this in data record 2 (S53, S54). Now the pointer is set to the second data record, ie the second data record is determined to be the current data record (S55), the data of which can now be used as reliable and unchangeable data. Finally, the entire content of data record 2 is copied into data record 1 in step S56, so that both data records contain identical data.

During operation, data is only changed in the non-current data record. According to FIG. 6, it is first determined during operation which data record is the non-current data record (S60). In In step S61, changing data is written into the non-current data record. Since the data of the data record changed in step S61, the count value nr updates is increased by 1 in step S62. The checksum is then newly formed from data from the non-current memory (S63) and stored in the non-current data record (S64). Now the pointer is directed to the record in which the data has just been changed so that this record is now the current record (S65). Finally, the entire data of the now current data record is copied to the other, not current data record (S66). Both data records in turn contain the identical data.

When the franking machine is switched on and before the remote value specification is called up, it must be checked whether a previous transaction was interrupted, for example by a voltage drop, and therefore operations are required to correct inconsistencies in the stored data.

• 1. Der Zeiger Act Pointer muß einen zulässigen Wert haben. Wie bereits oben erläutert wurde, sind nur zwei Werte erlaubt, wobei solche Werte gewählt werden, in denen aus dem Wert selbst heraus Bitfehler erkannt werden können.
• 2. Der aktuelle durch den Zeiger bezeichnete Satz muß eine gültige Prüfsumme haben.

The following basic requirements are made for the examination:

• 1. The Act Pointer pointer must have a permissible value. As already explained above, only two values are allowed, values being selected in which bit errors can be recognized from the value itself.
• 2. The current record identified by the pointer must have a valid checksum.

If at least one of the above requirements is not met, there is a fatal error and the franking machine goes into service mode.

The following steps are carried out for the consistency check, which are to be explained with reference to FIG. 7.

First, it is checked in step S70 whether the value of the pointer is permissible. In step S71, it is checked whether the checksum of the current data record identified by the pointer is valid. If one of the two steps is not fulfilled, the franking machine switches to service mode, as already mentioned above.

If, on the other hand, the checks in steps S70 and S71 have led to a positive result, the validity of the checksum of the non-current memory is checked in step S72. If this test is negative, i.e. if the checksum is not valid, it can be assumed that data storage or mirroring has been interrupted. To correct this error, the mirroring is repeated, i.e. all data of the current data set are copied into the non-current data set (S73). If, on the other hand, the checksum has proven to be valid, a check is carried out in S74 as to whether the checksums of the two data records and thus their data are the same. If this is the case, the test is finished. If, on the other hand, both checksums are valid but not the same, the data backup process was interrupted before mirroring. In this case, the data record whose count value nr updates is greater than the count value of the other is selected as the current record. Its data is copied to the other data set (S75).

In a modified embodiment, the franking machine can be set up both for the voice process and for the modem process. The user can select the type of communication method with the data center by means of a selection button 58 (FIG. 1) on the franking machine.

Claims (25)

Method for coordinating the data stock in the data processing device (22) of an electronic franking machine (12) comprising a credit memory (26) for a postage credit and the billing device (42) of a data center (18) comprising a billing memory (46) for the franking machine, characterized in that that a) a value change mode is set on the franking machine (12), b) that in a first transaction involving the exchange of code numbers between the franking machine (12) and the data center (18), a default value entered in the franking machine (12) is transmitted to the data center (18) and in a respective default value memory (28; 45) the franking machine (12) and the data center (18) are stored, c) that a reload mode is set and d) that in a second transaction, the exchange of code numbers between the franking machine (12) and the data center (18), the default value stored in the respective default value memory (28) for that in the credit memory (26) of the franking machine (12) and that in the accounting memory ( 46) the data center stored value is added. Method for coordinating the data stock in the data processing device (22) of an electronic franking machine (12) comprising a credit memory (26) for a postage credit and the billing device (42) of a data center (18) comprising a billing memory (46) for the franking machine, characterized in that that a) a value change mode is set on the franking machine (12), b) that in a first transaction involving the exchange of encrypted messages (crypto messages) between the franking machine (12) and the data center (18), a default value entered in the franking machine (12) is transmitted to the data center (18) and in a respective one Default value memory (28; 45) of the franking machine (12) and the data center (18) is stored, c) that a reload mode is set and d) that in a second the exchange of crypto messages between the franking machine (12) and the data center (18) transaction comprising the default value stored in the respective default value memory (28) to the in the credit memory (26) of the franking machine (12) and in Billing memory (46) of the data center stored value is added. 3. The method according to claim 1 or 2, characterized in that a franking machine (12) identifying identity number is entered in the franking machine (12) and that during the first transaction in the franking machine (12) using the identity number, the entered default value and an additional information is formed using a key (K1), a first code number, the identity number, the desired default value and the additional information are transmitted to the data center (18) together with the first code number, the first code number is verified in the data center (18) and the desired default value in Default value memory of the data center (18) is stored, a second code number is formed in the data center (18) using the identity number and the additional information using a key (K2) and transmitted to the franking machine (12) and the second code number is verified in the franking machine (12) is what success Verification of the second code number stores the desired default value in the default value memory (28) of the franking machine (12). 4. The method according to any one of claims 1 to 3, characterized in that during the second transaction in the franking machine (12) using the identity number and additional information by means of a key (K2), a third code number is formed and transmitted to the data center, which third code number is verified in the data center (18) and, upon successful verification, the default value stored in the default value memory (45) of the data center (18) is added to the value stored in the accounting memory (46) of the data center (18), in the data center (18) the identity number and the additional information are formed by means of a key (K3) and a fourth code number is transmitted to the franking machine (12), and the fourth code number is verified in the franking machine, whereupon after successful verification the preset value stored in the default value memory (28) of the franking machine to the in the credit memory (26) of the Fr ankiermaschine (12) stored value is added. 5. The method according to any one of claims 1 to 4, characterized in that a key used to determine the code numbers is changed after each completed transaction. 6. The method according to any one of claims 1 to 5, characterized in that during each transaction, the code number formed in the franking machine (12) is calculated by means of a key (K1) present after completion of the previous transaction, that the code number formed in the data center by means of same key (K2) is calculated, and that the new key (K2) is stored in the data center, communicated to the franking machine as part of the code number transmitted by the data center (18) and, after verification of this code number, is stored in the franking machine (12). 7. The method according to claim 6, characterized in that in the case in which a code number transmitted from the franking machine (12) to the data center (18) in the data center (18) cannot be verified, the verification by means of before the last key change key (K1) used is repeated, and that if the code number is successfully verified with this key (K1), the last transaction is corrected. 8. The method according to any one of claims 3 to 7, characterized in that after entering the identity number, the type of communication method between the franking machine and the data center is selected by actuating at least one selection button (58). 9. Electronic franking machine comprising an electronic data processing device (22) with a credit memory (26) for storing a postage credit and a default value memory (28) for storing a default value by which the postage credit can be changed and connected to the data processing device (22) are a printing device (38) for printing postage values, a data display device (36), an input device (34) for inputting postage values to be printed out and a device for setting a credit reload mode in which, after input and verification of a reload key number, the default value stored in the default value memory (28) is added to the postage credit, characterized by means (52) for setting a value change mode in which, after input and verification of a value change key number The default value in the default value memory (28) can be replaced by a changed default value entered in the franking machine (12). 10. Franking machine according to claim 9, characterized in that the data processing device (22) has a cryptographic device (30) for generating and / or verifying key numbers. 11. Franking machine according to claim 10, characterized in that the cryptographic device (30) has a memory (32) for at least one key (K1, K2 ...). 12. Franking machine according to one of claims 9 to 11, characterized in that the value change mode is adjustable by entering an identity number characterizing the franking machine (12) and the actuation of a first special key (52). 13. Franking machine according to one of claims 9 to 12, characterized in that it can be changed from the value change mode to a franking mode by actuating a second special key (54). 14. Franking machine according to one of claims 9 to 13, characterized in that the reloading mode can be set by pressing a third special key (56) after setting the value change mode. 15. Franking machine according to one of claims 9 to 13, characterized in that the reloading mode can be set by pressing the first special key (52) after setting the value change mode. 16. Postage meter machine according to one of claims 9 to 15, characterized by at least one selection button (58) for selecting the communication method between the postage meter machine and the data center. 17. Data center (18) comprising a communication device (16) for data exchange with at least one user station (10) which has at least one franking machine (12), and a data processing device (20) with a data input unit (40), a computing unit (44) and an accounting memory for each franking machine (46), in which the credit amounts loaded in the franking machine (12) are added up over a predetermined period of time, characterized by a default value memory (45) for each franking machine (12) for storing a default value assigned to the franking machine (12) (VGW) by which a credit value stored in the franking machine (12) is to be changed, the data processing device (20) being programmable in such a way that it receives the default value in accordance with first data received from the user station (10) via the communication device (16) Default value memory (45) changes and that they are second from the User station (10) via the communication device (16) adds the value stored in the default value memory (45) to the value stored in the accounting memory (46). 18. Data center according to claim 17, characterized in that the communication device comprises a modem which can be connected to a modem of the user station (10). 19. Data center according to claim 17, characterized in that the communication device comprises a telephone set (16) which can be connected to a telephone set (14) of the user station (10). 20. Data center mach one of claims 17 to 19, characterized in that it is a cryptographer hische device (48) for generating and / or verifying key numbers. 21. Data center mach claim 20, characterized in that the cryptographic device has a unit (50) for generating and storing keys. 22. A method for the secure storage of changeable data by generating and storing two matching datasets, characterized in that a first dataset is determined as the current unchangeable dataset by means of a pointer, the data of which are available for a query that when data are changed, these The change in the non-current second data record is such that the second data record for the current data record is then determined using the pointer and that the data from the current second data record is copied into the non-current first data record. 23. The method according to claim 22, characterized in that a variable of the variable data of each data set is a representative value for the number of changes made. 24. The method according to claim 22 or 23, characterized in that a variable of the variable data of each data set is a checksum calculated from at least part of the variable data. 25. The method according to any one of claims 22 to 24, characterized in that the value of the pointer for consistency and selected data of the data records are checked for consistency and equality and corrected if necessary.

Images