EP0944027A2 - Franking machine and a method for generating valid data for franking - Google Patents

Abstract

A programmed computer (11) captures stored addresses or commits new addresses to temporary storage. It communicates dispatch instruction data to the data center, comprising sender identification and recipient address. A second computer (21) acknowledges the request, checking address validity against stored data (23). The first computer is returned address validation (if appropriate), correct postage, and signature data, using address data in the central data bank (Automatic address correction is provided for). The return from the central databank is processed. Where appropriate, a valid franking mark is printed on the item to be posted.

Description

The invention relates to a franking device and a method for Creation of valid data for franking imprints according to the generic term of claim 1 and claim 4. The franking device is particularly suitable for home use and for users, who send only a few mail pieces.

DE 40 18 166 C2 has already been used for such users with little Postage volume a franking module for a personal computer proposed the franking module in the slot of a drive module is arranged, which both the franking and the Envelopes allowed. Such a franking module is surrounded by a secured housing and has circuitry the same structure as a franking machine, in which the Letter transport device is saved. It goes without saying that a franking module equipped in this way can be offered cheaper, as a franking machine.

By using the franking module, the billing of the Franking and the printing of the franking stamp image are not external be manipulated. The address data is from one of the personal computer managed memory read and over the internal information network fed to the franking module. However, it is not excluded that incorrect address data ultimately lead to that the mail carrier has difficulty in delivering the item or not at all Can deliver mail recipients. It is with a digital printing process difficult to determine whether the printed franking stamp image is not just is an unpaid copy of an earlier reprint and with a desired other address was combined. Therefore be special red fluorescent inks are prescribed, which are difficult to are copying. Due to the progress made in the meantime Color copiers and color printers cannot do this are considered more and more serious obstacles, fake unpaid ones To make impressions.

Usually there is also a printer connected to the personal computer, with which not only letters are printed out nowadays, but also addresses can be printed on envelopes. Basically, this can also do that Envelope to be franked. However, it is difficult with such open ones Systems to prevent manipulation. About the unsecured Connection lines, namely, could be a manipulator with the intention of forgery try to feed data into the system by pretends that they come from the authorized body.

The United States Postal Service has a catalog published in 1996 Requirements for the construction of future secure franking systems established (Information based Indicia Program IBIP). In it encouraged to encrypt certain data cryptographically and in form print a digital signature on the letter to be franked, by which the postal authority verifies the authenticity of franking imprints can check. At the U.S. Postal Service, estimates are based on Fraud claims an annual loss of approximately $ 200 million. These requirements are differentiated according to the type of franking device been. Traditional franking machines, which usually only one Franking stamps printed in red are also called "closed systems" referred to and need differently than with so-called "open systems" (PC franking) the corresponding letter address is not in the Include encryption. For open systems, however, is still a security module with advanced crypto technology and secured housing, in which data the Data center can be saved.

From US 5,625,839 is the sending of an update information as Data packet known to a franking machine. With a CRC checksum can check the correctness of the data transmission be, however, nothing yet about the accuracy of the transmitted Data content itself says. A problem could arise because of that unsecured connecting line arise when namely Manipulator with the intention of falsification tries to insert data into the Store the franking machine by pretending that it comes from the data center.

In DE 38 40 041 A1 an arrangement has therefore already been made proposed in which a franking device via a constantly in Operating TEMEX dedicated line with a central computer connected is. The postal customer enters the into the franking device desired franking value. The latter becomes the central computer transmitted, which is connected to a Giro computer, at which the customer has a Postgiro account. After a coverage check takes the giro computer provides the billing and the central computer provides the Franking function free. The franking device itself also owns additional postal storage, which is due to the data network can be queried and provide additional security Provide data loss in the event of a computer failure. The central computer triggers an alarm if this dedicated line is tapped or tapped is interrupted. However, it is complex and therefore not everywhere possible to use such a special secured line.

A communication system is known from EP 373 971 B1, with a transfer of address data from a local to one central database in a data center, an update of the stored address data in a central database of Data center based on the transmitted address data and a Modify the address data of the local ones in the system Databases based on the updated data from the data center. In order to the data in each local database is kept the same reached according to a central database. With an unsecured Connecting line can not be prevented that a incorrect address in the central database of the data center saved and from there to the respective local database of the others User is transferred.

In EP 782 296 A2 a certificate was called for by a user Address book memory over an unsecured communication link Although a public key procedure is proposed, it can only to ensure that the transmitted message is authentic. A fake message could therefore also be transmitted whose certificate is genuine.

In franking systems, in addition to the correctness and authenticity of a message, correct billing is also important. A postage box in a terminal (US Pat. No. 5,233,657) or a secure module (US Pat. No. 5,625,694) in which the accounting data are stored has therefore already been proposed.
The terminal according to the solution proposed in US Pat. No. 5,233,657 is used as a fax and franking device, essential franking image data being requested from a data center and then printed out complete with other image data which are stored in the terminal as a franking imprint. The communication between the terminal and the data center is secured by a cryptographic procedure, for example according to the well-known RSA procedure. A security code is generated from the data identifying the terminal by the central processing unit of the terminal and printed together with the franking value. The long arithmetic work that the central processing unit has to carry out is disadvantageous, on the one hand when image data is decrypted using the RSA method and on the other hand when the security code is generated.

In US 5,625,694 a computer with a secure module equipped. When requesting a digital signature such secure module, the requirement depending on a Change regarding the franking value entered and a The saved module then generates the recipient address on the one hand a corresponding digital signature and transmits it to the microprocessor of the computer, but on the other hand also carries out the Billing through. The computer's microprocessor then generates one Print image according to the franking value and the recipient address as well as the transmitted signature. Only then will a signature not be issued by secured module requested if neither the franking value nor the Address is changed. A copy of the same print will not be made included in the secured module. The postal carrier is responsible for the Authenticity check for every single piece of mail. Even the slightest difference in the address affect the signature. However, it is not sure that the user is entering a valid recipient address he follows. One with an invalid recipient address Mail piece may not be delivered, although it is with a valid postage has been franked and the postage properly in secured module was billed because the address was added later is not correctable. In all of the aforementioned solutions, this is complex Necessity of arranging a secure module in the end device.

The task is to create a low-end franking device with a local one Create database, being in the local database of Franking device valid addresses are stored. Furthermore, a Method for generating valid data for franking imprints specified so that the result is valid franking values with valid addresses can be printed on the item of mail together with a signature.

The object is achieved with the features of claims 1 and 4.

The need to arrange a secure module in the terminal not applicable. This also eliminates the need for a credit in the Reload the device and secure the communication accordingly To manipulate the credit. According to the invention digital signature in a data center of a manufacturer of franking systems or a mail carrier. Communication with the The data center is relatively short because the transmitted clear data is neither Image data still include all data to be encrypted, but in addition to only a relatively short signature is transmitted back to the clear data. The service provided by the data center is also advantageous a correction of an incorrectly entered mail recipient address. In this way, incorrect postage can be avoided. In a variant can postage calculation as an additional service from the data center according to the valid tariff. It is also cheap for security against manipulation, that secret keys and others security-relevant data are only stored in the data center and cannot be read externally. The imprint of the Data transmitted to the mailpiece can also be sent to any address done later. For external image generation from the transmitted data there are no restrictions. So can different printing processes are used. The different Conditions of use and requirements of the individual mail carriers can be best met.

Fig. 1, Blockschaltbild für die Frankiereinrichtung und die Datenzentrale,

Fig. 2, Beispiel für einen Abdruck auf einem Poststück.

Advantageous developments of the invention are characterized in the subclaims or are shown in more detail below together with the description of the preferred embodiment of the invention with reference to the figures. Show it:

1, block diagram for the franking device and the data center,

Fig. 2, example of an impression on a mail piece.

In the block diagram according to FIG. 1, a data center 20 with franking devices 10 and 30 and with a check point 50, for example in the post office, of the mail carrier is communicatively connected via a communication network 40.
The franking device 10 is designed as a digital printer 17 which is controlled by a first computer 11 and which can print at least envelopes of one format. For example, a personal computer PC 1 is connected on the one hand to the printer 17 via an unsecured cable 16 and, on the other hand, can establish a communication connection with the data center 20 online via modem 15 and communication network 40. A hard disk memory 13 for a local database, a keyboard 14 and a display unit 12 are connected to the first computer 11. Corresponding inputs can be made and made visible or the further program execution can be monitored by the latter input / output means 12 and 14. During the online connection, the database of the local database is reconciled and the transmitted data is saved. The generation of prints based on the transmitted stored data can take place at a later point in time.

The data center 20 consists of a second computer 21, preferably a personal computer PC 2 with connected Input / output means 22 and 24, a hard disk 23 and at least one Modem 25. The hard disk 23 stores special service programs and booking or billing data for services, which are provided for a customer.

A corresponding application program is loaded onto the hard disk 13 of the first personal computer PC 1 and is tailored to the needs of the users for soho (smal office & home office) markets. In such a market, the number of franked letters per unit of time is not important, but only a small outlay at moderate costs. A mere message could be sent via email. In practice, however, unique originals of pictures, photos, books, fabrics etc. should also be sent in an envelope. The invention therefore assumes that the basic system consisting of a computer and printer is already available to the user. Additional and expensive hardware components, for example a security module, can only be dispensed with in the terminal if the franking system is designed in accordance with the invention. The computer must be equipped with a fast, modern processor and sufficient storage space for processing modern crypto technologies.
The invention further presupposes that communication connections via the network 40, for example those via the Internet, WWW (Word Wide Web) or ISDN, can be produced inexpensively in the future.

The invention is that the data center based on a Hard disk 23 created central database the validity of a Checked the recipient's mailing address and, if necessary, produces that the franking device before being stored in the local database verifies the authenticity of a transmitted mail recipient address. A public key is used, which is preferred together with the valid mail recipient address and with the signature is transmitted from the correct data center. None other than that correct data center can generate the authentic signature.

Checking the validity of an address requires maintenance of the Address files of the central database by a mail carrier or through a service commissioned by the postal carrier. For The use of the will cover the resulting costs Address files by external users as a fee-based service charged to the user.

To carry out the check, at least the one to be printed Mail recipient address (address) first to the aforementioned data center transmitted. A wrong way of writing the address can automatically corrected using the postcode or a similar destination code if there is a corresponding file in the central Database exists. The reverse also applies. However, it is automatic Correction not possible, the user will be informed and asked to enter the address correctly. After the review a postage value corresponding to the valid tariff and the valid, possibly previously corrected address and postcode returned to the franking device, the returned data using a signature are linked together. As an intermediate step there will be a message generated from the data to be transmitted by a special mathematical Function is used, which is the one to be encrypted Data volume reduced. The signature is encrypted by the Message with a secret private key after a known one generated asymmetrical encryption algorithm.

A suitable known asymmetric encryption algorithm is, for example, the digital signature algorithm (DSA), an elliptic Curve Digital Signature Algorithm (ECDSA) or the ELGamal Algorithm (ELGA). This signature algorithm is a key pair together, which includes a private and public key. The private key is a secret that cannot be read externally Write key. And the public key acts as a read key for the signature and is accessible to everyone.

In the unpublished German application entitled: "Process for a digitally printing franking machine for production and verification of a security imprint ", became such asymmetrical Encryption algorithms applied to "closed systems" explained in more detail. There is a difference on the franking machine side a postage security device for the solution according to the invention Encryption used, which can now be omitted according to the invention.

Instead, the hard drive 23 of the second computer 21 has the Data center 20 specially secured storage areas for storage of the private key, so that the latter is not read out externally can be. Alternatively, a separate memory, for example a Semiconductor memory, for the secure storage of the private key be used, the memory integrated in the computer and against unauthorized reading is secured.

• auf eine gespeicherte bestimmte Postempfängeradresse zuzugreifen oder eine neu eingegebene bestimmte Postempfängeradresse zwischenzuspeichern,
• Anforderungsdaten des Postabsenders per Kommunikationsmittel zur Datenzentrale zu übermitteln, wobei die Anforderungsdaten die Identifikationsdaten des Postabsenders und Postversendungsdaten, einschließlich die bestimmte Postempfängeradresse, umfassen, um die Richtigkeit der Postempfängeradresse mittels eines zweiten Computers zu bestätigen oder anhand einer in der zentralen Datenbank gespeicherten Adreßdatei herzustellen,
• Daten zu empfangen, betreffend eine gültige Postempfängeradresse von einer in der zentralen Datenbank gespeicherten Adreßdatei, einen gültigen Portowert und eine Signatur, wobei der zweite Computer der Datenzentrale die angeforderten Daten nur mit einer Signatur ausstattet, wenn eine gültige Postempfängeradresse in der zentralen Datenbank gespeichert ist, wobei eine Mitteilung erzeugt wird, wenn eine automatische Korrektur einer Postempfängeradresse unmöglich ist,
• die von der zentralen Datenbank empfangenen Daten einschließlich der Signatur zu verarbeiten, um einen authentischen Frankierabdruck auf das Poststück abzudrucken.

Es ist weiterhin vorgesehen, die Authentizität der zur Frankiereinrichtung übermittelten empfangenen Daten anhand der Signatur zu überprüfen und bei Authentizität die Adreßdatei in der lokalen Datenbank bezüglich der bestimmte Postempfängeradresse zu aktualisieren.It is provided that the first computer 11 is programmed in the memory by means of a user program

• access a saved specific mail recipient address or temporarily store a newly entered specific mail recipient address,
• To transmit request data of the mail sender via communication means to the data center, the request data comprising the identification data of the mail sender and mailing data, including the specific mail recipient address, in order to confirm the correctness of the mail recipient address by means of a second computer or to produce it on the basis of an address file stored in the central database,
• To receive data relating to a valid mail recipient address from an address file stored in the central database, a valid postage value and a signature, the second computer of the data center only providing the requested data with a signature if a valid mail recipient address is stored in the central database, generating a notification when automatic correction of a mail recipient address is impossible,
• to process the data received from the central database, including the signature, in order to print an authentic franking imprint on the mail item.

Provision is also made to check the authenticity of the received data transmitted to the franking device on the basis of the signature and, in the case of authenticity, to update the address file in the local database with respect to the specific mail recipient address.

• Bildung und Übermittlung von Anforderungsdaten, mit welchen ein erster Computer der Frankiereinrichtung von einem zweiten Computer einer Datenzentrale eine Signatur anfordert, wobei die Anforderungsdaten mindestens eine Informationsgruppe mit Postempfängeradressendaten und Identifikationsdaten einschließen,
• Erzeugung einer Signatur auf der Basis verifizierter Daten unter Verwendung eines asymmetrischen Kryptoalgorithmus und geheimen privaten Schlüssels, sowie
• Rückübermittlung der verifizierten Daten und der Signatur zur Frankiereinrichtung, wobei die Authentizität der zurückübermittelten Daten anhand der Signatur unter Verwendung eines öffentlichen Schlüssels überprüfbar ist, sowie
• Speicherung authentischer empfangener Daten in einer lokalen Datenbank.

The method according to the invention for generating a valid database for franking imprints comprises the following steps:

• Formation and transmission of request data with which a first computer of the franking device requests a signature from a second computer of a data center, the request data including at least one information group with mail recipient address data and identification data,
• Generation of a signature based on verified data using an asymmetric crypto algorithm and secret private key, as well
• Retransmission of the verified data and the signature to the franking device, the authenticity of the retransmitted data can be checked using the signature using a public key, and
• Storage of authentic received data in a local database.

It is provided that the validity of data is checked by the second computer in the data center and, if necessary, that the signature is generated by the second computer in the data center from the requested data. This ensures that the valid data received from the terminal, which has to be partially returned, have been linked to one another by the second computer in the data center using the signature. The first computer receives valid data according to the request via modem. It is further provided that a comparison is made by the first computer on the basis of data from the information group transmitted to the data center and data from a received information group, the signature being used to carry out an authenticity check with respect to the received information group, a public key being used in the authenticity check, which is stored in the central or a local database.
In the event of a discrepancy between the transmitted and received data as a result of the comparison, the database in the local database is only updated if the received data are considered authentic. The first computer then generates a print image from the received data at an arbitrary later point in time and initiates printing accordingly.

Keeping the mail recipient address data in the local Authenticity check is based on the signature in the database Personal computer PC 1 ahead. When checking the authenticity, a public key used by the central or one local database is available. The public key can be in one unsecured storage area along with an associated date be saved for validity.

With the public key anyone can go through from the signature Decrypt the message back. For comparison, one Reference message generated from the transmitted clear data by the the same aforementioned special mathematical function for use comes, which reduces the amount of data. If the decrypted message with the reference message formed is the Authenticity of the data given, its validity by the Data center is secured at least for the mail recipient address.

In the same way, the signature in a post office 50 or in a post office or a private institution Postal requester are checked with the authenticity check at the same time, whether billing has taken place in the data center. To this end enters the signature a monotonously variable, which open at the same time in plain text on the mail piece but at least is machine-readable. Such a size are, for example the time data at the time the signature is retrieved from the central Database or the number of pieces. At the same time, the printed time data or number of pieces or another size in the Data center the accounting data can be retrieved and thus the Payment of the service can be checked in detail.

The post office 50 or commissioned institute can do this via the data center Call the communication connection to see the data stored in their database Query data.

An example of an impression on a piece of mail is shown in FIG. 2 explained. In the case of a letter, the address field is arranged centrally. The Postempfängeradersse is in plain text and an associated ZIP code is printed as a barcode. The franking imprint is in the periphery arranged at the top right. A sender information in the periphery on the left arranged at the top is optional. For the USPS, it is about 1 inch wider Franking imprint generated with a machine-readable area. Certain clear data and the signature are e.g. into a PDF 417 symbolism implemented and printed. The latter is from Symbol Technologies, inc. have been described in more detail in EP 439 682 B1. about the machine-readable area is the visually (human) readable area and an area for the FIM code in accordance with U.S. Postal Regulations arranged. To the left of this is another print area, which preferably used for printing an advertising slogan can. Because of the FIM code for an approx. 1 inch wide Franking imprint an approximately 11 to 14 mm wide visually (human) readable Area. Thus, the remaining width for the machine readable Range can be used.

The request data transmitted to the data center can be in one preferred first embodiment additionally the post value, others Mailing data and a monotonously continuously variable size lock in. The post value and other mailing data (EXPRESS, AIR MAIL, ..,) are on the keyboard 14 of the Personal computer PC 1 entered by the user for each letter.

The storage of the billing or accounting data accordingly further services are carried out in the central database. Since the Billing of mail transport in the data center customer-specific the accounting data can be manipulated in Intention to forgery can be excluded. A local postage box or a meter is unnecessary for the user of the franking device. The Hard disk 23 contains storage areas provided for booking, according to the agreed billing type and type of service. At least one exists to increase security against data loss further - not shown - hard drive 23 'in the data center, in which all data is saved redundantly.

A billing type for the aforementioned mail transport service is a cumulative settlement at the end of the month, with the cumulative Amount from a customer account with a bank or a comparable one Credit institution is debited according to the direct debit procedure. It can also use a different billing method, for example instant payment or prepayment. With the customer can have a corresponding agreement on different types of billing for different services.

It is provided in a second embodiment that Shipping data transmitted and also the service of a Postage calculation is carried out in the data center, the accumulated service costs periodically, for example on End of day, the customer will be billed. It is for that advantageous that the request data, which together with the Address data and further dispatch data to the data center are transmitted, also include identification data ID. Under Identification data ID should be an identification number of the customer or the mail sender or the machine serial number, or the Sender address can be understood. To rule out fraud, where another sender is faked, it is still intended that such identification data is also included in the signature. The data center generates a signature from the transmitted Request data, such as mail recipient address and identification data, as well as a generated monotonously continuously variable size and the Postage value using a private key and an asymmetric Encryption algorithm.

But if, on the other hand, as in the first variant, the Postage calculation service not in the data center but instead Such costs can not be carried out in the franking device are imposed on the customer, but rather a discount is too grant as the computer's data center through such Calculations are not unnecessarily blocked.

In the second embodiment it is provided that the received partially returned data one in the Data center calculated postage value, a recipient address, Identification data, data center a monotonously continuously changeable Include size and signature, where the data center is the monotonously continuously variable size generated and from the transmitted Request data such as mail recipient address and identification data as well as the postage value from other transmitted shipping data determined a valid tariff. In a maximum variant, the Request data generated for several letters that the user sent to has created his personal computer PC 1, which is also a component the franking device. Then according to the number of letters also assigned a number of different signatures to the Address and franking data generated. Leave the returned data assign themselves to the different letters via the address data.

The number and the format and weight of the individual letter pages per letter transmitted become. The letter weight can be determined from this in the data center, without a mail scale to the local user Franking device must be connected. Possibly opened the data center during the communication a user dialog via the Display 12 with the user to complete the data which are required for postage calculation.

In a minimal variant, only a signature for the following is used Information postal recipient address, post value, identification data, Quantity value requested. The quantity value is one by one Numerator generated unencrypted piece number print. Through a Numerateur is already providing adequate protection against copies of the Impression reached. When the collected mail is picked up by a Mail carrier employees could already use the sender identification information and the count reached by the numerator with the printed values are compared.

The probability is also low that at the same time Send a mail item of the same size and weight to the is sent to the same mail recipient. The probability can go further can be reduced by requiring that the time data be additional be printed on the mail piece. The time data can alternatively by an exact clock - not shown - from the data center to be provided.

It is provided in a further variant that all of the mail piece data to be printed are previously stored centrally. By doing The post office can deliver the delivered mail centrally stored data are checked whether copies of a Imprint can be used with the intention of forgery. To every one posted Mailpiece can have an entry in the central database in one special area. A double entry in the The database then indicates a forged imprint. Through the Linking the postal recipient address with the post value and number of items about the signature, it is impossible to separate one of the both postal address or post value for manipulation purposes copy.

It is further contemplated that each key pair consisting of a private key and a public key, in time is valid for a limited time and suddenly at a specific date and time can be changed from the data center. The time intervals of the change result in accordance with the currently achieved Advances in modern analytical methods, such as the differential cryptanalysis, and are sized to attack the security of the system is likely to fail.

The invention is not limited to the present embodiment, since obviously other arrangements or designs of the Invention can be developed or used by the same Basic ideas of the invention, starting from the attached Claims are included.

Claims (10)

Franking device, with a first computer and with a connected printer, the computer containing a memory with a local database for mail recipient address files and a communication means, the first computer being connected via the communication means to a data center which has a second computer with a central database ,
characterized in that the first computer is programmed, access a saved specific mail recipient address or temporarily store a newly entered specific mail recipient address, To transmit request data of the mail sender to the data center by means of communication, the request data comprising the identification data of the mail sender and mailing data, including the specific mail recipient address, in order to confirm the correctness of the mail recipient address by means of the second computer or to produce it on the basis of an address file stored in the central database, To receive data relating to a valid mail recipient address from an address file stored in the central database, a valid postage value and a signature, the second computer of the data center only providing the requested data with a signature if a valid mail recipient address is stored in the central database, generating a notification when automatic correction of a mail recipient address is impossible, to process the data received from the central database, including the signature, in order to print an authentic franking imprint on the mail item. Franking device according to claim 1, characterized in that the first computer is further programmed to check the authenticity of the received data transmitted to the franking device on the basis of the signature and to update the address file in the local database with respect to the determined mail recipient address if authenticity is present. Franking device according to claim 1, characterized in that the first computer is further programmed to form the request data, the mailing data including the desired franking value. Method for generating valid data for franking imprints, request data being formed by a franking device and transmitted to a data center and requested data being transmitted back and stored, characterized by the steps: Formation and transmission of request data with which a first computer of the franking device requests a signature from a second computer of a data center, the request data including at least one information group with mail recipient address data and identification data, Verification of transmitted data in a data center, Generation of a signature based on verified data using an asymmetric crypto algorithm and secret private key, as well Retransmission of the verified data and the signature to the franking device, the authenticity of the retransmitted data can be checked using the signature using a public key, and Storage of authentic received data in a local database. Method according to claim 4, characterized in that that the validity of data is checked by the second computer in the data center and, if necessary, that the signature is generated by the second computer in the data center from the requested data, the data to be partially transmitted by the second computer in the data center being linked to one another by means of the signature , that the first computer receives valid data according to the request via modem, that a comparison is made by the first computer on the basis of data from the information group transmitted to the data center and data from a received information group, an authenticity check being carried out with respect to the received information group by means of the signature, a public key being used in the authenticity check, which key is used in the central or stored in a local database, that in the event of a discrepancy between the transmitted and received data as a result of the comparison, the database in the local database is only updated if the received data are considered authentic, and that a print image is generated from the received data by the first computer and printing is initiated accordingly. Method according to Claim 5, characterized in that the request data transmitted to the data center additionally include the postage value, further mailing data and a monotonously continuously variable size. Method according to claim 5, characterized in that the partially returned data received include a postage value calculated in the data center, a recipient address, identification data, data center a monotonously continuously variable size and a signature, the data center generating the monotonously continuously variable size and from it transmitted request data, such as mail recipient address and identification data, as well as the postage value determined from other transmitted data according to a valid tariff, as well as from the transmitted request data, such as mail recipient address and identification data, as well as the monotonously continuously variable size generated and the postage value using a private key and an asymmetrical encryption algorithm generated a signature. Method according to claims 6 or 7, characterized in that the monotonously continuously variable variable is a time-related variable. Method according to claims 6 or 7, characterized in that the monotonously continuously variable size is a number of billed mail items. Method according to claims 4 and 5 or 7, characterized in that each key pair comprising a private key and a public key is valid for a limited time and can suddenly be changed by the data center at a specific date and time.

Images