EP1118964B1 - Method and device for validating a security print - Google Patents

Description

The invention relates to a method for checking a security imprint in a postal authority or similar institution, in the manner specified in the preamble of claim 1. The security imprint includes a marking and is generated by means of a franking machine.

In particular, the invention relates to franking machines which provide a fully electronic printed impression for franking mail, including printing an advertising cliché and a mark. The franking machine is equipped with at least one input means, an output means, an input / output control module, with memory means, a control device and a Druckerm module.

A franking machine usually generates a print in a form agreed with the post office right-justified, parallel to the top edge of the mail starting with the content postage in the postmark, date in the day stamp and stamp imprints for advertising clichés and possibly transmission type in the Wahldruckstempel. The postal value, the date and the type of shipment form the variable information to be entered in accordance with the item of mail.

The postage value is usually the forwarding charge prepaid by the sender (Franko), which is taken from a refillable credit register and used to clear the postal consignment.

The date is a current date or a future date in a postmark. While the current date is automatically provided by a clock / date block, a manual pre-dating must be used to set the desired future date. Interesting is the pre-dating in all cases where the amount of mail is processed and franked very early, but must be sent to a specific date. The embedding of the variable data for the date in the date stamp can basically be done as well as when the post value is printed.

The approved advertising clichés may include messages of various kinds, in particular the address, the company logo, the mailbox and / or any other message. The advertising cliché is an additional information in the postal sense, which must be agreed with the postal authority.

From the US 4 580 144 is an electronic franking with two thermal printing devices known, with the first printed the fixed image part (Posthoheitszeichen and picture frame) and the second, the variable printed image part (postage and date) in succession. Through this division and separate treatment of the variable and constant data, the printing speed can be increased. However, due to the lack of a "fingerprint" hereby no security imprint itself is given.

From the DE 38 23 719 On the one hand, a security system with a character printing authorization device is known. A computer of the franking machine is assigned a memory for the data to be loaded of the graphic change and the data of the associated date. When the user asks for a change of funds, the computer of the postage meter machine accesses an external dialing device via a connection device (modem) which makes a selection of a character pattern to be printed. The disadvantage here is that the user of the franking machine no freedom of choice for the selection of the character pattern is granted. It is envisaged that the printed character pattern will be used to verify the security of the franking machine. Here, however, the entire printed that special character pattern containing print image is evaluated by the postal authority, which is possible only with great effort.

On the other hand, it has already been proposed for franking machine imprinting to apply certain hidden or cryptified characters, bar codes, with several print heads as visible or invisible markings on the mail item, in order to be able to identify counterfeits.

So will in the US 4,775,246 is an alphanumeric number in the US 4,649,266 a single alphanumeric digit in a number additionally printed in the postmark, whereby in the comparison by the postal official of such numbers or numbers subjective errors are not excluded. In the US 4,934,846 (ALCATEL), on the other hand, a machine-readable barcode is already printed in a separate field next to the postage stamp, which disadvantageously reduces the available print area for the postmark and / or the advertising cliché.

To apply such a bar code by means of a separate printer is from the US 4,660,221 and from the US 4,829,568 In addition, in the latter patent, a character with offset elements is printed, whose offset contains the relevant safety information. The imprinting device is alternately supplied by means of a selection device variable data from a memory device and on the other hand, data from an encryption circuit. In the designated field for the variable data, alphanumeric characters with mixed areas (SPECKLE) are generated and printed on the print medium. The evaluation is carried out according to US 4 641 346 by reading such a character column by column and comparing it column by column with stored characters to recover the security information. In this case, the data originating from the encryption circuit are separated again, for which purpose a further device is required. The evaluation is accordingly complicated and only by means of complex equipment and skilled postal authorities to accomplish.

For a batch mail processing with a service device, according to US 4,760,532 , by which not every mail item must be individually franked, but instead a postage and an additional passport is printed, it has already been proposed to print a zip code in bar code format on the mail. It can be used with a fast, relatively inexpensive unsecured printer, with the addition of the recipient address is printed. If there is evidence of tampering with the service unit billing unit, an incorrect postcode will be printed in bar code form. The data on the stack of mail listed on the passport with a secure printer are simultaneously transmitted electronically from the service device to the central station after being processed by each batch. Thus, in the post office, if necessary, a comparison of the data printed on the passport with the data stored electronically in the central station can be made if a post marked as being manipulated is detected.
This so marked invalid manipulated mail can be sorted out in the post office but only if the entire post is constantly checked in the post office. Judging by the result of this effort is much too high, especially since only a manipulation of the service device but other types of manipulation of the post on the way to the post office can not be determined.

It is from the EP 540 291 a device for the analysis of post office use for counterfeiting purposes is known, which is based on a Nachkalkulationssystem. Also, the functioning of the system relies on scanning the entire mail stream again. The individual franked values are scanned, summed up and then with the reload amount for the corresponding Franking machine compared. Although data is entered automatically with an Optical Character Recognition (OCR) reader and a sophisticated computing technique is employed, this type of data collection is relatively uncertain and too slow for a post office, especially since the entire post would need to be evaluated in this way.

The printing of crypted data is done according to the US 4,725,718 in the address field. It is also known to carry out a comparison of plain text data with the crypted representation of this data, including the address data, for evaluation. Although a relatively large amount of space is consumed for the crypted data in the address field and the generation of the crypted data must be complicated and using a special encryption module, this system is not completely forgery-proof, because it generates a composed of segments encrypted text from the individual output data related to the aforementioned segments, which could be explored by long-term observation. This also applies if the impression is made as a barcode or in another machine-readable form. For franking machines without address printing - since no inclusion of the address data in the encryption is possible - this solution is unsuitable. Already in operation franking machines with non-mechanical printing principle can not be used due to the required additional special encryption module to generate a mark for a security print. Finally, the problem remains unresolved that the presentation of additional information, especially in the form of a bar or. Barcodes, relatively much space required.

One from the US 4,949,381 known security system uses imprints in the form of bitmaps in a separate Marking field under the franking machine stamp imprint. Although the bitmaps are packed particularly tightly there, the required relatively large marking field reduces the height of the stamp image by the height of the marking field. So much of the usable for an advertising cliché area is lost. Another disadvantage is the necessary high-resolution recognition device for evaluating the mark with the two-dimensional barcode, which is unacceptable for smaller post offices, which can not drive the cost of an automatic evaluation. Thus, there remains the disadvantage that such code only mechanically, that is no longer manually verifiable.

According to US 44 61 028 ( DE 31 41 017 ), an inspection is carried out with the aid of reference samples which have already been used in the examination of a preceding stamp impression. If variable data is printed in encrypted form on every print and if the evaluation has to be done in real time, this method is unsuitable.

Another security system uses imprints in the form of a diagram ( US 5 075 862 ) within the postage meter stamp imprint. But if individual printing elements have failed, dots are missing in the printed image, which can lead to a signaling of alleged falsification. Such markers within the franking machine stamp imprint are therefore not so secure. Even with a faultless impression, the machine evaluation is difficult because always the entire print image is evaluated.

Furthermore, in the DE 40 03 006 A1 a method has been proposed for marking mail to enable identification of postage meters, wherein a multi-digit crypto number including the date, the machine parameters, the postal value and the advertising clichés formed and cached separately becomes. Via a printer control setting the printer means, the crypto number is additionally inserted into the print pattern during printing. Thus, a forgery or any imitation of the postage meter stamp can be detected by a non-invoiced Postwertaufdruck means of Kryptozahl. Even with a large number of users of a single postage meter machine, the user who has manipulated the postage value can be easily found out. However, this is neither a fully electronically generated print image for an impact-less printer, nor can such a print image be evaluated electronically in a simple manner.

For a fully electronically generated print image is already in the DE 40 34 292 for technical safety reasons it has been proposed to store only a constant part of the franking image in the franking machine and to send the other associated variable part from the data center to the franking machine in order to assemble the final printed image. The fully electronically generated advertising cliche belongs in this solution but also to the constant data of the franking picture, as the frame arrangement of the value and the day stamp with location and possibly the postcode.

For the print data compilation, a communication of the terminal device containing a franking module with a central station is necessary for each franking. This delays the pressure, which also makes this solution unsuitable for mass franking of large mail volumes.

At one of the US 4,746,234 known franking machine fixed and variable information in storage means (ROM, RAM) are stored, to this, when a letter on the transport path before the printing position actuates a micro-switch, by means of a microprocessor read and to form a pressure control signal. Both are then composed electronically to a printed image and can be printed by thermal printing medium on an envelope to be franked. With many variable window image data to be included, the formation of the pressure control signal is delayed accordingly. The maximum achievable with the same postal data printing speed is limited in particular by the time required in the formation of the pressure control signal. It would be an additional material effort to operate or reduce the printing speed to be accepted if the data is to calculate a crypto number to produce a mark for a security print. In both cases, such a machine (high price and / or too slow) would ultimately be expected to lack acceptance by customers.
The advantage of such a marking is that a franking stamp printed by a postage meter machine could not be changed by a manipulator without a corresponding change in the marking, since a franking stamp with a non-applicable marking changed in the forgery intent can basically be recognized. On the other hand, it would be necessary to identify the manipulated franking machine whose function was intervened for manipulation purposes.

It is already in the US 4,812,965 a remote inspection system for franking machines has been proposed, which is based on special messages in the impression of mailpieces that must be sent to the headquarters. Sensors within the franking machine should detect any adulteration action taken, so that a flag can be set in associated memories if the postage meter machine intervened for manipulation purposes. Such an intervention could be done to load an unpaid balance into the registers. Disadvantageously, such a system can not prevent a sufficiently skilled manipulator, which breaks into the franking machine, from subsequently removing its left-over tracks by deleting the flags. Also, it can not be prevented that the impression itself is manipulated, which is produced by a properly operated machine. In known machines, there is the possibility of producing impressions with the postage value zero. Such zero frankings are needed for testing purposes, and could also be counterfeited by simulating a postage value greater than zero.

It was the object to overcome the disadvantages of the prior art and to achieve a significant increase in safety, without performing an extraordinary on-site inspection.

The object is achieved with the features of claim 1 for the method.

Aspects of the invention set forth in claim 1.

A first variant of the verification of a security imprint with a marker symbol series begins with a transmission of information from the data center to the postal authority, with respect to those franking machines that have no longer reloaded credits or have no longer reported to the data center and therefore appear suspicious.

The solution according to the invention is based on the recognition that only data stored centrally in a data center can be adequately protected against manipulation. Corresponding register values are queried during a communication, for example as part of a remote value specification of a recharge credit.

The accumulated amounts of credit, which accumulate in the franking machine, are ultimately consumed during franking. Thus, in a calculation by the data center, the average credit inflow is compared with the outflow of credit (postage consumption) in order to analyze the previous use of the franking machine and to predict future user behavior.

The franking machine, which receives a regular credit recharge or regularly reports to a data center, can be classified as unsuspicious. However, the franking machine which continues to operate without recharging beyond a predefined reload date does not necessarily have to be manipulated. Rather, if necessary, the mail volume to be processed by the postage meter machine may have reduced above average. If, therefore, sufficient residual value credit is still available in the franking machine, a user must of course be allowed to continue debiting this. Only an extraordinary on-site inspection could clarify in this case whether a manipulation exists. However, this inspection may defer a franking machine user with irregular postage and credit card recharge behavior when reporting to the data center as soon as he receives the information that his postage meter machine is suspect. The data center then performs a remote inspection. For safety reasons, it is proposed according to the invention that both measures, i. a remote inspection of the franking machine by the data center and a check of the mail pieces in the post office or an institute commissioned to perform.

The invention is based on the one hand on the consideration that the user who has manipulated, either an increased effort to bear if he tries to undo his manipulation to report in time to the data center, which queries the register values, or would only irregularly or no longer report. At the same time it is envisaged to make intervention in the franking machine function for manipulation purposes even more difficult by the safety construction of the franking machine by means of the sensor and the detector device. Thus, a significant increase in security can be achieved without an extraordinary on-site inspection.

On the other hand, a security print is made with separate areas for the marking information from the postage meter on the mail piece. By checking a series of markings by a competent authority, preferably at the post office, the on-site inspection of the postage meter can be replaced. Only in justified cases (manipulation) would then be made by an inspector or for inspection on the spot authorized person nor a direct inspection of the franking machine on site.

Because only a separate area containing only the marking information is to be evaluated, the postal authority can easily and relatively easily distinguish between the counterfeited manipulated and unmanipulated postage meter imprint. With the series of symbols used as marking information, an evaluation is easily possible, also with regard to an indication of a machine that was mimicked by the manipulator or that itself was manipulated and with regard to an indication of the machine, which was continued by the user beyond the remote inspection date.

The security symbol-printed mark symbol series is based on a compressed combination representation on an encrypted combination number whose digits are predetermined for an assignment of evaluable sizes. A marker symbol string may be generated via a routine by the microprocessor of the postage meter machine without the use of an additional encryption circuit. In this case, different variants of marking information are possible, which can be recovered from a marker symbol series.

• augenblickliche Summenwert an Frankierungen
• augenblickliche Summenwert an Frankierungen seit dem letzten Nachladedatum
• noch vorhandener Restwert, der zum Frankieren verbraucht werden kann
• augenblickliche Datums/Zeitdaten
• augenblickliche Datums/Zeitdaten seit dem letzten Nachladedatum
• physikalische zeitlich determiniert sich ändernde Daten

It is essential in addition to the actually to be checked postage value, which forms the one size, while a monotone continuously variable size. A certain monotone continuously variable size and other sizes form certain marker information variants. For the monotone continuously variable size, the following sizes are possible:

• instantaneous total value of frankings
• instantaneous cumulative value of postage since the last reload date
• Remaining residual value that can be consumed for franking
• current date / time data
• current date / time data since the last reload date
• physical time determines changing data

• Datum des letzten Nachladezeitpunktes
• Guthabennachladedaten zum Datum des letzten Nachladezeitpunktes
• eine bestimmte physikalische Größe, welche zum Datum des letzten Nachladezeitpunktes gemessen wurde und nur der Frankiermaschine und der Datenzentrale bekannt ist.

The representation of this monotone, continuously variable variable takes place in the form of a first number, which can optionally be added for certain meaningful combinations, a second number relating to:

• Date of the last reload time
• Credit recharge data on the date of the last reload time
• a certain physical quantity measured at the date of the last reload time and known only to the postage meter and the data center.

Each digit or each number formed by predetermined digits within the combination number is assigned a meaning in terms of content. Thus, later in an evaluation, the information relevant for further evaluation can be separated.

Due to the monotonously continuously variable size, the mark changes at each pressure, which makes such a franked mail piece unmistakable, while providing information about the previous credit balance and the last credit recharge data at the time of the last credit recharge or certain additional data such as the last recharge date / time, etc.

However, the aforementioned information about further data can also be requested from the data center by the post office or the institute commissioned with the verification. In this case, if the corresponding size forming a second number is stored in the data center, the monotone variable need only be included in part to form the combination number, but then only the part of maximum change to form a first number is included.

Another third number assigned at predetermined positions of the combination number corresponds to the size of the postage value. A fourth number corresponds to the information about the corresponding postage meter identification number (serial number). The information can be printed in the franking stamp additionally or exclusively as a barcode. Such information may also be the checksum or any other appropriately derived number from the identification number, as all that matters is to check the franking stamp on the mail piece or, indirectly, the postage meter by means of the impression of manipulation. If manipulation is detected, it must also be possible to open the mail piece to identify the true sender.

• die Frankiermaschine übermittelt ihre Registerwerte an die Datenzentrale zwecks Überprüfung,
• Ermitteln des Zeitpunktes der nächsten Kommunikation durch die Datenzentrale und/oder Frankiermaschine,
• die Datenzentrale prüft die Verdachtsmomente und meldet dies der Frankiermaschine oder löst eine außerplanmäßige Überprüfung der Frankiermaschine vor Ort aus,
• durch das zuständige Postamt oder ein damit beauftragtes Prüfinstitut wird der Sicherheitsabdruck auf Basis einer Stichprobenkontrolle oder auf Basis einer Information von der Datenzentrale, daß die Frankiermaschine als verdächtig eingestuft wird, überprüft,
• Auswertung der zusätzlich im Sicherheitsabdruck enthaltenen speziellen Zeichen, oder des Fehlens solcher speziellen Zeichen, falls die Frankiermaschine selbst eine Manipulation feststellt,
• Ermittlung des wahren Absenders im Falle einer Manipulation.

The review process therefore includes the following steps:

• the postage meter communicates its register values to the data center for verification,
• Determining the time of the next communication by the data center and / or franking machine,
• the data center checks the suspicions and reports this to the franking machine or triggers an unscheduled check of the franking machine on site,
• the security impression is checked on the basis of a random check or on the basis of information from the data center that the franking machine is classified as suspicious by the competent post office or a testing institute
• Evaluation of the special characters additionally contained in the security print, or the absence of such special characters, if the postage meter itself detects a manipulation,
• Identification of the true sender in case of manipulation.

For the time-critical generation of the marking data, the microprocessor of the franking machine is used to form at least one combination number of the predetermined sizes after the completion of all inputs and to encrypt them according to an encryption algorithm to a crypto number, which is then converted into a marker symbol series. To verify a security imprint, a random or centrally initiated check of mail pieces is provided to recover the individual information from the printed mark of a security imprint in a postal authority or similar institution and to compare it with the information printed on the mailpiece.

The verification of the marker symbol series by the postal authority is based on a second variant exclusively on random samples. In the random sample inspection of any arbitrarily selected mail piece is examined for manipulation, without there has been any other evidence of manipulation or suspicion.

After collecting all symbols of a symbol series and converting them into data, they can be decrypted with the appropriate DES key. As a result, the COMBI number is available, from which the sizes, in particular the sum of all franking values and the current postage value are split off. The split size of the postage value is compared with the open value of the postage.

The value of a split-off current quantity, for example the sum value of all franking values which have been carried out since the last reloading, is subjected to a monotonicity check by means of data of the last detected value of this variable. This excludes' that, for example, by fraudulently copying the franking imprint by means of a color copier seemingly genuine copies arise that would not be distinguished from the original. Between the current size enprinted in the mark and the last detected size, there must be a difference in at least the amount of the postage value. In the aforementioned case, the last detected quantity of the total value of all previously made frankings stored in the data center at the last remote query of the register statuses is. Likewise, if the corresponding size has been separated from the COMBI number after decryption, the counterfeiting of the franking machine serial number can be detected by means of a comparison by means of a comparison.

If no manipulation could be detected with respect to the identification of the serial number of the franking machine, the postal authority or the institute commissioned with the check transmits the corresponding franking machine serial number of the data center. With this information, the mail items (letters) could be checked indirectly in cooperation with the data center.

If there is no doubt that the imprint has been tampered with, the sender indicated on the item will be checked. For this purpose, the co-printed serial number of the franking machine can serve, if it is possible to identify the sender or, if available, the sender printed in clear text on the envelope. If such an indication is missing or if the franking machine serial number has been manipulated, the letter can be opened legally to determine the sender.

The aforesaid marking is preferably printed in the form of a series of symbols in a field of the postage meter image simultaneously with it by the single printer module. The shape of the symbols with their orthogonal edges enables pattern recognition with minimal computational effort.

Already an integral measurement of the degree of blackening with a simple opto-electronic sensor (for example a phototransistor) and a downstream A / D converter allows a particularly simple and fast machine readability. For this purpose, the symbols have been designed to be uniquely different in their integral degree of blackening (proportion of the printed area on the area of the character field). Each symbol corresponds to a specific value at the output of the A / D converter. With the symbol series, a higher information density is achieved compared to the bar code, thus saving space in the franking machine print image. On the other hand, more information can be printed coded using the graphical symbols.

A further advantage over a bar code is the good readability of the individual symbols arranged in the marking field, due to the symbolism of the image content, and the possibility of this to capture the image content for manual evaluation. Through the symbolism, in addition to the machine, a visual evaluation by a trained examiner, who evaluates the form and the conceptual content of the symbols, is made possible in the post office.

On the one hand were a machine-readable as well as manually readable and decodable form of the marking, which can be visibly applied to the mail piece or the franking strip together with the franking imprint, and on the other hand a solution for assembling constant and quickly changeable editable data for franking machines and for their printing control to develop for a column-wise printing of a franking impression image. The aforementioned solutions to the prior art are either too expensive to achieve a high printing speed or have multiple printers or are unsuitable for a time-optimized assembly of constant and variable data to form a pressure control signal for a single printer. To overcome the disadvantages of the prior art, i.a. also provided a method and an arrangement for producing a security impression.

The invention is based on the fact that, after the franking machine has been switched on, the postage value in the value impression corresponding to the last input before the franking machine is switched off and the date in the date stamp are given in accordance with the current date that the variable data is stored in the fixed data for the impression the frame and for all remaining unchanged data electronically embedded. These variable data of the window contents are hereinafter referred to as window data and all the fixed data for the value stamp, the day stamp and the advertising cliche stamp are referred to as frame data. The frame data is a first memory area of a read-only memory (ROM), which also serves as a program memory, removable. The window data are taken from a second memory area and correspond to the input stored in a non-volatile main memory and this at any time for the purpose of an assembly to an overall representation of a franking picture removed.

According to the invention, it is proposed to transfer hexadecimal window data in run-length-coded form into the respective separate memory areas of a non-volatile main memory and to store them there. If no new input is made, a transfer takes place in a volatile pixel memory and an arrangement of the window data corresponding to the predetermined assignment in the frame data. However, it is possible by the invention to work time-optimized, so that the printing speed is high. According to the invention, the data from both memory areas are assembled according to a predetermined assignment before the printing to a pixel print image and completed during the printing to a column of the entire franking machine print image. Those variable data embedded in the print column during printing include at least the marking data. The time required for the previous composition of the entire pixel image with the other data is reduced accordingly. The previous composition is similar to the date in the postmark and as the postage value in the value impression, the variable information can be subsequently supplemented and modified in the appropriate window. In order to save time, only the parts of a graphical representation are re-stored in the nonvolatile RAM when they are changed, which are actually changed.

Figur 1,

Blockschaltbild einer ersten Variante der erfindungsgemäßen Frankiermaschine,

Figur 2,

Kommunikation bei einer Auswertung des erfindungsgemäßen Sicherheitsabdruckes

Figur 3a,

Darstellung eines Sicherheitsabdruckes mit einem Markierungsfeld

Figur 3b

bis 3e, Weitere Varianten der Anordnung von Markierungsfeldern für Sicherheitsabdruck

Figur 3f,

Darstellung eines Satzes an Symbolen für ein Markierungsfeld im Werbeklischee

Figur 4a,

Aufbau einer Kombinationszahl,

Figur 4b,

Sicherheitsabdruck-Auswerteschaltung,

Figur 4c,

Teilschritt zur Markierungssymbol-Erkennung,

Figur 4d,

Sicherheitsabdruck-Auswerteverfahren,

Figur 5,

Ablaufplan für die Druckbilderstellung nach der ersten Variante der erfindungsgemäßen Frankiermaschine mit zwei Pixelspeicherbereichen,

Figur 6,

Ablaufplan nach einer zweiten Variante der erfindungsgemäßen Frankiermaschine mit einem Pixelspeicherbereich,

Figur 7,

Postwertzeichenbild mit zugeordneten Druckspalten,

Figur 8,

Darstellung der auf ein Pixelspeicherbild bezogenen und davon getrennt gespeicherten Fensterkennwerte,

Figur 9a,

Dekodierung des Steuercode, Dekomprimierung und Laden der festen Rahmendaten sowie Bildung und Speicherung der Fensterkennwerte,

Figur 9b,

Einbettung von dekomprimierten aktuellen Fensterdaten vom Typ 1 in die dekomprimierten Rahmendaten nach dem Start der Frankiermaschine bzw. nach dem Editieren von Rahmendaten,

Figur 9c,

Einbettung von dekomprimierten variablen Fensterdaten vom Typ 1 in die dekomprimierten Rahmendaten nach dem Editieren dieser Fensterdaten vom Typ 1,

Figur 10,

Bildung neuer kodierter Fensterdaten vom Typ 2 für ein Markierungsbild,

Figur 11,

Dekodierung von Steuercode und Umsetzung in dekomprimierte binäre Fensterdaten vom Typ 2,

Figur 12,

Druckroutine für das Zusammensetzen von Daten aus den Pixelspeicherbereichen I und II,

Figur 13,

Druckroutine für das Zusammensetzen aus einem Pixelspeicherbereich I und Arbeitsspeicherbereichen entnommenen Daten,

Advantageous developments of the invention are characterized in the subclaims or are presented in more detail below together with the description of the preferred embodiment of the invention with reference to FIGS. Show it:

FIG. 1,

Block diagram of a first variant of the franking machine according to the invention,

FIG. 2,

Communication during an evaluation of the security imprint according to the invention

FIG. 3a,

Presentation of a security impression with a checkbox

FIG. 3b

to 3e, Other variants of the arrangement of marking fields for security imprint

FIG. 3f,

Representation of a set of symbols for a checkbox in the advertising cliché

FIG. 4a,

Structure of a combination number,

FIG. 4b,

Security imprint evaluation circuit,

FIG. 4c,

Sub-step for marker symbol recognition,

FIG. 4d,

Security imprint evaluation methods,

FIG. 5,

Flowchart for the printing image production according to the first variant of the franking machine according to the invention with two pixel storage areas,

FIG. 6,

Flow chart according to a second variant of the franking machine according to the invention with a pixel storage area,

FIG. 7,

Postage stamp image with associated printing columns,

FIG. 8,

Representation of the window image values related to a pixel memory image and stored separately therefrom,

FIG. 9a,

Decoding of the control code, decompression and loading of the fixed frame data as well as formation and storage of the window characteristics,

FIG. 9b,

Embedding decompressed current window data of type 1 in the decompressed frame data after the start of the franking machine or after the editing of frame data,

FIG. 9c,

Embedding decompressed variable window data of type 1 in the decompressed frame data after editing this type 1 window data,

FIG. 10,

Formation of new type 2 coded window data for a marker image,

FIG. 11,

Decoding of control code and conversion into decompressed binary window data of type 2,

FIG. 12,

Print routine for composing data from the pixel memory areas I and II,

FIG. 13,

Print routine for composing data taken from a pixel memory area I and memory areas,

The FIG. 1 shows a block diagram of the franking machine according to the invention with a printer module 1 for a fully electronically generated franking image, a Advertising cliché and / or a mark for a security impression contains, with at least one actuating elements having input means 2, and with a display unit 3, both of which are coupled via an input / output control module 4, a non-volatile memory 5 for at least the constant parts of the franking image and A character memory 9 supplies the necessary pressure data for the volatile random access memory 7. The control device 6 has a microprocessor μP connected to the input / output control module 4, to the character memory 9, to the volatile random access memory 7 and to the nonvolatile working memory 5, with a cost center memory 10, with a program memory 11, with a transport or feed device optionally with strip trigger 12, an encoder (encoder disc) 13 and with a constantly in operation clock / date module 8 is in communication.

An additionally developed method for improving the safety of franking machines according to the German application P 43 44 476.8 is based on the idea of complicating the falsification of data stored in the postage meter so much that the expense of a manipulator is no longer worthwhile. In connection with this procedure can - in the in the FIG. 1 shown manner - at the input / output control module 4, a sensor 21 are connected to a detector device 20. In another variant but also - in one in the FIG. 1 not shown - be provided on the microprocessor directly or within the microprocessor, a corresponding safety device.

The preferred arrangement for producing a security impression for franking machines has in the program memory 11 a first storage area A (among others for the data of the constant parts of the franking image including the advertising cliché frame). The sub-memory areas A _i are provided for i = 1 to m frame or fixed data, wherein an associated index i identifies the respective frame, which is preferably assigned to a specific cost center. Usually, a cost center number is entered in order to select the advertising cliché, among other things. However, an advantageous method for user-oriented billing has already been proposed in which the selected cliché is examined in order to automatically determine the cost center under which billing is to be carried out.

In the character memory 9 all alphanumeric characters or symbols are stored pixel by pixel as binary data. Data for alphanumeric characters or symbols are stored in non-volatile main memory 5 compressed in the form of a hexadecimal number. As soon as the number of the cost center has been entered or stored in the memory area C, the compressed data from the program memory 11 is converted by means of the character memory 9 into a print image having a binary pixel data which is stored in such a decompressed form in the volatile random access memory 7.

In accordance with the position report on the feed of the mail or paper strip in relation to the printer module 1, supplied by the encoder 13, the compressed data are read from the main memory 5 and converted by means of the character memory 9 into a print image having a binary pixel data, which is also printed in such a decompressed form volatile memory 7 is stored. In order to explain the invention, memory 7a, 7b and pixel memory 7c will be used below, although physically this is preferably a single memory module.

The main memory 7b and the pixel memory 7c communicate with the printer module 1 via a printer controller 14 having a print register (DR) 15 and output logic. The pixel memory 7c is connected on the output side to a first input of the printer controller 14, at the other control inputs output signals of the microprocessor control device 6 abut.

The once called constant parts of the franking image and advertising clichés are in the pixel memory area I in the volatile pixel memory 7c decoded permanently available. For a rapid change of the window data, a second memory area B exists in the non-volatile main memory 5. The pixel memory area I in the pixel memory 7c is also provided for the selected decompressed data of the variable parts of the franking picture, which are marked with the indicator j. The second pixel memory area II in the pixel memory 7c is provided for the selected decompressed data of the variable parts of the franking image, which are identified by the indicia k. These are the marking data formed just prior to printing the security print.

It has already been proposed to provide a method and an arrangement for the rapid production of a security impression with only one microprocessor and one printing module of a franking machine ( EP 576 113 ). The embedding of the print data of the marking information in the remaining print data is preferably carried out during the printing of the respective column.

By means of the fully electronically generated printed image, the variable mark data can be realized in one or more windows within a fixed area by the franking machine print image in order to realize the security print given frame during column-wise printing. A significant reason why the printing speed is not lowered by the time required to form the mark data is the development of a time reserve during printing by the microprocessor of the controller which performs column-by-column embedding of window data.

The memory areas B to ST in the nonvolatile random access memory 5 may contain a multiplicity of sub memory areas, under which the respective data are stored in data records. The sub-memory areas B _j are provided for j = 1 to n semivariable window data and B _k for k = 1 to p variable window data, wherein various associations between the sub-memory areas of the various memory areas are selectable and / or predetermined.

The number strings (sTrings) which are input for generating the input data with a keyboard 2 or via an electronic balance 22, which calculates the postage value and is connected to the input / output device 4, are automatically stored in the memory area ST of the non-volatile main memory 5. In addition, data sets of the sub-memory areas, for example B _j , C, etc., are also retained. This ensures that the last input variables are retained even when the postage meter machine is switched off, so that after switching on, the postage value in the value impression corresponding to the last input prior to switching off the franking machine and the date in the date stamp is preset according to the current date.

It is envisaged that the program memory 11 is connected to the control device 6, wherein the data for the constant parts of the franking image, which relate to at least one Werbeklischeerahmen, are stored in a first memory area A _i and wherein an associated name identifies the Werbeklischeerahmen. It is further provided that the non-volatile main memory 5 is connected to the control device 6, wherein the data for the semivariable parts of the franking image are stored in a second memory area B _j and an associated name identifies the semivariable part, wherein a first assignment of the names of consists of semivariable parts to the names of the constant parts. In the postage meter machine, a second allocation can be made according to the cost center number stored in a third storage area C, so that optionally each cost center KST is assigned an advertising cliché.

The corresponding assignment of the respective cost center to the frame data is automatically requested after switching on. In another variant, the cost center must be reentered in memory area C each time it is switched on during the start routine, while it is retained in the case of short-term operating voltage interruptions. The number of printed letters with the respective o.g. Setting the advertising cliché via the cost center is registered in the postage meter machine for later evaluation.

In each record of a sub-memory area A _i , B _j and B _k are successively control code and run-length-coded frame or window data included.

Prior to the first print, the respective selected common frame data for the advertising cliché stamp, for the postmark and the postage stamp are transferred from the non-volatile program memory 11 to the registers 100, 110, 120,..., Of a volatile main memory 7a, control code being transmitted during the transfer decoded and stored in a separate memory area of the working memory 7b. Likewise, the respective selected window data is loaded into registers 200, 210, 220, .... Preferably, the registers of sub-memory areas are formed in the memory area of the main memory 7a. In another variant, these aforementioned registers and / or the volatile memory 7 part of the microprocessor control. 6

By decompressing, the runlength encoded hexadecimal data is converted to corresponding binary pixel data. At this time, the decompressed binary pixel data which remains unchanged for a long period of time can be taken into the second pixel memory area II in a first pixel memory area I and the binary pixel data concerning the marker data which is constantly changing with each footprint: The FIG. 1 shows a block diagram for such a first variant of the inventive solution.

The temporally less variable (semivariable) window data are referred to below as type 1 window data. By contrast, window data of type 2 are referred to below as the constantly changing (variable) window data.

New frame and / or window data of type 1 may be selected as long as there is a need after inserting and storing binary pixel data in the first pixel memory area I. If this is not the case, automatic generation of window data of the type 2 with subsequent decompression and their storage as binary pixel data in the second pixel memory area II follows. In another variant, not shown, the above steps can be repeated, if still none Print request is present. The compilation with the remaining binary pixel data stored in the pixel memory area I preferably takes place after the presence of a print request during a print routine.

By means of the input means 2 and the control device 6, the data in the memory areas C, D and E can be changed. In this case, preferably the same microprocessor of the control device 6, which also executes the billing routine and the print routine is used. The data from the memory areas are combined according to a predetermined (within certain limits freely selectable) assignment during printing to an overall representation of a security footprint. Here, for example, fourth and fifth memory areas D and E of the non-volatile main memory 5 are used. In the fourth memory area D of the non-volatile memory 5 is stored a name that identifies the currently set frame of an advertising cliché, while in a fifth memory area E stores data for a further selectable assignments of at least one advertising cliché part to a frame of the advertising cliché according to the aforementioned name are. It is envisaged that the data from the memory areas according to a predetermined (within certain limits freely selectable) assignment during printing to an overall representation of a security footprint are composed.

The identification of a franking machine usually takes place by means of an 8-digit serial number, which, however, only partially needs to be included in the marking symbol series in order to enable a check of the printed serial number in plain text. For example, this can be the checksum from the serial number in a simple variant. In more complicated other variants, other data goes to education a preferably at least 2-digit information, which allows the verification of the serial number.

In particular, in modification of in DE 40 03 006 A1 1, a marking of postal matter generated on the basis of a crypto-numeral to enable an identification of franking machines without difficulty, if the multi-digit crypto not including the data stored as a hexadecimal number of the entire cliche, but only with the inclusion of selected data values of the stereotype frame and other data as the machine parameter of the value setting and the date is formed and buffered. Not only numbers or numerical values, such as the number of the advertising clichés used, but also data values of the image information for forming the encrypted information can be used with the method according to the invention. In contrast to DE-PS 40 03 006 In order to form the crypto number, any area of the advertising cliché to which separate data is assigned in a data record can be used. For this purpose, individual data are selected from this data record. It is advantageous that the column end for each column to be printed is identified as a control code, which follows the run-length-coded hexadecimal data. In this case, preferably the run-length-coded hexadecimal data that is in the first place of the data record can be used.

In a development of the solution according to the invention, the associated data of the column-wise regional image information from the data set is selected by a quantity present in the machine and / or generated, in particular by the current date, in order to extract at least a number of data (hexadecimal numbers).

Furthermore, several data records can also be assigned to each advertising cliché number, with each data record having those data relating to a subarea of the advertising cliché. In this case, the data record with the associated data of the column-wise regional image information is selected by a quantity present in the machine and / or generated in order to extract at least a number of data (hexadecimal numbers).

Preferably, those run length coded hexadecimal data corresponding to a predetermined print column together with at least some of the machine parameter data (serial number, monotone variable, time data, inspection data such as the number of prints at the last inspection, or suspicious variable) and the postage value become a number in more specifically - in connection with FIG. 10 explained - way combined and encrypted. In the formation of new coded window data prior to their storage in the second memory area II, for example, the DES algorithm (Data Encryption Standard) for encryption and additionally a conversion into a special graphic character set can be used for a high security standard. Thus, the encryption of at least a first, third and fourth number comprehensive combination number succeeds in an 8-byte long record.

By the character memory 9, a conversion of a crypto-number into symbols having symbols is made. In particular, a list selected by another size, advantageously by the postal value, which assigns graphic symbols to the individual crypto numbers, is used. In this case, the encrypted hexadecimal data is decompressed by means of the character memory in order to print the identifier formed from the symbols to be printed. This is also a machine-readable mark.

However, other encryption methods and methods are also suitable for converting the crypto-number into a label.

It is particularly advantageous if the window data of type 2 for the security markings are accommodated in a separate window in the postmark or in the day stamp or between both stamps. Then the entire franking imprint is not enlarged (which is also not allowed by mail) or no additional printing unit, which prints elsewhere in the letter, is required.

In addition, particularly generated encrypted marking data stored in a sixth memory area F can be used to identify, for example, the franking machine serial number. Another possibility is the machine-readable but unverschüsselt printed as a bar code message of the franking machine serial number, the data either from the memory area F of the nonvolatile memory 5 or from the program memory 11 are removed to this in the franking image - such as based on FIG. 3e shown - insert. A notification of the sender address to be applied by means of a separate printer by means of a barcode can be promoted by a discount. According to the invention, these messages mentioned above can reduce the checking effort of mail items because they permit a targeted machine check of particular senders or franking machines. It is provided in a second variant that the data center detects suspicious franking machines and transmits the serial numbers of the postal authority or a commissioned with the verification institute.

Newer franking machines are loaded by means of a remote value specification FWV from a data center with a new recharging credit. For each postage meter user, the data center stores the credit amounts and the dates on which these credits were transferred to the postage meter machine. On the basis of this data stored in the data center, further security checks are possible for checking the regular use of the franking machine.

The FIG. 2 shows which communication is required in an evaluation of the security imprint according to the invention. On the one hand, a data connection line L is required for the credit recharge. At the same time, the data center receives information about the respective franking machine for each communication via the data connection line L. It is provided that in a further memory area N a dialing parameter and / or telephone number is stored in order to establish the communication link to the data center DZ, which queries at least the postal registers in the nonvolatile cost center memory 10. After evaluation, the data center, if necessary, establishes a data connection via a line H to the evaluation device 29 in the post office or in the institute commissioned with the evaluation of the franking stamp of the mailpieces.

In the first verification variant, provided that a postage meter machine is considered suspect, the post office will initiate an inspection of the mail pieces. The information is received by the postal authority from the data center via the data link H together with the serial number. Also, for requests from the post office, depending on the type of evaluation, the data link H is to be used. On the other hand, the data link L is provided for inquiries from the franking machine to the data center.

In such a first check variant, which is centrally initialized in accordance with the invention, the data center determines an average postage consumption P _K on the basis of the user-specific historical data of a certain past time period. In this case, it is assumed according to the invention that the average credit balance also corresponds to the average credit balance, ie the average postage consumption. This therefore equals the ratio of the sum of the credits G transferred in the period under consideration, and the sum of the periods of time t between the recharges: $${\mathrm{P}}_{\mathrm{K}}\mathrm{=}\frac{{\displaystyle \underset{\mathrm{i}\mathrm{=}\mathrm{1}}{\overset{\mathrm{n}}{\mathrm{\Sigma }}}}{\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{i}}}{{\displaystyle \underset{\mathrm{i}\mathrm{=}\mathrm{1}}{\overset{\mathrm{n}}{\mathrm{\Sigma }}}}{\mathrm{t}}_{\mathrm{K}\mathrm{.}\mathrm{i}}}$$

On the basis of this average postage consumption P _{K of} the franking machine user K and on the basis of his last credit recharge G _{K, n} , the probable time duration t _{K, n + 1} can be calculated until the next credit debit: $${\mathrm{t}}_{\mathrm{K}\mathrm{.}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{=}\frac{{\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{n}}}{{\mathrm{P}}_{\mathrm{K}}}\mathrm{*}\left(\mathrm{1}\mathrm{+}\mathrm{1}\mathrm{/}\mathrm{\beta }\right)$$

• R1 (descending register) vorrätige Restbetrag in der Frankiermaschine,
• R2 (ascending register) Verbrauchssummenbetrag in der Frankiermaschine,
• R3 (total resetting) die bisherige Gesamtvorgabesumme aller Fernwertvorgaben,
• R4 (piece count Σ printing with value # 0) Anzahl gültiger Drucke,
• R8 (R4 + piece count Σ printing with value = 0) Anzahl aller Drucke

The term (1 + 1 / β) is used to compensate for normal variations in postage consumption. Therefore, at G _{K, n,} a penalty of 1 / β in this example is preferably raised by 10%, ie 1 / β = 1/10).
The postage meter can transmit the data central register values before a credit recharge:

• R1 (descending register) remaining amount in the franking machine,
• R2 (ascending register) consumption sum amount in the franking machine,
• R3 (total resetting) the previous total of all remote value defaults,
• R4 (piece count Σ printing with value # 0) Number of valid prints,
• R8 (R4 + count Σ printing with value = 0) Number of prints

Taking into account the sum stored in the rising register (consumption sum amount R2) of all previously loaded (used) recharging credits, the following applies: $$\mathrm{R}\mathrm{2}\mathrm{=}\underset{\mathrm{i}\mathrm{=}\mathrm{1}}{\overset{\mathrm{n}}{\mathrm{\Sigma }}}{\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{i}}$$

Außerdem gilt: $$\mathrm{R}\mathrm{3}\mathrm{=}\mathrm{R}\mathrm{2}\mathrm{+}\mathrm{R}\mathrm{1}$$

A value R2 taken from the ascending register corresponds to the current query value. According to the default _request , which is to lead to a reload _credit G _{K n + 1} , which must be added to the current query value R ₂ , the future value R _{2 new results} . The following applies: $${\mathrm{R}\mathrm{2}}_{\mathrm{New}}\mathrm{-}\mathrm{R}\mathrm{2}\mathrm{=}{\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{n}\mathrm{+}\mathrm{1}}$$

In addition: $$\mathrm{R}\mathrm{3}\mathrm{=}\mathrm{R}\mathrm{2}\mathrm{+}\mathrm{R}\mathrm{1}$$

Taking into account a still available postage balance (remaining amount R1) stored in the falling register of the cost center memory 10, a following total value for frankings can thus be used up: $${\mathrm{R}\mathrm{1}}_{\mathrm{New}}\mathrm{-}\mathrm{R}\mathrm{1}\mathrm{=}{\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{n}\mathrm{+}\mathrm{1}}$$

For each remote value specification, the remaining amount R1 can be queried and evaluated statistically. If the remaining amount R1 ever larger, then the same Nachladebetrag can be reloaded in ever-larger reloading periods, or the number of pieces is set smaller, which may be franked until the next communication. From this consideration, and because reload amounts are customarily requested at the same level, the probable time duration t _{K, n + 1} until now next credit balance calculated according to the following formula: $${\mathrm{t}}_{\mathrm{K}\mathrm{.}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{=}\left({\mathrm{G}}_{\mathrm{K}\mathrm{.}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{+}\mathrm{R}\mathrm{1}\mathrm{*}{\mathrm{\alpha }}_{\mathrm{x}}\right)\mathrm{*}\mathrm{1}\mathrm{/}{\mathrm{P}}_{\mathrm{K}}$$

The disposition factor α _x is dependent on the rating of the franking machine user as an A, B or C customer.

$${\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{<}{\mathrm{P}}_{\mathrm{K}}\mathrm{\le }{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }{\mathrm{\alpha }}_{\mathrm{B}}$$

$${\mathrm{P}}_{\mathrm{K}}\mathrm{>}{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }{\mathrm{\alpha }}_{\mathrm{C}}$$

On the basis of the determined for the user K average postage consumption P _K of the disposition factor α _K is assigned to one of for example three consumption classes A, B and C: $${\mathrm{P}}_{\mathrm{K}}\mathrm{\le }{\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{\to }{\mathrm{\alpha }}_{\mathrm{A}}$$

$${\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{<}{\mathrm{P}}_{\mathrm{K}}\mathrm{\le }{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }{\mathrm{\alpha }}_{\mathrm{B}}$$

$${\mathrm{P}}_{\mathrm{K}}\mathrm{>}{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }{\mathrm{\alpha }}_{\mathrm{C}}$$

Each of these consumption classes is a typical disposition factor α _A , α _B , α _C assigned, which according to the equation (6) in the consumption class A, ie the class with the smallest consumption, per time interval, the longest time (t _A ) is achieved and at the consumption class C the shortest time (t _C ).

$${\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{<}{\mathrm{P}}_{\mathrm{n}}\mathrm{\le }{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }\mathrm{B}$$

$${\mathrm{P}}_{\mathrm{K}}\mathrm{>}{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }\mathrm{C}$$

A simplification of this calculation scheme is achieved in that no longer the individual variables _{K K} and _{K K, n + 1 are} recalculated for each user K, but a classification is made. On the basis of the determined for the user K average postage consumption P _K of this is classified into one of for example three consumption classes A, B and C. $${\mathrm{P}}_{\mathrm{K}}\mathrm{\le }{\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{\to }\mathrm{A}$$

$${\mathrm{P}}_{\mathrm{A}\mathrm{/}\mathrm{B}}\mathrm{<}{\mathrm{P}}_{\mathrm{n}}\mathrm{\le }{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }\mathrm{B}$$

$${\mathrm{P}}_{\mathrm{K}}\mathrm{>}{\mathrm{P}}_{\mathrm{B}\mathrm{/}\mathrm{C}}\mathrm{\to }\mathrm{C}$$

Each of these consumption classes is assigned a typical consumption time t _A , t _B , t _C , whereby the consumption class A, ie the class with the lowest consumption, is assigned the longest time (t _A ) per time interval and the consumption class C the shortest time (t _C ).

If the time t _{K, n + 1} or t _A , t _B or t _{C is} exceeded, the respective K th franking machine FM _{K is in} principle considered to be suspicious. At regular intervals, a plausibility check of all franking machines in use is carried out in the data center. In this procedure, the machines are marked and reported to the postal authority whose franking behavior appears suspicious or which have obviously been manipulated. Upon entering this suspicious mode, several reactions containing several steps are now possible:
a) The data center makes contact with the K-th franking machine FM _K on. In the presence of a modem connection, this can happen automatically. In the case of the so-called voice control, a telephone call is required at the FM _K customer.

In any case, the customer or the postage meter machine is requested to perform the overdue communication. In the case of a communication, the current status of the register can be requested from the data center in order to check the size of the remaining credit or to obtain further statistical data on the use of the K-th franking machine FM _K. For security reasons, this transmission is to be protected in the same way as the remote value specification itself. This is done, for example, by encrypting the message with the DES key. The data center can then possibly transmit to the K-th postage meter FM _K the message that it is no longer suspicious.

Otherwise, the K-th franking machine FM _K goes into the suspicion mode. This means that it has to be checked on-site within a limited time, when subsequently no communication between the data center and the franking machine is performed.

und falls Rlalt Ï R1, um die Änderung zu überprüfen, außerdem: $${\mathrm{V}}_{\mathrm{susp}\mathrm{2}}\mathrm{=}\frac{\mathrm{R}\mathrm{4}-\mathrm{R}\mathrm{4}\mathrm{alt}}{\mathrm{R}\mathrm{1}\mathrm{alt}-\mathrm{R}\mathrm{1}}\mathrm{*}{\mathrm{F}}_{\min }$$

mit

R1 :

R1 Abfragewert bei der n-ten Fernwertvorgabe

R1_neu:

R1 Abfragewert vor der (n+1)-ten Fernwertvorgabe eines Nachladeguthabens

V_susp1:

heuristischer Wert, der Auskunft über den Zustand der Frankiermaschine gibt

F_min:

minimaler Frankierwert

From the data center, the behavior of the postage meter user is also monitored on the basis of further data transmitted during the communication in order to detect suspicious postage meters. Such franking machine-specific data, such as the number of impressions made or all prints (register values R4 or R8), can also be included in the calculation for determining the franking machine profile. Advantageously, the following formulas are used successively: $${\mathrm{V}}_{\mathrm{susp}\mathrm{1}}\mathrm{=}\frac{\mathrm{R}\mathrm{4}}{\left(\mathrm{R}\mathrm{3}\mathrm{-}\mathrm{R}\mathrm{1}\right)}\mathrm{*}{\mathrm{F}}_{\min }\mathrm{=}\frac{\mathrm{R}\mathrm{4}}{\mathrm{R}\mathrm{2}}\mathrm{*}{\mathrm{F}}_{\min }$$

and if Rlalt Ï R1 to verify the change, also: $${\mathrm{V}}_{\mathrm{susp}\mathrm{2}}\mathrm{=}\frac{\mathrm{R}\mathrm{4}-\mathrm{R}\mathrm{4}\mathrm{old}}{\mathrm{R}\mathrm{1}\mathrm{old}-\mathrm{R}\mathrm{1}}\mathrm{*}{\mathrm{F}}_{\min }$$

With

R1:

R1 query value at the nth distance value specification

R1 _new :

R1 query value before the (n + 1) -th remote value specification of a reload credit

V _susp1 :

heuristic value that gives information about the state of the franking machine

F _min :

minimal franking value

With a minimum franking value of, for example, F _min = 20 cents, the following case distinction results: V _susp1 <5 OK V _susp1 = 5..100 suspicous V _susp1 > 100 manipulated

• Stufe 1: Frankiermaschine ist verdächtig oder
• Stufe 2: Frankiermaschine ist manipuliert worden.

On the basis of the franking machine specific data, a postage meter profile can be created. This franking machine profile provides information on whether a customer was able to carry out the determined number of frankings with the reloading operations carried out. There are two different levels within the suspicious mode:

• Stage 1: Postage meter is suspicious or
• Stage 2: Postage meter has been manipulated.

A corresponding suspicious mode can only be activated by the data center, with no direct effects on the postage meter machine.

b) Just as in the data center, the K-th franking machine FM _K can automatically determine the message and indicate that it is suspicious. The K-th franking machine FM _K goes with display of the message in suspicion mode. This means that the data center will initiate a check within a limited time in the field if subsequently no communication between the data center and the franking machine is performed. Such a communication can be made, for example, for the purpose of a remote value specification of a credit.

In the remote value specification of a credit, the individual transactions with encrypted messages are performed one after the other. After entering the identification number (ID No.) and the intended input parameters, the franking machine checks whether a MODEM is connected and ready for operation. If this is not the case, it is indicated that the transaction request must be repeated. Otherwise, the postage meter reads the dialing parameters consisting of the dial out parameters (main / extension, etc.) and the Telephone number from the NVRAM memory area N and sends them with an election request command to the modem 23. Then the required connection for communication via the MODEM 23 with the data center.

After establishing the connection, the encrypted opening message is transmitted to the data center. In it is u.a. the postage number for the notice of the caller, i. the postage meter, at the data center included. In addition, the transmission of the encrypted register data to the data center takes place.

This opening message is checked for plausibility in the data center, and the franking machine is identified and evaluated for errors. The data center recognizes which request the franking machine has made and sends a reply message to the franking machine as a header.

If a header has been received, ie the franking machine has received an OK message, the header parameters are checked with regard to a change of telephone number. If an encrypted parameter has been transmitted, there is no telephone number change and a start message is sent encrypted from the postage meter machine to the data center. If the reception of proper data is detected there, the data center begins to perform a transaction. In the above example, new postage credit data is encrypted and transmitted to the postage meter, which receives and stores this transaction data. In another variant, it is provided that the franking machine is transferred back to the normal mode with each successful communication from the suspicion mode.

At the same time, the status of the franking machine is again determined in the data center on the basis of the new transferred register values.

c) According to the invention, in this first verification variant, in addition to the reactions a) or b), a message can be sent to the postal authority, which is responsible for checking the K-th franking machine FM _K. This postal authority can then, for example, initiate a targeted check of the franking of the mail items and, if necessary, an on-site inspection if the investigations carried out have revealed that the franking machine must have been manipulated.

If it has been determined by the data center that the postage meter machine is suspicious, the mailing authority or the institute responsible for the check is sent the associated postage meter serial number. Thus, i.a. the occurrence of the letters or mailpieces franked by this suspect franking machine are monitored if the letters or mail pieces have a machine-readable address of the sender or the franking machine serial number. The occurrence of the franked by this suspect franking machine letters is monitored by the number and / or value sum in the time interval, for example, counted from 90 days and compared with the credit value that was present in the postage meter since the last recharge.

d) Independently or in combination with the reactions a) to c), a special character is activated after acceptance of the suspicion mode by the K-th franking machine FM _K and printed at a predetermined position in the franking imprint. In the simplest case, this character can be a cluster of printed pixels or a barcode, eg to the right of the field FE9 ( FIG. 3a ) is printed. When checking the franking imprint, the postal authority immediately receives the indication that this franking machine is suspicious. The postal authority can then carry out a check of the franking of the mail piece and, if the suspicion is confirmed, for example, an inspection of the K-th franking machine FM _K on site.

If the imprint of such suspicion signs is known to d) the manipulator of the K-th franking machine FM _K , he can just try to eliminate this imprint. This is made ineffective in that in addition the information of the suspicion mode is printed in cryptified form. For this purpose, another digit, which together with the other variables (postage value, date and possibly franking machine number) cryptified and in a suitable form, for example, the symbol series after FIGS. 3a-3e is printed. In another variant, without requiring the space for another digit for a suspicion variable SV _V , in the combination number a fourth number, which allows the verification of the serial number, is set to a specific value which normally can not occur.

If, in the reactions according to the first verification variant, the checking of the correct handling of a postage meter machine was essentially initiated or at least traceable by the remote value default center, ie the data center, then this initiative proceeds in the reaction according to a second verification variant via the security imprint and its check by the security imprint competent authority or institution and, ultimately, indirectly from the postage meter itself, with the data center and the post office or inspection body only controlling the response retrospectively.

In the second verification variant, a random check is carried out for randomly selected mailpieces or senders. The security impression is evaluated in cooperation with the data center. About the data connection H franking machine data are queried, which are stored in the data center and are not printed on the mail piece open.

In the spot check, the impression of any randomly selected mail item is examined for manipulation. After collecting all symbols of a symbol series and converting them into data, they can be decrypted with the appropriate DES key. As a result, the COMBI number is available, from which the sizes, in particular the sum of all franking values and the current postage value are split off. The split size of the postage G3 is compared with the actually printed postage value G3 '.
The split-off variable G4, ie the sum value of all franking values which have been carried out since the last reloading, is subjected to a monotonic test by means of data of the last detected variable G4 '. There must be a difference in at least the height of the postage value between the size G4 actually encrypted in the marking and the last detected size G4 '. In the simplest case, the last detected quantity G4 'is the total value of all previously made frankings stored in the data center at the last remote inquiry of the register statuses. Likewise, the counterfeiting of the franking machine serial number can be recognized by means of the marking by separating and checking the size G0 after decryption from the KOMBI number.

If there is no doubt that the imprint has been tampered with, the sender indicated on the item will be checked. This can be the mitabgedruckte serial number serve the franking machine, via which an identification of the sender is possible or, if available, the sender printed in plain text on the envelope. If such an indication is missing or if the franking machine serial number has been manipulated, the letter can be opened legally to determine the sender.

The postage meter machine cumulates the used postage values since the last credit-recharge or forms a residual value by subtracting from the previously loaded credit the sum of the used postage values. This value is updated with each franking. It is combined with other security-relevant data (postage value, date, franking machine serial number) and cryptified for anti-counterfeiting security and finally printed in the manner described above. After capturing the security imprint and decrypting and separating the individual data as described in o.g. As already described, the evaluation takes place. The comparison of the postage and the monotony test can, as in o.g. Be carried out manner. The information about the postage value W consumed since the last credit recharge is now compared with data stored at the checking station for this franking machine.

In the simplest case, the value W is compared with a fixed threshold, which is not exceeded during normal use of the franking machine. If exceeded, suspicion is near.

In an improved version, W is compared with a threshold SW _n , which corresponds to the respective postage consumption class. These postage consumption classes can be set once for the use of the respective franking machine. But you can also come from a statistic, which for this franking machine was led. These statistics can be kept by the examining postal authority or else the statistical data that the data center prepares anyway and then transferred to the postal authority is used.

A further refinement of the check results from the fact that according to a first marking information variant as the second number in the combination number also the date of the last credit recharge t _{L is} included and mitabgedruckt with the other data in cryptified form. Then, the postal authority is also able to check to what extent certain fixed maximum time periods between two credit reloads have been exceeded, thereby making the postage meter suspicious. In addition, the postal authority would be able to determine the current postage consumption P since the time t _{L of} the last credit recharge with t _A for current date, according to Equation (16): $$\mathrm{P}\mathrm{=}\frac{\mathrm{W}}{{\mathrm{t}}_{\mathrm{A}}\mathrm{-}{\mathrm{t}}_{\mathrm{L}}}$$

The same criteria can be used for checking P, as has already been described in connection with the first verification variant.

1. 1. Datum der letzten Guthabennachladung
2. 2. absolute Zeitzählung zwischen den Guthabennachladungen mit Rücksetzung.

For example, in another tag information variant, the date / time data is a monotone steadily increasing size. In order not to require additional space in the security imprint to print the date of the last credit recharge, in this variant this information can be combined with the absolute time count. The latter is necessary in order to recognize counterfeit copies in the form of copies by means of a monotonic test according to a first evaluation variant explained in FIG. 4c. The time data is then composed of 2 components:

1. 1. Date of last credit recharge
2. 2. absolute time between the credit reloads with reset.

The question of how this information together with the plain text information can be detected visually / manually or automatically, will be discussed below in connection with the statements on the FIGS. 4a to 4c received.

The serial number can also be printed out as a barcode. However, all other information is presented in a different manner according to the invention, because a bar code may take up considerable space or force the franking machine imprint to increase in the postage meter image, depending on the amount of information encoded, or not all information in the bar code imprint can be reproduced.

According to the invention, a particularly compact impression consisting of special graphic symbols is used. An identifier formed, for example, from symbols to be printed can before, behind, under u./o. be printed over a field within the actual franking stamp imprint. In accordance with the invention, this is a man-made, as well as machine-readable mark.

A letter envelope 17 transported under the printer module 1 is printed with a postage meter stamp image. The marking field is here in a manner advantageous for an evaluation in a row below the fields for the value stamp, for the day stamp, for the advertising cliché and, if necessary, in the field for the optional print supplement of the postage meter stamp image.

From one - in the FIG. 3a As shown in a first example of the security print, it can be seen that there is good readability for manual evaluation as well as machine readability with good recognition reliability.

The marking field is located here in a window FE 6 arranged under the day stamp within the franking machine print image. The stamp containing the post value in a first window FE 1, the machine serial number in a second and third windows FE 2 and FE 3 optionally has a reference field in one Window FE 7 and, if necessary, an indication of the number of the advertising cliché in a window FE 9. The reference field serves for pre-synchronization for the reading of the graphic character string and for obtaining a reference value for the light / dark threshold in the case of a machine evaluation. A pre-synchronization for the reading of the graphic string is also achieved by and / or in conjunction with the frame, in particular the postage stamp or value stamp.

The fourth window FE 4 in the day stamp contains the current or, in special cases, pre-dated date. Below is an eighth window FE 8 for a compressed accurate time, especially for high-performance franking machines with tenths of a second. This ensures that no impression is similar to another impression, whereby a forgery by copying the impression with a color copying machine is detectable.

A fifth window FE 5 is provided in the advertising cliché for an editable advertising cliche text part.

From the FIG. 3b is the representation of a security impression with a check box in the columns between the value stamp and the day stamp can be seen, wherein the upstream vertical part of the frame of the value stamp of the Vorsynchronisation and possibly serves as a reference field. This eliminates a separate window FE7. The marking data can be detected in this variant with a vertical arrangement of the symbol series in a shorter time almost simultaneously.

It is still possible, compared to those in the FIG. 3a shown windows to save further windows for the open unencrypted impression. On the other hand, the printing speed can be increased because fewer windows are to be embedded in the frame data before printing and thus the formation of marking data can start earlier. To achieve a simple copy protection already satisfies the cryptographic impression using marker symbols, without an open unencrypted impression of the absolute time in a window FE8. In the marking field FE 6, the marking data, which are generated on the basis of at least the post value and such a time count, are as follows FIG. 10 explained - already sufficient.

In one - in the Figure 3c illustrated - third example of the security imprint, in addition to that in the FIG. 3b variant shown another check box in the postmark under the window FE 1 arranged for the postage value. Here further information, for example about the number of the selected advertising clichés, can be communicated unencrypted but in a machine-readable form.

In the 3d figure In a fourth security print example, two more checkboxes are placed in the postmark below and above the FE 1 window for the postal value.

In the FIG. 3e In a fifth security print example, two more checkboxes are placed in the postmark below and above the FE 1 window for the postal value. In this case, the marking field, which is arranged in the postmark above the window FE 1 for the postal value, has a barcode. Thus, for example, the postage value can be communicated unencrypted but in a machine-readable form. A comparison of the encrypted and the unencrypted information can, since both are machine-readable, be carried out fully automatically.

With fewer symbols available, more symbol fields must be printed for the same information. Then a symbol series can be either two lines or in the form of a combination of the in the FIGS. 3a to 3e shown variants.

The marking form is freely compatible with any postal authority. Any general change of the marking image or the arrangement of the marking field is easily possible because of the electronic printing principle.

The arrangement for the rapid generation of a security impression for franking machines allows a fully electronically generated franking image, which was formed by the microprocessor-controlled printing process from fixed data and current data, to be set.

The data for the constant parts of the franking image which relate to at least part of the fixed data are stored in a first memory area A _i and by an associated address and the data for the variable parts of the franking image are in a second memory area B _j or for marking data stored in a memory area B _k and identified by an associated address.

At predetermined intervals, for example regularly with each inspection of the franking machine, can also be a change or replacement of - in the FIG. 3f - Set of symbols are made in order to further increase the security against counterfeiting.

In the FIG. 3f For example, an illustration of a set of icons for a marker box is shown, with the icons appropriately shaped to allow both machine and visual evaluation by trained post office personnel.

To increase anti-counterfeiting security, a set of symbols is used that is not included in the standard character set of common printing devices.

In principle, the very high number of variations also allows a variant that uses several symbol sets for the marking.

According to the invention, space is saved with a higher information density compared with a bar code when printing the symbols. It suffices to distinguish between 10 degrees of blackening in order, for example, to achieve a shorter length in the representation of the information by about a factor of three compared with the ZIP-CODE. This results in ten symbols, with a blackening of 10% each. When reduced to five symbols, the degree of blackening may differ by 20%, but it is necessary to considerably increase the number of symbol fields to be printed if the same information as that in the FIG. 3f displayed symbol set to be played. Even a sentence with a higher number of symbols is conceivable. Then, the series or rows of symbols shortened accordingly, but also correspondingly reduces the recognition security, so that then appropriate evaluation of digital image processing, such as those with edge detection, are required. Due to the consistent use of orthogonal edges and omission of rounding, a sufficient recognition reliability is already achieved with simple algorithms of digital image processing. Such recognition systems use, for example, commercially available CCD line scan cameras and commercially available personal computer based image processing programs.

In the FIG. 4a the construction of a combination number KOZ in an advantageous variant with a first number (sum of all postage values since the last reload date), third number (postage value) and a fourth number (generated from a serial number) is shown.

A corresponding - in the FIG. 4b Safety-pressure evaluation device 29 for manual identification shown has a computer 26 with a suitable program in memory 28, input and output means 25 and 27. The evaluation device 29 used by the respective postal authority is associated with a - in the FIG. 2 shown - data center DZ via a communication line H in combination.

FIG. 4c shows a partial step for marking symbol recognition, which is used for an automatic input, in accordance with a - in the FIG. 4d explained in more detail - safety footprint evaluation method is required.

In the preferred variant, the marker field is located at least under a field of the postage meter stamp image, and a series of such symbols are printed below and simultaneously with the postage stamp impression. However, the check box can also be different - such as in the FIG. 3b Shown - may be arranged, in each case corresponding transport devices are provided for the mail piece, when the image sensor, such as the CCD line scan camera is immovably disposed. An Indian FIG. 4b illustrated marker reader 24 may for example also be designed as a guided in a guide, reading pin. The apparatus preferably comprises a CCD line camera 241, a comparator 242 connected to the CCD line camera 241 and a D / A converter 243, and an encoder 244 for detecting the stepwise movement. The data input of the D / A converter 243 for digital data and the outputs of the comparator 242 and encoder 244 are connected to an input / output unit 245. This is a standard interface to the input means 25 of the security impression evaluation device 29.

The automatic identification of the symbols in the marking can take place in two variants: a) via the integrally measured degree of blackening of each symbol or b) via edge recognition for symbols.

The orthogonal edges of the symbol set after FIG. 3 allow a particularly simple and with little effort to implement automatic detection method. The recognition device contains a CCD line scan camera of medium resolution, for example 256 pixels. With a suitable lens, the height of the symbol row is mapped to the 256 pixels of the line scan camera. The respective symbol field is now scanned column by column starting from left to right with the right column beginning. The line scan camera is preferably arranged stationary and the letter is led away under the line scan camera by uniform motor drive. Since the row of symbols within the franking imprint is always positioned in the same place according to an agreement once made, and the Franking imprint is in turn positioned by existing postal regulations on the envelope, the leadership of the envelope to a fixed edge of the recognition device is sufficient.

The CCD line scan camera determines the contrast value of the pixels belonging to the column for each column. The output of the CCD line scan camera is connected to a comparator, which assigns the binary data 1 and 0 to the pixels by means of threshold value comparison. Even with constant artificial lighting conditions, it will be necessary to adapt the threshold to the very different light reflection factors of the different types of paper used for letter envelopes. For this purpose, the threshold is guided to a reference field FE 7, which consists of a series of bars and is arranged at the level of the symbol row and in front of it. The threshold value is defined as the mean value of the light and dark stripes of the reference field. The scanning of the reference field is performed either with an additional sensor (e.g., a phototransistor) or with the CCD line scan itself. In the latter case, the measured values of the line scan camera A / D must be displayed, the threshold value must be formed from this in a computer connected via a standard interface and fed to the comparator via a D / A converter. Newer CCD line scan cameras have integrated the comparator, with its threshold controlled directly from the computer with a digital value.

The binary data supplied by the line scan camera, including the comparator, are stored in a computer-aided evaluation device in an image memory column-by-column and line-by-line. A simple and fast-running evaluation program examines in each column of a symbol field the change of the binary data contents from 1 to 0 or 0 to 1, as is the case with reference to FIG. 4c has been shown. For example, if the program starts to examine a column of a symbol field with the top (white) edge, the binary content of that first pixel data = 0. After ml points of this column, the 1st change to the binary content 1 (printed) takes place. The address of this 1st binary change and also the address m2 of the following binary change (1st unprinted) pixel is stored in a feature memory. At the in FIG. 3f The symbol set shown already satisfies these two contours when the process is repeated for all columns of a symbol field. If a symbol field has n columns, then after its detection, there are 2n data in the assigned feature memory which allow a clear assignment by comparison with the data records of the pattern symbols stored in a pattern memory. This method is real-time due to its simplicity and has a high degree of redundancy over individual printing or sensor errors.

The quantized blackening difference between the symbols enables simple machine evaluation without complex pattern recognition. For this purpose, a suitably focused photodetector is arranged in a reading device.

Even with envelopes of different colors, this simple machine evaluation is possible. To compensate for different measured values obtained whose differences are due to the different printing conditions or types of paper, a reference value is derived from the reference field. The reference value is used for the evaluation of the degree of blackening. With this reference value obtained can be achieved relative to failed printing elements, such as a thermal bar 16 in the printer module 1 advantageously a relative insensitivity.

The safety impression evaluation method according to FIG. 4d shows how these security information printed in the franking field can be evaluated in an advantageous manner. It is necessary to enter individual sizes manually and / or automatically. In this case, the symbol series is arranged vertically between the value stamp and the date stamp. It contains in cryptified form information about the printed postage value, a monotone variable (for example, the date or an absolute time count) and the information on the serial number or whether the suspicion mode is present. This information is recorded visually / manually or automatically together with the plain text information.

A first evaluation variant - according to FIG. 4d - consists of recovering the information from the printed mark and comparing it with the information printed on the mail piece. The symbol series acquired in step 71 is converted into a corresponding crypto number in step 72. This unambiguous assignment can take place via a table stored in the memory of the evaluation device, wherein in a particularly advantageous manner the symbol set in FIG FIG. 3f Use is made, in which case each symbol field corresponds to a digit of the crypto number. The crypto number determined in this way is decrypted in step 73 with the aid of the crypto key stored in the evaluation device.

If the crypto numbers for the marking were generated according to a symmetrical algorithm (for example the DES algorithm), then after step 73 of the first evaluation variant, the starting number can be generated again from each crypto number. The initial number is a combination number KOZ and contains the number combination of at least two sizes, the one size by the upper digits of the combination number KOZ and the other size is represented by the lower parts of the KOZ. The part of the number combination (for example, the postal value) to be evaluated is separated and displayed in step 74.

Each digit of the initial number obtained after decryptification is assigned a meaning in terms of content. Thus, the information relevant for the further evaluation can be separated. It is essential in addition to the actually to be checked postage, which forms the one size, u.a. a monotone continuously variable size. A certain monotone continuously variable size and other sizes form certain marker information variants.

On the basis of this consideration, in a first marking information variant, the sum value of frankings stored in a postage meter register forms at least one first number assigned to the predetermined positions of the combination number. This aforementioned first number is a monotone continuously variable size. As a result, the mark changes with each print, which makes such a franked mail piece distinctive and at the same time provides information about the previous credit consumption. This information about the credit consumption is checked at intervals on the basis of known in the data center stored credit balance and credit recharge data checked for plausibility. Preferably, the sum value of franking values since the last reload date forms at least one first number assigned to the predetermined positions of the combination number. A second number placed at predetermined positions of the combination number is formed, for example, by the last reload date.

In a second marking information variant, this aforementioned first number forms according to the summation value at frankings together with the second number, concerning the credit recharge data at the time of the last recharge, a monotone continuously variable quantity.

In a third marking information variant, this abovementioned first number corresponding to the sum value of frankings together with the second number, relating to the piece number data at the time of the last recharging, forms a monotone, continuously variable variable.

A corresponding number of alternative variants results if the residual value is now used to form the marking information instead of the total value of frankings (used postage values since the last credit debit). The residual value results from subtracting from the previously loaded credit the sum of the used postage values.

A corresponding number of further alternative variants results if current date / time data as a whole or since the last reload date, piece number data as a whole or since the last reload date or other physical, but temporally determined data (for example battery voltage) are included to form the marking information.

1. a) Der aus den Sicherheitsabdruck extrahierte tatsächliche abgerechnete Portowert PW_V wird mit dem im Schritt 70 ermittelten, als Klartext im Wertstempel abgedruckten Portowert PW_k im Schritt 75 verglichen. Stimmen beide nicht überein, wurde offensichtlich der abgedruckte Wertstempel manipuliert. Im Schritt 76 wird das Erfordernis einer Inspektion der Frankiermaschine vor Ort festgestellt und angezeigt.
2. b) Der im Schritt 74 extrahierte Zeitpunkt t_n ist nun die aus dem Sicherheitsabdruck abgetrennte Monotonievariable MV_V und kennzeichnet in eindeutiger Weise den Zeitpunkt der Abbuchung des Portowertes bzw. der Ausführung der Frankierung. Diese Daten können bestehen aus dem Datum und der Uhrzeit. Wobei letztere nur so weit aufgelöst wird, daß die nächstfolgende Frankierung sich mit ihrem Zeitpunkt t_n vom vorigen Zeitpunkt t_n-1 unterscheidet. Diese Daten können auch eine fiktive Zeitzählung beginnend mit einem Fixdatum = 0 darstellen. Letzteres kann zum Beispiel den Beginn der Inbetriebnahme der Frankiermaschine betreffen.
   Jeder im Schritt 74 als Monotonievariable MV_V abgetrennter Zeitpunkt kennzeichnet also in eindeutiger Weise einen einzelnen Frankierabdruck dieser Frankiermaschine und macht diesen somit zum Unikat. Jede Frankiermaschine wird durch ihre Seriennummer charakterisiert, welche im Schritt 77 erfaßt wird. Durch einen Vergleich im Schritt 80 mit einem oder mehreren früheren Abdrucken dieser Frankiermaschine, wobei eine zur Seriennummmer zugeordnet gespeicherte vorhergehende Monotonievariable MV_k-1 im Schritt 79 abgerufen wird kann die o.g. Einmaligkeit überprüft werden. In vorteilhafter Weise bildet die Folge der Zeitpunkte ... t_n-1, t_n einer Frankiermaschine eine monotone Reihe. Es ist dann lediglich die Monotonie an Hand des letzten gespeicherten Zeitpunktes t_n-1 dieser Frankiermaschine zu überprüfen. Ist die Monotonie nicht gegeben, liegt eine Kopie von einem früheren Abdruck dieser Frankiermaschine vor, was im Schritt 76 angezeigt wird.
3. c) Zur Prüfung, ob sich die Frankiermaschine während des Druckens im Verdachtsmodus befand, ist lediglich eine Susspiciosvariable SV_v im Schritt 81 auszuwerten. Nimmt das entsprechende Digit einen speziellen Wert an oder ist beispielsweise ungerade, so bedeutet dies, das diese Frankiermaschine überfällig zur Guthabenladung war. Die Feststellung des Verdachtsmodus im Schritt 81 und die Prüfung der Richtigkeit der Seriennummer im Schritt 78 können dabei auf einer abgespaltenen vierten zweistelligen Zahl basieren, welche im Normalfall aus der Seriennummer abgeleitet wird, d.h. wenn sich die Frankiermaschine nicht im Verdachtsmodus befindet. Im Schritt 76 erfolgt zur Anzeige eine Oderverknüpfung der Informationen aus den Schritten 75, 78, 80 und 81.

In the following exemplary embodiment, the instantaneous date / time data form a monotone, continuously variable variable for a monotonicity variable MV _V , which is separated from the combination number in step 74. The evaluation variant then comprises the following steps:

1. a) The actual billed postage value PW _V extracted from the security printout is determined with the value determined in step 70 as plain text in the value stamp printed postage value PW _k compared in step 75. If both do not match, obviously the printed stamp was manipulated. In step 76, the need for on-site inspection of the postage meter machine is noted and displayed.
2. b) The extracted in step 74 time t _n is now separated from the security imprint monotony variable MV _V and uniquely identifies the time of debiting the postage value or the execution of the franking. This data may consist of the date and time. The latter is only resolved to such an extent that the next following franking differs with its time t _n from the previous time t _n-1 . This data can also represent a fictitious time counting starting with a fix date = 0. The latter may, for example, relate to the start of the commissioning of the franking machine.
   Each time separated in step 74 as a monotony variable MV _V thus uniquely identifies a single franking imprint of this franking machine and thus makes it unique. Each franking machine is characterized by its serial number, which is detected in step 77. By comparing at step 80 with one or more previous impressions of this postage meter, retrieving a previous monotonic variable MV _{k-1 associated} with the serial number, at step 79, the above _- mentioned uniqueness can be checked. Advantageously, the sequence of points in time makes ... t _n-1, t a monotonic series _n a postage meter. It is then only the monotony on the basis of the last stored time t _n-1 to check this franking machine. If the monotony is not present, there is a copy of an earlier impression of this postage meter, which is displayed in step 76.
3. c) To check whether the franking machine was in suspicion mode during printing is merely to evaluate a sweet spot variable SV _v in step 81. If the corresponding digit assumes a specific value or is, for example, odd, this means that this franking machine was overdue for the credit balance. The determination of the suspicion mode in step 81 and the checking of the correctness of the serial number in step 78 may be based on a split-off two-digit number, which is normally derived from the serial number, ie if the postage meter machine is not in suspicion mode. In step 76, an OR link of the information from steps 75, 78, 80 and 81 is displayed.

For evaluation, a device equipped with an appropriate program (laptop) is sufficient. In this case also variables G1 possibly G4 which can not be removed from the franking machine stamp image and at least one variable G5 known only to the franking machine manufacturer and / or the data center and communicated to the postal authority can be encrypted. These are also recovered by decryption from the tag and can then be compared with the user-specific stored sizes. The lists stored in the memory 28 may be updated via a connection to the data center 21.

The lists created for each serial number or each user, preferably stored in databases of the data center for all franking machines, contain for each variable data values that are used to verify the authenticity of a franking. Thus, on the one hand, the assignment of symbols to listed weights and on the other hand, in another - in the FIG. 3f not shown - set of symbols the assignment of importance and degree of blackening are set differently for different users.

The advantage of a symbol set of the type indicated is that, depending on the requirements of the respective national postal authority, it is easily possible to mechanically (by for example integral measurement of the degree of blackening of the symbols) and / or manually identify an authentic franking stamp via the conceptual contents of the symbols ,

In one - in the FIG. 4d not shown - second evaluation variant are entered manually or automatically by means of a reading device unencrypted in plain text sizes G0, G2, G3 and G4 in the evaluation 29 by the operator, with the same key and encryption algorithm, as used in the franking machine, only one Crypto number and then derive a marker symbol series. Further details on this are in connection with - in the FIG. 10 - Step 45, made a formation of new coded "Type 2" window data for a marker image. A marker generated therefrom is displayed and compared by the operator with the mark printed on the mail piece (letter envelope). The comparison to be made by the operator is countered by the symbolism of the markings shown in the output means 25 and printed on the mail.

In a - also not shown - third evaluation variant are automatically entered in a first step in the input means 25 by the trained examiner manually or by means of a suitable reader 24, the graphical symbols to the printed on the mail (letter) mark in at least one to convert back to first crypto KRZ1. Here, the actuators, in particular keyboard, the input device may be marked with the symbols to facilitate manual input. In a second step, the frankly printed sizes, in particular G0 for the serial number SN of the franking machine, G1 for the advertising frame frame number WRN, G2 for the date DAT and G3 for the post value PW, G4 for the non-repetitive time data TIME, and also at least partially used to form at least one comparison crypto VKRZ1 from at least one known only to the meter manufacturer and / or the data center and the postal authority notified size G5 INS. The verification is carried out in a third step by comparing two crypto KRZ1 with VKRZ1 in the computer 26 of the evaluation device 29, wherein a signal for authorization in case of equality or non-entitlement in negative comparison result (inequality) is submitted.

In the exemplary embodiment explained below, an evaluation according to the second or third evaluation variant is explained in greater detail.

The first size G1 is the advertising tile frame number WRN which the examiner recognizes from the franking stamp image. In addition to the user, this first variable is also known to the franking machine manufacturer and / or data center and is communicated to the postal authority. In a variant, preferably with a data connection to the data center, the advertising frame frames WR _{n associated} with the serial number SN of the respective franking machine are displayed with assigned numbers WRN _n on a screen of the data output device 27. The comparison with the advertising frame WR _b used on the letter is made by the examiner who inputs the thus obtained number WRN _n .

The stored lists transferred from the data center to the memory 28 on the one hand contain the current one Assignment of the parts of the advertising frame FRNT to a second size G2 (for example, the date DAT) and on the other hand, the assignment of symbol lists to a third size G3 (for example, the post value PW). In addition, there may be a list of parts SNT of the serial number SN selected by the first size G1, in particular the advertising cliche frame number WRN. User specific information, such as the adclause frame number WRN, may be used to randomly sample the marker by selecting decode lists based on user-specific information containing corresponding records. The size G2 (DAT) is then used to determine the byte from the data record which is used when generating the combination number.

In the preferred variant, a monotony test is used on the one hand to test the uniqueness of the impression. The inspector extracts the serial number SN from the windows FE2 and FE3 of the impression and notes the meter user. In this case, additionally, the advertising cliché number can be used, since these are usually assigned to certain cost centers if one and the same machine is used by different users. In the o.g. Lists are data from the last test, etc. also entered data from the last inspection. Such data is, for example, the quantity if the machine has an absolute piece count, or the absolute time data if the machine has an absolute time count.

In the first test step, the correctness of the printed postage value is checked in accordance with the valid regulations of the postal authority. This can be found fraudulent intentional subsequent manipulation of the value impression. In the second test step then the monotony of the data, in particular which is checked in window FE8. With this, copies of a franking imprint can be detected. A manipulation for the purpose of counterfeiting is therefore not promising since these data are additionally printed in at least one marking field in the form of a cryptified symbol series. For an absolute time or piece count, the number printed in the window FE8 must have increased since the last check. In the window FE8 nine digits are displayed, which allows the representation of a period of about 30 years with a resolution of seconds. Only after this time would the counter overflow. From the mark, these sizes can be recovered to compare with the open-faced unencrypted sizes. In a third optional test step, the other variables, in particular the serial number SN of the postage meter machine, if necessary the cost center of the user, can also be checked and ascertained if a manipulation is suspected. On the other hand, the information such as the advertising cliche frame number WRN may be indicated by a predetermined window FE9. The associated window data are type 1, ie they are changed less frequently than type 2 window data, such as the TIME data in window FE8 and the tag data in window FE6.

In a further embodiment, the data of the windows FE8 and FE9 are not printed open unencrypted, but are used only for encryption. That's why they are missing over the FIG. 3a shown windows FE8 and FE9 in the - FIGS. 3b to 3e illustrated franking machine print images to illustrate these variants.

In a preferred input variant for the test, the temporarily variable variables to be entered, for example the advertising cliché frame number WRN, are Date DAT, the post value PW, time data TIME and the serial number SN automatically detected by a reader 24 from the corresponding field of the postage meter stamp image and read. In this case, the arrangement of the windows in the franking machine impression must be observed in a predetermined manner.

Other temporarily variable variables assigned to the respective serial number SN are known only to the franking machine manufacturer and / or data center and are communicated to the postal authority. For example, the defined number of frankings achieved at the last inspection serves as a fifth size G5.

All sizes to be entered, except sizes G1, G4 and G5, must be able to be taken from the individual windows FE _{j of} the franking machine stamp image. The size G5 forms, for example, the key for the encryption, which is changed at predetermined time intervals, ie after each inspection of the franking machine. These time intervals are dimensioned such that even with the use of modern analysis methods, for example differential cryptanalysis, it is certainly not possible to reconstruct the original information from the markings in the marking field, in order to subsequently produce counterfeits on franking stamp images.

The size G1 corresponds, for example, to an advertising cliché frame number. In the sub-memory areas ST _i , ST _{j of} the main memory 5 of the franking machine, corresponding number strings (sTrings) for window or frame input data are stored.

The variables G0, G2 and G3 correspond, for example, to the window data stored in the sub-storage areas ST _{j of} the non-volatile main memory 5 of the franking machine, the size G0 in the windows FE2 and FE3 from the sub-storage areas ST ₂ and ST ₃ , the size G ₂ in the window FE 4 from the sub-storage area ST _4, and the size G 3 in the window FE 1 from the sub-storage area ST ₁ .

In the sub-memory areas B ₅ B ₆ and B _{7 of} the main memory 5 of the franking machine are the stored window data for a Werbeklischeetextteil, a check box and possibly for a reference field. It should be noted that in some of the sub-memory areas of the main memory 5 of the franking machine designated as B _k , the window data are written in and / or read out more often than in other sub-memory areas. If the nonvolatile memory is an EEPROM, a special memory method can be used to safely stay below the limit of memory cycles allowed for it. On the other hand, it is also possible to use a battery-supported RAM for the non-volatile main memory 5.

In the FIG. 5 a flow chart of the solution according to the invention is shown, wherein the method based on the presence of - in the FIG. 1 - Shown two pixel memory areas.

According to the frequency of a change of data, decoded binary frame and window data are stored in two pixel memory areas before printing. The type 1 non-continuously variable (semi-variable) window data such as date, serial number of the franking machine and the cliche text part selected for multiple prints may be decompressed into binary data prior to printing together with the frame data and assembled into a pixel image stored in the pixel memory area I. On the other hand, constantly changing (variable) type 2 window data are decompressed and as binary window data in the second pixel memory area II saved before printing. Window data of type 2 are, for example, the postage and forwarding postage value to be printed and / or the constantly changing marking. After a print request, in the course of a print routine during printing, for each column of the print image, the binary pixel data from the pixel storage areas I and II are assembled into a print column control signal.

A postage meter can after switching on and their initialization several states (communication mode, test mode, franking mode, etc. modes), which, for example, in the application P 43 44 476.8 in the German Offenlegungsschriften DE 42 17 830 A1 and DE 42 17 830 A1 were described in more detail. After the start step 40 of the franking mode, the input of the cost center in step 41 automatically enters the last currently stored window and frame data and in step 42 a corresponding display. In this case, relevant memory areas C, D, E of the non-volatile main memory 5 are queried with regard to a set allocation of window and frame data or cost center. After the aforementioned or in another, for example, after the in DE 42 21 270 A1 a cliche text part, which is assigned to a specific advertising cliché, can also be automatically specified.

In step 43, frame data is taken in registers 100, 110, 120,..., Of the volatile main memory 7a, thereby detecting control codes and stored in the volatile main memory 7b. The remaining frame data is decompressed and stored in the volatile pixel memory 7c as binary pixel data. Likewise, the window data is loaded into registers 200, 210, 220, ..., the volatile random access memory 7a, thereby detecting control codes and stored in the volatile memory 7b and the remaining window data after its decompression stored column by column in the volatile pixel memory 7c.

In the FIG. 9a is the, decoding of the control codes, decompression and loading of the fixed frame data as well as the formation and storage of the window characteristics and in the FIG. 9b For example, the embedding of decompressed current type-1 window data into the decompressed frame data after starting the postage meter or after editing frame data is shown in detail.

In step 44, either the decompressed frame and window type I data is stored as binary pixel data in the pixel memory area I and may be further processed in step 45 or a new input of frame and / or window data. In the latter case, a branch is made to step 51.

In step 51, the microprocessor determines whether an input has been made via the input means 2 in order to replace window data, for example for the postal value, with a new one or to replace or edit window data, for example for a cliché text line. If such input has been made, then in step 52, the required sub-steps are made for the inputs, i. a ready-made other record is selected (cliche text parts) and / or a new record is generated containing the data for the individual characters (numbers and / or letters) of the input size.

In step 53, corresponding input valid data verification records are called and provided for the subsequent step 54 of reloading the pixel memory area I with the type 1 window data.

In the FIG. 9c Step 54 for embedding decompressed semivariable type-1 window data in the decompressed frame data after re-input or after editing of this type-1 window data is shown in detail. The data of records called up according to the input are evaluated to detect control codes for a "color change" and a "column end", respectively, which are required for embedding the newly entered window data. Then, those data which are not control codes are decompressed into binary window pixel data and embedded in the pixel memory area I column by column.

If, on the other hand, it has been determined in step 51 that no window data is to be selected or edited, then a branch is made to step 55. In step 55, the possibility of changing the used fixed advertising cliché data to step 56 results in the entry of the currently selected frame data sets together with the window records. Otherwise, a branch is made to step 44.

If a re-entry of selected special sizes is to take place, a flag is set in step 44 and taken into account in the subsequent step 45 for formation of data for a new marker symbol row, if a step 45b is to be processed here according to a second variant.

In step 45, the new type 2 coded window data is formed. Preferably, the tag data for a window FE6 is generated here, with previous steps of encrypting data to generate a crypto number included. In this step 45, a shaping is also provided as bar code and / or symbol chain. Based on FIG. 10 In two variants, the formation of new coded window data of type 2 for a marker image is explained.

In a first variant, a monotone variable is processed in a step 45a, so that ultimately by the printed marker symbol series each impression is unmistakable. In a second variant, other variables are processed in a step 45b before step 45a.

The correspondingly formed data record for the marking data is then loaded in an area F and / or at least in a sub-memory area B _{6 of} the non-volatile main memory 5, thereby overwriting the previously stored data record for which window characteristic values have already been determined or are predetermined and now only in the volatile random access memory 7b are stored. The sub-memory area B ₁₀ is preferably provided for a data record which leads to the printing of a second series of marking symbols, as in US Pat Figure 3c and 3d is shown. In addition, double rows of symbols - in one in the FIG. 3b not shown - printed side by side. The area F is preferably provided for a data record which leads to the printing of a bar code, as in the US Pat FIG. 3e is shown.

In step 46, data is transferred byte by byte into the volatile memory register 7a and the control characters "color change" and "column end" are decoded to decode the remaining data of the data set and decoded binary window pixel data of type 2 into the pixel memory area II of the volatile random access memory 7c. In the FIG. 11 the decoding of control code and conversion into decompressed binary window data of type 2 is shown in detail. Such type 2 window data are identified in particular by the index k and relate to the data for the window FE6, if necessary, to FE10 for marking data and optionally to FE8 for the time data of the absolute time count. Just the time data represent a monotone variable, as time-dependent increasing size, first BCD-packed, from the. Clock / date module 8 supplied time data, if necessary, are converted into a suitable TIME data record containing run-length-coded hexadecimal data. Now they can also be stored in a memory area B ₈ for type 2 window data FE8 and / or loaded in columns 46 in register 200 of the main memory 7a or in the pressure register 15 immediately in step 46.

In step 47, when the print request has been made, step 48 containing a print routine is waited for and the print request is waiting for a print request that has not yet occurred. In one embodiment, the holding pattern is - in the Figures 5 or 6 - returned directly to the beginning of step 47. In another embodiment, the holding pattern is - in one of the Figures 5 or 6, not shown - returned to the beginning of step 44 or 45.

The - in the FIG. 12 shown in step 48 for the assembly of Druckspaltendaten from the pixel memory areas I and II, takes place during the loading of the print register (DR) 15. The printer control (DS) 14 causes this immediately after loading the print register (DR) 15 a Pressure of the charged pressure column. Subsequently, it is checked in step 50 whether all columns for a franking machine print image are printed by comparing the current address Z with the stored end address Z _end . If the print routine for a mail item is executed, the system branches to step 57. Otherwise, the program branches back to step 48 to generate and print the next print column until the print routine is completed.

In step 57 it is checked whether more mail pieces are to be franked. If this is not the case and the print routine is ended, the step 60 is reached, thus completing the franking. Otherwise, the end of printing is not reached and it is branched back to step 51.

In the FIG. 6 is a fourth variant of the solution according to the invention, wherein deviating from the block diagram according to the FIG. 1 only one pixel memory area I is used, shown. In this pixel memory area I, decoded binary frame data and type-1 window data are assembled and stored before printing. The steps are up to the step 46, which here in this variant after the FIG. 6 is saved and the step 48, which is replaced here by the step 49, identical. Until step 46 results in substantially the same order in the sequence.

In the FIG. 13 More specifically, the printing routine for composing data taken from a pixel memory area I and memory areas is discussed. The ever-changing type 2 window data is decompressed in step 49 during the printing of each column and assembled together with the column-by-pixel binary pixel data from the pixel memory area I into a print column control signal. Window data of type 2 are, for example, the postage- and forwarding-dependent postage value to be printed and / or the constantly changing marking.

Based on a - in the FIG. 7 - Postwertzeichenbildes and the data assigned to a pressure column data of the pressure control signal whose generation from the frame and window data is explained.
A letter envelope 17 is under the printing module 1 of an electronic postage meter at the speed v is moved in the direction of the arrow and printed in the column s ₁ starting grid-like columns with the postage value image shown. The printer module 1 has, for example, a pressure bar 16 with a series of pressure elements d1 to d240. For printing, the inkjet, or a thermal transfer printing principle, for example, the ETR printing principle (Electroresistive Termal Transfer Ribbon) can be used.

A column s _f to be printed has a printed pattern 30 to be printed consisting of colored dots and non-colored dots. In each case a colored pressure point is printed by a printing element. On the other hand, the non-color printing dots are not printed. The first two printing dots in the printing column s _f are colored to print the frame 18 of the postal stamp image 30. Then, 15 non-colored (ie non-active) and 3-colored (ie active) pressure points are alternately followed until a first window FE1 is reached in which the postal value (postage) is to be inserted. This is followed by a range of 104 non-colored pressure points to the end of the column. Such run-length coding is realized in the data record by means of hexadecimal numbers. The storage space requirement is minimized by having all the data in such a compressed form.

With hexadecimal data "QQ" 256 bits can be generated. If one subtracts from this the required control code bits, less than 256 bits remain to drive the dot generating means. But if you use additional a color change causing control characters "00", even more than 256 dots can be controlled, in the sub-memory area A _{i of} the main memory 5 but now more space is needed. The embodiments of the Figures 9 . 11 . 12 and 13 are designed for such a high-resolution printer module.

Control characters are "00" intended for color change. Thus, a following hexadecimal number is still considered colored (f: = 1), which would otherwise be considered non-colored. A reset color flip-flop (f: = 0) is set at color change (f: = 1) and switched again at the next color change (f: = 0). With this principle, 256 dots or more can be addressed. The register 15 in the print controller 14 is bit-loaded from the pixel memory (e.g., for a print column with N = 240 dots).

Further control characters are "FE" for the end of the column, "FF" for the end of the screen, "F1" for the window start of the first window FE1, etc.

In the following to explain the FIG. 7 example chosen is compared to a pressure column to be controlled with more than 240 dots less space in the ROM needed because the control characters laid low. For hexadecimal data "01", "02", ..., "QQ", ... "F0" are 1 to 240 dot ("F0" = [F ^* 16 ¹ ] + [0 ^* 16 ⁰ ] = [ 15 ^* 16] + [0 ^* 1] = 240).

Here, the control code "00" for color change can theoretically be omitted, since with a single hexadecimal number "F0" an entire pressure column of 240 dots with the same color can be completely defined. Nevertheless, with only a small number of additional memory requirements, a change of color can make sense for several windows in a column.

This method yields a data set for the pressure column s _f in the form shown in detail:
... "2", "0D", "02", "4F", "F1", "68", "FE", ..., ...

When taken over into a register 100 of the μP controller 6 control characters are detected from hexadecimal numbers "QQ" and evaluated in the course of a step 43.

In this evaluation, window characteristics Z _j , T _j , Y _j . or Z _k , T _k , Y _k and stored together with specified values for the start address Z ₀ , end address Z _end and the total run length R, ie the number of binary data required per pressure column, stored in volatile memory RAM 7b.

For the 13 control characters "F1" to "FD", a maximum of 13 windows could be called and the start addresses determined. For example, with "F6" for window start of a window FE6 of type 2, an initial address Z ₆ can be determined and stored as a window characteristic value.

In the FIG. 8 A representation of the window characteristic values related to a pixel memory image and stored separately therefrom is shown for a first window FE1. The window has a window column run length Y ₁ = 40 pixels and a column number of about 120, which is stored as a window column variable T ₁ . If, for this purpose, the window start address Z ₁ is stored as the destination address, the position of the window FE1 in the binary pixel image can be reconstructed at any time.

Binary data converted from the registers 100, 200 are read bit by bit into the volatile pixel memory RAM 7c, each bit being assigned an address. If the hexadecimal number loaded in the register is a detected control character "F2", the window characteristic value Z _j for an initial address of the window of the number j = 2 is determined for a total of n windows. With this, window data can later be reinserted into the frame data at this point marked by the address. It is the window column run _length Y _j <R total run length of the print column. Out When added with R, the new address can be generated in the same row but in the next column.

In the FIG. 9a It shows the decoding of the control codes, decompression and loading of the fixed frame data as well as the formation and storage of the window characteristics. With the consideration of the production of very high-resolution prints, a control code "color change" was taken into account. Therefore, in a first sub-step 4310, a color flip-flop 1 is to be reset to f: = 0. The source address H _i for finding the frame data is initially H _i : = H _i -1 and the destination address Z: = Z ₀ .

For the type 1 window data, in sub-step 4311, the window column variable T _j : = 0, for j = 1 to n window and for the type 2 window data, the window column variable T _k : = 0 is set for k = 1 to p window. In sub-step 4312, the source address H _i for frame data is incremented and a color change is made, so that the initial data byte is evaluated, for example, as colored, which later leads to correspondingly activated printing elements.

The above-mentioned byte, which is a run-length-coded hexadecimal number for frame data, is now transferred in sub-step 4313 from the area A _{i of} the nonvolatile memory 5 correspondingly selected automatically by the cost center KST to a register 100 of the volatile memory 7a. In this case, control characters are detected and a run-length variable X is set back to zero.

In sub-step 4314, a control character "00" is recognized for a color change, resulting in a color change after branching back to the sub-step 4312, ie the next run-length-coded hexadecimal number causes inactivation of the printing elements corresponding to Run length. Otherwise, it is determined in sub-step 4315 whether there is a control character "FF" for the end of the picture. If such is detected, the point d is corresponding to the Figures 5 or 6 reached and processed the step 43.

Otherwise, if in sub-step 4315 such a control character "FF" is not recognized for picture end, it is checked in the sub-step 4316 whether there is a control character "FE" for a column end. If such is detected, the color flip-flop 1 is reset in sub-step 4319 and branched to the sub-step 4312, and then in sub-step 4313 to load the byte for the next printing column. If no column end exists, it is determined in sub-step 4317 whether there is a control character for a type 2 window. If such has been recognized, then branching is made to sub-step 4322. Otherwise, it is examined in sub-step 4318 whether there is a control character for type 1 windows. If that is the case, then a point c _{1 is} reached, at which a - in the FIG. 9b shown - step 43b is performed.

If no control character for type 1 window data is detected in the sub-step 4318, then the run-length-coded frame data are decoded in sub-step 4320 and stored in binary frame pixel data stored in the pixel memory area I of the pixel memory 7c at the set address Z. In the subsequent sub-step 4321, the column run-length variable X is determined according to the number of bits converted, and thereafter the destination address for the pixel memory area I is increased by this variable X. Thus, a point b is reached and to call a new byte, is again branched back to the sub-step 4312.

In sub-step 4322, if there is a control character for type 2 window data, the stored storage is executed determined by window parameters T _k . If a window characteristic value, in this case the window column running variable T _{k, is} still at the initial value zero, the window start address Z _k corresponding to the address Z is determined in a sub-step 4323 and stored in the volatile main memory 7 b. Otherwise, a branch is made to a sub-step 4324. The sub-step 4323 is also followed by the sub-step 4324, in which the window characteristic value of the window column variable T _{k is} incremented. In the subsequent sub-step 4325, the previous window column variable T _k stored in the volatile main memory 7 b is overwritten with the current value, and the point b is reached.

The window characteristic values are thus loaded for k = 1 to p windows, in particular FE6 if necessary FE10 or FE8. Thereafter, a branch is made back to the sub-step 4312 in order to load a new byte in the sub-step 4313. The converted from the hexadecimal data bits (dot = 1) are thus in the - in the FIG. 9a Step 43a taken byte by byte in the pixel memory area I of the volatile pixel memory 7c and stored sequentially as binary data.

In the FIG. 9b the embedding of decompressed current window data of type 1 into the decompressed frame data after the start of the franking machine or after the editing of frame data is shown. Provided that a control character for type 1 window has been detected in sub-step 4318, the point c _{1 is reached,} and thus the beginning of step 43b.

In sub-step 4330, the executed storage of window parameters T _{j is} determined. If a window characteristic value, in this case the window _column running variable T _{j, is} still at the initial value zero, the window start address Z _j corresponding to the address Z is determined in a sub-step 4331 and in the volatile main memory 7b stored. Otherwise, a branch is made to a sub-step 4332. Sub-step 4331 is also followed by sub-step 4332, in which the window characteristic of the window column run length Y _j and the window column run length variable W _{j are} zero, and the window source address U _j is the initial value U _oj -1 and the second window color flip-flop "Print uncoloured".

In the subsequent sub-step 4333, the previous window source address U _{j is} incremented and a color change is performed, so that any window bytes loaded in the subsequent sub-step 4334 are evaluated as colored, which subsequently leads to activated printing elements during the printing.

In sub-step 4334, one byte from the sub-memory areas B _j in the non-volatile main memory 5 is loaded into register 200 of the volatile main memory 7 a, thereby detecting for control characters.

In sub-step 4335, the window column run length Y _j is incremented by the value of the window column run-length variable W _j . In sub-step 4336 it is determined whether there is a control character "00" for color change. If such has been detected, the program branches back to sub-step 4333. Otherwise, it is examined in sub-step 4337 whether there is a control character "FE" for the end of the column. If this is not the case, window data is available. Thus, in a sub-step 4338, the content of the register 200 is decoded with the aid of the character memory 9 and the binary window pixel data corresponding to that byte is stored in the pixel memory area I of the pixel memory 7c.

The window column run length variable W _j is then determined in a sub-step 4339 to the value of the variable increment the address Z W _j. Thus, the new address is available for a new byte of the record to be converted and it is branched back to the sub-step 4333, in which also the new source address for a byte of the record for window FEj is generated.

Was in sub-step 4337, a control character "FE" detected for a column end, a branch is made to sub-step 4340, in which increments the window column variable T _j and the volatile memory 7b saved window column variable T _j, and the window column run length Y _j overwritten with the current value are. Subsequently, a color change is performed in the sub-step 4341 and the point b is reached.

Thus, step 43b has been completed and new frame data could be converted in step 43a unless a next window is detected or point d has been reached.

In the FIG. 9c Fig. 3 illustrates the embedding of decompressed variable window data of type 1 into the decompressed frame data after editing of this type 1 window data. As already shown, pixel memory data and window characteristics have already been stored prior to the beginning of step 54. Sub-step 5440 begins by determining the number n 'of windows for which the data has been changed and determining the associated window start address Z _j and window column variable T _j for each window F Ej. In addition, a window count variable q is set equal to zero.

In sub-step 5441 it is determined whether the value of the window count variable q has already reached the value of the window change number n '. At zero changes, ie n '= 0, the comparison is positive and the point d is reached. Otherwise, the system branches to sub-step 5442, wherein for a first window FEj whose data has been changed, the window start address Z _j and the window column variable T _{j are taken} from the volatile main memory 6b. In addition, the source address U _{j is set} to an initial value U _oj -1, the destination address Z _{j used} to address the pixel memory area I, a window column counter P _j and the second color flip-flop set back to the initial value zero.

In the subsequent sub-step 5443, the source address is incremented and a color change is performed before the sub-step 5444 is reached. In sub-step 5444, a byte of the changed data set in nonvolatile memory is called and transferred to register 200 of volatile memory 7a, detecting control characters. In the case of a control character "00" for color change, branching back to sub-step 5443 takes place in sub-step 5445. Otherwise, the sub-step 5446 is branched to search for control characters "FE" for a column end. However, if such a control character is not present, the content of the register 200 can be decoded in the following sub-step 5447 with the assistance of the character memory 9 and converted into binary pixel data for the window to be changed. These now replace the previous pixel data stored in the region I of the pixel memory 7c from the point predetermined by the window start address Z _j . The bits converted thereby are counted as window run length variable W _j , with which in sub-step 5448 the destination address V _{j is} incremented. Subsequently, a branch is made back to sub-step 5443 in order to load the next byte in sub-step 5444.

If, however, a control character "FE" for column end is detected in sub-step 5446, then sub-step 5449 is called branches, in which the window _column counter P _{j is} incremented.

In sub-step 5450 it is examined whether the window characteristic value for the associated window column variable T _{j is} reached by the window column counter P _j . Then, for a first changed window, all change data would be loaded into the pixel memory area I and branched back to sub-step 5453 and from there to sub-step 5441 to transfer change data into the pixel memory area I for a possibly second window. In sub-step 5453, the window count variable q is incremented for this purpose and the subsequent window start address Z _{j + 1} and the following window column variable T _{j + 1 are} determined.

Otherwise, if in sub-step 5450 window column variable T _j has not yet been reached by window column counter P _j , then branching back to sub-step 5443 via sub-steps 5451 and 5452 to overwrite another window column in the pixel memory area until the old binary window pixel memory data is replaced by the new one have been completely replaced. In sub-step 5451, for this purpose, the destination address for the data in the pixel memory area I is incremented by the frame total column length R. The destination address V _j is thus set to the next column for binary pixel data of the window in the pixel memory area I. In sub-step 5452, the color flip-flop is reset to zero to begin conversion with pixel data evaluated as colored.

If no further new input is determined in step 44, the formation of new coded window data of type 2 for a marking image, in particular according to a first variant with a step 45a, can now take place in step 45.

The step 45 includes further - in the FIG. 10 illustrated sub-steps for forming new coded window data of type 2 for a marker image.

While decompressed binary pixel data are already present in the pixel memory area I, after step 44 in step 45 the output data for the data records containing the compressed data are again required for the windows FEj and possibly for the frame data to generate new coded window data of type 2 for a Make markup symbol array. The individual output data (or input data) are stored in accordance with the respective quantities G _w in the memory areas ST _W as a BCD-packed number. In addition to the non-volatile data records stored in the sub-memory areas A _i and B _j, the data for a data record for window FEk of type 2 are now assembled in several steps and stored non-volatilely in a sub-memory area B _k .

1. a) Generierung einer Kombinationszahl KOZ1, wobei eine stetig monoton veränderbare Größe G4 zur Bildung von ersten zusammenhängenden Stellen und mindestens eine das Postgut charakterisierende weitere Größe G3 zur Bildung von zweiten zusammenhängenden Stellen der Kombinationszahl KOZ1 zur Verfügung gestellt werden,
2. b) Verschlüsselung der Kombinationszahl KOZ1 zu einer Kryptozahl KRZ1,
3. c) Umsetzen der Kryptozahl KRZ1 in mindestens eine Markierungssymbolreihe MSR1 anhand eines Satzes SSY1 an Symbolen.

The method for rapidly generating a security impression comprises, after providing sizes, a sub-step 45a performed by the microprocessor of the postage meter controller 6 before a print request (step 47), comprising the sub-steps:

1. a) generation of a combination number KOZ1, wherein a continuously monotone variable G4 for the formation of first contiguous positions and at least one characterizing the mail further size G3 are provided for forming second contiguous positions of the combination number KOZ1,
2. b) encryption of the combination number KOZ1 to a crypto number KRZ1,
3. c) converting the crypto number KRZ1 into at least one marker symbol series MSR1 based on a set of symbols SSY1.

In a first variant 1, a marking symbol series are generated in a step 45a. In the manner according to the invention, due to the amount of information provided by the variables G0 to G5, which should only be partially printed unencrypted in the franking machine stamp image, at least part of the sizes are used in the franking machine to form a single number combination (sub-step 451) a single crypto-number is encrypted (sub-step 452) and then converted into a mark to be printed on the mail (sub-step 453). The storage of the data record to be generated for the marking in a window FE6 can take place in a concluding sub-step 454. Then the point c _{3 is} reached. As a result of this first variant carried out in sub-step 45a, the time otherwise required in the franking machine for generating further crypto-numbers can be saved.

It is provided that the continuously monotone variable G _{w is} at least one ascending or descending machine parameter, in particular a time count or its complement during the service life of the franking machine.

It is advantageous if a machine parameter is time-dependent, in particular if it comprises a variable G4a characterizing the decreasing battery voltage of the battery-backed memory and a second continuously monotonically decreasing variable G4b or the respective complements of the quantities G4a and G4b.

It is further provided in a variant that the second continuously monotonically decreasing quantity G4b is the complement of the number of pieces or a continuously monotonically decreasing time-dependent variable.

It is provided on the one hand in a variant that the steadily monotonically decreasing size is a numerical value corresponding to the next inspection date (INS) and a continuously monotonically decreasing time-dependent variable.

On the other hand, it is envisaged that a steadily monotonically increasing quantity includes the date or the number of pieces determined during the last inspection.

As has already been explained in more detail, it is advantageous if a part of a variable G0, G1 characterizing the user of the postage meter machine is provided by the control device 6 to form third contiguous positions of the combination number KOZ1.

Preferably, the upper 10 digits of the combination number KOZ1 for the TIME data (size G4) and the lower 4 digits for the post value (size G3) are provided in the sub-step 451 from the storage areas ST _W. This results in a combination number with 14 digits, which would then be encrypted. When using the DES algorithm, a maximum of 8 bytes, ie 16 digits, can be encrypted at once. Thus, the combination number KOZ1 can be supplemented in the direction of the lower digits, if necessary, by a further size. For example, the supplementary part may be part of the serial number SN or the number WRN of the advertising frame or the byte selected from the record of the advertising frame in dependence on another size.

This combination number KOZ1 can be encrypted in sub-step 452 in about 210 ms into a crypto KRZ1, with a number of further known steps taking place here. Thereafter, in the sub-step 453, the crypto KRZ1 is converted into a corresponding symbol series on the basis of a predetermined marking list stored in the memory areas M of the non-volatile main memory 5. This can in particular which, in the later impression so advantageous, increased information density can be achieved.

Even if one - in the FIG. 3f shown set with 10 symbols, ie without an increase in the information density compared to the crypto KRZ1 is used, but two rows of marks (side by side, or among each other) would be printed, more symbols could remain, with which further information could be displayed unencrypted or encrypted , Preferably, this is then information which does not change or hardly changes, and only needs to be encrypted once and converted into a symbol series. This is preferably the size G5, ie inspection data (INS), for example the date of the last inspection or the remainder of the serial number SN or SN and the byte of the record of the advertising language frame which was not included in the first combination number KOZ1, or selected predetermined parts thereof. In the Figure 3c are in - here othogonal to each other - windows FE6 and FE10 each a row with 20 symbols shown, with which, for example, the total of 8 bytes, ie 16 digits, the crypto KRZ1 and other information may be played unencrypted or otherwise encrypted.

A second variant with a step 45b in addition to the step 45a differs from the first variant by other output variables or input quantities that are to be considered equally. In the second variant, a marker symbol series are successively generated in two steps 45b and 45a, the step 45b being carried out analogously to step 45a.

In this case, in a first sub-step 450 of the executed by the control device 6 step 45 is checked If a flag has been set to cause the sub-steps 45b and / or 45a to be performed, a second combination number KOZ2 having at least the other part of the size G0, G1 characterizing the user of the franking machine is then formed in the sub-step 45b encrypted second crypto KRZ2 and then converted into at least one second marker symbol series MSR2 based on a second set SSY2 of symbols.

In sub-step 455 is compared to the sub-step 451 a combination number KOZ2 formed, in which case in particular the sizes for other parts of the serial number, for advertising cliché (frame) number u.a. Sizes can go down. In sub-step 456, as in sub-step 452, a crypto-number KOZ2 is formed. In sub-step 457, the transformation then takes place again into a marker symbol series, which is temporarily stored in sub-step 458.

Subsequently, sub-step 45a comprising sub-steps 451 to 453 takes place. This may optionally be connected by a sub-step 454. Subsequently, the point c _{3 is} reached.

In this case, despite twice the application of the DES-A1-gorithmusses, there is nevertheless a time saving since an evaluation takes place in a first sub-step 450 as to whether the selected quantities required for the formation of the marking symbol series in sub-step 45b have been changed by an input , Upon re-entry of selected special sizes, a flag would be set in step 44 and taken into account in subsequent formation of data for a new marker symbol row to process step 45b here. However, if this is not the case, then the marker symbol series already formed earlier and stored nonvolatilely in a memory area 458 can be used or parts of the marker symbol series are used.

In an embodiment variant, a different encryption algorithm than the DES is used for saving time in the sub-step 456.

In an advantageous embodiment variant, a transformation is carried out in sub-step 453 of the first variant or in sub-step 457 of the second variant to additionally increase the information density of the marker symbol series compared to the crypto-number KRZ1 or KRZ2. For example, with a crypto number of 16 digits, a set of 22 symbols is now used to store the information using only 12 digits - in the FIG. 3b apparent way - to map. For two kryto numbers, the marker symbol row shown there must be doubled. This can be done by means of a to - in FIG. 3b shown - mark symbol series parallel other marker symbol sequence done.

Accordingly, it can be further shown that for a marker symbol string of 14 digits only a symbol set comprising 14 symbols is required. The previously described test in the postal authority of such mark symbol rows having mail pieces can - after the second evaluation variant - by a reverse transformation of the mark symbol series in crypto KRZ1 KRZ2 if necessary, their subsequent decryption to combination numbers KOZ1 KOZ2 if necessary, whose individual sizes with on the Postage in the franking picture can be compared to open printed sizes.

A marker string - as in the FIG. 3a has been shown - is designed for 10 digits and can map a crypto KRZ1 if the symbol set has 40 symbols. Here is a fully automated input and evaluation - even subjective errors of the Inspector in detecting the symbols to avoid, makes sense.

In a step following step 45, the data of a record for the mark symbol series are then embedded in the remaining pixel data after their decompression. For this purpose, in particular two different possibilities are provided according to the invention. The one possibility is based on the FIG. 11 another based on the FIG. 13 explained in more detail.

In the FIG. 11 In particular, step 46 of FIG FIG. 5 explained. In a sub-step 4660, window characteristics Z _k and T _{k are} specified for changed window data, the window change number p 'is determined, and a window count variable q is set equal to zero. In a sub-step 4661 it is evaluated whether window count variable q is equal to the window change number p '. Then the point d ₃ and thus the next step 47 would already be reached. However, this path is not regularly entered at the beginning because the monotonically increasing size constantly generates new marker symbol rows for each impression.

Otherwise, if a change has occurred, the program branches to sub-step 4662 to enter window parameters corresponding to the changed windows and set initial conditions.

In a sub-step 4663, a new source address for the data of the record of the currently processed window FEk is generated to load in the next sub-step 4664 a byte of the coded window data of type 2 from the memory area B _k in registers of the nonvolatile memory 7a and to detect control characters ,

In a sub-step 4665, the window column run length Y _k then becomes the window column run length variable W _k incremented, which is still zero here. Thereafter, control characters for color changes are examined (sub-step 4666) and, if necessary, branched back to sub-step 4663 or searched for control characters column end (sub-step 4667). If successful, the sub-step 4669 is branched and the window column counter P _{k is} incremented. Otherwise, in the next sub-step 4668 a decoding of the control code and conversion of the called byte into decompressed binary window pixel data of type 2 is to be carried out.

Sub-step 4670 then checks whether all columns of the window have been processed. If this is the case, a branch is made to the sub-step 4671 and the column run length Y _{k of} the window FEk is stored in the memory 7b and branched back to the sub-step 4673. If it is detected in sub-step 4670 that not all the columns have yet been processed, branching back to sub-step 4663 via sub-step 4672, whereby the window characteristic value Y _k and the color flip-flop are set back to zero. In the next sub-step 4668, a decoding of the control code and an implementation of the called byte into decompressed binary window pixel data of type 2 may then be performed again.

After sub-step 4673, where the parameters of the next changed window are called, the program branches back to sub-step 4661. When processing all change windows, the point d _{3 is} reached.

The in the FIG. 12 shown printing routine for the composition of data from the pixel memory areas I and II expires when a print request is detected in step 47 and data in a - in the FIG. 5 not shown - sub-step 471 have been loaded.

In sub-step 471, the end address Z _{end is} loaded, the current address Z (run variable) to the value of Source address Z ₀ in the area I of the pixel memory 7c, the window column counter P _k to the respective value corresponding to the stored window column variable T _k , the window bit count lengths X _{k set} to the respective value corresponding to the stored window column run length Y _k and the destination addresses Z _k for k = p window and the total run length R for a pressure column s _k loaded. The pressure column has N pressure elements.

Subsequently, with the reaching of the point e ₁ at the beginning of the step 48, several sub-steps take place. Thus, first in a sub-step 481, the register 15 of the printer controller 14 is serially loaded bit by bit from the area I of the pixel memory 7c with binary print gap data called with the address Z and the window counter h is set to a number which is the number of windows increased by one p corresponds. In sub-step 482, a window counter h is decremented, which successively outputs window numbers k, whereupon in sub-step 483 the address Z reached in the pixel memory is compared with the window start address Z _{k of} the window FE _k . If the comparison is positive and a window start address is reached, the process branches to sub-step 489, which in turn consists of sub-steps 4891 to 4895. Otherwise, a branch is made to sub-step 484.

In sub-step 4891, a first bit from region II of pixel memory 7c for window FE _k is serially loaded into register 15, the sub-step 4892 increments address Z and bit count variable 1 and decrements window bit count X _k . In a sub-step 4893, if not all bits corresponding to the window column run length Y _{k have been} loaded, further bits are loaded from area II. Otherwise, a branch is made to the sub-step 4894, wherein the window start address Z _k for addressing the next Window column correspondingly increased by the total length R and the window column counter P _{k is} decremented. At the same time, the original window bit count length X _k corresponding to the window column run length Y _{k is} restored.

Sub-step 4895 then checks whether all window columns have been processed. If this is the case, then the starting address Z _k for the corresponding window FE _{k is set} to zero or an address which lies outside of the pixel memory area I. Otherwise, and after the sub-step 4896, a branch is made to the point e ₁ .

In sub-step 484 it is checked whether all window start addresses have been queried. If this is done, then the sub-step 485 is branched to increment the current address Z. If this has not yet occurred, the system branches back to sub-step 481 in order to further decrement window counter h until the next window start address is found or until sub-step 484 causes window counter h to become zero.

In sub-step 486 it is checked whether all data for the column s _k to be printed in register 15 is loaded. If this is not yet the case, the bit count variable 1 is incremented in the sub-step 488 to return to the point e ₁ and then (in the sub-step 481) to load the next bit addressed by the address Z from the pixel memory area into the register 15.

If the register 15 is full, then the column is printed out in sub-step 487. After that, in one - already in the FIG. 5 Step 50 determines whether all the pixel data of the pixel storage areas I and II have been printed out, that is, the mailpiece has been fully franked. If that is the case, then the point f _{1 is} reached. Otherwise it will be on the sub-step 501 branches and the bit count variable 1 is reset to zero, after which branch back to the point e ₁ . Now the next pressure column can be created.

The print routine for composing data taken from only one pixel memory area I and work memory areas will be described with reference to FIG FIG. 13 explained in more detail. After printing request, which in the - in the FIG. 6 Step 47 is detected, immediately takes place a sub-step 471, as already in connection with the FIG. 12 was explained in order to reach the point e ₂ . The now beginning - already in the FIG. 6 Step 49 includes sub-steps 491 to 497 and sub-steps 4990 to 4999. Sub-steps 491 to 497 proceed with the same result in the same order as sub-steps 481 to 487 used in connection with Figs FIG. 12 already explained. Only in the sub-step 493 is the sub-step 4990 branched in order to reset a color flip-flop to g: = 0, whereupon the already described in connection with the FIG. 6 explained process of printing column-wise decompression of coded window data type 2 with the sub-step 4991 is initiated. Here is an already - in connection with the FIG. 7 - Explained color change in the evaluation of the type 2 window pixel data to be converted, so that the first hexadecimal data of the retrieved record are evaluated as colored, for example. The source address is incremented. Then loading the compressed window data for the window FE _k of type 2, in particular for the tag data from which takes place (in the corresponding sub-memory B _j stored) predetermined data set in the register 200 of the volatile memory 7a in sub-step 4992nd A hexadecimal "QQ "corresponds to one byte.

In this case also the control codes are detected. If a window column is to be printed which starts with non-colored pixels, that is to say not to be printed, a control code "color change" would have come first in the data record at this point. Thus, in sub-step 4993, branch back to sub-step 4991 to perform the color change. Otherwise, the system branches to sub-step 4994. In sub-step 4994 it is determined whether a control code "column end" exists. If this is not the case, then the register contents must be decoded and decompressed. For each time-coded hexadecimal numerical value, the character memory (CSP) 9 contains a series of binary pixel data which can be correspondingly retrieved on the basis of the hexadecimal number loaded in the volatile main memory 7a. This is done in sub-step 4995, and then the decompressed window pixel data for a column of windows FE _j of type 2 are loaded serially into the print register 15 of the printer controller 14.

In sub-step 4996, the address is then incremented and a corresponding next hexadecimal number is selected in the data set stored in non-volatile random access memory 5 in sub-area B ₅ , as well as the bits converted in decoding the run-length encoding to form a window column run-length variable W _j with which the destination address is incremented. Thus, the new destination address for the reading is generated. and it may be branched back to sub-step 4991.

When the end of the column has been reached, sub-steps 4997 to 4999 follow, and then branch back to point e ₂ . The sub-steps 4998 and 4999 run similar to the - in the FIG. 12 shown - sub-steps 4895 and 4894.

Sub-step 497 prints the finished loaded print column. Sub-steps 491 to 497 are similar to those in the FIG. 12 shown - sub-steps 481-487.

In addition to a lower mechanical complexity results in a high printing speed at a variety in a stored solid printed image to be embedded variable print image data.

In a further variant of the method for producing a security impression for franking machines, a printer module applies a fully electronically generated franking image to a mail piece, corresponding to the current inputs or data made via an input means and an input / output control module, which can be checked by a display unit , It is provided that the data for the constant parts of the franking image, which concern at least the frame of an advertising cliché, are stored in a first memory area A _{i of} the program memory 11, that the nonvolatile memory 5 has a plurality of memory areas and that the data for the variable or ., semivariable parts of the franking image are stored in second memory areas B _k and B _{j of} the nonvolatile memory 5. The selectable cost center numbers for the cost centers are in a third memory area C of the non-volatile memory 5, the name of the Werbeklischeerrahmen assigned. The name of the ad frame is equivalent to ad frame number WRN.

With the microprocessor-controlled printing process and the printer control, the print pattern is generated from fixed data and current data. It is envisaged that corresponding to the name or the Werbeklischeerrahmennummer WRN, which are stored in memory areas of the nonvolatile memory 5 and the current Mark set frame of an advertising cliche. Frame data is extracted from the first memory area of the program memory 11, decompressed and stored in a first area I of a pixel memory 7C. Semivariable window data from the second memory area B _j are subsequently embedded in the aforementioned constant data. Before printing, in the case of a print request 47, billing is performed in a sub-step 470 under the aforementioned account number in the cost center memory 10, and then variable window data is embedded from the second memory area B _k for the mark data during printing, with embedding during loading of the print register 15 he follows.

In particular, the advantageous variants have been explained in more detail, but it is quite possible with a faster hardware to change the order of the method steps in order to generate as quickly as a security footprint.

Is waited in step 47 for a successful print request on a print routine containing step 48 or 49 and at a not yet completed print request in a queue on the print request by - in the Figures 5 or 6 shown - is returned to the beginning of step 47 directly, according to the invention has a further temporal advantage, since not permanently new crypto numbers must be generated according to the DES algorithm. The next detectable time after a generation of the marker symbol series can already trigger the pressure. Nevertheless, as mentioned, other reverse branches are possible. Step 47 may be preceded by an additional step 61 in order to branch to a standby mode (step 62) in step 61 if a missing print request is detected, for example the current time and / or display the date and / or perform error checks automatically. From the standby mode 62 is branched back to the starting step 40 directly or indirectly via further steps or modes.

Likewise, in another variant, step 45 may be placed between steps 53 and 54. In the step 54 following the step 45, the data of a data set for the marking symbol series are then embedded in the remaining pixel data of the pixel memory area I after they have been decompressed. Another pixel storage area is not required.

Another opposite variant stores only the frame pixel data in the pixel memory area and embeds all the window pixel data equally into the corresponding columns read into the print register 15, without requiring a pixel memory for window data therebetween.

In one variant, without the automatic editing of cliché parts, memory areas D and E can be dispensed with. Instead, the immutable image information for a finished cliche is stored in a read-only memory (ROM), e.g. in the program memory 11. In the decoding of the invariable image information is accessed on the read-only memory 11, wherein the caching of cliché parts can be omitted.

The program memory 11 is connected to the control device 6, the data for the constant parts of the franking image, which relate to at least one advertising cliche frame, being stored in a first memory area A _i . An assigned name identifies the ad frame. The non-volatile main memory 5 is connected to the control device 6, wherein the data for the semivariable parts of the Franking image in the second memory area B _j are stored and an associated name indicates the semivariable part. A first assignment of the names of the semivariable parts to the names of the constant parts is according to the stored program. A second assignment is made in accordance with the cost center number stored in a third memory area C, so that optionally each cost center KST is assigned an advertising cliché. A microprocessor is provided in the controller 6 for encryption to tag pixel image data prior to its columnar embedding into the remaining pixel image data. Therefore, a volatile memory 7, a printer controller 14 is connected to the microprocessor with pressure register 15, with which, under the control of the microprocessor according to a program stored in the program memory 11, the marker pixel image data is inserted into the remaining fixed and variable pixel image data during printing.

Claims (13)

1. A method for checking a security print at a postal authority or similar institution,
   characterized by the steps of:

   - determining the expected time t_{K, n+1} until the next credit reload at a remote data central, on the basis of a determined average postage consumption of a franking-machine user and based on the amount of a last credit reload of the franking-machine user;

   - receiving a message at the postal authority that the franking machine is regarded as suspicious on part of a remote data central, such franking machines being suspicious that have not reloaded a credit or have not communicated with the data central for quite some time;

   - checking the franking of the postal items from suspicious franking machines, wherein manipulations are detected with the involvement of further data stored and/or calculated at the data central.
2. A method according to claim 1, characterized by a determination of the expected time t_K,n+1 until the next credit reload on the basis of a determined average postage consumption P_K of a franking-machine user K and based on the amount of his last credit reload G_K,n according to the formula: $${\mathrm{t}}_{\mathrm{K}\mathrm{,}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{=}\frac{{\mathrm{G}}_{\mathrm{K}\mathrm{,}\mathrm{n}}}{{\mathrm{P}}_{\mathrm{K}}}\mathrm{*}\left(\mathrm{1}\mathrm{+}\mathrm{1}\mathrm{/}\mathrm{\beta }\right)$$

   

   
   with the term (1 + 1/β) for compensating for normal fluctuations of the postage consumption.
3. A method according to claim 1, characterized in that, on the basis of the average postage consumption P_K determined for the user K, said user is classified as belonging to one of for example three consumption classes A, B and C to each of which a typical consumption time t_A, t_B, t_C is assigned for the purpose of determining the expected time t_K,n+1 until the next credit reload.
4. A method according to claim 1, characterized in that the expected time t_K,n+1 until the next credit reload is determined according to the following formula: $${\mathrm{t}}_{\mathrm{K}\mathrm{,}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{=}\left({\mathrm{G}}_{\mathrm{K}\mathrm{,}\mathrm{n}\mathrm{+}\mathrm{1}}\mathrm{+}\mathrm{R}\mathrm{1}\mathrm{*}{\mathrm{\alpha }}_{\mathrm{x}}\right)\mathrm{*}\mathrm{1}\mathrm{/}{\mathrm{P}}_{\mathrm{K}}$$

   

   
   with the desired reload credit G_K,n+1 that is reloaded into the franking machine, with the residual amount R1 available in the franking machine, with the average postage consumption P_K determined on that basis for the user K and with the disposition factor α_x depending on the classification of the franking-machine user as A, B or C customer.
5. A method according to one of claims 1 to 4, characterized in that the expected time t_K,n+1 until the next credit reload is determined at the remote data central DZ and in the franking machine in order to generate a message that the franking machine is regarded as suspicious on part of a remote data central.
6. A method according to one of the above claims 1 to 5, characterized in that, during a communication via a communication connection L, the franking machine transmits to the data central register values before a credit reload and that, on part of the data central, the behaviour of the franking-machine user is monitored on the basis of further data transmitted during the communication in order to detect suspicious franking machines and in order to determine a franking-machine profile, and that at least a postponement of an on-site franking-machine inspection is effected by regular communication of the franking machine with the remote data central.
7. A method according to claim 6, characterized in that, using the queried franking-machine-specific data, such as the number of franking processes effected or of all prints (register values R4 or R8) and a minimum franking value, suspicious franking machines are detected according to the formulas: $${\mathrm{V}}_{\mathrm{susp}\mathrm{1}}\mathrm{=}\frac{\mathrm{R}\mathrm{4}}{\left(\mathrm{R}\mathrm{3}\mathrm{-}\mathrm{R}\mathrm{1}\right)}\mathrm{*}{\mathrm{F}}_{\min }\mathrm{=}\frac{\mathrm{R}\mathrm{4}}{\mathrm{R}\mathrm{2}}\mathrm{*}{\mathrm{F}}_{\min }$$

   

   
   and, if R1old ≠ R1, for checking the change, moreover: $${\mathrm{V}}_{\mathrm{susp}\mathrm{2}}\mathrm{=}\frac{\mathrm{R}\mathrm{4}\mathrm{-}\mathrm{R}\mathrm{4}\mathrm{old}}{\mathrm{R}\mathrm{1}\mathrm{old}\mathrm{-}\mathrm{R}\mathrm{1}}\mathrm{*}{\mathrm{F}}_{\min }$$

   

   
   with

   R1: query value in the n^th remote value definition

   R1_new: query value before the (n+1)^th remote value definition of a reload credit

   V_susp: heuristic value providing information on the condition of the franking machine

   F_min: minimal franking value.
8. A method according to claim 7, characterized in that, using the queried franking-machine-specific data, at least two levels are distinguished within the suspicious mode:

   Level 1: franking machine is suspicious or

   Level 2: franking machine has been manipulated.
9. A method according to claim 5, characterized in that there is generated a message that the franking machine is regarded as suspicious on part of a remote data central in such a way that the franking machine, based either on an own calculation or on a message from the data central, activates a certain sign and prints it at a predetermined place in the franking print.
10. A method according to claim 9, characterized in that the special sign is a cluster of printed image dots or a barcode or an information in a marking symbol row by means of which it is indicated in the process of checking the franking print that the respective franking machine is suspicious and that, in such case, the postal authority effects a check of the postal item and, if the suspicion is hardened, causes the K^th franking machine FM_K to be inspected on site.
11. A method according to claims 5, 9 and 10, characterized in that the information of the suspicious mode is in addition printed in an encrypted form or that, in a combined number that forms the basis of a marking symbol row, a fourth number that allows a check of the serial number is set to a certain value.
12. A method according to claims 1 and 5, characterized in that, for the examination of a security print at a postal authority or similar institution, the following steps are carried out:

    - the franking machine transmits its register values to the data central for checking;

    - determination of the time of the next communication by the data central and/or the franking machine;

    - the data central examines the grounds for suspicion and signals that to the franking machine or triggers and extraordinary check of the franking machine on site;

    - the competent post office or a test institute entrusted with the checking checks the security print either on a sample basis or on the basis of an information from the data central that the franking machine is regarded as suspicious;

    - analysis of the additional specific signs contained in the security print or of the lack of such special signs if the franking machine itself detects a manipulation;

    - determination of the true sender in case of a manipulation.
13. A method according to claim 12, characterized in that, before the check for collection of the marking of a security print by a marking reader (24) connected to a computer, input, output and memory means, a CCD line camera determines for every column the contrast value of the image dots belonging to the column; that a threshold-value comparison is made by means of a comparator for the purpose of assigning the binary data 1 and 0 to the image dots; and that the threshold value is adapted to the greatly varying light reflection factors of the different types of paper used for envelopes by determining the threshold value on the basis of a reference field (FE 7) that comprises a sequence of bars and is arranged at the level of the row of symbols and before it as mean value of the light and dark strips of the reference field.

Images