EP0390731B1 - Method for recharging the funding register of a postage meter and postage meter for carrying out the method - Google Patents

Abstract

For recharging the funding register (20) of a franking machine, a return code is released from the read-only memory (21) of the latter, which must be notified, along with the amount to be recharged, to an authorising control centre in order to obtain from this control centre an input code enabling the funding register to be recharged with this amount. Numerous information pairs consisting of an input code and a return code are stored in tabular form in the control centre and in the read-only memory (21) of the franking machine. These codes consist of real random numbers. Once the input code has been entered in the franking machine, a search is performed in the read-only memory (21) of the franking machine, on the basis of a program of a central electronic control unit of the franking machine, to identify the position in the table in which an identical real random number occurs. Once this identity has been established, the funding register (20) is recharged by a prespecified amount according to the table and the new return code is issued which is required for future recharging and is allocated to the last input code according to the table. <IMAGE>

Description

The invention relates to a method and a franking machine with the features of the preambles of the independent claims.

According to known methods of this kind, e.g. in accordance with US-A-4,097,923, the required pairing information is provided in accordance with a rule that is uniform for all franking machines, i.e. according to an algorithm, calculated both in the control center and in the franking machine and compared after the information exchange with the control center with regard to the possible pairing in the franking machine. This results in a pair of information that is valid for filling up the value memory when the comparator of the franking machine has determined that both individual pieces of information of the pair have been calculated according to the same rule. This rule thus forms an access key for the acquisition of new amounts of value that can be used in the franking machine.

These known methods have the disadvantage of limited security against unauthorized filling of value specifications, because the key to the security system valid for all franking machines, i.e. the algorithm on which this is based can be determined relatively easily by trial and error with the help of conventional computers. The random number generators, which are sometimes used in known methods, also contain a calculation rule and therefore do not supply any real random numbers, so that they likewise only provide limited security.

The invention has for its object to find a method and a franking machine of the type mentioned, which without increased equipment expenditure ensure a significantly improved security against unauthorized filling of the value storage.

This object is achieved according to the invention by the features of the independent claims.

Since, due to the method, both the individual information and its paired assignment are completely random, ie independent for each franking machine according to real random characteristics are formed and these are only legible at the head office, there is a very high level of security against misuse.

Security can be further increased in that the pairs of information are provided in table form in the memory of the postage meter machine and accordingly in the central office and can only be called up in the order of the table-like arrangement for filling up the value memory.

There can be several control centers, e.g. are located at the postal directorate of a particular postal district and are responsible for the franking machines available in this postal district. The technical effort can e.g. At individual smaller post offices, it can be reduced that the pairs of information, or their tables, are only stored in the headquarters in the form of signed, signed sheets, instead of storing them electronically in a computer system.

Fig.1

ein Schaltpult einer Frankiermaschine,

Fig.1A

das Hauptanzeigefeld zu dem Schaltpult nach Fig.1 mit dem Ziffernfeld für die Informationseingabe,

Fig.1B

das Hauptanzeigefeld der Fig.1B, mit sieben Ziffern einer achtziffrigen Eingabeeinformation,

Fig.2

einen Teil eines vereinfachten Blockschemas der zentralen elektronischen Steuereinheit der Frankiermaschine,

Fig.3A

den oberen Teil eines Flussdiagrammes des Programmablaufs für die Auffüllung des Wertvorgabespeichers,

Fig.3B

den unteren Teil zu dem Flussdiagramm nach Fig.3A,

Fig.4

ein Blockschema der verketteten Datenfelder (Pointer) eines nichtflüchtigen RAM-Registers sowie der die Informationspaare enthaltenden Codetabellen eines Festwertspeichers (ROM) und

Fig.5

ein Abbildung von schriftlichen Codetabellen.

Further advantageous embodiments of the invention result from the following description with reference to the drawings. It shows:

Fig. 1

a control panel of a franking machine,

Fig.1A

the main display field for the control panel according to FIG. 1 with the number field for information input,

Fig.1B

the main display field of Fig. 1B, with seven digits of eight-digit input information,

Fig. 2

part of a simplified block diagram of the central electronic control unit of the franking machine,

Fig. 3A

the upper part of a flowchart of the program flow for filling the default value memory,

Fig. 3B

the lower part of the flow chart according to FIG. 3A,

Fig. 4

a block diagram of the linked data fields (pointer) of a non-volatile RAM register and the code tables containing the information pairs of a read-only memory (ROM) and

Fig. 5

an illustration of written code tables.

The control desk 1 shown in FIG. 1 is provided, for example, on the housing of a postage meter machine, the details of which with regard to its electronically controlled, electromechanical drive and the function of the control desk elements in CH-PS 669 056 (US Serial No. 256,070 and US-PS 4,520,725) as well as described in CH applications No. 853/89 and 854/89. As mentioned there, the input buttons 2-6 of the control panel 1, which are located below the display panel 7, can be used, depending on the selection of a corresponding program using the D-SET button 8, either for the input and for the electromechanical setting of predetermined franking values according to the assigned label 9 or for incrementally passing on individual decimal digits of a franking value. The introduction of a zero key 10 into the key receptacle 11 of the control panel 1 and the subsequent actuation of the D-SET key 8 gives these input keys 2-6 a further function in accordance with the program diagram of FIGS. 3A, B, by using keys on a numeric keypad for entering code digits. The five other keys on the numeric keypad result from the change in function of the function keys 13-17 arranged symmetrically to the input keys 2-6 above the display field 7. After this function switchover, the numerical values 0-9 assigned to the respective keys 2-6 and 13-17 are shown next to the corresponding keys on the display panel 7, as shown in FIGS. 1A and 1B.

The switchable first function of the "CRED LEFT" function key 13 is used to query the default value that is still available for franking. A red light-emitting diode 18 arranged above this labeled function key lights up when a value entered for franking exceeds the remaining default value. At this moment the franking machine can no longer be used for franking until the value memory 20 (FIG. 2) is refilled.

The block diagram of the central control unit according to FIG. 2 shows the peripheral elements already mentioned as blocks "KEYBORD" 8.2-6, 13-17, "INDICATOR LAMPS" 18, "DISPLAYS" 7, "KEY" 10. The signals of the function keys 8, 2-6, 13-17 and the key 10 are converted into binary word signals by ENCODER 22 and fed to a BUSCONTROLLER and MULTIPLEXER 24. This periodically or spontaneously operates the aforementioned peripheral elements, separates inputs and outputs and brings or reads the information in sequential form to or from the peripheral bus 25. It can be designed as a separate microprocessor. The display panel 7 and the indicator lamps (18) of the control panel 1 are each operated via a DECODER / DRIVER 23 in order to be controlled with the required electrical power on the basis of binary information. The "CLOCK" element 26 is used for time control for the date display on the second display 27 of the control panel 1. The central computer bus 28 is connected to the BUS CONTROLLER and MULTIPLEXER 24 via a bus port 29 and a bus isolator 30. The bus isolator 30 causes the signals to be separated so that no faults reach the computer bus 28. The bus port 29 converts the signals from the fast computer bus 28 to the slow peripheral bus 25.

The central computer CPU 32 and several memories 20, 21, 33, 34 are connected to the computer bus 28. The non-volatile data memory RAM 20, which is designed, for example, as a RAM with battery, as NOVRAM, EEPROM or EAROM, stores intermediate results and contains the value specification that can be used by franking and the chain fields (POINTERS) (FIG. 4) for querying those in the read-only memory ROM 21 contained code tables (Fig.4). This read-only memory 21 is enclosed in the sealed housing of the franking machine or fastened in a sealed manner. It can be replaced by a person authorized by the post office, for example if the code tables provided or a have been consumed by them. This can take place at the same time as the machine revision which has become due due to the correspondingly long operating time of the franking machine. The consumption is signaled, for example, on the display 7 by a suitable written information ("out of order") after the LAST POINTER has arrived at the end of one of the stored code tables 38 according to the register 36 of the block diagram in FIG. Furthermore, a program memory 33 designed as a ROM, PROM or EPROM is provided for the various function programs of the franking machine, as described in more detail in the aforementioned CH applications 853/89 and 854/89, among others. Finally, a data memory RAM 34 is provided for temporary storage. It goes without saying that different memories of the same characteristic can also be present as memory fields in a uniform memory chip.

In order to make it possible to fill up the default value memory 20 only after obtaining prior approval from the post office, e.g. After an amount corresponding to the desired default value has been transferred to the relevant post office account, a coded information exchange must take place between the franking machine and the authorizing post office. For this information exchange, the post office must be informed of a return code number stored in the read-only memory (ROM) 21 of the franking machine and the desired amount to be refilled. The authorizing input code number subsequently supplied by the post office forms the key number for filling up the default value memory RAM 20 of the franking machine. This exchange of information, e.g. in the form of an eight-digit number, can be done in any way, e.g. orally or by modem over a telephone connection or in writing.

The required return code is always released by the franking machine in response, ie in "return", for the input of an input code number authorizing the filling from the otherwise inaccessible read-only memory ROM 21 and can be called up as often as desired on the display 7 of the control panel 1, if the zero key 10 in the key holder 11 of the franking machine is stuck. The first return code is thus made available to the user of the franking machine for later filling by the franking machine from its read-only memory ROM 21 after he has entered the first input code number for the first use of the franking machine. This first input code number is supplied to the buyer when the franking machine is purchased, for example, or was entered before the sale for a first replenishment paid for with the purchase.

The information required for each replenishment in the form of two eight-digit code numbers results from the return code communicated to the post office, e.g. corresponding to the number combination "21379432" shown on the display 7, together with the specified desired replenishment amount of e.g. Fr. 500, - and the new input code number, which corresponds to the desired replenishment amount and is taken from the post office for the relevant table according to Fig. 5 for the postage meter in question. According to this table, the input code number required for replenishment by CHF 500 is equal to the number combination "134411 76˝. The new return code number, which is automatically displayed by the franking machine for subsequent subsequent replenishment by this amount, 5 corresponds to the number combination "23490039" according to this table according to Fig. 5. This return code number is used for comparison with the return code number released by the franking machine, or for identification if the user subsequently requests a further refill amount for his franking machine and will in principle not communicated by the post office.

The program sequence of the central electronic control unit (FIG. 2) when filling up its default value memory is explained in more detail below with the aid of the flow chart in FIGS. 3A, B. The program path via a transition point represented by a circle 40 takes place when the statement associated with the respective branch, e.g. "Key No. = 0", does not apply.

The complete program run sets according to the flow chart According to branch 41, the presence of the key 10 with the number "0" first, ie this must be signaled via the key holder 11 of the control panel 1 of the control unit according to FIG. According to branch 42, the "PENALTY" timer should have the value zero, because according to the bottom part of the flowchart it only comes into operation after a complete incorrect entry of a code entry number. By doubling the timing of incorrect entries, it is intended to prevent numerous entries from being tried. According to function fields 43, 44, the last pointer position Pw in a table Nw is taken from the register "LETZTER POINTER" (FIG. 4) in order to display the old return code required for obtaining an authoritative input code in accordance with function field 45, such as is shown in Fig.1.

In order to be able to enter the input code received from the post office, the code input function is activated after inserting the key No. 0 according to the functional fields 46 to 51. The result of this is that, according to function fields 49 to 51, ten flashing arrows 52 with the value numbers 53 on the numeric keypad 2-6, 14-17 and eight dashes "--------" appear on the display 7, which indicate the free spaces mark for the code numbers to be entered. The line 54 provided on the left outside in the line of lines also flashes, as indicated by the dashed lines in FIGS. 1A, B. This means that the program is ready to start entering the code at this point.

For each of the eight code tables Nw = 0 to Nw = 7, a pointer Pw is stored in the pointer register (FIG. 4) of the non-volatile RAM memory 20, which pointer points to the next code line 55 with the pointer that has not yet been used for filling -Numbers 0, 1,2, 3, ... shows. The pointer registers are each called with the number Nw of the code table. The lines 55 contained in each of the code tables Nw each have a return code and a primary code. The latter can be found by program-wise searching of all stored tables Nw and compared with the input code until the primary code stored in the code register at branch 56 matches this Input code and then according to function field 57, the value 58 corresponding to the relevant code table Nw can be added to the value specification register 20.

The input code number begins with the number "1" because each input code number has a "1" as the first digit, while each return code number begins with a "2". To do this, press the button 13 of the control panel 1 located next to the "1" shown in the display 7. Then the table number Nw corresponding to the desired replenishment amount is entered. According to the table in FIG. 5, the number "1" must be entered for the refill amount of CHF 100. Then enter the number sequence "445378" following this table. Fig. 1B shows the display 7 before entering the last number "8" of this example. The line "-" flashes at the point to be completed. The branch 61 corresponds to the program position at which an input key 2-6, 13-17 is to be pressed. According to function field 62, the key value is entered in the code input register and, in the subsequent function field 63, the reduced number of free number spaces "-" is correspondingly reduced in a digit counter. The branch 64 causes the program to continue in the same way along the returning program loop 65 and via the function fields 50, 51, 61-64 until there is no free number space "-" and consequently eight numbers "11445378" have been entered .

After the input code has been completely entered, the code tables Nw are searched according to function field 73 for the primary code having the same number. According to functional field 66, this begins with table Nw = 0. If the primary code was not found in the relevant table Nw and thus the condition "code register = primary code" of branch 56 was not met, then the next table Nw becomes functional field 67 "increment Nw" fetched to be searched. This continues according to branch 68 and the returning program loop 69 until the table Nw = 8 has been searched without the condition of branch 56 having been fulfilled, or without finding the appropriate primary code. In this case there is an incorrect entry and the entry program is interrupted for a certain time by the PENALTY timer taking effect according to function fields 70 to 72. After approval, the previous return code appears again on display 7 and the entry can be started again. If the eight-digit number entered is again not found as the primary code number in a table Nw of the read-only memory 21, the interruption or penalty time increases twice.

If the identity between the entered code number "11445378" and the primary code number has been determined at branch 56, the PENALTY timer according to function fields 74, 75 is reset to zero after any previous incorrect entry. Furthermore, the pointer number (Po) is increased by a value (field 76) and saved as a new pointer in register 36 "LAST POINTER" together with the associated table number (Nw = 0) (field 77), so that the same code number is not repeated can be used for filling. Finally, the default value 58 of the table Nw is added to the default value register (20) and the new return code to be used for later replenishments appears on the display 7 as long as the key with the number "0" remains in the key holder 11 of the control panel 1. Another key is used for franking, of which there may be several depending on the number of users. The execution of these keys is described in more detail in US-A-4,788,623.

If the CE key 80 is pressed on the branch 61 instead of an input key 2-6, 13-17, the number entered at the relevant number place disappears by a space character "-" being overwritten there according to function field 81. The changed number of the numbers still to be entered is registered in the number counter at the function field 82. However, if, according to the previous branch 83, eight number spaces "--------" are already free, the program is returned to the functional field 50.

Claims (10)

1. Method for filling the value preset memory of a franking machine, whose functional sequence is controlled by a central electronic control unit, with a coded information exchange between an authorizing, remote control room and the user of the franking machine, in which by means of the control unit of the franking machine an appropriate association between the exchanged informations is checked, characterized in that the assembly of the coded informations and their reciprocal association for providing information pairs is carried out in random manner in the form of true random numbers and the informations and associations valid only for the particular franking machine are stored both in the control room and in a memory (21) of the franking machine, so that the informations pairs are only present in readable form in the control room, the filling of the value preset memory (20) of the franking machine taking place when it has been established, on the basis of a program of the control unit, that the information received from the control room and entered as an input code into the franking machine for filling the value preset memory (20) is already stored in identical form in the franking machine and in which there is an information pair from this input code and a return code to be provided for a further filling of the control room.
2. Method according to claim 1, characterized in that the informations and their reciprocal association are stored in pairs comprising the input code and the return code in tabular arrangement at the control room, an individual table being provided for each given, fillable value quantity.
3. Method according to claim 2, characterized in that only the input code of the information pair following in the table the information pair used for the preceding filling can be used for filling purposes.
4. Method according to one of the claims 1 to 4, characterized in that the coded information to be supplied by the control room to the franking machine user is read out of a table having in written form the information pairs.
5. Method according to one of the claims 1 to 4, characterized in that the informations comprise a sequence of numbers, the number located at a predetermined decimal point characterizing one of several possible value quantities given for filling.
6. Method according to one of the claims 1 to 5, characterized in that the number of a number sequence provided at a predetermined decimal location characterizes the particular information pair of the information pair.
7. Franking machine for performing the method according to claim 1 with an electronic control unit having a computer (32) and memories (20,21,33,34), which is provided with a plurality of input keys (2-6,13-17,8) and a display (7), one of the memories being a value preset memory (RAM,20) for the value quantities to be used during franking, which can be filled by a coded information exchange of the user of the franking machine with an authorizing, remote control room, characterized in that the electronic control unit of the franking machine has a read-only memory (ROM,21), which stores several fixed, predetermined information pairs comprising an input code and a return code, both codes consisting of true random numbers which, in the same way as their reciprocal association, are only valid for the particular franking machine, on the display (7) can be polled a return code to be transmitted to the remote control room, by means of the input keys (2-6,13-17) can be inputed an input code received from the remote control room as a result of the return code and containing a desired filling amount, so that the control unit can be checked by means of a stored program as to whether the inputed code is stored in the read-only memory, the value preset memory (20) can only be filled by an amount stored in the read-only memory and fixed by the inputted code if the result of the check is positive and after filling the value preset memory (20) the new return code to be transmitted to the remote control station for its next filling is released from the otherwise inaccessible read-only memory and displayed on the display (7).
8. Franking machine according to claim 7, characterized in that the information pairs are present in tabular, predetermined order in the read-only memory (ROM,21) and can only be polled in this order for filling the value preset memory (RAM,20).
9. Franking machine according to claim 8, characterized in that the information pairs are stored in several tables (38), there being one table (38) for each of the different predetermined value quantities (58) to be filled.
10. Franking machine according to one of the claims 7 to 9, characterized in that at least ten keys (2-6,13-17) are arranged along the display (7) and have a multiple function for the command input to the central electronic control unit, at least one command input means (10,8) being provided for introducing a program of the control unit for filling the value preset memory (20) and for modifying the function of the keys (2-6, 13-17), so that same form a tens keyboard for inputing a coded information in the form of a multiple-digit code number, the key value (0-9) being displayed alongside the particular key on the display (7).

Images