Classifications

• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01G—WEIGHING
  • G01G19/00—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups
  • G01G19/002—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups for postal parcels and letters
  • G01G19/005—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups for postal parcels and letters with electric or electronic computing means
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01G—WEIGHING
  • G01G19/00—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups
  • G01G19/40—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups with provisions for indicating, recording, or computing price or other quantities dependent on the weight
  • G01G19/413—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups with provisions for indicating, recording, or computing price or other quantities dependent on the weight using electromechanical or electronic computing means
  • G01G19/414—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups with provisions for indicating, recording, or computing price or other quantities dependent on the weight using electromechanical or electronic computing means using electronic computing means only
  • G01G19/4148—Weighing apparatus or methods adapted for special purposes not provided for in the preceding groups with provisions for indicating, recording, or computing price or other quantities dependent on the weight using electromechanical or electronic computing means using electronic computing means only for controlling postal rate in articles to be mailed
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
  • G07B17/0008—Communication details outside or between apparatus
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00362—Calculation or computing within apparatus, e.g. calculation of postage value
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00459—Details relating to mailpieces in a franking system
  • G07B17/00508—Printing or attaching on mailpieces
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
  • G07B17/0008—Communication details outside or between apparatus
  • G07B2017/00088—Communication details outside or between apparatus via landlines
  • G07B2017/00096—Communication details outside or between apparatus via landlines via phone lines
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
  • G07B17/0008—Communication details outside or between apparatus
  • G07B2017/00137—In a LAN
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
  • G07B17/0008—Communication details outside or between apparatus
  • G07B2017/00145—Communication details outside or between apparatus via the Internet
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
  • G07B17/0008—Communication details outside or between apparatus
  • G07B2017/00153—Communication details outside or between apparatus for sending information
  • G07B2017/00177—Communication details outside or between apparatus for sending information from a portable device, e.g. a card or a PCMCIA
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00193—Constructional details of apparatus in a franking system
  • G07B2017/00201—Open franking system, i.e. the printer is not dedicated to franking only, e.g. PC (Personal Computer)
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00193—Constructional details of apparatus in a franking system
  • G07B2017/00258—Electronic hardware aspects, e.g. type of circuits used
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00362—Calculation or computing within apparatus, e.g. calculation of postage value
  • G07B2017/0037—Calculation of postage value
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00362—Calculation or computing within apparatus, e.g. calculation of postage value
  • G07B2017/00419—Software organization, e.g. separation into objects
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
  • G07B17/00435—Details specific to central, non-customer apparatus, e.g. servers at post office or vendor
  • G07B2017/00443—Verification of mailpieces, e.g. by checking databases
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00459—Details relating to mailpieces in a franking system
  • G07B17/00508—Printing or attaching on mailpieces
  • G07B2017/00572—Details of printed item
  • G07B2017/0058—Printing of code
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00459—Details relating to mailpieces in a franking system
  • G07B17/00508—Printing or attaching on mailpieces
  • G07B2017/00572—Details of printed item
  • G07B2017/0058—Printing of code
  • G07B2017/00588—Barcode
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00459—Details relating to mailpieces in a franking system
  • G07B17/00508—Printing or attaching on mailpieces
  • G07B2017/00572—Details of printed item
  • G07B2017/00596—Printing of address
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00459—Details relating to mailpieces in a franking system
  • G07B17/00508—Printing or attaching on mailpieces
  • G07B2017/00572—Details of printed item
  • G07B2017/00604—Printing of advert or logo
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
  • G07B2017/00935—Passwords
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
  • G07B2017/00951—Error handling, e.g. EDC (Error Detection Codes)
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
  • G07B17/00—Franking apparatus
  • G07B17/00733—Cryptography or similar special procedures in a franking system
  • G07B2017/00959—Cryptographic modules, e.g. a PC encryption board
  • G07B2017/00967—PSD [Postal Security Device] as defined by the USPS [US Postal Service]

Definitions

• This invention relates in general to a portable postage storage device that can be coupled to processor-based systems to receive and retrieve an amount of authorized postage and to enable the printing of an authenticating indicia. More particularly, the invention relates to a system and method whereby a first processor-based system retrieves postage credit contained within a portable postage storage device coupled to a second processor-based system.
• postage meters were developed to relieve the manual application of stamps on mail and to automate the above process.
• a postage meter residing within an office is not as convenient and efficient as it may first seem to be.
• a postage meter may not be purchased, but must be rented.
• the rental fees alone are typically over twenty dollars per month. For a small business, this can be quite an expense to incur year after year.
• a postage meter must be adjusted, serviced and replenished manually; e.g.. each day the date must be adjusted manually, periodically the stamp pad must be re-inked, and when the amount of postage programmed within the postage meter has expired, the postage in the meter must be replenished.
• a postage meter must be manually unplugged, placed into a special case
• the meter is of a significant weight
• an employee must visit a U.S. Post Office to have the meter reprogrammed with additional postage.
• a teller Upon arrival at the U.S. Post Office, a teller must cut the seal, replenish the meter with a desired amount of postage, and reseal the meter before returning it to the employee. The meter must then be returned to the office and powered up.
• a slightly more expensive meter (rental of approximately $30.00 more) works in the following manner: 1) a user sets up an account with the meter owner, 2) 7 to 10 days before a user requires more postage, the user deposits with the meter owner the amount of postage required, 3) the user then calls the owner (7 to 10 days later) and they issue instructions as to the manual pushing of a variety of buttons on the meter (programming) which will replenish the postage amount on the meter. Nonetheless, the meter must be taken to the Post Office every 6 months. Thus, in addition to the monthly rent, the servicing and replenishing of the meter requires the time and expense of at least one employee to take the meter to the U.S. Post Office to have it replenished.
• Another object of the invention is to provide a system and method whereby various configurations of postage indicia can be input into the portable memory device.
• a portable device is constructed with a memory and having a processor controlling that memory.
• the device is arranged to communicate with a CPU, such as operable in a general purpose computer or PC, in order to exchange data and instructions therewith.
• the portable processor device has on board certain security related fields, such as the date and time, the balance, random number generators, a private cryptographic key number of transactions that have taken place on the device, and the serial number of the device. It may also have on board when the user initializes the device, information about the owner of the device including his/her name, the registration number and other information about the owner such as the user's address and password. When the device is used and a transaction is about to be debited from the device, the information about the transaction, such as the debit amount and other transaction information that is postage related, such as the addressee's ZIP code, the addressor's ZIP code, the recipient's address and name, the mail class, etc. These are all uploaded to the device from the PC.
• certain security related fields such as the date and time, the balance, random number generators, a private cryptographic key number of transactions that have taken place on the device, and the serial number of the device. It may also have on board when the user initializes the device, information about the owner of the device including his
• the processor stores them in memory, then it takes all of these packets of information, the security information, the owner information, date and time and the transaction information, and encrypts them into a packet, using its own key which is on board the device (it is not given externally).
• the device gives data back to the PC in encrypted form.
• the PC then takes that information and packages it into an indicia in the form of a portable data file so that the encrypted information can then be authenticated by the authenticating agency after it has been delivered along with a document. If the object is not to print the indicia but to authenticate a transaction that is being transmitted electronically, then the packet is used for verification of the electronic data. Typically, the verification occurs at a point remote from any connection to the PC or to the PC user.
• the portable processor device of the present invention may be coupled directly to a PC with which it is communicating, a preferred embodiment provides an information link for communication between the device and a PC without them being directly coupled.
• the device may be removably coupled to a node on a local area network (LAN) which provides information communication between the device and at least one PC.
• LAN local area network
• the display screen coupled to the processor-based system employs a "WINDOWS" type graphical user interface for interfacing with the user. Through the display screen, the program will request a password from the user and the amount of postage the user wishes to apply to a piece of outgoing mail or corresponding label for subsequent application to a package or envelope.
• the program will retrieve this postage stored within the portable processor, and the E-STAMP program will print postage indicia through a coupled printing device onto the outgoing mail or label.
• the program may be coupled to another process such as a word processing program, spreadsheet, graphic application, database, accounting package, or any other process residing within the processor-based system.
• the application of the postage indicia may be made in conjunction with these programs, which have the capability to print particular items of correspondance to be posted.
• the system may also be programmed to print the address, return address and postage indicia on correspondence, invoices, statements, or other items. This correspondence can then be placed in envelopes with cutouts or glassine paper at the appropriate areas so that the address, return address and/or meter stamp can be visualized through the envelope.
• the aforementioned portable processors are specially manufactured by Dallas Semiconductor for use in conjunction with programs, i.e., unique serial numbers specific to the program are embedded within each portable processor button. These serial numbers are then recorded in a user registration database for use by the Post Office and their associated scanning software, hereinafter referred to as "POSTAGESCANTM" software, to scan and verify letters.
• POSTAGESCANTM scanning software
• a special user-defined password shall be dedicated for use with the program so that access is only provided to users entering the correct password.
• the aforementioned serial numbers and passwords may, in addition to protecting against unauthorized use, also allow a user and the Postal authority to track postage used by every company, department, employee, etc.
• other software programs may also be configured to access the control program so that spreadsheets and/or graphs may be produced providing statistics on postage use within a business.
• control program can be used to encode a variety of information within the postage indicia using bar code symbol technology. Such information would be machine readable and can be used to identify postal indicia forgeries, in combination with the established control database of active system users.
• the system is arranged to automatically calculate the correct postage to place on a letter, parcel or label as a function of the class, zone and weight of the particular item to be mailed.
• One embodiment of the present invention includes a balance coupled to the host processor-based system so that mail can be placed on the balance and the weight of the mail automatically entered into the system for calculating the correct postage for that mail.
• the portable processor memory is refilled, the recorded transaction information can be analyzed either from the perspective of management information or to try to detect fraud. This allows for authentication or verification at a point remote (both physically and electronically) from the user and remote from the PC and even remote from the portable processor.
• the portable postage storage devices are durable, long lasting and economical.
• One method of accomplishing this is to use a portable processor with a hardened case, not allowing direct contact with the processor. In this way, the code which defines the personalizing of the processor remains secret and cannot be disassembled.
• a technical advantage is achieved in that a plurality of PCs may then communicate with a single portable processor device.
• FIGURE IA illustrates a host processor-based system for implementation of the present invention
• FIGURE IB illustrates several embodiments of the postage storage device
• FIGURE 1C illustrates a computer network system for implementation of the present invention utilizing a client processor-based system in combination with a host processor-based system interconnected via a local area network.
• FIGURE ID illustrates a computer network system for implementation of the present invention utilizing a first processor-based host and an alternative embodiment of a second processor-based system interconnected via a local area network.
• FIGURES 2A-2B illustrate an embodiment of user instructions and screen prompts utilized by the present invention to interface with a user when installing the program on the processor-based system for implementation of the present invention
• FIGURE 3A illustrates one embodiment of a user registration form
• FIGURE 3B illustrates a postal or verification indicia
• FIGURE 3C illustrates an encoded user registration form
• FIGURES 4 and 5 illustrate flow diagrams of the replenishing and debiting processes
• FIGURE 6 illustrates a preferred embodiment of the security techniques utilized within the present invention
• FIGURE 7 illustrates a flow diagram of the operation of the present invention within a host processor-based system
• FIGURES 8 and 8A illustrate a display interface provided to a user when accessing the present invention on a host processor-based system
• FIGURE 9 illustrates an envelope used to display the postage indicia printed on a letter
• FIGURES 10A-10F illustrate various management functions associated with the master, agent and postage buttons
• FIGURE 11 illustrates the architecture for the preferred embodiment of the portable processor
• FIGURE 12 illustrates how a postage button is encoded
• FIGURE 13 illustrates how an agent or master button is encoded
• FIGURE 14 shows the interrelationship of the database for registering memories assigned to users and the use of the database for verification purposes
• FIGURE 15 illustrates processor based systems for implementation of remote refilling of the postage storage device of the present invention.
• the present invention provides for a portable postage dispensing device, described in more detail below, that can be coupled to a host processor-based system at both the customer's site and at the postal authority or an authorized agent.
• a host processor-based system at both the customer's site and at the postal authority or an authorized agent.
• U.S. Post Office postal authority or its agents. Note, however, that the present invention may be implemented within any country and with respect to any postal system or with respect to any data packet which is being examined by a validating authority detached, both physically and electronically, from its source.
• the present invention will allow an individual to purchase a desired amount of postage at an authorized agent of the U.S. Post Office, such postage being stored within a portable postage dispensing device, which itself is a portable processor.
• the user may then invoke a host processor-based system to access and retrieve a portion of the stored amount of postage via a program stored on the host processor-based system, such program hereinafter referred to as the "E-STAMP" program.
• the E-STAMP program requests input from the user on the weight of the item to be mailed, the addressee's address, etc.
• the E-STAMP program utilizes the information that was entered to calculate the amount of desired postage for an item to be mailed and prints a meter stamp indicia on an envelope, label or letter through a printer or special purpose label maker coupled to the host processor-based system.
• the portable processor device is not directly coupled with a client processor-based system with which it is communicating
• the device is coupled to a host processor-based system.
• the client system and the host system are in information communication through a network, such as, by way of example, a local area network (LAN).
• LAN local area network
• E-STAMP SERVER E-STAMP SERVER
• E-STAMP CLIENT E-STAMP CLIENT modules
• E-STAMP SERVER and E-STAMP CLIENT modules include programs suitable for execution on processor-based systems.
• E-STAMP program collectively refers to the E-STAMP SERVER and E-STAMP CLIENT modules and their programs.
• the E-STAMP CLIENT program is stored on the client system and provides control for such functions as the entry of data, requesting postage from the E-STAMP SERVER program, and printing of the postage indicia.
• the E-STAMP SERVER program is stored on the host system and provides control for such functions as queuing and servicing postage requests from a plurality of client systems, demanding a portion of the stored amount of postage from the device, and logging detailed information regarding postage requests.
• the E-STAMP program may not be divided into two modules to be stored on the client and host systems.
• the host system may simply be a network node capable of emulating an input/output (I/O) port of the host system.
• the network node is a NETSERIAL device manufactured by Shiva Corporation, Burlington, MA.
• Information communication between the portable processor device and the client system is accomplished by a terminate and stay resident (TSR) program supplied by the manufacturer of the network node.
• TSR terminate and stay resident
• Such a TSR program causes the E-STAMP program's request to access the device through a local I/O port to be redirected through a LAN to the host system. It also operates to mediate concurrent requests to use the same networked portable processor, causing one client to wait until the portable processor is available.
• the E-STAMP SERVER program controls printing of postage indicia in the amount requested by the E- STAMP CLIENT program.
• Such an embodiment not only provides a centralized supply of postage credit, but also provides the ability to print the postage indicia on a centralized printer or printers.
• An advantage to such a system is the ability to more economically utilize expensive equipment.
• an advantage is achieved in the ability to maintain a printing device constantly in a state ready for printing postage indicia by such means as being constantly loaded with the proper media upon which to print postage indicia.
• a further advantage of such an embodiment is that the communication of postage credit between the E- STAMP SERVER program and E-STAMP CLIENT program may be omitted if desired.
• communication of postage credit between the portable processor device and the client system may be in the form of a data representation of the postage indicia to be printed or data representative of a particular value from the portable processor.
• data representation of the postage indicia to be printed is utilized to increase the integrity of the system by avoiding the distribution of postage indicia generation capability to multiple systems.
• data representative of a particular value from the portable processor is utilized to decrease the volume of information communication necessary over the communication link.
• the portable postage dispensing device can also be coupled to a host processor-based system located at the authorized U.S. Post Office Agent.
• POSTAGEMAKERTM The program installed at the U.S. Post Office, hereinafter referred to as the "POSTAGEMAKERTM" will allow an authorized agent to interface the portable postage dispensing device with the host processor-based system residing at the authorized refilling agent in order to replenish the amount of postage programmed within the portable postage dispensing device in an amount requested and purchased by the customer.
• POSTAGEMAKER program operates to allow the authorized refilling of the portable postage device remotely, such as, for example, through a public switched network (PSN) or LAN.
• PSN public switched network
• the POSTAGEMAKER program operates in conjunction with the E-STAMP program to replenish the amount of postage programmed within the postage device without the need for physically coupling the portable postage device directly to a postal authority host processor.
• the E-STAMP program may initiate communications with the POSTAGEMAKER program through the use of modems and telecommunications lines as is well known in the art. Such communications may be initiated automatically upon the occurrence of a condition or event or may be initiated at the request of an operator.
• the E-STAMP program may request an amount of postage to be replenished and indicate payment by such means as a valid bank card or a debit account maintained with the postal authority.
• refill request authentication means may be included within the POSTAGEMAKER and E-STAMP programs, such as verification of unique information associated with the E-STAMP program and/or associated portable postal device, to detect fraudulent requests for postal credit, if desired.
• the POSTAGEMAKER program may request certain information of the postage storage device in order to detect tampering with the device. Such information may include total strike count, balance of various registers, or date of last refill. This information may be analyzed or compared with information available at the postal authority to detect unauthorized use or refilling of a postal storage device. Detection of improper usage of the postal storage device will result in refusal to transmit a replenishing amount of postage from the POSTAGEMAKER program to the E-STAMP program.
• FIGURE 1C illustrates a computer network system for implementation of the present invention.
• This multiple processor system includes a client processor-based system 10 and a host processor-based system 20.
• system 10 is utilized for implementing the aforementioned E-STAMP CLIENT program while system 20 is utilized for implementing the aforementioned E-STAMP SERVER program.
• System 10 includes chassis 11 enclosing processor (CPU) 12 and disk drive 14. Coupled to CPU 12 is display 13, keyboard 15, mouse 16, and network interface card (NIC) 104. System 10 is coupled to computer network 105 through NIC 104. Furthermore, system 10 is adapted for information communication with postage storage device 18 through computer network 105 and system 20. System 10 also includes modem 101 for communication through PSN 102, printer/label maker 19 and scale 103.
• CPU central processing unit
• NIC network interface card
• System 20 includes chassis 21 enclosing CPU 22 and disk drive 24. Coupled to CPU 22 is display 23, keyboard 25, mouse 26, and NIC 124. System 20 is coupled to computer network 105 through NIC 124. System 20 also includes modem 121 for communication through PSN 122, printer/label maker 29 and scale 123. Additionally, system 20 is adapted for coupling with postage storage device 18, such as the preferred embodiment portable processor button 182 illustrated in FIGURE IB and shown in block diagram form in FIGURE 11. Postage storage device 18 is coupled to processor-based system 20 through a postage storage device receptor 17.
• postage storage device 18 is coupled to processor-based system 20 through a postage storage device receptor 17.
• modems 101 and 121, printer/label makers 19 and 29, and scales 103 and 123 may be omitted from either or both of systems 10 and 20.
• Such devices may be advantageous, for example, to accomplish features such as remote refilling of postage credit, centralized or distributed printing of postage indicia, or automatic determination of postage required for a postal item.
• An advantage to the utilization of systems 10 and 20 in combination with computer network 105 is that multiple ones of system 10 may utilize postage storage device 18.
• the E-STAMP SERVER program provides centralized logistical control, such as queuing and servicing requests by ones of system 10.
• An added security advantage may be realized by this configuration in that the E-STAMP SERVER program may be utilized to generate a data representation of the postage indicia ultimately to be printed, and thus avoid multiple occurrences of this ability.
• the E-STAMP SERVER program records detailed transaction information on disk drive 24.
• FIGURE ID illustrates a client processor-based system 10 and an alternative embodiment of the host processor-based system 20, of FIGURE 1C, depicted here as system 20D.
• System 20D is a dedicated purpose network node device.
• System 10 is utilized for implementing the aforementioned E-STAMP program while system 20D is utilized for emulating an I/O port of system 10.
• This emulation is accomplished in part by a TSR program stored on system 10 that redirects information from an I/O port within system 10 to system 20D.
• Such I/O port emulation is well known in the art and may be accomplished by any number of commercially available means such as the preferred embodiment utilizing the NETSERIAL device by Shiva Corporation, Burlington, MA
• An advantage to utilizing I/O port emulation is that both the physical size and expense of a dedicated use network node device capable of I/O port emulation are typically less than a complete PC system.
• FIGURE IA there is illustrated processor-based system 10 utilized for implementing the POSTAGEMAKER program.
• Postage storage device 18 is coupled to system 10 through a postage storage device receptor 17 coupled directly to system 10.
• the portable postage dispensing device may be any securable, intelligent device having some residual data capability, where that device can provide sufficient security measures to efficiently limit access to the memory and executable code of the device to authorized users.
• Intelligence is defined as having a CPU or other processor and memory built into the portable processor device.
• portable processor button 182 incorporates a small disk having a memory and CPU.
• Portable processor button 182 is a small, light-weight, portable, essentially non-breakable device available as a touch memory utility button (TMU) from Dallas Semiconductor, Dallas, Texas.
• TMU touch memory utility button
• a portable processor button may be coupled to many processor-based systems, including those illustrated herein as systems 10, 20 and 20D, through button holder 172.
• a batch of buttons will be manufactured with specifically designated serial numbers for use solely with the present invention.
• disposable portable processor buttons 182, preloaded in various denominations, could also be sold either over the counter or in existing stamp machines at post office locations.
• the postal authority may also select to sell pre-loaded portable processors, on which the customer pays a deposit, that can be exchanged for another portable processor or returned for the deposit whenever button 182 is depleted of postage. All authorized postal agent locations may sell pre-loaded portable processors or the postal authority may elect to designate particular postal authority locations for selling portable processors.
• the portable processor button 182 is that a portable processor button 182 is small enough and light enough that several may be carried in one hand. Furthermore, the portable processor button 182 is sufficiently durable to be sent through the mail. The fact that the portable processor is universally usable with PC's allows the per unit cost to be lower. However, it shall be understood that the use of a secured data file stored on a hard disk drive, or any other suitable electronic memory, coupled to a processor based system may be utilized in the present invention.
• FIGURE IB Additional alternative embodiments of the portable postage dispensing device 18 are illustrated in FIGURE IB.
• One alternative postage storage device 18 is a smart disk 188 incorporating its own electronic modules capable of read/write operations.
• SMART DISKTM can be obtained from Smart Disk Security Corporation, Naples, Florida.
• the smart disk looks like a floppy disk and fits into a typical PC's floppy disk drive, such as disk drive 178, connected either externally or internally to host processor-based system 10; however, smart disk has its own microprocessor that provides secure, password protected storage.
• One advantage of the smart disk is that it can operate in a standard PC disk drive without modification to the disk drive or PC. Smart disk provides security for stored postage with an encrypted password and the encryption algorithm.
• Another type of portable postage dispensing device 18 is a smart card 186, a plastic card with an embedded microchip.
• the microchip contains mathematical formulas that encrypt computer data to secure access to that data (i.e., postage) and verify a user's identity before allowing access to the data.
• One drawback in the currently available smart cards 186 is that they require a smart card processor 176 hooked to the processor-based system 10.
• Still another type of postage storage device 18 is a PCMCIA card
• PCMCIA cards are currently used on notebook computers for modular storage and communication. Both external and internal add-on readers 174 (i.e., card slots) are available for PCs.
• Postal storage device 18 may be used on a variety of processor-based systems 10 and/or 20 in a variety of configurations.
• Processor-based systems 10 and/or 20 may be located in an individual's home, at any business location, or may even be present in a post office lobby for after hours usage.
• processor-based systems 10 and 20 may be located at sites remote from one another, interconnected by computer network 105.
• Computer network 105 may be a wide area network (WAN) capable of providing information communication between systems 10 and 20 separated by large physical distances or alternatively may be a LAN providing information communication between systems 10 and 20 located proximal to each other. It shall be understood that computer network 105 may be any information communication scheme capable of providing information communication between systems 10 and 20.
• WAN wide area network
• systems 10 and 20 are each a PC.
• systems 10 and 20 could be parts of a mainframe computer system (which, for the purposes of this application shall include miniframe computers as well as all other suitable processor- based systems) or, as illustrated in the utilization of network node device 20D, of differing types. Selection of systems 10 and 20 to be utilized by the present invention is only limited by the systems' ability to interface with each other and a portable processor device 18 while combining to execute the E-STAMP program.
• a user will buy a portable postage dispensing device 18, which could contain a quantity of postage, included with a copy of the E-STAMP program. The user will then install the E-STAMP program on the user's host processor-based system 10.
• FIGURES 2A-2B illustrates one embodiment of user instructions and screen prompts to be followed by the user during the installation of the E-STAMP program.
• the instructions and screen prompts illustrated in FIGURES 2A-2B reflect the installation of the E-STAMP program in a Microsoft "WINDOWS" operating environment on a PC equipped to communicate with a portable processor 182 and portable processor holder 172.
• WINDOWS Microsoft "WINDOWS" operating environment on a PC equipped to communicate with a portable processor 182 and portable processor holder 172.
• other means could be employed for implementing the present invention within a processor-based systems 10 and 20.
• the user installation instructions 201 inform the user how to pull up the E-STAMP installation program. Once the installation program is initiated, screen 203 will appear.
• the screen represented by box 203 accepts the user's determination of how the E-STAMP program is to be utilized. Specifically, the user inputs information indicating whether the
• E-STAMP program is to be operated in separate modules on systems 10 and 20.
• the screen represented by box 204A instructs the user to connect the TMU holder 172 to a serial port and to insert TMU button 182 into holder 172.
• This coupling of TMU button 182 provides the installation routine the opportunity to verify information communications between the E-STAMP SERVER program and TMU button 182. Thereafter, the screen represented by box 213, discussed below, is implemented.
• the screen represented by box 204B instructs the user to indicate whether the E-STAMP CLIENT or the E- STAMP program in its entirety has already been installed. If the appropriate program has not been previously installed, the user is then instructed by Screen IB to insert TMU button 182 into holder 172, turn on printer 19 that has been coupled to system 10 and check to see that printer 19 is supplied with paper.
• Screen IB further requests that the user prepare the following information: the user's full name and address, an identification number for the user (i.e., an employer identification number (EIN#), if the user is a business or organization; or a social security number (SS#), if the user is an individual), the user's ZIP code, the user's telephone number and the user's fax number.
• an identification number for the user i.e., an employer identification number (EIN#), if the user is a business or organization; or a social security number (SS#), if the user is an individual
• the screen represented by box 213, discussed below is implemented.
• the next screen, represented by box 205 displays the E-Stamp
• License Agreement with its legal terms and conditions. Acceptance of the terms and conditions set out in the license agreement is indicated when the user continues with the installation program.
• the screen represented by box 207 will appear and display the E-STAMP serial number and TMU serial number.
• the user-specific information requested by box 203 should be entered into the E-STAMP program.
• the screen represented by box 209 will appear warning the user to carefully verify the correctness of the entered information.
• the screen represented by box 211 will remind the user to ensure that a coupled printer 19 is on line.
• the user information entered into the E-STAMP program will then be incorporated into a user registration form, one embodiment of which is illustrated in FIGURE 3A.
• the E-STAMP registration form will be printed in triplicate.
• the user is instructed to sign and mail two copies of the registration form to the creator of the E-STAMP program, E-Stamp Corporation and to retain one copy of the registration form.
• This screen also informs the user that a registration card will be mailed to the user in order that the user may access TMU refilling stations.
• the E-STAMP program installation continues with a screen, represented by box 213, which describes the progress being made in installing the necessary components of the E-STAMP program, and a screen, represented by box 215, which informs the user when the E-STAMP program installation has been completed.
• the registration form includes information such as the portable processor button serial number 31, the E-STAMP serial number 32, the date and time that the E-STAMP program was installed 33, and user-specific information 35 (e.g., name, address, telephone and fax numbers, and identification number), and a copy of the E-Stamp License Agreement 36 having an identified location
• E-STAMP registration form will also contain all of the information needed to specifically identify the TMU button, E-STAMP program, and registered user in an encrypted format 301 FIG 3C.
• the encrypted information 301 will be in a machine-readable graphical security interface, such as a standard bar code. In the preferred embodiment, the code would be the PDF417 code discussed in more detail below.
• indicia 300 shown in FIGURE 3B also has a logo portion 39 and a printed "human readable" portion 38 as well as an encoded portion 37. It is this portion 37 which is read and, if desired, compared to a database at a location remote from the user, remote from the generating PC and remote from the portable processor.
• the standard bar code contains white and dark areas in the form of bars that can be read by a laser scanner.
• the laser scanner illuminates the white and dark areas with a light of a certain frequency. The light is reflected back to the laser scanner in such a way as to indicate the pattern of white and black areas within the bar code. Since white areas reflect much more light than dark areas do, a perpendicular scan of the bar code will allow the scanner to translate the reflected light into the coded information.
• More than 20 linear bar code languages have been developed, each with its own specifications for how many bars and spaces make up a character, how characters are to be arranged, whether the characters can be letters as well as numbers, and so forth.
• the most widely-used bar code is the Universal Product Code (UPC) seen on everyday grocery items.
• UPC Universal Product Code
• the standard bar code currently used by the post office is PostNet described in Postal Service Publication number 67. More sophisticated graphical security interfaces have been developed over the last decade, such as Intermec Corporation's Code 49 and Laserlight System Inc.'s Code 16K. A major advantage of these more sophisticated symbologies is that they contain an error-correction formula which can often recover the entire message even if parts of the code have been torn or damaged.
• a preferred embodiment of encrypted information 301 is a graphical security interface developed by Symbol Technologies of Bohemia, New York and is called PDF417, a portable data file.
• PDF417 is a graphical security interface constructed from data units called "words," each of which is 17 modules long. Bars are made from filling in up to six consecutive modules and each unit has four separate bars and four spaces. In essence, PDF417 can stack the equivalent of up to 90 one-dimensional bar codes, each just three hundredths of an inch high. Thus, the PDF417 symbology is more complicated to produce and scan than is the typical one-dimensional bar code and allows for a denser coding of information.
• PDF417 symbology specification includes sophisticated protocols for error-correction, the actual density of information is highly variable, but can be more than ten times the amount of information found in U.S.P.S. PostNet bar code, per square inch.
• PDF417 is available from Symbol Technologies, Inc., 116 Wilbur Place, Bohemia, NY 11716 and the operation of the PDF417 is detailed in PDF Primer obtained from them and is hereby incorporated herein by reference.
• the encrypted information 301 can be scanned with a laser scanner so that the information contained therein can be automatically transferred to a Registered User's database.
• a registration card containing a serial number will be printed and mailed to the registered user.
• the valid entry of the user registration information in the E-Stamp Database guarantees that user's mail to pass verification at the U.S. Post Office, for the letter scanning equipment will be connected to E-Stamp for real-time verification of mail.
• letter scanning equipment may be updated in batch with information indicating registration of postal storage devices, or registration information may be provided to the postal service by any means deemed efficient to indicate the authorized use of a postal storage device of the present invention.
• System 10 may be utilized at a customer site for permitting a user to retrieve postage stored within portable postage dispensing device 18, via the E-STAMP program, for subsequent printing as a postage indicia onto a piece of mail through printer 19, coupled to system 10, or printer 29, coupled to system 20.
• the utilization of the E-STAMP program by a customer will be further described below.
• the user may then physically carry the button back to the user's business location and couple the portable processor button 182 to a processor-based system through button holder 172 for information communication with system 10.
• the customer's processor-based system 10 can access the postal amount stored in portable processor button
• the E-STAMP program may be a stand-alone program, or it may be associated and coupled with a word processor or other document producing program, such as a spreadsheet, database, accounting system, or graphics program. Therefore, the E-STAMP program may be started directly (step 702) or via step 701. Thereafter, at step 703, the E-STAMP program shows display 80, illustrated and described with respect to
• FIGURE 8 to the user.
• step 704 the E-STAMP program verifies the existence of portable processor button 182 in communication with processor-based system 10.
• the process of portable processor verification represented by box 704 includes several steps as follows:
• Step 1 Successful communication with portable processor within its strict communication protocol and command structure already demonstrates likelihood that at least the type of button is correct (i.e., it is more than just a Dallas Semiconductor button, it is a button running the proprietary code particular to the postage application outlined herein).
• Step 2 Serial number of portable processor is verified against encrypted registration information in the PC. If a valid portable processor button is in information communication with system 10, at step 707, other information stored in the secure environment of the portable processor is demanded via the common command structure used for host-to-button communications.
• Step 1 E-STAMP passes user password entered to portable processor and verification takes place within the secure environment of the portable processor button to guarantee maximum secrecy of the password. Password is never stored in processor-based system 10.
• Step 2 If the portable processor reports a result from Step 1 as a password match, E-STAMP will then be able to access the command facilities of the portable processor to ultimately print postage indicia thereby deducting value from the internal data representation of credit within the portable processor.
• Step 3 Portable processor verifies its own expiration date based on an internal real time clock. Processor-based system 10 never has opportunity to interfere in this decision.
• Step 4 If the result of the expiration date check of Step 3 is that the portable processor is still valid, the user registration information stored in the processor-based system 10 is passed to the portable processor for validation.
• Step 5 If the check of Step 4 is valid, the current meter balance is displayed in the center-button part of the E-STAMP program screen block 806, indicating that a valid portable processor button is available for use in printing postage indicia. If any of the above checks are invalid, a valid postage dispensing device was not detected.
• return address box 803 is completed automatically or manually. The address within 803 may be automatically entered from the adjoining word processor program, the address may be selected from a drop-down box (not shown), or the address may be manually input. Any entered address may be saved within the E-STAMP program. Additionally, if a return address is not desired, it may be omitted.
• step 709 the contents of address box 805 are entered in a manner similar to the contents of return address 803.
• Any one of a number of "time-out" scenarios could be employed. For example, a preestablished time of three months from last refilling, or the time-out could occur a certain time after non-use.
• the user may select the print format by the use of the "Print Setup" standard dialogue box selected in the "File” Menu as pictured in FIGURE 8A.
• the postage indicia may be printed on a label through printer ⁇ abel maker 19 or 29, or a choice may be made to print the postage indicia on an envelope inserted within printer 19 or 29, which may be chosen to be a standard size or a nonstandard size as selected by the user.
• selection of either printer 19 or 29 may be accomplished through the use of print managers well known in the art, or may be accomplished by an option (not shown) within the E-STAMP program. Note that if the postage indicia is to be printed on a label, it may be desired that the return address within 803 and the address within box 805 not be printed.
• the postage indicia with or without the addresses within boxes 803 and 805 may be printed on a flyer, a pamphlet, a postcard, a sheet of paper, or any other document.
• the indicia is printed on a letter, along with the addresses in boxes 803 and 805, that letter may be folded so that the indicia will show through an opening or window, in the top right hand corner of a specially designed envelope 900 an image of which is illustrated in FIGURE 9 and as shown in co-pending Design Patent Applications Serial No. 29/022,913, filed May 16, 1994, and
• Envelope 900 may be a standard or non-standard size with any number of windows as designed by the user. Typically, envelope 900 will have a first window (not shown) in the top right hand corner for the printed postage indicia to show through. Envelope 900 may also have other windows for the addressee's name and address (903) and for a return address (902) to show through. Envelope 900 may have glassine paper, or other transparent covering material, covering the described windows such that the postage indicia and other imprinted information is protected from inadvertent detachment and adverse conditions (such as inclement weather).
• step 711 the user enters the weight of the package or letter associated with the postage indicia.
• This weight may be entered manually, or automatically through the use of scale 103 coupled to processor-based system 10 in a manner well known in the art.
• step 712 the user selects the class of mail from the choices shown in box 809.
• step 713 the user may select the location of routing information for the recipient address. Such information will be automatically extracted from the address, and formatted in the PostNet symbology for ZIP +4 information, as provided in Postal Service Publication 67 and incorporated herein by reference.
• Step 713 Such information will be automatically extracted from the address, and formatted in the PostNet symbology for ZIP +4 information, as provided in Postal Service Publication 67 and incorporated herein by reference.
• the user may select a postal zone.
• the postal indicia may include any combination of the following information: the date, the postage dispensing device serial number, the sender's ZIP code, the addressee's ZIP code, the expiration date of the postage dispensing device, the cumulative values of the strike and dollar counters, E-STAMP registration number and the post office identification number.
• the postage indicia shall contain this information which was encrypted by the portable postage dispensing device and presented to the outside world thusly, thereby guarding the data content of the indicia a secret to all but the U.S. Post Office scanning equipment which will be charged with decoding the indicia bar code and decrypting the information for use in verification of the integrity of the indicia and its appropriateness for the mail piece.
• the postage indicia physical form may encode the encrypted information within an insignia or design, or it may appear as a background for the postage amount printed in a visually recognized form.
• POSTAGEMAKER program in conjunction with a database program will allow tracking the authorized postage by post office location (or ZIP code), post office agent, portable postage dispenser serial number, etc. This information can be easily compiled to determine post office sales, market forecasts, etc.
• the E-STAMP program will automatically incorporate the aforementioned entered parameters-weight, class, zone-in order to correctly calculate the correct postage, as shown in box 804, to print in conjunction with the postage indicia and to deduct from the postage amount stored within portable processor button 182.
• the user confirms his/her choice to print the postal indicia or not, thereby with the understanding that the amount of postage will be deducted from the balance in the portable postage dispenser 182. If YES is chosen, control passes to step 716 and the E-STAMP program utilizes the input/output ports of processor-based system 10 to send to printer/label maker 19, the correct data pertaining to the indicia to be printed on an envelope, letter, card or label.
• the amount of postage printed on the indicia is automatically deducted from the amount stored within portable processor button 182 by the button itself on command from the E-STAMP program in step 716.
• usage record for this particular portable processor, which is kept internally, but accessible to the outside host via authorized commands.
• usage records may include, but are not limited to, addressee, postage amount, and date.
• the E-STAMP program may be implemented to update the postage amount displayed within meter display 806 as the ongoing communications dialogue between the portable processor and processor- based system 10 is essentially in real time.
• Box 802 is provided for the user to select the location (ZONE) to which the mail is to be sent.
• the location may be used to calculate the correct postage for the indicia.
• the date that the mail is stamped is automatically adjusted every day by a real time clock which exists in the safe confines of the portable processor and therefore cannot be tampered with by external influence. This will help prevent pre-dating or post-dating of mail.
• the date and if desired, time shall also be encrypted in the postal indicia for external verification.
• the mailing date may be user adjustable where pre-dating or post-dating is not a concern.
• adjustment of the mailing date may be allowed for post-dating the postal item while restricting pre-dating.
• an additional date may be input to indicate the anticipated date of mailing while the actual date of metering remains unchanged.
• the "Print Preview" option selected from the file menu in FIGURE 8A is provided to not only get an idea of how the finished envelope (or label or other document) will look but to add personalized items such as a greeting or graphical bit-map which might represent a company logo for instance.
• the aforementioned steps may be repeated for a subsequent piece of mail, or the user may decouple the portable process button 182 from holder 172.
• portable processor button 18 includes secure non-volatile (battery-backed or otherwise stable) memory and a CPU (central processing unit) capable of executing instructions. These items are enclosed in the confines of a hermetically sealed metal can.
• the internal operating code which gives the portable processor its useful attributes is kept in ROM (read-only memory) and/or RAM (random access memory). Additionally, the extremely sensitive data representations of monetary value, strike counters, usage logs, refilling logs and encryption keys used to encrypt information passed externally is kept in non-volatile memory not directly accessible by processor-based system 10 executing the E-STAMP program.
• buttons which relate to different levels of authority and use: master buttons (authority level 2) which are provided to a limited number of supervising postal authority personnel; agent buttons (authority level 1) which are provided to authorized postal agents who perform refill operations on used portable postage dispensing buttons and initialization operations on new portable postage dispensing buttons; and postage buttons (authority level 3) which allow the postal customer (user) to print an authorized amount of postage indicia using a separate processor-based system controlled by the user.
• the first two types of buttons are known as security devices which grant authority to serve credit and maintenance to the third type of button which is a postage dispensing device usable by postal clients.
• buttons may be initialized upon manufacturing to function as the variously defined buttons of the present invention, it is envisioned that an issuing authority may wish to be able to directly expand the availability of suitable devices and, thus, would utilize an initialization procedure as depicted in FIGURES 10D and 10F.
• an issuing authority may wish to be able to directly expand the availability of suitable devices and, thus, would utilize an initialization procedure as depicted in FIGURES 10D and 10F.
• FIGURE 10E illustrates a preferred embodiment of repair of a postage button.
• both a valid master and a valid agent button must be in information communication with the Postal Authority/Refill Station (POSTAGEMAKER) version of system 10, such as depicted in FIGURE IA, before a refill or initialization operation of a postage button can take place.
• POSTAGEMAKER Postal Authority/Refill Station
• a preferred embodiment utilizes button holder 17 coupled directly to system 10 for the POSTAGEMAKER program, a multiple processor system, utilizing systems 10 and 20 as discussed above in conjunction with the E-STAMP program, may advantageously be utilized for implementation of the POSTAGEMAKER program.
• buttons 10A-10B are all validated by the Postal Authority/Refill Station software during refill operations. Additionally, each postage button (level 3) is validated by the customer's E-STAMP software prior to the commencement of any indicia printing operations. The sequences for validating the master, agent and postage buttons using the Postal Authority/Refill Station software are depicted in FIGURES 10A-10B.
• the Postal Authority validation procedure for a button in information communication with system 10 begins at Step 1000, with the initiation of the POSTAGEMAKER refill station software. For discussion purposes, assume only one portable processor button 18 has been coupled to system 10 at this point. At Step 1001, the software reads the communication bus to see if any valid devices exist on it. If no, it just continues to look in a "loop.” If yes, the POSTAGEMAKER software running in system 10 sends a command to the portable processor button
• the button which is reset from a "sleep" or dormant state when it receives the command, can verify its contents to be correct and that it is the type of button (POSTAGE or SECURITY DEVICE) that system 10 expects to work with. If a valid response does not come back before a time-out in
• Step 1003 it is assumed that the button on the communication bus is not valid and an error message would be displayed at Step 1004. If the response is OK, it is implied that there is a good chance this is a E- STAMP-programmed button because of its validated response to the E- STAMP-specific command issued to it.
• Step 1007 proceeding to Step 1019 of FIGURE 10B, otherwise generating an error at Step 1004.
• Step 1008 a connect operation for that type of button is attempted in Step 1008, 1014 or 1019.
• Step 1015 and 1009 If master or agent security device, a security device type of connect is issued to the button and a correct response must be received by system 10 (Steps 1015 and 1009) before proceeding or an error is generated (Step
• Step 1013 If the connection signal is valid at Step 1009 proceeding to Step 1010. If the connection signal is valid at Step 1015 proceeding to Step 1016.
• Step 1011 validates this password by passing the password to the button so that it can verify it in its own secure environment. The password is never stored in system 10 for security reasons.
• a positive validation of password from the button grants the host authority level of 1 for master and agent simultaneously on the bus and authority level 2 for master only on the bus at Step 1012, otherwise an error is generated (Step 1017).
• the POSTAGEMAKER software does not require the validated password of the postage button to continue. However, it will check that the proper authority level has been previously granted by the presence of both a validated agent and master button on the bus at the same time in Step 1021. If the proper authority level has not been attained, no operations may be performed on the postage button. If that authority exists, control can proceed to Step 1018 in the case of a customer demand for new button initialization, old button credit refill or old, damaged button repair operations or to Step 1022 in the case of agent button initialization operations. Of course if the use of security buttons is omitted, as in an alternative embodiment discussed above, the POSTAGEMAKER software needs only to verify the presence of a suitable postage storage device. The credit refill operation to a used button is depicted in FIGURE
• step 1030 The credit command must first verify, in step 1031, its authority level is correct and set at two by the presence of valid and password-unlocked master and agent buttons looping back to Step 1031 if not. Provided this is the case, in step 1032, the amount of postage to be credited to the button is input by the authorized agent into a form dialogue window and validated for correctness by the POSTAGEMAKER software.
• Step 1033 the CREDIT command, amount and a conglomeration of encrypted data known as a security packet are sent to the postage button which must decode and validate and if all appears to be valid, perform the credit operation before the time-out signified in step 1034 which will occur if the response does not come back from the button to the system 10 in a specified period of time, otherwise an error is generated (Step 1035). It is the security packet that allows the button to continue with the credit operation.
• This data structure has a predefined layout and contents which are encrypted using a certain key and method of encryption.
• This security packet contains data items, such as identification numbers of master and agent issuing the credit to the button, host date/time (which must match not exactly but closely with internal button date/time), workstation number for system 10 running the POSTAGEMAKER software and postal authority location identification. Other data items could be used for checking purposes.
• This security packet is different in form and function from the one described here below in FIGURE 6.
• Step 1036 (FIGURE 10C) a receipt is printed out for the customer and the results are written in a transaction log stored on system 10 or on another system in information communication with system 10, such as host system 20 running E-STAMP SERVER. Thereafter the credit refill operation is ended at Step 1037.
• postage and/or security buttons may be coupled to the host processor executing the POSTAGEMAKER software through communication means such as computer network 105 or PSN 102 or 122 illustrated in FIGURE 1C if desired.
• communication means such as computer network 105 or PSN 102 or 122 illustrated in FIGURE 1C if desired.
• refilling of postage storage device 18 coupled to system 20 may be accomplished by the E-STAMP program operating on system 10 establishing communication with the POSTAGEMAKER program operating on system 1500 through PSN 102. Thereafter, POSTAGEMAKER may refill postage storage device 18, functioning substantially as described above, through remote communication rather than coupling directly to the host computer.
• System 1500 includes chassis 1511 enclosing CPU 1512 and disk drive 1514. Coupled to CPU 1512 is display 1513, keyboard 1515, and mouse 1516. System 1500 also includes modem 1501 for communication through PSN 102, printer/label maker 1519 and scale 1503. Additionally, system 1500 is adapted for coupling with postage storage device 1518, such as the preferred embodiment portable processor button 182 illustrated in FIGURE IB and shown in block diagram form in FIGURE 11. Postage storage device 1518 is coupled to processor-based system 1500 through a postage storage device receptor 1517. Of course, communication between postage storage device 18 and the POSTAGEMAKER program operating on system 1500 may be established through modem 121 of system 20 rather than modem 101 of system 10, if desired.
• remote refilling of postage storage device 18 may be accomplished through the use of a single system, such as system 20, in communication with the system executing the POSTAGEMAKER program.
• the communication system comprising modems 101, 1501 and PSN 102 of systems 10 and 1500, as well as computer network 105 and receptor 17 comprise the communication bus providing information communication between system 1500 and the postage storage device.
• remote refilling of the postage storage device may be accomplished through the use of a LAN or Internet communication between the POSTAGEMAKER program and the postage storage device.
• the E-STAMP program may be utilized to establish remote communication with the POSTAGEMAKER program
• refilling of the postage storage device is accomplished by commands sent to the portable processor button by the POSTAGEMAKER program.
• commands may be handed blindly to the postage storage device by the E- STAMP program operating on system 10, or may actually be received and interpreted.
• the POSTAGEMAKER commands operate to enable the E- STAMP program to cause the postage storage device to be replenished. Because remote refilling of the postage storage device does not require its physical transportation, the replenishment of postage credit stored within may be easily automated to result in its automatic occurrence upon a condition or event. Of course, remote refilling also may be instigated at the command of a user of the E-STAMP program, if desired. Furthermore, refilling, automatic or otherwise, may advantageously occur in the form of either the POSTAGEMAKER program or the E-STAMP program establishing communication to accomplish replenishing of the postage storage device.
• the E-STAMP program may automatically cause a coupled modem to go off hook and initiate communication with a POSTAGEMAKER program.
• information necessary to establish communication with the POSTAGEMAKER program may be stored within the postage storage device or may be input and/or stored within the E-STAMP program, such as, for example, at the time of registration.
• the predetermined value at which the E-STAMP program so reacts may be established by the user of the E-STAMP program, may be stored within the postage storage device, or may be a value determined by the postal authority below which the credit should not be allowed to fall.
• the POSTAGEMAKER program may initiate the communication with the postage storage device. Occurrences which may be advantageous in causing the POSTAGEMAKER program to initiate communication include the passing of a predetermined amount of time since the last refill of a particular postage storage device. This communication may be utilized not only to refill the postage storage device, but may be utilized poll registers or data stored within the postage storage device to determine if unauthorized use or refilling has occurred.
• FIGURE 4 depicts the credit process within the postage storage device.
• Box 401 reviews the material received from the host to determine validity looping back to box 401 if no security packet is received.
• Boxes 402-404 validate the security packet generating an error at box 404 if not valid in box 403, otherwise proceeding to box 405.
• Boxes 405-406 validate the valid credit amount generating an error at box 406 if the credit amount is not valid, otherwise proceeding where box 407 updates the internal memory. Box 408 ends the routine.
• FIGURE 5 shows the button Debit Process which begins with box 500.
• a transaction buffer request from the host is checked generating an error at box 502 if no transaction buffer request is received at box 501, otherwise proceeding to box 503 and 504 to validate the request. If the transaction buffer request is not valid in box 504 an error is generated at box 505, otherwise proceeding to box 506.
• boxes 506-507 the validity of debit amounts on the bus are checked. If the debit amount is not valid, an error is generated at box 507, otherwise proceeding to box 508.
• Box 508 updates the internal registers of the button and box 509 creates the security packet for transmission to the host.
• Box 510 ends the routine.
• FIGURE 6 there is illustrated a preferred embodiment of the transformation of user information by the portable processor button into a data entity known as a security packet which is then handed off to the E-STAMP application, running in a processor-based system and transformed into an indicia for inclusion on an envelope.
• a security packet which is then handed off to the E-STAMP application, running in a processor-based system and transformed into an indicia for inclusion on an envelope.
• the process begins in Box 650 in the software, running in the processor-based system, when a user fills out an envelope and demands of the program that it be printed with an indicia of x amount of postage determined by weight, zone, etc., as shown in boxes 654, 655 and 656.
• Much of the information to be printed on the envelope will be transferred to the internal software printing functions which interact through interfaces with the "Windows" operating system by methods well known in the art.
• Step 651 the program sends a command to the portable processor button 18 (FIGURE IA) to create a data entity or form known as a security packet.
• the data that will produce the envelope which includes, but is not limited to, date and time, current balance of metering device, strike counter of total transactions, serial number of meter, transaction id, debit amount, addressee ZIP code, addressee name and class of postage.
• registration id, name, company and address included for secure access to the button.
• PIN personal identification number
• PIN personal identification number
• the secure processor 18 accepts all of this data from the host process-based system and in Step 652, using internal math co-processor hardware, encryption software algorithms and encryption keys, the portable processor produces the security packet using information from Boxes 657 and 658.
• the encryption algorithms can advantageously be RSA public/private key but might be changed at any time related to security issues. Indeed, this security packet, produced in the secret and secure environment of the portable processor becomes indecipherable to the outside world including the processor-based system. The only other entity which should have knowledge of the keys to be able to decrypt this packet would be the postal authority in their designated mail sorting and scanning centers.
• Step 653 the security packet is transmitted back as a response to the host processor-based system.
• This indecipherable security packet is then handled blindly by the program to the point where it is passed on to a software function within the program which will encode security packet 653 into a bar code image.
• the program then takes this bar code image, includes certain other unencrypted information for the visual identification of the postage indicia and passes this through the programmer's interface to the "Windows" system to the standard printing facilities of that environment in a fashion well known in the art. Also included in this step is the passing of the return and designation addresses and all other parts of the envelope or other document which must be printed and can vary based on user choices before the printing step.
• the POSTAGE button initialization operation for new (never used buttons) is shown in FIGURE 10D beginning at STEP 1040.
• the initialization command must first verify, in step 1041, its authority level is correct and set at one by the presence of valid and password-unlocked master and agent buttons looping back to Step 1041 if not.
• the initialization function must locate a "blank" button on the bus to proceed to Step 1043, otherwise looping back to Step 1041.
• a blank button is defined as one which has pre-loaded operating instructions in its internal read-only-memory which are specific to the E- Stamp/Postal authority application outlined in this patent.
• the operating instructions must also be of the type of button being initialized. That is, those instructions for a POSTAGE button are somewhat different than those for a SECURITY DEVICE button necessitated by the differences in their operating behaviors and functions.
• buttons POSTAGE or SECURITY DEVICE type
• receives an initialization command from system 10 it must first have instructions in it to tell it what initialization means and what should be performed to accomplish this.
• it is the button that initializes itself after receiving a command from system 10, not system 10 directly writing in memory locations within the button.
• the architecture of the button is such that outside influence cannot directly change its operating instructions or memory.
• the host system for the button can only issue commands as defined in a narrow set of criteria to the button to make it perform a task such as initialization, credit or debit operations and repair of damaged memory.
• Step 1043 the actual initialize command is issued from system 10 to button and response of completed or not must return before the time-out period as shown in step 1044 or an error is generated (Step 1045), otherwise proceeding to Step 1046.
• step 1046 the positive or negative outcome are displayed on system 10 display screen to the agent.
• the transaction is logged and a customer receipt is printed out by POSTAGEMAKER before ending the initialization function at Step 1047.
• the internal layout of data in RAM for a POSTAGE button is depicted in FIGURE 12, as box 1201.
• the POSTAGE button repair operation is shown in FIGURE 10E beginning at step 1050.
• the repair command must first verify, in step 1051, its authority level is correct and set at one by the presence of valid and password-unlocked master and agent buttons to proceed to Step 1052, otherwise looping to Step 1051.
• the repair function must locate a damaged, but still valid POSTAGE button on the bus to proceed to Step 1053, otherwise looping to Step 1051.
• a damaged button is defined as one which has some internal memory location(s) which have been lost or changed because of internal program errors in the POSTAGE button itself.
• a more permanent kind of damage might be the loss of internal RAM or ROM which would probably be catastrophic enough that total replacement of the button would be in order. Such replacement would necessarily dictate marking the button serial number as invalid in the E- STAMP user registration database and entering the new button serial number for that user once it has been replaced and registered.
• Step 1053 the actual Repair command is issued from system 10 to the POSTAGE button and response of completed or not must return before time-out period as shown in step 1054 to proceed to Step 1056, otherwise an error is generated (Step 1055).
• the button must act on this command by checking its internal structures insofar as it can to see if all is as it should be. If nothing seems out of order, there is no repair work to be done. Otherwise, anything that can be reinitialized will be, and in any case, the results of the operation are reported back to system 10 and displayed in Step 1056. Thereafter, the postage button repair operation is ended at Step 1057.
• the AGENT button initialization operation is shown in FIGURE 10F beginning at step 1060.
• the initialization command must first verify, in step 1061, its authority level is correct and set at two by the presence of a valid and password-unlocked master button looping to Step 1061 if not.
• step 1062 the agent initialization function must locate a "blank" button on the bus to proceed to Step 1063, otherwise looping to Step 1061.
• a blank button is defined as one which has pre-loaded operating instructions in its internal read only memory which are specific to the E-Stamp/Postal authority application outlined in this patent. As explained above, the operating instructions must also be of the type of button being initialized. That is, those instructions for a POSTAGE button are somewhat different than those for a SECURITY DEVICE button necessitated by the gross differences in their operating behaviors and functions.
• Step 1063 the actual Initialize command is issued from system 10 to button and response of completed or not must return before time-out period as shown in step 1064 to proceed to Step 1066, otherwise an error is generated (Step 1065).
• Step 1066 the positive or negative outcome is displayed on system 10 display screen to the agent.
• the agent button initialize operation is ended at Step 1067.
• the newly formatted agent button may now be removed from its holder and distributed to its new agent owner.
• FIGURE 13 The internal layout of data in RAM for an agent (or master) button is depicted in FIGURE 13. Referring back to FIGURE 10A, and for the sake of further discussion and understanding of this POSTAGEMAKER button validation process, if a real-world situation presents itself where all three types of buttons: AGENT, MASTER and POSTAGE happen to be on the bus at the same time, the proper button is located by its response after a status query by system 10 running POSTAGEMAKER.
• the POSTAGEMAKER software has been designed in such a fashion that the button's physical position on the bus is not of importance. Once a button has been located and connected, its position on the bus could physically change with no effect to POSTAGEMAKER. This flexibility lends a certain forgiveness to order of log on of Master or Agent and distinguishing between the two and also between POSTAGE buttons and the Master or Agent.
• FIGURE 11 depicts a functional layout of the Dallas Semiconductor "smart" button 182 which is the preferred embodiment of the portable postage dispensing device.
• the smart button is so called because of its button-like appearance and small size and built-in memory 1104, 1107 and processor (CPU) 1101. It is a microprocessor contained in a hermetically sealed metal can with several other "hybrid" components which make it even more useful in a secure environment.
• Central processing unit (CPU) 1101 is a more efficient copy of the original 8051 microprocessor of Intel Corporation. Like most microprocessors, it executes instructions in sequence out of a memory, in this case, 32 Kbytes of read only memory (ROM) 1107. This sequence of instructions is sometimes known as a program or as operating code. Any process which has been programmed into a CPU will also require data to represent various control aspects of its task. Most of the data for the E-
• STAMP postage dispensing devices is kept in the 6 Kbytes of random access memory (RAM) which are non-volatile.
• RAM random access memory
• Semiconductor RAM loses its contents once power is removed from it, thus its volatile nature. Where this unique device draws its power from will be discussed here below.
• a small battery 1103 with a life of 10 years is present.
• registers 1102 for various uses as discussed herein.
• registers 1102 for various uses as discussed herein.
• registers 1102 for various uses as discussed herein.
• registers 1102 In addition to the normal registers which are part of the 8051-like architecture of the smart button, there are several other general purpose registers which provide such features as timed access to particularly sensitive RAM locations (such as the location of a cryptographic key).
• Another register is used for sequence checking of the operating code of the smart button. This feature makes sure that the code is executing in the proper sequence and has not somehow jumped out of its normal path of execution because of an anomaly of electrical states or due to tampering.
• Another register is a real-time clock 1111 which gives the button self-sufficiency in knowing what the current time is relative to its expiration date and also as an unimpeachable (in the sense that it cannot easily be externally tampered with) source of date stamping for the postage indicia.
• Several other special features have been added just for E-STAMP use.
• There is a 1024-bit modular exponentiator circuit 1105 which can handle two 1024-bit operands in extremely high speed. The application of this is for the cryptographic chores which are necessary in secure communications between system 10 and button 182.
• Another feature is random number generator 1108, also for cryptographic algorithm use.
• CRC cyclic redundancy check
• UART universal asynchronous receiver transmitter
• Bus 1110 connects all of the internal devices together so that they can function as a unit.
• the manner in which the UART and parasitic power are arranged to interface with the outside world, through the metal can of the processor is unique and leads to increased usability for the entire device.
• FIGURE 12 is the layout given to the 6K RAM in the preferred embodiment for a postage button. All registration identity, current balance and history logging data are stored in box 1201.
• FIGURE 13 is the layout given to the 6K RAM in the preferred embodiment for a security device button such as an agent or master.
• the SECURITY DEVICE is a similar, but limited subset of the POSTAGE memory definitions.
• box 1301 There is just enough data in box 1301 to identify its owner and to provide logging services in order to better know how various buttons are being used.
• Step 1400 the process begins at Step 1400 where a button is initially created and may be given a small token value.
• the button creation is marked by its entry into an "Initial Fill Button Inventory Database" simultaneously with its inclusion in a shrink-wrapped package of software to be shipped to users of the verification system.
• an electronic user registration form whose present embodiment is that of a "Windows" program separate from the main program but included with it on the system installation disks.
• the registration program must be executed as part of the installation of the system before it can be used to issue postage.
• the process of the user filling out the form, sending it and the still-unregistered button back for registration to be scanned into the user registration database for registration is represented in Step 1401 and Step 1402.
• buttons are a valid registered postage dispensing device.
• the button with its unique serial number, was moved from one inventory to another.
• the user registration database will be used for far more than just normal user registration of a software product.
• the registration of the button may be accomplished remotely, utilizing communications means, such as a PSN or LAN, and methods substantially the same as in remote refilling of the button discussed above.
• Such remote registration would involve the communication of information as described above, but transmission of this data is accomplished by electronic means rather than the form described above.
• the use of the above mentioned form may be omitted even without remote registration by the storage of such information electronically, such as, for example, within the postage storage device itself or other machine readable media.
• Step 1403 the user has received back his/her button, now fully registered and therefore legal to use in postage transactions.
• the user inserts the secure meter (button) in its interface receptacle and invokes the system control program on the PC. Once a letter has been produced, with a certain amount of postage, this amount of postage is deducted from the amount stored in the portable processor (memory) by way of commands from the E-STAMP program.
• the postal indicia with its encrypted form of user information, postage amount, date, strike counter and other information is printed on a label for sticking to an envelope, actually printed on an envelope or directly on a document.
• the mail object is entered into the mail system of the Postal Authority in Step 1404A.
• Step 1404B the article of mail has been gathered and sent to a central processing facility.
• Step 1405 the article of mail is scanned.
• the scan process first decodes the postal indicia using bar code scanning technology coupled with industrial automation toward the goal of validation of the pre-paid rights to send the article of mail.
• the system in Step 1406, uses a series of criteria and checks to accomplish this.
• criteria include, (but are not limited to): 1) Just the fact that the indicia, which was encrypted in the secure environment of the portable postage dispensing device, can be decrypted gives a basic comfort level of validation; 2) Check against the central user database for validation of expiration date, expected balance of meter as of now and special flags for lost or stolen portable postage dispensers giving the capability to invalidate them much in the same way lost or stolen credit cards can be invalidated because of their validation against a central database.
• Step 1407A the mail is routed to its normal destination. However, if the article of mail does not pass one of the tests, it is rejected to Step 1407B where an entry is written in an Anomaly database 1407C of items to be investigated.
• the refill, Step 1408, happens asynchronously to the rest of the steps, but is included, nevertheless, because of its contribution to the overall process loop. This is performed when a user has used most of the pre-paid credit on his/her meter (portable processor) and must return the portable processor to an authorized refill station, such as the Postal
• the preferred embodiments may include simply a host processor-based system used by one authorized agent to serve walk-up clients or an automated process whereby postage processor buttons are refill-processed in batches with little human interaction.
• the user provides his/her portable processor (memory) to the authorized agent, along with prepayment in the form of check, credit card, ACH, electronic funds transfer, or private account.
• the portable processor is credited with the prepayment amount using a PC which is executing to accomplish this in a secured and authorized environment. Once the portable processor has been credited, it is returned to the user, who can then continue to freely use the system to issue postage until the next time the portable processor must be refilled with pre-paid credits.
• the other important contribution of the system is its updating of the central user database with information on renewed expiration date, user pre-paid balance, refilling station identification, etc. This information is invaluable in the validation Step 1406. As discussed above, the process loop gives the benefits of accounting and audit-ability of pre-paid electronic postage to the adopting Postal Authority.
• the indicia is simply a printed form of a data packet produced by the cooperative effort of the PC and the portable processor.
• the data packet contains information that can be used for look up purposes in the database.
• the data packet can serve to authenticate any data stream coming from the PC or can be to authenticate itself, thereby granting a user certain privileges, based upon the authentication.
• the data packet could be associated with airline tickets, either in printed form or in electronic form. In either event, the data packet associated with the document to be checked is authenticated to prove the authenticity of the accompanying data.
• the "other" data can be printed (the data packet would then be printed and scanned into the system) or the "other" data could be electronic (the data packet could then be electronic and read directly).
• the invention has been discussed with reference to the United States Post Office, it shall be understood that it may be advantageously utilized in conjunction with any number of other postal authorities such as official postal authorities of foreign countries or private parcel carriers.
• the present invention may also be utilized where the electronic transfer of monetary indicia is advantageous without being limited to the transmission of postal items.

Landscapes

• Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Mathematical Physics (AREA)
• General Physics & Mathematics (AREA)
• Theoretical Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Devices For Checking Fares Or Tickets At Control Points (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=24924262

Family Applications (1)

Country Status (4)

Families Citing this family (35)

Family Cites Families (9)

• 1997
  • 1997-10-02 CA CA002266517A patent/CA2266517A1/en not_active Abandoned
  • 1997-10-02 EP EP97909958A patent/EP0931298A2/de not_active Withdrawn
  • 1997-10-02 AU AU47446/97A patent/AU727477B2/en not_active Ceased
  • 1997-10-02 WO PCT/US1997/017875 patent/WO1998014909A2/en not_active Application Discontinuation

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events