EP1585064A2 - Device and method for performing transactions - Google Patents

Abstract

The system has a number of postal franking machines (2,7,8,9,10) that are bus coupled (4) to a central data provider (3). This is programmed with a transaction monitoring function that checks entries for compatibility and stores data in memory modules.

Description

The present invention relates to a method for performing at least a first Transaction between a first data processing unit, in particular a franking machine, and a remote first data center. In this method, the first transaction in a performing step via a communication link between the first data processing unit and the first data center. In this case, in a first predetermining step preceding the implementation step of FIG a first source of a first transaction control information associated with the first data processing unit and the first transaction in the execution step in response to the first transaction control information. The The present invention further relates to a corresponding arrangement for carrying out the method according to the invention.

In a variety of applications, a first data processing unit is used and a remote first data center via a corresponding communication link Transactions performed. These may be, for example, transactions act in which the state of the data processing unit is changed. So For example, these may be transactions involving data in the first computing device be loaded or removed from this. Likewise it can but also be transactions that do not change the state of the data processing unit even done. For example, data can be easily extracted from the data processing unit be read out.

From the field of franking machines, it is known, for example, via a communication link between the postage meter machine and a remote data center a service provider, which is often the manufacturer of the franking machine is to load postage in the franking machine. This postage can then be used franking imprints valid with the franking machine accepted by a mail carrier to create. In certain variants of so-called post-payment systems the load is logged in the data center of the service provider and usually sent to a data center of the mail carrier at a later date. The postal carrier then calculates the amount charged directly to the user of the Franking machine off.

For safety reasons, these systems usually have one for each Franking machine a separate contract between the mail carrier and the user of respective franking machine. On the other hand, a separate one is created in the respective data center Master data set for the respective franking machine held and maintained. This regularly synchronized master data record usually contains such a called credit limit. This credit limit is determined by the postal carrier on the basis of certain Specified criteria and usually sets a maximum postage amount, which can be loaded into the franking machine within a certain period of time.

For each new transaction with a postage load, the data center of the service provider checks whether with the requested amount the given maximum amount is exceeded will, and respond according to the result of the review. For example, she can stop charging if the credit limit is exceeded. With others Thus, the credit limit represents a first transaction control information in which Dependency the transaction is performed.

Especially with owners of several franking machines, such as larger Companies etc., which have several franking machines, possibly different Often use sites, the problem is that the transactions of each Franking machines only decentrally monitored at the individual franking machine or to can be influenced. A central monitoring or influencing is usually difficult or only with a certain delay after invoicing by the postal carrier possible.

The present invention is therefore based on the object, a method or a Arrangement of the type mentioned to provide, which or which the disadvantages mentioned above, or at least to a lesser extent and in particular a simple central monitoring or influencing the transactions of a or more data processing units.

The present invention solves this problem starting from a method according to the The preamble of claim 1 by the specified in the characterizing part of claim 1 Characteristics. It continues to solve this task on the basis of an arrangement according to the preamble of claim 18 by the in the characterizing part of claim 18th specified characteristics.

The present invention is based on the technical teaching that a simple, central monitoring or influencing of the transactions of one or more data processing units allows, if in a method mentioned in a the second preselection step preceding a second step of the execution step Source one of the first data processing unit associated second transaction control information and the first transaction in the execution step is performed in response to the second transaction control information.

This is the owner of several, possibly decentralized arranged first data processing units in a simple way, as a second source or over a second source to closely monitor the transactions of the first data processing unit or to influence, without directly to the respective first data processing unit to access yourself. In the case of a postage meter machine can do so in a simple manner For example, internal limits may be set for postage recharge by the Credit limits of the respective postal carrier differ.

Preferably, the first transaction control information and the second relate Transaction control information therefore on the same transaction feature. In which Transaction property may be any feature of the transaction. For example, in the case of the franking machine, it may be the postage amount which is loaded with the transaction.

In addition, the second transaction control information may be a plurality of data processing units be assigned so that transactions over a single centralized specification multiple data processing units can be influenced or monitored. In the case a postage meter machine can thus in a simple manner, for example, internal limits for the Reloading postage will be specified by the credit limits of the respective postal carrier differ.

Furthermore, for a group of several data processing units over the second transaction control information also includes variable transaction control information are given by previous transactions of the data processing units depend on the group or any other parameters. It can specified arbitrarily complex rules on the second transaction control information according to which the transactions of the data processing units of the group are influenced or monitored. Thus, for a group of postage meters for For example, simply set a total internal limit for reloading for a specific time period be specified by Porto. In the simplest case, as a rule, only the exhaustion of the internal total limits for the group. If this is exhausted, becomes independent of which franking machines have exhausted the total limit, the other Reloading postage in franking machines of the group prevented.

Is not only the first data center at the first transaction but also another Data center involved, so the first transaction control information in the first Default step both the first data center and the other data center for Be made available to be considered in the context of the first transaction to be able to. The first transaction control information is preferred in the first predetermining step However, the first data center provided a quick settlement to enable the transaction. The same applies to the second transaction control information. In the second predetermining step, this too can be used both for the first data center as well as the further data center are made available. Prefers it is also provided in the second default step of the first data center. Incidentally, it goes without saying that the first data center even the first source can be.

The transmission of the respective transaction control information to the first data center can be done in any way. So can a so-called offline transmission be selected, for example by mail, telephone, fax, e-mail or other electronic Document or file transfer (eg via EDI, FTP etc.). It is preferred a so-called online transmission with a direct communication with the first Data center selected. Preferably, therefore, it is provided that the first transaction control information in the first default step of the first data center via a Communication link between the first source and the first data center for Is made available. Additionally or alternatively, the second transaction control information becomes in the second default step of the first data center via a communication link between the second source and the first data center posed.

The respective source of the respective transaction control information may be of any kind be. In particular, the source may also be a person. Preferably each is also a remote data center.

The first transaction can be triggered in any way and from any page. Often it is triggered by the first data processing unit. It is preferred in a request step preceding the execution step, one of the first Transaction associated, from the first and second transaction control information specified different request information by the first data processing unit and the first data center provided. The first transaction is then in the performing step in response to the request information.

Is this request information different from the first and second transaction control information not with the first transaction control information or the second transaction control information compatible, it may be provided that the Transaction is completely denied. Preferred is then a corresponding note transmitted to the first data processing unit.

Preferably, however, it is provided that the transaction is not denied, but in the performing step in response to the request information in the frame the predetermined by the first and second transaction control information limits he follows. In other words, the first transaction is performed in the Implementation step depending on the request information then insofar as the request information with the first transaction control information and / or the second transaction control information is compatible. Is at a postage meter z. For example, a postage amount requested by the second transaction control information predetermined internal limit, then a rule may be provided which causes in the context of the first transaction to load a lower postage amount takes place, with which the internal limit is exactly exhausted.

For this purpose, in a first checking step of the implementation step, preference is given to Compatibility of the request information with the first transaction control information checked. In a first modification step then the request information depending on the result of the check in the first checking step and a predetermined first modification criterion modified such that the request information compatible with the first transaction control information. additionally or alternatively, in a second checking step of the implementing step, the Compatibility of the request information with the second transaction control information checked. In a second modification step, the request information is in Depending on the result of the check in the second checking step and a predetermined second modification criterion then modified such that the request information compatible with the second transaction control information. The respective modification criterion can be specified in the form of an arbitrarily complex rule be.

Preferably, a precedence rule is between the first and second transaction control information specified. In this example, a precedence of the first transaction control information predetermined before the second transaction control information be. Thus, it can be provided that the execution of the first transaction in the Performing step in response to the second transaction control information at most insofar as the second transaction control information matches the first one Transaction control information is compatible.

Preferably, in a third checking step, the compatibility of the second Transaction control information with the first transaction control information checked. In a third modification step, the second transaction control information then becomes depending on the result of the check in the third checking step and a predefinable third modification criterion modified in such a way that the second transaction control information with the first transaction control information is compatible. Again, the modification criterion can again in shape be given an arbitrarily complex rule.

In advantageous variants of the method according to the invention takes place in the context of the first Transaction in a logging step, a logging of at least one Part of the between the first data processing unit and the first data center exchanged information. In this case, a first protocol information is generated. Prefers is then at least in a reporting step following the logging step a portion of the first protocol information is transmitted to the second source. This is it in a simple manner, an owner of several first data processing units Any detailed feedback about the transaction activity of its data processing units to give. In other words, this can be timely and centrally its data processing units monitor without accessing them directly.

Depending on the security relevance of the respective transaction can be provided that at least that between the first data processing unit and the first data center exchanged information is secured by cryptographic means. in this connection can be varied according to the nature and content of the transaction. Should the exchanged For example, data that is unobservable to unauthorized third parties will usually be encoded by appropriate means, for example, encrypted. Lies a Emphasis on the comprehensible immutability of the exchanged data, so they are authenticated by appropriate means. There are a number of suitable ones for this purpose known authentication methods, which are not discussed in detail at this point shall be. There are only exemplary so-called message authentication Called codes (MAC) or digital signatures. It is further understood that the described Hedging also on all other aforementioned communications between other communication partners.

As already mentioned above, several data processing units can be combined into groups then for a single preset the second transaction control information can be specified. It can be different second Transaction control information for different data processing units in group transaction control information. It is the same but possible, a second transaction control information common to a plurality of data processing units by assigning the second transaction control information to specify to these data processing units. The assignment to these data processing units is done by a corresponding part of the group transaction control information.

In advantageous variants of the method according to the invention is therefore a number of Data processing units are provided which are a first group of data processing units assigned. In the implementation step becomes a first transaction between a data processing unit of the first group and the first data center carried out. In this case, in the second predetermining step from the second source, one of the predetermined group transaction control information assigned to the first group, which the second transaction control information comprises.

It is understood that for the existing data processing units any fine subdivision into groups and subgroups, etc. may be provided. With In other words, an arbitrarily highly hierarchized hierarchy of data processing units be given, in a simple way an accurate, timely monitoring or influencing the transactions of the existing data processing units is possible.

The present invention further relates to an arrangement for carrying out at least a first transaction between a first data processing unit, in particular a franking machine, and a remote first data center, which is connectable to perform the first transaction via a communication link with the first data processing unit. The first data center in this case has a first memory, in which a predetermined by a first source and the first data processing unit associated first transaction control information is stored. The first data center is further adapted to perform the first transaction in response to the first transaction control information. According to the invention, it is provided that
the first data center has a second memory in which a second transaction control information predetermined by a second source and associated with the first data processing unit is stored. Furthermore, the first data center is designed to perform the first transaction in dependence on the second transaction control information.

This arrangement is suitable for carrying out the method according to the invention. With her can be described above in connection with the method according to the invention Realize variants and advantages to the same extent, so here largely only Reference is made to the above statements.

Furthermore, the present invention relates to a data center for an inventive Arrangement which is designed in the manner of the first data center. This data center in other words, at least part of that described above or below Features of the first data center on.

Figur 1

ein Blockschaltbild einer bevorzugten Ausführungsform der erfindungsgemäßen Anordnung zur Durchführung des erfindungsgemäßen Verfahrens;

Figur 2

ein Ablaufdiagramm einer bevorzugten Ausführungsform des erfindungsgemäßen Verfahrens, das mit der Anordnung aus Figur 1 ausgeführt werden kann;

Figur 3

ein Ablaufdiagramm einer weiteren bevorzugten Ausführungsform des erfindungsgemäßen Verfahrens, das mit der Anordnung aus Figur 1 ausgeführt werden kann;

Figur 4

einen Teil eines Ablaufdiagramms einer weiteren bevorzugten Ausführungsform des erfindungsgemäßen Verfahrens, das mit der Anordnung aus Figur 1 ausgeführt werden kann.

Further preferred embodiments of the invention will become apparent from the dependent claims and the following description of preferred embodiments, which refers to the accompanying drawings. Show it

FIG. 1

a block diagram of a preferred embodiment of the inventive arrangement for carrying out the method according to the invention;

FIG. 2

a flow diagram of a preferred embodiment of the method according to the invention, which can be carried out with the arrangement of Figure 1;

FIG. 3

a flow diagram of another preferred embodiment of the method according to the invention, which can be carried out with the arrangement of Figure 1;

FIG. 4

a part of a flowchart of another preferred embodiment of the method according to the invention, which can be carried out with the arrangement of Figure 1.

FIG. 1 shows a block diagram of a preferred embodiment of the arrangement 1 according to the invention for carrying out the method according to the invention. The arrangement comprises a first data processing unit 2 in the form of a first franking machine (FM ₁₁ ), which can communicate via a communication link with a first data center 3 of a service provider.

The first franking machine 2 has a postal security module (PSD ₁₁ ) 2.1 with a credit store 2.2 in the form of postal registers. In this credit store is, inter alia, a so-called descending register whose value is reduced by each printed by the first franking machine 2 franking imprint by the printed postage value.

The service provider in this example is the manufacturer of the Postage meter 2. This offers as a service for the first postage meter 2 the Loading postage into the credit storage 2.2 of the security module 2.1. Will this Service in the context of a first transaction between the first franking machine 2 and The first data center executes, among other things, the value of the descending register increased by the reloaded value. The first transaction is via a Communication connection between the first franking machine 2 and the first data center 3 settled.

The first data center 3 comprises a central processing device 3.1, which with a Communication module 3.2, for example, a modem bank or the like, connected is. With this communication module 3.2 can via a communication network 4 the Communication connection can be made with the first franking machine 2, the For this purpose also a corresponding - not shown - communication module comprises.

In addition to the first franking machine 2, the arrangement 1 also comprises further franking machines. These are assigned to two groups, a first group 5.1, a second group 5.2 and a third group 6. The first group 5.1 are assigned n franking machines, of which only the first franking machine 2 and the nth franking machine 7 (FM _1n ) are shown. The second group 5.2 are assigned the franking machines of the first group 5.1 and the franking machine 8 (FM _{1n + 1} ).

The third group 6 are associated with m franking machines, of which only the franking machine 9 (FM ₂₁ ) and the mth franking machine 10 (FM _2m ) are shown in FIG. The franking machines 7, 8, 9 and 10 are constructed like the first franking machine 2. They each have a postal security module 7.1, 8.1, 9.1, 10.1 (PSD _1n, PSD _{1n + 1} , PSD ₂₁ , PSD _2m ) with a credit storage 7.2, 8.2, 9.2, 10.2 in the form of postal registers.

The franking machines of the first group 5.1 and the second group 5.2 are located spatially separated locations of a first company, which this Owns franking machines. The franking machines of the second group 6 are located also in geographically separated locations of a second company, which owns these franking machines.

The first data center 3 can continue via the communication network 4 with a remote second data center 11 of a mail carrier to be connected. This mail carrier conveys the franked with the franking machine 2 mail pieces, where he a valid franking imprint accepted as proof of payment for the transport fee.

In the case implemented in this case, so-called post-payment system is the charging process performed in the first data center during the first transaction 3 of the service provider first logged and at a later time the second data center 11 of the mail carrier transmitted. The mail carrier pays the charged amount then directly from the owner of the franking machine.

For reasons of security, for each franking machine 2, 7, 8, 9, 10 there is a separate contract between the mail carrier and the owner of the respective franking machine 2, 7, 8, 9, 10. For this reason, 3 or 10 are stored in the respective data center 11 a separate master data record for the respective franking machine 2, 7, 8, 9, 10 held and maintained. In the first data center 2, this master data record is stored in each case in a first memory 3.3 connected to the central processing device 2.1. This regularly synchronized master data record usually contains a so-called credit limit. This credit limit, which constitutes a first transaction control information TSI ₁ in the sense of the present invention, is specified by the postal carrier on the basis of specific criteria. It determines a maximum postage amount for the respective franking machine 2, 7, 8, 9 and 10, respectively, which can be loaded into the respective franking machine 2, 7, 8, 9 or 10 within a certain period of time. The credit limit refers to a first transaction characteristic of certain transactions, namely the postage amount that is loaded into the postage meter 2, 7, 8, 9 or 10 with such a transaction.

The first data center 3 can continue via the communication network 4 with a remote third data center 12 of the owner of the franking machines of the first and second group 5.1 and 5.2. As explained in detail below is, the owner of the first and second group can 5.1 and 5.2 through the connection the third data center 12 with the first data center 3 on the one hand to the transactions between the first data center 3 and the franking machines of the first and second group 5.1 and 5.2. Second, he can do transactions between the first data center 3 and the franking machines of the first and second Monitor groups 5.1 and 5.2 centrally and in a timely manner. Both can be done in an advantageous way without immediate access of the third data center 12 to the franking machines of the first and second groups 5.1 and 5.2.

The first data center 3 can continue via the communication network 4 with a remote fourth data center 13 of the owner of the franking machines of the third group 6 get connected. Again, the owner third group 6 on the compound of fourth data center 13 with the first data center 3 on the one hand on the transactions between the first data center 3 and the franking machines of the third group 6 influence to take. For another, he can handle the transactions between the first data center 3 and the franking machines of the third group 6 monitor centrally and promptly. Both again in an advantageous manner without immediate access of the third data center 12 take place on the franking machines of the first and second groups 5.1 and 5.2.

The first data center 3 comprises a first memory 3.3 in which specifications of the second data center 11 are stored. These specifications include, inter alia, first transaction control information TSI ₁ , which are assigned to the respective franking machine and whose function will be explained in detail below.

The first data center 3 further comprises a second memory 3.4, in which specifications of the third data center 12 and the fourth data center 13 are stored. These specifications include, among other things, second transaction control information TSI ₂ , which are assigned to franking machines and whose function will also be explained in detail below.

The first data center 3 further comprises a third memory 3.5, in which among other things first modification criteria MK ₁ are stored, which are associated with franking machines. In a fourth memory 3.6 of the first data center 3, among other things, second modification criteria MK ₂ are stored, which are also assigned to franking machines. The function of these modification criteria will be explained in detail below.

The first data center 3 further comprises a log memory 3.7, in which inter alia Log information PI can be stored on performed transactions. Finally, the first data center still includes a with the processing device .31. Connected security module 3.8, which inter alia cryptographic means for Securing data transmissions provides.

In the following, with reference to Figures 1 and 2, the sequence of the invention Method for carrying out transactions between the first data center 3 and the first franking machine 2 described in more detail.

After the procedure has been started in a step 14.1, it is first checked in a step 14.2 whether a new specification of a first transaction control information TSI _{1 is to} take place. If this is the case, a first transaction control information TSI ₁ in the form of a credit limit for the first franking machine 2 is specified in a first predefined step 14.3. This first transaction control information TSI ₁ is specified by the second data center 11 as the first source. It is transmitted as the first default data record for the first franking machine 2 from the second data center 11 via the communication network 4 to the first data center 3. There it is stored for updating the master data record of the first franking machine 2 in the first memory 3.3. The specification and transmission of the first transaction control information TSI ₁ can occur at regular intervals or as required.

In a step 14.4 it is then checked whether a new specification of a second transaction control information TSI _{1 should} take place. If this is the case, a second transaction control information TSI _{2 is} predefined in a second predefined step 14.5, which comprises an intra-company credit limit for the first franking machine 2. This intra-company credit limit specifies an internal upper limit for the postage to be loaded into the first franking machine 2 over a certain predetermined period of time. The intra-company credit limit and thus also the second transaction control information TSI ₂ thus also relate to the same transaction feature as the first transaction control information TSI ₁ , namely the above-mentioned first transaction feature, ie the postage amount that is loaded into the postage meter machine 2 with such a transaction.

The second transaction control information TSI ₂ is specified by the third data center 12 as the second source. It is transmitted from the third data center 12 via the communication network 4 to the first data center 3 in a second default data record assigned to the first franking machine 2. There, the second default data set with the second transaction control information TSI _{2 is} stored in the second memory 3.4.

The company-internal credit limit in the second default data record, ie the second transaction control information TSI ₂ , is not only associated with the first franking machine 2, but also by means of corresponding references in the second default data record with all other franking machines of the first group 5.1. In other words, the second default data record thus comprises a group transaction control information for all franking machines of the first group 5.1. As a result, second transaction control information TSI ₂ can be specified for all franking machines of the first group 5.1 with a single transmission of the second default data record.

For the franking machine 8 is in a separate third default data set of the third data center 12 a from the credit limit for the franking machines of the first Group 5.1 different credit limit specified. In other words, it is with the present invention possible, any subdivisions of the franking machines in Groups and subgroups, etc. and this subdivision a the to influence the transactions adapted to specific needs.

Furthermore, the third data center 12 with a fourth default data record becomes a Group transaction control information for all postage meters of the second Group 5.2 specified. This indicates, on the one hand, a time interval after each of which expires Postage meters of the second group 5.2 as part of a transaction with the first Data center 3 to a detailed status report to the first data center 3 causes becomes.

The group transaction control information thus refers to a second transaction feature, namely the reporting data provided in the context of the transaction in question. The timing and / or scope of the transaction according to the group transaction control information submitted report data may differ from the time and / or scope of the submitted reporting data, according to another Transaction control information are given. This further transaction control information thus also refers to the same transaction feature, viz the second transaction feature. This further transaction control information can for example, be specified by the mail carrier as the first source.

Finally, the group transaction control information gives the fourth default record a credit limit rule for all franking machines of the second group 5.2. This states that within a certain period the sum of all franking machines the second group 5.2 charged credit amounts a certain amount may not exceed. In other words, a group credit limit for all Postage meters of the second group 5.2 given.

It is understood that the transmission of the default data sets or contained therein Transaction control information to the first data center in the first and second, respectively Predetermined step in other variants of the invention also take other ways can. Thus, the transmission, for example, by mail, telephone, fax, e-mail or otherwise electronic document or file transfer (eg via EDI, FTP etc.) respectively. Furthermore, the specification and transmission of the default data sets in regular Intervals or as needed.

Furthermore, it is understood that the respective transaction control information in other Variants of the invention next to or instead of the credit limit or the report interval one or more of any other requirements for one to be performed in the course of the transaction Service for the franking machine. In other words, can the respective transaction control information is common to any other Refer to transaction feature.

In a step 14.6 it is then checked whether a new service request is to be made by the franking machine with the specification of a request information AI. If this is not the case, it is jumped back to step 14.2. Otherwise, the franking machine 2 initiates a transaction with the first data center 3 in a request step 14.7 by contacting it via the communication network 4 and thereby transmitting a request data record. This request data record comprises a request information AI, with which the execution of several services D ₁ to D _{x is} requested. These include as service D ₁ the loading of a specific credit in the franking machine 2.

In an execution step 14.8, this first transaction is now performed in a series of substeps. First, the processing device 3.1 checks in a checking step 14.9 whether the request information AI is compatible with the second transaction control information TSI ₂ stored in the second memory 3.4 and associated with the franking machine 2. Thus, it is first checked whether the requested amount for the postage meter 2 predetermined internal credit limit is exceeded. Furthermore, it is checked whether the group credit limit prescribed by the credit limit rule for all franking machines of the second group 5.2 is exceeded.

In both cases, upon detection of a conflict between the request information AI and the transaction control information TSI ₂ , the processing device 3.1 changes the request information AI in a modification step 14.10. For this purpose, it accesses the second modification criterion MK ₂ stored in the fourth memory 3.5 and assigned to the franking machine 2. This second modification criterion MK ₂ specifies in which way the request information AI is modified in the case of such a contradiction.

In the present case, the second modification criterion MK _{2 means} that the request information AI is modified so that it contains the maximum credit amount still allowed, with which the company-internal credit limit and the group credit limit are adhered to.

The in-house credit limit of the franking machine ₂ predefined by the transaction control information TSI ₂ in a predefined time period T lies at L _max = € 1000. If, for example, the franking machine 2 has already loaded L _sum = € 700 in the predefined time period T and now requests it with the request information Al an amount L _AI = Euro 400, the request information AI is modified in the modification step 14.10 so that the requested amount is only the maximum permitted after the company credit limit L _AI '= € 300.

If, in addition, the group _{credit limit of} the first group 5.1 is L _Gmax = Euro 3000 in the predetermined period T and L _Gsum = Euro 2800 have already been loaded by the franking _{machines of} the first group 5.1 in the predetermined period T, then the request _information AI in the modification step 14.10 modified so that the requested amount is only the maximum permitted L _AI '= Euro 200 after the group credit limit.

It is understood that in the event that this amount then in the postage meter 2 is loaded, none of the franking machines of the first group 5.1 in the given Period T can still load more postage, since the group credit limit of the first Group 5.1 is then exhausted.

It is understood in this context also that in other variants of the invention may also be provided that the request information in a detected Incompatibility is not modified, but the entire transaction or at least the requested service to which the incompatibility relates was aborted or not executed. For example, a load can be canceled, if the given credit limit is exceeded while other requested or pending services, such as loading a new postage table into the postage meter machine, be executed.

In a checking step 14.11, the processing device 3.1 checks whether the request information AI is compatible with the first transaction control information TSI ₁ stored in the second memory 3.4 and associated with the franking machine 2. It is thus checked whether the requested amount exceeds the credit limit specified for the postage meter machine 2 by the mail carrier.

In this case too, when a contradiction between the modified request information AI and the transaction control information TSI _{1 is} established, the processing device 3.1 changes the modified request information AI in a further modification step 14.12. For this purpose, it accesses the first modification criterion MK ₁ stored in the third memory 3.5 and assigned to the franking machine 2. This first modification criterion MK ₁ specifies how the request information AI is modified in the event of such a contradiction.

In the present case, the first modification criterion MK _1, analogous to the second modification criterion MK ₂ , means that the request information AI is modified such that the franking machine 2 contains the maximum credit amount still allowed, with which the credit limit specified by the mail carrier is adhered to.

The credit limit of the franking machine 2 predetermined by the transaction control information TSI ₁ for the predetermined time period T is L _Pmax = € 800. For the above example, the request _information AI is modified in the modification step 14.12 such that the requested amount only remains after the maximum permitted by the postal carrier preset credit limit _AI L '= EUR 100.

The respective modification criterion is specified by the data center 11, 12 or 13. In other words, it represents a conflict resolution strategy according to which Conflicts between the requirements and specifications in the context of transactions resolved become.

In the execution step 14.13, the services D ₁ to D _x are then executed sequentially in accordance with the modified request information Al. Here, it is understood that the request information A1 may have been modified according to the first and second transaction control information so that not only the service D ₁ but also other services according to the first and second transaction control information are executed. For example, it may be predetermined by the second transaction control information TSI ₂ that a detailed status report from the franking machine 2 is requested at predefinable times as the service D _x .

Through the chosen sequence of checking and modification steps 14.9 to 14.12 it is ensured that the credit limit prescribed by the postal carrier takes precedence over the company's internal credit limits. That prescribed by the mail carrier Credit limit is therefore respected in any case. The execution of the transaction in dependence from the request information and the second transaction control information In other words, it is only to the extent that it is the same as that of the postal carrier specified credit limit are compatible.

In a logging step 14.14, the processing device 3.1 then generates in a given format and scope for the first transaction protocol information PI and stores them in the log memory 3.8. The log memory 3.8 contains among other things for each franking machine a protocol over that for the data center recognizable activities of the franking machine since its initialization.

In a reporting step 14.15 at least a part of the protocol information PI in a Report data set to the second source, so the third data center 12 transmitted. Gegebenenfialls this report step is only to be determined by the second source Time points performed. This can be done by the third data center 12, for example with the transmission of the second transaction control information to the first data center 3 are given.

Hereby, any surveillance scenarios can be realized with which the respective Owner can variably monitor his franking machines according to his needs. So can For example, be provided that the second source with the second transmission Transaction control information dictates that the credit card load activities of the postage meters the first group 5.1 for a certain period of time should. The report data set generated in the first data center then comprises each the current total of the loading amounts of the franking machines of the first Group 5.1 has been loaded since the beginning of this period. At the specifiable period it can be a time interval of a certain length (eg 20 days), the beginning of which by the arrival of the associated transaction control information in the first Data center is highlighted. Similarly, it may be a calendar-fixed period trade (for example, from the first day to the last day of a given calendar month).

This allows the owner of the postage meter a detailed, timely and according to his needs formatted overview not only about the activities individual franking machines but also over the total activities arbitrarily defined To obtain groups of postage meters. In particular, it is possible to have an alarming function provide for the respective owner, according to this the owner or the Data center assigned to it is immediately informed in any desired detail, if one of them predetermined monitoring criterion is met. In this monitoring criterion For example, it may be about exceeding or reaching a credit limit act.

Finally, in a step 14.16 it is checked whether the method sequence is ended should. If this is the case, the processing ends in a step 14.17. Otherwise, that becomes Step 14.2 jumped back.

All transmissions of security-relevant data, in particular billing-relevant Data, between the franking machines 2, 7, 8, 9, 10 or the data centers 11, 12, 13 and the data center 2 are in a well-known manner by cryptographic Secured funds. This can be varied depending on the nature and content of the transaction. Should the exchanged data not be visible to unauthorized third parties, for example, They are usually encoded by appropriate means, for example, encrypted. There is a focus on the comprehensible immaculateness of the exchanged Data, they are authenticated by appropriate means, for example through so-called message authentication codes (MAC) or digital signatures.

FIG. 3 shows a flow chart of a further preferred embodiment of the invention Method that can be performed with the arrangement of Figure 1. This version differs only in a few steps from the execution of FIG 2, so here only the differences should be discussed. Especially For example, identical steps in Figs. 2 and 3 are given the same reference numerals.

The essential difference from the embodiment of Figure 2 is that the second data center 11 of the mail carrier is involved in the transaction. Consequently, the first transaction control information TSI ₁ in this variant does not necessarily have to be transmitted to the first data center 3 in the first specification step 14.3 'after its specification by the second data center 11. Rather, it is sufficient that the first transaction control information TSI ₁ in the second data center 11 is present. The first memory 3.3 of the first data center 3 can then optionally remain empty or missing.

If the check in the checking step 14.9 reveals that the request information AI is incompatible with the second transaction control information TSI ₂ stored in the second memory 3.4, associated with the postage meter 2, the request information Al is modified in the modification step 14.10 'according to the second modification criterion MK ₂ . Subsequently, the modified request information AI is transmitted in this step to the second data center 11 of the mail carrier. In this case, the modified request information AI is provided with a digital signature or another authentication means of the first data center 3 in order to make the authenticity of the modification traceable.

If the check in the checking step 14.9 shows that the request information AI is compatible with the second transaction control information TSI ₂ , the request information AI is transmitted in step 14.18 directly to the second data center 11 of the mail carrier.

The verification step 14.11 'then takes place in the second data center 11 of the mail carrier. The first modification criterion MK ₁ is then present at least in the second data center 11. The third memory 3.5 of the first data center 3 can then optionally remain empty or missing.

If the check in the checking step 14.11 'reveals that the request information A1 is incompatible with the first transaction control information TSI ₁ assigned to the franking machine 2 in the second data center 11, the request information AI in the modification step 14.12' is changed by the second data center 11 according to FIG modified first modification criterion MK ₁ . Subsequently, the modified request information AI is transmitted to the first data center 3 together with a corresponding authorization information in this step. The authorization information authorizes the execution of the transaction with the modified request information Al. Among other things, the modified request information Al is provided with a digital signature or another authentication means of the second data center 3 in order to make the authenticity of the modification traceable.

If the check in the checking step 14.11 'reveals that the request information AI is compatible with the first transaction control information TSI ₁ , the request information Al is transmitted to the first data center 3 directly in step 14.19 together with a corresponding authorization information.

All other steps of this variant of the method according to the invention are designed as described in connection with FIG.

FIG. 4 shows part of a flowchart of a further preferred embodiment of the inventive method, which is carried out with the arrangement of Figure 1 can be. This version differs in only a few steps from the embodiment of Figure 2, so that only the differences are discussed here should. In particular, identical steps in FIGS. 2 and 3 are given the same reference numerals Mistake. FIG. 4 shows the modified section of the method sequence between points 14.20 and 14.21 of Figure 2.

The essential difference from the embodiment of FIG. 2 is that not the request information AI but the second transaction control information TSI _{2 is} checked for its compatibility with the first transaction control information TSI ₁ and if necessary modified.

Accordingly, in this variant, after the second specification step 14.5, it is checked in a checking step 14.22 whether the second transaction control information TSI ₂ is compatible with the first transaction control information TSI ₁ . If this is not the case, the processing device 3.1 modifies the second transaction control information TSI ₂ in a modification step according to a third modification criterion MK ₃ such that it is compatible with the first transaction control information TSI ₁ . This third modification criterion MK ₃ may have been predetermined by the second data center 11 and stored in a fifth memory 3.10 of the first data center 3.

In this variant, then the steps 14.11 and 14.12 from Figure 2, while make the remaining steps as described in connection with Figure 2.

The individual steps of the variants of the invention described above Processes are preferably carried out sequentially immediately after one another. It understands However, there are certain longer time intervals between individual steps can.

Furthermore, it should be understood that the separate memories described above are not necessarily have to consist of separate memory modules. Rather, they can also at least partially as separate memory areas of a single memory module be educated.

The present invention has been described above exclusively by way of examples described in the field of franking machines. It is understood, however, that they themselves equally applicable to other applications in which data processing units, perform the transactions with a remote data center, centrally influenced or monitored via specifications to the remote data center should.

Claims (37)

Method for carrying out at least one first transaction between a first data processing unit (2, 7, 8, 9, 10), in particular a franking machine, and a remote first data center (3), in which in an execution step (14.8) the first transaction is performed via a communication link between the first data processing unit (2, 7, 8, 9, 10) and the first data center (3), wherein in a first predetermining step (14.3) preceding the execution step (14.8), a first transaction control information assigned to the first data processing unit (2, 7, 8, 9, 10) is specified by a first source (11), and the first transaction is performed in the performing step (14.8) in response to the first transaction control information, characterized in that in a second preselection step (14, 5) preceding the execution step (14, 8), a second transaction control information assigned to the first data processing unit (2, 7, 8, 9, 10) is specified by a second source (12) and the first transaction is performed in the performing step (14.8) in response to the second transaction control information. A method according to claim 1, characterized in that the first transaction control information and the second transaction control information relate to the same transaction feature. A method according to claim 1 or 2, characterized in that the first transaction control information is provided in the first predetermining step (14.3) of the first data center (3) and or the second transaction control information is provided in the second setting step (14.5) of the first data center (3). A method according to claim 3, characterized in that the first transaction control information is provided in the first setting step (14.3) of the first data center (3) via a communication link between the first source (11) and the first data center (3) and or the second transaction control information is provided in the second default step (14.5) of the first data center (3) via a communication link between the second source (12) and the first data center (3). Method according to one of the preceding claims, characterized in that the first transaction control information is given by a remote second data center (11) as the first source and or the second transaction control information is given by a remote third data center (12) as the second source. Method according to one of the preceding claims, characterized in that in a request step (14.7) preceding the execution step (14.7), a request information assigned to the first transaction and different from the first and second transaction control information is given by the first data processing unit (2, 7, 8, 9, 10) and the first data center (3) Is made available the first transaction is performed in the performing step (14.8) in response to the request information. A method according to claim 6, characterized in that the implementation of the first transaction in the implementation step (14.8) depending on the request information is at most insofar as the request information with the first transaction control information and / or the second transaction control information is compatible. A method according to claim 6 or 7, characterized in that in a first checking step (14.11) of the execution step (14.8) the compatibility of the request information with the first transaction control information is checked, and in a first modification step (14.12), the request information is modified in dependence on the result of the check in the first checking step (14.11) and a predefinable first modification criterion such that the request information is compatible with the first transaction control information and or in a second checking step (14.9) of the execution step, the compatibility of the request information with the second transaction control information is checked, and in a second modification step (14.10) the request information is modified in dependence on the result of the check in the second checking step (14.9) and a predefinable second modification criterion such that the request information is compatible with the second transaction control information. Method according to one of the preceding claims, characterized in that the implementation of the first transaction in the execution step (14.8) in dependence on the second transaction control information is at most insofar as the second transaction control information is compatible with the first transaction control information. A method according to claim 9, characterized in that in a third checking step (14.22) the compatibility of the second transaction control information with the first transaction control information is checked, and in a third modification step (14.23) the second transaction control information is modified in dependence on the result of the check in the third checking step (14.22) and a predefinable third modification criterion such that the second transaction control information is compatible with the first transaction control information. Method according to one of the preceding claims, characterized in that in the context of the first transaction, a first service for the first data processing unit (2, 7, 8, 9, 10) is performed. A method according to claim 11, characterized in that in the context of the first transaction, a change in state of the first data processing unit (2, 7, 8, 9, 10) takes place. Method according to one of the preceding claims, characterized in that the first data processing unit is a franking machine (2, 7, 8, 9, 10) and in the context of the first transaction new credit in the postage meter (2, 7, 8, 9, 10) is loaded. Method according to one of the preceding claims, characterized in that in a logging step (14.14) a logging of at least a part of the first transaction between the first data processing unit (2, 7, 8, 9, 10) and the first data center (3) exchanged information, wherein a first protocol information is generated. Method according to claim 14, characterized in that in a reporting step (14.15) following the logging step (14.14) at least a part of the first log information is transmitted to the second source (12). Method according to one of the preceding claims, characterized in that at least the information exchanged between the first data processing unit (2, 7, 8, 9, 10) and the first data center (3) is protected by cryptographic means, in particular encrypted and / or authenticated , Method according to one of the preceding claims, characterized in that a number of data processing units (2, 7) are provided, which are assigned to a first group (5.1) of data processing units, in the performing step (14.8), a first transaction is performed between a data processing unit (2, 7) of the first group (5.1) and the first data center (3), wherein in the second predetermined step (14.5), from the second source (12), a group transaction control information associated with the first group (5.1) is provided, which comprises the second transaction control information. Arrangement for carrying out at least one first transaction between a first data processing unit (2, 7, 8, 9, 10), in particular a franking machine, and a remote first data center (3), which is used to carry out the first transaction via a communication link with the first data processing unit (3). 2, 7, 8, 9, 10) is connectable, wherein the first data center (3) has a first memory (3.3) in which a first transaction control information predetermined by a first source (11) and associated with the first data processing unit (2, 7, 8, 9, 10) is stored, and the first data center (3) is designed to perform the first transaction in dependence on the first transaction control information, characterized in that the first data center (3) has a second memory (3.4) in which a second transaction control information predetermined by a second source (12) and associated with the first data processing unit (2, 7, 8, 9, 10) is stored, and the first data center (3) is adapted to perform the first transaction in response to the second transaction control information. Arrangement according to claim 18, characterized in that the first transaction control information and the second transaction control information relate to the same transaction feature. Arrangement according to claim 18 or 19, characterized in that a first source (11) which can be connected to the first data center (3) via a communication connection and which is designed to transmit the first transaction control information to the first data center (3), and or a second source (12) which can be connected to the first data center (3) via a communication connection and which is designed to transmit the second transaction control information to the first data center, Arrangement according to one of claims 18 to 20, characterized in that the first source is a remote second data center (11) and or the second source is a remote third data center (12). Arrangement according to one of claims 18 to 21, characterized in that the first data processing unit (2, 7, 8, 9, 10) is designed to transmit a request information associated with the first transaction to the first data center (3), and the first data center (3) is designed to perform the first transaction in response to the request information. Arrangement according to claim 22, characterized in that the first data center (3) is designed to check the compatibility of the request information with the first transaction control information and / or the second transaction control information. Arrangement according to claim 23, characterized in that the first data center (3) is designed to carry out the first transaction in the case of determining the compatibility of the request information with the first transaction control information and / or the second transaction control information. Arrangement according to claim 23 or 24, characterized in that the first data center (3) has a third memory (3.6) in which a specifiable first modification criterion is stored, and the first data center (3) is arranged to modify the request information in response to the first modification criterion in case the incompatibility of the request information with the first transaction control information is such that the request information is compatible with the first transaction control information, and or the first data center (3) has a fourth memory (3.7) in which a prescribable second modification criterion is stored, and the first data center (3) is designed in such a way that it modifies the request information in response to the second modification criterion in case the incompatibility of the request information with the second transaction control information is such that the request information is compatible with the second transaction control information. Arrangement according to one of claims 18 to 25, characterized in that the first data center (3) is designed to check the compatibility of the second transaction control information with the first transaction control information. Arrangement according to claim 26, characterized in that the first data center (3) is designed to carry out the first transaction in case of determining the compatibility of the second transaction control information with the first transaction control information. Arrangement according to claim 26 or 27, characterized in that the first data center (3) has a fifth memory (3.10) in which a predefinable third modification criterion is stored, and the first data center (3) is arranged to modify the second transaction control information in response to the third modification criterion so that the second transaction control information is consistent with the first transaction control information in case of determining incompatibility of the second transaction control information with the first transaction control information. Arrangement according to one of claims 18 to 28, characterized in that the first data center (3) for executing a first service for the first data processing unit (2, 7, 8, 9, 10) is formed in the context of the first transaction. Arrangement according to one of claims 18 to 29, characterized in that the first data processing unit (2, 7, 8, 9, 10) is designed to make a change of state in the context of the first transaction. Arrangement according to one of claims 18 to 30, characterized in that the first data processing unit is a postage meter (2, 7, 8, 9, 10) having a credit store (2.2, 7.2, 8.2, 9.2, 10.2) and for loading Credit in the credit store (2.2, 7.2, 8.2, 9.2, 10.2) is formed in the context of the first transaction. Arrangement according to one of Claims 18 to 31, characterized in that the first data center (3) is designed to log at least part of the information exchanged between the first data processing unit and the first data center in the context of the first transaction, the first data center (3) especially has a log memory (3.8), is designed to generate a first protocol information which is associated with at least a part of the information exchanged between the first data processing unit (2, 7, 8, 9, 10) and the first data center (3) in the context of the first transaction, and for storing the protocol information in the log memory (3.8). Arrangement according to Claim 32, characterized in that the first data center (3) is designed to transmit at least part of the first protocol information to the second source (12). Arrangement according to one of claims 18 to 33, characterized in that at least the first data processing unit (2, 7, 8, 9, 10) and the first data center (3) are designed to secure the information exchanged between them by cryptographic means, in particular for Secured the information exchanged between them by encryption and / or authentication. Arrangement according to one of claims 18 to 34, characterized in that a first group (5.1) of first data processing units (2, 7) is provided, and in the second memory (3.4) a first group transaction control information predetermined by the second source (12) is stored associated with the first group (5.1) and comprising the second transaction control information. Arrangement according to claim 35, characterized in that a second group (5.2) of data processing units (2, 7, 8) is provided for carrying out transactions with the first data center (3), the second group (5.2) comprises at least part of the first data processing units (2, 7) and in the second memory (3.4), a second group transaction control information predetermined by the second source (12) is stored associated with the second group (5.2) and comprising the second transaction control information. Data center for an arrangement according to one of claims 18 to 36, characterized in that it is designed in the manner of the first data center (3).

Images