EP2077528B1 - Delivery station and method for franking post in delivery station - Google Patents

Description

The invention relates to a delivery station for franking mailpieces, which has at least one scale for determining the weight of a mailpiece and at least one dimension measuring device for determining the dimensions of a mailpiece. Furthermore, an arithmetic unit for determining the postage charge for a mail item and a franking unit for applying a postage indicium to the mail item are provided. The arithmetic unit has access to measurement tolerances of the scale and the dimension measuring device.

The invention further relates to a method for franking mailpieces in such a delivery station.

In addition to the application of postage stamps such as stamps, it is known in the field of postage stamping to use franking machines which can be used by a user to provide larger quantities of mailpieces with a franking mark. However, the purchase of a franking machine is often avoided, in particular by customers with little or irregular incidence of mailpieces to be franked.

Customers can also submit a larger quantity of unfranked mail in a branch of a transport and delivery service. The delivery company carries out a franking of the shipments, whereby franking machines can also be used. However, the customers are for the delivery of Shipments bound to specified opening hours of branches of the delivery company.

In the postal sector, there is therefore a need for a mailing station, into which customers can deliver large quantities of unfranked mail, the device automatically franking the mailpieces. The device could be placed in public areas to provide customers with 24-hour service. In this case, such a device requires a method for the automatic determination of a postage amount or postage due required for a shipment.

Such a consignment station for letter mail is for example from the German patent application DE 10 2005 006 005 A1 known. The document discloses a mailing station, in which a mail item is transferred from an acceptance means into a housing which is inaccessible to a customer. Within the housing measured values for weight, length, width and height of the mail item are determined by measuring devices. The negative tolerances of the individual measuring devices are added to the measured values thus determined, and the amounts of the positive tolerances are subtracted in order to obtain adapted measured values. These adjusted measured values are compared with value ranges of a reference list, whereby the reference list assigns different postage amounts to value ranges of the adjusted measured values and a result list with the postage amounts assigned to the determined adjusted measured values is generated. The smallest postage amount of the result list is determined and determined as the required postage fee for the postal item in question. Then a franking mark is applied to the mailpiece, the franking mark containing the determined postage amount. This procedure ensures that a customer never has to pay too high a postage amount. This is an essential prerequisite for the admission of such a consignment post, if it is made public.

For measuring devices such as scales, fuel dispensers and mailing stations for franking mail, it is necessary to have them calibrated in accordance with national calibration laws in order to be able to carry out measurements that require verification. Verification in most cases requires type approval, which means that a typical copy of the measuring instrument concerned must be approved by the competent authority. In the Federal Republic of Germany, for example, the responsible authority is the Physikalisch Technische Bundesanstalt (PTB).

The authority usually checks the registration documents and a sample device according to the regulations of the respective calibration regulations. Essential aspects here are the measuring accuracy and measuring stability. In particular, the applicable requirements and error limits must be adhered to. The admission test includes metrological, technical and administrative examinations. The technical tests, which also include software tests, will examine whether the operating, display and impression functions meet the requirements and that the device is adequately protected against operator error and manipulation. As delivery stations for franking mailpieces are usually computer-controlled, approval and calibration of software components is thus also required.

If the approval test was successful, the applicant will receive from the competent authority a registration certificate and a registration mark which must be displayed on all measuring instruments in a visible place. If the device type has been approved, then each individual device must then be calibrated by the responsible calibration authority before it may be used, for example, in business transactions.

In particular, in the field of testing and calibration of software are also recommendations of WELMEC (Western European Legal Metrology Cooperation) before, which is a European cooperation in legal metrology. As a legal metrology, the entirety of the technical and administrative procedures established by public authorities in order to guarantee the quality of the measurements carried out in the context of commercial transactions and official controls or health care, safety, etc. In doing so, recommendations are given for the execution of software subject to legal custody and the processing of legal metrics and parameters.

If a consignment station is to be calibrated for the delivery and franking of postal consignments, it is possible to have all components of the system and the software in their entirety checked and calibrated. However, this has the disadvantage that changes to the device and / or the software are associated with a re-examination by an approval authority. A change in the operating system underlying the software or other non-calibration-relevant parameters can therefore not be performed by an administrator in this case. However, because a consignment station may include hardware and software components that are not subject to custody, it is possible to separate custody and non-custody components. This allows the non-legal components to be freely modified without the need for re-approval or calibration of the entire assembly. The German utility model DE 296 13 903 U1 For this purpose, for example, discloses an arrangement for quality assurance of complex electronic measuring devices, which have both custody and non-custody components.

Furthermore, from the German patent application DE 195 27 293 A1 a method and a device for the safe measurement and processing of measurement data in the field of emission analysis known. So that a computer connected to a measuring module does not have to be calibrated together with the measuring module, which would lead to a restriction of the initially open PC system, the document proposes that measured values are transmitted to a PC via a suitable interface. The PC does not have to be calibrated, but can also be used freely for other applications.

Known approaches, however, are not suitable for designing a verifiable delivery station for franking postal items in such a way that components subject to custody can be checked and calibrated by an approval authority, while components that are not subject to custody can be changed freely by the operator of the delivery station. There are so far no post office consignments known that meet the criteria of the competent licensing authorities. The object of the invention is therefore to provide a mailing station which meets these requirements.

According to the invention, this object is achieved by a device having the features of independent claim 1. Advantageous developments of the device will become apparent from the dependent claims 2-12. The object is further achieved by a method according to claim 13. Advantageous embodiments of the method will become apparent from the dependent claims 14-22.

The delivery station according to the invention for franking mailpieces has at least one scale for determining the weight of a mailpiece and at least one dimension measuring device for determining the dimensions of a mailpiece. Furthermore, an arithmetic unit for determining the postage fee for a mail item is provided, wherein the arithmetic unit has access to measurement tolerances of the scale and the dimension measuring instrument. A franking unit serves to apply a postage indicium to the mailpiece. The scale and the dimension measuring device are each physically sealed and are connected via physically sealed data cables in conjunction with a serial interface of the processing unit. These measuring devices or a respectively associated interface sign the generated measured values. The measuring tolerances of the scale and the dimension measuring device and format categories for mailpieces are stored in a signed one-way memory, on the data of which a signed measuring module of the arithmetic unit has read-only access. This measurement module furthermore has means for receiving measured values from the balance and the dimension measuring device via the serial interface.

A component of the measuring module in the form of a correction module comprises means for adding and subtracting the respective measuring tolerances of the scale and the dimension measuring device to the received measured values so as to produce corrected measured values. The measurement module also has a format module comprising means for determining the format category of a mailpiece from the corrected dimension measurements and the format categories in the disposable memory. In addition, the measuring module comprises means for determining the product category of a mail item from the corrected weight measurement value of the mail item and the format category of the mail item determined by the format module. The measuring module has access to a file which contains an association between product categories of mailpieces and postage charges, so that a postage fee determined therefrom for a mail item can be supplied by the metering module to the franking unit. This file preferably has no signature. The measuring module furthermore has means for signing data records, comprising at least measurement values of the scale and the dimension measuring device, the associated corrected measured values and the determined product category of a mailpiece, and a memory module for storing a signed data record in the signed disposable memory.

In one embodiment of the invention, the delivery station has a display in connection with the measurement module, on which at least measurement values and / or corrected measurement values of the balance and the dimension measurement device are displayed, wherein a mask displayed on the display is generated and signed by the measurement module.

Preferably, the measurement module and its components are signed with a signature based on asymmetric encryption. This signature can be generated with a private key that was generated by and / or stored in a TPM chip (Trusted Platform Module) of the arithmetic unit, wherein the TPM chip is permanently installed in the arithmetic unit. Access to the private key in the TPM chip can be password protected.

In one embodiment of the invention, the scale, the dimension measuring device and / or an associated interface form a hash value over a measured value. Furthermore, the measuring module forms a hash value over a data set, comprising at least the measured values of the balance and the dimension measuring device, the associated corrected measured values and the determined product category of a mailpiece.

The measuring module and its components are preferably software components in the form of Java archive files. In this case, the measuring module and its software components can be stored on a write-protected storage medium whose mechanical write-protect switch has been physically sealed, the connection of the storage medium to the arithmetic unit also being physically sealed. The measuring module can be stored, for example, on a USB memory stick or a hard disk with a mechanical write-protect switch.

The invention further comprises a method for franking mailpieces in such a delivery station. Preferably, the measuring module and its components are signed prior to carrying out the method steps, wherein the signing is effected by asymmetric encryption. The storage of the measuring module and its software components on a write-protected storage medium is preferably carried out prior to performing the method.

The invention has the advantage that a verifiable consignment station for franking mailpieces is provided, which meets the requirements for approval. This ensures that software and hardware components that are subject to custody are protected against manipulation and that any potential manipulation can be clearly established. The invention brings with it in particular the advantage that components that are not subject to custody are separated from the components subject to calibration such that they are not influenced by them. Among other things, this means that the non-legal components the consignment station according to the invention can be changed by the operator of the machine without a renewed approval or calibration is required.

Further advantages, features and expedient developments of the invention will become apparent from the dependent claims and the following description of preferred embodiments with reference to the drawings.

Fig. 1

ein Ausführungsbeispiel der erfindungsgemäßen Einlieferungsstation;

Fig. 2

eine schematische Darstellung eichpflichtiger und nicht-eichpflichtiger Komponenten zum Betrieb der erfindungsgemäßen Einlieferungsstation;

Fig. 3

eine schematische Darstellung der Verfahrensschritte bei der Portoermittlung für eine Postsendung mit dem erfindungsgemäßen Verfahren; und

Fig. 4

eine schematische Darstellung der Komponenten einer Recheneinheit der erfindungsgemäßen Einlieferungsstation.

From the pictures shows:

Fig. 1

an embodiment of the delivery station according to the invention;

Fig. 2

a schematic representation of custody and non-custody components for operating the consignment station according to the invention;

Fig. 3

a schematic representation of the method steps in the postage determination for a mail with the inventive method; and

Fig. 4

a schematic representation of the components of a computing unit of the delivery station according to the invention.

In Fig. 1 is a possible embodiment of the delivery station according to the invention shown. The delivery station 10 is a self-service machine to which customers can deliver mailings such as mail or goods shipments. Preferably, these are registered customers who can identify themselves, for example via a customer card, so that the services provided by the consignment station can be billed to the customer in a simple manner. Among the services of the machine is in particular the franking of mail with the required postage. The machine automatically determines the format of a shipment, calculates the correct charge and prints it as Franking mark on the consignment. The machine can also be made available to non-registered customers, if appropriate billing procedures are integrated. In addition to mail and consignments, for example, postal delivery orders, registered mail, COD shipments or an address check can be carried out by the delivery station 10.

Several delivery stations are preferably connected to a backend system, which handles at least the operation of the machines and the billing of services at the customer. The operation of the machines includes, for example, the maintenance, the setting of collection containers for receiving mail items and the demand-based collection of delivered items. The backend systems may also take over customer identification and legitimization, determination of delivery limits, and tracking of delivered shipments. The overall application may be a client-server application, but a delivery station is preferably configured as a rich client on which the application logic resides.

In order to be able to be used outdoors, a consignment station 10 is expediently designed burglar-proof and weather-resistant. A post office usually includes a housing inaccessible to a customer. As soon as the customer has introduced the mailpieces into the device and the measuring and franking process has been started, there is no possibility for him to access the mailpieces. However, the device is accessible to service personnel who have access to the various technical components. For this purpose, one or more closable flaps may be provided which release the access to the technique of the device. The device is also accessible to employees of the operator of the device, which remove delivered mail and forward them to the transport and delivery process.

For picking up and subsequent transport, the delivered mail items 20 are preferably collected in one or more containers 12, which are also accessible through a closable flap. It can be provided that the device performs a level control of the respective collection container. If the sump filled to a predetermined level, the operator of the device is notified that an emptying must be done. Furthermore, the acceptance of further transmissions on the device can be denied.

The device according to Fig. 1 has an acceptance means 11 for accepting mailpieces 20. This is preferably a singler, which feeds a stack of mailpieces individually into the device. The singler can be a device known from the prior art, which allows a single feed. The customer places a stack of items, for example, in an acceptance opening 11 and closes a cover flap, behind which thereupon the collection of the shipments takes place. Individual consignments can also be received via the collection in the device. The device may further include, like conventional mailboxes, a slot for inserting individual mailings.

After the singulation of the mailings, a mail item 20 passes through the device 10 by means of one or more means of transport. The means of transport are, for example, conveyor belts and rollers which guide a shipment through various measuring devices and subsequently through a pressure arrangement. The items are preferably transported lying horizontally. A hochkanter transport is also possible. The various measuring devices determine at least the weight and dimensions of the shipment. The determination of the individual measured values can take place simultaneously or successively by different measuring devices.

The weight G of a mail item 20 can be measured by various methods of weight determination. In a particularly preferred embodiment of the invention, the weight is determined by a dynamic balance 30. The scale can be calibrated, with the minimum and maximum Maximum tolerance values are determined. The tolerance values of the balance are stored in a computing means 50 of the device. The length L and height H of a broadcast can also be determined by various known means. The maximum and minimum tolerance values of this measurement can be obtained by the evaluation of measurement series.

The measurement of the width B of a transmission takes place, for example, via an image recognition or permanently installed width measuring sensors. In this case, the width B is defined as the smallest distance between two opposite edges of a shipment to each other. The tolerance values of the measuring device can be determined by measuring series.

The measuring devices for determining the length, width and height of a mail item 20 are referred to below in their entirety as a dimension measuring device 40. Such a dimension measuring device can thus consist of one or more measuring devices. The various measuring devices are connected to a computing unit 50, which is preferably also located within the device 10. The computing unit 50 may be, for example, a PC having a processor, a memory, a plurality of hard disks and removable media. The PC also has a network connection, for example in the form of Fast Ethernet.

If a mail item 20 passes through the various measuring devices, the determined measured values are transferred to the arithmetic unit 50 for evaluation. In this case, the arithmetic unit 50 generates measured values corrected from the measured values by processing the negative and positive tolerances of the individual measuring devices. In a first step, these tolerance values are offset with the measured values H for the height, L for the length, G for the weight and B for the width of the mail item. In each case, the amount of the negative tolerance is added to the measured value measured in order to obtain adapted measured values H ', L', G 'and B'. Furthermore, the amount of the positive tolerance is subtracted from the measured value measured to obtain adjusted measured values H ", L", G "and B".

For example, if the length measuring device has a tolerance of + 2 mm and -3 mm, the negative tolerance of 3 mm is added to a measured length L = 236 mm, resulting in an adapted measured value of L '= 239 mm. Furthermore, the positive tolerance of 2 mm is subtracted from the measured length value, so that an adapted measured value of L "= 234 mm results The adjusted measured values of the other variables are calculated analogously in the computing means 50.

On the basis of the determined adjusted measured values H ', H ", L', L", G ', G ", B' and B", the arithmetic unit 50 compares the adapted measured values with the value ranges of a reference list. If a product or a product class is determined in whose value range all adjusted measured values lie, the assigned postage amount is included in a result list. If this result list contains several postage amounts, the smallest amount is determined and determined as the postage amount to be applied to the mail piece. If the result list contains only one entry, the relevant postage amount is determined as the postage amount to be applied. With the postage amount thus determined, a franking mark is generated in a franking unit 60 and printed on the mailpiece 20. As a franking unit, any known from the prior art franking units are used, for example, imprint a postage indicium in the form of a matrix code on a mailpiece.

If the result list is empty, no product class could be determined from the measurements and the shipment can not be accepted by the device. In this case, the user is displayed via a display means of the device, a corresponding message and ejected the shipment from the device.

In a further embodiment of the invention, the determination of the postage amount is supplemented by information provided by a user about the type of mail item, so that it is a semi-automatic postage determination. The type of shipment may include, for example, information about content, mission or additional services include. This information is not determined physically in one embodiment of the invention, but entered by the user through an operating unit 13 of the delivery station 10. The operating unit may comprise, for example, a keyboard, a screen or a touchscreen and a card reader.

For example, a user indicates whether the mailing destination of the mailpiece is national or international. This can also be done automatically by an evaluation of the shipment address. However, since a manual evaluation is required for illegible addresses, it can be provided that the transmission target is always entered by the user. In this case, it is advantageous that the user does not specify the distinction between national and international deliveries individually for each shipment but rather for a larger quantity of simultaneously delivered shipments.

The delivery station 10 may further comprise a bar code reader for detecting bar codes located on postal items. In addition, the device preferably has one or more cameras to record images of the mailpieces. In this case, images of the address side of mailpieces are preferably recorded. The image of a mailpiece can be used, for example, to display it to a customer on the screen of the operating unit 13. The customer can view the address data and thus order a registered letter.

However, the invention is not limited to the described embodiment of a consignment station, but is suitable for any devices for accepting and franking mailpieces, which must be approved and calibrated.

Fig. 2 shows a schematic representation of custody and non-custody components for operating the consignment station according to the invention. Hardware components such as a scale 30 and the dimension measuring devices 40 are preferably connected via standardized interfaces to the arithmetic unit 50 of the delivery station 10, so that they can be exchanged. Since the process of automatic consignments within a consignment station 10 determines the format of the consignments and their weight by means of measuring equipment and the price of the consignment fee is automatically determined on the basis of the results of these measurements, the whole process is subject to approval and verification by the competent authority. The calibration extends not only to the measured values themselves but also to the data processing that determines the transmission format from the measured values. The verification confirms the correctness of the measurement and the fee determination by a calibration official.

The primary purpose of the measurement of a consignment is to determine the consignment format and weight, as these form the basis for the product determination and thus the fee determination. The program format is determined by means of a software of the arithmetic unit 50 from the entirety of the measurement results and their tolerance parameters. This part of the software is also subject to verification. This means that this software component of the arithmetic unit 50 is provided with a seal by a calibration official and that a manipulation of the software components must be perfectly verifiable.

Furthermore, the customer must be able to understand the charge determination so that the measurement results are displayed to him. The display of the measurement results is also subject to the calibration process, as this should not be manipulated. If an output of individual measurements, for example on a receipt or a screen, is not required by the approval authority, it is possible to store the basic data of the format determination in a measured value memory 55 for possible subsequent inspection. This measured value memory, like the measured values, must be protected against manipulation itself, so that it is preferably a disposable memory that can only be read by reading. Preferably, both the Software component, which forms the interface to the measured value memory 55, as well as the disposable memory itself protected against manipulation.

The measured value memory 55 can be created, for example, in a database of the arithmetic unit 50 and access to the measured value memory is made only via a predetermined interface, which can be done on stored data only a read access. The stored data can be stored as binary database files on a hard disk. A manipulation of the database files can be excluded by security mechanisms of the database itself, if manipulated database files are identified as corrupt by the database and can no longer be activated. A deletion of the database files can be timed within the database schema itself. So there is no deletion function from the outside. The storage duration of data records can be stored for example by the calibration officer in the measured value memory itself and thus controlled at any time.

The overall system of measuring devices 30 and 40, measurement data transmission to the format-determining software of the arithmetic unit 50, the format determination of the arithmetic unit 50, the measured value memory 55 and an indication of the measurement results on a display 80 are usually signed and sealed on site by a calibration official. However, a product and price list 93, which shows the postage to be paid for a determined product category, is not subject to custody. This can therefore be changed by the operator of the consignment station, without a renewed calibration must be performed. If this results in new format categories, however, these are to be stored in the measured value memory 55.

The software of the arithmetic unit 50 must be protected in particular against deliberate changes by means of common software tools. The interfaces between software subject to legal custody and software that is not subject to custody transfer must be free of feedback, ie the interfaces prevent the entry of impermissible data, parameters and commands. Measuring devices may, for example are not unduly influenced if their non-reactive interfaces are exposed to external voltages. Furthermore, the interface outputs the main displays in legal-for-trade format to additional legal-for-trade instruments.

Furthermore, there must be a software identification which includes the program parts and parameters subject to calibration and which can be checked during calibration. The calibration officer checks on site at a consignment station a signature of the calibration-relevant software modules attached by the approval authority and seals the whole by signing with a separate key. The actual calibration takes place with calibration measures, whereby the correctness of the data measured by the measuring devices and the measured data corrected by the tolerance values takes place.

The components of the arithmetic unit 50 and their functions will be described with reference to FIG Fig. 2 explained. Measuring devices such as the scale 30 and the dimension measuring devices 40 are subject to the calibration process. In order to prevent subsequent manipulation of the device or to properly demonstrate manipulations, these calibrated measuring devices are usually sealed with a calibration seal. Also, the transport path of measurement data from the measuring devices to a measured value software of the computing unit 50 must be sealed. Such seals provide an example of a physical seal in the sense of this invention. The scale 30 and the dimension measuring instruments 40 are thus calibrated and then physically sealed.

The programs are transported, for example, in the automatic feeder occasionally through the measuring chain, and the individual measuring devices automatically take their measured value, sign it and send it via an interface 51 to a measuring module 52 of the arithmetic unit 50. The interface 52 is preferably a serial interface, and each meter has a corresponding hardware driver 53 and 54. The measuring devices are also connected to the arithmetic unit 50 via physically sealed data cables 80 and 71. The measured values themselves can be determined by the measuring instruments independently by means of events (Events) are reported to the measuring module 52. An event can either be the reporting of a new measurement result or the reporting of an error that has occurred. For example, the data can be exchanged over the interface in XML format. It should be noted that measurement data can be retrieved but not manipulated.

To preclude subsequent manipulation, the measuring instruments sign their measurement data records. One possible form of the signature is the formation of a hash value or scatter value over the supplied data record. For example, cryptographic hash functions such as MD5, SHA-1 or RIPEMD-160 can be used. The use of a certificate or an encryption of the data can additionally be carried out. The calibration official must usually be given the opportunity to check the integrity of the signature of each individual measured value in the measured value memory. Depending on the signature used, he must be given access to a public key.

As an asymmetric cryptographic method with public and private keys, for example, RSA may be used in various signatures within the scope of the invention. Asymmetrical methods are also referred to as public-key methods. In these methods, the user has two keys, a public key and a secret key. Both keys fulfill certain tasks. The public key is made public. Any other user can use this key to send to the owner a message that has been generated by clear text encryption. The secret key is kept secret by the owner. It is used to decrypt encrypted messages sent to it.

Technically, signing a message or a binary file means that, according to a known method, a message or binary checksum is computed and then encrypted with the private key of an asymmetric key pair. If it is now to be determined whether the present message or binary file is unchanged at the time of signing, this can with the public key of the asymmetric key pair. To do this, the checksum algorithm is used, the encrypted checksum is decrypted with the public key, and the values are compared.

In order to ensure the identity of the holder of a public key in a public-key cryptosystem, a public key with the identity of a third person can be created. Certificates can be used. A certificate is a kind of proof of authenticity for a public key, where a certificate consists of the public key of the holder of the certificate, an identity characteristic of the holder of the certificate, the name of the issuer of the certificate and a digital key of the issuer of the certificate.

The signing of a measured value can take place in the physical measuring device itself, if, for example, a key is stored in the EPROM of the measuring device. The signing can also take place in the interface of the respective measuring device. In this case, the interface is subject to calibration and the software must also be signed.

The structure of the measuring module 52 and its interaction with other components is Fig. 4 refer to. The software components for measuring data acquisition and evaluation are available, for example, as Java archive files (jar files). The jar files can be provided with a signature, whereby the signature is stored in the jar file itself. This signature is generated using a private key and can be verified using a public key.

The required key pair, consisting of private and public key, can be generated and stored for example by a TPM chip of the arithmetic unit 50. The TPM (Trusted Platform Module) is a chip that is permanently installed in the arithmetic unit 50. He is comparable to a smartcard soldered to the motherboard. The chip is passive and can not be directly influenced.

A TPM chip is thus able to safely store or execute secret data, certificates, keys and cryptographic operations in a protected hardware environment. The TPM chip contains a hardware number generator and can encrypt, decrypt and sign data. For example, the TPM chip can generate 2048-bit RSA keys directly on the chip. The nonvolatile TPM memory has multiple keys, and the volatile area accommodates multiple temporary RSA keys, 16 or 24 Platform Configuration Registers that capture hashes of hardware and software configurations, and two types of handles. Since each TPM chip is unique and can not be exchanged, the software signed with it is bound to the respective consignment station.

Any manipulation of a signed Jar file results in a non-valid signature, which can be determined at any time by a check. Without the private key a renewed signature is not possible. The private key lies inside the TPM chip and is never visible to the outside. Only functions for using the private key are available. Access to the private key in the TPM chip can be password protected by the calibration officer.

As soon as all measured values for a consignment 20 are present, as shown in FIG Fig. 3 labeled as step 1), these are forwarded to a correction component 90 within the measurement module 52. The correction module 90 for tolerance correction of the measured values is subject to the calibration process. The valid tolerance values lie within the saved measured value memory 55 and are retrieved from the correction module 90 therefrom. The calibration official previously signed these tolerance values during calibration with his private key. The tolerance values including the signature are stored in the measured value memory 55. The calibration official can use his public key to verify the tolerance values.

1. 1. Addiere für jeden Messwert die messungsspezifische Positiv-Toleranz für den Vergleich mit dem minimalen Grenzwert der Formatkategorie.
2. 2. Subtrahiere von jedem Messwert die messungsspezifische Negativ-Toleranz für den Vergleich mit dem maximalen Grenzwert der Formatkategorie.
3. 3. Errechne den Quotienten aus Messwert Länge plus Positiv-Toleranz der Längenmessung und Messwert Breite minus Negativ-Toleranz der Breitenmessung für den Vergleich mit dem minimalen Seitenverhältnis (Ratio) der Formatkategorie.

The recorded measured values are corrected by the correction module 90 by the retrieved tolerance values from the one-way memory 55, as shown in FIG Fig. 3 labeled with step 2). As described above, the tolerance correction algorithm is preferably as follows:

1. 1. Add the measurement-specific positive tolerance for each measurement to the comparison with the minimum limit of the format category.
2. 2. Subtract from each reading the measurement-specific negative tolerance for comparison with the maximum limit of the format category.
3. 3. Calculate the quotient of the measured value length plus positive tolerance of the length measurement and the measured value width minus the negative tolerance of the width measurement for the comparison with the minimum aspect ratio of the format category.

If the correction module 90 has generated corrected measured values in this manner, only these corrected measured values may be used for the further process steps. Both the original measurement data and the corrected measured values are forwarded to the measured value memory 55 in the data packet for later storage. The complete measurement data set is signed by the measurement module 52 so that stored values can no longer be manipulated at the system level. This can also be done via a hash value over the complete record.

The measuring module 52 further comprises a module 91 for format determination, wherein this format module 91 is also subject to the calibration process. The format module accesses format categories that are also stored in the measured value memory 55. Although the valid format categories are part of the non-legal file 93 with the price and product list (PPL), they are also stored in the saved measured value memory 55. The format categories are for example signed in the backend and delivered to the machine 10. There, the format categories after successful verification of the signature by the front-end software in the measured value memory 55 of the arithmetic unit 50 are imported. The format categories are retrieved from the memory module 55 from the format module 91, and the format determination module compares the corrected measurement values of the program with these stored format category limits. The format module 91 determines from this the format category of the program to be used, as described in step 3) in Fig. 3 is marked.

After determining the shipment format, the corresponding product from the valid price and product list 93 is selected with the additional information provided by the customer (eg ordered quality of service, additional services, etc.) as described in Fig. 3 labeled with step 4). This price and product determination is not subject to the calibration process, since, apart from the format category, no measured values are used, but information or wishes of the customer. However, the determined product and its price are preferably recorded to the measured values of the transmission in the measured value memory 55. For this reason, the product identification with the measured values is forwarded to a calibration-relevant memory module 92 of the measuring module 52.

This memory module 92 is used to store the complete measurement data record. This module 92 is also subject to the calibration process. After completion of the data set by the information from the product and price determination of the complete data set is signed to exclude subsequent changes, and then stored in the measured value memory 55. This process is in Fig. 3 as step 5). The measuring device itself, which has generated a measured value, is preferably identifiable by a unique identification number. For example, a SHA1 checksum per measured value and ID number can be formed for each dimension for a measurement. After the correction of the measured values by the tolerances, a SHA1 hash value is formed via the aggregated data record, which also contains the determined format category and the product ID. This hash value and the SHA1 hash value for all software modules relevant to eich are linked to one another, for example, via an XOR connection. Both the hash value over the record and the hash value formed via the XOR connection can be verified.

The postage fee determined by the measuring module 52 as a result of said steps is sent as a print job to a franking module 60, around the mail item 20 to frank accordingly with a postage indicium. This is as step 6) in Fig. 3 shown. The franked mail item is for example introduced into a collecting container 12. The printed postage amount will be charged to the customer and a receipt will be issued. Since customers usually deliver several postal items, the sum of the franking services is indicated on the receipt, which is preferably printed at the end of the process.

Should the measurement module 52 determine that a shipment 20 is not a valid product or the shipment can not be further processed, the shipment will be ejected and the recorded measurements may be discarded. In this case, the measured values do not have to be stored in the measured value memory 55 since no service is charged to the customer.

In addition to the measurement process, the system preferably offers the customer the option of retrospectively reading the measured values of his shipments. For this purpose, a menu item is offered to the customer, for example, on a control unit 13 on a screen, which allows him within a fixed period of time (eg 90 days) the stored measurements after specifying the date, the billing number on the receipt of the customer or the shipment number to view a single shipment. This display of the measured values on a display 80 is likewise subject to the calibration process, since manipulation of the data between measured value memory and display 80 must be precluded. The mask to be displayed is therefore also created and signed by the measuring module 52.

In order to bind the software of the arithmetic unit 50 to a special machine and secure it as far as possible before copying, a root-CA authenticated by the machine can be created, which also uses the storage root key of the Trusted Platform Module (TPM chip). The TPM chip contains a unique identifier such as an endorsement key in the form of a 2048-bit RSA key pair that the manufacturer writes to the chip. The TPM chip can thus serve to identify the processing unit and the software thereon. The arithmetic unit 50 with the associated software is thus protected from it, to another To be transferred to the consignment station. The software is thus tied to a specific consignment station and hardware.

To permanently protect the software from tampering and physically bind the software to the machine, it may also be loaded onto a USB memory stick attached to the PC, which is physically set to a read-only mode read-only switch upon completion of signing by the metering officer and is sealed by the calibration official with seals. As an alternative to a USB stick, a hard disk with a mechanical write-protection switch can also be used for this purpose.

A calibration officer will primarily use the console of the computer on which the calibration-relevant software modules are installed for his main task. Using the console, he is able to verify the signature of all calibration-relevant software modules or to sign them themselves. For the verification of the tolerance values, the calibration official is expediently provided with a screen mask. On the one hand, the verification of the determined measured values can be carried out using the identical masks of the measured value display as for the customer. However, as the calibration officer also needs access to the original measured values of the measuring instruments, an equivalent mask, for example, such as the measured value display of the customer, but with the original measured values, will be made available. The calibration officer is then able to verify the signature of the individual measured values and the signature of the entire measured value data set in both masks. The verification can be carried out automatically in the calibration-relevant and thus signed measured value software.

The development of the business logic of the delivery station 10 takes place, for example, in the programming language Java, which offers the advantage that the software can be used platform-independently. As a runtime environment, for example, an OSGi server can be used. OSGi is an abbreviation for the Open Services Gateway Initiative. The Open Services Gateway Initiative is a Java-based management standard have been set by hardware-independent service components. Services can be implemented in the Java programming language, but can also consist of native code.

LIST OF REFERENCE NUMBERS

10

Consignment station, self-service machine

11

Acceptance opening, move-in, separator

12

Clippings

13

operating unit

20

Mailing, letter, goods

30

Libra

40

dimension measuring apparatus

50

Computing unit, measuring software

51

Interface, serial

52

measurement module

53.54

driver

55

Data memory, disposable memory

60

franking unit

70.71

data cable

80

Measurement display

90

correction module

91

format module

92

memory module

93

File, product price list

Claims (22)

1. A drop-off station (10) for franking mailpieces (20) comprising at least one set of scales (30) to determine the weight of a mailpiece (20), at least one dimension measuring device (40) to determine the dimensions of a mailpiece (20), a computing unit (50) to determine the postage fees for a mailpiece (20), and a franking unit (60) to apply a postage indicium onto the mailpiece (20), whereby the computing unit (50) has access to measuring tolerances of the scales (30) and of the dimension measuring device (40),
   characterized in that
   the scales (30) and the dimension measuring device (40) are each physically sealed and are connected to a serial interface (51) of the computing unit (50) via a data cable (70, 71) that is likewise physically sealed, and the scales (30) as well as the dimension measuring device (40) or an interface associated with them comprise means to sign the measured values, and in that the measuring tolerances of the scales (30) and of the dimension measuring device (40) as well as format categories for mailpieces (20) are stored in signed form in a disposable memory device (55) to whose data a signed measuring module (52) of the computing unit (50) has read-only access, whereby the signed measuring module (52) comprises means to receive signed measured values from the scales (30) and from the dimension measuring device (40) via the serial interface (51), and in that a correction module (90) of the signed measuring module (52) comprises means to add and subtract the appertaining measuring tolerances of the scales (30) and of the dimension measuring device (40) to or from the received measured values in order to generate measured values corrected in this manner, and in that the signed measuring module (52) also comprises a format module (91) that comprises means to determine the format category of a mailpiece (20) on the basis of the corrected dimension measured values and on the basis of the format categories in the disposable memory device (55), and in that the signed measuring module (52) comprises means to determine the product category of a mailpiece (20) on the basis of the corrected weight measured value of the mailpiece (20) and on the basis of the format category of the mailpiece (20) determined by the format module (91), and in that the signed measuring module (52) also has access to a file (93) containing an association between the product categories of mailpieces and the postage fees, so that a postage fee determined on this basis for a mailpiece (20) can be sent by the signed measuring module (52) to the franking unit (60), and in that the signed measuring module (52) also comprises means to sign data records consisting at least of measured values from the scales (30) and from the dimension measuring device (40), consisting of the associated corrected measured values, and consisting of the determined product category of a mailpiece (20), and it also comprises a memory module (92) to store a signed data record in the disposable memory device (55).
2. The drop-off station according to claim 1,
   characterized in that
   the drop-off station (10) comprises a display (80) connected to the measuring module (52) on which at least measured values and/or corrected measured values from the scales (30) and from the dimension measuring device (40) can be displayed, whereby a mask displayed on the display (80) can be signed by the measuring module (52).
3. The drop-off station according to one of claims 1 and 2,
   characterized in that
   the file (93) that contains an association between the product categories of mailpieces and the postage fees does not have a signature.
4. The drop-off station according to one of claims 1 to 3,
   characterized in that
   the measuring module (52) and its components have a signature that is based on an asymmetrical encryption.
5. The drop-off station according to claim 4,
   characterized in that
   the signature was generated with a private key that can be generated by a TPM (Trusted Platform Module) chip of the computing unit (50) and/or that had been stored therein, whereby the TPM chip is permanently installed in the computing unit (50).
6. The drop-off station according to claim 5,
   characterized in that
   access to the private key in the TPM chip is protected by a password.
7. The drop-off station according to one of claims 1 to 6,
   characterized in that
   the scales (30), the dimension measuring device (40) and/or an associated interface have means to form a hash value relating to a measured value.
8. The drop-off station according to one of claims 1 to 7,
   characterized in that
   the measuring module (52) has means to form a hash value relating to a data record consisting at least of the measured values from the scales (30) and from the dimension measuring device (40), consisting of the associated corrected measured values, and consisting of the determined product category of a mailpiece (20).
9. The drop-off station according to one of claims 1 to 8,
   characterized in that
   the measuring module (52) and its components are software components in the form of Java archive files.
10. The drop-off station according to claim 9,
    characterized in that
    the measuring module (52) and its software components are stored on a write-protected storage medium whose mechanical write-protection switch is physically sealed, whereby the connection of the storage medium to the computing unit (50) is likewise physically sealed.
11. The drop-off station according to claim 10,
    characterized in that
    the measuring module (52) is stored on a USB memory stick that has a mechanical write-protection switch.
12. The drop-off station according to claim 10,
    characterized in that
    the measuring module (52) is stored on a hard drive that has a mechanical write-protection switch.
13. A method for franking mailpieces in a drop-off station (10) in which the weight of a mailpiece is determined by at least one set of scales (30), and the dimensions of a mailpiece (20) are determined by at least one dimension measuring device (40), and this information is then sent to a computing unit (50), and in which the computing unit (50) determines the postage fee for a mailpiece (20) and sends it to a franking unit (60) that applies a postage indicium onto the mailpiece (20), whereby, in order to generate corrected measured values, the computing unit (50) accesses measuring tolerances of the scales (30) and of the dimension measuring device (40), whereby the scales (30) and the dimension measuring device (40) are each physically sealed and are connected to a serial interface (51) of the computing unit (50) via a data cable (70, 71) that is likewise physically sealed,
    characterized by at least the following steps:

    • the measured values for the weight and for the dimensions of the mailpiece (20) are signed by the scales (30) and by the dimension measuring device (40) or by an interface associated with them;

    • the signed measured values are transmitted to the computing unit (50) via a serial interface (51);

    • signed tolerance values of the scales (30) and of the dimension measuring device (40) are retrieved from a disposable memory device (55) by a signed measuring module (52) of the computing unit (50) to whose data the signed measuring module of the computing unit has read-only access;

    • corrected measured values for the weight and for the dimensions of the mailpiece (20) are determined by means of a correction module (90) of the signed measuring module (52), whereby the tolerance values of the scales (30) and of the dimension measuring device (40) are used;

    • signed format categories for mailpieces are retrieved from the memory device (55) by the signed measuring module (52);

    • a format category for the mailpiece (20) is determined by a format module (91) of the signed measuring module (52) on the basis of the corrected measured values for the dimensions of the mailpiece (20), whereby the retrieved format categories from the disposable memory device (55) are used;

    • the signed measuring module (52) determines a product category on the basis of the format category of the mailpiece (20) and on the basis of the corrected measured value for the weight of the mailpiece (20);

    • the signed measuring module (52) determines a postage fee on the basis of a file (93) containing an association between the product categories of mailpieces and the postage fees, on the basis of the determined product category;

    • the signed measuring module (52) sends the determined postage fee to the franking unit (60) and a postage indicium is applied onto the mailpiece (20) by the franking unit (60); and

    • a data record consisting at least of measured values from the scales (30) and from the dimension measuring device (40), consisting of the associated corrected measured values, and consisting of the determined product category of a mailpiece (20) is signed and this signed data record is stored in the disposable memory device (55) by a memory module (92) of the signed measuring module (52).
14. The method according to claim 13,
    characterized in that
    at least measured values and/or corrected measured values from the scales (30) and from the dimension measuring device (40) are displayed on a display (80) connected to the computing unit (50), whereby a mask displayed on the display (80) is signed by the measuring module (52).
15. The method according to one of claims 13 and 14,
    characterized in that
    the measuring module (52) and its components are signed before the method steps of claim 13 are carried out, whereby the signing is carried out by means of an asymmetrical encryption.
16. The method according to claim 15,
    characterized in that
    the signature is carried out with a private key that was generated by a TPM (Trusted Platform Module) chip of the computing unit (50) and/or that had been stored therein, whereby the TPM chip is permanently installed in the computing unit (50).
17. The method according to one of claims 13 to 16,
    characterized in that
    the scales (30), the dimension measuring device (40) and/or an associated interface form a hash value relating to the measured value at the time when a measured value is signed.
18. The method according to one of claims 13 to 17,
    characterized in that
    the measuring module (52) forms a hash value relating to a data record consisting of at least the measured values from the scales (30) and from the dimension measuring device (40), consisting of the associated corrected measured values, and consisting of the determined product category of a mailpiece (20), and this hash value, together with the data record, is stored in the disposable memory device (55) by the memory module (92).
19. The method according to one of claims 13 to 18,
    characterized in that
    the measuring module (52) and its components are made up of software components in the form of Java archive files.
20. The method according to claim 19,
    characterized in that,
    before the method steps according to claim 13 are carried out, the measuring module (52) and its software components are stored on a write-protected storage medium whose mechanical write-protection switch is physically sealed after the storing procedure, whereby the connection of the storage medium to the computing unit (50) is likewise physically sealed.
21. The method according to claim 20,
    characterized in that
    the measuring module (52) is stored on a USB memory stick that has a mechanical write-protection switch.
22. The method according to claim 20,
    characterized in that
    the measuring module (52) is stored on a hard drive that has a mechanical write-protection switch.

Images