WO2009083103A1

WO2009083103A1 - Delivery station and method for franking postal items in a delivery station

Info

Publication number: WO2009083103A1
Application number: PCT/EP2008/010378
Authority: WO
Inventors: Hans Schneider; Rolf Peters; Mike Bobinski; Guido Leidig
Original assignee: Deutsche Post Ag
Priority date: 2008-01-02
Filing date: 2008-12-08
Publication date: 2009-07-09
Also published as: ES2571857T3; EP2077528B1; EP2077528A1; PL2077528T3; EP2077528B8; ES2571857T8

Abstract

The invention relates to a device which is appropriate for verification and a method for franking postal items in a delivery station (10), measured values being signed. Tolerance values of the measuring devices are called by a likewise signed write-once memory (55) to the data of which a measuring module (52) has a read-only access only, and are used for producing corrected measured values. A data file (93) containing a correlation of product categories of postal items and postages is used to determine a postage, using the measuring module (52) and a product category previously determined, said postage being applied by a franking unit (60) to the postal item (20) in the form of a franking mark. A data set, consisting at least of measured values, corrected values and the product category, is signed by the measuring module (52) and is saved by a storage module (92) in the signed read-once memory (55).

Description

Dispatch station and method for franking mail in a consignment station

Description:

The invention relates to a delivery station for franking mailpieces, which has at least one scale for determining the weight of a mailpiece and at least one dimension measuring device for determining the dimensions of a mailpiece. Furthermore, an arithmetic unit for determining the postage charge for a mail item and a franking unit for applying a postage indicium to the mail item are provided. The arithmetic unit has access to measurement tolerances of the scale and the dimension measuring device.

The invention further relates to a method for franking mailpieces in such a delivery station.

In addition to the application of postage stamps such as stamps, it is known in the field of postage stamping to use franking machines which can be used by a user to provide larger quantities of mailpieces with a franking mark. However, the purchase of a franking machine is often avoided, in particular by customers with little or irregular incidence of mailpieces to be franked.

Customers can also submit a larger quantity of unfranked mail in a branch of a transport and delivery service. The delivery company carries out a franking of the shipments, whereby franking machines can also be used. However, the customers are for the delivery of Shipments bound to specified opening hours of branches of the delivery company.

In the postal sector, there is therefore a need for a mailing station, into which customers can deliver large quantities of unfranked mail, the device automatically franking the mailpieces. The device could be placed in public areas to provide customers with 24-hour service. In this case, such a device requires a method for the automatic determination of a postage amount or postage due required for a shipment.

Such a mailing station is known for example from the German patent application DE 10 2005 006 005 A1. The document discloses a mailing station, in which a mail item is transferred from an acceptance means into a housing which is inaccessible to a customer. Within the housing measured values for weight, length, width and height of the mail item are determined by measuring devices. The negative tolerances of the individual measuring devices are added to the measured values thus determined, and the amounts of the positive tolerances are subtracted in order to obtain adapted measured values. These adjusted metrics come with value ranges of

Reference List, the reference list assigns different postage amounts to value ranges of the adjusted measured values, and a result list with the postage amounts assigned to the determined adjusted measured values is generated. The smallest postage amount of the result list is determined and determined as the required postage fee for the postal item in question. Then a franking mark is applied to the mailpiece, the franking mark containing the determined postage amount. This procedure ensures that a customer never has to pay too high a postage amount. This is an essential prerequisite for the admission of such a consignment post, if it is made public. For measuring devices such as scales, fuel dispensers and mailing stations for franking mail, it is necessary to have them calibrated in accordance with national calibration laws in order to be able to carry out measurements that require verification. Verification in most cases requires type approval, which means that a typical copy of the measuring instrument concerned must be approved by the competent authority. In the Federal Republic of Germany, for example, the responsible authority is the Physikalisch Technische Bundesanstalt (PTB).

The authority usually checks the registration documents and a sample device according to the regulations of the respective calibration regulations. Essential aspects here are the measuring accuracy and measuring stability. In particular, the applicable requirements and error limits must be adhered to. The admission test includes metrological, technical and administrative examinations. The technical tests, which also include software tests, will examine whether the operating, display and impression functions meet the requirements and that the device is adequately protected against operator error and manipulation. As delivery stations for franking mailpieces are usually computer-controlled, approval and calibration of software components is thus also required.

If the approval test was successful, the applicant will receive from the competent authority a registration certificate and a registration mark which must be displayed on all measuring instruments in a visible place. If the device type has been approved, then each individual device must then be calibrated by the responsible calibration authority before it may be used, for example, in business transactions.

In particular, in the field of testing and calibration of software are also recommendations of WELMEC (Western European Legal Metrology Cooperation) before, which is a European cooperation in legal metrology. As a legal metrology, the entirety of the technical and administrative procedures established by public authorities in order to guarantee the quality of the measurements carried out in the context of commercial transactions and official controls or in the areas of health care, safety and so on. In doing so, recommendations are given for the execution of software subject to legal custody and the processing of legal metrics and parameters.

If a consignment station is to be calibrated for the delivery and franking of postal consignments, it is possible to have all components of the system and the software in their entirety checked and calibrated. However, this has the disadvantage that changes to the device and / or the software are associated with a re-examination by an approval authority. A change in the operating system underlying the software or other non-calibration-relevant parameters can therefore not be performed by an administrator in this case. However, because a consignment station may include hardware and software components that are not subject to custody, it is possible to separate custody and non-custody components. This allows the non-legal components to be freely modified without the need for re-approval or calibration of the entire assembly. The German Utility Model DE 296 13 903 U1 discloses, for example, an arrangement for quality assurance of complex electronic measuring devices, which have both custody as well as non-custody components.

Furthermore, German Patent Application DE 195 27 293 A1 discloses a method and a device for reliable measurement and processing of measured data in the field of exhaust gas analysis. So that a computer connected to a measuring module does not have to be calibrated together with the measuring module, which would lead to a restriction of the initially open PC system, the document proposes that measured values are transmitted to a PC via a suitable interface. The PC does not have to be calibrated, but can also be used freely for other applications. Known approaches, however, are not suitable for designing a verifiable delivery station for franking mail so that components subject to calibration can be checked and calibrated by a licensing authority, while non-compulsory components can be changed freely by the operator of the consignment station. There are no

Mailing stations are known which fulfill the criteria of the competent registration authorities. The object of the invention is therefore to provide a mailing station which meets these requirements.

According to the invention, this object is achieved by a device having the features of independent claim 1. Advantageous developments of the device will become apparent from the dependent claims 2-12. The object is further achieved by a method according to claim 13. Advantageous embodiments of the method will become apparent from the dependent claims 14-22.

The delivery station according to the invention for franking mailpieces has at least one scale for determining the weight of a mailpiece and at least one dimension measuring device for determining the dimensions of a mailpiece. Furthermore, an arithmetic unit for determining the postage fee for a mail item is provided, wherein the arithmetic unit has access to measurement tolerances of the scale and the dimension measuring instrument. A franking unit serves to apply a postage indicium to the mailpiece. The scale and the dimension measuring device are each physically sealed and are connected via physically sealed data cables in conjunction with a serial interface of the processing unit. These measuring devices or a respectively associated interface sign the generated measured values. The measuring tolerances of the scale and the dimension measuring device and format categories for mailpieces are stored in a signed one-way memory, on the data of which a signed measuring module of the arithmetic unit has read-only access. This

Measurement module further comprises means for receiving measurements from the scale and the dimension measuring device via the serial interface. A component of the measuring module in the form of a correction module comprises means for adding and subtracting the respective measuring tolerances of the scale and the dimension measuring device to the received measured values so as to produce corrected measured values. The measurement module also has a format module comprising means for determining the format category of a mailpiece from the corrected dimension measurements and the format categories in the disposable memory. In addition, the measuring module comprises means for determining the product category of a mail item from the corrected weight measurement value of the mail item and the format category of the mail item determined by the format module. The measuring module has access to a file which contains an association between product categories of mailpieces and postage charges, so that a postage fee determined therefrom for a mail item can be supplied by the metering module to the franking unit. This file preferably has no signature. The measuring module furthermore has means for signing data records, comprising at least measurement values of the scale and the dimension measuring device, the associated corrected measured values and the determined product category of a mailpiece, and a memory module for storing a signed data record in the signed disposable memory.

In one embodiment of the invention, the delivery station has a display in connection with the measurement module, on which at least measurement values and / or corrected measurement values of the balance and the dimension measurement device are displayed, wherein a mask displayed on the display is generated and signed by the measurement module.

Preferably, the measurement module and its components are signed with a signature based on asymmetric encryption. This signature can be generated with a private key that was generated by and / or stored in a TPM chip (Trusted Platform Module) of the arithmetic unit, wherein the TPM chip is permanently installed in the arithmetic unit. Access to the private key in the TPM chip can be password protected. In one embodiment of the invention, the scale, the dimension measuring device and / or an associated interface form a hash value over a measured value. Furthermore, the measuring module forms a hash value over a data set, comprising at least the measured values of the balance and the dimension measuring device, the associated corrected measured values and the determined product category of a mailpiece.

The measuring module and its components are preferably software components in the form of Java archive files. In this case, the measuring module and its software components can be stored on a write-protected storage medium whose mechanical write-protect switch has been physically sealed, wherein the connection of the storage medium to the arithmetic unit has also been physically sealed. The measuring module can be stored, for example, on a USB memory stick or a hard disk with a mechanical write-protect switch.

The invention further comprises a method for franking mailpieces in such a delivery station. Preferably, the measuring module and its components are signed prior to carrying out the method steps, wherein the signing is effected by asymmetric encryption. The storage of the measuring module and its software components on a write-protected storage medium is preferably carried out prior to performing the method.

The invention has the advantage that a verifiable consignment station for

Franking of mail items is provided, which meets the requirements for admission. This ensures that software and hardware components that are subject to custody are protected against manipulation and that any potential manipulation can be clearly established. The invention brings with it in particular the advantage that components that are not subject to custody are separated from the components subject to calibration such that they are not influenced by them. Among other things, this means that the non-legal components the consignment station according to the invention can be changed by the operator of the machine without a renewed approval or calibration is required.

Further advantages, features and expedient developments of the invention will become apparent from the dependent claims and the following description of preferred embodiments with reference to the drawings.

From the pictures shows:

1 shows an embodiment of the delivery station according to the invention;

Fig. 2 is a schematic representation of custody and non-custody

Components for operating the inventive

Delivery station;

Fig. 3 is a schematic representation of the method steps in the

Postage determination for a mailing with the invention

Method; and

4 shows a schematic representation of the components of a computing unit of the delivery station according to the invention.

In Fig. 1, a possible embodiment of the delivery station according to the invention is shown. The delivery station 10 is a self-service machine to which customers can deliver mailings such as mail or goods shipments. Preferably, these are registered customers who can identify themselves, for example via a customer card, so that the services provided by the consignment station can be billed to the customer in a simple manner. Among the services of the machine is in particular the franking of mail with the required postage. The machine automatically determines the format of a shipment, calculates the correct charge and prints it as Franking mark on the consignment. The machine can also be made available to non-registered customers, if appropriate billing procedures are integrated. In addition to mail and consignments, for example, postal delivery orders, registered mail, COD shipments or an address check can be carried out by the delivery station 10.

Several delivery stations are preferably connected to a backend system, which handles at least the operation of the machines and the billing of services at the customer. The operation of the machines includes, for example, the maintenance, the setting of collection containers for receiving mail items and the demand-based collection of delivered items. The backend systems may also take over customer identification and legitimization, determination of delivery limits, and tracking of delivered shipments. The overall application may be a client-server application, but a delivery station is preferably configured as a rich client hosting the application logic.

In order to be able to be used outdoors, a consignment station 10 is expediently designed burglar-proof and weather-resistant. A post office usually includes a housing inaccessible to a customer. As soon as the customer has introduced the mailpieces into the device and the measuring and franking process has been started, there is no possibility for him to access the mailpieces. However, the device is accessible to service personnel who have access to the various technical components. For this purpose, one or more closable flaps may be provided which release the access to the technique of the device. The device is also accessible to employees of the operator of the device, which remove delivered mail and forward them to the transport and delivery process.

For the collection and the subsequent transport, the delivered mail items 20 are preferably collected in one or more containers 12, which are also accessible through a closable flap. It can be provided that the device performs a level control of the respective collection container. If the sump filled to a predetermined level, the operator of the device is notified that an emptying must be done. Furthermore, the acceptance of further transmissions on the device can be denied.

The device according to FIG. 1 has an acceptance means 11 for accepting mailpieces 20. This is preferably a singler, which feeds a stack of mailpieces individually into the device. The Vereinzeier may be a known from the prior art device which allows a single feeder. The customer places a stack of items, for example, in an acceptance opening 11 and closes a cover flap, behind which thereupon the collection of the shipments takes place. Individual consignments can also be received via the collection in the device. The device may further include, like conventional mailboxes, a slot for inserting individual mailings.

After the singulation of the mailings, a mail item 20 passes through the device 10 by means of one or more means of transport. The means of transport are, for example, conveyor belts and rollers which guide a shipment through various measuring devices and subsequently through a pressure arrangement. The items are preferably transported lying horizontally. A hochkanter transport is also possible. The various measuring devices determine at least the weight and dimensions of the shipment. The determination of the individual measured values can take place simultaneously or successively by different measuring devices.

The weight G of a mail item 20 can be measured by various methods of weight determination. In a particularly preferred

Embodiment of the invention, the weight is determined by a dynamic balance 30. The scale can be calibrated, with the minimum and maximum Maximum tolerance values are determined. The tolerance values of the balance are stored in a computing means 50 of the device. The length L and height H of a broadcast can also be determined by various known means. The maximum and minimum tolerance values of this measurement can be obtained by the evaluation of measurement series.

The measurement of the width B of a transmission takes place, for example, via an image recognition or permanently installed width measuring sensors. In this case, the width B is defined as the smallest distance between two opposite edges of a shipment to each other. The tolerance values of the measuring device can be determined by measuring series.

The measuring devices for determining the length, width and height of a mail item 20 are referred to below in their entirety as a dimension measuring device 40. Such a dimension measuring device can thus consist of one or more measuring devices. The various measuring devices are connected to a computing unit 50, which is preferably also located within the device 10. The computing unit 50 may be, for example, a PC having a processor, a memory, a plurality of hard disks and removable media. The PC also has a network connection, for example in the form of Fast Ethernet.

If a mail item 20 passes through the various measuring devices, the determined measured values are transferred to the arithmetic unit 50 for evaluation. In this case, the arithmetic unit 50 generates measured values corrected from the measured values by processing the negative and positive tolerances of the individual measuring devices. In a first step, these tolerance values are offset with the measured values H for the height, L for the length, G for the weight and B for the width of the mail item. In each case, the amount of the negative tolerance is added to the measured value measured in order to obtain adapted measured values H ', L', G 'and B'. Furthermore, the amount of the positive tolerance is subtracted from the measured value measured to obtain adjusted measured values H ", L", G "and B". For example, if the length measuring device has a tolerance of + 2 mm and -3 mm, the negative tolerance of 3 mm is added to a measured length L = 236 mm, resulting in an adapted measured value of L '= 239 mm. Furthermore, the positive tolerance of 2 mm is subtracted from the measured length value, so that an adapted measured value of L "= 234 mm results The adjusted measured values of the other variables are calculated analogously in the computing means 50.

On the basis of the determined adjusted measured values H ', H ", L', L", G ', G ", B' and B", the arithmetic unit 50 compares the adapted measured values with the value ranges of a reference list. If a product or a product class is determined in whose value range all adjusted measured values lie, the assigned postage amount is included in a result list. If this result list contains several postage amounts, the smallest amount is determined and determined as the postage amount to be applied to the mail piece. If the result list contains only one entry, the relevant postage amount is determined as the postage amount to be applied. With the postage amount thus determined, a franking mark is generated in a franking unit 60 and printed on the mailpiece 20. As a franking unit, any known from the prior art franking units are used, for example, imprint a postage indicium in the form of a matrix code on a mailpiece.

If the result list is empty, no product class could be determined from the measurements and the shipment can not be accepted by the device. In this case, the user is displayed via a display means of the device, a corresponding message and ejected the shipment from the device.

In a further embodiment of the invention, the determination of the postage amount is supplemented by information provided by a user about the type of mail item, so that it is a semi-automatic postage determination. The type of shipment may include, for example, information about content, mission or additional services include. This information is not determined physically in one embodiment of the invention, but entered by the user through an operating unit 13 of the delivery station 10. The operating unit may comprise, for example, a keyboard, a screen or a touchscreen and a card reader.

For example, a user indicates whether the mailing destination of the mailpiece is national or international. This can also be done automatically by an evaluation of the shipment address. However, since a manual evaluation is required for illegible addresses, it can be provided that the

Consignment target is basically entered by the user. In this case, it is advantageous that the user does not specify the distinction between national and international deliveries individually for each shipment but rather for a larger quantity of simultaneously delivered shipments.

The delivery station 10 may further comprise a bar code reader for detecting bar codes located on postal items. In addition, the device preferably has one or more cameras to record images of the mailpieces. In this case, images of the address side of mailpieces are preferably recorded. The image of a mailpiece can be used, for example, to display it to a customer on the screen of the operating unit 13. The customer can view the address data and thus order a registered letter.

However, the invention is not limited to the embodiment described

But suitable for any devices for receiving and franking of mail, which must be approved and calibrated.

Fig. 2 shows a schematic representation of custody and non-custody components for operating the consignment station according to the invention. Hardware components such as a scale 30 and the dimension measuring devices 40 are preferably connected via standardized interfaces to the arithmetic unit 50 of the delivery station 10, so that they can be exchanged. Since the process of automatic consignments within a consignment station 10 determines the format of the consignments and their weight by means of measuring equipment and the price of the consignment fee is automatically determined on the basis of the results of these measurements, the whole process is subject to approval and verification by the competent authority. The calibration extends not only to the measured values themselves but also to the data processing that determines the transmission format from the measured values. The verification confirms the correctness of the measurement and the fee determination by a calibration official.

The primary purpose of the measurement of a consignment is to determine the consignment format and weight, as these form the basis for the product determination and thus the fee determination. The shipment format is determined by means of a

Software of the arithmetic unit 50 from the totality of the measurement results and their tolerance parameters determined. This part of the software is also subject to verification. This means that this software component of the arithmetic unit 50 is provided with a seal by a calibration official and that a manipulation of the software components must be perfectly verifiable.

Furthermore, the customer must be able to understand the charge determination so that the measurement results are displayed to him. The display of the measurement results is also subject to the calibration process, as this should not be manipulated. If an output of individual measurements, for example on a receipt or a

Screen is not required by the approval authority, it is possible to store the basic data of the format determination in a memory 55 for a possible subsequent inspection. This measured value memory, like the measured values, must be protected against manipulation itself, so that it is preferably a disposable memory that can only be read by reading. Preferably, both the Software component, which forms the interface to the measured value memory 55, as well as the disposable memory itself protected against manipulation.

The measured value memory 55 can be created, for example, in a database of the arithmetic unit 50 and access to the measured value memory is made only via a predetermined interface, which can be done on stored data only a read access. The stored data can be stored as binary database files on a hard disk. A manipulation of the database files can be excluded by security mechanisms of the database itself, if manipulated database files are identified as corrupt by the database and can no longer be activated. A deletion of the database files can be timed within the database schema itself. So there is no deletion function from the outside. The storage duration of data records can be stored for example by the calibration officer in the measured value memory itself and thus controlled at any time.

The overall system of measuring devices 30 and 40, measurement data transmission to the format-determining software of the arithmetic unit 50, the format determination of the arithmetic unit 50, the measured value memory 55 and an indication of the measurement results on a display 80 are usually signed and sealed on site by a calibration official. However, a product and price list 93, which shows the postage to be paid for a determined product category, is not subject to custody. This can therefore be changed by the operator of the consignment station, without a renewed calibration must be performed. If this results in new format categories, however, these are to be stored in the measured value memory 55.

The software of the arithmetic unit 50 must be protected in particular against deliberate changes by means of common software tools. The interfaces between software subject to legal custody and software that is not subject to custody transfer must be free of feedback, ie the interfaces prevent the entry of impermissible data, parameters and commands. Measuring devices may, for example are not unduly influenced if their non-reactive interfaces are exposed to external voltages. Furthermore, the interface outputs the main displays in legal-for-trade format to additional legal-for-trade instruments.

Furthermore, there must be a software identification which includes the program parts and parameters subject to calibration and which can be checked during calibration. The calibration officer checks on site at a consignment station a signature of the calibration-relevant software modules attached by the approval authority and seals the whole by signing with a separate key. The actual calibration takes place with calibration measures, whereby the correctness of the data measured by the measuring devices and the measured data corrected by the tolerance values takes place.

The components of the arithmetic unit 50 and their functions will be explained with reference to the illustration in FIG. Measuring instruments such as the scale 30 and the

Dimensional measuring devices 40 are subject to the calibration process. In order to prevent subsequent manipulation of the device or to properly demonstrate manipulations, these calibrated measuring devices are usually sealed with a calibration seal. Also, the transport path of measurement data from the measuring devices to a measured value software of the computing unit 50 must be sealed. Such seals provide an example of a physical seal in the sense of this invention. The scale 30 and the dimension measuring instruments 40 are thus calibrated and then physically sealed.

The programs are transported, for example, in the automatic feeder occasionally through the measuring chain, and the individual measuring devices automatically take their measured value, sign it and send it via an interface 51 to a measuring module 52 of the arithmetic unit 50. The interface 52 is preferably a serial interface, and each meter has a corresponding hardware driver 53 and 54. The measuring devices are also connected to the arithmetic unit 50 via physically sealed data cables 80 and 71. The measured values themselves can be determined by the measuring instruments independently by means of events (Events) are reported to the measuring module 52. An event can either be the reporting of a new measurement result or the reporting of an error that has occurred. For example, the data can be exchanged over the interface in XML format. It should be noted that measurement data can be retrieved but not manipulated.

To preclude subsequent manipulation, the measuring instruments sign their measurement data records. One possible form of the signature is the formation of a hash value or scatter value over the supplied data record. For example, cryptographic hash functions such as MD5, SHA-1 or RIPEMD-160 can be used. The use of a certificate or an encryption of the data can additionally be carried out. The calibration official must usually be given the opportunity to check the integrity of the signature of each individual measured value in the measured value memory. Depending on the signature used, he must be given access to a public key.

As an asymmetric cryptographic method with public and private keys, for example, RSA may be used in various signatures within the scope of the invention. Asymmetrical methods are also referred to as public-key methods. In these methods, the user has two keys, a public key and a secret key. Both keys fulfill certain tasks. The public key is made public. Any other user can use this key to send to the owner a message that has been generated by clear text encryption. The secret key is kept secret by the owner. It is used to decrypt encrypted messages sent to it.

Technically, signing a message or a binary file means that, according to a known method, a message or binary checksum is computed and then encrypted with the private key of an asymmetric key pair. If it is now to be determined whether the present message or binary file is unchanged at the time of signing, this can with the public key of the asymmetric key pair. To do this, the checksum algorithm is used, the encrypted checksum is decrypted with the public key, and the values are compared.

In order to ensure the identity of the holder of a public key in a public-key cryptosystem, a public key with the identity of a third person can be created. Certificates can be used. A certificate is a kind of proof of authenticity for a public key, where a certificate consists of the public key of the holder of the certificate, an identity characteristic of the holder of the certificate, the name of the issuer of the certificate and a digital key of the issuer of the certificate.

The signing of a measured value can take place in the physical measuring device itself, if, for example, a key is stored in the EPROM of the measuring device. The signing can also take place in the interface of the respective measuring device. In this case, the interface is subject to calibration and the software must also be signed.

The structure of the measuring module 52 and its interaction with other components is shown in FIG. 4. The software components for measuring data acquisition and evaluation are available, for example, as Java archive files (jar files). The jar files can be provided with a signature, whereby the signature is stored in the jar file itself. This signature is generated using a private key and can be verified using a public key.

The required key pair, consisting of private and public key, can be generated and stored for example by a TPM chip of the arithmetic unit 50. The TPM (Trusted Platform Module) is a chip that is permanently installed in the arithmetic unit 50. He is comparable to a smartcard soldered to the motherboard. The chip is passive and can not be directly influenced. A TPM chip is thus able to safely store or execute secret data, certificates, keys and cryptographic operations in a protected hardware environment. The TPM chip contains a hardware number generator and can encrypt, decrypt and sign data. For example, the TPM chip can generate 2048-bit RSA keys directly on the chip. The nonvolatile TPM memory has multiple keys, and the volatile area accommodates multiple temporary RSA keys, 16 or 24 Platform Configuration Registers that capture hashes of hardware and software configurations, and two types of phones. Since each TPM chip is unique and can not be replaced, the software signed with it is bound to the respective consignment station.

Any manipulation of a signed Jar file results in a non-valid signature, which can be determined at any time by a check. Without the private key a renewed signature is not possible. The private key lies inside the TPM chip and is never visible to the outside. Only functions for using the private key are available. Access to the private key in the TPM chip can be password protected by the calibration officer.

As soon as all measured values for a program 20 are present, as indicated in FIG. 3 as step 1), these are forwarded to a correction component 90 within the measuring module 52. The correction module 90 for tolerance correction of the measured values is subject to the calibration process. The valid tolerance values lie within the saved measured value memory 55 and are retrieved from the correction module 90 therefrom. The calibration official previously signed these tolerance values during calibration with his private key. The tolerance values including the signature are stored in the measured value memory 55. The calibration official can use his public key to verify the tolerance values.

The recorded measured values are corrected by the correction module 90 by the retrieved tolerance values from the one-way memory 55, as shown in FIG labeled with step 2). As described above, the tolerance correction algorithm is preferably as follows:

1. Add the measurement-specific positive tolerance for each measurement to the comparison with the minimum limit of the format category.

2. Subtract from each reading the measurement-specific negative tolerance for comparison with the maximum limit of the format category.

3. Calculate the quotient of the measured value length plus positive tolerance of the length measurement and the measured value width minus the negative tolerance of the width measurement for the comparison with the minimum aspect ratio of the format category.

If the correction module 90 has generated corrected measured values in this manner, only these corrected measured values may be used for the further process steps. Both the original measurement data and the corrected measured values are forwarded to the measured value memory 55 in the data packet for later storage. The complete measurement data set is signed by the measurement module 52 so that stored values can no longer be manipulated at the system level. This can also be done via a hash value over the complete record.

The measuring module 52 further comprises a module 91 for format determination, wherein this format module 91 is also subject to the calibration process. The format module accesses format categories that are also stored in the measured value memory 55. Although the valid format categories are part of the non-legal file 93 with the price and product list (PPL), they are also stored in the saved measured value memory 55. The format categories are for example signed in the backend and delivered to the machine 10. There, the format categories after successful verification of the signature by the front-end software in the measured value memory 55 of the arithmetic unit 50 are imported. The format categories are retrieved from the memory module 55 from the format module 91, and the format determination module compares the corrected measurement values of the program with these stored format category limits. The format module 91 determines therefrom the format category of the program to be used, as indicated in step 3) in FIG. 3.

After determining the mailing format, the corresponding product from the valid price and product list 93 is selected with the additional information provided by the customer (including ordered quality of service, additional services, etc.), as indicated in step 4 in FIG. 3 , This price and product determination is not subject to the calibration process, since, apart from the format category, no measured values are used, but information or wishes of the customer. The determined product and its price are however preferentially to the measured values of the transmission in the

Measured value memory 55 recorded. For this reason, the product identification with the measured values is forwarded to a calibration-relevant memory module 92 of the measuring module 52.

This memory module 92 is used to store the complete measurement data record. This module 92 is also subject to the calibration process. After completion of the data set by the information from the product and price determination of the complete data set is signed to exclude subsequent changes, and then stored in the measured value memory 55. This process is indicated in FIG. 3 as step 5). The measuring device itself, which has generated a measured value, is preferably identifiable by a unique identification number. For example, a SHA1 checksum per measured value and ID number can be formed for each dimension for a measurement. After the correction of the measured values by the tolerances, a SHA1 hash value is formed via the aggregated data record, which also contains the determined format category and the product ID. This hash value and the SHA1 hash value for all software modules relevant to eich are linked to one another, for example, via an XOR connection. Both the hash value over the data record and the hash value formed via the XOR connection can be verified.

The postage fee determined by the measuring module 52 as a result of said steps is sent as a print job to a franking module 60, around the mail item 20 to frank accordingly with a postage indicium. This is shown as step 6) in FIG. The franked mail item is for example introduced into a collecting container 12. The printed postage amount will be charged to the customer and a receipt will be issued. Since customers usually deliver several postal items, the sum of the franking services is indicated on the receipt, which is preferably printed at the end of the process.

Should the measurement module 52 determine that a shipment 20 is not a valid product or the shipment can not be further processed, the shipment will be ejected and the recorded measurements may be discarded. In this case, the measured values do not have to be stored in the measured value memory 55 since no service is charged to the customer.

In addition to the measurement process, the system preferably offers the customer the option of retrospectively reading the measured values of his shipments. For this purpose, a menu item is offered to the customer, for example, on a control unit 13 on a screen, which allows him within a fixed period of time (eg 90 days) the stored measurements after specifying the date, the billing number on the receipt of the customer or the shipment number to view a single shipment. This display of the measured values on a display 80 is likewise subject to the calibration process, since manipulation of the data between measured value memory and display 80 must be precluded. The mask to be displayed is therefore also created and signed by the measuring module 52.

In order to bind the software of the arithmetic unit 50 to a special machine and secure it as far as possible before copying, a root-CA authenticated by the machine can be created, which also uses the storage root key of the Trusted Platform Module (TPM chip). The TPM chip contains a unique identifier such as an endorsement key in the form of a 2048-bit RSA key pair that the manufacturer writes to the chip. The TPM chip can thus serve to identify the processing unit and the software thereon. The arithmetic unit 50 with the associated software is thus protected from it, to another To be transferred to the consignment station. The software is thus tied to a specific consignment station and hardware.

To permanently protect the software from tampering and physically bind the software to the machine, it may also be loaded onto a USB memory stick attached to the PC, which will physically be set to a read-only mode read-only switch upon completion of the signing by the calibration officer and is sealed by the calibration official with seals. As an alternative to a USB stick, a hard disk with a mechanical write-protection switch can also be used for this purpose.

A calibration officer will primarily use the console of the computer on which the calibration-relevant software modules are installed for his main task.

Using the console, he is able to verify the signature of all calibration-relevant software modules or to sign them themselves. For the verification of the tolerance values, the calibration official is expediently provided with a screen mask. On the one hand, the verification of the determined measured values can be carried out using the identical masks of the measured value display as for the customer. However, as the calibration officer also needs access to the original measuring values of the measuring instruments, for example, an equivalent mask like the

Measured value display of the customer, but provided with the original measured values. The calibration officer is then able to verify the signature of the individual measured values and the signature of the entire measured value data set in both masks. The verification can be carried out automatically in the calibration-relevant and thus signed measured value software.

The development of the business logic of the delivery station 10 takes place, for example, in the programming language Java, which offers the advantage that the software can be used platform-independently. As a runtime environment, for example, an OSGi server can be used. OSGi is an abbreviation for the Open Services Gateway Initiative. The Open Services Gateway Initiative is a Java-based management standard have been set by hardware-independent service components. Services can be implemented in the Java programming language, but can also consist of native code.

LIST OF REFERENCE NUMBERS

10 Consignment station, self-service machine 11 Receipt opening, feeder, singler

12 collection containers

13 operating unit

20 mailing, letter, goods

30 Balance 40 Dimension measuring device

50 arithmetic unit, measuring software

51 interface, serial

52 Measurement module 53.54 Driver 55 Measurement memory, disposable memory

60 franking unit

70.71 data cable

80 measured value display

90 Correction module 91 Format module

92 memory module

93 file, product price list

Claims

claims:

1. delivery station (10) for franking mailpieces (20), the at least one balance (30) for determining the weight of a mailpiece

(20), at least one dimension measuring device (40) for determining the dimensions of a mail item (20), an arithmetic unit (50) for determining the postage fee for a mail item (20) and a franking unit (60) for applying a postage indicium to the postal item (20 ), wherein the arithmetic unit (50) access

Measuring tolerances of the scale (30) and the dimension measuring device (40), characterized in that the scale (30) and the dimension measuring device (40) are each physically sealed and via physically sealed data cable (70; 71) in conjunction with a serial interface ( 51) of the arithmetic unit (50), and the scale (30) and the dimension measuring device (40) or an associated interface have means for signifying measured values, and that the measuring tolerances of the balance (30) and the dimension measuring device (40) and format categories for mail (20) are stored in a signed one-way memory (55), on whose data a signed

Measuring module (52) of the arithmetic unit (50) has read-only access, wherein the measuring module (52) comprises means for receiving measured values from the scale (30) and the dimension measuring device (40) via the serial interface

(51), and in that a correction module (90) of the measuring module (52) comprises means for adding and subtracting the respective measuring tolerances of the scale (30) and the dimension measuring device (40) to the received measured values so as to produce corrected measured values, and that the measuring module

(52) further comprises a format module (91) comprising means for determining the format category of a mailpiece (20) from the corrected dimensional measurements and the format categories in the disposable memory (55), and the measuring module (52) comprises means for determining the product category of a mailpiece (20) from the corrected Weight reading of the mailpiece (20) and the format category of the mailing (20) determined by the format module (91), and that the measuring module (52) also has access to a file (93) containing an association between product categories of mailpieces and postage rates; so that a determined postage fee for a mail item (20) from the

Measuring module (52) of the franking unit (60) can be supplied, and that the measuring module (52) further comprises means for signing records, comprising at least from measurements of the scale (30) and the dimension measuring device (40), the associated corrected measured values and the determined product category a mail item (20) and a storage module (92) for

Storage of a signed record in the signed one-way memory (55).

2. Dispatch station according to claim 1, characterized in that the delivery station (10) has a display (80) in connection with the measuring module (52) on which at least measured values and / or corrected measured values of the scale (30) and the dimensional measuring device ( 40) can be displayed, wherein a mask displayed on the display (80) can be signed by the measuring module (52).

3. Consignment station according to one of claims 1 and 2, characterized in that the file (93), which contains an association between product categories of postal items and postage fees, has no signature.

4. Consignment station according to one of claims 1 to 3, dadu rc hgekennzeichnet that the measuring module (52) and its components have a signature based on asymmetric encryption.

5. Consignment station according to claim 4, characterized in that the signature has been generated with a private key that can be generated and / or stored by a TPM chip (Trusted Platform Module) of the arithmetic unit (50), wherein the TPM Chip firmly in the

Arithmetic unit (50) is installed.

6. Consignment station according to claim 5, characterized in that the access to the private key in the TPM chip is protected by a password.

7. A consignment station according to any one of claims 1 to 6, wherein a scale (30), the dimensional measuring device (40) and / or an associated one of them

Interface means for forming a hash value on a measured value.

8. Einlieferungsstation according to one of claims 1 to 7, dadu rc hgekennzeichnet that the measuring module (52) means for forming a hash value over a data set consisting of at least the measured values of the balance (30) and the dimension measuring device (40), the associated corrected measured values and the determined product category of a mail item (20).

9. The consignment station according to claim 1, wherein the measuring module and its components are software components in the form of Java archive files.

10. Consignment station according to claim 9, dadu rc hgekennzeichnet, in that the measuring module (52) and its software components are stored on a write-protected storage medium whose mechanical write-protect switch is physically sealed, wherein the connection of the storage medium to the arithmetic unit (50) is also physically sealed.

11. A consignment station according to claim 10, wherein a measuring module (52) is stored on a USB memory stick with a mechanical write-protection switch.

12. A consignment station according to claim 10, wherein the measuring module (52) is stored on a hard disk with a mechanical write-protect switch.

13. Method for franking mailpieces in a delivery station (10), in which the weight of a mail piece of at least one scale (30) and the dimensions of a mail item (20) are determined by at least one dimension measuring device (40) and fed to a computing unit (50) and in which the arithmetic unit (50) determines the postage fee for a mail item (20) and feeds it to a franking unit (60) which applies a postage indicium to the mail item (20), wherein the arithmetic unit (50) generates corrected meter values Measuring tolerances of the scale (30) and the dimension measuring device (40) accesses, characterized by at least the following steps:

- Signing the measurements for the weight and dimensions of the mailpiece (20) by the scale (30) and the dimension measuring device (40) or a respective associated interface;

- Transmission of the signed measured values to the arithmetic unit (50) via a serial interface (51); - Retrieving tolerance values of the balance (30) and the dimension measuring device (40) from a signed disposable memory (55) by a measuring module (52) of the arithmetic unit (50);

Determination of corrected measured values for the weight and the dimensions of the mail item (20) by a correction module (90) of the mail item (20)

Measuring module (52), wherein the tolerance values of the scale (30) and the dimension measuring device (40) are used;

Retrieving format categories for mailpieces from the signed disposable memory (55) by the measurement module (52); - Determining a format category for the mail item (20) by a

Format module (91) of the measurement module (52) based on the corrected measurements for the dimensions of the mailpiece (20), wherein the retrieved format categories are used from the disposable memory (55);

Determination of a product category from the format category of the mail item (20) and the corrected measured value for the weight of the mail item (20) by the measuring module (52),

Determining a postage fee from a file (93) containing an association between product categories of postal items and postage due to the determined product category by the measuring module (52); - Feeding the determined postage fee from the measuring module (52) to the

Franking unit (60) and application of a postage indicium on the mail item (20) by the franking unit (60); and signing a data set comprising at least measurement values of the scale (30) and the dimension measuring device (40), the associated corrected measured values and the determined product category of a

Mailing (20) and storing this signed record in the signed disposable memory (55) by a memory module (92) of the measuring module (52).

14. The method according to claim 13, characterized in that at least measured values and / or corrected measured values of the balance (30) and the dimension measuring device (40) on a display (80) in conjunction with the arithmetic unit (80) are displayed, wherein a mask displayed on the display (80) is signed by the measuring module (52).

15. The method of claim 13, wherein the measurement module and its components are signed prior to carrying out the method steps of claim 13, wherein the signing is performed by asymmetric encryption.

16. The method according to claim 15, characterized in that the signing takes place with a private key which was generated by a TPM chip (Trusted Platform Module) of the arithmetic unit (50) and / or stored in the same, the TPM Chip is firmly installed in the arithmetic unit (50).

17. The method according to claim 13, wherein the scale, the dimension measuring device and / or an associated interface, when signing a measured value, have a hash value over the scale

Form a measured value.

18. Method according to one of claims 13 to 17, characterized in that the measuring module (52) has a hash value over a data set consisting of at least the measured values of the scale (30) and the dimension measuring device (40), the associated formed corrected values and the determined product category of a mail item (20) and this hash value is stored together with the record from the memory module (92) in the disposable memory (55).

19. Method according to claim 13, wherein the measuring module and its components are formed by software components in the form of Java archive files.

20. The method according to claim 19, wherein the measuring module and its software components are stored on a write-protected storage medium before the method steps according to claim have been carried out, the mechanical component of which is stored in a read-only memory medium

Write-protect switch is physically sealed after storage, wherein the connection of the storage medium to the arithmetic unit (50) is also physically sealed.

21. The method of claim 20, wherein a measurement module is stored on a USB memory stick with a mechanical write protect switch.

22. The method of claim 20, wherein a measuring module is stored on a hard disk with a mechanical write-protect switch.