Method for modifying data loaded into memory cells of an electronic postage meter machine

• US 5,734,571 A
• Filed: 09/05/1996
• Issued: 03/31/1998
• Est. Priority Date: 09/08/1995
• Status: Expired due to Term

• Current Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Original Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Inventors: Pilz, Joachim, Zarges, Olav
• Primary Examiner(s): Cosimano, Edward R.
• Application Number:
  US08/708,656
• Time in Patent Office: 572 Days
• Field of Search: 235/375, 235/380, 235/382, 235/382.5, 340/825.3, 340/825.31, 340/825.32, 340/825.34, 364/464.11, 364/464.15, 364/464.2, 380/3, 380/4, 380/23, 380/25, 395/239, 395/241, 395/244, 395/609, 395/651, 395/653, 395/712, 395/726
• US Class Current: 705/400
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G07B 17/0008 Communication details outside or between apparatus coin-freed apparatus for franking per se G07F17/26
• CPC Class Codes: G07B 17/00314 Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
• CPC Class Codes: G07B 2017/00177 from a portable device, e.g. a card or a PCMCIA
• CPC Class Codes: G07B 2017/00258 Electronic hardware aspects, e.g. type of circuits used
• CPC Class Codes: G07B 2017/00354 Setting of date
• CPC Class Codes: G07B 2017/00395 Memory organization
• CPC Class Codes: G07B 2017/0054 Thermal printhead
• CPC Class Codes: G07B 2017/00774 MAC (Message Authentication Code), e.g. DES-MAC

Abstract

In a method for modifying data loaded into memory cells of an electronic postage meter machine having a microprocessor which executes steps for a routine controlled by an external storage medium, a data modification mode is entered into by plugging a programmed, read-only memory module, which contains a program to be interpreted, into communication with the microprocessor and the program is loaded from the module into the microprocessor, a check routine is executed in a secure region of the postage meter machine for checking the validity of the loaded program, and given validity of the loaded program, the data in the postage meter machine are modified including initialization of an interpreter routine, with the interpreter routine being executed in the data modification sequence.

Claims

1. A method for modifying data loaded into memory cells of an electronic postage meter machine, said electronic postage meter machine having a microprocessor for executing steps for a routine controlled by an external storage medium, said method comprising the steps of:

(a) entering into a mode that allows a modification of the data loaded in the memory cells of the electronic postage meter machine, plugging a programmed, read-only memory module that contains a program to be interpreted into communication with said microprocessor, and loading the program to be interpreted from the plugged read-only memory module into the postage meter machine;

(b) calling a check routine, which executes in a secure, internal region of the electronic postage meter machine, for checking the validity of the loaded program to be interpreted, in a predetermined memory location, with a finding of validity being based on an authentification method; and

(c) modifying said data in the postage meter machine given validity of the loaded program to be interpreted that was checked with the authentification method, including initializing an interpreter routine, executing said interpreter routine in a sequence to modify the data in the postage meter machine, and exiting the check routine of the postage meter machine if the loaded program to be interpreted is invalid and automatically executing security protection measures.

2. A method as claimed in claim 1 comprising the additional steps of:

storing said interpreter routine in an internal program memory of said postage meter machine;

providing an externally accessible EPROM base on an exterior of said postage meter machine and activating said interpreter routine by applying activating data from the exterior of said postage meter machine via said external EPROM base for causing said interpreter routine to operate, in combination with an operating program for said postage meter machine;

activating an access key to enter into said mode that allows modification of the data; and

including data in said activating data which are processed by said interpreter routine and said microprocessor executing operations located exclusively in a code area of said operating program in said internal program memory.

3. A method as claimed in claim 1 comprising the additional steps of:

actuating a default key and checking an access authorization on the basis of an access code for entering into said mode that allows a modification of the data and thereafter loading said program to be interpreted from said plugged read-only memory module into said postage meter machine;

allocating a first MAC to a first portion of the contents of said read-only memory module to be interpreted and forming a first MAC checksum in said microprocessor covering said first content;

comparing said first MAC checksum to said first MAC;

if said first MAC checksum and said first MAC agree, executing a processing routine for processing said first content in said microprocessor after interpretation of the loaded program;

if said first MAC and said first MAC checksum do not agree, exiting said test routine and automatically executing security protection measures;

executing internal dealer routines for modifying said data in said postage meter machine;

loading a further program to be interpreted from an external plugged-in read-only memory module into said postage meter machine;

allocating a second MAC to a second content of the contents of said read-only memory module and forming a second MAC checksum over said second content;

comparing said second MAC checksum and said second MAC;

if said second MAC checksum and said second MAC agree, executing a processing routine for processing said second content in said microprocessor after interpretation of the program to be interpreted; and

ending processing of said second content or preventing execution of said check routine if an error is found.

4. A method as claimed in claim 3 comprising the additional steps of:

providing an externally accessible EPROM base on said postage meter machine;

plugging an EPROM into said EPROM base, said EPROM having a key for access authorization;

connecting driver circuits in said postage meter machine to said EPROM base for preventing internal data from said postage meter machine from being read out to an exterior of said postage meter machine via said EPROM base; and

upon actuation of said default key, modifying said data in said postage meter machine by executing a data modification program stored in said postage meter machine.

5. A method as claimed in claim 3 comprising the step of protecting said default key with a sealed postal flap, and opening said sealed postal flap for actuating said default key for entering into said mode that allows modification of the data.

6. A method as claimed in claim 3 comprising the additional steps of:

providing an externally accessible EPROM base on said postage meter machine;

plugging an EPROM into said EPROM base, said EPROM having a key for access authorization;

connecting driver circuits in said postage meter machine to said EPROM base for preventing internal data from said postage meter machine from being read out to an exterior of said postage meter machine via said EPROM base; and

modifying said data in said postage meter machine using an interpreter routine applied from an exterior of said postage meter machine via said EPROM base.

7. A method for modifying data loaded into data cells of an electronic postage meter machine, comprising the steps of:

a) entering into a mode that allows a modification of the data loaded in the memory cells of the electronic postage meter machine, plugging a storage medium containing a program to be interpreted into said postage meter machine and loading said program to be interpreted from the plugged storage medium into the postage meter machine;

b) calling a check routine which is executed by an OTP processor in a secure, internal region of said OTP processor, for conducting at least one of a check of the validity of a program code and a check of data of said loaded program on the basis of an MAC stored in said storage medium, said OTP processor conducting said check routine with a selected checksum method; and

modifying said data in said postage meter machine given validity of the loaded program to be interpreted and agreement of the data checked with the MAC, and exiting the check routine of the postage meter machine if either the loaded program is determined to be invalid or in the absence of MAC agreement and automatically executing security protection measures.

8. A method as claimed in claim 7 comprising the additional steps of:

providing an externally accessible EPROM base on said postage meter machine;

plugging an EPROM into said EPROM base, said EPROM having a key for access authorization;

connecting driver circuits in said postage meter machine to said EPROM base for preventing internal data from said postage meter machine from being read out to an exterior of said postage meter machine via said EPROM base; and

modifying said data in said postage meter machine using an interpreter routine applied from an exterior of said postage meter machine via said EPROM base.

9. A method as claimed in claim 7 comprising the additional steps of:

providing a plurality of areas in said storage medium containing code to be interpreted and respectively securing each of said areas with respective MACs;

providing a mode for processing service functions;

executing an interpreter routine within said mode for service functions by calling said service functions via a keyboard including actuating a key of said keyboard which identifies memory contents in an area of said storage medium to be loaded, authenticating the data to be loaded using its MAC and, given MAC agreement, interpreting the data in said area and, if no code to be interpreted is allocated to a key of said keyboard, continuing normal processing using said key.

10. A method as claimed in claim 9 comprising the additional steps of:

transmitting an externally stored, predetermined MAC value into an OTP-RAM in said OTP processor for volatily storing said predetermined MAC therein, allocating a first MAC to first contents of a memory and forming a first MAC checksum covering said first contents;

entering into said mode for processing servicing functions and implementing routines for service functions using said interpreter routines and ending said mode for processing servicing functions; and

transmitting an externally stored, predetermined MAC into said OTP-RAM for volatile storage therein, allocating a second MAC to second contents of said memory and forming a second MAC checksum in said OTP processor covering said second contents.

11. A method as claimed in claim 7 comprising the additional steps of:

storing an interpreter routine in an internal program memory of said postage meter machine;

providing an externally accessible EPROM base on an exterior of said postage meter machine and activating said interpreter routine by applying activating data from the exterior of said postage meter machine via said external EPROM base for causing said interpreter routine to operate, in combination with an operating program for said postage meter machine;

activating an access key to enter into said mode that allows modification of the data; and

including data in said activating data which are processed by said interpreter routine and said microprocessor executing operations located exclusively in a code area of said operating program in said internal program memory.

12. A method as claimed in claim 11 comprising the additional steps of processing data in said interpreter routine formed by a series of commands each composed of a data set with three components;

in a first of said three components, identifying an operation to be executed by that command;

in a second of said three components, identifying a type of value; and

in a third of said components, identifying said value.

13. A method as claimed in claim 7 comprising the additional steps of:

triggering said check routine by actuating a default key; and

upon actuation of said default key, executing one of copying said first contents into an internal data area of said OTP-RAM, forming an MAC checksum, encoding a checksum covering said first contents and executing an MAC comparison for said MAC checksum covering said first contents, encoding a checksum covering said second contents and executing an MAC comparison to said MAC checksum covering said second contents; and

identifying errors occurring in processing during said interpretation which result in a termination of said interpretation.

14. A method as claimed in claim 13 comprising the additional steps of:

storing an interpreter routine in an internal OTP-ROM program memory of said electronic machine;

providing an externally accessible EPROM base on an exterior of said postage meter machine and activating said interpreter routine by applying activating data from the exterior of said electronic machine via said external EPROM base for causing said interpreter routine to operate, in combination with an operating program in said OTP-ROM for said electronic machine;

activating an access key to enter into said mode that allows modification of the data; and

including data in said activating data which are processed by said interpreter routine and said microprocessor executing operations located exclusively in a code area of said operating program in said OTP-ROM.

15. A method as claimed in claim 7 comprising the additional steps of:

actuating a default key and checking an access authorization on the basis of an access code for entering into said mode that allows a modification of the data and thereafter loading said program to be interpreted from said plugged read-only storage medium into said postage meter machine;

transmitting an externally stored, predetermined MAC value into an OTP-RAM in said OTP processor for volatily storing said predetermined MAC therein, allocating a first MAC to first contents of a memory and forming a first MAC checksum covering said first contents;

comparing said first MAC checksum to said first MAC;

if said first MAC checksum and said first MAC agree, executing a processing routine for processing said first content in said microprocessor after interpretation of the loaded program;

if said first MAC and said first MAC checksum do not agree, exiting said test routine and automatically executing security protection measures;

executing internal dealer routines for modifying said data in said postage meter machine;

transmitting an externally stored, predetermined MAC value into an OTP-RAM in said OTP processor for volatily storing said predetermined MAC therein, allocating a second MAC to second contents of a memory and forming a second MAC checksum covering said second contents;

comparing said second MAC checksum and said second MAC;

if said second MAC checksum and said second MAC agree, executing a processing routine for processing said second content in said microprocessor after interpretation of the program to be interpreted; and

ending processing of said second content or preventing execution of said check routine if an error is found.

16. A method as claimed in claim 15 comprising the additional steps of:

providing an externally accessible EPROM base on said postage meter machine;

plugging an EPROM into said EPROM base, said EPROM having a key for access authorization;

connecting driver circuits in said postage meter machine to said EPROM base for preventing internal data from said postage meter machine from being read out to an exterior of said postage meter machine via said EPROM base; and

upon actuation of said default key, modifying said data in said postage meter machine by executing a data modification program stored in said postage meter machine.

17. A method as claimed in claim 15 comprising the step of protecting said default key with a sealed postal flap, and opening said sealed postal flap for actuating said default key for entering into said mode that allows modification of the data.

18. A method for modifying data loaded into memory cells of an electronic machine, said electronic machine having a microprocessor for executing steps for a routine controlled by an external storage medium, said method comprising the steps of:

(a) entering into a mode that allows a modification of the data loaded in the memory cells of the electronic machine;

(b) calling a check routine, which executes in a secure, internal region of the electronic postage meter machine, for checking at least one of the validity of a program code the loaded program to be interpreted and data associated with said loaded program in a predetermined memory location, with a finding of validity being based on an authentification method; and

(c) modifying said data in the electronic machine given validity of the loaded program to be interpreted that was checked with the authentification method, and exiting the check routine of the electronic machine if the loaded program to be interpreted is invalid and automatically executing security protection measures.