Arrangement and method for generating a security imprint

• US 6,853,986 B1
• Filed: 06/14/2000
• Issued: 02/08/2005
• Est. Priority Date: 06/15/1999
• Status: Expired due to Term

• Current Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Original Assignee: Francotyp-Postalia GmbH (Francotyp-Postalia Holding AG)
• Inventors: Wagner, Andreas, Rosenau, Dirk
• Primary Examiner(s): Hayes, John W.
• Assistant Examiner(s): Abdi, Kambiz
• Application Number:
  US09/593,406
• Time in Patent Office: 1,700 Days
• Field of Search: 705 60- 62, 705/401, 705/405, 705/408, 380/23
• US Class Current: 705/60
• CPC Class Codes: G07B 17/00314 Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
• CPC Class Codes: G07B 17/00362 Calculation or computing within apparatus, e.g. calculation of postage value
• CPC Class Codes: G07B 2017/00322 Communication between components/modules/parts, e.g. printer, printhead, keyboard, conveyor or central unit
• CPC Class Codes: G07B 2017/0037 Calculation of postage value
• CPC Class Codes: G07B 2017/00959 Cryptographic modules, e.g. a PC encryption board

Abstract

In a method and an arrangement for increasing the throughput of mail when franking with a security imprint, the editing of the print image data is undertaken by a postage meter machine processor, and the calculation of the security code is undertaken by a separate security module while the print image data are being edited. A high system clock performance is achieved by interleaving of the two calculation tasks.

Claims

1. An arrangement for generating a security imprint comprising:

a security module containing a first program memory in which a first program is stored and a security module data processing unit connected to said first program memory and being programmed by said first program to calculate a multi-byte security code from existing system data and to be able to receive new system data to modify said existing system data;

a separate data processing unit disposed externally of said security module and having a second program memory in which a second program is stored, said separate data processing unit being programmed by said second program to edit print data to compile a print image that contains said security code as a security imprint and that embodies a monetary value for franking a mail item;

said security module data processing unit being further programmed by said first program to, immediately upon receipt of said new system data, validate said new system data and determine whether said new system data are required for said security code and, only if so, to immediately begin recalculating a portion of said security code in a first routine and, in a second routine, to finish recalculating said security code for at least one security imprint, thereby producing a recalculated security code, and to initiate an accounting operation for said monetary value and to communicate the recalculated security code to said separate data processing unit; and

said separate data processing unit, upon receiving said recalculated security code, compiling said print image containing said recalculated security code as a security imprint and embodying said monetary value.

2. An arrangement as claimed in claim 1 wherein said security code is a data authorization code and wherein said security module data processing unit contains an internal non-volatile memory in which at least one key for calculating said data authorization code is protectively stored against access and wherein said security module contains a further security module data processing unit for performing said accounting.

3. An arrangement as claimed in claim 2 wherein said security module data processing unit is a processor programmed by said first program to calculate a first eight bytes of said data authorization code in advance in said first routine each day, and wherein said further security module data processing unit is a hardware accounting unit which produces an accounting result as a result of said accounting in said second routine, and wherein said security module further contains a non-volatile memory, accessible by said hardware accounting unit, in which said hardware accounting unit stores said accounting result.

4. An arrangement as claimed in claim 3 wherein said processor is programmed by said first program to determine an ascending register value, dependent on said monetary value, for at least one mail item, and to finish calculating said data authorization code in said second routine for said at least one mail item using said ascending register value.

5. An arrangement as claimed in claim 3 for use with a plurality of mail items all having the same monetary value for franking, and wherein said processor is programmed by said first program to pre-calculate a next-successive data authorization code for a next mail item after debiting said monetary value for a preceding mail item, and to immediately communicate said next-successive data authorization code to said separate data processing unit.

6. An arrangement as claimed in claim 3 wherein said internal non-volatile memory is an SRAM of said processor, and wherein said security module further comprises a battery supporting said SRAM, and wherein said SRAM had memory areas for protected storage of at least some data produced by said pre-calculation, and wherein said at least one key for calculating said data authorization code is protectively stored in a memory area of said SRAM.

7. An arrangement as claimed in claim 6 wherein said processor is programmed by said first program to calculate said data authorization code using a machine identifier and OCR key indicator, a date, said monetary value, and a register value for an ascending register.

8. An arrangement as claimed in claim 2 wherein said processor is programmed by said first memory to calculate said data authorization code using an algorithm selected from the group consisting of DES algorithms and triplet DES algorithms.

9. A method for generating a security imprint, comprising the steps of:

providing a security module containing a security module data processing unit;

presetting all system data required for calculating a security code and, only upon receipt of new system data requiring a re-calculation of the security code, in said security module data processing unit immediately validating said new system data and re-calculating said security code using said new system data, by immediately beginning re-calculating a portion of said security code in a first routine, and a second routine, finishing re-calculating the security code to produce a re-calculated security code;

also in said security module data processing unit, calculating an ascending register value for a monetary value associated with said new system data; and

communicating the re-calculated security code to a separate data processing unit external of said security module and, in said separate data processing unit, compiling a print image, including said security code as a security imprint and printing said print image.

10. A method as claimed in claim 9 comprising calculating a data authorization code in said security module data processing unit as said security code dependent on said ascending register value and additional data in said new system data and generating said security imprint at a time following an end of entry of said new system data and before conducting an accounting for said monetary value.

11. A method as claimed in claim 9 wherein said new system data are associated with an inserted mail item and wherein said security code is a data authorization code and wherein said security module data processing unit calculates said data authorization code dependent on said ascending register value and additional data in said new system data at a time from said insertion of said mail item and before conducting an accounting for said monetary value.

12. A method as claimed in claim 9 wherein said security code is a data authorization code and wherein said security module data processing unit calculates said data authorization code dependent on a machine identifier, said monetary value and a current date, and wherein at least said machine identifier is included in a pre-calculation of n bytes of said data authorization code.

13. A method as claimed in claim 9 wherein said security code is a data authorization code and wherein said security module data processing unit calculates said data authorization code dependent on a machine identifier, said monetary value and a current date, and wherein at least said machine identifier and said date is included in a pre-calculation of n bytes of said data authorization code.

14. A method as claimed in claim 9 comprising successively supplying sets of new system data to said security module data processing unit and after communicating said security code to said separate data processing unit, in said security module data processing unit beginning calculation of a next-successive security code for next new system data, at least dependent on said ascending register value to produce pre-calculated n bytes of said next-successive security code.