Method for protecting a device against operation with unallowed consumables and arrangement for the implementation of the method6978255Abstract In a method and apparatus for protecting a device against operation with unallowed consumables whose authenticity is checked in a remote data center, at least one code word is generated, an allocation to a specific consumable is stored in the form of a dataset with a reference code word, the consumable is aggregated with the generated code word, which has a predetermined relationship to the reference code word or to a group of reference code words that are stored in the data center. An operation for the replacement of a consumable in a device remote from the data center is detected and a communication connection is set up between the device and the remote data center and the code word aggregated with the consumable is communicated to the data center. The communicated code word is received in the data center and the authenticity of the consumable on the basis of a stored reference code word is checked at the data center, which transmits a message to the device after checking the code. Claims 1. A method for protecting a device against operation with an unallowed tangible consumable product, comprising the steps of: Description BACKGROUND OF THE INVENTION
The latter is the case if there is no predetermined relationship with one of the reference codes stored remote, or given non-coincidence. An evaluation of a predetermined counter reading for the imprints occurs when sensors identify the occurrence of an ink tank cassette charge, and monitoring an ink level serves for indirect recognition of the change of an ink tank cassette. DESCRIPTION OF THE DRAWINGS FIG. 1 is a perspective view of a postage meter machine of the type T1000 from the left front, in which the invention can be used. FIG. 2 is a block circuit diagram of the postage meter machine according to FIG. 1. FIG. 3 is a circuit diagram of a detector in accordance with the invention. FIG. 4 is a perspective view of a postage meter machine of the type JetMail® from the right front in which the invention can be used. FIG. 5 illustrates of changing of the ink tank in the postage meter machine of the type JetMail® in accordance with the invention. FIG. 6 is a block circuit diagram of the postage meter machine of the type JetMail®. DESCRIPTION OF THE PREFERRED EMBODIMENTS A perspective view of a postage meter machine of the type T1000 manufactured by Francotyp Postalia AG & Co. is shown from the left front in FIG. 1. The postage meter machine 1 has an internal modem and, for example for recrediting, is connectable via a first data connection 14 to a data center 100 that has a data bank 130. A chip card 10 serves, for example, for setting the postage meter machine to a cost center under which the accounting is to be undertaken. The postage meter machine 1 has a cassette compartment 7 that must be opened for the insertion of a thermal transfer inking ribbon cassette 9. Upon opening before and/or when removing the cassette, which is detected by a sensor (not shown), a microprocessor in the postage meter machine 1 generates a display text and a warning appears on the display of a user interface 4. This text warns against removing a cassette 9 authorized by the manufacturer and continuing the operate the postage meter machine 1 with an unauthorized cassette, in order to prevent damage as well as premature aging of the printer mechanism and a qualitatively compromised print image. A marking is impressed as a bar code at the start of the inking ribbon. After the insertion of the new inking ribbon cassette into the postage meter machine, a detection of this marking is automatically implemented with an optical scanner (not shown) in order to communicate the data content of the marking to the control unit of the postage meter machine, as disclosed in European Application 730 974. Differing from the system disclosed in European Application 730 974, however, a communication is carried out between the control unit of the postage meter machine 1 and the data center 100 an authentic manufacturer's inking ribbon being recognized in the data center as a result thereof and the microprocessor being initiated therefrom to either display an OK message, or to emit an error message (CALL SERVICE) if the data center was incapable of recognizing an authentic manufacturer's inking ribbon. Physical identifiers are also conceivable, for instance gluing on a bar code label, that can be read with a simple scanner. The marking of the consumable with this code word can also ensue other different ways. A block circuit diagram is explained on the basis of FIG. 2, for the postage meter machine 1 shown in FIG. 1 or to some other, arbitrary device. Such a device has a microcomputer (μP) 19 for the control of the user interface 4, comprising a keyboard and a display with controller. A modem 13 and a printer 17 and/or other actuators (not shown) are connected to the microcomputer 19 via an input/output interface 18. Further sensors such as an encoder 90 and a letter sensor 91 are also connected in a known way. Additionally, a scanner 15 or a comparable means for recognizing a code word at the consumable can be connected to the input/output interface 18. When the aforementioned device is a postage meter machine 1, a postage-calculating scale 2 can be connected to the input/output interface 18 via a cable 24 for data connection. A further data connection 14 serves for the connection of the modem 13 to the data center 100. The scanner 15 can be omitted when a code word is entered by user interface 4 and communicated to the data center 100 via the modem 13 and the data connection 14. FIG. 3 shows a circuit diagram of a detector that for detecting the removal or replacement of the consumable when the device is turned off and not supplied with system voltage Us. The detector has a commercially obtainable lithium battery BAT that supplies a memory with a memory maintenance voltage of approximately 3 V. A first switch S1 is actuated upon removal or replacement of the consumable. For example, a mechanical contact is opened that interrupts the voltage supply of the memory from the lithium battery BAT. This voltage supply is detected and causes the closure of a second switch S2, that is preferably realized as a CMOS circuit. The reset input of the memory is thereby connected to ground (L level), which leads to the dependable erasure of the memory content of the memory. Otherwise, and with the device turned on, a positive voltage Us=+4.5 through +5 V (H level) is present at the reset input via a resistor R and the diode D1, or—with the device turned off—a positive voltage UBAT=+2.5 through +3 V (H level) is present via the diode D2. The memory can be fashioned as SRAM that is equipped with a code by the microcomputer 19 via the interface 18 by means of a shift register (not shown) and that can be queried with respect to the presence of the code. The nature of the aggregation of the consumable to the code word is preferably dependent on the nature of the consumable. A sensor directly or indirectly allows the presence of consumable to be identified according to a physical interactive principle, if the consumable is a solid. For example, the consumable can be an inking ribbon for a postage meter machine 1 according to FIG. 1. It is provided for a postage meter machine according to FIG. 4 that the consumable is an ink tank filled with ink. For a different postage meter machine (not shown) the consumable is an ink jet print head with integrated ink tank or, respectively, a cartridge. For example, Siemens type DHP50 is such a disposable print head. Fundamentally, the inventive solution can be applied in postage meter machines of other types, for example in a postage meter machine with print drum, wherein the consumable is ink. After a cover has been opened, ink can be replenished from a bottle or an ink cartridge. The code word is printed on the bottle or ink cartridge or is printed on a label that is secured to the latter. A postage meter machine Type EFS with a printing drum has an inking unit with a step-shaped covering that enables a simple refilling of the print stamp ink and prevents an unintended emergence of the print stamp ink (European Application 269 883). The ink flows from a screwed-on cartridge into an ink chamber and is conveyed to the printing drum with rollers. In an especially simple version proceeds therefrom that the code word is supplied together with the consumable as a visually legible number, and the user must type in the number by actuating corresponding operating elements. The advantage of a semi-automatic solution is (a) the elimination of the outlay for a scanner in the postage meter machine, and (b) protection of the consumable, ink, enabled for the first time as a result of the invention. This solution likewise assumes the presence of a modem and a sensor that recognizes the replacement or the use of a new consumable. The postage meter machine has a sensor and a control unit with a processor that is programmed to generate a message after the recognition, and to display it and to wait for the input of a number that is communicated to the data center by modem as the code word. For some peripheral device, for example, the consumable is in a non-solid aggregate state. For a peripheral device, for example, the consumable can be a specific fluid for a letter moistener and sealer. The latter can be a component of an automatic feeder means for letters. Usually, however, at least one container is present that is a solid body and can be provided with a marking. Another version employs a chip in which the code word is stored and can be read out by producing a connection, for example via electrical contacts, given installation of the new consumable. A postage-calculating scale 2 (shown in FIG. 1) has a weighing pan 21, a display 23 and a keyboard 25 for the entry of shipping information about a letter 33 to be dispatched. When there is a further data connection 24 between the postage-calculating scale 2 and the postage meter machine 1, the scale 2 can send the weight, the postage value and other data to the postage meter machine 1, and can also send a message to the remote data center 100 via the modem of the postage meter machine 1, for example to identify which rate PROM is being employed for calculating the postage value. The latter is located within a memory insert card 22 that can be plugged in the postage-calculating scale 2. On the basis of data stored in a data bank 110, the data center 100 can distinguish whether an authorized or a non-authorized postage rate table is being employed in the postage-calculating scale 2. In the perspective view from the right of a JetMail® type postage meter machine shown in FIG. 4, there is an internal data connection to the integrated scale 20 whose rate PROM (not shown) can be basically checked in the same way as, for example, an arbitrary other component that is present in modularly removable form, and has a memory. An automatic feeder 3 with integrated separating mechanism is arranged upstream of the postage meter machine 1. A pressure bow 35 can be hinged up and then presses against a stack of mail from which letters are separated with haul-off rollers 32. Further parts of the separating mechanism is situated under a hood 34. A letter lies against a guide plate 31 and is moved downstream to the guide plate 11 of the postage meter machine 1 where the printing event franking ensues. A franked letter that is conveyed farther lies against a guide plate 81 of a closing module 8. A closing roller pair 82 closes envelopes that have not yet been completely closed and ejects the envelopes via an insert 5 into the deposit box 6. The structure of the JetMail® type postage meter machine has been disclosed in greater detail in, for example, German Patent Application DE 199 00 686.5-27. A chip card write/read unit 70 and an on/off switch 71 are arranged in the guide plate 11 of the postage meter machine 1. After being turned on, a chip card 10 can be employed in combination with the user interface 43, 45 for simplified setting of the postage meter machine. The user interface 43, 45 is situated on the meter 12 of the postage meter machine 1. An internationally usable user interface has been set forth in greater detail in German Utility Model 298 21 903. A microprocessor (not shown) of the postage meter machine 1 monitors the filling level of an ink tank 95 (shown in FIG. 5) with an end of ink sensor 92. The latter can be in contact with two electrodes according to German Patent 196 13 944. In the JetMail®, such sensors—to be on the safe side—already supply an end signal when a maximum of 200 frankings are still possible in order to avoid an incompletely printed franking print image due to lack of ink. As warranted, the microprocessor generates a display text for display in the display 43: THE INK SUPPLY HAS BEEN NEARLY USED UP. PLEASE REPLACE THE INK TANK AS SOON AS POSSIBLE! IMPRINT RESERVE: 200. The postage meter machine 1 then can continue to be operated with the quantity of reserve ink. In its memory space, the microprocessor has a down counter that is preset to the number 200 by the end of ink signal and that is decremented by one upon every further franking. The number 200 is derived empirically from values for a remainder of possible imprints and a safety factor. The number identifying the remainder can be displayed before the next franking. After every further franking, the microprocessor generates a status line that indicates the number of remaining imprints and, at the end, outputs the message: THE INK SUPPLY HAS BEEN USED UP. PLEASE CHANGE THE INK TANK. After opening the flap 99 of the ink compartment 98, the used ink tank 95 can be removed and placed into a plastic bag that collects ink residues that may leak out. A new ink tank can be taken from its package and checked to see whether the color of the ink is right. A perforation encoding on the back side of the ink tank can be utilized for this purpose. The new code word can be read at the same time. The ink tank is placed into lateral guide rails (not shown) of the ink tank compartment and pushed in until it noticeably engages. As long as the ink tank has not been properly inserted, the microprocessor generates the message: THE INK TANK IS MISSING! A contact is automatically closed when the new consumable is docked. As a result of this contact, the postage meter machine 1 recognizes that a new consumable has been installed. Dependent on a perforation encoding at the back side of the ink tank, the original ink type (postal red, fluorescent red, etc.) can be detected with suitably fashioned contacts. The microprocessor 19 now generates a messages that prompts the customer to input the new code word: INPUT CODE WORD. For example, the customer can take this code word from an imprint on the package and can input it into the postage meter machine 1 with the keyboard 45. Now that the postage meter machine 1 has the new code word available to it, a connection is set up to the data center of the manufacturer. Modem postage meter machines are all already equipped with a modem in order to be able to communicate with the manufacturer's data center. This normally serves for having a credit loaded from the data center when the credit memory becomes exhausted. The transmission of the code words can ensue separately immediately after the detection of the new consumable or can be an additional component of the communication for the periodic remote crediting of the postage meter machine at a later time. Known measures for data protection are utilized in order to prevent the code words from being tapped on the transmission link. The data center receives the code word of the new consumable 95 together with an identifier of the postage meter machine 1. The matching code word is sought in the group of stored reference code words. When it is found, the logged-on consumable is considered authorized and nothing opposes continued employment of the postage meter machine 1. If the code word is not identified, a counterfeit code word or a code word that is no longer valid must be assumed. Given a counterfeit code word, the customer has obviously acquired a non-authorized consumable with an arbitrary, pseudo code word, or created the code word due to a lack of a true code word when requested to enter the code word. Given a code word that is no longer valid, a check is carried out to see whether this was already employed. When the answer is 'no', this can mean an authorized but expired consumable. In this case, a check should be carried out to determine whether the material can still be permitted to be used. When the invalid code word has already been employed, it is obviously an attempted manipulation. FIG. 6 shows a block circuit diagram of the JetMail® type postage meter machine with a control unit 40 through 58 comprising a processor 46 and with a base including an integrated scale 20, a rate PROM 22, a modem 53 and a detector 96 that detects the changing or the employment of a new ink tank cassette 95. Alternatively, the rate PROM 22 can also be realized in the broken-line memory module 51, 52 within the meter. Alternatively, the direct measuring method with the detector 96 can be replaced by an indirect measuring method that uses the existing sensors 92 and 97. After a consumption of the ink, a predetermined remainder of ink is detected with the electrodes 93, 94 and the sensor 92 and communicated to the microprocessor 46 via the assemblies SAS 59, sensor/actuator control interface ASIC 58, the microprocessor 46 subsequently generating a display. A predetermined remainder of ink remains that suffices for approximately 200 imprints when the conductivity between the contacts 93, 94 falls below a predetermined threshold. A turn-on/off of the postage meter machine 1 via the switch 71 can be detected via the sensor 97, which is likewise connected to the SAS 59. A shutdown at the time during which the postage meter machine only has the ink remainder available to it can indicate an impending replacement. An end of ink can be determined by a comparison of the counted imprints to a limit value or by counting down from a predetermined plurality. When, following a re-activation without a replacement detected via the contacts 93, 94 and the sensor 92 for restored conductivity between the contacts 93, 94, the postage meter machine can continue to be operated beyond a number of, for example, 200 imprints, then this is an indication that ink was refilled in an unauthorized fashion in the interim. As a reaction thereto, at least a display message is generated and a message also may be communicated to the date center when a credit must be reloaded. A security module 60 serves as first accounting module and has a hardware accounting unit 63 and a battery-supported non-volatile memory 16 into which a credit can be loaded by modem 53. An OTP (One-time programmable) processor 66 thereby implements security routines both in the credit reloading as well as for securing the register data with a MAC (Message authentication code). The advantage of the security module is comprised therein that the check of the dependability and the approval of the inventive franking and posting machine, which is carried out by the mail carrier, is then only required for the appertaining processor system 60 and the connected printer module 55-57. A second processing module is formed by the chip card 10 in combination with the chip card write/read unit 70. The microprocessor 46 and the first memory components 41, 42 then form a third processing module, and the microprocessor 46 and the second memory components 51, 52) broken lines) then form a fourth processing module, etc. As a rule, one accounting module suffices and the other processing modules can assume other tasks. The microprocessor 46 with the appertaining memories 41,42 is programmed for counting the imprints in combination with the recognition of a change of the ink cassette and is also employed as postage computer and for the print control. The accounting module 60 serves for accounting and for calculating encryption codes at least for the communication with the data center for the purpose of credit reloading. The accounting module 60 has been developed to form the security module on the basis of this division of tasks. All processing modules 41, 42 and 51, 52, the security module 60, the microprocessor 46, the interface assemblies 44, 54 and 55, a main working memory pixel-RAM 47, clock/date module 48, slogan memory EEPROM 49, program memory ROM 50 and an ASIC with the sensor/actuator interface 58 are connected to a meter-internal bus 40 of the controller. An input at the ports of the microprocessor 46 for the corresponding control of the postage meter machine 1 is actuated with the keyboard 45. A generated screen image can proceed to the display via the interface assembly 44. The display has an integrated controller for support. Further sensors and actuators (not explained in greater detail herein) of the base, an encoder 90 for weighing a letter and at least one letter sensor 91 as well as—via the interface 54—at least the modem 53 are electrically connected to the meter 12 of the postage meter machine 1 via the sensor/actuator control interface 58. Both interface circuits 54 and 58 can be realized in an application circuit ASIC. Further details about this can be derived from European Application 716 398. Further details about the control of the other components in the base and in the periphery can be derived from European Application 875 864. The modem 53 is electrically connected to the meter 12 of the postage meter machine 1 via the interface 54. Another advantage is achieved due to the comparison of the code words carried out in the remote data center 100 (not shown). Even given a valid code word, a check is carried out to determine whether it was already previously used. If it was reported from a different postage meter machine, the user thereof obviously gave the code word and the new customer is attempting to employ unauthorized consumables in combination with this code word. If the customer has already previously indicated the code word, this is an indication that, following the use of authorized consumables, the customer has now gained possession of unauthorized consumables. The range of possible responsive measures extends from a cordial telephone admonition to the dispatching of a service technician with an original consumable, up to a remote disable of the postage meter machine 1, for example given a repeat offender. The advantage of this method is that there are no "old" code words that are no longer valid and that could undermine the security system by being passed on. This is achieved because the check of the code words does not occur in the individual postage meter machine 1 that is not networked to another machine, but proceeds remote therefrom at the level of the data center, which has access to all assigned code words and is also always loaded with the corresponding reference code words synchronously with newly produced consumables. The data center described herein can be remote from a data center for credit reloading but is connected to the latter. Another advantage is the elimination of the necessity of issuing new codes at specific time intervals and invalidating the old ones, with more than one set of code words always being valid during the transition times. No memory space requirement in the postage meter machine 1 for storing one or more sets of code words arises in the inventive solution. Another advantage of the method is the possibility of acquiring information about the kind of manipulation. For example, it is possible to not only identify the customer who is attempting to employ the unauthorized consumable at the moment but also to identify the source from which the offender probably obtained a valid code word. In the scope of this inventive method, an effective protection against refilling ink tanks is also possible. The ink tank need not necessarily be removed from the device in this unauthorized refilling with any old ink. On the contrary, it is also conceivable that the ink is injected into the stationary tank with a syringe. In this case, no contact would be triggered that indicates the replacement of the consumable and consequently prompts the customer to input the new code word. The following modification is a deterrent. Let it be assumed that the customer has first acquired authorized consumables; this is at least assured when purchasing the postage meter machine 1. Subsequently, the data center has received the code word of the authorized consumable in the above-described way. At the same time, a counter for this machine is started in the data center. This registers the time until the next credit reloading. At the next credit reloading, the item count is transmitted from the postage meter machine 1 into the data center, this indicating how many frankings were carried out since the last credit reloading. The consumable is designed for a specific number of franking imprints that is subject to only a slight fluctuation when priming is not carried or only a little priming is carried out (for example, JetMail tank for 30,000 frankings+/-5%). The point in time of the acquisition of the consumable then divides the time period between two credit reloadings in a specific relationship. The ink consumption must also correspond to this relationship if the user behavior has not fundamentally changed. The relationship calculation, however, also can extend over more than one period of credit reloadings and gains in precision. If significantly more frankings have been implemented in this time span than would have been possible at all with the most recently reported consumable, this is an indication that, without replacing the ink cartridge, this was apparently refilled with unauthorized ink, quod erat demonstratum. This enables an evaluation in the data center in view of suspect machines that can be inspected in targeted fashion in future by the service technician. A check of the authorization of the consumable can fundamentally also ensue only in the postage meter machine. A transmission of the code words immediately after determination of the new consumable or as an additional component part of the communication for periodic remote loading of the postage meter machine at a later time continues to be required. The data center receives the code word of the new consumable 95 together with an identifier of the postage meter machine 1. A search for the matching code word is made in the group of stored reference code words. A reference code word that has been found is then communicated to the postage meter machine. Known data protection measures are utilized in the communication in order to prevent the code words from being tapped on the transmission link. A check is carried out in the postage meter machine to determine whether the two, i.e. the code word and the reference code word, have a predetermined mathematical relationship to one another. When this is the case, the reported consumable is considered authorized and nothing opposes continued use of the postage meter machine 1. The advantage of this version is that, even given interruption of the communication with the data center, the postage meter machine can independently implement the comparison and enable or block itself, or modify its operation in some other, suitable way, so that a use of refilled, authorized ink reservoirs with unauthorized ink is at least deterred. A check of the authorization of the consumable can also fundamentally ensue in both, i.e. in the data center and, additionally, in the postage meter machine. Although modifications and changes may be suggested by those skilled in the art, it is the intention of the inventors to embody within the patent warranted hereon all changes and modifications as reasonably and properly come within the scope of their contribution to the art.
|
Same subclass Same class Consider this |
||||||||||