EP0700021A1 - Method for transmitting information between a computerized control centre and a plurality of electronic franking machines - Google Patents

Abstract

The method involves transmitting data between a data control centre (1) and a number of machine readers (8). The centre (1) can transmit to each machine (8) a data reset instruction. The method is designed to inscribe data onto or read data from memory on a card (14) with elements (15-17). For protection against fraudulent use, the reloading of transmitted data is subject to an authorisation system and the data received is only validated for use after verification by the authorisation system. The data can be prepared and verified only if secret data is known which is stored in both the memories of the central control and the security memory of the machine to which the data is transmitted.

Description

The invention relates to electronic franking machines which are part of a computerized control center.

It is known that franking machines have different counters, in general at least one so-called ascending counter whose value, on each impression of a franking, is increased by the amount thereof, and a so-called descending counter whose value is decreased of the postage amount, the value of the ascending counter representing the total sum of postage printed by the machine since it was put into service while the value of the descending counter indicates the credit not yet consumed since the last reloading of the machine in monetary units .

Numerous methods have already been proposed to allow the control center, when it has verified that the required conditions are met, to transmit to the machine concerned an instruction to reload its down counter.

More generally, there are various systems allowing not only the transmission of an instruction to reload the meter from the center to one of the machines, but also the transmission of meter readings between this machine and the center. One of these systems plans to equip each machine with a modem, the dialogue between the machine and the center using the public telephone network using two-way secure messages. Another system provides for the use of a portable object with data memory protected by an access logical layer, an object which is transported between the center and the machine.

These systems are currently very satisfactory, particularly with regard to protection against fraud with meter reloading, since access to the information transmitted between the center and the machine is respectively prohibited by securing the transmission on the public telephone network, or by the access protection logical layer of the portable object.

The invention aims to allow the transmission of information with the same degree of security, but in a more economical manner.

To this end, it proposes a method of transmitting information between a computerized control center and a plurality of electronic franking machines, at least so that the center can transmit to each said machine a counter reloading instruction, a method in which write or read the data to be transmitted and received respectively in a memory of a portable object which is transported between a means of recording the data to be transmitted and a means of reading the data to be received, with a said means of inscription ordered by the center and a said reading means provided in each postage meter; characterized in that portable objects are used in which the writing and reading of the data in the memory are free, providing, if information is transmitted to be protected from fraud such as said recharging instruction, to issue data comprising an authentication means, and to take into account the data received only after verification of the authentication means, the latter being adapted to be able to be prepared and verified only if there is known secret information stored at the times in a secure memory of the center and in a memory secure machine with which transmission takes place.

We see that the invention takes advantage of the fact that computerized control centers and electronic franking machines are already provided with means of protection against fraud, and in particular secure memories, that is to say with protected access, in a way that allows the transmission to benefit from these already existing access security, instead of providing additional security specific to the transmission as in the aforementioned prior systems.

The invention therefore makes it possible to avoid the costs associated with these additional securities. In particular, in terms of hardware, portable objects are used and means of writing and reading their memory which are particularly simple and economical since writing and reading from the memory are entirely free.

• à la mise en service de chaque dite machine à affranchir, on réalise une phase d'initialisation dans laquelle on lui attribue de manière secrète un ensemble de nombres aléatoires différents qu'on charge à la fois dans une mémoire sécurisée du centre et dans une mémoire sécurisée de la machine, chaque nombre secret y étant conservé en association avec un index à deux états mis alors dans un premier état ;
• pour transmettre une instruction de rechargement de compteur à destination de cette machine, le centre lit dans sa dite mémoire sécurisée l'un des nombres secrets attribués à cette machine et dont l'index est dans le premier état, il met dans le deuxième état l'index associé au nombre secret lu, et il inscrit dans la mémoire d'un dit objet portatif ledit nombre secret lu ; et
• lorsqu'une machine à affranchir détecte la présence d'un objet portatif dans son moyen de lecture, elle fait celui-ci lire la mémoire de l'objet, elle recherche si le nombre figurant dans les données qu'elle vient de recevoir fait partie des nombres secrets conservés dans sa mémoire sécurisée, et si elle y trouve ce nombre associé à un index dans le premier état, elle met l'index dans le deuxième état, et elle recharge son compteur.

According to preferred features of the invention:

• when each said franking machine is put into service, an initialization phase is carried out in which a secret set of different random numbers is assigned to it, which is loaded both into a secure memory of the center and into a memory secure machine, each secret number being kept there in association with a two-state index then put in a first state;
• to transmit a counter reload instruction to this machine, the center reads from its so-called secure memory one of the secret numbers assigned to this machine and whose index is in the first state, it puts in the second state l 'index associated with the secret number read, and it writes into the memory of said portable object said secret number read; and
• when a franking machine detects the presence of a portable object in its reading means, it does this read the memory of the object, it searches if the number appearing in the data that it has just received is part of the secret numbers kept in its secure memory, and if it finds this number associated with an index in the first state, it puts the index in the second state, and it reloads its counter.

Thus, the authentication means that comprise the transmitted data is the secret number, that is to say an element of the secret information stored in secure memory.

Passing the indexes associated with this number into the second state makes it possible to avoid its re-use, which is necessary since the number may have been revealed to a third party, since the portable object is free reading.

Preferably, for reasons of simplicity, in said initialization phase, the machine is assigned a unique counter reload value, which it takes into account each time it reloads its counter.

According to a more elaborate variant, in said initialization phase, several series of different random numbers are provided, each of which corresponds to a separate counter reload value, the machine, when it reloads its counter, taking into account the value corresponding to the series which includes the secret number she has just received.

• à la mise en service de chaque dite machine à affranchir, on réalise une phase d'initialisation dans laquelle on lui donne un jeu de clefs numériques secrètes pour un algorithme adapté à produire un cryptogramme à partir de données et d'une telle clef numérique, et on charge ces clefs à la fois dans une mémoire sécurisée du centre et dans une mémoire sécurisée de la machine ;
• pour authentifier l'origine d'informations émises par le centre ou par ladite machine, on choisit l'une desdites clefs numériques secrètes, l'émetteur de l'information calcule un cryptogramme avec cette clef, il inscrit dans la mémoire d'un dit objet portatif l'information à transmettre ainsi que le cryptogramme, et lorsque le destinataire de l'information détecte la présence d'un objet portatif dans son moyen de lecture, il fait celui-ci lire la mémoire de l'objet, il calcule un cryptogramme avec la même clef, il compare le cryptogramme figurant dans les données reçues avec celui qu'il a calculé, et ne considère les informations comme authentiques que si le cryptogramme reçu et le cryptogramme calculé se correspondent.

According to other preferred characteristics:

• when each said franking machine is put into service, an initialization phase is carried out in which it is given a set of secret digital keys for an algorithm suitable for producing a cryptogram from data and such a digital key, and these keys are loaded both into a secure memory of the center and into a secure memory of the machine;
• to authenticate the origin of information sent by the center or by said machine, we choose one of said secret digital keys, the sender of the information calculates a cryptogram with this key, he writes in the memory of a said portable object the information to be transmitted as well as the cryptogram, and when the recipient of the information detects the presence of a portable object in its reading means, it makes it read the memory of the object, it calculates a cryptogram with the same key, it compares the cryptogram appearing in the data received with that which it calculated , and only considers the information as authentic if the received cryptogram and the calculated cryptogram match.

The authentication means of the transmitted data that the cryptogram forms here is not directly an element of the secret information, but it can only be obtained by access to the appropriate secret digital key.

The use of such an authentication means is particularly suitable for example for authenticating meter readings of a machine, on the basis of which its user will be billed.

In such a case, the data with which the cryptogram is calculated may be characters appearing in the information transmitted, or else, in particular in the case where the information transmitted comprises relatively few characters, the data with which the cryptogram is calculated are randomly generated characters, which are also written to the memory of the portable object.

• la figure 1 montre de façon schématique un centre de contrôle informatisé ayant la responsabilité d'un ensemble de machines à affranchir électroniques, avec lesquelles il communique conformément à l'invention ;
• la figure 2 est une vue schématique en perspective d'une de ces machines à affranchir, montrée dans une phase d'initialisation ;
• la figure 3 est une vue en plan de la carte à puce qu'on utilise pour transmettre les informations ;
• la figure 4 est une autre vue en perspective de la machine à affranchir illustrée sur la figure 2, montrant la partie externe de son lecteur/encodeur de carte à puce ;
• la figure 5 est une perspective montrant, en agrandissement par rapport à la figure 4, le logement du lecteur/encodeur de carte et certains éléments qui lui sont associés ;
• la figure 6 est une vue partielle en élévation-coupe suivant le plan repéré VI-VI sur la figure 5 ; et
• la figure 7 est une vue schématique en perspective illustrant de façon schématique un terminal télématique pouvant être relié par le réseau téléphonique au centre de contrôle montré sur la figure 1.

The description of the invention will now be continued with the description of an exemplary embodiment given below by way of illustration and not limitation, with reference to the appended drawings, in which:

• FIG. 1 schematically shows a computerized control center responsible for a set of electronic franking machines, with which it communicates in accordance with the invention;
• Figure 2 is a schematic perspective view of one of these franking machines, shown in an initialization phase;
• Figure 3 is a plan view of the smart card used to transmit the information;
• Figure 4 is another perspective view of the franking machine illustrated in Figure 2, showing the external part of its smart card reader / encoder;
• Figure 5 is a perspective showing, in enlargement with respect to Figure 4, the housing of the card reader / encoder and certain elements associated therewith;
• Figure 6 is a partial elevation-sectional view along the plane marked VI-VI in Figure 5; and
• FIG. 7 is a schematic perspective view schematically illustrating a telematic terminal which can be connected by the telephone network to the control center shown in FIG. 1.

The center 1 shown in this last figure, comprises a computer assembly composed of a server computer 2 to which three management computers 3 are connected to each of which is connected a reader / encoder 4 of smart card as well as a printer 5 of labels, a modem 6 directly connected to the computer 2 being connected to a telephone line 7 which is dedicated to it.

The franking machine 8 shown in particular in FIGS. 2 and 4, conventionally comprises a plate 9 for guiding the object on which the franking must be printed by a head 10 situated above the plate 9, and various other usual elements not shown, in particular a keyboard and a balance, as well as internal control and management circuits controlled by a microcontroller provided with postage management software of known type, corresponding for example to that described in the application for French patent 93-04694 belonging to the Applicant.

In addition to these conventional elements, the machine 8 comprises a connector 11 through which one has access to its internal circuits, in order to carry out an initialization operation by connecting these circuits to the computers of the center 1 by means of the cable 12 whose one end has a connector 13 adapted to cooperate with the connector 11, the other end of the cable 12 being directly connected to one of the computers in the center 1, when the initiation operation is carried out on site, or by the via a secure data transmission line when the operation is carried out remotely. In normal service, the connector 11 is hidden by a tamper-proof protective envelope.

The machine 8 also has other elements, described below, which allow it to cooperate with the smart card 14 shown in FIG. 3.

The format of this card, its connector 15 as well as its location comply with those standardized by ISO. It is fitted with a microcircuit (not shown) of the non-volatile, rewritable RAM type, of the EEPROM type, or equivalent. This microcircuit has no logic input protection, which means that reading and writing of data is entirely free on the card 14.

In line with the connector 15, the card 14 has a hole 16 made in its thickness, this hole being covered in certain cases, mentioned below, by a label printed with one of the printers 5 in the center 1, which is glued at the location shown in Figure 3 by the frame 17 in broken lines.

As shown in FIGS. 4 to 6, the franking machine 8 comprises an element 18 for housing the card 14, which opens outwards through a slot 19, the housing 18 being associated, as shown in FIG. 5 , to a connector 20 in two parts which comes into action when the card is pushed all the way, and an electromagnet 21 provided with a plunger 22 ending in a point (see FIG. 6), the plunger 22 being provided, when activated, to pass through the hole 16 of the card 14, and therefore to perforate at the level of the hole 16 the label 23 possibly stuck on the card 14 at the location 17.

In addition to the postage management software of the conventional type mentioned above, the microcontroller controlling the management and control circuits of the machine 8 is also provided with additional software which allows this same microcontroller to manage the various operations in relationship with the transmission of information carried out via the card 14, operations which will now be described.

To initialize the machine 8, a file is opened in the computers of center 1 which contains the references of a user duly listed and authorized to use the machine, and the procedure is carried out as previously indicated to connect a computer of center 1 to the connector 11.

Machine 8 is secretly assigned a set of different random numbers, for example 250 numbers of ten decimal digits, the machine number and the series of 250 numbers are saved in the center folder, and these same data to machine 8, which automatically saves them to permanent (non-volatile) memories, each number being associated, whether in the center folder or in machine memories, with an index which can take at least the states zero and one, and which is set to zero at this point.

The file part of the 250 secret random numbers is stored securely in center 1, so that even during maintenance operations, unauthorized persons cannot access it.

During initialization, a value is also recorded in the center folder and in the machine 8, the counter descending from the machine must be recharged when the latter receives a recharging instruction from the center.

When the initialization operation is finished, the machine 8 is enclosed in its security envelope, which is itself sealed with a tamper-proof seal, and the machine is ready to be put into service.

Once the machine 8 has been installed in the site where it is to be used, it must, in order to function, receive via the card 14 an instruction to reload its descending counter, which is at zero.

This instruction is in fact given by the reception of one of the 250 numbers contained in the memory registers of the machine 8, provided that it has not already been used.

In the embodiment of FIGS. 1 to 6, the transmission of the card 14 containing the instruction authorizing the reloading of the descending counter is ensured by the center 1.

For this, when asked for an authorization, by post or by telephone, the center, after checking that the required conditions are met (payment of funds made, or any other condition), uses one of the readers / encoders 4 to write in the memory of a card 14 a certain amount of information intended to designate the machine for which it is intended, in particular the number of this machine, as well as one of the secret numbers, not yet used (index at zero) , among the 250 that are assigned to this machine, the index of the transmitted number is then set to one to show that it has been used.

In addition, thanks to a printer 5, a self-adhesive label 23 is printed in clear with identification data of the machine for which the authorization is intended, and this label, when the card 14 has been coded, is stuck to the 'location 17 where it closes the opening 16, this label being made with a background printing which allows to recognize the origin and limits the risks of having it replaced with fraudulent intent.

Having thus prepared the card 14, the center 1 sends it, for example by a carrier or by post, to the site where the machine 8 is located, and when it reaches this site, the card 14 is introduced. in the housing 18, the connectors 20 are put into action when the card is fully inserted, the data present on the card are read and communicated to the internal circuits of the machine, these check whether the identification number appearing in the data which have just been received correspond to the identification number which has been assigned to it in the initialization phase, if this is the case, the circuits control the electromagnet 21 so that the plunger 22 descends and then rises , that is to say to move it from its rest position where it is outside the space for receiving the card 14 which opens outwards through the slot 19, to an actuated position where it crosses this space, then to the rest position, so that it perforates the label 23 at the level of the hole 16, the circuits seek whether the number appearing in the data which has just been read is one of the secret numbers kept in its memory registers, and whether the machine finds there this number associated with an index in the zero state, it puts the latter in state one, and it reloads its counter descending from the reload value which has been assigned to it during initialization operations.

The reloading value can naturally vary from one machine to another, having regard to foreseeable consumption or any other consideration, but for a given machine, it cannot be modified remotely.

As a variant, in the initialization phase, several series of different random numbers are provided, each of which corresponds to a separate counter reload value, the machine, when it reloads its counter, taking into account the value corresponding to the series of which is part of the secret number she just received.

In other variants, we use the same method for other counters controlling the use of the machine 8, for example to authorize the machine to operate for a predetermined period, or to authorize it to operate until the ascending counter has reached a value calculated by adding the reload value to the value that this counter had at the time the reload took place.

In view of the fact that the re-use of a secret number is prohibited, counter reloading can only take place, after initialization, a number of times corresponding to the quantity of secret numbers allocated during the phase of initialization, which is 250 in this example. If the machine is still to be used, a new initialization operation should be carried out.

In the description of the embodiment of Figures 1 to 6 above, it is the center 1 which is the transmitter of the information to be transmitted, and the machine 8 which is the recipient or receiver, but it is also possible to have the machine 8 as the sender and the center 1 as the recipient, in particular for transmitting to the latter a reading of the ascending counter or other data stored in the machine 8, for example statistics of use of the various franking slots , the machine 8 transmitting the data to the center 1 for example in response to a command entered by the center on the card at the same time as the counter reloading instruction.

Since the card 14 is free-writing, it is preferable, to be certain that the data read in the center 1 are indeed those which have been recorded by the desired machine 8, to also provide a means of authenticating the data.

Thus, one can for example provide that during the initialization phase of the machine 8, it is given a set of secret digital keys for an algorithm adapted to produce a cryptogram from data and one of the keys in question, these being stored in the file held by the center 1 for the machine 8, in its secure part, and in the memory registers of the machine 8. One of the secret keys being chosen, the machine calculates at from the data it transmits the cryptogram, and writes it on the card at the same time as the data, center 1, after reading the data, redoing the same calculation and checking that the cryptogram it obtains corresponds well to the one on the map.

Naturally, in the event that the data have been modified for a fraudulent purpose, the absence of correspondence between the cryptograms would reveal the fraud.

To choose the one of the keys used for the transmission, one can for example fix a first one during initialization operations, and provide commands that the center can transmit to the machine 8 so that it uses another of the keys that it keeps in memory.

Of course, the authentication cryptogram is calculated by the internal electronic circuits of the machine 8, the algorithm being contained in the additional software with which the microcontroller is provided, this algorithm being for example of the DES type.

The ability to make the machine 8 send data back to the center 1 can in particular be used to proceed, on command, as indicated above, to the ascending meter reading, in order to invoice the machines according to their actual consumption.

It can also be used to check the maintenance of the machines: for this, a card is issued by the center and sent to the organization responsible for maintenance. This card bears the number of the machine to be verified, and a deadline for carrying out the verification. A technician must then go to the machine, insert the card into it, which will record the information requested on the state of said machine. The proof of the intervention will be given by the return of the card in center 1.

It is also possible that the transmitter to be authenticated is the center 1. In this case, if it has no data to transmit or if it is insufficient, it generates a series of characters randomly, it calculates on the basis of these is the cryptogram, and it registers both the series of characters and the cryptogram, the latter being checked on arrival by the machine 8.

In another embodiment, explained below in support of Figures 1 and 7, it is not the readers / encoders 4 provided in the center 1 which are used by the latter to write or read information on the card 14, but the telematic terminal 24 shown in FIG. 7, which is present on a site where a number of machines 8 are located, this site being distant from the center 1. The terminal 24 comprises in a single housing at least one reader / encoder 25 of smart card, of the same kind as the reader / encoder 4 of the center 1 or that which is provided in the machines 8 and which comprises a slot 18 for the card. In addition to the reader / encoder 25, the terminal 24 includes logic control circuits and a modem, and possibly, as in the example shown in FIG. 7, a keyboard 26 and a screen 27.

The logic control circuits are sensitive to the introduction of a card into the reader / encoder 25, recognize the type of card introduced and verify that the card contains the appropriate identification information. According to the information read on the card (see below), the control circuits can initiate the execution of a card reading operation, a writing operation, or even automatically call center 1 at means of the modem to request a transaction, transmit information to or receive it from the center.

In the site where the terminal 24 and the various machines 8 are located, a card 14 is provided per machine, the memory of which includes the identification number of this machine thanks to an initialization carried out by the center 1, without the latter producing a label with the printer 5 or sticking to the location 17, and more generally in the variant using the terminal 24, no label is affixed to the cards 14 used. Apart from this difference, the transmission of information is similar to that of the first embodiment except that the reader / encoder 25 is connected to the computer 2 not by means of a management computer 3, but via the public telephone network 7 and the modem 6.

From the point of view of the user, while in order to obtain an instruction to reload the meter when the card is issued by the center, he must make a request by telephone, mail, fax, or telex, and wait for the card to be created by the center during its opening hours and finally sent to the site by post or carrier, the fact of having a telematic terminal 24 makes it possible to obtain a recharging instruction in a few moments and at any time.

To obtain such an instruction, the card specific to the machine which needs it is inserted into the latter, the card being recognized, the machine 8 will record on its own card 14 its state, and in particular the value of some of its counters, as well as the usage cryptogram.

The user then removes the card from the machine, and introduces it into the terminal. The latter recognizes the card, and calls the center using its modem, the communication passing through the public telephone network 7 and the modem 6 of the center 1, the data transmitted being that which is recorded in the memory of the card 14.

After receiving the data, the center 1 verifies their authenticity using the cryptogram, and if all the conditions are met, it sends a return message containing the data to be entered on the card for constitute a counter reload instruction, and in particular one of the 250 numbers still valid.

The user collects the card from the terminal and inserts it again into the machine, which performs the same operations as described above until reloading its counter, certain data can then be written on the card so that the process can be repeated when it will again be necessary to request a new meter reload instruction.

Many variations are possible depending on the circumstances, and in this regard, it is recalled that the invention is not limited to the examples described and shown.

Claims (10)

Method for transmitting information between a computerized control center (1) and a plurality of electronic franking machines (8), at least so that the center (1) can transmit to each said machine (8) an instruction for reloading counter, method in which the data to be transmitted and received respectively is written or read in a memory of a portable object which is transported between a means of writing the data to be transmitted (4, 18, 25) and a means for reading the data to be received (4, 18, 25), with a said writing means (4, 25) controlled by the center (1) and a said reading means (18) provided in each franking machine; characterized in that portable objects (14) are used where the writing and reading of the data in the memory are free, providing, if information to be protected from fraud is transmitted such as said reloading instruction, to send data comprising an authentication means, and to take into account the data received only after verification of the authentication means, the latter being adapted to be able to be prepared and verified only if secret information is known kept both in a secure memory of the center and in a secure memory of the machine with which the transmission is carried out. Method according to claim 1, characterized in that: - when each said franking machine (8) is put into service, an initialization phase is carried out in which a set of different random numbers is secretly allocated to it and loaded both into a secure memory in the center (1) and in a secure memory of the machine (8), each secret number being kept there in association with a two-state index then put in a first state; - to transmit a meter reload instruction to this machine, the center reads from its so-called secure memory one of the secret numbers assigned to this machine and whose index is in the first state, it puts in the second state the index associated with the secret number read, and it writes to the memory of a said portable object (14) said secret number read; and - when a franking machine detects the presence of a portable object in its reading means, it makes the latter read the memory of the object, it searches whether the number appearing in the data which it has just received does part of the secret numbers kept in its secure memory, and if it finds this number associated with an index in the first state, it puts the index in the second state, and it reloads its counter. Method according to claim 2, characterized in that, in said initialization phase, the machine is assigned a unique counter reload value, which it takes into account each time it reloads its counter. Method according to claim 2, characterized in that, in the said initialization phase, several series of different random numbers are provided, to each of which corresponds a separate counter reload value, the machine (8), when it reloads its counter , taking into account the value corresponding to the series which includes the secret number it has just received. Method according to any one of Claims 1 to 4, characterized in that: - when each said franking machine is put into service, an initialization phase is carried out in which it is given a set of secret digital keys for an algorithm suitable for producing a cryptogram from data and such a digital key , and these keys are loaded both into a secure memory of the center and into a secure memory of the machine; - to authenticate the origin of information sent by the center (1) or by said machine (8), chooses one of said secret digital keys, the sender of the information (1, 8) calculates a cryptogram with this key, he writes in the memory of a said portable object (14) the information to be transmitted as well as the cryptogram, and when the recipient of the information detects the presence of a portable object (14) in its reading means (4, 18, 25), it makes it read the memory of the object (14), it calculates a cryptogram with the same key, it compares the cryptogram appearing in the data received with that which it has calculated, and only considers the information as authentic if the received cryptogram and the calculated cryptogram match. Method according to claim 5, characterized in that the data with which the cryptogram is calculated are characters appearing in the information transmitted. Method according to claim 5, characterized in that the data with which the cryptogram is calculated are randomly generated characters, which are also written into the memory of the portable object (14). Method according to any one of Claims 1 to 7, characterized in that the center controls a means (4, 25) of writing / reading in the memory of the portable object (14), and in that each said machine to be franked (8) comprises such a means of writing / reading (18). Method according to claim 8, characterized in that at least one means (25) of writing / reading controlled by the center (1) forms part of a telematic terminal (24) arranged in a site where a said machine is located franking (8), said terminal (24) comprising means for connecting to the center through the public telephone network (7). Method according to any one of Claims 1 to 9, characterized in that the said portable object is a memory card.

Images