GB2270500A

GB2270500A - Shielded franking machine

Info

Publication number: GB2270500A
Application number: GB9219391A
Authority: GB
Inventors: Cyrus Abumehdi; Raymond John Herbert; Daniel John Lee
Original assignee: Neopost Ltd
Current assignee: Neopost Ltd
Priority date: 1992-09-14
Filing date: 1992-09-14
Publication date: 1994-03-16
Anticipated expiration: 2012-09-14
Also published as: GB9219391D0; DE9313749U1; GB2270500B; FR2695746B3; FR2695746A3

Abstract

A franking machine is provided with a shield (22) to prevent X-ray radiation being used to destroy information stored in memory of the franking machine, and to prevent non-invasive inspection of the interior of a secure housing of the franking machine. An indicator 25, which is not protected by the shield, may be provided to indicate if the franking machine has been subjected to X-ray radiation. The indicator is preferably located behind a sealed door to prevent unauthorised access to the indicator. <IMAGE>

Description

FRANKING MACHINE AND PROTECTION THEREOF This invention relates to franking machines and in particular to the protection of franking machines from both invasive and non-invasive tampering.

Currently known franking machines use electronic circuitry for carrying out accounting and control functions in the machine. The circuitry includes non-volatile memories and maintains account records relating to the amount of credit with which the franking machine is funded at any instant and the usage of that credit in carrying out franking operations to print franking impressions on mail items.

The carrying out of the accounting functions and the storage of account records in the memories is relied upon for accounting for payment from the user of the franking machine to the postal authority in respect of postage value used in franking mail items. Thus the postal authority requires to be assured that values of postage charge printed in franking impressions on mail items are properly accounted for in the account records stored in the franking machine. In particular it is required by the postal authorities that attempts to tamper with operation of the franking machine, which would permit printing of franking impressions for which proper accounting did not take place or printing of franking impressions for a higher value of postage charge that for which accounting is effected, are prevented.

In order to prevent undetected tampering, the electronic circuits are housed within a secure ;hovusing and access to the interior of the housing is permitted only by postal authority personnel or authorised 'service agents.

Security devices such as interlocks, switches and detectors are usually provided which, in the event of the occurrence of unauthorised access to the interior of the housing, operate not only to prevent further operation of the franking machine to print franking impressions but also to provide an indication that such unauthorised access has occurred. Clearly it is desirable that the location of such security devices in the secure housing is not known to unauthorised persons because knowledge of the location of such devices may assist in by-passing or rendering inoperative the security devices.

According to one aspect of the present invention a franking machine includes electronic circuits for carrying out accounting functions and for storing accounting data in a non-volatile manner and a secure housing containing said electronic circuits; said housing comprising a wall effective to prevent physical access to said electronic circuits from the exterior of the housing and a screen located within the housing or included in said wall of said secure housing and extending such as to prevent passage of high energy radiation through the housing.

According to another aspect of the present invention a franking machine includes electronic circuits for carrying out accounting functions and for storing accounting data in a non-volatile manner and a secure housing containing said electronic circuits; said housing comprising a wall effective to prevent physical access to said electronic circuits from the exterior of the housing and indicator means operative to provide an indication of subjection of the franking machine to high energy radiation.

According to a further aspect of the invention a method of preventing non-invasive access to components of a franking machine housed in a secure housing of the franking machine using high energy radiation comprising providing a barrier of material substantially opaque to said radiation located and extending such as to prevent or inhibit inspection of said components by passage of said radiation through said components.

An embodiment of the invention will now be described by way of example with reference to the drawing which is a diagrammatic block representation of a franking machine in accordance with the invention.

Referring to the drawing, a franking machine comprises electronic circuits including a micro-processor 10 to which is connected a keyboard 11 for entry of command and data signals to the micro-processor. A display device 12, such as an LED display, is connected to the microprocessor to enable an echo of input on the keyboard and information relating to operation of the franking machine to be displayed to assist a user in the operation of the franking machine. Non-volatile memory devices 13, 14 are provided for the storage of accounting data.Generally the accounting data comprises a credit value stored in a descending register, an accumulated value of postage used in franking operations stored in an ascending register, a count of items franked stored in an items register and a count of items franked with a value of postage charge in excess of a predetermined value stored in a high items register. Each register is implemented in duplicate in each of the memory devices 13, 14. Accordingly if due to a fault, the value stored in one of the implementations of a register is incorrect and differs from the value stored in the other implementations of that register, the true value can be ascertained and the integrity of the stored account data can be restored and maintained.The microprocessor operates under control of program routines stored in a read only memory (ROM) 15, operation under a program routine to perform for example a franking operation or, under a different routine, to effect refunding of the machine by resetting the credit value in the descending register being initiated by a command signal input on the keyboard corresponding to the required operation to be performed. The circuit elements described hereinbefore are housed in a secure housing 16 to prevent unauthorised access to the circuit elements and in particular to the micro-processor and memory devices.

A printing device 17 is controlled by the micro-processor to print franking impressions. The control of the printing device by the micro-processor includes controlling the device to print a franking impression having a value of postage charge selected by entry on the keyboard and for which accounting operations are carried out by the microprocessor. The printing device may consist of a mechanical printing device such as a drum printer having a print die to print fixed information and settable print wheels for printing postage value in the franking impression. The print wheels are set by mechanisms operated by the microprocessor such as to set the wheels to print the value of postage charge selected by input on the keyboard 11.Alternatively the printing device may be a digital printing device comprising a plurality of printing elements which are selectively operated to build up a printed franking impression on a mail item. Usually such printing elements are arranged in a row and are repeatedly selectively operated to build up the franking impression line by line as the mail item is fed past the row of printing elements. Digital printing devices of include ink jet and thermal printing elements, the latter effecting printing by thermal transfer of ink from a ribbon to a surface of the mail item. To as large an extent as possible the printing device is housed within the secure housing 16. However because it is necessary for the printing device to be able to transfer ink to the mail items the housing has an aperture in the vicinity of the printing device and for example when a thermal transfer printer is used the thermal elements are disposed externally of the secure housing.

Refunding of the franking machine by resetting the credit value in the descending register may be effected remotely by setting up telephonic communication with a remote resetting data centre operated by a postal authority or other service agency or by taking the franking machine to the postal authority. When resetting of the franking machine is effected by communication with a remote data centre, an inputtoutput interface 18 having a connector 19 extending to the exterior of the secure housing is utilised to provide communication between the microprocessor 10 and a telephone network connected to the connector 19.When resetting is carried out directly on the franking machine at the postal authority premises, an authorised postal authority employee operates a switch 20 to cause the franking machine to operate in a resetting mode which enables the microprocessor to add a credit value input on the keyboard to that which is stored in the descending register. To prevent unauthorised resetting of credit in the descending register, the switch 20 is located in a compartment 24 behind a locked door 21 in the housing. Franking machines are usually designed such that any illegal or unauthorised access to the circuits and/or mechanisms housed in the secure housing is not possible without leaving evidence that such tampering or attempted tampering has occurred.Thus, the door 21 is provided with a tamper indicating seal or other means to provide an indication of the door having been opened and hence when the franking machine is taken for resetting the postal authority employee would be alerted to a tampering attempt having occurred previously and thus investigate if any fraud has occurred or been attempted.

It is possible that the account data stored in the memories could be vulnerable to erasure if subjected to high energy radiation such as X-rays. If all the account data is erased it would not be possible to determine the extent of use of the franking machine subsequent to the last time that the account data was read from the registers in a credit resetting operation and the postal authority could suffer a financial loss of the total value of postage charge used subsequent to that time.

Furthermore it may not be apparent that the loss of data had occurred due to intentional subjection of the franking machine to such radiation.

Another risk to security of the account data and to ensuring operation of the franking machine with proper accounting for value of postage charge used, is that by the use of high energy radiation, for example X-ray photography, the locations and form of security devices could be determined prior to attempting to gain access to the interior of the secure housing. Knowledge of the devices and locations thereof would be likely to be beneficial to anyone trying to gain illegal access to the circuits and/or mechanisms within the secure housing.

With this knowledge, anyone intending to tamper with the franking machine may be assisted in finding a method of gaining access to the circuits and/or mechanisms of the r franking machine which does not leave evidence of tampering or attempted tampering and hence such access would be undetected by the postal authority.

In order to protect the security of the franking machine and of the account data stored therein from invasion by such high energy radiation, a screen or barrier 22 which is substantially opaque to that radiation is provided.

The screen 22 extends over the inner surface of the walls of the secure housing 16. Where the walls of the housing have apertures for circuit elements to extend to the exterior of the housing, for example in the vicinities of the keyboard 11, the display 12, the printing device 17 and the connector 19, the screen may include portions 23 extending behind these elements. Thus although these particular elements are not protected from the radiation, the security sensitive accounting circuits and account storage registers are protected. It will be appreciated that generally the housing is constructed in two or more parts secured together and separate parts of the screen would be provided on each part of the housing such that when the parts of the housing are secured together the parts of the screen mate together and maintain continuity of the screen.In order to protect against X-ray radiation the screen would comprise a sheet or layer of lead on the inner surface of the walls of the secure housing. Generally the sheet or layer is 15 thousandths of an inch thick to provide a desired level of protection.

However different thicknesses of screen material may be used depending upon the strength of radiation against which it. is desired to protect the franking machine. The provision of screening as described hereinbefore would provide not only protection against invasion from intentionally applied external radiation such as X-rays but would also provide the protection required against normal radiated interference, that is to say against interference radiated from the franking machine and interference radiated by other equipment which may unintentionally interfere with operation of the franking machine.

In addition to or instead of providing a screen to protect the security of the franking machine and account data stored therein, indicator means 25 may be provided to detect if the franking machine has been subjected to radiation. The indicator means may comprise a film sensitive to the radiation and for example mounted in the form of a badge such as that worn by personnel working in areas where they may be exposed to hazardous radiation.

Conveniently the indicator badge may be located in the compartment 24 behind the door 21 thereby preventing unauthorised replacement of the indicator. Clearly if the indicator is located in the compartment 24 to the rear of the door 21, the screen 22 extends to the rear of the compartment so that the compartment and the indicator badge therein would be exposed to any radiation.

Claims

1. A franking machine including electronic circuits for carrying out accounting functions and for storing accounting data in a non-volatile manner and a secure housing containing said electronic circuits; said housing comprising a wall effective to prevent physical access to said electronic circuits from the exterior of the housing and a screen located within the housing or included in said wall of said secure housing and extending such as to prevent passage of high energy radiation into or through the housing.

2. A franking machine including electronic circuits for carrying. out accounting functions and for storing accounting data in a non-volatile manner and a secure housing containing said electronic circuits; said housing comprising a wall effective to prevent physical access to said electronic circuits from the exterior of the housing and indicator means operative to provide an indication of subjection of the franking machine to high energy radiation.

3. A method of preventing non-invasive access to components of a franking machine housed in a secure housing of the franking machine using high energy radiation comprising providing a barrier of material substantially opaque to said radiation located and extending such as to prevent or inhibit inspection of said components by passage of said radiation through said components.

4. A method of preventing inspection of components of a franking machine housed in a secure housing by using X-ray radiation directed through the housing, said method comprising providing a screen substantially opaque to Xrays and located to prvent or inhibit passage of said Xrays through said components.

5. A franking machine as claimed in claim 1 wherein said screen comprises a sheet or layer of material disposed on an inner wall of the secure housing.

6. A franking machine as claimed in claim 1 or 5 wherein the material of which the screen is formed is lead.

7. A franking machine as claimed in claim 1 or any one of claims 4 to 6 including indicator means operative to provide an indication of subjection of the franking machine to high energy radiation.

8. A franking machine as claimed in claim 2 or 7 wherein said indicator means is located within the secure housing.

9. A franking machine as claimed in claim 8 wherein access to the indicator means is provided only via lockable or sealable access means.

10. A franking machine constructed and arranged to protect components thereof from radiation substantially as hereinbefore described with reference to the drawing.

11. A method of protecting components of a franking machine substantial as hereinbefore described with reference to the drawing.