EP1607912B1 - Method and device for opening a security housing - Google Patents

Description

The invention relates to a security housing according to claim 1. The invention is used for franking machines, addressing machines and other printing mail processing equipment with a security housing.

Applicant's thermal transfer postage meter T1000 has a thermal transfer printhead fixedly disposed in the housing for printing a franking imprint. The franking imprint includes previously entered and stored postal information including the postal fee data for carriage of the letter. A compartment attached to the housing serves to accommodate a replaceable ribbon cassette ( US 4,767,228 ). While a door leading to the compartment can be opened at any time, access to the security area of the printing device is prevented by a security housing.

If a franking machine is to be opened for repair purposes, tearing screws of the safety housing must be destroyed. In franking machines and other mail processing devices with a security housing seals or plastic parts can also be used as further access protection to the microprocessor control and to the control lines of the fixed printhead. After a repair that requires the security case to be opened, it is necessary to replace the security housing tear-off screws, seals or plastic parts used for access protection.

Applicant's JetMail® franking machine is equipped with a base and a detachable meter. Only the latter is protected by a suitably trained housing against misuse. The meter includes a controller for controlling the printing and controlling of peripheral components of the postage meter, and a security module equipped with a bill unit and a cryptographic unit for securing postage data to be printed. An encapsulation of the safety module by means of another housing provides additional mechanical protection. In contrast, the housing of the base does not have a protective function and can be designed repair-friendly. The base includes a mail transport device and an ink jet printing device for printing the postage stamp on the mail. Replacing the printhead is unnecessary because the ink tank is separated from the printhead and can be replaced. Also, no special security measures have to be taken for the printhead or for protection of the drive and data signals when a security imprint with a mark is printed with a special piezo inkjet printhead, which allows a verification of the authenticity of the security imprint ( US 6,041,704 ). However, the creation of a false security impression is only made more difficult and not prevented from the beginning.

In franking machines, bubble jet printing heads are also used in the printing module (for example, in the applicant's mymail®, in the Personal Post ™ by Pitney Bowes and the PortoStar by Neopost). The ink tank and bubble-jet printhead are integrated into a replaceable ink cartridge, as it is already known from the ½ inch ink cartridges from Hewlet Packard (HP). The contacting of the electrical contacts of the print head of the replaceable ink cartridge can be done via a connector of a commercial Pen Driver Board's company HP. Because of the easy interchangeability of the ink cartridge by the user, there may be new possibilities for creating a false security print, for example by operating further print modules with print data that are intended only for a specific print module (Replay Attack). Loud US 5,365,312 (Mannesmann AG ), an ink cartridge of the print module has a chip with readable stored identity data to authorize the ink cartridge upon insertion into the print module for printing. Some postal authorities impose stricter requirements for the approval of franking machines, which causes their manufacturers to provide such ink cartridges with additional security measures or to take appropriate protective measures, so that neither indirectly via manipulated ink cartridges or directly on the printing process can be influenced to print franking imprints without paying for it. The franking machine is to exclude the use of a "foreign" ink cartridge. To EP 875 862 A2 read by means of reading the franking machine unique identity data of the ink cartridge and the authorization checked to use the latter in the franking machine. Loud US 5,956,056 (respectively. EP 881 599 A2 ) checks if an ink cartridge is installed. If not, then a billing module for "token" generation is disabled. In addition to purely electronic solutions are already known, which mechanically prevent that inadmissible during printing another print module is controlled with the pressure data. To US 6,102,534 (respectively. EP 875 861 A2 ), a franking machine for franking printing can only be operated if a hatch is closed. Transverse movement means allow the print module with the ink cartridge to move into an area adjacent to the printing area in order to move the printing module Remove or replace the ink cartridge. The hatch located in the safety enclosure can only be opened if the print module with the ink cartridge has been moved to the adjacent area. In the other cases, the hatch is closed by means of closure. To EP 875,865A2 An access to the print module with the ink cartridge is barricaded by means of a hatch and only in response to an authorization signal which picks up the barricade, the hatch can be opened, which allows removal or replacement of the ink cartridge. A direct access to the security area of the device housing is provided in any of the aforementioned solutions.

In the European patent application EP 881 086 A 2 There is proposed a security printing apparatus with a removable printhead which is slidably reciprocated during printing on a pole. Its replacement is possible outside the printing area in a parking position by the print head on the rod sliding laterally moved to the recording medium to the parking position. In this case, a resilient safety means separates the electrical contacts between the print head and control cable when reaching the parking position and restores the electrical contacts after leaving the parking position. After replacing the printhead, the operation of the franking machine is prevented as long as the lid is not fully closed. The lid remains locked during operation of the postage meter, as long as the printhead does not yet resume the parking position. The locking / unlocking is done by an electronic operated shutter.

The invention has for its object to develop a security housing. On the one hand, the user should be given the opportunity to remove or replace an ink cartridge. On the other hand, the user should be denied access to sensitive digital leads for driving the inkjet print head of the ink cartridge.

The object is achieved with the features of the arrangement according to claim 1.

• aus einer Heimposition in eine Druckposition zum Drucken,
• aus einer Heimposition oder aus der Druckposition in eine Entriegelungsposition zum Freigeben des Sicherheitsgehäuses oder des ersten Zuganges zum Sicherheitsgehäuse oder
• in eine Wechselposition zum Wechseln der Tintenkartusche.

Within the security enclosure there is at least one security area and at least one non-security area. Only authorized persons, such as service technicians, are authorized to access both areas. This is based on the consideration that a mechanical release is triggered inside the safety housing. The force of a drive for transverse movement of the print module allows access to the security housing part to remove or replace an ink cartridge.
It is further contemplated that upon a mechanical release of the access to the security housing, a control of an ink jet print head of an ink cartridge is prevented. It is advantageous if it can be determined by a sensor that a mechanically released access for changing an ink cartridge has been locked again before the operation of the postal device. The printing module can basically be traversed by means of transverse movement:

• from a home position to a print position for printing,
• from a home position or from the printing position to an unlocking position for releasing the security housing or the first access to the security housing or
• in a change position for changing the ink cartridge.

The print position and the unlock position form the endpoints of the travel of the print module with the ink cartridge change position between the print position and the unlock position or the home position and the unlock position.
The print module may first be moved in the X direction to the unlock position and then opposite to the X direction to the ink cartridge replacement position. Thus, on the one hand the locking of the safety housing is mechanically released directly or an unlocked state of access to the safety housing is present.

• Figur 1a, perspektivische Ansicht einer Frankiermaschine mit Klappe,
• Figur 1b, perspektivische Ansicht eines abnehmbaren Gehäuseoberteils,
• Figur 2, perspektivische Ansicht einer Chassisanordnung in gesprengter Darstellung,
• Figur 3, Schutzummantelung für einen Bandleiter,
• Figur 4, Sicherheitsgehäuseteil zum Verwehren und Schutzanordnung zum Beschränken des Zuganges in das Innere zum Wechseln einer Tintenkartusche.

On the other hand, with a print module parked in the change position, an ink cartridge can be removed or replaced.
It is provided that an access is mechanically released by a transverse movement of the printing module in the unlocking position, which is accessible for changing an ink cartridge.
It is envisaged that the inkjet printhead is part of a postal ink cartridge having electrical and mechanical features that distinguishes it from the usual ink cartridges, the special features for automatic and / or easy recognition of the postal ink cartridge by the postal device and / or by the Users are trained. Further electronic and mechanical protective measures are provided in connection with the printing module, which must be brought into a predetermined change position to allow replacement of the ink cartridge.
The access to change an ink cartridge is already released mechanically when the print module traverses the change position in the transverse movement or if only a transverse movement of the print module takes place until the change position, ie when an unauthorized person a transverse movement of the print module, for example, before operating the postal device for franking mailpieces triggers. The user thus only has access to non-safety areas of the device, for example for changing consumables, such as franking strips or ink cartridges, for changing the battery. In the upper part of the postage meter, there is a corresponding opening for changing the ink cartridge. After entering an (unauthorized) signal, the print carriage is moved with the ink cartridge to a change position, from which the ink cartridge can be removed or replaced. For the user, a flap is provided which covers the aforementioned opening. The flap may be opened at least if the print carriage has been moved to the ink cartridge change position or to the adjacent additional unlock position. Alternatively, the flap is not part of the security housing and / or can be opened or removed at any time. When the print carriage for printing in is brought a printing position, a cap prevents access to the control lines during printing. The protective cap is attached to the carriage and closes the aforementioned opening in the housing, according to the movement of the carriage in the direction of the printing position. In any other position in which the print carriage can be brought, the aforementioned opening is not or not completely closed by the cap.
Alternatively, it is provided that a security housing part denies the user a first access to the interior of the mail processing device and a releasable further locking means which is disposed on a located inside the security housing wall of a housing base or upper part of the security housing to ver the security housing to ver - Or unlock that the safety housing part at least one mechanical locking element is arranged, which is equipped with a hook nose at the end of a resilient extension arm, which is engageable with the aforementioned located inside the security housing wall, wherein the safety housing part is removable only by visible destruction in that the security housing upper part has an opening which allows the user, for changing an ink cartridge, a limited second access to the inside of the mail processing device, that the Ö can be closed by a flap which is equipped with a stopper, which operates when opening the flap a switch which is located inside the safety housing, whereby the power supply to a motor of the transverse movement means of the printing module is interrupted and that at the printing module a protective cover and a Protective cap for preventing unauthorized access to the band conductor and on the control electronics unit are attached.
Advantageous developments of the invention are characterized in the subclaims or are presented in more detail below together with the description of the preferred embodiment of the invention with reference to FIGS. Show it:

• FIG. 1a , Perspective view of a franking machine with flap,
• FIG. 1b , perspective view of a removable housing top,
• FIG. 2 , perspective view of a chassis assembly in exploded view,
• FIG. 3 , Protective coating for a strip conductor,
• FIG. 4 , Security housing part for defense and protection arrangement for restricting access to the interior for changing an ink cartridge.

The FIG. 1a shows a perspective view of a franking machine with a removable housing upper part 2, which is arranged in the Y direction over a housing lower part 1. The front side 25, the incoming mail side 27 and the mail exit side (not visible) of the housing upper part 2 have a slot-shaped opening 21 for a postal item to be franked, which can be fed in the Z direction. The upper side of the housing has an inclined surface 22 towards the front side 25, which is suitable for receiving a user interface (not shown). On the housing upper side 23, which adjoins the inclined housing surface 22 in the X direction, a lid-shaped flap 3 is arranged. The housing rear side 26 is suitably designed to receive a locking means which can lock or unlock the housing parts 1, 2. The cut surface A located in the XY plane is only in the Fig. 1a located.

The FIG. 1b shows a perspective view of the removable housing upper part 2 with the slot-shaped opening 21 on the front side 25, the mail entrance side 27 and the mail exit side (not visible) of the housing top 2, with the housing back 26, with the inclined housing surface 22 and the housing top 23. The latter is shown without the flap and has an opening 24 which is bounded by the inclined housing surface 22. In addition, at least one releasable safety housing part 4 may be provided, which must be released before the housing upper part 2 is removable.
The removable housing upper part 2 is open at the bottom and has an identically formed circumferential edge B2, with the exception of the edge H2 on the front side. Before the upper housing part 2 can be removed, an authorization check must be carried out by the franking machine or meter of the franking machine or via postage meter or meter through a remote data center. The authorization check can advantageously take place by means of the data center and the control unit of the franking machine. The control unit can distinguish between authorized opening (service, inspection) and unauthorized opening (tampering), in connection with the data transmitted by the data center and a signal detected by a sensor, such as the following: Method for improving the security of postage meters Manipulation, im EP 969 421 A2 (or im US 5,671,146 ) has already been described.

Look for one in the FIG. 2 In a perspective view of a chassis assembly shown in exploded view, a mechanical protection of a printed circuit board is shown, which is arranged in the inner security area of a franking machine and carries a control unit of the Fankiermaschine. An upper shell 15, which is correspondingly shaped for protection and support purposes, is disposed above a lower shell 13, which is formed for protection and support purposes, and a printed circuit board 14 on which the components of the inner security area are interconnected. The chassis shells 13 and 15 may comprise a group of arranged in a row outer ventilation openings, which are preferably slot-shaped incorporated on the outer edge. The lower shell 13 consists of a parallel to the lower housing part 1 shielding and support plate 131 and a rear side of the housing rear side 26 parallel angled shielding and support plate part 136, which has at least openings for the power supply via a mains plug cable and for the discharge of a heated air flow to the outside. The safety-related components arranged on the printed circuit board 14 are covered in a box-like manner by the chassis components in the assembled state. In the assembled state, the printed circuit board 14 is located on the front side of the skirt 134 of the lower shell 13. On the circuit board 14, the chassis upper shell 15 is supported with its side walls.
The upper chassis shell 15 is limited poststromein- or post-stream exit side by a respective side wall 157 and 158 and by a front side wall 155 and by a side wall 152 parallel thereto. An inner cavity is divided into a lower cavity 50 and an upper cavity 60 by a plate 156 lying parallel to the shielding and support plate 131. The lower cavity 50 is provided for receiving an inner security area control electronics for printing. The upper cavity 60 is provided for receiving a pressure mechanism for the mailpiece transport. In addition, a box 159 is arranged on the upper chassis shell 15, which extends, for example, in the X direction to the rear wall 29 of the housing. If the box 159, as shown, a box bottom 1590, then in the latter at least one opening 1591 for electrical cables of the circuit board 14 in the form of a strip conductor 34 is provided. Above the chassis upper shell 15 is a support frame 10 ( Fig. 3 ) arranged as another chassis part for supporting the printing mechanism.

The FIG. 3 shows a protective sheath 9 for a strip conductor 34, which is guided from the chassis assembly through the support frame 10 to a drive electronics unit 38 (not shown). The support frame 10 has postflow on the output side limited by side walls rectangular boxes with a bottom plate 100. The latter has opposite to the X direction near the front an opening 101 for the - not shown - pressure mechanism for the carriage of a mail item in the transport direction Z on.

The protective casing 9 consists of a flattened piece of hose 94 and merges at the one end into a cap 90 for covering the control electronics unit 38. The tube piece 94 is designed to receive a strip conductor 34 and preferably has a releasable positive connection with the cap 90, which is designed for strain relief. For example, a bead-shaped collar 95 is formed on the tube piece 94 and the cap 90 has a hidden opening 91 for the passage of the tube piece 94 through the cap 90 from the side of the control electronics unit 38 to the side of the circuit board 14 hinführend. The cap 90 is adapted for attachment to the printing module 30, the means for attachment being arranged so that the latter are inaccessible from access through the opening 24. The cap 90 has, for example, side walls 92, 93 with an opening 96. A screw 97 which can be screwed into the opening serves for fastening to the printing module 30.
The protective sheath 9 leads at the other end to a cover plate 99, which is fastened to the support frame 10 and which is designed for strain relief and for covering the openings in the upper chassis part 15. The - not shown - means for fixing the cover plate 99 on the support frame 10 are also arranged inaccessible from access through the opening 24. A slot-shaped opening 98 in the cover plate 99 is provided for the passage of the hose piece 94, wherein the cover plate 99 is formed in the opposite direction to the Y direction for strain relief. The tubular piece 94 is positively and non-positively connected to the cover plate 99, for example, by a special shape or S-shaped passageway between the cover plate 99 and the box bottom 1590 of the box 159 of the upper chassis shell 15. The hose piece 94 is made for example of a particularly resistant plastic and is flexible.
Alternatively, cover plate 99 and cap 90 can already be formed on the protective casing 9 during production and made of the same material.

In the FIG. 4 a variant embodiment is shown, with a security housing part 4 ', which denies the user a first access to the inside of the mail processing device and with a protective arrangement 8', 9 ', 33', which at any time grants a second limited access for changing an ink cartridge. The safety housing part 4 'covers a releasable further locking means, which is arranged on a wall located in the interior of the safety housing, for example, the housing upper part to manually lock or unlock the safety housing. The releasable further locking means is for example a screw 16 'which can be inserted into the support frame 10' or into a chassis part. The safety housing part 4 'at least one mechanical locking element 43' is arranged, which consists of a resilient extension arm with a hook nose 432 'at its end, which is engageable with the aforementioned wall located in the interior of the safety housing, wherein the safety housing part 4' only by visible destruction is removable. The safety housing part 4 'preferably has an access protection panel 41' and guiding and locking elements 42 ', 43'.
In combination with this alternative embodiment, it is further provided that the safety housing upper part has an opening 24 ', which allows the user to change an ink cartridge 31', 32 'a second access to the interior of the mail processing device, that the opening 24' closed by a flap is, which is equipped with a stop 39 'which actuates when opening the flap a switch 8', which is arranged inside the safety housing, wherein the power supply to a motor 5 'of the transverse movement means of the printing module 30' is interrupted.

When opening the flap 3 ( Fig. 1 a) For example, a microswitch is used as the switch 8, which is arranged inside the safety housing and connected to the printed circuit board 14 (FIG. Fig. 2 ) is electrically connected.

The latter carries the control electronics for printing, for example, with a franking machine and can interrupt the power supply of a motor 5 'of the transverse movement means of the printing module 30' in order to prevent the printing module 30 'from transverse movement. The motor 5 'is connected to the circuit board in terms of control. In a sub-variant of the motor 5 'is electrically connected via the switch 8' to the circuit board and can be switched directly de-energized when the door is opened. The ink cartridge 31 ', 32' can not be replaced only in the one case when the latter has been positioned near the printing position or directly in the latter. In any other case, with the transversely movable printing module moved to a position out of print position and the flap then opened, an ink cartridge 31 ', 32' positioned in the region of the opening 24 'can be replaced. An empty or incapable ink cartridge 31 ', 32' can be replaced at any time. To protect against manipulation of the franking machine via the opening 24 'and to cover the control electronics unit 38' from above, the protective cap 33 'prevents access to the ribbon conductor 34' and the control lines in the control electronics unit 38 '. In any position in which the printing module 30 'can be brought and access to the tape conductor 34' and the control lines would be possible, the aforementioned opening 24 'is at least partially or completely closed by the protective cap 33'.

The invention is not limited to the present embodiments. Rather, a number of variants within the scope of the claims is conceivable. Thus, obviously other other embodiments of the invention can be developed or used, starting from the same basic idea of the invention, which are encompassed by the appended claims.

Claims (7)

1. Security housing of a printing postal-item processing appliance equipped with a mechanical locking device, with a print module (30) arranged in manner transversally movable in relation to the postal-item transport direction (Z) by means of transverse movement means (5'), characterized in that there is provided a security housing part (4) that bars the user from a first access to the inside of the postal-item processing appliance and covers an unlockable further locking means arranged inside the security housing on a wall of a lower housing part (1) or an upper housing part (2) of the security housing for manually locking or unlocking the security housing, that there is arranged, on the security housing part (4'), at least one mechanical locking element (43') provided with a hook nose on the end of a spring-mounted extension arm that can be engaged with the aforementioned wall located inside the security housing, wherein the security housing part (4') can only be removed by visible destruction, that the upper housing part (2) has an opening (24) allowing the user a limited second access to the inside of the postal-item processing appliance for exchanging an ink cartridge, that the opening (24) can be closed by a flap (3) provided with a stop (39') that, when the flap (3) is opened, operates a switch (8') arranged inside the security housing, wherein the power supply of a motor (5') of the transverse movement means of the print module (30') is interrupted, and that, for preventing unauthorized access to a strip conductor (34) and to an electronic control unit (38'), a protective sheathing (9) and a protective cap (33') are fixed on the print module (30'), wherein, in every position to which the print module (30') may be moved and where access to the strip conductor (34') and the control lines would be possible, said opening (24') is closed by the protective cap (33') either in part or completely.
2. Security housing according to Claim 1, characterized in that the protective sheathing (9) comprises a piece of tubing (94) on the ends of which there are fixed a cover plate (99) and a cap (90), said cap (90) being shaped for preventing unauthorized access to the electronic control unit (38).
3. Security housing according to Claim 1, characterized in that the piece of tubing (94) is shaped for accommodating the strip conductor (34) and is made of a plastic material that is particularly resistant and flexible.
4. Security housing according to Claim 1, characterized in that the piece of tubing (94) has a separable positive connection to the cap (90) that is designed as pull relief, that cap (90) is designed for fixing to the print module (30'), wherein the fixing means are arranged in such a manner that the latter are not accessible from the access through opening (24).
5. Security housing according to Claim 1, characterized in that the protective sheathing (9) comprises a piece of tubing (94) on the ends of which a cover plate (99) and a cap (90) made of the same material are fixed by forming in the manufacturing process.
6. Security housing according to Claim 1, characterized in that the cap (90) and the cover plate (99) are shaped for passing through the piece of tubing (94) and for pull relief.
7. Security housing according to Claim 1, characterized in that the switch (8') is a micro switch.

Images