Method and apparatus for a modular postage accounting system

Abstract

Apparatus and method for a modular postage accounting system. An open system metering device of the present invention includes a general purpose computer, a digital printer and a secure metering device (SMD). The SMD performs the accounting functions of a postage meter and generates encrypted postage indicia data for transmission by the computer to the digital printer and subsequent printing on a mailpiece by the digital printer. Postage credit data can be entered into the SMD using a computerized meter resetting system just as it is in a conventional postage meter.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

The following three commonly-owned copending applications, including this one, are being filed concurrently and the other two are incorporated by reference into this application:

Inventors Chandrakant J. Shah and D. T. Gilham, entitled “METHOD AND APPARATUS FOR AUTHENTICATION OF POSTAGE ACCOUNTING REPORTS” U.S. patent application Ser. No. 08/561,662, filed Nov. 22, 1995,

Inventors Chandrakant J. Shah and Keith B. Robertson, entitled “METHOD AND APPARATUS FOR REDUNDANT POSTAGE ACCOUNTING DATA FILES” U.S. patent application Ser. No. 08/562,143, filed Nov. 22, 1995;

Inventors Chandrakant J. Shah and Keith B. Robertson, entitled “METHOD AND APPARATUS FOR A MODULAR POSTAGE ACCOUNTING SYSTEM” U.S. patent application Ser. No. 08/562,268, filed Nov. 22, 1995

BACKGROUND OF THE INVENTION

The present invention relates generally to a method and apparatus for a modular postage accounting system. More specifically, the present invention allows the printing of postage using any computer having the proper communications and printing capabilities.

Historically, postage meters have been dedicated, stand-alone devices, capable only of printing postage indicia on envelopes (or labels, in the case of parcels). These devices resided at a user site and could provide postage metering for that site alone. Such postage meters required the user to physically transport the device to a post office for resetting (increasing the amount of postage contained in the meter). An advance over this system was the ability to allow users to reset their meters via codes, provided by either the manufacturer or the postal authority once payment by the customer had been made. In contrast, modern electronic meters are often capable of being reset directly by an authorized party, on-site (at the user's location) via a communications link. A system which performs meter resetting in this manner is known as a Computerized Meter Resetting System (or “CMRS”). The party having authority to reset the meter and charge the customer (usually the manufacturer or the postal authority) thus gains access to and resets the meter.

Postage meters are still, unfortunately, restricted to use at a single customer location. As such devices are dedicated (and rather sophisticated in their fail-safes and security), their price tends to be prohibitive for small companies. What is needed is a system which can be connected to existing computer equipment to allow the efficient, economical printing of postage indicia. Such a system would provide postage at a user's location at the user's request.

SUMMARY OF THE INVENTION

According to the present invention, an apparatus and method are described for a modular postage accounting system (MPAS). As will be discussed, many configurations are possible, due to the modularity of the system.

In one embodiment of the present invention, an open system metering device of the present invention consists of a general purpose computer, a digital printer and a secure metering device (SMD). The SMD performs the accounting functions of a postage meter and generates encrypted postage indicia data for transmission by the computer to the digital printer and subsequent printing on a mailpiece. Postage credit data can be entered into the SMD using a CMRS just as it is in a conventional postage meter. This configuration requires the user to maintain a special item of hardware (the SMD) in order to print postage purchased via the CMRS.

In another embodiment, the present invention eliminates that requirement by embedding the SMD functions within the CMRS computer system. A user who has obtained the required license from the postal service can contract with the meter company to interface the user's general purpose computer to the CMRS computer via modem and telephone line. In effect, this provides the postage meter function on a service basis. This has the advantage of simplifying resetting and accounting procedures for the user and eliminates the leasing or housing of any special equipment. Also eliminated is the need to present metering equipment for postal inspection. It also enables one SMD to handle multiple sites in a common account, to accommodate multi-site users that have centralized accounting functions. This last capability has never been possible within the architecture of past or present postage metering systems.

The present invention uses the telephone system to link the user's standard general-purpose computer to a dedicated central-office CMRS computer system. One or more SMD modules may be either attached to or embedded in either the user's computer or the CMRS computer. A single SMD module may an be dedicated to a specific user or it may serve a number of computers. Multiple computers may be placed at one or more sites and multiple sites may be geographically separated. Each SMD module performs all the data storage and accounting functions of a conventional postage meter, and transmits encrypted indicia data for printing. By virtue of the SMD's central location in the system, it automatically consolidates postage accounting data relevant to all the sites it serves. Such data may also be separated so as to report on individual sites. This functionality, too, is unique to the present invention.

The CMRS validates requests from users, and having done so transfers funds from the user's bank account to the postal service's receiving account. The CMRS then either resets the user's postage metering device with the prepaid amount directly, or issues a one-time code to let the user accomplish the reset using the computer's keyboard. In the present invention, this resetting process can be done within a few seconds (in real-time), allowing for near-continuous processing of mail by the user. The CMRS is in constant communication with each SMD, and validation of a reset order can be reduced to a single keystroke, if desired. Once validated by the user, the remainder of the transaction is done by the CMRS/SMD system without further operator intervention.

The present invention allows a multi-site user's individual sites to process mail continuously, with payment to the post office and replenishment of credit handled through central accounting facilities. As long as the user's central accounting facility maintains adequate fund reserves, the individual sites have access to an on-line service which provides postage on an as-needed basis. The need for individual cash accounts to prepay on-site postage meters is thus eliminated, realizing an improvement in corporate cash-flow and better control of the user's funds.

A further understanding of the nature and advantages of the present invention may be realized by reference to the remaining portions of the specification and the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is a diagram showing a specific embodiment of the present invention;

FIG. 1B is a diagram showing an example of a secure communications link between a general purpose computer and a secure metering device;

FIG. 2A is a diagram showing an example of a postage indicium produced by the present invention with postage information symbology located inside the postage indicium;

FIG. 2B is a diagram showing an example of a postage indicium produced by the present invention with postage information symbology located outside the postage indicium;

FIG. 2C is a diagram showing an example of a postage indicium produced by the present invention without postage information symbology;

FIG. 3 is a diagram showing an enlarged example of a postage indicium produced by the present invention with postage information symbology located inside the postage indicium;

FIG. 4 is a diagram showing an example of a secure metering device (SMD);

FIG. 5 is a diagram showing an example of an SMD having a network interface and printing capabilities;

FIG. 6 is a diagram showing second specific embodiment of the present invention, wherein the SMD is connected to a resetting station computer;

FIG. 7 is a diagram showing a third specific embodiment of the present invention using a local area network for the communications medium;

FIG. 8 is a diagram showing a fourth specific embodiment of the present invention using a local area network for the communications medium; and

FIG. 9 is a diagram showing an auditing system for preventing the printing of fraudulent postage indicia.

DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 1A is a diagram showing an MPAS 1 designed according to the present invention. MPAS 1 consists of three major components: a CMRS 105 , a ZIP-code information system (ZCIS) 191 and an open system metering device (OSMD) 5 . The first component, CMRS 105 , is a system based on modem communications between a modern electronic postage meter (not shown) and a resetting station computer 120 . Well known in the art, the operation of CMRS 105 is the subject of government standards and, while CMRS 105 's interaction with OSMD 5 will be discussed later, the operation of CMRS 105 will not be treated in detail here. The second component, ZCIS 191 , provides computer access to U.S. ZIP-codes and international postal codes. ZCIS 191 is a commercially-available system, with some 150 installations in the U.S. As such, the operation of ZCIS 191 will not be treated in detail either. However, the interaction between ZCIS 191 and OSMD 5 will also be discussed later. The final component, OSMD 5 , performs all of the functions traditionally associated with conventional postage meters and may include a secure metering device (SMD) 10 , a general purpose computer (GPC) 20 , an electronic scale 40 and a digital printer 60 . SMD 10 performs the accounting functions generally associated with the traditional postage meter. SMD 10 generates encrypted postage indicia for transmission by the computer to digital printer 60 , where it is subsequently printed on a mailpiece (exemplified by a mailpiece 100 ).

According to the invention, FIG. 1A shows SMD 10 attached to GPC 20 via a secure communications link 30 . Secure communications link 30 may be any mechanism for transferring information that is impervious to unauthorized interception, for example sending encrypted data over an RS-232C serial communications line, transmitting data by wireless techniques (with or without encryption), or by embedding SMD 10 in GPC 20 . SMD 10 may be housed separately from GPC 20 . As shown in FIG. 1B , a secure housing 11 is provided for SMD 10 to prevent tampering by unauthorized persons. Alternately, SMD 10 may also be housed within GPC 20 and communicate directly with a bus system 18 . This communication may be encrypted, if desired. To provide added security on such configuration, encryption may be used on the software residing in GPC 20 .

FIG. 1B is a simplified block diagram of GPC 20 in which the present invention may be embodied. In accordance with known practice, GPC 20 includes a processor 12 that communicates with a number of peripheral devices via bus subsystem 18 . These peripheral devices typically include a memory subsystem 21 , a user input facility 31 , a display subsystem 24 , output devices such as a printer 17 , and a file storage system 13 . Memory subsystem 21 may consist of a number of memory units, including a main random access memory (RAM) 22 and a read only memory (ROM) 23 in which fixed instructions may be stored. User input facility 31 typically includes a keyboard 32 and may further include a pointing device 33 (e.g., a mouse, trackball or the like) or other common input devices. Display subsystem 24 typically includes a display device 26 (e.g., a cathode ray tube (CRT) or similar device) coupled to display controller 25 . File storage system 13 may include a hard disk 14 , a floppy disk 15 or other storage media 16 .

In this context, the term “bus subsystem” is used generically so as to include any mechanism for letting the various components of the system communicate with each other as intended. With the exception of the input devices and the display, the other components need not be at the same physical location. Thus, for example, portions of the file storage system could be connected via various local-area or wide-area network media, including telephone lines. Similarly, the input devices and display need not be at the same location as the processor, although it is anticipated that the present invention will most often be implemented in the context of general purpose computers and workstations.

Bus subsystem 18 is shown schematically as a single bus, but a typical system has a number of buses such as a local bus and one or more expansion buses (e.g., ADB, SCSI, ISA, EISA, MCA, NuBus, or PCI), as well as serial and parallel ports. Network connections are usually established through a device such as a network adapter on one of these expansion buses or a modem on a serial port. The computer system may be a desktop system or a portable system, or may be a larger “mainframe” system.

As FIG. 1A indicates, a communications line 90 (e.g., a parallel printer line) connects GPC 20 to digital printer 60 (preferably a laser-printer). This facilitates the printing of postage indicia on labels and envelopes (exemplified here by mailpiece 100 ). Optionally, electronic scale 40 may be attached to GPC 20 (via a communications line 70 ). A communications line 80 (e.g., an RS-232C serial communications line) also connects GPC 20 to a communications interface device 50 (e.g., a modem). Communications interface device 50 provides access to computerized meter resetting system (CMRS) 105 via a communications medium 110 . Resetting station computer 120 communicates postage information (for example, resetting information or auditing information) with GPC 20 and SMD 10 via a communications interface device 130 connected to communications medium 110 and to resetting station computer 120 via a communications line 140 . Optionally, GPC 20 and SMD 10 may communicate with ZCIS computer 150 . ZCIS computer 150 is connected to communications medium 110 via a communications line 170 and a communications interface device 160 . Also connected to ZCIS computer 150 via a communications line 190 is a CD-ROM device 180 , which holds U.S. ZIP-code and international postal code information.

As is well known in the art, a system such as this requires operating software (not shown). Software resident on GPC 20 enables GPC 20 to communicate with CMRS 105 , SMD 10 , digital printer 60 and, optionally, electronic scale 40 . Software with these capabilities is commercially available, and so will not be described in detail herein. The protocol used by CMRS 105 (which supports communication between SMD 10 , GPC 20 and CMRS 105 ) is also well-known, as it is the subject of a U.S. government standard. Software resident on SMD 10 is also well-known and is similar to that disclosed in U.S. Pat. No. 4,484,307, by Quatse et al., the disclosure of which is incorporated herein by reference.

Communication between GPC 20 and SMD 10 is bi-directional. GPC 20 sends control commands and information requests to SMD 10 . SMD 10 , in return, may send human-readable data (in response to information requests), postage indicia (in response to postage requests and which are encrypted) or both. For example, postage is requested by a user (not shown) by the user's entering postage information into GPC 20 . GPC 20 sends this information, together with mail class/service, any other values required (e.g., insurance) and the destination ZIP-code to SMD 20 . Any failure in this communication prevents further issuance of postage by SMD 10 . In turn, SMD 10 responds by generating a secure (via encryption) postage indicia file together with a license number and transmitting that information to GPC 20 . GPC 20 then takes this information and constructs a postage indicia print file including a two-dimensional code, graphical information and human-readable data. The postage indicia print file, together with optional information (such as address information, ZIP-code barcoding and any user-defined information) is transmitted to printer 60 for printing.

Printer 60 then imprints the postage indicium and other information onto an envelope (mailpiece 100 ), a label (not shown) or other means of affixation of postage. Examples of postage indicia are shown in FIGS. 2A-2C . As shown in FIG. 3 (an enlargement of FIG. 2 A), a postage indicium 195 may include such features as a graphic 196 , human-readable postage information 197 and encoded postage information 198 . As shown in FIGS. 2A-2C , encoded postage information 198 may be included inside or outside postage indicium 195 , or omitted entirely. Tables 1 and 2 include listings of other communications which can occur between GPC 20 and SMD 10 .

TABLE 1
Communications Between GPC and SMD
ITEM	DESCRIPTION	FUNCTION	APPROACH
1	SERVICES:
1.1	Install	To reset the	User follows instructions
		lock on the	to connect the SMD via the
		SMD which is	PC system to the Neopost
		set by the	remote centre. Once the
		factory before	status is checked a code is
		shipping.	transmitted to unlock the
			SMD for use. Successful
			unlock is confirmed. A way
			to ensure the correct install
			location may also be
			required.
1.2	Reset Postage	To charge the	Direct connect version of
		SMD with a	POC. Read and check
		new postage	registers and make and
		payment.	confirm transaction. Any
			amount limitations eg
			min/max/increments will be
			controlled by the POC
			centre.
1.3	Set Reset	To block the	After receipt of a sequence
	Code Lock	SMD in the	of 16 wrong postage
		event of an	payment reset codes the
		attempted	SMD will lock-out. A
		misuse.	message is sent to the
			user with instructions.
1.4	Unlock Code	To reset the	The user must contact the
		SMD lock-out	Neopost POC enquiry line.
		condition.	If a reset is to be
			initiated the register
			status is validated and a
			reset code is issued and the
			unlock action confirmed.
1.5	Remote	To read the	In the event of a detectable
	Diagnostics	contents of the	fault which could put
	Status	fault register.	accountability at risk the
			SMD is blocked and the
			fault is recorded. On-line
			the Neopost support service
			will be able to read the
			fault register.
1.6	Reset Soft	To reset a soft	In the event that
	Fault	fault which	accountability is not
		unblocks the	compromised and following
		SMD.	verification of data a code
			can be issued to reset the
			fault flag. The resetting of
			the flag is confirmed. If the
			fault proves to be
			permanent the SMD must
			be returned for service or
			replacement.
1.7	Reconfigure	To reconfigure	A read confirmation is
		certain	made followed by a code
		parameters in	which changes the status of
		the SMD which	variant registers. The
		have been	reconfiguration action must
		designed into	be verified before the SMD
		the system.	is released again for use.
			It should be possible to
			configure:
			a) decimal or fraction
			b) change inspection period
			in months from 3 to 12,
			for example, and
			c) correct any permissible
			data errors.
1.8	Withdraw	To set the	A read confirmation is
		displayed	made followed by a code
		descending	which locks the SMD from
		register to zero	use. In this condition the
		and block the	SMD when read will show
		SMD from use.	the descending register as
			zero but the original
			contents of the descending
			register is retained for later
			verification, if required, by
			a service centre.
2	OPERATIONS:
2.1	User Access	To provide a	The PIN will be 4 digits
	PIN	user PIN to	and based on an algorithm
		safeguard use	derived from the serial #.
		of the postage	For the SMD the PIN is
		function.	fixed and is required each
			time the SMD is switched
			on. The PC gives the user
			the option to enter a PIN
			or not as well as the
			possibility to change the
			PIN. This flexibility is
			managed in the PC. Service
			access to the SMD
			information is always
			possible via the SMD
			service mode and unique
			access code.
2.2	Zero test	To enable the	This can be a menu
	imprint	user or service	selection via the PC. Zero
		to test the	test prints will not register
		system with a	on the USPS cycle counter.
		zero value	It is acceptable for the PC
		postage	to add the word “TEST”
		imprint; all	diagonally across the print
		normal meter	or in anther suitable format.
		functions are
		active.
2.3	Request	To enable	This request can be initiated
	Postage	normal postage	by a user making a direct
		values to	postage value entry or from
		be selected.	a postage value calculation
			with a scale or from a look-
			up table (menu). The PC
			sends the postage value to
			the SMD together with the
			Mail class/service
			(complete with any values
			reqd. eg insurance) and the
			Destination ZIP + 4 + 2.
			It should be possible for the
			user to set up a print run for
			a batch of envelopes
			comprising the same
			postage value eg for a
			mailing. The user should be
			advised if there is
			insufficient credit to
			complete the run.
2.4	Issue Postage	To provide	The SMD generates a
		the PC with	secure indicia postage file
		the indicia	and sends this to the PC
		postage file.	together with the license.
			This communication must
			be secure and closed loop.
			Any failure in this
			communication cycle
			prevents further issue of
			postage together with a
			fault message to the user.
			The PC constructs the
			indicia print file comprising
			a 2D code, graphics and
			human readable data. The
			indicia print file together
			with a CASS address and
			ZIP + 4 + 2 barcode and
			any user defined
			information is issued to the
			printer. Once the data is
			issued to the printer it is
			fixed; it cannot be changed
			by normal PC application
			software.
2.5	Re-print	To allow up to	In the event of a printer
	Postage	3 total attempts	malfunction and the printer
		to print an	is lost the user can try up to
		indicia	two more times. This
		(fixed state).	function is managed by the
			PC since the SMD issues
			only one indicia for one
			recorded postage. The PC
			adds a “*” to the imprint
			and communicates the
			number of re-prints to the
			SMD.
2.6	Date Advance	To advance the	The user can select a
		date for	forward date only for
		processing	printing post. The postage
		items for future	date is managed by the
		posting.	SMD. The user can request
			a forward posting date up
			to 3 days in advance.
2.7	Fault Message	To advise the	In the event that a fault is
		user of a fault	detected by the SMD a fault
		and to give	code is generated and, if
		appropriate	possible, communicated
		instructions.	to the PC. Regardless, the
			PC displays a fault
			message. The fault code is
			recorded in the SMD
			service history register. It
			is acceptable for the SMD
			to retain only the last 10
			faults.
3	INSPECTION:
3.1	Advanced	To advise the	Whenever the system is
	Inspection	user of an	switched on within one
	Flag Warning	upcoming	week of an inspection date
		inspection.	the user will be advised that
			a remote inspection is
			required by the required
			date; a message tells the
			user how to initiate an
			inspection. The date is
			controlled by the set
			inspection date in the PC.
			An inspection can be made
			at any time during this
			warning period.
3.2	Inspection	To advise the	To display a permanent
	Reset	user an	message on the date of
		inspection must	expiry that an inspection
		be made by the	must be made this date
		expiry date.	otherwise the system will
			be locked until the
			inspection is completed.
3.3	Inspection	To make an	A remote communication is
		inspection of	initiated by the PC with the
		the SMD.	Inspection Centre.
			Provision shall be made for
			the Inspection Centre to be
			a different telephone
			number to the POC Direct
			Resetting Centre. All
			registers are transmitted
			as with a POC Direct
			Connect resetting plus
			usage statistics and number
			of reprints register. It is
			assumed that the inspection
			will have to be made
			separately to a normal
			remote postage payment
			resetting. However, if
			transmission time permits,
			all the information
			communicated during an
			inspection should also be
			included in each read
			sequence of the normal
			postage resetting
			transaction.
3.4	No Inspection	To block the	At midnight of the last date
	After Time	SMD in the	by which inspection is
	Out (SMD	event that an	required, the SMD is
	Blocked)	inspection is	blocked and a user message
		not made by	is displayed on the PC. The
		the required	message informs the user
		date.	that an inspection must be
			made before further postage
			can be dispensed.
3.5	Inspection	To advise the	If an inspection fails to be
	Failure	user in the	completed satisfactory for
		event of a	any reason the system
		failure to	should try to reinitiate
		complete the	another inspection cycle.
		inspection	Up to 3 maximum attempts
		satisfactory.	should be made before an
			error message is displayed.
			An error code is also
			recorded. A wait message
			should be displayed to the
			user while the remote
			transmission is in operation.
			When the inspection is
			complete a user message
			will be displayed together
			with the next date an
			inspection is required.
4	REPORTS:
4.1	Status	To print a	All user register
	Reports	report of all	information is
		user non	communicated, upon
		secure	request, to the PC. The
		registers.	PC defines the report
			format. The report shall
			have a title, date, license
			#, register values and
			system set-up e.g. postage
			range, last inspection date,
			low credit warning level,
			high value interlock level,
			etc.
4.2	Postage Reset	To print a	Upon request, the SMD
	Statement	statement of	communicates relevant
		new postage	information as listed in the
		payment.	example given in DTG/
			F1724 dated 25.10.95. The
			PC defines the report
			format. Additional
			information listed in F1724
			is provided from the PC.
			It should be only possible
			to print the statement
			immediately after a postage
			payment transaction, i.e.
			prior to printing postage.
4.3	Usage	To print user	Reports can be provided by
	Statistics	reports on	the PC on usage, viz for
		system usage.	any given period by
			selected services or service,
			the $ value and # of items
			sent. The user should be
			able to print the report in
			tabular and graphical
			representations. Note: the
			SMD will also record basic
			usage statistics information
			which can be transmitted
			during an on-line postage
			resetting or inspection.
4.4	Audit Report	To print a	It is proposed that at the
	Checksum	system usage	time this report is made
		audit report	the current values of the
		with some level	ascending and descending
		of validation.	registers are used to
			generate a validation code.
			This code is generated by
			the SMD, on request, and
			printed at the end of the
			report. The code can be
			based on a function of the
			above SMD registers and
			the license number.
4.5	Service	To print in	A means shall be devised to
	History	service mode	put the SMD into a service
	Report	the contents	mode. This could be
		of the service	achieved, for example, with
		history fault	a dedicated PC software
		register.	and a service PIN. In this
			mode the contents of the
			service history fault register
			can be printed out. The last
			recorded faults are retained
			even if faults were reset;
			resets are also recorded.
			Fault codes should be
			printed with a description
			of each fault code listed.
5	FACTORY/
	REPAIR:
5.1	Functional	To make a	The SMD should contain
	Test	system	sufficient test software to
		functional test	enable a functional test to
		via the SMD	be made to verify all basic
		communication	functions, both internal and
		with the PC.	coms, with the PC. Note: a
			secure internal connection
			means is provided to allow
			the SMD to be initialized
			during manufacture with
			direct memory read/write
			access and testing. This
			connection means is not
			accessible once the housing
			is applied without
			mutilation of the housing.

TABLE 1
Communications Between GPC and SMD
ITEM	DESCRIPTION	FUNCTION	APPROACH
1	SERVICES:
1.1	Install	To reset the	User follows instructions
		lock on the	to connect the SMD via the
		SMD which is	PC system to the Neopost
		set by the	remote centre. Once the
		factory before	status is checked a code is
		shipping.	transmitted to unlock the
			SMD for use. Successful
			unlock is confirmed. A way
			to ensure the correct install
			location may also be
			required.
1.2	Reset Postage	To charge the	Direct connect version of
		SMD with a	POC. Read and check
		new postage	registers and make and
		payment.	confirm transaction. Any
			amount limitations eg
			min/max/increments will be
			controlled by the POC
			centre.
1.3	Set Reset	To block the	After receipt of a sequence
	Code Lock	SMD in the	of 16 wrong postage
		event of an	payment reset codes the
		attempted	SMD will lock-out. A
		misuse.	message is sent to the
			user with instructions.
1.4	Unlock Code	To reset the	The user must contact the
		SMD lock-out	Neopost POC enquiry line.
		condition.	If a reset is to be
			initiated the register
			status is validated and a
			reset code is issued and the
			unlock action confirmed.
1.5	Remote	To read the	In the event of a detectable
	Diagnostics	contents of the	fault which could put
	Status	fault register.	accountability at risk the
			SMD is blocked and the
			fault is recorded. On-line
			the Neopost support service
			will be able to read the
			fault register.
1.6	Reset Soft	To reset a soft	In the event that
	Fault	fault which	accountability is not
		unblocks the	compromised and following
		SMD.	verification of data a code
			can be issued to reset the
			fault flag. The resetting of
			the flag is confirmed. If the
			fault proves to be
			permanent the SMD must
			be returned for service or
			replacement.
1.7	Reconfigure	To reconfigure	A read confirmation is
		certain	made followed by a code
		parameters in	which changes the status of
		the SMD which	variant registers. The
		have been	reconfiguration action must
		designed into	be verified before the SMD
		the system.	is released again for use.
			It should be possible to
			configure:
			a) decimal or fraction
			b) change inspection period
			in months from 3 to 12,
			for example, and
			c) correct any permissible
			data errors.
1.8	Withdraw	To set the	A read confirmation is
		displayed	made followed by a code
		descending	which locks the SMD from
		register to zero	use. In this condition the
		and block the	SMD when read will show
		SMD from use.	the descending register as
			zero but the original
			contents of the descending
			register is retained for later
			verification, if required, by
			a service centre.
2	OPERATIONS:
2.1	User Access	To provide a	The PIN will be 4 digits
	PIN	user PIN to	and based on an algorithm
		safeguard use	derived from the serial #.
		of the postage	For the SMD the PIN is
		function.	fixed and is required each
			time the SMD is switched
			on. The PC gives the user
			the option to enter a PIN
			or not as well as the
			possibility to change the
			PIN. This flexibility is
			managed in the PC. Service
			access to the SMD
			information is always
			possible via the SMD
			service mode and unique
			access code.
2.2	Zero test	To enable the	This can be a menu
	imprint	user or service	selection via the PC. Zero
		to test the	test prints will not register
		system with a	on the USPS cycle counter.
		zero value	It is acceptable for the PC
		postage	to add the word “TEST”
		imprint; all	diagonally across the print
		normal meter	or in anther suitable format.
		functions are
		active.
2.3	Request	To enable	This request can be initiated
	Postage	normal postage	by a user making a direct
		values to	postage value entry or from
		be selected.	a postage value calculation
			with a scale or from a look-
			up table (menu). The PC
			sends the postage value to
			the SMD together with the
			Mail class/service
			(complete with any values
			reqd. eg insurance) and the
			Destination ZIP + 4 + 2.
			It should be possible for the
			user to set up a print run for
			a batch of envelopes
			comprising the same
			postage value eg for a
			mailing. The user should be
			advised if there is
			insufficient credit to
			complete the run.
2.4	Issue Postage	To provide	The SMD generates a
		the PC with	secure indicia postage file
		the indicia	and sends this to the PC
		postage file.	together with the license.
			This communication must
			be secure and closed loop.
			Any failure in this
			communication cycle
			prevents further issue of
			postage together with a
			fault message to the user.
			The PC constructs the
			indicia print file comprising
			a 2D code, graphics and
			human readable data. The
			indicia print file together
			with a CASS address and
			ZIP + 4 + 2 barcode and
			any user defined
			information is issued to the
			printer. Once the data is
			issued to the printer it is
			fixed; it cannot be changed
			by normal PC application
			software.
2.5	Re-print	To allow up to	In the event of a printer
	Postage	3 total attempts	malfunction and the printer
		to print an	is lost the user can try up to
		indicia	two more times. This
		(fixed state).	function is managed by the
			PC since the SMD issues
			only one indicia for one
			recorded postage. The PC
			adds a “*” to the imprint
			and communicates the
			number of re-prints to the
			SMD.
2.6	Date Advance	To advance the	The user can select a
		date for	forward date only for
		processing	printing post. The postage
		items for future	date is managed by the
		posting.	SMD. The user can request
			a forward posting date up
			to 3 days in advance.
2.7	Fault Message	To advise the	In the event that a fault is
		user of a fault	detected by the SMD a fault
		and to give	code is generated and, if
		appropriate	possible, communicated
		instructions.	to the PC. Regardless, the
			PC displays a fault
			message. The fault code is
			recorded in the SMD
			service history register. It
			is acceptable for the SMD
			to retain only the last 10
			faults.
3	INSPECTION:
3.1	Advanced	To advise the	Whenever the system is
	Inspection	user of an	switched on within one
	Flag Warning	upcoming	week of an inspection date
		inspection.	the user will be advised that
			a remote inspection is
			required by the required
			date; a message tells the
			user how to initiate an
			inspection. The date is
			controlled by the set
			inspection date in the PC.
			An inspection can be made
			at any time during this
			warning period.
3.2	Inspection	To advise the	To display a permanent
	Reset	user an	message on the date of
		inspection must	expiry that an inspection
		be made by the	must be made this date
		expiry date.	otherwise the system will
			be locked until the
			inspection is completed.
3.3	Inspection	To make an	A remote communication is
		inspection of	initiated by the PC with the
		the SMD.	Inspection Centre.
			Provision shall be made for
			the Inspection Centre to be
			a different telephone
			number to the POC Direct
			Resetting Centre. All
			registers are transmitted
			as with a POC Direct
			Connect resetting plus
			usage statistics and number
			of reprints register. It is
			assumed that the inspection
			will have to be made
			separately to a normal
			remote postage payment
			resetting. However, if
			transmission time permits,
			all the information
			communicated during an
			inspection should also be
			included in each read
			sequence of the normal
			postage resetting
			transaction.
3.4	No Inspection	To block the	At midnight of the last date
	After Time	SMD in the	by which inspection is
	Out (SMD	event that an	required, the SMD is
	Blocked)	inspection is	blocked and a user message
		not made by	is displayed on the PC. The
		the required	message informs the user
		date.	that an inspection must be
			made before further postage
			can be dispensed.
3.5	Inspection	To advise the	If an inspection fails to be
	Failure	user in the	completed satisfactory for
		event of a	any reason the system
		failure to	should try to reinitiate
		complete the	another inspection cycle.
		inspection	Up to 3 maximum attempts
		satisfactory.	should be made before an
			error message is displayed.
			An error code is also
			recorded. A wait message
			should be displayed to the
			user while the remote
			transmission is in operation.
			When the inspection is
			complete a user message
			will be displayed together
			with the next date an
			inspection is required.
4	REPORTS:
4.1	Status	To print a	All user register
	Reports	report of all	information is
		user non	communicated, upon
		secure	request, to the PC. The
		registers.	PC defines the report
			format. The report shall
			have a title, date, license
			#, register values and
			system set-up e.g. postage
			range, last inspection date,
			low credit warning level,
			high value interlock level,
			etc.
4.2	Postage Reset	To print a	Upon request, the SMD
	Statement	statement of	communicates relevant
		new postage	information as listed in the
		payment.	example given in DTG/
			F1724 dated 25.10.95. The
			PC defines the report
			format. Additional
			information listed in F1724
			is provided from the PC.
			It should be only possible
			to print the statement
			immediately after a postage
			payment transaction, i.e.
			prior to printing postage.
4.3	Usage	To print user	Reports can be provided by
	Statistics	reports on	the PC on usage, viz for
		system usage.	any given period by
			selected services or service,
			the $ value and # of items
			sent. The user should be
			able to print the report in
			tabular and graphical
			representations. Note: the
			SMD will also record basic
			usage statistics information
			which can be transmitted
			during an on-line postage
			resetting or inspection.
4.4	Audit Report	To print a	It is proposed that at the
	Checksum	system usage	time this report is made
		audit report	the current values of the
		with some level	ascending and descending
		of validation.	registers are used to
			generate a validation code.
			This code is generated by
			the SMD, on request, and
			printed at the end of the
			report. The code can be
			based on a function of the
			above SMD registers and
			the license number.
4.5	Service	To print in	A means shall be devised to
	History	service mode	put the SMD into a service
	Report	the contents	mode. This could be
		of the service	achieved, for example, with
		history fault	a dedicated PC software
		register.	and a service PIN. In this
			mode the contents of the
			service history fault register
			can be printed out. The last
			recorded faults are retained
			even if faults were reset;
			resets are also recorded.
			Fault codes should be
			printed with a description
			of each fault code listed.
5	FACTORY/
	REPAIR:
5.1	Functional	To make a	The SMD should contain
	Test	system	sufficient test software to
		functional test	enable a functional test to
		via the SMD	be made to verify all basic
		communication	functions, both internal and
		with the PC.	coms, with the PC. Note: a
			secure internal connection
			means is provided to allow
			the SMD to be initialized
			during manufacture with
			direct memory read/write
			access and testing. This
			connection means is not
			accessible once the housing
			is applied without
			mutilation of the housing.

GPC 20 , connected to communications medium 110 via communications interface device 50 , accesses CMRS 105 for resetting SMD 10 , auditing by postal authorities, and other purposes. This allows the entry of postage credit in a manner similar to conventional electronic postage meters. In the present invention, GPC 20 communicates with resetting station computer 120 to reset SMD 10 (i.e., add postage credit to the values currently contained in SMD 10 ). Other functions may, of course, be provided in a similar manner.

FIG. 4 is a diagram showing SMD 10 designed according to the present invention. A battery augmented memory (BAM) 810 (and, optionally, a second BAM 820 ) receive data from and provide data to a memory controller 830 . BAM's 810 and 820 may consist, for example, of static RAM memory and batteries for providing non-volatile storage of postage accounting information. This postage accounting information, as is well known in the art, generally includes an ascending register, a descending register and a control total register (none of which are shown in FIG. 4 ). As is also well-known in the art, an ascending register holds a value equal to the amount of postage used, a descending register holds a value equal to the amount of postage which remains unused and a control total register holds the sum of the ascending and descending registers. Memory controller 830 may be accessed by a control unit 800 or an I/O protection circuit 900 . Control unit 800 accesses BAM's 810 and 820 by reading or writing on data lines 840 , and controls these operations via control lines 870 . I/O protection circuit 900 accesses BAM's 810 and 820 by reading or writing data on data lines 910 , and controls these operations via control lines 920 . I/O protection circuit 900 also contains a service port 880 and an I/O port 890 . Service port 880 allows direct access (with proper access codes) to BAMs 810 and 820 , for the repair and maintenance of SMD 10 . I/O port 890 supports communications with a general purpose computer (not shown). A printer port 895 is optional and may be connected to a printer (not shown) to allow the printing of postage indicia directly from SMD 10 . Such a configuration is shown in FIG. 5 . Also shown in FIG. 5 is an SMD containing a network interface, allowing the transmission of encrypted postage indicia files to remote computers over a network. This configuration is discussed later in this section.

Control unit 800 communicates with service port 880 , I/O port 890 and printer port 895 via control/data lines 930 and I/O protection circuit 900 . Control unit 800 contains circuitry for controlling the functions of SMD 10 , and may also contain a real-time clock (not shown) and memory (also not shown). Encryption may be performed by a sub-unit of control unit 800 (not shown; e.g., a hardware encryptor) or by software algorithm (e.g., the well-known RSA algorithm). SMD 10 may contain postage accounting information for a single department (e.g., the entire company is represented by a single account) or may contain postage accounting information for two or more departments within a customer's organization. Moreover, such departments may be widely dispersed geographically given the capabilities of the present invention. As use of the present invention consolidates postage accounting information, multi-site users will benefit from simplified, more efficient tracking of such information. The present invention will also make site-specific postage accounting information available to the user's central accounting facility and to the site accounting facility as well. The reader will note that the internal architecture of SMD 10 in the present invention parallels that of the invention disclosed in U.S. Pat. No. 4,484,307, by Quatse et al., the disclosure of which has already been incorporated herein by reference. Thus, the internal architecture of SMD 10 is well known and will not be described in further detail.

Beyond those already mentioned, many other advantages are provided by the present invention. The software and hardware required to implement the present invention are inexpensive in comparison to conventional postage metering systems, allowing postage metering dedicated to a particular user. Postage may be provided as an on-line service to individual sites of a multi-site user. In comparison to conventional postage meters, use of postage itself is simplified. The individual user or site need not maintain logbooks, lease equipment, comply with any special regulations, physically transport a postage metering device to a post office for inspection nor perform the other custodial tasks related to the use of conventional postage meters.

A second embodiment of the present invention, shown in FIG. 6 , operates in a manner similar to that of the above embodiment. Elements depicted in previous figures are referred to in FIG. 6 using the reference numerals assigned in the figure in which the given element originally appears. However, in this case, an SMD 210 is connected to resetting station computer 120 via secure communications link 230 . In this configuration, a user needing postage, for example, enters their request using a GPC 20 . GPC 20 communicates this request (containing information similar to that in the preceding example) to resetting station computer 120 . This communication is accomplished via communications interface device 50 , which provides access to communications medium 110 and thereby to communications interface device 130 connected to resetting station computer 120 . Resetting station computer 120 relays the request to SMD 210 . Multiple SMDs may be connected to resetting station computer 120 and may be organized in any fashion. For example, a customer may have all their postage information retained in a single SMD or multiple SMDs. Further, an SMD may contain postage accounting information for a single department (e.g., the entire company is represented by a single account) or for multiple departments.

SMD 210 responds to the request in the manner previously described, in this case by returning a secure (encrypted) postage indicia file and a license number. This information returns to GPC 20 via the communications path outlined above. GPC 20 takes the information provided by SMD 210 and constructs a postage indicia print file, as before. The postage indicia print file, together with optional information (such as address information, ZIP-code barcoding and any user-defined information) is communicated to a printer 60 for printing. As noted above, Tables 1 and 2 include listings of other communications which can occur between GPC 20 (and so resetting station computer 120 ) and SMS 210 .

A third embodiment of the present invention, shown in FIG. 7 , operates in a manner similar to that of the preceding embodiments. Elements depicted in previous figures are referred to in FIG. 7 using the reference numerals assigned in the figure in which the given element originally appears. However, in this case, a GPC 410 is connected to a local-area network (LAN) 500 . Although LAN 500 is shown in a star topology, other computer network topologists and networking techniques may be used. GPC 410 is again connected to an SMD 400 via a secure communications link 420 . In this configuration, a user needing postage, for example, enters their request using a GPC 430 . GPC 430 may be one of several GPCs attached to LAN 500 (exemplified in FIG. 7 by GPCs 480 (1)-(N)). GPC 430 communicates this request (containing information similar to that in the preceding examples) to GPC 410 via LAN 500 . GPC 410 relays the request to SMD 400 , which responds in the manner outlined in the preceding examples (i.e., SMD 400 generates encrypted postage indicia for transmission by the computer to a digital printer 440 , where it is subsequently printed on a mailpiece (exemplified by mailpiece 100 )). Again, a CMRS 550 may be communicated with using a communications interface device 540 , as can a remote ZCIS (not shown). However, a ZCIS computer 150 may reside on LAN 500 to provide ZIP-code information (in the manner previously described) to any computer connected to LAN 500 .

In the example, GPC 410 then returns the encrypted postage indicia file generated by SMD 400 to GPC 430 , which in turn constructs a postage indicia print file, as before. The postage indicia print file, together with optional information (such as address information, ZIP code barcoding and any user-defined information) is transmitted to printer 440 for printing. Tables 1 and 2 include listings of other communications which can occur. As in the preceding example, more than one SMD may be connected to GPC 410 . Moreover, there may be multiple GPCs on the LAN providing postage. Numerous topologists and configurations are thus possible and are to be considered as part of this application. Additionally, SMD 400 may reside remotely at a resetting station computer (not shown) as part of a CMRS 550 , as in the second example. Communications from GPC 430 would be transmitted over LAN 500 to GPC 410 . GPC 410 sends the information to CMRS 550 via communications link 540 . CMRS 550 responds and the information is passed back along the same path to GPC 430 . Further, as shown in FIG. 8 , an SMD 600 may provide these services directly to GPC 430 via LAN 500 , without the need for GPC 410 . Elements depicted in previous figures are referred to in FIG. 8 using the reference numerals assigned in the figure in which the given element originally appears.

A secure means of authenticating postage indicia is of great importance to the Unites States Post Office, which loses millions (and potentially billions) of dollars a year to the use of fraudulent postage indicia. In all the preceding embodiments, a printer imprints postage indicium and other information on mailpiece 100 . As shown in FIG. 3 , postage indicium 195 may include human-readable postage information 197 and encoded postage information 198 . These can be used to determine the authenticity of the affixed mark. Encoded postage information 198 is generated in the following manner. Information from SMD 10 (and, optionally, from GPC 20 ) may be encrypted by SMD 10 using an encryption algorithm (e.g., DES, RSA or a comparable algorithm). The information is then converted into a printable binary code of some sort. Examples of a printable binary code include bar codes, data matrix, PDF417 or other comparable method. An example of a data matrix is the data matrix described in the AIM USA Technical Specification entitled “Uniform Symbology Specification” (AIM USA Technology Group, Pittsburgh, Pa.; Draft of May 18, 1995), which is hereby incorporated by reference in its entirety. The PDF417 printable binary code is described in “RPS Multicode Bar-Code Label Guide” (RPS Roadway Package System, Draft of May, 1995 (Rev. 2)), which is hereby incorporated by reference in its entirety. The data matrix method is of particular interest because it allows the printing of a relatively large amount of data in a small space. As the present application (postage on envelopes, labels and the like) requires minimal consumption of available area, efficient use of printing area is an advantage.

An authentication system 1000 for the detection of fraudulent postage indicia is shown in FIG. 9 . ZIP reader 1100 reads human-readable postage information 197 and symbology reader 1200 reads encoded postage information 198 . This information is passed to GPC 1300 , where software (not shown) residing on GPC 1300 decodes, then (if required) decrypts encoded postage information 198 . The software then compares this decoded information to human-readable postage information 197 and indicates whether or not the postage indicium is authentic. Other information may be provided by the user to aid in the authentication of the postage indicium. Aside from the advantage of small area, this method can also provide two levels of security. First, decoding a data matrix requires special software or at least an understanding of the techniques involved. Second, even if the data matrix is captured and decoded, encryption can be used to prevent viewing of any or all the data. Thus, this system meets the requirement for a secure, accurate means of authenticating postage indicia.

Moreover, while the invention has been particularly shown and described with reference to these specific embodiments, it will be understood by those skilled in the art that the foregoing and other changes in the form and details may be made therein without departing from the spirit or scope of the invention. For example, the present invention should not be limited by any one placement or connection of the SMD in the postage metering system. There may be one or many SMDs, each storing postage information for any number of user sites. Such sites may be local, or remote and widely dispersed geographically. Consequently, the scope of the invention should be determined with reference to the appended claims.

Claims

1. A modular postage accounting system comprising:a secure metering device configured to store postage accounting information, to generate data representing at least a portion of a secure postage indicium, and to account for the generation of said data by changing at least a portion of said postage accounting information, and wherein said secure postage indicium is configured to permit authentication of said secure postage indicium using encoded information included therein; a first computer coupled to said secure metering device, wherein said first computer is configured to control said secure metering device via at least one control signal, and wherein said secure metering device is configured to generate said data in response to said at least one control signal; a second computer; a printer coupled locally to said second computer; and a network communications medium coupled to said first and second computers, wherein said first computer is configured to convey said data to said second computer via said network communications medium to allow said second computer to control said printer to print said secure postal indicium.

2. The modular postage accounting system of claim 1, wherein said first computer is further configured to retrieve said postage accounting information stored in said secure metering device.

3. The modular postage accounting system of claim 1, wherein said secure metering device comprises:a first memory unit configured to store said at least said portion of said postage accounting information; a second memory unit configured to store said at least said portion of said postage accounting information; a central processing unit coupled to said first and second memory units and configured to update at least a portion of said at least said portion of said postage accounting information stored in said first and second memory units; and a communications port coupled to said central processing unit and said first computer, wherein said central processing unit is configured to communicate information held in said first and second memory units to said computer via said communications port, and said computer is configured to access said first and second memory units via said communications port.

4. The modular postage accounting system of claim 1, wherein at least one component of said secure metering device is housed in a housing configured to impede unauthorized access to said at least one component.

5. The modular postage accounting system of claim 1, wherein at least one component of said secure metering device is a memory unit.

6. The modular postage accounting system of claim 1, wherein at least one component of said secure metering device is a storage device configured to store said postage accounting information.

7. The modular postage accounting system of claim 1, wherein said secure metering device comprises:a first storage device and a second storage device capable of redundantly and securely storing said postage accounting information; a communications unit configured to communicate with said computer; and a processor coupled to said first and second storage devices and to said communications unit, said processor configured to control said first and second storage devices and to transfer postage information from said first and second storage devices to said communication unit.

8. The modular postage accounting system of claim 1, further comprising:a reader configured to read human-readable information and said encoded information from said secure postage indicium; and a computing unit coupled to said reader and configured to determine the authenticity of said secure postage indicium by comparing said human-readable information and said encoded information.

9. The modular postage accounting system of claim 1, wherein said secure metering device comprises:a first storage unit configured to store said at least said portion of said postage accounting information; a control unit coupled to said first storage unit, said control unit configured to update information stored in said first storage unit; and a communications port coupled to said control unit.

10. The modular postage accounting system of claim 9, wherein said control unit is configured to communicate information stored in said first storage unit to said first computer via said communications port, and said computer is configured to access information stored in said first storage unit via said communications port.

11. The modular postage accounting system of claim 9, wherein said secure metering device further comprises:a second storage unit coupled to said control unit and configured to store a redundant copy of information stored in said first storage unit.

12. The modular postage accounting system of claim 9, wherein said first storage unit comprises a non-volatile memory unit.

13. A modular postage accounting system comprising:a secure metering device configured to generate data representing at least a portion of a secure postage indicium and to account for the generation of said data; a printer configured to print said secure postage indicium, wherein said secure postage indicium is configured to allow authentication of said secure postage indicium using secure information included therein; a first computer coupled to said secure metering device and configured to cause said secure metering device to generate said data; a second computer coupled locally to said printer; and a network communications medium coupled to said first and second computers; wherein said first computer is configured to convey said data to said second computer via said communications medium and said second computer is configured to receive said data from said first computer and to cause said printer to print said secure postage indicium.

14. The modular postage accounting system of claim 13, wherein at least one component of said secure metering means is housed in a housing configured to impede unauthorized access to said at least one component.

15. The modular postage accounting system of claim 13, wherein said printer is a physically unsecure unit.

16. The modular postage accounting system of claim 13, wherein said printer is configured to print information in addition to said secure postage indicium.

17. A modular postage accounting system comprising:a first computer; a second computer; a printer coupled locally to said second computer, said printer configured to print a secure postage indicium and additional information; and a secure metering device coupled to said first computer and configured to generate data representing at least a portion of said secure postage indicium, to account for the generation of said data by updating at least a portion of postage accounting information, and to communicate postal information to and from said first computer; and a network communications medium coupled to said first and second computers, wherein said first computer is configured to convey said data to said second computer via said network communications medium to allow said second computer to control said printer to print said secure postal indicium; wherein at least one component of said secure metering device is housed in a housing configured to impede unauthorized access to said at least one component, and said secure postage indicium is configured to permit authentication of said secure postage indicium via secure information included therein.

18. The modular postage accounting system of claim 17, further comprising software residing on said computer for controlling said printer, said modem, and said secure metering device, wherein said software is configured tocause said secure metering device to generate said data, cause said secure metering device to communicate said data to said computer, cause said computer to generate said secure postage indicium using said data, cause said computer to communicate said secure postage indicium to said printer, and cause said printer to print said secure postage indicium.

19. The modular postage accounting system of claim 17, wherein said secure metering device comprises:a first storage device and a second storage device configured to redundantly and securely store postage information, wherein said first storage device serves as said at least one component; a communication unit coupled to said computer; and a processor coupled to said first and second storage devices and said communication unit, said processor configured to control said first and second storage devices and to transfer postal information from said first and second storage devices to said communication unit.

20. The modular postage accounting system of claim 17, further comprising:a reader configured to read human-readable information and said secure information from said secure postage indicium; and a computing unit coupled to said reader, said computing unit configured to determine the authenticity of said secure postage indicium by comparing said human-readable information and said secure information.

21. The modular postage accounting system of claim 17, wherein said secure metering device comprises:a first memory unit configured to store said at least said portion of said postage accounting information; a second memory unit configured to store said at least said portion of said postage accounting information; a central processing unit coupled to said first and second memory units, said central processing unit configured to update at least a portion of said at least said portion of said postage accounting information stored in said first and second memory units; and a communications port coupled to said central processing unit and said first computer, wherein said central processing unit is configured to communicate said data to said computer via said communications port, and said computer is configured to access said first and second memory units via said communications port.

22. A postal system comprising:a secure metering device configured to store postage accounting data, to generate postal data embodied in least a portion of a postage indicium, which indicium includes secure data that permits authentication of said postage indicium, and to account for the generation of said postal data by updating at least a portion of said postage accounting data; and a first computer coupled to said secure metering device, said first computer configured to control said secure metering device via at least one control signal, and wherein said secure metering device is configured to generate said postal data in response to said at least one control signal; a second computer; a printer coupled locally to said second computer; and a network communications link coupled to said first and second computers, wherein said first computer is configured to convey said postal data to said second computer via said network communications medium to allow said second computer to control said printer to print said postal indicium embodying said postal data.

23. The postal system of claim 22, wherein said postage accounting data is accessible by said computer.

24. The postal system of claim 22, wherein said postal data is provided to said computer via a secure mechanism.

25. The postal system of claim 24, wherein said secure mechanism is achieved by encryption.

26. The postal system of claim 22, wherein said secure metering device comprises:a first storage unit configured to store said at least said portion of said postage accounting data; and a control unit coupled to said first storage unit, said control unit configured to update data stored in said first storage unit.