Abstract: A postage metering system configurable to execute a security routine that inhibits certain transactions but maintains secure postage data. The system includes a security module coupled to a postage meter. The security module executes a set of transactions with the meter, and includes a processor and a memory. The processor executes a security routine upon occurrence of one or more defined events. The memory stores secure postage data. When the security routine is executed, selected ones of transactions between the meter and security module are inhibited, but the secure postage data stored within the memory is retained. The memory can also store security data (e.g., encryption keys) that are erased when the security routine is executed. The security routine can be initiated upon: (1) failure to receive an authorization signal by the security module within a particular time-out period, (2) detection of tampering with the security module, (3) receipt of a command from the meter, or other events.

Abstract: An electronic postage meter with memory and a postage printing function having enhanced I/O capability. The meter, in addition to its normal mode of operation, has a transparent mode of operation wherein the meter keyboard and display can be utilized as a user interface to an external I/O device. During the transparent mode of operation, the meter maintains control and security over the meter memory and print function.

Abstract: An improved electronic postage meter which includes a microcomputer (17), redundant memories ("BAMs") (35a-b), and fault flip-flops (30a-b). Improved circuitry for controlling the writing to the BAMs includes a timer ("BAM-protection timer") (40) coupled to the write-enable input of each of the BAMs. The BAM-protection timer has a trigger input (43) coupled to the microcomputer. The microcomputer is programmed to execute an instruction to generate a triggering signal at the BAM-protection timer's trigger input immediately prior to executing an instruction to write to the BAM. This opens a window for writing; the duration of the window is set to be just long enough to allow the completion of the write operation. The fault flip-flops, once set, unconditionally prevent writing to the BAMs, regardless of any other signals that might be present. The setting of the fault flip-flops is controlled by a first timer ("watchdog timer") (60) and a second timer ("second-chance timer") (62).