EP2304693B1 - Access control method and access control system - Google Patents

Description

The invention relates to the field as access control. It relates more particularly to an access control procedure and access control system based on an identification procedure (actually: authentication method).

Identification systems (often referred to as identification systems) are used in different applications such as access control prepaid card systems, data acquisition systems, etc. The wireless information transmissions, for example via radio frequency signals or microwaves (eg via GSM), are becoming increasingly important. Due to the comparatively large range, the potential problem of manipulation arises. Thus, for example, by means of a remote from a data exchange point (writing and / or reading device of a locking system of a prepaid card reader, etc.) a transmitter / receiver of a manipulator be set up by means of a so-called "man-in-the-middle" attack or another vulnerability of the exchange protocol used exploiting exploitation is performed.

For some time, the use of so-called capacitive-resistive coupling (also called 'capacitive coupling' or 'PAN coupling') for access control has been known. This is very short-range, and it often becomes the path exploited by the human body for signal transmission. As a result, receiving signals by a manipulator positioned at some distance can be ruled out with rather great certainty.

A disadvantage of the capacitive-resistive coupling is the data transmission rate of the information transmission, which is usually very low in realizable embodiments. This is because the communication device is generally set up to allow signal transmission through the human body. This prohibits high frequencies and high amplitudes.

Due to the very limited data transmission rate, either only very short data packets can be transmitted, or a correspondingly long waiting time arises. The former is undesirable for higher security applications, the latter has a negative impact on comfort.

From the EP 1 024 626 a method is known, by means of which the information transmission via a PAN coupling (or an IR interface or the like) is combined with the information transmission via a 'broadcast' medium, for example RF. For this purpose, a key is transmitted via the PAN coupling, which encrypts the data transmitted in the subsequent communication via the RF channel. This procedure has the advantage that the security ensured by the very short-range PAN coupling can be combined with the transmission of larger amounts of data by means of another technology. For the application access control but also this procedure is not very comfortable, since the correct information transfer can only be used when the user is in the immediate vicinity of the writing and / or reading device (this sits, for example, in the door). Similar systems are in WO2005 / 034393 and WO2007 / 036061 disclosed.

It is therefore an object of the invention to provide an authorization method and an authorization system which overcome disadvantages according to the prior art and, in particular for the application 'access control', enable the necessary security and at the same time a satisfactory speed of the method.

This object is achieved by a method and a system as defined in the claims.

The invention is characterized essentially by the fact that for the access control in a first step, a wireless radio link (this is expressly meant in addition to radio frequencies communication via microwave frequencies) between the object to the access is sought, and an access control medium (mobile phone, other electronic device, smart card, etc.) is established. Via this wireless connection, an authentication procedure is initially performed, in which the access authorization of the access control medium is checked. Subsequently, a temporary access code is sent from the object to the access control medium and sent back by this to the object, possibly in a modified form. In this case, the capacitive-resistive coupling is used either for the return of the - optionally modified - access code to the object or possibly for the transmission of the access code to the access control medium; in the other direction the signal is sent via the wireless connection.

If the temporary access code - possibly in modified form - returns to the object correctly, the object is released. In many embodiments, the object is a door with a mechatronic Locking device, which is in communication with a - optionally integrated in the locking device - writing and / or reading device, which in turn has means for communicating over the wireless connection and for receiving and / or transmitting capacitive-resistive signals. The release of the object in this case corresponds to the mechatronic unlocking of the door.

The authentication method is any method of determining whether the access control medium is authorized to access the object. This can be done through a simple query of codes that must be present on the access control medium, over more complex, secure procedures. In particular, it is possible to carry out the authentication method in a manner known per se from the prior art or by means of a commercially available system whose protocol does not necessarily have to be known. In any case, the authentication method preferably provides a yes / no answer to the question whether the access control medium authorizes access in the present situation. Only if the answer is "yes" is a temporary access code generated and transmitted to the access control medium.

The temporary access code is, for example, a random sequence; it is only accepted by the object for some time after its generation, for example during 2-10 seconds or can only be received once as entitled ("one time" code). Optionally, further temporary access codes are generated by the writing and / or reading device of the object if, after this time, the wireless communication connection still exists, but access to the object has not yet taken place; it may also be provided that the temporary access code is valid as long as the wireless connection exists.

The procedure according to the invention has the advantage that it combines the manipulation security of known authentication processes, which can take place via secure connections (for example with encryption) and can cause the exchange of larger amounts of data, with the selectivity of the capacitive-sensitive coupling. In contrast to the prior art, this is done without sacrificing comfort due to delays caused by the slow, short-range capacitive-resistive coupling. The relatively time-consuming construction of a secure radio link - which may include synchronization, etc. - can take place as the user approaches the object. Over the capacitive-resistive channel then only - for example, unencrypted - a very short data sequence must be transmitted, and the release of the object can be done immediately after their receipt.

This results in a natural movement for the user. He can carry the access control medium in his pocket. As he approaches the door, a communication connection is established and the access authorization is checked automatically, without user intervention. A random access code containing random elements is transmitted - in the preferred embodiment via the secure connection - to the access control medium.

Then the access control medium, for example, constantly repeatedly emits the temporary access code or the data packet derived therefrom via the transmitter (transmitter) of the capacitive-resistive coupling; For this purpose, a pair of electrodes present in the access control medium is supplied with a corresponding signal. Once the user is in the immediate vicinity of a receiver electrode (eg, a door handle, which is preferably configured as a receiver electrode or part of the receiver electrode of the capacitive-resistive receiver) or contacts the receiver electrode, reception of the signal by the capacitive-resistive receiver begins Coupling, wherein the signal path may pass through the user's body when carrying the access control medium in the pocket.

Due to the procedure according to the invention, therefore, only a simple character string must be transmitted via the capacitive-resistive coupling. In particular, no data relating to the actual authentication process has to be transmitted in this step. In particular, all information that serves the writing and / or reading device for identifying / authenticating the access control medium may have already been transmitted via the wireless connection. The data transmitted with the capacitive-resistive coupling can consist of a temporary access code (containing no access-control-medium-specific data), which possibly has still been changed with a simple, non-access-control-medium-specific operation. Adding an ID or other simple string is not excluded.

A security against manipulation consists on the one hand in the security of the selected wireless connection; available methods often include encryption, and it is also for practical reasons (synchronization, etc.) not easy and quickly possible to listen to a short time existing radio signal. On the other hand, a manipulating person could also use the unauthorized temporarily received temporary access code only to a limited extent, since this is only valid for a very short time.

According to a variant of the method according to the invention, the temporary access code is transmitted via the capacitive-resistive coupling-permanently-and then sent back via the existing wireless connection; it is easily possible for the recipient to verify that it comes from the same sender with which the successful authentication process was previously performed. In this variant too, the method according to the invention brings practically no time delays which are recognizable to the user, since the back transmission of the optionally modified access code can take place immediately after its reception via the capacitive-resistive coupling, namely via the already established wireless connection.

Particularly suitable as an information transmission channel (as the wireless connection) is the previously known under the name "Wibree" standard Bluetooth Low Energy. The use of this comparatively short-range (about 10 m signal range) technology is advantageous in terms of safety due to the short range. In addition, it proves to be particularly favorable for the application "access control" for the following reason: Doors in buildings are often not wired, and a wiring would be very costly. Therefore, such "standalone" devices rely on battery power. For practical reasons, it is undesirable if these batteries are to be replaced at high speed. Therefore, the very energy-saving Bluetooth low energy technology, which was actually developed for the communication between sensors and in their vicinity placed receivers, quite surprisingly very well suited for the present application. The use of "normal" Bluetooth is likewise possible, with the disadvantage that the power consumption of such a system is higher.

The access control medium is preferably a portable device, for example a mobile telephone. In such is generally enough power available. According to a preferred embodiment, the access control medium assumes the role of "master" in Kommuninkation Bluetooth or Bluetooth Low Energy, ie the initialization of the connection is based on the access control medium.

According to a preferred embodiment, after the authentication process, maintenance data is transmitted from the writing and / or reading device (the door) to the access control medium, for example battery life data etc. In the event of an accident or a necessary battery change, the non-wired writing and / or writing data can be transmitted Reading device via the access control medium trigger a warning signal or draw attention in another suitable manner to be remedied.

As explained above, the procedure according to the invention is particularly suitable for applications in which the access control medium does not have to be actively handled by the user, for example, but can remain in his pocket. The kapitizitiv-resistive coupling is then preferably primarily through the body of the user, which acts as a - bad - electrical conductor. Therefore, for the capacitive-resistive coupling, the ultra-wideband signal transmission is particularly preferred using the frequency spreading method. This can cause the current amplitudes flowing through the body to be very small. Regarding implementation of this method and benefits will also be on the WO 2007/112609 directed.

• Fig. 1 eine Skizze zur Veranschaulichung des Ablaufs beim erfindungsgemässen Verfahren;
• Fig. 2 eine Darstellung eines Mobiltelefons als Zugangskontrollmedium in einem erfindungsgemässen System; und
• Fig. 3 ein Ablaufdiagramm einer Ausführungsform eines erfindungsgemässen Verfahrens.

Hereinafter, embodiments of the invention will be illustrated with reference to schematic drawings. Show it:

• Fig. 1 a sketch to illustrate the process in the inventive method;
• Fig. 2 a representation of a mobile phone as an access control medium in a system according to the invention; and
• Fig. 3 a flowchart of an embodiment of a method according to the invention.

According to FIG. 1 For example, a user 1 can carry the access control medium 2, for example, in a bag or attached to a belt. During the entire procedure, he does not have to take control of the access control medium. When the user 1 approaches a door 3, to which he wants to gain access with the method according to the invention, the data exchange via the wireless connection already starts while the user approaches the door. The typical range for the preferably used here Bluetooth or Bluetooth low energy technology is about 10 meters. The door handle 3.1 of the door is designed, for example, as a receiver electrode for the capacitive-resistive coupling. As soon as the user touches the door handle, or shortly before, the transmission of the data packet from the access control medium 2, for example through the body of the user 1 to the receiver electrode, begins, according to the method discussed in more detail below. If the data has been exchanged correctly and successfully, the door is released and the user can press the door handle. For him, the whole process is so, so whether the door would be constantly open.

If the user only moves past the door without the user attempting to operate the door handle, the authentication process may also take place. Since, however, the extremely short-range capacitive-resistive coupling does not start under these circumstances, the door does not open. For example, a person accidentally located nearby, therefore, can not open the door.

Particularly preferably, the access control medium is designed as a mobile telephone 11. The mobile phone has means for communicating via Bluetooth Low Energy technology. In addition, it is provided with a transmitter (or possibly receiver, see below) for the capacitive-resistive coupling. For example, housing parts or a transparent display surface can be designed as corresponding electrodes 13, 14 or coated with them. This will also be on the documents WO 2008/098397 . WO 2008/098398 and WO 2008/098399 directed.

FIG. 3 shows a flowchart of an embodiment of a method according to the invention. Here, solid arrows between the box signal transmissions over the wireless connection (eg Bluetooth Low Energy), the dotted arrow represents the capacitive-resistive data transmission. In the left column states of the writing and / or reading device (the "door") are listed, in the middle column states of the access control medium (hereinafter it is described as a mobile phone, the method would be carried out analogously on other access control media). The terms "Advertiser", "Scanner", "Initiator", "Slave" and "Master" correspond to the terminology commonly used for Bluetooth Low Energy; the corresponding states will be briefly explained below. "RCID Rx" and "RCID Tx" stand for receiver and transmitter for the capacitive-resistive coupling; "open" refers to the state of the release of the object, eg. Unlocking the door.

The time axis runs in Fig. 3 from top to bottom.

In the normal state 31 "Standby" state, in which no access control procedure is initialized, sends either the write and / or Reading device or the mobile from periodic initialization signals ("advertising packets"), for example, with a clock of between 0.2 and 10 Hz, for example. Once per second. In the illustrated embodiment, the initialization signals are sent from the writing and / or reading device. When the advertising packet is received by the mobile phone, the mobile phone may change from the scanner to the initiator role and ask the writer / writer for a wireless connection (step 32). Thereupon, the secure Bluetooth low energy connection is set up within, for example, at most 2 s, the mobile telephone acting as "master", the writing and / or reading device as "slave" according to common terminology (step 33). The authentication process is carried out with the aid of the established wireless connection, ie the access authorization of the master is checked (step 34).

In the case of the method mentioned here, it is checked whether the access control medium authorizes access, that is to say by means of a data exchange via a secure, for example encrypted connection - the data exchange can be based on the challenge-response method or another suitable method the access control medium required data and / or qualifications are available. The procedure chosen during the authentication process will not be explained in detail here; It can be done according to the prior art or according to other suitable procedures. There are - especially in connection with communication via radio frequencies - various different solutions from different providers, such as the "Legic®" system. The procedure according to the invention even makes it possible to use proprietary solutions from third-party providers, ie the method sequence of the authentication method need not be known to the person implementing the method according to the invention; only the result (an "OK" or an "access denied") is needed.

Upon authentication, a temporary (i.e., only for a limited time and / or single access only) access code is transmitted to the mobile by the writing and / or reading device (step 35). This is done via the secure wireless connection. This access code - or a quantity derived therefrom - is transmitted back to the writing and / or reading device repeatedly immediately and if necessary, the capacitive-resistive information transmission being used for this return (step 36). The transmission of the access code or the derived variable takes place, for example, until either a time limit (for example a value between 2 and 10 seconds) has been exceeded or the access code has been received by the writing and / or reading device.

As a variant of the illustrated procedure, it can also be provided that the temporary access code is transmitted capacitively and resistively to the mobile telephone by the writing and / or reading device, and that it sends back the access code or the derived variable via the secure wireless connection, in which case the sending of the access code by the writing and / or reading device can take place until either a time limit is reached or the returned access code or the derived variable is received via the secure connection.

The access code is, for example, a random number or a random sequence or a variable composed or calculated from a random number / random sequence and further variables.

The method according to the invention can be implemented particularly simply if the temporary access code itself is sent back by the mobile telephone. As a possible derived therefrom come to a unique number or The same, a time information, a further random variable, etc. added access code, sequences of the access code, or a variable obtained with a previously known operation on the possibly completed access code or sequences thereof.

Following the forward and backward transmission of the temporary access code-or at least simultaneously thereto-maintenance data can optionally also be exchanged, for example test data, battery life data, status data etc. can be transmitted from the writing and / or reading device to the mobile telephone (step 37) and be evaluated for maintenance if necessary; also appropriate warnings or the like can be triggered. Finally, the connection is terminated (here by the mobile telephone) (step 38), and the object is released, for example the door is unlocked (step 39).

Far right in Fig. 3 schematically the time is shown, which is needed for the steps before or after first touching the door handle. The particularly time-consuming process steps such as setting up the secure connection can already take place while the user approaches the door and, for example, between 1 and 5 s claim - in the example shown about 2 s. Favored by the relatively long available time until a secure connection must stand, long device detection times can be tolerated, which in turn makes long advertising intervals of the object or short active scanner times of the access medium possible. This reduces the power consumption both on the object and on the access medium, without affecting the comfort for the user. The (return) transmission of the temporary access code and the release of the door, however, are very fast processes that last at most a few tenths of a second, for example. Between 0.05 s and 0.5 s, in the example shown about 0.15 s.

All processes are thus characterized by a very low energy consumption and are therefore suitable to be performed even with relatively small and / or long-lasting batteries, for example. Especially if the writing and / or reading device of the door as a non-wired, standalone 'device available is, whose battery then, for example, only every one to two years must be replaced.

Claims (10)

1. An access control method for the controlled release of an object, comprising the following steps:

   - building up a wireless connection between an access control medium and a write/read device of the object via radio waves or microwaves,

   - carrying out an authentication process by way of data signals which are transferred between the access control medium and the write/read device of the object via the wireless connection;

   - given a successful authentication in the authentication process, transferring a temporary access code from the write/read device of the object to the access control medium;

   - sending a data package based on the temporary access code, back from the access control medium to the write/read device of the object,

   - wherein the transfer of the temporary access code or the sending-back of the data package is effected by way of the capacitive-resistive coupling; and

   - release of the object by way of this write/read device, if the received data package is recognised as being correct.
2. An access control method according to claim 1, characterised in that the transfer of the temporary access code is effected via the wireless connection, and the sending-back of the data package is effected via the capacitive-resistive coupling.
3. An access control method according to claim 1 or 2, characterised in that the data package is identical to the temporary access code or comprises at least a part of the temporary access code in an unencrypted manner.
4. An access control method according to one of the preceding claims, characterised in that a mobile telephone is used as an access control medium.
5. An access control method according to one of the preceding claims, characterised in that the wireless connection is a Bluetooth or Bluetooth low energy connection.
6. An access control method according to one of the preceding claims, characterised in that initialisation signals are emitted from the write/read device of the object at regular intervals, prior to building up the wireless connection.
7. An access control method according to claim 6, characterised in that the access control medium requests the wireless connection on receiving an initialisation signal.
8. An access control method according to one of the preceding claims, characterised in that maintenance data is transmitted from the write/read device of the object to the access control medium via the wireless connection, subsequently to the authentication process.
9. An access control method according to one of the preceding claims, characterised in that the signal transmission by way of the capacitive-resistive coupling is effected as a transmission of an ultra-broadband signal whilst using a frequency spread method.
10. An access control system for the controlled release of an object, comprising at least one write/read device of the object for blocking or releasing an object, in dependence on a control of the access authorisation, as well as comprising at least one access control medium, wherein the write/read device of the object and the access control medium in each case comprise a transmitter and receiver device for the wireless communication via radio wave or microwave signals, and moreover a transmitter and a receiver for the capacitive-resistive coupling between the write/read device of the object and the access control medium are present in the write/read device of the object and in the access control medium, with which transmitter and receiver capacitive-resistive signals can be transmitted from the access control medium to the write-/read device of the object and/or from the write/read device of the object to the access control medium, characterised in that the write/read device of the object and the access control medium are configured to carry out an access control method according to one of the preceding claims.

Images