EP2453085B9 - Locking device - Google Patents

Description

The invention relates to a locking device with a locking cylinder and an actuating element for the locking cylinder.

the DE 10 2005 034618 A1 shows an electronic locking device and a locking method.

It is the object of the present invention to improve a locking device of the type mentioned above in such a way that there is increased security against attempts at manipulation.

This object is achieved by the combination of features of claim 1.

The arrangement of the actuator unit in the lock cylinder results in a particularly secure configuration, since the actuator unit is thereby protected from direct access, which usually emanates from the actuating element. Before the actuator can be manipulated, the actuating element must first be removed and the anti-drilling device arranged between the actuating element and the interior of the lock cylinder overcome. According to the invention, a secondary control device is provided in the lock cylinder, which is connected to the primary control device via the electrical connection means and is designed to exchange data with the primary control device. This configuration advantageously enables direct activation of the actuator unit by the secondary control device, which is also arranged in a protected manner in the interior of the lock cylinder, while operation of the secondary control device can be controlled, for example, by the primary control device. For this purpose, for example, a corresponding exchange of data between the control devices via the electrical connection means can take place, which can preferably also provide for coding or encryption of exchanged information. This effectively makes attempts at manipulation more difficult, in which the actuating element with the primary control device integrated therein is first removed from the lock cylinder, and in which an attempt is then made to control the actuator unit via the electrical connection means, which may now be exposed, in such a way that it becomes a locking element of the lock cylinder unlocked. According to the invention, the primary control device is designed to receive information, in particular control commands and/or identification data, from an identification transmitter via an interface unit and to transmit data to the secondary control device depending on the information received. The exchange of data with the information provider can preferably take place wirelessly, for example via a suitable radio protocol or using an RFID system in which the interface unit has an RFID reader and in which the information provider has at least one RFID transponder in a manner known per se which can store identification data and send it to the RFID reader when it is queried accordingly.

Alternatively or additionally, the interface unit can have means for inputting biometric data (fingerprints, retina/iris structures, DNA data). A contact-based electronic transmission, for example by means of high-frequency signals emitted by the identification transmitter, which propagate over the body surface of a person touching the actuating element, is also conceivable.

In one variant of the invention, the primary control device is designed to forward the signals received from the identification transmitter by means of the interface unit to the secondary control device via the electrical connection means. In this embodiment, the primary control device can be of relatively simple design because it essentially only has to forward the received signals, while the received signals are evaluated and the actuator unit is optionally activated by the secondary control device arranged in the lock cylinder.

In the simplest case, the primary control device can therefore be passive, that is to say it can only be used to establish an electrical connection between the interface unit and the electrical connection means, which lead to the secondary control device. In this variant, an authorization check and/or other analysis of the data received from the interface unit can preferably be carried out by the secondary control device.

In addition to simply forwarding received signals, according to a further embodiment, the primary control device can also be designed to amplify the signals received from the identification transmitter by means of the interface unit and/or to shape (filter) and/or demodulate and/or to their frequency spectrum modulate, for example, to ensure reliable data transmission to the secondary control device that performs further signal processing or evaluation. According to the invention, the primary control device is particularly advantageously designed to subject received identification data to an authorization check and, if the result of the authorization check is positive, to transmit control information signaling the positive result of the authorization check to the secondary control device. In this variant of the invention, the signals or data received are therefore already evaluated in the primary control device. The purpose of the authorization check can be a comparison, for example, in which it is determined whether the received identification data match the identification data stored in the primary and/or the secondary control device, which, for example, represent authorized users of the locking device. Depending on the storage location of the stored identification data (Primary/secondary control device) a corresponding data communication between the control devices can accordingly take place.

The identification data assigned to authorized users are particularly preferably stored in a memory assigned to the primary control device, which memory can preferably also be integrated into the primary control device. If the primary control device has a microcontroller, for example, the identification data assigned to authorized users can be stored in a non-volatile memory of the microcontroller. In this variant of the invention, the authorization check can be carried out solely in the primary control device, so that no resources need to be reserved for this in the secondary control device and for data communication between the two control devices. Only the control information signaling the positive result of the authorization check is transmitted to the secondary control device after evaluation in the primary control device. The secondary control device can then advantageously control the actuator unit directly, for example in order to unlock a locking element of the lock cylinder.

The actuator unit can act directly on a locking member of the lock cylinder in a manner known per se. As an alternative to this, however, it is also possible to design the actuating element to be rotatable, for example relative to the lock cylinder, and to provide a mechanical coupling between the actuating element and the closing element, with this mechanical coupling being able to be interrupted by coupling means arranged between the actuating element and the closing element, for example as long as there is no proper identification signal has been sent to the interface unit. In this embodiment, the actuator unit does not act directly on the closing element, but rather on the coupling means in order to control a mechanical coupling between the actuating element and the closing element. This has the advantage that an actuating force for driving the closing element has to be applied by a person using the closing device and not by an actuator of the actuator unit.

According to the invention, the secondary control device is designed to transmit at least one data sequence to the primary control device after receiving the control information signaling the positive result of the authorization check, wherein the data sequence can be used by the primary control device for future communication with the secondary control device. The data sequence preferably represents secret information that is known only to the two control devices and can therefore be used to verify future data communications between the two control devices.

As an alternative or in addition to sending such data sequences after receiving the control information signaling the positive result of the authorization check, the secondary control device can also send one or more data sequences to the primary control device at other, generally arbitrary, times in order to ensure that they always have a sufficient supply of data sequences.

According to the invention, the secondary control device is designed to form the data sequence as a function of a random process and/or a quasi-random process, with the control devices being designed to store the at least one data sequence in a volatile memory. This results in a particularly high degree of security against manipulation, because unauthorized persons cannot observe the generation of the data sequences and because new data sequences are formed again in the system after a power failure. The data sequences generated during the operation of the locking device are individual and change continuously, i.e. from sequence to sequence.

In a further preferred embodiment, both control devices each have at least one non-volatile, identical data sequence for initialization, so that a first signaling from the primary control device to the secondary control device can also be recognized as a correct communication process. This initialization sequence can be used after a battery change, for example. The initialization sequence is preferably written into the memories of the two control devices during the manufacture of the locking device, with a different value being used for each copy of the locking device 100 . The initialization sequence is preferably written into an internal EEPROM memory of the relevant microcontroller. The initialization sequence thus enables a “pairing” process which enables the control devices to communicate with one another for the first time. Dynamically generated data sequences are preferably used for further, future communications.

So that a subsequent exchange of components of the locking device (e.g. actuating element together with the primary control device arranged therein) is possible, a reset mechanism can also be provided in a further advantageous embodiment of the invention, which is preferably only accessible after the locking device has been dismantled and a new initialization sequence can be memorized eg in the control device(s).

It is also conceivable to design the primary control device in such a way that a default value for the initialization sequence can be transmitted to it once via the interface, eg by a special information transmitter, and that it stores this for future operation. This default value can also be forwarded to the secondary control device, for example is also configured in such a way that it receives the default value once via the cable connection and saves it in non-volatile memory.

In a further, particularly preferred embodiment, the primary control device is designed to form the control information signaling the positive result of the authorization check as a function of at least one data sequence previously received from the secondary control device. The control information can also be identical to the data sequence, for example. Since the data sequence was previously formed and stored by the secondary control device, the secondary control device can recognize upon receipt of a corresponding data sequence or data derived therefrom that the primary control device or its data communication to the secondary control device has not been manipulated. Only then can the secondary control device, for example, control the actuator unit.

In a further embodiment, a tensioning device is provided in the lock cylinder, which is designed to apply a tensile force to at least one component of the electrical connection means, in particular at least one electrical connection cable. For this purpose, the tensioning device can have a spring device, for example. The tensile force with which the tensioning device applies to the connecting cable is selected in such a way that a proper connection of the connecting cable to the primary control device is not impaired, but that in the event of a mechanical interruption of the connecting cable, as can occur in the event of an attempt at sabotage, this is, however, preferably completely , is pulled through the drilling protection into an interior area of the lock cylinder. This advantageously deprives an unauthorized person of the opportunity to supply the actuator unit with signals or electrical energy for activation. The embodiment described above can also be provided for such locking devices that have a secondary control device in the locking cylinder. The tensioning device is then preferably arranged between the drilling protection and the secondary control device.

In a further embodiment, at least one component of the electrical connection means is electrically and/or mechanically contacted with a contact point in the area of the lock cylinder in such a way that at least the electrical contact of the component opens to the contact point when the component is subjected to a tensile force which is greater than a holding force of the entire plug connection, in particular greater than about 1 Newton per plug contact. The contact point can be designed as a socket, for example, in which one end of a cable of the electrical connection means or a corresponding plug is held in a non-positive manner, for example by means of electrically conductive spring means. As soon as a tensile force that is too great - based on the design of the system - acts on the cable, at least the electrical connection between the contact point and the cable tears off, so that the cable can no longer be used to control components integrated in the lock cylinder. For example, a force of approximately 1 Newton per plug contact of the plug connection can be defined as excessive tensile force. In order to ensure optimal functioning of this embodiment, the length of the connecting cable and/or the non-positive connection in the contact point and/or the arrangement of the contact point and/or the routing of the connecting cable in the lock cylinder connecting cable must be coordinated as precisely as possible. In general, the force required to tear off the electrical connection between the contact point and the cable can be set within wide ranges by designing the components.

In a further embodiment, the electrical connection means have a multiplicity of individual conductors, with at least some conductors being formed from enamelled copper wire. This variant of the invention advantageously enables a "mechanical coding", as it were, since an unauthorized person cannot easily deduce from the similarity of the individual conductors and their large number which conductor serves which purpose or any purpose at all.

In a further embodiment, the electrical connection means have at least one breakable electrical conductor which, in the event of a manipulation attempt, causes the electrical connection between the actuating element or the components arranged therein and the interior of the lock cylinder to be interrupted in a targeted manner. Preferably, at least one section of the fragile conductor that is arranged in the interior of the lock cylinder is destroyed, in particular behind the anti-drill protection, so that the deliberately created point of interruption is only accessible from the side of the actuating element by overcoming the anti-drill protection.

In a further embodiment, an actuator is provided in the actuating element, which is designed to unlock a locking mechanism under activation by the primary control device, the locking mechanism being provided to make unauthorized opening of a housing of the actuating element more difficult or to prevent it. For example, the actuator can be designed so that when activated, it moves a bolt out of a locked position in which the bolt locks a first housing part (eg handle area) of the actuating element to a second housing part (eg cover) of the actuating element. The activation of the actuator can, for. B. done by the primary controller and example triggered after receiving an identification signal from a specific transponder.

An operating method according to patent claim 10 is specified as a further solution to the object of the present invention.

According to the invention, it is provided that a secondary control device arranged in the lock cylinder sends at least one data sequence to the primary control device, with the primary control device and the secondary control device storing the data sequence in a volatile memory, and with the primary control device storing the stored data sequence and/or from sends information dependent on the data sequence to the secondary control device. The data sequence, which is initially generated by the secondary control device, preferably randomly, serves as a so-called "common secret" for the two control devices, which they can use for future communication, whereby this communication can be secured against attempts at manipulation. Since no valid data communication can be set up between the control devices without knowledge of the secret data sequences, it is impossible for unauthorized persons, for example, to simulate the primary control device and in this way cause the secondary control device to activate the actuator unit.

Further features, application possibilities and advantages of the invention result from the following description of exemplary embodiments of the invention, which are illustrated in the figures of the drawing. All of the features described or illustrated form the subject matter of the invention, either alone or in any combination, regardless of how they are summarized in the patent claims or their back-reference and regardless of their wording or representation in the description or in the drawing.

Figur 1

schematisch eine erste Ausführungsform einer erfindungsgemäßen Schließeinrichtung,

Figur 2

ein Kommunikationsdiagramm der Ausführungsform gemäß Figur 1,

Figur 3a

schematisch eine weitere Ausführungsform einer erfindungsgemäßen Schließeinrichtung in einem ordnungsgemäßen Betriebszustand,

Figur 3b

schematisch die Ausführungsform gemäß Figur 3a in einem aufgrund eines Manipulationsversuchs beschädigten Zustand, und

Figur 4

schematisch noch eine weitere Ausführungsform einer erfindungsgemäßen Schließeinrichtung.

In the drawing shows:

figure 1

schematically a first embodiment of a locking device according to the invention,

figure 2

a communication diagram according to the embodiment figure 1 ,

Figure 3a

schematically a further embodiment of a locking device according to the invention in a proper operating condition,

Figure 3b

schematically according to the embodiment Figure 3a in a damaged state due to an attempted tampering, and

figure 4

schematically yet another embodiment of a locking device according to the invention.

Figure 1a shows schematically a first embodiment of a locking device 100 according to the invention, which has a locking cylinder 110 and an actuating element 120 embodied here as a rotary knob.

A housing of the lock cylinder 110 that is not designated separately can be designed, for example, in the manner of a DIN profile cylinder or some other standardized lock cylinder, so that the locking device 100 can be used, for example, instead of conventional lock cylinders in mortise locks of doors and the like. Even though figure 1 shows a configuration called "full cylinder", the inventive principle described below can also be applied to half cylinders offering locking/opening of a door (not shown) from one side only.

The actuating element 120 has a primary control device 122, which is connected via electrical connection means 130, e.g. a multi-core cable, to a secondary control device 118 arranged in the lock cylinder 110 and can exchange data with it. In a preferred embodiment, the data exchange between the control devices 122, 118 takes place bidirectionally.

The secondary control device 118 is connected to an actuator unit 114 and can control it as a function of control commands that are transmitted to the secondary control device 118 from the primary control device 122 via the cable 130 . As indicated by the arrow in figure 1 indicated, the actuator unit 114 acts on a locking member 112 of the lock cylinder, which cooperates in a manner known per se, for example with a locking bolt (not shown) of a door in which the lock cylinder 110 is installed, in order to lock the door.

In its end region 110a facing the actuating element 120, the lock cylinder 110 has a drill protection 116, which is preferably approximately bell-shaped and prevents or at least makes it more difficult to drill open the lock cylinder 110 and other manipulations in the end region 110a. In order to enable the above-described data connection between the control devices 122, 118, the cable 130 is guided through an opening in the drilling protection 116. It should be noted that figure 1 only represents a schematic drawing, in which, for example, the passage opening for the cable 130 in the drill protection 116 is indicated in the drawing to be significantly larger than is technically necessary.

The electric energy supply of the components 114, 118, 122 is brought about by an electric energy source 124 integrated in the knob 120, which can be a battery, for example, for the transmission of energy from the knob 130 can be used.

Primary control device 122 has an interface unit 122a and is designed to receive information, in particular control commands and/or identification data, from an identification transmitter 122b via interface unit 122a and to transmit data to secondary control device 118 depending on the information received. In this way, e.g.

The interface unit 122a can have, for example, an RFID (radio frequency identification) reading unit, which interacts in a manner known per se with an RFID transponder arranged in the identification transmitter 122b in order to transmit information from a memory of the RFID transponder to the control device 122. Alternatively or additionally, the interface unit 122a can enable another wireless or wired data transmission or also the exchange of biometric data (e.g. fingerprints, retina/iris structures, DNA data).

In a preferred embodiment, the primary control device 122 can be of relatively simple design, because essentially it alone has to forward the signals received from the RFID transponder, while an evaluation of the received signals and the possibly subsequent activation of the actuator unit 144, for example by the Lock cylinder 110 arranged secondary control device 118 takes place.

In the simplest case, the primary control device 122 can therefore even be passive, possibly even only used to establish an electrical connection between the interface unit 122a and the cable 130 that leads to the secondary control device 118 .

In addition to merely forwarding received signals, according to a further embodiment, primary control device 122 can also be configured to amplify the signals received from ID transmitter 122b by means of interface unit 122a and/or to shape (filter) and/or demodulate and /or to modulate, for example in order to ensure secure and reliable data transmission to the secondary control device 118 which carries out further signal processing or evaluation.

In a further, particularly preferred embodiment, primary control device 122 is designed to subject received identification data to an authorization check and, if the result of the authorization check is positive, to transmit control information signaling the positive result of the authorization check to secondary control device 118. In this variant of the invention, an initial evaluation of the received signals or data is therefore already carried out in the primary control device 122. The authorization check can, for example, involve a comparison in which it is determined whether the received identification data is in the primary and/or the secondary control device 122, 118 stored identification data, which represent, for example, authorized users of the locking device, match. Depending on the storage location of the stored identification data (primary/secondary control device), corresponding data communication can accordingly take place between the control devices.

The identification data assigned to authorized users is particularly preferably stored in a memory 122c assigned to the primary control device 122 . For example, the primary controller 122 may comprise a microcontroller, and the identification data associated with authorized users may be stored in a non-volatile memory 122c of the microcontroller. In this variant of the invention, the authorization check can advantageously be carried out solely in the primary control device 122, so that no resources in the secondary control device 188 and for data communication between the two control devices 118, 122 need to be reserved for this. Only the control information signaling the positive result of the authorization check is transmitted to the secondary control device 118 after the evaluation by the primary control device 122 . The secondary control device 122 can then advantageously control the actuator unit 114 directly, for example in order to unlock the locking element 112 of the lock cylinder 110 or to move it between different possible operating states.

figure 2 FIG. 12 shows a communication diagram by way of example, which indicates a data flow between the components 122b, 122, 118, 114 during an identification process according to the invention.

First, the identification transmitter 122b sends an identification signal s_2 to the primary control device 122, which receives the identification signal s_2 via its interface 122a.

In step 200, the primary control device 122 checks whether the received identification signal s_2 is a known identification signal s_2, which is assigned to an authorized user of the locking device 100, for example. For this purpose, a search process can be carried out via the memory 122c.

If the check 200 shows that the identification signal s_2 is assigned to an authorized user of the locking device 100, the primary control device 122 sends a release signal s_4 via the connecting cable 130 ( figure 1 ) to the secondary controller 118.

The secondary control device 118 then evaluates the enable signal s_4 and finally, by means of the signal s6, controls the actuator unit 114 in a manner corresponding to the enable signal s_4, for example in order to unlock the closing element 112.

The actuator unit 114, which can be an electromagnetic actuator (e.g. lifting magnet or electric motor), for example, can act directly on the locking element 112 of the locking cylinder 110 in a manner known per se.

As an alternative to this, however, it is also possible to design the actuating element 120 to be rotatable relative to the lock cylinder 110, for example, and to provide a mechanical coupling between the actuating element 120 and the locking element 112, which can take place, for example, by means of a shaft (not shown). This mechanical coupling can then advantageously be interrupted by coupling means which are arranged between the actuating element 120 and the locking element 112 and which are preferably arranged inside the locking cylinder 110 . For example, in a first mode of operation, the coupling between the knob 120 and the locking member 112 can be deactivated, and only if a successful identification process, cf. figure 2 , has taken place, the coupling means are actuated in a second operating mode by actuator unit 114 for a predetermined period of time in order to activate the coupling between knob 120 and locking element 112, so that an authorized person can open locking device 100 by turning knob 120 .

According to the invention, the secondary control device 118 is designed to transmit at least one data sequence to the primary control device 122 after receiving the control information signaling the positive result of the authorization check 200 (= release signal s_4), the data sequence being available from the primary control device 122 for future communication with of the secondary controller 118 can be used. The data sequence preferably represents secret information that is known only to the two control devices 118, 122 and can therefore be used to verify future data communications between the two control devices 118, 122.

The secondary control device 118 is designed to form the data sequence(s) as a function of a random process and/or a quasi-random process. For example, after receiving the release signal s_4 from the primary control device 122, the secondary control device 118, which analogously to the primary control device 122 can also have a microcontroller, can form one or more data sequences, cf. step 220 figure 2 . The secondary control device 118 then transmits the data sequence(s) to the primary control device 122, see signal s_8.

The control devices 118, 122 are designed to store the data sequence(s) in a volatile memory, e.g. in a random access memory (RAM) of the respective microcontroller. This results in a particularly high degree of security against manipulation, because unauthorized persons cannot observe the generation of the data sequences, and because new data sequences are formed again in the system 100 after a power failure.

The data sequences generated in the course of the operation of the locking device 100 are individual and change continuously, i.e. from sequence to sequence, so that the greatest possible security against manipulation is provided. This advantageously prevents, for example, an unauthorized person from forcibly separating knob 120 from lock cylinder 110 and successfully sending control commands to secondary control unit 118 via cable 130, which is then exposed.

As an alternative or in addition to sending such data sequences after receiving the enable signal s_4, the secondary control device 118 can also send one or more data sequences to the primary control device 122 at other, generally arbitrary, times in order to ensure that the latter always has a sufficient supply of data sequences has.

In a further, particularly preferred embodiment, the primary control device 122 is designed to form the control information signaling the positive result of the authorization check (= release signal s 4 ) as a function of at least one data sequence previously received from the secondary control device 118 . The control information or the release signal s_4 can also be identical to a data sequence, for example. Since the data sequence has previously been formed by the secondary control device 118 and has been stored, preferably in a volatile manner, the secondary control device 118 can, upon receipt of a corresponding data sequence or data derived therefrom, recognize that the primary control device 122 or its data communication to the secondary control device 118 has been manipulated because the data sequences are only known to the two components 118, 122. Only then can the secondary control device 118 control the actuator unit, for example.

The generation of the data sequence according to the invention by the secondary control device 118 is based on random or at least quasi-random. Random-based data sequences can be derived, for example, from an electronic noise signal that is applied to an A/D (analog/digital) conversion input of a microcontroller 118a ( figure 1 ) of the secondary controller 118, or from a value of a timer register of the microcontroller 118a. Quasi-random numbers can be determined in a manner known per se using a suitable software program for the microcontroller.

In a preferred embodiment a data sequence has a length of at least 8 bytes (= 64 bits).

In a further preferred embodiment, both control devices 118, 122 each have at least one non-volatile, identical data sequence for initialization, so that a first signaling from the primary control device 122 to the secondary control device 118 can also be recognized as a proper communication process. This initialization sequence can be used after a battery change, for example. The initialization sequence is preferably written to the memories of the two control devices 118, 122 during the manufacture of the locking device 100, with a different value being used for each copy of the locking device 100. The initialization sequence is preferably written into an internal EEPROM memory of the relevant microcontroller.

Provision can be made for the initialization sequence to be used for communication between the control devices 118, 122 only if a correspondingly encoded key has previously been recognized via the interface 122a. For example, the encoded key may be some sort of "master" transponder 122b that is authorized to initiate use of the initialization sequence.

It is also conceivable to design the primary control device 122 in such a way that a default value for the initialization sequence can be transmitted to it once via the interface 122a, e.g. from a special information provider, and that it stores this for future operation. This default value can, for example, also be forwarded to the secondary control device 118, which is also configured in such a way that it receives the default value once via the cable connection 130 and stores it in a non-volatile manner.

Furthermore, in a further embodiment, a reset mechanism for programming an initialization sequence can be provided which, for example, is only accessible after an authorized opening of the lock cylinder 110 and allows an initialization sequence to be programmed again. As a result, individual components of the locking device 100 can advantageously also be exchanged subsequently.

• die Möglichkeit, die Batterie 124, die Funkschnittstelle 122a und die Mittel 122 zur Identifizierung bzw. Überprüfung der Berechtigung eines Identifikationsgebers 122b in dem Knauf 120 anzuordnen, der gegenüber dem Innenraum des Schließzylinders 110 einen verhältnismäßig geringen Schutz gegen Manipulation bietet, wodurch Einbauraum in dem Schließzylinder 110 eingespart wird;
• ein einfacher Austausch der Batterie 124 durch Öffnen des Knaufs 120;
• die Generierung und Übersendung neuer Datensequenzen an die primäre Steuereinrichtung 122 nur dann, wenn bereits ein berechtigter Identifikationsgeber erkannt worden ist;
• keine Beobachtbarkeit der Generierung der Datensequenzen, weil diese in der abgeschirmten sekundären Steuereinrichtung 118 erfolgt;
• nicht vorhersagbare, veränderliche Werte der Datensequenzen; - keine wenig aufwändige Möglichkeit, eine Initialisierungssequenz zu manipulieren;
• keine aufwändige Decodierung in der sekundären Steuereinrichtung 118 erforderlich, ein einfacher Vergleich der empfangen Datensequenz s_4 mit einer zuvor an die primäre Steuereinrichtung 122 gesendeten Datensequenz ist ausreichend;
• bei Halbzylinder-Konfigurationen ergeben sich keine Sicherheitseinbußen.

Particular advantages of the aspects of the invention and embodiments described above are:

• the possibility of arranging the battery 124, the radio interface 122a and the means 122 for identifying or checking the authorization of an identification transmitter 122b in the knob 120, which offers relatively little protection against manipulation compared to the interior of the lock cylinder 110, thereby saving installation space in the lock cylinder 110 is saved;
• easy replacement of battery 124 by opening knob 120;
• the generation and transmission of new data sequences to the primary control device 122 only if an authorized identifier has already been recognized;
• no observability of the generation of the data sequences because this occurs in the shielded secondary controller 118;
• unpredictable, changing values of the data sequences; - no low cost way to manipulate an initialization sequence;
• no complex decoding required in the secondary control device 118, a simple comparison of the received data sequence s_4 with a data sequence previously sent to the primary control device 122 is sufficient;
• there is no loss of security with half-cylinder configurations.

Figure 3a shows a further embodiment 100a of a locking device according to the present invention in a first operating state. How out Figure 3a As can be seen, a tensioning device 140 is provided in the lock cylinder 110 between the drill protection 116 and the secondary control device 118, which is designed to apply a tensile force to at least one component of the electrical cable 130, in particular at least one wire of the cable 130, cf. the block arrow in the tensioning device 140. For this purpose, the tensioning device 140 can have, for example, a spring device (not shown).

The tensile force with which the tensioning device 140 acts on the connecting cable 130 or individual wires thereof is selected in such a way that a proper connection of the connecting cable 130 to the primary control device 122 is not impaired, that in the event of a mechanical interruption of the connecting cable 130, as is the case with a manipulation attempt can occur, the cable 130 is pulled, preferably completely, through the drilling protection 116 and into a protected interior area 110b of the lock cylinder 110. As a result, an unauthorized person is advantageously prevented from supplying the actuator unit 114 with signals or electrical energy for activation.

Figure 3b shows the locking device 100a according to FIG Figure 3a in a damaged state due to an attempted tampering. The knob 120 has been mechanically separated from the key cylinder 110 .

In a conventional locking device 100a, the cable 130 would possibly be off in this state protrude from the lock cylinder and thus give unauthorized persons the opportunity to actuate the actuator 114 or to act on the control device 118 with control commands.

However, the clamping means 140 according to the invention have advantageously pulled the cable 130, which was also severed during the attempted manipulation, using its spring force, through the opening 116a of the anti-drill device 116, completely back into the interior space 110b of the lock cylinder 110, so that the cable end 130a cannot be reached without the anti-drill device 116 to overcome.

The embodiment described above Figures 3a, 3b can also be provided for such locking devices that do not have a secondary control device in the locking cylinder 110. The clamping device 140 is then preferably provided directly between the drilling protection 116 and the actuator unit 114 . This embodiment has the advantage that, in addition to the actuator unit 114 and the clamping means 140, no further components have to be integrated into the lock cylinder 110, in particular no control unit 118, and that there is nevertheless increased protection against manipulation.

In a further embodiment 100b of the locking device according to the invention, cf. figure 4 , electrical and/or mechanical contacting of at least one component (e.g. cable end 130a) of electrical connection means 130 with a contact point 132 in the area of lock cylinder 110 is designed in such a way that at least the electrical contact of component 130a with contact point 132 opens when the Component 130a is subjected to a tensile force that is greater than a holding force of the entire connector, in particular greater than about 1 Newton per plug contact.

For this purpose, the contact point 132 can be designed, for example, as a socket, in which the end 130a of the cable 130 or a corresponding plug is held in a non-positive manner, for example by means of electrically conductive spring means. As soon as a tensile force that is too great - based on the design of the system - acts on the cable 130, at least the electrical connection between the contact point 132 and the cable 130 tears off, so that no controlled activation of components 118 , 114 more can be done.

In order to ensure optimal functioning of this embodiment, the length of the connecting cable 130 and/or the non-positive connection at the contact point 132 and/or the arrangement of the contact point 132 and/or the routing of the connecting cable 130 in the lock cylinder 110 must be coordinated with one another as precisely as possible.

In yet another embodiment, the electrical connection means 130 comprises a plurality of individual conductors, at least some conductors being formed of, for example, enameled copper wire. This variant of the invention advantageously enables a "mechanical coding", so to speak, since after a manipulation attempt, which involves the forcible removal of the knob 120, an unauthorized person cannot easily deduce from the similarity of the individual conductors of the cable 130 and their large number which of the Head which serves a purpose or at all and/or in which order they are to be controlled.

In yet another embodiment, a decoder unit (not shown) can be provided between electrical connection means 130 and actuator unit 114, which checks an activation pattern corresponding to a predetermined code on a plurality of electrical lines of electrical connection means 130 and only activates actuator unit 114 if the correct control pattern has been issued by the control unit 122. A simple yet efficient code can be achieved, for example, by realizing the decoder unit as a logical functional unit which has a plurality of inputs which are to be controlled by the control unit 122 via the connection means 130 . The logical functional unit implements a specifiable logical transfer function, and an output of the logical functional unit is connected to actuator unit 114 . Thus, the correct combination of input signals, which triggers the actuator unit 114, can only be applied in a targeted manner if the transfer function is known. The provision of storage elements in the logical functional unit offers a further increase in security against sabotage.

In yet another embodiment, the electrical connection means 130 have at least one breakable electrical conductor which, in the event of an attempt at manipulation, causes the electrical connection between the actuating element 120 or the components 122, 124 arranged therein and the interior 110b of the lock cylinder 110 to be interrupted in a targeted manner. At least one section of the fragile conductor that is arranged in the interior space 110b of the lock cylinder 110 is preferably destroyed, in particular behind the drill protection 116, so that the deliberately created interruption point is only accessible from the side of the actuating element 120 by overcoming the drill protection 116 .

Fragile electrical conductors can be produced using conventional printed circuit board technology, for example, in which printed circuit board structures with defined weakening or predetermined breaking points are provided. Ceramic substrates or metallized glass bodies can also be used to form fragile electrical conductors.

In a further embodiment, an actuator 126 ( Figure 3a, 3b ) is provided, which is designed to, under control of the primary control device 122, a locking mechanism to unlock, the locking mechanism being provided to make unauthorized opening of a housing of the actuating element 120 more difficult or to prevent it. For example, the actuator 126 can be designed so that when it is actuated, it moves a bolt (not shown) out of a locked position in which the bolt locks a first housing part (e.g. handle area) of the actuating element 120 to a second housing part (e.g. cover) of the actuating element 120 . Actuator 126 can be actuated, for example, by primary control device 122 and triggered, for example, after receiving an identification signal from a special transponder, which signals system 100 that an authorized person wishes to open knob 120, for example for maintenance purposes.

Claims (9)

1. A locking device (100) having a lock cylinder (110) and an actuation element (120) for the lock cylinder (110), wherein the lock cylinder (110) has an actuator unit (114) for actuating a locking member (112), wherein the actuation element (120) has a primary control device (122) provided for controlling the actuator unit (114); wherein the lock cylinder (110), in an end region (110a) oriented toward the actuation element (120), has an anti-drill element (116); wherein electrical connection means (130) are provided, which connect the primary control device (122) to the actuator unit (114) and are passed through the anti-drill element (116); wherein a secondary control device (118) in the lock cylinder (110) is provided, which is connected via the electrical connection means (130) to the primary control device (122) and is embodied for exchanging data with the primary control device (122); wherein the primary control device (122) is embodied for receiving information, in particular control commands and/or identification data, from an identification transducer (122b) via an interface unit (122a) and, as a function of the information received, transmitting data to the secondary control device (118); wherein the primary control device (122) is embodied for subjecting received identification data to an authorization check and, upon a positive outcome of the authorization check, for transmitting control information that signals the positive outcome of the authorization check to the secondary control device (118); wherein the secondary control device (118) is embodied for transmitting at least one data sequence to the primary control device (122) after receiving the control information signaling the positive outcome of the authorization check; and wherein the data sequence from the primary control device (122) is usable for a future communication with the secondary control device (118), wherein the secondary control device (118) is embodied for forming the data sequence as a function of a random process and/or a quasi-random process; and wherein the control devices (118, 122) are embodied for storing each at least one data sequence in a volatile memory.
2. The locking device (100) of claim 1, wherein the secondary control device (118) is embodied for triggering the actuator unit (114) after receiving the control information signaling the positive outcome of the authorization check.
3. The locking device (100) of claim 1, wherein the primary control device (122) is embodied for forming the control information signaling the positive outcome of the authorization check as a function of at least one data sequence previously received from the secondary control device (118).
4. The locking device (100) of one of the foregoing claims, wherein in the lock cylinder (110) a tensioning device (140) is provided, which is embodied for subjecting at least one component of the electrical connection means (130), in particular at least one electrical connecting cable, to a tensile force.
5. The locking device (100) of one of the foregoing claims, wherein an electrical and/or mechanical contacting of at least one component (130a) of the electrical connection means (130) having a contact point (132) in the vicinity of the lock cylinder (110) is embodied such that at least the electrical contact of the component (130a) having the contact point (132) opens if the component is subjected to a tensile force that is greater than a retention force of the entire plug connection, and particular greater than approximately 1 Newton per plug contact.
6. The locking device (100) of one of the foregoing claims, wherein the electrical connection means (130) have a plurality of individual conductors, and at least some conductors are formed of enameled copper wire.
7. The locking device (100) of one of the foregoing claims, wherein the electrical connection means (130) have at least one breakable electrical conductor.
8. The locking device (100) of one of the foregoing claims, wherein in the actuation element (120), an actuator (126) is provided, which is embodied for unlocking a locking mechanism upon triggering by the primary control device (122), and the locking mechanism is provided for making unauthorized opening of a housing of the actuation element (120) more difficult or for preventing such unauthorized opening.
9. A method for operating a locking device (100) having a lock cylinder (110) and an actuation element (120) for the lock cylinder (110), wherein the lock cylinder (110) has an actuator unit (114) for actuating a locking member (112), wherein the actuation element (120) has a primary control device (122) provided for controlling the actuator unit (114); wherein the lock cylinder (110), in an end region (110a) oriented toward the actuation element (120), has an anti-drill element (116); wherein electrical connection means (130) are provided, which connect the primary control device (122) to the actuator unit (114) and are passed through the anti-drill element (116); wherein a secondary control device (118) in the lock cylinder (110) is provided, which is connected via the electrical connection means (130) to the primary control device (122) and exchanges data with the primary control device (122); wherein the primary control device (122), via an interface unit (122a), receives information, in particular control commands and/or identification data, from an identification transducer (122b) and, as a function of the received information, transmits data to the secondary control device (118); wherein the primary control device (122) subjects received identification data to an authorization check and upon a positive outcome of the authorization check transmits control information, signaling the positive outcome of the authorization check, to the secondary control device (118); wherein the secondary control device (118), after receiving the control information signaling the positive outcome of the authorization check, transmits at least one data sequence to the primary control device (122); and wherein the data sequence from the primary control device (122) is usable for a future communication with the secondary control device (118), wherein the secondary control device (118) forms the data sequence as a function of a random process and/or a quasi-random process; and wherein the control devices (118, 122) store each at least one data sequence in a volatile memory.

Images