WO2009152628A1

WO2009152628A1 - Access control method and access control system

Info

Publication number: WO2009152628A1
Application number: PCT/CH2009/000202
Authority: WO
Inventors: Andreas HÄBERLI
Original assignee: Kaba Ag
Priority date: 2008-06-18
Filing date: 2009-06-15
Publication date: 2009-12-23
Also published as: EP2304693B1; EP2304693A1

Abstract

The invention is substantially characterized in that, for access control, in a first step a wireless radio connection (expressly meaning not only radio frequencies, but also the communication by way of microwave frequencies or other frequencies of the electromagnetic spectrum) is established between the object to which access is sought and an access control medium (mobile telephone, other electronic device, chip card, and the like). By way of said wireless connection, first an authentication method is carried out, during which the access authorization of the access control medium is checked. Thereafter, a temporary access code is sent from the object to the access control medium and from there it is returned to the object, in some instances in modified form. For this purpose, the capacitive-resistive coupling is used either for returning the – optionally modified – access code to the object, or perhaps for sending the access code to the access control medium; the signal is sent in the respectively other direction by way of the wireless connection.

Description

ACCESS CONTROL METHOD AND ACCESS CONTROL SYSTEM

The invention relates to the field as access control. It relates more particularly to an access control procedure and access control system based on an identification procedure (actually: authentication method).

Identification systems (often referred to as identification systems) are used in different applications such as access control prepaid card systems, data acquisition systems, etc. The wireless information transmissions, for example via radio frequency signals, or microwaves (eg via GSM) are becoming increasingly important. Due to the comparatively large range, the potential problem of manipulation arises. Thus, for example, by means of a distance from a data exchange point (writing and / or reading device of a locking system of a prepaid card reader, etc.) a transmitter / receiver of a manipulator be set up by means of a so-called "man-in-the-middle" Attack or another vulnerability of the exchange protocol used exploiting exploitation is performed.

For some time now, the use of so-called capacitive-resistive coupling (also called 'capacitive coupling' or 'PAN coupling') for access control has been known. This is very short-range, and it often becomes the path exploited by the human body for signal transmission. As a result, receiving signals by a manipulator positioned at some distance can be ruled out with rather great certainty.

A disadvantage of the capacitive-resistive coupling is the very low data transmission rate of the information transmission, which is generally achievable. This is because the communication device is generally set up to allow signal transmission through the human body. This prohibits high frequencies and high amplitudes.

Due to the very limited data transmission rate, either only very short data packets can be transmitted, or a correspondingly long waiting time arises. The former is undesirable for higher security applications, the latter has a negative impact on comfort.

From EP 1 102 626 a method is known, by means of which the information transmission via a PAN coupling (or an IR interface or the like) with the information transmission via a 'broadcast' medium, eg.

RF, combined. For this purpose, a key is transmitted via the PAN coupling, which transmitted the in the subsequent communication via the RF channel

Data encrypted. This procedure has the advantage that the security ensured by the very wide-ranging PAN coupling can be combined with the transmission of larger amounts of data by means of another technology.

For the application access control but also this procedure is not very comfortable, since the correct information transfer can only be used when the user is in the immediate vicinity of the writing and / or reading device (this sits, for example, in the door). It is therefore an object of the invention to provide an authorization method and an authorization system which overcome disadvantages according to the prior art and, in particular for the application 'access control', enable the necessary security and at the same time a satisfactory speed of the method.

This object is achieved by a method and a system as defined in the claims.

The invention is characterized essentially by the fact that for the access control in a first step, a wireless radio link (here are expressly meant in addition to radio frequencies communication via microwave frequencies or other frequencies of the electromagnetic spectrum) between the object to the access is sought, and an access control medium (mobile phone, other electronic device, smart card, etc.) is established. Via this wireless connection, an authentication procedure is initially performed, in which the access authorization of the access control medium is checked. Subsequently, a temporary access code is sent from the object to the access control medium and sent back by this to the object, possibly in a modified form. In this case, the capacitive-resistive coupling is used either for the return of the - optionally modified - access code to the object or possibly for the transmission of the access code to the access control medium; in the other direction the signal is sent via the wireless connection.

If the temporary access code - possibly in modified form - returns to the object correctly, the object is released. In many embodiments, the object is a door with a mechatronic Locking device, which is in communication with a - optionally integrated in the locking device - writing and / or reading device, which in turn has means for communicating over the wireless connection and for receiving and / or transmitting capacitive-resistive signals. The release of the object in this case corresponds to the mechatronic unlocking of the door.

The authentication method is any method of determining whether the access control medium is authorized to access the object. This can be done through a simple query of codes that must be present on the access control medium, over more complex, secure procedures. In particular, it is possible to carry out the authentication method in a manner known per se from the prior art or by means of a commercially available system whose protocol does not necessarily have to be known. In any case, the authentication method preferably provides a yes / no answer to the question whether the access control medium authorizes access in the present situation. Only if the answer is yes is a temporary access code generated and transmitted to the access control medium.

The temporary access code is, for example, a random sequence; it is accepted by the object only for some time after its generation, for example, for 2-10 seconds, or can be received only once ("one time" code) .Otherwise, the writing and / or reading device of the object becomes temporary Access codes are generated if, after this time, the wireless communication connection still exists but the access to the object has not yet taken place, it may also be provided that the temporary access code is valid as long as the wireless connection exists. The procedure according to the invention has the advantage that it combines the manipulation security of known authentication processes, which can take place via secure connections (for example with encryption) and can cause the exchange of larger data volumes, with the selectivity of the capacitive-sensitive coupling. In contrast to the prior art, this is done without sacrificing comfort due to delays caused by the slow, short-range capacitive-resistive coupling. The relatively time-consuming construction of a secure radio link - which may include synchronization, etc. - can take place as the user approaches the object. Over the capacitive-resistive channel then only - for example, unencrypted - a very short data sequence must be transmitted, and the release of the object can be done immediately after their receipt.

This results in a natural movement for the user. He can carry the access control medium in his pocket. As he approaches the door, a communication connection is established and the access authorization is checked automatically, without user intervention. A random access code containing random elements is transmitted - in the preferred embodiment via the secure connection - to the access control medium.

Then, for example, the access control medium constantly repeats the temporary access code or the data packet derived therefrom via the transmitter

(Transmitter) of the capacitive-resistive coupling to send out; For this purpose, a pair of electrodes present in the access control medium is supplied with a corresponding signal. Once the user is in the immediate vicinity of a receiver electrode (e.g., a door handle, which is preferably as a receiver electrode or as part of the receiver electrode of the capacitive-resistive

Received by the receiver), the reception of the signal by the capacitive-resistive coupling receiver starts; wherein the signal path may pass through the user's body when carrying the access control medium in the pocket.

Due to the procedure according to the invention, therefore, only a simple character string must be transmitted via the capacitive-resistive coupling. In particular, no data relating to the actual authentication process has to be transmitted in this step. In particular, all information that serves the writing and / or reading device for identifying / authenticating the access control medium may have already been transmitted via the wireless connection. The data transmitted with the capacitive-resistive coupling may consist of a temporary access code (containing no access control medium-specific data) which may have been modified with a simple access control medium-specific operation. Adding an ID or other simple string is not excluded.

A security against manipulation consists on the one hand in the security of the selected wireless connection; available procedures often include one

Encryption, and it is also for practical reasons (synchronization etc.) not easy and quickly possible to listen to a short time existing radio signal. On the other hand, a manipulating person could also use the unauthorized temporarily received temporary access code only to a limited extent, since this is only valid for a very short time.

According to a variant of the method according to the invention, the temporary access code is transmitted via the capacitive-resistive coupling-permanently-and then sent back via the existing wireless connection; it is easily possible for the recipient to verify that it comes from the same sender with which the successful authentication process was previously performed. In this variant too, the method according to the invention brings practically no time delays which are recognizable to the user, since the back transmission of the optionally modified access code can take place immediately after its reception via the capacitive-resistive coupling, namely via the already established wireless connection.

Particularly suitable as an information transmission channel (as the wireless connection) is the Bluetooth Low Energy standard previously known under the name "Wibree." The use of this comparatively short-range (approximately 10 m signal range) technology is advantageous in terms of safety because of the short range In addition, they favor the "access control" application for the following reason: Doors in buildings are often not wired, and wiring would be very time consuming. Therefore, such stand-alone devices rely on battery power, which is undesirable for practical reasons when these batteries need to be replaced at high speeds, so the very energy-efficient Bluetooth Low Energy technology is actually the receiver for communications between and near sensors The use of "normal" Bluetooth is likewise possible, with the disadvantage that the power consumption of such a system is higher.

The access control medium is preferably a portable device, for example a mobile telephone. In such is generally enough power available. According to a preferred embodiment, the access control medium assumes the role of "master" in Kommuninkation Bluetooth or Bluetooth Low Energy, ie the initialization of the connection is based on the access control medium. According to a preferred embodiment, after the authentication process, maintenance data is transmitted from the writing and / or reading device (the door) to the access control medium, for example battery life data etc. In the event of an accident or a necessary battery change, the non-wired write and / or Reading device via the access control medium trigger a warning signal or draw attention in another suitable manner to be remedied.

As explained above, the procedure according to the invention is particularly suitable for applications in which the access control medium does not have to be actively handled by the user, for example, but can remain in his pocket. The kapitizitiv-resistive coupling is then preferably primarily through the body of the user, which acts as a - bad - electrical conductor. Therefore, for the capacitive-resistive coupling, the ultra-wideband signal transmission using the frequency spreading method is therefore particularly preferred. This can cause the current amplitudes flowing through the body to be very small. Regarding implementation of this method and advantages, reference is also made to WO 2007/112609.

Embodiments of the invention will be illustrated below with reference to schematic drawings. Show it:

- Figure 1 is a sketch to illustrate the sequence in the inventive method;

FIG. 2 shows an illustration of a mobile telephone as access control medium in a system according to the invention; FIG. and 3 shows a flow chart of an embodiment of a method according to the invention.

According to FIG. 1, a user 1 can carry the access control medium 2, for example fastened in a pocket or on a belt. During the entire procedure, he does not have to take control of the access control medium. When the user 1 approaches a door 3 to which he intends to gain access with the method according to the invention, the data exchange via the wireless connection already sets in while the user approaches the door. The typical range for the preferably used here Bluetooth or Bluetooth low energy technology is about 10 meters. The door handle 3.1 of the door is designed, for example, as a receiver electrode for the capacitive-resistive coupling. As soon as the user touches the door handle, or shortly before, the transmission of the data packet from the access control medium 2, for example through the body of the user 1 to the receiver electrode, begins - in accordance with the method discussed in more detail below. If the data has been exchanged correctly and successfully, the door is released and the user can press the door handle. For him, the whole process is so, so whether the door would be constantly open.

If the user only moves past the door without the user attempting to operate the door handle, the authentication process may also take place. Since, however, the extremely short-range capacitive-resistive coupling does not start under these circumstances, the door does not open. For example, a person accidentally located nearby, therefore, can not open the door. Particularly preferably, the access control medium is designed as a mobile telephone 11. The mobile phone has means for communicating via Bluetooth Low Energy technology. In addition, it is provided with a transmitter (or possibly receiver, see below) for the capacitive-resistive coupling. For example, housing parts or a transparent display surface can be designed as corresponding electrodes 13, 14 or coated with them. In this regard, reference is also made to patent applications PCT / CH 2008/000057, PCT / CH 2008/000058 and PCT / CH 2008/000059, the contents of which are hereby incorporated by reference.

FIG. 3 shows a flow chart of an embodiment of a method according to the invention. Here, solid arrows between the boxes indicate signal transmissions over the wireless link (e.g., Bluetooth Low Energy), the dotted arrow indicates capacitive-resistive data transmission. In the left column are states of the writing and / or reading device (the "door") listed in the middle column states of the access control medium (hereinafter it will be described as a mobile phone, the method would be carried out analogously on other access control media) "Advertiser", "Scanner", "Initiator", "Slave" and "Master" correspond to the terminology commonly used for Bluetooth Low Energy; the corresponding states will be briefly explained below. "RCID Rx" and "JRCID Tx" stand for receiver respectively transmitter for the capacitive-resistive coupling; "Open" refers to the state of the release of the object, eg. Unlocking the door.

The time axis runs in Fig. 3 from top to bottom.

In the normal state 31 "Standby" state, in which no access control procedure is initialized, sends either the write and / or Reading device or the mobile from periodic initialization signals ("advertising packets"), for example, with a clock of between 0.2 and 10 Hz, for example, once per second In the illustrated embodiment, the initialization signals are sent from the writing and / or reading device When the advertising packet is received by the mobile phone, the mobile phone may change from the scanner to the initiator role and ask the writer and / or reader for a wireless connection (step 32), then within about 2 seconds, for example, the secure one Bluetooth Low Energy connection is set up, whereby according to common terminology the mobile telephone functions as "master", the writing and / or reading device as "slave" (step 33) the access authorization of the master has been checked (step 34).

In the case of the authentication process mentioned here, it is checked whether the access control medium authorizes access, ie by means of a data exchange via a secure, for example encrypted connection - the data exchange can be based on the challenge-response method or another suitable method the access control medium required data and / or qualifications are available. The procedure chosen during the authentication process will not be explained in detail here; It can be done according to the prior art or according to other suitable procedures. There are various different solutions from different providers, for example the "Legic®" system, in particular in connection with the communication via radio frequencies The procedure according to the invention even makes it possible to use proprietary solutions from third-party providers, ie the procedure of the authentication method does not have to be that one be known who implements the inventive method, only the result (an "OK" or an "access denied") is needed. Upon authentication, a temporary (ie only for a limited time and / or only once for access authorizing) access code is transmitted to the mobile phone by the writing and / or reading device (step 35). This is done via the secure wireless connection. This access code - or a quantity derived therefrom - is transmitted back to the writing and / or reading device repeatedly immediately and if necessary, the capacitive-resistive information transmission being used for this return (step 36). The transmission of the access code or the derived size takes place, for example, until either a time limit (for example a value between 2 and 10 seconds) has been exceeded or the access code has been received by the writing and / or reading device.

As a variant of the illustrated procedure can also be provided that the temporary access code from the writing and / or reading device capacitive resistive is transmitted to the mobile phone, and that this sends back the access code or the derived Great on the secure wireless connection, in which case the transmission of the access code by the writing and / or reading device can take place until either a time limit is reached or the returned access code or the derived variable is received via the secure connection.

The access code is, for example, a random number or random sequence or a variable composed or calculated from a random number / random sequence and further variables.

The method according to the invention can be implemented particularly simply if the temporary access code itself is sent back by the mobile telephone. As a possible derived large come of a unique number or The same, a time information, a further random variable, etc. added to the access code, sequences of the access code or a size obtained with a previously known operation on the possibly completed access code or sequences thereof.

Following the forward and backward transmission of the temporary access code-or at least simultaneously thereto-maintenance data can optionally also be exchanged, for example test data, battery life data, status data etc. can be transmitted from the writing and / or reading device to the mobile telephone (step 37) and be evaluated for maintenance if necessary; also appropriate warnings or the like can be triggered. Finally, the connection is terminated (here by the mobile telephone) (step 38), and the object is released, for example the door is unlocked (step 39).

On the far right in Fig. 3, the time is shown schematically, which is needed for the steps before or after first touching the door handle. The particularly time-consuming process steps such as setting up the secure connection can already take place while the user approaches the door and, for example, between 1 and 5 s claim - in the example shown about 2 s. Favored by the relatively long available time until a secure connection must stand, long device detection times can be tolerated, which in turn makes long advertising intervals of the object or short active scanner times of the access medium possible. This reduces the power consumption both on the object and on the access medium, without affecting the comfort for the user. The (return) transmission of the temporary access code and the release of the door, however, are very fast processes that last at most a few tenths of a second, for example. Between 0.05 s and 0.5 s, in the example shown about 0.15 s. AlIe processes are thus characterized by a very low energy consumption and are therefore suitable to be run even with relatively small and / or long-lasting batteries, for example. Especially if the writing and / or reading device of the door as a non-wired, standalone 'device available is, whose battery then, for example, only every one to two years must be replaced.

Claims

1. Access control procedure, comprising the following steps:

Establishing a wireless connection between an access control medium and a writing and / or reading device via radio or microwaves,

Conducting an authentication process based on data signals communicated between the access control medium and the writing and / or reading device via the wireless connection;

Upon authentication in the authentication process, transmitting a temporary access code from the writing and / or reading device to the access control medium;

Returning a data packet based on the temporary access code from the access control medium to the writing and / or reading device,

- wherein the transmission of the temporary access code or the resending of the data packet takes place by means of the capacitive-resistive coupling; and

- Releasing an object by the writing and / or reading device when the received data packet is recognized as correct.

2. access control method according to claim 1, characterized in that transmitting the temporary access code via the wireless connection and the resending of the data packet via the capacitive-resistive coupling takes place.

3. Access control method according to claim 1 or 2, characterized in that the data packet with the temporary access code is identical or at least part of the temporary access code contains unencrypted.

4. Access control method according to one of the preceding claims, characterized in that a mobile telephone is used as the access control medium.

Access control method according to one of the preceding claims, characterized in that the wireless connection is a Bluetooth or Bluetooth low energy connection.

6. Access control method according to one of the preceding claims, characterized in that are emitted by the writing and / or reading device previously to set up the wireless connection at regular intervals initialization signals.

7. Access control method according to claim 6, characterized in that the access control medium upon receipt of an initialization signal requests the wireless connection.

8. Access control method according to one of the preceding claims, characterized in that subsequent to the authentication process via the wireless connection maintenance data between the access control medium and the writing and / or reading device are transmitted.

9. Access control method according to one of the preceding claims, characterized in that the signal transmission takes place by means of the capacitive-resistive coupling using the frequency spreading method as a transmission of an ultra-wideband signal.

10. Access control system, comprising at least one writing and / or reading device for blocking or releasing an object in response to a control of the access authorization, and at least one access control medium, wherein the writing and / or reading device and the access control medium each have a transmitter and receiver device for have wireless communication via radio or microwave signals and also a transmitter and a receiver for the capacitive-resistive coupling are present, with which capacitive-resistive signals from the access control medium to the writing and / or reading device and / or from the writing and / or reading device to the access control medium can be transmitted, characterized in that the write and / or

Reader and the access control medium are capable of performing an access control method according to one of the preceding claims.