EP0627713B1 - Monitoring and controlling device of the differential access to at least two separate sections provided in an enclosed space - Google Patents

Description

The present invention relates to a device capable of controlling and controlling access, according to a given hierarchy, to at least first and second compartments delimited inside an enclosure. The invention is more particularly applicable to a distributor of products and / or services, such as consumable products, or transport tickets, or even a parking meter.

We know that such dispensers generally include an enclosure in which are arranged the devices capable of enabling the dispenser to operate, said enclosure being generally divided so as to delimit at least one first compartment containing the means of operation of the dispenser, such as for example the means of conveying the currency, the means of issuing a ticket corresponding to the requested service, the means of printing the ticket, or any other device necessary for the operation of the dispenser. The enclosure also includes a second compartment called to contain the values, and in particular the sums in cash introduced by the user. Said second compartment forms what is commonly called the piggy bank compartment. The latter can for example contain a "coin piggy bank" and a "bank notes piggy bank".

Each compartment has its own access door.

Access to the first compartment in which the various devices and operating systems of the dispenser are located is not regulated in the same way as access to the piggy bank. In other words, the people having to intervene inside the distributor for reasons of maintenance or upkeep, do not normally have to intervene inside the piggy bank, access to which is reserved only for persons authorized to withdraw the funds resulting from the transactions carried out.

Known distributors include locks making it possible to block access to the first compartment, and also to the second compartment (piggy bank compartment). Thus, each person called upon to intervene inside the distributor is the holder of a key. The persons in charge of maintenance and upkeep have a key giving access to the first compartment, while the persons authorized to withdraw the sums contained in the piggy bank, hold two keys, one for the first compartment and the another for the piggy bank.

This key system raises difficulties. The first is that the keys are likely to be duplicated relatively easily, and it is therefore possible to circulate these keys or to give them to people other than those authorized. It is also certain that the people involved in these devices may be tempted to carry out fraudulent maneuvers inside the dispensers. In addition, management simplification constraints lead to the provision of identical keys for a large number of distributors. However, doing so increases the risk of attempted fraud.

Also, from the point of view of the management of a fleet of distributors of this type, it is important for the manager to know with as much accuracy as possible, the nature of the operations carried out as well as their frequency, and also the identity of persons intervened on this occasion and this is particularly important with regard to the persons responsible for collecting the sums contained in the piggy bank.

In conclusion, it is desirable to determine, at each intervention inside the distributor, the identity of the person carrying out this intervention, in order to check whether the person seeking to intervene is an authorized person. It is obvious that a conventional key lock system does not allow this control, since the keys can be duplicated and the holder of a key is not necessarily an authorized person.

Devices have been proposed to try to control and regulate access to the piggy bank, and in particular to know its content. There are thus devices, in particular in the field of parking meters, comprising a collection center, associated with a memory card, and also associated with portable computer means capable of interacting on the one hand, with the collection and on the other hand, with each parking meter, in encrypted language, in particular with a view to knowing the content of the sums contained inside the piggy bank of the parking meter questioned. This device provides relative control of access to the piggy bank. However, access to the piggy bank is always carried out by means of a conventional key, with the resulting limitations mentioned above.

• des moyens de reconnaissance d'un objet d'identification d'un intervenant et introduit depuis l'extérieur,
• une unité centrale avec laquelle lesdits moyens de reconnaissance sont aptes à communiquer par des premiers moyens de dialogue,
• un actionneur disposé à l'intérieur du second compartiment et susceptible de permettre l'ouverture/fermeture d'une serrure associée audit second compartiment,

There is known from international application No. W0-85 / 01139 a device for controlling and controlling differential access to at least first and second compartments delimited inside an enclosure of a product distributor and / or services, so as to prevent access to the second compartment, while allowing access to the first compartment, said device comprising:

• means of recognizing an object of identification of a stakeholder and introduced from the outside,
• a central unit with which said recognition means are able to communicate by first means of dialogue,
• an actuator arranged inside the second compartment and capable of allowing the opening / closing of a lock associated with said second compartment,

Although this device is satisfactory, it is capable of being improved, and it is precisely the object of the invention to provide a device making it possible to control and command differential access to at least two compartments delimited inside. of an enclosure, so as to identify the person seeking to intervene inside the device, and to check that it is indeed the person empowered in this regard. The device of the invention also aims to ensure the security of the device allowing the opening of the piggy bank, in an encrypted manner, without it being possible, for a person not authorized by a fraudulent operation inside the first compartment (maintenance) to cause the opening of the piggy bank.

To this end, according to the invention, said central unit is able to communicate in an encrypted manner by the first means of dialogue with the recognition means and by second means of dialogue with said actuator, with a view to controlling the latter, and comprises means capable of generating an encrypted message using a mother key, specific to the central unit, said actuator having means capable of decrypting said message to find said mother key, the latter thus becoming the key daughter likely to be used to generate at least one communication message between the actuator and the central unit and vice versa.

Advantageously, said mother key consists of a random number generated by the central unit.

According to a preferred embodiment, said object introduced by the operator is a memory card and the recognition means include a memory card reader (LCAM).

The dialogue means include an encryption algorithm, of the preference type, D.E.S (DATA ENCRYPTION STANDARD).

The recognition means are also able to control a code specific to the holder of the memory card in order to control, in addition to the key (CAM), the identity of the card holder and therefore to ensure that the holder is the authorized person.

The device also includes a memory capable of recording all of the operations carried out, and the identity of the participants.

• la figure 1 montre de façon schématique un distributeur, en coupe longitudinale, et incluant les moyens de l'invention;
• la figure 2 est un schéma synoptique du fonctionnement du dispositif de l'invention; et
• la figure 3, montre de manière schématique, le dialogue entre l'unité centrale et l'actionneur.

The invention will be clearly understood in the light of the description which follows, referring to an illustrative but nonlimiting example, with reference to the appended drawings in which:

• Figure 1 schematically shows a distributor, in longitudinal section, and including the means of the invention;
• Figure 2 is a block diagram of the operation of the device of the invention; and
• Figure 3 shows schematically the dialogue between the central unit and the actuator.

As shown in FIG. 1, the distributor of products or services, such as for example a distributor of transport tickets, bearing the general reference 1, consists of a box 2 which is rectangular and delimits inside an enclosure itself divided into a first compartment 3 and a second compartment 4. The second compartment 4 is delimited with respect to the first compartment 3 by partitions referenced 5. The second compartment 4 is of the armored type, and is called upon to contain the sums collected in exchange for the service provided to users of such a distributor. The second compartment 4 is commonly called the piggy bank compartment. The cash stored inside the piggy bank is symbolically represented and bears a general reference 6. The dispenser comprises inside the first compartment 3 a central unit represented by the functional block 7 and intended for the command and control of the set of devices and systems necessary and specific to the operation of the ticket dispenser. For example, the central unit controls and monitors the progress of the operation of the coin selector and the routing of the coin either to the piggy bank or to the coin return; the central unit also makes it possible to control the opening and closing systems of the interior doors of the device; also, the central unit is associated with software management systems and comprising memories called to contain information specific to the operations carried out inside the dispenser.

The piggy bank 4 is disposed inside the dispenser, and is accessible by a door of its own. The dispenser itself has a door allowing access to the first compartment 3, it being understood that access to the piggy bank is not possible directly since the latter is provided with a clean door actuated by a lock disposed at the interior.

The piggy bank includes an actuator 8 capable of acting on a lock 9 capable of allowing the opening of the door (not shown) of the piggy bank 4. The actuator is connected to the central unit by connections symbolically represented by line 10 .

Also inside the distributor is a memory card reader 11 (LCAM), itself connected to the central unit by a link 12.

Also shown in FIG. 1, symbolically, the hand 13 of a user carrying a memory card 14, and moreover the hand 13A of this same user in the process of striking keys 14 of a keyboard 16 arranged on one of the exterior walls of the dispenser.

A ticket 17 represents the counterpart, in the form of a service, of the cash introduced by the user / customer.

One of the aims of the device of the invention is to allow access to the interior of the dispenser to authorized persons only, and this, moreover, in the form of a specific hierarchy according to the authorization of these the latter, certain persons being authorized to intervene inside the apparatus, in the first compartment 3, to carry out maintenance and / or repair operations there, while other persons, different from the first, will be authorized to have access to the interior of the piggy bank.

With reference to FIGS. 1 and 2, the person called upon to intervene (for maintenance or access to the piggy bank) is symbolically represented by the hand 13 and carrying a memory card 14, of known type and comprising storage means and electronic means capable of enabling dialogue with the memory card reader "(LCAM). The card 14 is inserted by the user into a slot provided for this purpose and associated with LCAM) 11. This corresponds to functional block 18 of the Figure 2 (the memory card being referenced as CAM).

The first operation carried out by LCAM is to check whether the CAM introduced complies with the type of CAM expected and suitable for the interventions to be carried out in the dispenser (see function block 19). Verification gives rise to either a negative or a positive response. If the CAM does not comply (answer no), LCAM 11 delivers information to the user, in the form of a return of the card inserted (functional block 20). This constitutes a first security step insofar as this avoids the introduction of false cards or cards which are manipulated or which do not comply with the use for which they are intended, in the context for example of the maintenance of this type of distributor.

In the event that the CAM has been recognized as compliant, the device of the invention proceeds to a second verification step, namely the identification of the wearer. Indeed, it is not enough that the CAM introduced is a compliant card, but it is also appropriate that the person who introduced this card is among those who are authorized to work inside the dispenser. In order to identify the holder of the card (block 21), the latter, as shown diagrammatically in FIG. 1, indicates on the keyboard 16 arranged on an external face of the device, a code which is specific to it, by typing on the corresponding keys 15 of the keyboard 16.

Again, depending on the result of this verification, either the transaction is rejected, and therefore the card is returned to the user (block 22), or the transaction is validated, the carrier being identified. as being a suitable carrier; the device then proceeds to a third step (block 23) aimed at determining what type of operations are to be carried out, in other words, determining the identity of the person and in particular the type of intervention which he requests and that '' it is authorized to carry out (maintenance and / repair, or withdrawal of the sums disposed in the piggy bank).

The above elements relating to the operation of the device in relation to FIG. 2, were produced by a dialogue between the LCAM 11 and the central unit, by the link 12 (FIG. 1). The verifications of the conformity of the card, of the conformity of the bearer, and the determination of the nature of the intervention to be carried out are carried out by the central unit.

As regards the determination of the nature of the intervention requested by the user, the functional block 23 offers, in the example shown, three possibilities, namely a so-called first level maintenance intervention, a so-called maintenance intervention second level, and a so-called collection intervention, that is to say access to the piggy bank in order to collect the cash it contains. These three possibilities are represented by way of example by the functional blocks of FIG. 2 referenced 24, 25 and 26.

Access to the various possibilities is carried out by the operator who, depending on the code he has introduced at the start, or depending on the card inserted, which itself carries information specific to the operation that is capable of carrying out the service provider, thus chooses the corresponding functional block (24, 25 or 26). In the event that the operator wishes a so-called first level maintenance operation (that is to say on only some of the devices contained in the distributor and / or for the consultation of certain computer files, or repair ), it should be checked once again that this is possible taking into account the nature of the card introduced, the holder, and / or other information such as the advisability of a maintenance operation and / or repair, and depending for example on the date of the last intervention or any other factual element, such as a breakdown requiring intervention.

For block 24, this leads to block 27 symbolizing the last verification step consisting in checking whether the requested operation is possible; if so, the central unit will unlock the door to the dispenser assembly and thus allow access to the interior of the latter (except the piggy bank). In the event that access is denied, the device causes the information to return to the first level maintenance menu.

Thus, for each type of operation desired, a verification is carried out, leading to a refusal or acceptance, which results in the opening of the corresponding door or the keeping of the said door closed (in case of refusal). Blocks 27, 28 and 29 correspond to these last verification steps.

If the requested operations are accepted, it leads to blocks 30, 31 and 32, symbolizing the unlocking of the corresponding door, namely for blocks 30 and 31, unlocking the main door for operations maintenance and / or repair, and for block 32, unlocking of the piggy bank compartment door.

The card holder and card identification verification operations and requested operations make it possible to ensure, by memorizing this information, in the central unit during the course of the latter, that the persons intervening are the right ones people, but also that for example the person responsible for collecting, is indeed an authorized person. It is also ensured that the latter does not intervene to carry out maintenance and / or repair operations which would exceed its function and / or its capacities.

FIG. 3 shows, in more detail, the means which allow the dialogue between the various elements of the invention, and in particular between the LCAM, the central unit, the actuator and the lock of the piggy bank.

The central unit 7 is connected, symbolically for the convenience of understanding the invention, to a means capable of generating a random number, reference 40, and a memory 41 containing a mother key in the form of a numerical value. These numerical values (random number and mother key) are used to encrypt the information which is conveyed between the central unit and the actuator, by the communication line 10. The encryption means are known in themselves, on the hardware level, and for example may call, in the form of software, a known algorithm, such as an algorithm of the DES (DATA ENCRYPTION STANDARD) type. These algorithms are known in themselves and are not described below in more detail. The encryption / decryption means are symbolically represented by the block.

The central unit 7 receives from the functional block 32 (corresponding to the functional block 32 of FIG. 2) a request to unlock the access door to the piggy bank, with a view to collection. The actuator 8 is associated with the mother key from the block 41, and also with means for encryption / decryption referenced 43. The actuator is capable of controlling, by a command line in bold line and bearing the reference 44, the lock 9 capable of opening the door of the piggy bank 4.

The central unit, upon receipt of a request to open the door of the piggy bank 4, draws a random number from block 40 and encrypts this value by means 42, using the mother key of block 41 This encrypted value of the random value is addressed by the communication line 10 to the actuator 8. The actuator in turn, by its own decryption means 43, knowing the mother key of block 41, is able to find said random number.

The latter then becomes the daughter key which will encrypt the communication between the central unit 7 and the actuator 8. The encryption may be carried out as indicated above using an algorithm of the known type such as call to a DES function.

Thus, the communication between the central unit and the actuator is carried out in encrypted form, in an inviolable manner, since the daughter key used to encrypt the message is a random number which is known only to the central unit and the actuator. It is therefore not possible to intervene at the level of communication, by fraudulent maneuvers of simulation, display or detection of the commands or orders communicated, to actuate the actuator with a view to the opening of the piggy bank 4 The link 44 between the actuator and the lock is a so-called power link since the lock is essentially an electrical-mechanical device which requires electrical power, in particular significant power. The device of the invention makes it possible to isolate the actuator part inside the piggy bank, and thus to prevent any direct action on the lock, by means of power relatively easy to duplicate.

In addition, the device includes means for memorizing the characteristics of the operations carried out, such as the number of operations, the identity of the people involved and also the memorization of the characteristics of valid memory cards but which have been lost and then found by an unauthorized person and fraudulently introduced into the dispenser. This allows from the start of operations to identify any fraudulent maneuver.

The above description refers to the security aspect vis-à-vis the piggy bank (money).

The system of the invention also makes it possible to ensure security of access to the maintenance compartment which can hold, in the form of pre-printed transport tickets, very important values.

Indeed, the actuator and the encryption system of the invention control the opening of the two doors of the two compartments "piggy bank" and "maintenance".

A person authorized for maintenance, who has opened the maintenance door, must not have access to the closing system of this same door; otherwise, he could fraudulently block the actuator and thus intervene later on a machine without "defense".

This is why the complete maintenance compartment and piggy bank closing assembly are located in the shielded zone of the piggy bank compartment.

The invention is not limited to the embodiment described above, but encompasses any variant as it appears in the claims below.

Claims (7)

1. A device for controlling and giving differential access to at least a first compartment (3) and a second compartment (4) defined inside an enclosure (1) of a dispenser for goods and/or services, in such a manner as to prevent access to the second compartment (4) while allowing access to the first compartment (3), said device comprising:

   · recognition means (11) for recognizing an identifying object (14) of an intervening person (13), the object being inserted from the outside;

   · a central unit (7) with which said recognition means (11) are adapted to communicate through first dialog means; and

   · an actuator (8) disposed inside the second compartment (4) and adapted to allow opening/closing of a lock (9) associated with said second compartment,

   said device being characterized in that said central unit (7) is adapted to communicate in an encrypted manner through the first dialog means with the recognition means and through second dialog means with said actuator (8), so as to control the actuator, and includes means adapted to generate an encrypted message with the aid of a mother key specific to the central unit (7), said actuator (8) having means (43) adapted to decrypt said message in order to recover said mother key, the latter thus becoming the daughter key adapted to be used to generate at least one communication message between the actuator (8) and the central unit (7) and vice versa.
2. A device according to claim 1, characterized in that said mother key is formed by a random number generated by the central unit (7).
3. A device according to claim 1 or 2, characterized in that said object (14) inserted by the intervening person is a memory card (14) and the recognition means (11) include a memory card reader (MCR).
4. A device according to any one of claims 1 to 3, characterized in that the dialog means include an encrypting algorithm.
5. A device according to claim 4, characterized in that said encrypting algorithm is a DES (data encryption standard) algorithm.
6. A device according to any one of claims 3 to 5, characterized in that the recognition means (11) are also adapted to check a code pertaining to the holder of the memory card (14).
7. A device according to any one of claims 1 to 6, characterized in that it further includes a memory adapted to record the set of operations carried out and the identity of the intervening persons.

Images