EP0813170A2 - Electronic access authorisation system and method for detecting authorised access - Google Patents

Abstract

The system has a key (20) and lock (10) each having a memory (13,23) for a code. The system also has devices (14,24) for transmitting the codes between key and lock. A comparator (11) compares the code transmitted by the key with a code stored in the lock. Control devices (11,21) control the transmission and comparison devices and allow access when the codes match. A number of different codes are stored in the memory of the key. A corresponding number of matching codes are put into the memory (13) of the lock. The control devices are formed so that when the system is operated, each code stored in the lock is used only once by the comparator. The lock may also have a device for transmitting a code request signal. The key may have a receiver suitable for receiving this signal. The key then transmits the code in response to the code request signal.

Description

The present invention relates to an electronic access authorization system according to the preamble of patent claim 1.

The present invention further relates to a method for determining authorized access to a system.

Electronic access authorization systems are widely used today. An access authorization system is to be understood here and in the following to mean a system which enables only certain authorized persons to access the system. Typical applications are, for example, computer networks that offer services or information to an authorized user. Another application is an electronic lock with one or more associated electronic keys built into a handheld transmitter. The lock is installed in a door, for example a building or a motor vehicle, and only opens in response to a specific code transmitted by the handheld transmitter. The code can be transmitted using optical, electromagnetic or sound signals.

The applications mentioned above are only intended to be examples of access authorization systems and it should be noted that the present invention is not restricted to the examples mentioned.

In conventional access authorization systems, the user receives a specific personal code that is used by the system to identify the user.

Furthermore, it is known to use algorithms to calculate further codes from the specific code.

The problem with the known access authorization systems is that they do not offer sufficient security against manipulation attempts. Both the specific code and the calculated codes can be cracked by a specialist when observing an authorized access, possibly with computer help. It is then possible to make a copy of the key and gain unauthorized access to the system.

It is therefore an object of the present invention to increase security against manipulation attempts in the case of an electronic access authorization system and a method for determining authorized access.

This object is achieved according to the invention by an electronic access authorization system with the features of patent claim 1 and by a method with the features of patent claim 10.

The crucial new idea in the electronic access authorization system according to the invention is that not only a specific code, but a plurality of different codes stored in advance are used to determine the access authorization, the codes of the key and lock matching each other and each code being used only once . This means that every time an attempt is made to access the system, a different code is used, which means that the observation itself successful access to the system does not indicate the code that will be used next. Such an access authorization system is practically protected against any manipulation.

• Fig. 1 den Aufbau der Hardware eines elektronischen Schlosses und eines dazu gehörigen elektronischen Schlüssels, und
• Fig. 2 ein Ablaufdiagramm der Operationen im Schlüssel und Schloß zum Feststellen eines berechtigten Zugangs.

Preferred embodiments of the invention will now be described with reference to the accompanying figures. Show it:

• Fig. 1 shows the structure of the hardware of an electronic lock and an associated electronic key, and
• Fig. 2 is a flowchart of operations in the key and lock to determine authorized access.

1, reference numeral 10 generally designates an electronic lock and reference numeral 20 an associated key, only one key being shown for reasons of clarity of illustration. It is clear to the person skilled in the art that a lock and any number of keys can be provided in an access authorization system of the type in question, each key being able to open the lock alone. Alternatively, a lock can only be opened when several different keys are present. Other combinations of these alternatives are known to the person skilled in the art.

The electronic lock 10 and each key 20 have an 8-bit controller 11, 21, which is of the 87C51 type, for example, to control their operating functions. The control program for the controller is stored in an internal memory of the controller. A code address is stored in a non-volatile EEPROM memory 12 of the lock, and so on will be explained in detail below. In addition, an identification address with a length of, for example, 32 bits is stored in the internal memory of the controller, which allows a unique identification of the lock and key.

The lock and key each have an EPROM memory 13, 23, in which a large number of different codes are stored, which represent a random sequence. What is special about the arrangement is that the content of the EPROM memories, i.e. the multiplicity of codes match when the lock and key belong together, for example are identical. The storage capacity of the EPROM memories 13, 23 is variable depending on the number of expected access attempts. A typical size for this memory is between 1 Mbit and 8 Mbit.

For the lock and each key, the controller and the memory are integrated in an ASIC, a user-specific circuit. An ASIC is economically producible in mass production and is secured against reading out the memory contents if suitable measures are taken.

The key and lock have an interface 14, 24 for suitable communication, e.g. Infrared light transmission. The structure of such interfaces is familiar to the person skilled in the art and is therefore not described in detail.

Furthermore, the controller 21 of the key has a suitable interface for the manual input of control signals, for example via a keyboard 25. The controller 11 of the lock 10 controls an actuator 15, for example an electrical relay, which enables access to a system.

The structure of an exemplary EPROM memory is described below.

The lock code and key code with a length of 24 bits (3 bytes) are stored alternately in this memory. Each code is a random sequence generated, for example, by subsampling a white thermal noise source. The memory in the example described here is constructed in such a way that a data byte is stored at each address. Therefore, for example, the 24 bits of the first lock code are at the first three addresses of the memory, the 24 bits of the first key code at addresses 4 to 6, the 24 bits of the second lock code etc. at addresses 7 to 9. A lock code is used for each access authorization process and a key code together requires 48 bits. An EPROM with a storage capacity of 8 Mbit thus allows more than 150,000 access authorization processes to be carried out.

An access authorization process will now be described in detail with reference to FIGS. 1 and 2.

The lock is initially in the waiting state 100 and is waiting for identification by the key. When the operator presses an actuation key (step 200), the key sends its stored identification to the lock (step 201). If the lock has received an identification (step 101), a comparison is made between the received identification and an identification stored in the lock (step 102). If the identifications match, the controller 11 reads the current code address from the EEPROM, updates the code address and writes it back to the EEPROM.

Then in step 104 the read code address and the associated 24-bit lock code, which is read out of the EPROM 13, are transmitted to the key. The received code is compared in the key with the code that is stored at the code address in the EPROM memory 23 of the key (step 202). In the event of a match, the key transmits the 24-bit key code associated with the lock code to the lock in step 203. The lock compares the transmitted key code with its own stored key code (step 105) and, if the codes match, enables access to the system (step 106). This can trigger the generation of a suitable control signal for an actuator 15, for example.

In summary, it can be stated that the system and the key and lock are only released if the identifications and the 24-bit lock and key codes match. Since the transmitted lock code and the key code expected by the key as a response signal change after each comparison, the access authorization system is immune to manipulation.

For an additional increase in security, a counting device can be provided which, after receiving a certain number of incorrect codes, causes the lock to be temporarily or permanently blocked. Then a repeated random query can not lead to success with this system.

The data can be transmitted using conventional communication devices, for example using infrared transmitters and receivers. To make a reliable distinction between manipulation attempts and incorrect data transmission To achieve this, a check sum can be formed over a group of 8 transmitted bits, which is also transmitted. Only if the checksum is correct is a data reception evaluated as an attempt to gain access. Otherwise, a code that has been transmitted incompletely or incorrectly, for example, is regarded as receiving an incorrect code, which could result in the lock being locked unnecessarily. It should be noted that in the invention, the transmission protocol and the type of data transmission can be freely selected by the person skilled in the art.

If the access authorization system according to the invention is used in a computer network, chipsets are provided in the central computer and in the user. Here the personal identification number is replaced by the codes saved in advance.

Claims (14)

Electronic access authorization system with a key (20) and a lock (10), each having a memory (13, 23) for a code, comprising: Devices (14, 24) for transmitting the code between the key (20) and the lock (10), means (11) for comparing the code transmitted by the key with the code stored in the lock, and Means (11, 21) for controlling the transmission and comparison means and for granting access if the codes to be compared match,
characterized in that a plurality of different codes are stored in the memory (23) of the key (20) and a corresponding number of matching codes are stored in the memory (13) of the lock (10), and that the control devices (11, 21) are designed such that each code stored in the lock is used only once by the comparison device during operation of the system. Electronic access authorization system according to claim 1, characterized in that the lock (10) a device (14) for transmitting a code request signal and the key (20) one suitable for receiving this signal Receiving device (24) and the key transmits the code in response to the code request signal. Electronic access calculation system according to claim 2, characterized in that the code request signal comprises an address signal for addressing one of the plurality of codes stored in the key (20). Electronic access authorization system according to Claim 2 or 3, characterized in that the code request signal comprises at least one further additional code which is additionally stored in the lock and key memory, and that the key (20) has a comparison device for comparing the additional code received by the lock with the additional code stored in its memory and the key only transmits its code if the additional codes match. Electronic access authorization system according to one of Claims 1 to 4, characterized in that the key (20) has a device for generating and transmitting an identification to the lock and the lock comprises a device for checking the identification. Electronic access authorization system according to one of Claims 1 to 5, characterized in that the memories for storing the codes are EPROMs (13, 23). Electronic access authorization system according to at least claim 3, characterized in that the control device of the lock comprises a non-volatile memory (12) for reading and writing the address signal. Electronic access authorization system according to one of Claims 1 to 7, characterized in that the comparison, control and storage devices assigned to the key (20) are integrated in an ASIC. Electronic access authorization system according to one of Claims 1 to 8, characterized in that the comparison, control and storage devices assigned to the lock (10) are integrated in an ASIC. Method for determining an authorized access to a system with a key (20) and a lock (10), each of which has a memory (13, 23) for a code, with the following steps: Transferring (203) the code between the key and the lock, Comparing (105) the code transmitted by the key with the code stored in the lock, and Determining the authorized access if the codes to be compared match
characterized in that a plurality of different codes are stored in the memory (23) of the key and a corresponding plurality of matching codes are stored in the memory (13) of the lock, and that each code stored in the lock is compared only once with a code transmitted by the key. Method according to claim 10, characterized in that the lock transmits a code request signal to the key and in response to this the key sends its code to the lock. A method according to claim 11, characterized in that the code request signal comprises an address signal for addressing one of the plurality of codes stored in the key. Method according to Claim 11 or 12, characterized in that the code request signal comprises at least one additional code which is additionally stored in the lock and key memory, and in that the key compares the additional code with the additional code stored in its memory (23) and its Code is only transmitted if the additional codes match. Method according to one of claims 10 to 13, characterized in that the key transmits an identification to the lock and the lock checks the identification before sending out the code request signal.

Images