EP1044433A1

EP1044433A1 - Method and system for controlling access to a resource limited to certain time frames

Info

Publication number: EP1044433A1
Application number: EP99900508A
Authority: EP
Inventors: Fabrice Clerc; Marc Girault
Original assignee: Ministere des PTT
Current assignee: Ministere des PTT
Priority date: 1998-01-08
Filing date: 1999-01-08
Publication date: 2000-10-18
Anticipated expiration: 2019-01-08
Also published as: JP2002501134A; DE69912737D1; FR2773405A1; EP1044433B1; FR2773405B1; WO1999035617A1

Abstract

The invention concerns a method for controlling the access of an electronic key to an electronic lock inside a predetermined time frame which consists in; initialising the lock with a reference metering value; then, at each attempt for accessing the lock with the key: reading in the key a previously stored time frame; storing a current time value delivered by the real time clock; transmitting from the key to the lock the time frame and the current time value; and, in the lock: verifying the coherence of the current time value with the time frame; in case of coherence, authorising access, and updating the reference metering value, on the basis of the current time value transmitted; otherwise, prohibiting the key from accessing the lock.

Description

METHOD AND SYSTEM FOR CONTROLLING ACCESS TO A RESOURCE LIMITED TO CERTAIN TIME RANGES

The present invention relates to a method and a system for controlling access to a resource limited to certain time slots.

It applies to controlling access to any resource, accessed resource, the use of which is to be controlled, and the access to which is to be limited to one or more specific time slots, also called predetermined validity periods, that the resource considered is a building, a computer system, or any other object, such as a mailbox or a bank safe.

The invention applies more particularly to the control of access to resources which are not autonomous in energy and / or which have only a limited potential for checking a valid time range, in particular resources which do not have real time clock.

The validity range can be either the actual period during which it is possible to access the resource, or any other parameter making it possible to limit in time an attack by fraudulent use of the accessing resource.

The main advantage of a logical means of access to a resource compared to a physical means of access generally lies in the possibility of allowing access to the resource only within a relatively short time slot. predetermined.

Under these conditions, if the electronic key is lost, stolen, assigned or duplicated, it will not allow its illegitimate holder to access the resource outside the predetermined time slot. However, this assumes that the resource accessed is able to verify that this time range is respected. This generally implies that the resource accessed has a real time clock.

Thus, document FR-A-2 722 596 describes an access control system limited to authorized and renewable time slots by means of a portable storage medium. This system, based on cryptographic mechanisms, makes it possible to limit the period of validity of access rights to a short duration, in order to avoid illegitimate use in the event of loss, theft, transfer or illegal duplication.

However, the solution described is based on the highly restrictive assumption that the resource accessed is self-sufficient in energy, in order to maintain a real-time clock enabling it to check the validity of the time slot in which the access attempt takes place by the accessing resource.

The present invention aims to remedy the aforementioned drawbacks by allowing the accessed resource to check the range of validity without having a real time clock.

To this end, the present invention provides a method of controlling access to at least one electronic key, _^ provided with a real time clock delivering a current time value, to at least one electronic lock, inside of a predetermined time slot, remarkable in that:

(a) the electronic lock is initialized by a reference count value; then, on each attempt to access the electronic key to an electronic lock: in the electronic key: (b) a predetermined time slot is read, previously stored in the electronic key;

(c) a current hourly value delivered by the real time clock is memorized; (d) the time range and the current time value are transmitted from the electronic key to the electronic lock, and in the electronic lock:

(e) it is checked that the current transmitted hourly value is within the predetermined time range, and that it is later than the reference count value stored in the lock;

(f) if the verifications carried out in step (e) are satisfied, the access is authorized, and the reference count value is updated, from the current hourly value transmitted;

(g) if the current hourly value transmitted is outside the predetermined time range, or if it is earlier than the reference count value memorized in the lock, access to this key is prohibited.

In an embodiment which provides increased security, the following additional steps are carried out. In the electronic key: (bl) in step (b), we read, in addition to the time slot, or instead of the time slot, an electronic signature of the time slot, previously calculated and stored in the electronic key;

(dl) in step (d), the electronic key is transmitted to the electronic lock, in addition to the time slot, or instead of the time slot and the current hourly value, the signature and the value current schedule, and in the electronic lock:

(el) before step (e), the transmitted signature is verified, using a specific verification key;

(fl) in step (f), access is authorized, and the reference count value is updated, from the current hourly value transmitted, only if the checks carried out in steps (el ) and (e) are satisfied;

(gl) in step (g), access of this key to this lock is prohibited if the current hourly value transmitted is outside the time range, or if it is earlier than the reference count value stored in the lock, or if the verification carried out in step (el) is not satisfied.

Alternatively, the order of execution of steps (el) and (e) can be reversed.

The specific verification key used in step (el) can be a public or secret key.

The aforementioned time slot may include several separate time slots. In a particular embodiment, the time slot is an interval comprising two limits each expressed as a date in day, month, year and a schedule in hours, minutes, seconds.

The present invention also provides an electronic access control system, within a predetermined time range, comprising at least one electronic lock and at least one electronic key, remarkable in that the key comprises a real time clock delivering a current hourly value, and a transmission module to the lock of a predetermined time slot, and in that the lock comprises a storage module accessible in read and write, - a counting module, this counting module being updated from the current hourly value on each successful access attempt, and a module for comparing the current hourly value with the predetermined time slot and with the value stored in the counting module.

In an embodiment which provides increased security, the transmission module to the lock of a predetermined time slot is accompanied by a transmission module to the lock of an electronic signature of the time slot, and the lock comprises in addition a module for verifying the electronic signature transmitted by the key.

In a particular embodiment, the storage module comprises an electrically reprogrammable non-volatile memory.

In a particular embodiment, the electronic key communicates with the electronic lock using a contactless transmission module, by electromagnetic induction. This contactless transmission module may include a first electromagnetic coil provided in the key and a second electromagnetic coil provided in the lock. These two windings can be concentric. Other characteristics and advantages of the present invention will appear on reading the description. β detailed below of a particular embodiment, given by way of nonlimiting example.

The present invention refers to the accompanying drawings, in which: FIG. 1 is a flow diagram of the access control method of the present invention, in a particular embodiment; FIG. 2 is a flowchart of the access control method of the present invention, in another particular embodiment; FIG. 3 schematically represents the access control system of the present invention, in a particular embodiment; FIG. 4 schematically represents the access control system of the present invention, in another particular embodiment; and FIG. 5 schematically represents the contactless transmission module allowing the electronic key to communicate with the electronic lock, in one. particular embodiment.

In the following, we consider an electronic key used for an attempt to access an electronic lock. The electronic key and lock have a calculation unit. The electronic key is provided with a real time clock. This real-time clock delivers a current hourly value VH, expressed for example in day, month, year, hours, minutes, seconds. We want to limit access from the key to the lock to a given time range PH, defined as the time interval between two determined time values VH1 and VH2: PH = [VH1, VH2], or more broadly as a union of such intervals: PH = [VHl, VH2] [VH3, VH4] ... [VHn-1, VHn].

As indicated in FIG. 1, a first step 1001 of the method consists in initializing the electronic lock by a reference count value VC _rβf .

We then consider a situation where the electronic key attempts to access the electronic lock. This situation can be expressed in various ways, depending on the form and nature of the supports containing the key and the lock. By way of nonlimiting example, if the key has a tubular part or in the form of a flat tongue, the access attempt is made by introducing the tubular part into a complementary tubular cavity of the lock, or into a complementary slot, respectively. A protocol for verifying the right of access of this key to this lock is then implemented successively in the key and in the lock.

In the key, as indicated in 1002 in FIG. 1, we read a predetermined time range PH, which has been previously stored in the electronic key.

As indicated in 1003, during the access attempt, the current hourly value VH delivered by the real time clock of the key is stored in the key.

Then, in 1004, the validity range and the current hourly value VH are transmitted to the lock.

The following verification steps then take place in the lock.

In 1005 and 1006, one checks, on the one hand, the consistency between the current hourly value transmitted VH and the predetermined time range PH, and on the other hand, the consistency between VH and the reference count value VC _ref stored in the lock.

For example, in the case of a time slot reduced to an interval [VH1, VH2], we check that VH is after VH1 and before VH2, and that VH is after VC _ref .

If one of the verifications carried out in steps 1005 and 1006 gives rise to a negative response, the access of this key to this lock is prohibited.

If all of these checks have been satisfied, access is authorized, and VC _{ref is} updated by replacing it, for example, with the current hourly value VH.

Another embodiment of the method of the invention is described below, which provides increased security compared to the previous embodiment. We consider an accessed resource that is not self-sufficient in energy and / or that has only a limited potential for verifying an access right.

By "right of access" is meant the electronic signature of a range of validity. An electronic signature can be obtained using various cryptographic mechanisms, such as encryption mechanisms, or authentication. It can for example be obtained using a secret key signature algorithm or a public key signature algorithm. When an "accessing resource", or "electronic key", presents a right of access to a "accessed resource", or "electronic lock", a protocol for verifying the right of access is implemented. In this embodiment, this protocol includes, in addition to checking the range of validity, checking the electronic signature of this range of validity. In this embodiment, the validity range can be either the period proper during which it is possible to access the resource, or the period of validity of a signature key of the accessing resource allowing it to authenticate vis-à-vis the accessed resource, or any other parameter making it possible to limit in time an attack by fraudulent use of the accessing resource.

As shown in FIG. 2, in this embodiment, a first step 2001 consists, as in step 1001 in the previous embodiment, in initializing the electronic lock with a reference count value VCref-

In the case where the electronic signature S used is calculated using a public key algorithm, of the type

RSA (Rivest Shamir Adleman) for example, the public key K _P for checking the signature is stored in the electronic lock.

The electronic signature S can also be calculated using a secret key algorithm, of the DES (Data Encryption Standard) type for example. In this case, unlike the previous case, the verification key which is stored in the lock in step 2001 is secret. Therefore, it should be stored in a physically protected memory, so that it cannot be read or modified by an unauthorized entity.

We then consider a situation where the electronic key attempts to access the electronic lock. As in the previous embodiment, a protocol for verifying the right of access of this key to this lock is implemented successively in the key and in the lock. In the key, as indicated in 2002 in FIG. 2, one reads or establishes an electronic signature S (PH) of the predetermined time slot PH. This step takes place, either in addition to or in place of step 1002 of reading the time slot PH of the previous embodiment.

This electronic signature S (PH) may have been calculated beforehand, for example by an external entity for calculating signatures, independent of the key.

In this case, during a loading step, for example by means of a validation terminal, a validation entity transfers and stores the signature S (PH) in the key before this key is put into service.

As a variant, the key can itself establish the signature, if the private key necessary for this operation, as well as the cryptographic signature algorithm, has been stored in the electronic key, and if this key has the necessary computing resources.

As indicated in 2003, during the access attempt, the current hourly value VH delivered by the real time clock of the key is stored in the key.

Then, in 2004, the electronic signature S (PH) of the validity range and the current hourly value VH are transmitted to the lock. If, in step 2002, the time range PH was read in addition to the signature S (PH), this time range PH is also transmitted to the lock in step 2004.

The following verification steps then take place in the lock.

In 2005, we verify the signature transmitted. If the signature calculation algorithm is a public key algorithm, step 2005 consists, for the electronic lock, of applying the public key K _P , beforehand stored in the lock, to the verification algorithm. The positive verification of the signature makes it possible to ensure the authenticity of the range of validity [VH1, VH2], said range being obtained either by re-establishing the message during the signature verification stage, or by simple reading if it was transmitted in clear with the signature.

In 2006 and 2007, we check, on the one hand, the consistency between the current hourly value transmitted VH and the predetermined time range PH, and on the other hand, the consistency between VH and the reference count value VC _ref stored in the lock.

For example, in the case of a time slot reduced to an interval [VH1, VH2], we verify that VH is after VH1 and before VH2, and that VH is after VC _ref -

If one of the verifications carried out in steps 2005, 2006 and 2007 gives rise to a negative response, the access of this key to this lock is prohibited.

If all of these checks have been satisfied, access is authorized, and VC _re f is updated by replacing it, for example, with the current hourly value VH.

A particular embodiment of the access control system according to the present invention will now be described with the aid of FIG. 3. The system comprises an electronic key 1 and an electronic lock 2.

The electronic key 1 comprises a power supply module 11, of the battery or battery type for example. The module 11 supplies an internal real time clock 12 which delivers a current hourly value VH as defined above. Key 1 also includes a memory 13, in which the validity range PH is stored.

The real-time clock 12 and the memory 13 are connected to a module 14 for communication of the key with the lock. The module 14 allows the key, during each access attempt, to transmit to a communication module 21 included in the lock 2 the time range PH stored in the memory 13, as well as the current time value VH delivered by the clock 12. The module 21 for communication of the lock with the key is connected to a memory 22 accessible for reading and writing. The memory 22 includes a counting module 23, in which is stored a reference count value VC _ref , initialized before the electronic lock is put into service and updated using the current hourly value VH transmitted by the key 1, on each successful access attempt. The memory 22 is for example an electrically reprogrammable memory of the EPROM or EEPROM type. The lock 2 further comprises a comparison module 25, which receives the current hourly value VH transmitted by the key 1, and compares it to the predefined time range PH = [VH1, VH2] and to the reference count value VC _ref stored in the counting module 23. The comparison module 25 tests if VH> VH1 and VH <VH2, and if VH> VC _r ef.

The power supply module 11 of the key 1 optionally supplies the lock 2 with the energy necessary for the verification operations carried out by the comparison module 25, as well as the energy necessary for the module updating operation. 23 counting in case of successful access attempt. With the aid of FIG. 4, another embodiment of the access control system of the invention is described below, comprising an electronic key 41 and an electronic lock 42, which provides increased security with respect to in the embodiment of FIG. 3.

The elements of this system which are analogous to those of the embodiment of FIG. 3 bear the same reference numbers, and will not be described again. In this embodiment, the memory 13 of the key 41 contains not only the range of validity PH, but also the electronic signature S (PH) of this range of validity.

The module 14 for communication of the key with the lock allows the key 41, during each access attempt, to transmit to the communication module 21 included in the lock 42, not only the current hourly value VH delivered by the clock 12 and the time range PH stored in the memory 13, but also the electronic signature S (PH) stored in the memory 13. The lock 42 comprises, in addition to the module 21 for communication with the key, memory 22 comprising the module 23 counting, and the comparison module 25, described above, a signature verification module 24. The module 24 is connected to the module 21 for communication of the lock with the key and to the comparison module 25. The module 24 receives the signature S (PH) of the validity range and, in the case where the signature calculation algorithm used is a public key algorithm, verifies the signature S (PH) received by means of the public key K _P.

The power supply module 11 of the key 41 optionally supplies the lock 42 with the necessary energy verification operations performed by the signature verification module 24 and the comparison module 25, as well as the energy required for the operation to update the counting module 23 in the event of a successful access attempt.

FIG. 5 illustrates a particular hardware embodiment of the modules 14 and 21 for communication between the key and the lock, applicable both to the embodiment of FIG. 3 and to the embodiment of FIG. 4.

The key 1 (or 41 in the case of the embodiment of FIG. 4) comprises a rod 30 made of ferromagnetic material, furnished with copper windings 31 forming a first coil. This first winding is connected to the module 14 for communication of the key with the lock.

At each access attempt, the key 1 or 41 is housed in a tubular cavity 32 with a diameter slightly greater than the diameter of the rod 30. The cavity 32 is also furnished with copper windings 33 forming a second winding, connected to the module 21 for communication of the lock with the key. The two windings 31, 33 are then concentric, and the information is transmitted in binary coded form between the key and the lock 2 (or 42 in the case of the embodiment of Figure 4) by electromagnetic induction.

The present invention finds an application particularly suitable for access, by mail attendants, to mailboxes, which are not energy independent. Access control security can be further strengthened by adding other data to the signature and time slot information transmitted by 99/35617 PO7

15 the key to the lock. For example, you can add a serial number identifying the electronic key. In this case, the lock is provided with an additional counting module, associated with this serial number; the start of the next time slot during which a key bearing this serial number can access the lock is stored in the additional counting module.

Claims

9/3561716 CLAIMS

1. Method for controlling access to at least one electronic key, provided with a real time clock delivering a current hourly value, to at least one electronic lock, within a predetermined time range, characterized in that than :

(a) the electronic lock is initialized by a reference count value; then, on each attempt to access the electronic key to an electronic lock: in the electronic key:

(b) a predetermined time slot is read, previously stored in the electronic key; (c) a current hourly value delivered by the real time clock is memorized;

(d) the time range and the current time value are transmitted from the electronic key to the electronic lock, and in the electronic lock:

(e) it is checked that the current transmitted hourly value is within the predetermined time range, and that it is later than the reference count value stored in the lock; (f) if the verifications carried out in step (e) are satisfied, the access is authorized, and the reference count value is updated, from the current hourly value transmitted;

(g) if the current transmitted hourly value is outside the predetermined time range, or if it is earlier than the reference count value stored in the lock, this key is not allowed access to this lock.

2. Method according to claim 1, characterized in that: in the electronic key:

(bl) in step (b), we read, in addition to the time slot, or instead of the time slot, an electronic signature of said time slot, previously calculated and stored in the electronic key;

(dl) in step (d), the electronic key is transmitted to the electronic lock, in addition to the time slot, or instead of the time slot and the current hourly value, said signature and the value current timetable, and in the electronic lock:

(fl) in step (f), access is authorized, and the reference count value, based on the current hourly transmitted value, is only updated if the checks carried out in steps (el ) and (e) are satisfied;

(gl) in step (g), access of said key to said lock is prohibited if the current hourly value transmitted is outside of said time range, or if it is earlier than the reference count value stored in the lock, or if the verification carried out in step (el) is not satisfied.

3. Method according to claim 2, characterized in that the order of execution of steps (el) and (e) is reversed.

4. Method according to claim 2 or 3, characterized in that said specific verification key is a public or secret key.

5. Method according to any one of claims 1 to 4, characterized in that said predetermined time slot comprises several disjoint time slots.

6. Method according to any one of claims 1 to 5, characterized in that each time slot is an interval comprising two limits each expressed as a date in day, month, year and a schedule in hours, minutes, seconds.

7. Electronic access control system, within a predetermined time range, comprising at least one electronic lock (2; 42) and at least one electronic key (1; 41), characterized in that the key (1; 41) comprises a real time clock (12) delivering a current hourly value (VH), and means (14) for transmitting to the lock (2; 42) a predetermined time slot (PH), and in that the lock (2; 42) comprises storage means (22) accessible in read and write, counting means (23), said counting means (23) being updated from said current hourly value (VH ) on each successful access attempt, and means (25) for comparing the current hourly value (VH) with the predetermined hourly period (PH) and with the value (VC _rβ f) stored in said means (23) for counting.

8. System according to claim 7, characterized in that said means (14) of the electronic key (1; 41) further comprise means for transmitting to the lock (2; 42) an electronic signature (S (PH)) of said time slot (PH), and in that the lock (2; 42) further comprises means (24) for verifying said electronic signature (S (PH)) transmitted by the key (1; 41).

9. System according to claim 7 or 8, characterized in that said storage means (22) comprise an electrically reprogrammable non-volatile memory.

10. System according to claim 7, 8 or 9, characterized in that the electronic key (1; 41) communicates with the electronic lock (2; 42) using contactless transmission means, by electromagnetic induction.

11. System according to claim 10, characterized in that said contactless transmission means comprise a first electromagnetic coil (31) provided in the key (1; 41) and a second electromagnetic coil (33) provided in the lock (2; 42).

12. System according to claim 11, characterized in that the coils (31,33) provided in the key (1; 41) and in the lock (2; 42) are concentric.