Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
  • G07C9/00571—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated by interacting with a central unit
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
  • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C9/00—Individual registration on entry or exit
  • G07C9/20—Individual registration on entry or exit involving the use of a pass
  • G07C9/27—Individual registration on entry or exit involving the use of a pass with central registration
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C2209/00—Indexing scheme relating to groups G07C9/00 - G07C9/38
  • G07C2209/08—With time considerations, e.g. temporary activation, valid time window or time limitations

Definitions

• the invention relates to access control systems and especially to mobile communication between the lock and the access control system.
• the objective of the invention is to create a cost effective way to connect a lock in separate premises to a centralized control system with minimum required hardware and to create a way for occasional visitors to get the access licence for a remote lock in cost efficient and easy way.
• the present access control systems are based on hierarchical structure.
• the database of the access control data is in one server, and the database is at least partially copied to the lower level servers. If the main database server is down or disconnected from the network, the rest of the system works still autonomously. All the lower level components are working in the same way. This makes the system fail tolerant, only updating of the control data is delayed, if the connection to the control data database is lost.
• one building has at least one server for managing doors and routing the communications between the door controllers and the rest of the infrastructure. This makes it very costly to connect a separate building with only one controlled door to the infrastructure.
• a lock needs to be connected in some way to the server in order to get the access right information from the database and report the transactions to the database.
• the problem is that the needed infrastructure is very expensive for one separate door, as the cost of servers and network infrastructure is needed only for small amount of doors in one building and the need for temporary keys and connection to infrastructure is still needed for security.
• An example of that kind of access control need is for a telecommunications switch, a cross-connection closet, a base station, or a transformer room or other kind of technical premises that are not maintained by the occupant of the house. In this case, often the visitors should be logged and the access licences should often be only for some hours at a time.
• the lock is standalone, the present infrastructure model needs communication channel, and local infrastructure for even only one lock. This is extremely expensive, as only one lock shares a communications server and door manager and the wiring in also a considerable cost.
• the aim of invention is to create an inexpensive infrastructure for a single or only a few doors to connect to the access control infrastructure without needing any costly cabling, computer system or complicated configuration. Further the aim is to create an easy way to grant access licences and to track use of them. Further the licences should be granted without distributing access control tag or badges to users.
• the invention makes effectively use of the existing access control infrastructure, connecting only a gateway to the controlling servers of the access control infrastructure.
• the communications between the lock controller and the gateway is enabled by a mobile terminal of the lock user.
• This makes the infrastructure cost per door very small, the lock is off-line, but the user's mobile terminal is online-key to it, and the infrastructure is able to log events and use up-to-date licensing and key-database with minimal changes to the existing system.
• the user identification is based on the mobile terminal's phone number (embedded in the phone's SW) and an (optional) password inquiry which makes the identification fairly safe. This makes it possible to give an authorization to a user of defined phone number and password instead of giving authorization to a key badge that must be sent in advance to the user.
• the licences can be easily granted to a user of other organization, and still having a track of at least the phone number of the user.
• the invention is based on using an on-line mobile terminal as a key and communication gateway for an off-line lock.
• the lock is still controlled by the infrastructure for each event, if necessary.
• Another object is to grant and cancel "keys" or licences to mobile terminal users without a badge.
• Fig 1 Schematic diagram of a known access control infrastructure
• Fig 2 Schematic diagram of the arrangement according to the invention
• Figure 1 shows an example of an infrastructure of existing technology.
• the system is redundant and hierarchical, geographically distributed.
• Database server DS also called application server
• Communication Servers CS are often in same strictly guarded premises with database server DS.
• Door manager controllers DMC are based for each location, and finally the door managers DM are reading the badges, communicating with the rest of the infrastructure and monitoring the door.
• the complicated hierarchical system is necessary for decentralizing and for fault-proofing. Also the load balancing is one issue, so that the data base can be updated hierarchically.
• door manager DM is a small computer with I/0-lines for communication to DMC and for controlling the lock, reading badges or cards, motion detection, or for example to connect to biometric devices.
• one separate lock in one building needs always 2 computers, namely Door Manager DM and Door manager controller DMC and the wiring and communications channel from the building to the access manager. Therefore, connecting one separate door to the system needs a lot work and expensive hardware.
• FIG. 2 shows infrastructure needed for a door controlled with method according to the invention.
• the Front Manager and the Door manager controller is replaced by a Gateway GW, and a mobile terminal MT.
• the Lock Manager sends its identification to the mobile terminal MT.
• the software in the mobile terminal MT sends the identification information of the door together with the identification information of the MT itself to GW.
• the gateway is connected to DS, so it acts like a CS. If gateway is under a CS, it acts like a DMC towards the closed network of the infrastructure.
• the port of the gateway is connected to public network PNW, for example to internet or to public telecomm network or to public mobile network through which the mobile terminal can communicates with the gateway.
• public network PNW for example to internet or to public telecomm network or to public mobile network through which the mobile terminal can communicates with the gateway.
• the door manager used in the method according to the invention may be much simpler than the door manager in the system of figure 1.
• the door manager in the system according to the invention may have very limited amount of connections.
• the necessary connections for the DM are power supply, Bluetooth and lock control, maybe also keyboard.
• the door manager should have enough processing power for encrypting messages and memory for storing the encryption keys and badge key codes and their validity information.
• the gateway server is working as a link between the mobile net or the internet or other equivalent communications media (PNW) and the network of the access control infrastructure.
• the later network is usually physically strictly isolated, usually inside locked and guarded room.
• the gateway is acting towards the servers of the access control infrastructure as a network element of the infrastructure. Therefore, there is no need for change of configure the infrastructure, the system according the invention is bolt-on solution, that is transparent to the rest of the infrastructure.
• the lock is controlled by a door manager DM next to the lock.
• the controller includes a short range communication means (BT), for example a display, Bluetooth, IrDA or WLAN.
• BT short range communication means
• BT Bluetooth is the preferred option, but also WLAN or even manual entry with keyboard and a display is a possible option, even it is more expensive to install, and inconvenient and slow for the user.
• the short-range communication means (BT) are used to send the identifying information of the lock to a mobile terminal of the user of the lock. In the mobile terminal there is a midlet that recognizes the identifying information, and possibly the midlet asks confirmation or password from the user. After that, the terminal sends the identifying information of the user, itself and the lock to the gateway.
• the lock uses first a beacon-signal, after a MT makes a communication link with the DM; the DM sends a single use random code to MT.
• the MT sends this random code, its own identification information and maybe a pass code of the user to GW.
• GW verifies the message, sends an encrypted, unique reply to the MT, and MT can use the content of the reply once or several times to open the door by sending the content of message from GW to the DM.
• the gateway sends the information in a form of a key and the lock information and asks authentication from the infrastructure to open the lock. In the same time the GW send the auditing information of the users acts. In case of later described automatic mode, where the key code is valid for opening the lock several times, the GW does not necessarily get the auditing information immediately or maybe never gets detailed information about all the incidents. If the key code is valid for single use only, the infrastructure is always aware of all the incidents.
• All the communications are preferably encrypted with public key encryption, preferably the messages include a single use random number to ensure that recording or copying the message is not useful for fraud.
• the communications in the public network must be encrypted.
• the public key encryption is easier, as the mobile terminal needs not to exchange secret key.
• random encryption keys for each communication session there is no way for outsider to track the users by capturing the radio- communications, as only the door beacon is always the same and the first connection of the MT is already encrypted with the public single use key of the DM.
• the DM and GW may know each others public keys, so they do not need to change the public key every time, but the message needs to have an order number or time stamp, so that the code is unique.
• the gateway is critical point, as it connects the closed network to the public network.
• the gateway may be therefore a combination of several computers, for example a firewall and a gateway. This makes cracking into the closed network more difficult, as both computers in serial must be cracked.
• the system can work in two different modes, manual mode works every time on-line.
• manual mode the mobile terminal asks every time the authorization information from the central lock infrastructure. The authorization is therefore for single use.
• automatic mode the mobile terminal may ask the authorization automatically in a background process and the authorization is valid for a time period.
• the mobile terminal asks an authorization that is valid for a certain time interval and maybe also for a set of doors.
• the phone may ask a new authorization after the old authorization is expired. This may be done automatically in a background process or when first time trying to open the door after the expiration or when entering to the coverage area of the DM transmitter.
• the authorization for multiple uses is easier to abuse, but the opening the door does not need to open the GPRS-connection to the gateway, so the opening of the lock is practically instantaneous.
• the automatic mode is preferably using public key encryption, so that the lock uses every time a different code, and the mobile terminal uses its authorization code for creating the reply message. The opening message is never the same twice, so capturing the message would not make possible to copy the authorization.
• the automatic mode authorization code is not normally easy to cancel, so the automatic "key code" should be for moderately short period.
• the lock controller may have a list of cancelled codes, but it can be updated only if there is a communication channel to the infrastructure.
• automatic mode is used for less critical areas, where a lost phone and key code is not critical.
• the software in the mobile phone may also be able to cancel the code by remote control from the network. If the code of the MT software is for example Java, this is moderately easy to tamper by end user and the cancelling may be inactivated.
• the key codes are valid only for some hours, so the probability of misuse of a lost phone is relatively small in any case.
• the infrastructure may command the lock (DM) to manual mode, that case the next mobile terminal requesting a key does not receive automatic mode key-code but a command to enter manual mode, this code may be encrypted and transparent for the MT, so it is not possible to tamper.
• the message from GW may also contain more information, a list of banned key- codes, and the lock manager may send access information to the infrastructure with the authorization request.
• the off-line lock is practically on-line each time there is a transaction with first to MT and maybe later (automatic mode) to GW, as the communications is preferably encrypted with keys of DM and GW, the MT is not able to detect or alter the contents of the messages. So there no easy way to false any codes, as the MT can be also recognized by the mobile network, as the MT has unique number and also it is possible to detect the IMEI and the MT software serial number together with the software password, if necessary.
• the mobile terminal is listening in a background process the beacon signals and the mobile terminal automatically makes a contact to the door managers (DM) the mobile terminal assumes the user may want to open or the user may have access rights.
• the phone may also ask automatically a short term ticket for each door, or open a connectionless channel to GW in advance.
• the infrastructure also receives more often information from the door managers and the infrastructure gats also information about the movement of the users, even they do not open any door. This enables higher security, and the door managers may receive cancelling message of user rights faster, as any user nearby can relay the information between the DM and GW. Also the stolen MT or user with cancelled user rights may cause alarm even by entering to the coverage of any DM.
• This background process is cost effective, as the GPRS data needed is very limited and the Bluetooth is mainly only receiving.
• the battery consumption of the mobile terminal is not raised too much and a few kilobytes of data sent automatically are not too costly to send over GPRS or UMTS even in daily bases.
• the time for opening in full manual mode is around 10 to 20 seconds more than in the automatic mode with background negotiating in advance.
• the opening tickets expiry times may vary from some minutes to days.
• the operation of door is virtually immediate, the user selects the door from the door list and the door opens immediately.
• the beacon signals of the doors enable the mobile terminals to connect to all the DMs that are in the range of the Bluetooth, and therefore the Bluetooth connection to the DM is ready all the time, and if the opening "key code" or ticket is asked in advance from the GW, the phone can open the door immediately.
• the phone next time takes contact to the GW, and the door the incident information is sent to the GW.
• the DM and GW can track the communications and if there is fraud detected the user may be banned and the system makes an alarm.
• the fraud may be for example, that the terminal is refusing to pass the messages after opening the door. That case the alarm may be set, and also the next user's terminal is passing the necessary information in any case.
• There is no easy way to prevent the incident information transmission as the encrypted message content is not readable by the mobile terminal, and the user cannot control the message content.
• the method is as fast for the user as a pass code ticket stored in the mobile terminal used in the prior art.
• the pure gateway solution for data transmission via mobile phone offers high security for the user identification, and the user rights may be checked for each incident. But if the authentication is not prepared in advance, the opening of the lock takes typically over ten seconds, which is annoyingly slow.
• the automatic negotiation and frequent connection between the lock and the lock solves both security problem and smooth operation for the user.
• the mobile phone (MT) of the user is replacing the need for own communication channel for the lock and the infrastructure can be sure, that the mobile phone is in the proximity of the lock before opening the lock.
• the lock manager computer with Bluetooth is much cheaper to manufacture and to maintain than if the lock would have own GPRS-, WLAN- or Ethernet- connection for connecting to the gateway.
• This case still the identity of the mobile phone must be verified through the telecomm or GPRS-network and the short distance communications is needed anyway for the proximity check, i.e. the user is close to the door, he wants to open. So, if the phone is to be used to open the lock, it is advantageous to use the user's phone for all the communications between the lock manager and the gateway.
• the amount of the data to be transferred is relatively small, much less than a kilobyte for authorization. In automatic mode the authorization is made relatively seldom. It is possible to use the text-messages (SMS) to transfer the authorization codes, but typically the GPRS is cheaper to use for a short two-way connection.
• SMS text-messages
• the connection type is not relevant; the connection may as well be WLAN with user authentication, if available for the MT.
• the GW is connected to public internet, to mobile cellular network with SMS or with GPRS or equivalent, or to several communication channels or it may use external gateways for reception of SMS from public internet.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Mobile Radio Communication Systems (AREA)

Applications Claiming Priority (2)

Publications (2)

Family

ID=34778480

Family Applications (1)

Country Status (3)

Cited By (3)

Families Citing this family (32)

Citations (1)

Family Cites Families (3)

• 2005
  • 2005-06-23 FI FI20055344A patent/FI20055344A0/fi not_active Application Discontinuation
• 2006
  • 2006-06-22 WO PCT/FI2006/050277 patent/WO2006136662A1/en not_active Application Discontinuation
  • 2006-06-22 EP EP06764516A patent/EP1897066A4/de not_active Withdrawn

Patent Citations (1)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events