EP2137704A2 - Procédé d'authentification d'un terminal de téléphonie mobile - Google Patents

Procédé d'authentification d'un terminal de téléphonie mobile

Info

Publication number
EP2137704A2
EP2137704A2 EP07845283A EP07845283A EP2137704A2 EP 2137704 A2 EP2137704 A2 EP 2137704A2 EP 07845283 A EP07845283 A EP 07845283A EP 07845283 A EP07845283 A EP 07845283A EP 2137704 A2 EP2137704 A2 EP 2137704A2
Authority
EP
European Patent Office
Prior art keywords
avo
authentication device
identification means
idm
mfe
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP07845283A
Other languages
German (de)
English (en)
Inventor
Christian Csank
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
CSANK Christian
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Publication of EP2137704A2 publication Critical patent/EP2137704A2/fr
Withdrawn legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • the invention relates to a method zw authentication of a mobile terminal, which is uniquely characterized by means of identification, by an authentication device which can store the identification means of the at least one mobile station in at least one memory unit and which covers a Seten transmission and reception area.
  • the invention relates to an authentication device for authentication of at least one mobile radio terminal, which can be uniquely characterized by means of identification.
  • a mobile terminal is understood to mean any terminal which can exchange data with another terminal via radio, for example mobile phones and personal digital assistants (FDAs).
  • FDAs personal digital assistants
  • the large number of possible radio standards from GSM, WAP, UMTS, GPRS and Bluetooth to W-LAN allows for a variety of applications.
  • the authentication device with the at least one mobile radio terminal initiates a connection as soon as the at least one mobile terminal is in the transmission and reception area of the authentication device, and the authentication device on Radio interrogates the identification means of the at least one mobile station and checks whether they are identical to the identification means stored in the memory device with at least one memory unit, wherein in the case that they are identical, the authentication device terminates the connection establishment and performs an action.
  • the identification means comprise an identification number, which is a manufacturer-unique assigned device number. This number is a device-specific number that provides a high level of security as it is awarded only once worldwide.
  • Bluetooth TM is an industry standard developed in the 1990s in accordance with IEEE 802.15.1 for the wireless radio networking of devices over short distances.
  • Bluetooth TM uses a wireless interface, which is present in most of today's mobile terminals, thus facilitating the use of the method according to the invention.
  • Bluetooth TM includes various security mechanisms that allow a high level of security.
  • the identification means include a bluetoothTM-specific connection key (also: "link key") generated in this "pairing process". This connection key is typically a 128-bit key.
  • the pairing process and thus the generation of the connection key, only takes place when the connection is confirmed by the connection subscriber offered to establish the connection by entering a PIN code which can be between 4 and 16 bytes long.
  • the PIN code can optionally also be valid only once (one-time code). If the mobile terminal device is lost, a new PIN must be entered on the authentication device side, which can then also be used only once. This ensures that the high security of the link key is not circumvented by the lower security of the PIN.
  • the abovementioned object can also be achieved with an authentication device of the type mentioned in the introduction by providing at least one search module for the search for mobile radio terminals in the transmission and reception area of the authentication device, and at least one connection module for establishing a connection with found ones Mobile terminals, also a memory device is provided with at least one memory unit in which the identification means of the authenticated mobile terminals are stored.
  • An advantageous variant of the system according to the invention can be achieved by arranging the at least one memory unit directly in the at least one search module.
  • Such a system can be produced particularly space-saving.
  • commonly used storage units are limited in their storage capacity.
  • the storage device comprises at least one internal database, which is arranged in the authentication device.
  • the storage device may include at least one external database located outside the authentication device.
  • the arrangement outside of the authentication device, the external database can also be made larger by their physical dimensions, which of course a larger storage space can be realized.
  • the external database can be located remotely from the authentication device, for example on a central server.
  • the identification means of mobile radio terminals can be stored in the at least one internal database or the at least one external database and deleted from the at least one memory unit. This can prevent that a connection is not possible because the storage space of the storage unit is used up and no further connection can be established.
  • the authentication device polls the identification means of a mobile station which is located in the transmission and reception area of the authentication device, it is advantageously checked whether the identification means are stored in the internal database or in the external database, and when the identification means are located, the identification means are turned off the internal database or from the external database in the at least one storage unit transmitted and a connection is initiated.
  • this introduces an intermediate step into the authentication, it is thereby possible to carry out the authentication according to the invention and at the same time to utilize the much larger storage space of an internal or external database.
  • the at least one search module and the at least one connection module are Bluetooth TM modules. This makes it possible to use the Bluetooth TM wireless standard, which can be said to be established worldwide, as many mobile terminals currently in use are already Bluetooth TM enabled.
  • the range of the at least one search module and the at least one connection module can be reduced by device-internal attenuation of the radio signal or by surrounding the parts of the modules that emit and receive the radio signal with a damping material.
  • the former can for example be realized with a resistor, the second can be achieved by shielding the antenna or by using directional antennas. If you reduce the range of the modules, you can prevent unintentional communication with the authentication device and unintentional triggering of an action, eg opening a door.
  • FIG. 4 is a block diagram of a method according to the invention.
  • FIG. 1 shows by way of example a door ENT.
  • a USR user To open this door ENT, a USR user must be authenticated for this. The authentication opens the door.
  • Authentication is in this case a mobile terminal MFE, which communicates with the authentication device AVO via the Bluetooth TM wireless standard.
  • the advantage of using Bluetooth TM lies in its intrinsic security features and limited range. Depending on the transmit power, Bluetooth TM can be used over distances of up to 100 m. In the example of FIG. 1, however, a much lower power is used, so that the transmission and reception range SEB is very limited. In addition to reduced transmission power, the range can also be limited by the signal is attenuated.
  • the mobile radio terminal MFE has identification means IDM which comprise at least one identification number IDN which is a device number assigned once by the manufacturer. This number consists of 6 bytes and is awarded worldwide only once.
  • IDM identification number
  • IDN a device number assigned once by the manufacturer. This number consists of 6 bytes and is awarded worldwide only once.
  • the Bluetooth TM chip which in the present example is used in the mobile terminal, this number is deposited on the production of the chip on this. The representation of the number takes place in a six-digit hexadecimal number. The first three blocks form the manufacturer code, the remaining ones are used for internal coding.
  • another identification means IDM of the mobile radio terminal MFE is the bluetooth TM -specific connection key VBS (also: 'Link Key').
  • This connection key VBS is generated at the first contact between two Bluetooth TM enabled devices. This is done by the device initiating the connection, a PIN request to the other device.
  • the PIN code that needs to be entered can be between 6 and 16 bytes long. If the PIN is entered correctly, a connection is established and there is a so-called 'pairing' (also: 'pairing') between the two devices.
  • the identification number of the other device is stored directly in the Bluetooth TM chips.
  • the connection key VBS is calculated and generated. It is a 128-bit key that is also stored in the Bluetooth TM chips for added security. Each time a connection is established between the two devices, it is then checked whether this connection key is correct. If the connection key VBS is correct, then no PIN code must be entered subsequently.
  • These numbers represent the identification means IDM of a mobile station MFE.
  • any further authentication takes place automatically.
  • the authentication device AVO makes contact with the mobile radio terminal MFE and checks whether its identification means IDM are stored in the storage device SPV. If this is the case, the door ENT opens. If the mobile radio terminal MFE is not authenticated and therefore its identification means are not stored in the memory device SPV of the authentication device AVO, the contact is aborted and the door ENT remains closed.
  • an authentication device AVO comprises at least one search module SM1, SM2 or SM3, a connection module VBM and a storage device SPV with at least one storage unit SPE1, SPE2 and SPE3, as shown in FIG. 3a. Furthermore, the authentication device AVO comprises one or more inputs ENG and one or more outputs AUG1 and AUG2.
  • the input ENG is used to operate the device not only with the mobile station MFE, but also by other means, such as a conventional changeover switch. In the present case, this would mean that the door ENT of Figure 1 can not only be opened by authenticating an authorized mobile terminal MFE, but also by simply operating a conventional toggle switch connected via the ENG input.
  • the outputs AUG1 and AUG2 serve to activate the required action, in this case the opening of the door ENT, that is to say, for example, an electric lock is operated. Furthermore, by providing one or more additional outputs, it is also possible to control various activities via an authentication device AVO.
  • a list of the identification means IDM of the authenticated mobile radio terminals is stored in the at least one memory unit SPE1, SPE2 or SPE3 of the memory device SPV. This list is also known as the Access List. It is always possible to assign or revoke authentications by adding or removing identification means. This can be done from a server. Decisive here are the intervals in which the server synchronizes with the storage unit: They define the intervals in which the 'access list' is updated.
  • the connection module VBM is responsible for establishing a connection to authenticated mobile radio terminals found. The connection is established on a low protocol layer to ensure interoperability with all bluetooth TM enabled devices.
  • the search modules SM1, SM2 and SM3 are Bluetooth TM modules in the exemplary embodiment described. By way of example, three search modules are used here, but it is also possible to use only one or much more than three.
  • the at least one search module permanently searches for mobile radio terminals MFE within the transmission and reception area SEB. If several search modules are used, the method of "asynchronous search" can greatly reduce the time for finding a mobile radio terminal MFE, which is located within the transmission and reception area SEB.
  • the search modules are supplied with voltage with a time delay.
  • different frequency ranges of the Bluetooth TM frequency band are searched at any time, which can drastically shorten the duration of the search for a mobile radio terminal.
  • the search modules As soon as the search modules have found a mobile radio terminal MFE, it is checked whether the identification means IDM transmitted by the mobile radio terminal MFE are identical to those stored in the at least one memory unit SPE1, SPE2 or SPE3 of the memory device SPV of the authentication device AVO. If this is the case, a connection is established.
  • the identification means IDM of the mobile station MFE of the relevant person USR must be stored in the at least one memory unit SPE1, SPE2 or SPE3 of the memory device SPV. Furthermore, the person USR a PIN code must be communicated, which must be entered when first contacting the search modules with the mobile station MFE. This PIN code is also stored in the at least one memory unit of the authentication device.
  • the storage device SPV can be expanded by a database in addition to the at least one storage unit SPE1, SPE2 and SPE3.
  • a database in addition to the at least one storage unit SPE1, SPE2 and SPE3.
  • many more mobile devices can be authenticated, the only limitation being the size of the database.
  • Either an internal database IDB as in FIG. 3b or an external database EDB as in FIG. 3c can be used.
  • a mobile radio terminal MFE is now found when using a database by the authentication device AVO, it is checked whether its identification means IDM are in the database. If so, the identification means are copied from the database into the at least one memory unit SPE1, SPE2 or SPE3, and a connection is established as described above.
  • FIG. 4 shows a block diagram which shows an exemplary, non-restrictive procedure of the method according to the invention, for example when using the Bluetooth TM radio standard.
  • the aim of the procedure is to open a door here.
  • a search begins, and from the use of two or more search engines, it is possible to perform asynchronous searches.
  • a special method is used to ensure that all mobile radio terminals MFE are actually found in the transmission and reception area SEB of the authentication device AVO. This search is done in an infinite loop.
  • a mobile radio terminal MFE If a mobile radio terminal MFE is found, it is checked whether the identification number IDN, in this case referred to as the MAC address (Media Access Control), which subsequently transmits the mobile radio, in the list of authenticated numbers, the access list ', is located. If not, the process is aborted. If the number is in the 'Access List', it is checked whether the corresponding application triggered by the authentication process (open door) is activated. If not, the process is aborted. If the application is activated, the connection keys (also: 'link key') are read from the at least one memory unit SPE1, SPE2 or SPE3 of the memory device SPV of the authentication device AVO. If the first connection is established (here: 1.
  • a PIN code is required during the pairing process (here: pairing). If an incorrect PIN code is entered, the process is aborted. Upon correct entry, the pairing process is continued, in the course of which a connection key VBS (here: 'Link Key') is generated, which is then stored in the storage device SPV of the authentication device AVO.
  • the connection key VBS can be stored directly in the at least one memory unit SPE1, SPE2 or SP3 or in the internal database IDB or the external database EDB. After that, the door is opened.
  • connection key VBS (here: 'Link Key'), which is stored in the 'access list', is stored on the internal database IDB or the external database EDB, depending on the variant used is entered in the at least one memory unit SPEl, SPE2 or SPE3. If the variant is used in which the identification means IDM are stored directly in the at least one memory unit SPE1, SPE2 or SPE3, this step can be omitted.
  • connection key VBS here: 'Link Key'

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Lock And Its Accessories (AREA)

Abstract

L'invention concerne un procédé et un dispositif d'authentification (AVO) destinés à l'authentification d'un terminal de téléphonie mobile (MFE) qui peut être caractérisé de façon bien définie par des moyens d'authentification (IDM), le dispositif d'authentification couvrant une zone émettrice et réceptrice (SEB) déterminée, et les moyens d'identification du terminal de téléphonie mobile pouvant être mémorisés dans au moins une unité de mémoire (SPE1, SPE2, SPE3). L'invention est caractérisée en ce que le dispositif d'authentification initie, au moyen d'au moins un terminal de téléphonie mobile, un établissement d'une communication, dès qu'au moins le terminal de téléphonie mobile se trouve dans sa zone émettrice et réceptrice, et en ce que le dispositif d'authentification interroge et vérifie par radio, les moyens d'identification d'au moins le terminal de téléphonie mobile, en vue de savoir s'ils sont identiques aux moyens d'identification mémorisés dans au moins une unité de mémoire et, au cas où ils sont identiques, le dispositif d'authentification coupe l'établissement de la communication et exécute une action, tandis que dans le cas où les moyens d'identification d'au moins un terminal de téléphonie mobile ne sont pas identiques avec les moyens d'identification mémorisés dans au moins l'unité de mémoire, le dispositif d'authentification coupe l'établissement de la communication et n'exécute aucune action.
EP07845283A 2006-12-13 2007-12-07 Procédé d'authentification d'un terminal de téléphonie mobile Withdrawn EP2137704A2 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
AT0206006A AT504633B1 (de) 2006-12-13 2006-12-13 Verfahren zur authentifizierung eines mobilfunkendgerätes
PCT/AT2007/000554 WO2008070886A2 (fr) 2006-12-13 2007-12-07 Procédé d'authentification d'un terminal de téléphonie mobile

Publications (1)

Publication Number Publication Date
EP2137704A2 true EP2137704A2 (fr) 2009-12-30

Family

ID=39494755

Family Applications (1)

Application Number Title Priority Date Filing Date
EP07845283A Withdrawn EP2137704A2 (fr) 2006-12-13 2007-12-07 Procédé d'authentification d'un terminal de téléphonie mobile

Country Status (3)

Country Link
EP (1) EP2137704A2 (fr)
AT (1) AT504633B1 (fr)
WO (1) WO2008070886A2 (fr)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2002671A4 (fr) 2006-04-03 2015-07-15 Eckey Corp Procédés permettant de déterminer la proximité entre des dispositifs à radiofréquence et des commutateurs de commande
US8706083B2 (en) 2009-01-07 2014-04-22 Eckey Corporation Bluetooth authentication system and method
FR3010571B1 (fr) * 2013-09-09 2016-12-30 Valeo Securite Habitacle Authentification d'un utilisateur muni d'un appareil mobile aupres d'un vehicule
DE102021211579A1 (de) 2021-10-14 2023-04-20 Robert Bosch Gesellschaft mit beschränkter Haftung Verfahren zum Betreiben eines Zutrittskontrollsystems

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU7697300A (en) * 1999-09-27 2001-04-30 Tactel Ab Automatic locking system
FI20002255A (fi) * 2000-10-13 2002-04-14 Nokia Corp Menetelmä lukkojen hallintaan ja kontrollointiin
WO2002039674A1 (fr) * 2000-11-08 2002-05-16 Telefonaktiebolaget Lm Ericsson (Publ) Point d'acces au reseau avec emetteur / recepteur auxiliaire
DE10316307A1 (de) * 2003-04-08 2004-10-21 Brose Schließsysteme GmbH & Co.KG Kraftfahrzeug-Türschließsystem
JP2005240492A (ja) * 2004-02-27 2005-09-08 Oki Electric Ind Co Ltd 鍵システム
GB2416964A (en) * 2004-08-07 2006-02-08 Richard Hoptroff Bluetooth Proximity Detector
US7446644B2 (en) * 2005-01-14 2008-11-04 Secureall Corporation Universal hands free key and lock system
SE530279C8 (sv) * 2005-03-18 2008-06-03 Phoniro Ab Metod för upplåsning av ett lås med en låsanordning kapabel till trådlös kortdistansdatakommunikation i enlighet med en kommunikationsstandard, samt en tillhörande låsanordning

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See references of WO2008070886A2 *

Also Published As

Publication number Publication date
WO2008070886A3 (fr) 2009-03-26
WO2008070886A2 (fr) 2008-06-19
AT504633A1 (de) 2008-06-15
AT504633B1 (de) 2009-05-15

Similar Documents

Publication Publication Date Title
DE102006042358B4 (de) Verfahren und Servicezentrale zum Aktualisieren von Berechtigungsdaten in einer Zugangsanordnung
DE69637053T2 (de) Personalisierung von Teilnehmeridentifikationsmodulen für Mobiltelefone über Funk
EP1336937A1 (fr) Système de contrôle d'accès, methode de contrôle d'accès et dispositifs pour la mettre en oeuvre
EP2936469B1 (fr) Téléphone mobile pour la commande à distance d'une fonction d'un dispositif de sécurité d'un véhicule automobile
EP2779722B1 (fr) Procédé de personnalisation d'un module de sécurité d'un terminal de télécommunication
WO2020002499A1 (fr) Procédé de sécurisation d'une communication entre un appareil de communication mobile et un véhicule
DE102007023728A1 (de) Verfahren und Vorrichtung zur elektronischen Kommunikation zwischen wenigstens zwei Kommunikationsgeräten
DE102011008500A1 (de) Verfahren zum Durchführen einer Transaktion zwischen einem tragbaren Datenträger und einem Terminal
EP2137704A2 (fr) Procédé d'authentification d'un terminal de téléphonie mobile
WO2002021860A2 (fr) Procede et systeme de controle d'acces
WO2017016713A1 (fr) Accumulateur d'énergie électrique comprenant un dispositif de blocage actionnable à distance
EP3557660B1 (fr) Véhicule électrique avec câble de recharge
EP3580942A1 (fr) Procédé de détermination de la position d'un appareil ble mobile
DE112019007512T5 (de) Konfigurierbare zugriffssteuerung und zugehörige systeme, verfahren und vorrichtungen
WO2020058059A1 (fr) Système d'accès et procédé de vérification d'accès
DE102017122021A1 (de) Verfahren zur Zugangangsgewährung zu einem Fahrzeug sowie Fahrzeugzugangssystem
EP2584539A1 (fr) Procédé de configuration d'une serrure électromécanique
DE102021118667A1 (de) Verfahren und System zur Steuerung von Funktionen eines Fahrzeugs mit einem mobilen Endgerät
WO2003023722A2 (fr) Procede de controle d'autorisation d'acces
EP1768316B1 (fr) Déblocage d'une carte mobile
WO2018219922A1 (fr) Procédé et dispositif de détection d'une attaque de relais
EP1300037B1 (fr) Telephone mobile
EP1762998B1 (fr) Commande d'éléments actionneurs à l'aide de terminaux mobiles
DE102005045887A1 (de) Entsperren von Mobilfunkkarten
WO2009129821A1 (fr) Procédé de contrôle d’accès pour une entrée de configuration d'appareil et appareil à un contrôle d’accès pour une entrée de configuration

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20090609

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC MT NL PL PT RO SE SI SK TR

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20100305

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: CSANK, CHRISTIAN

RIN1 Information on inventor provided before grant (corrected)

Inventor name: CSANK, CHRISTIAN

RIC1 Information provided on ipc code assigned before grant

Ipc: H04M 1/725 20060101ALI20150326BHEP

Ipc: G07C 9/00 20060101AFI20150326BHEP

Ipc: H04L 29/06 20060101ALI20150326BHEP

Ipc: H04W 12/06 20090101ALI20150326BHEP

Ipc: H04W 88/02 20090101ALI20150326BHEP

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTG Intention to grant announced

Effective date: 20150506

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN

18D Application deemed to be withdrawn

Effective date: 20150917