EP2624223B1 - Procédé et dispositif de contrôle d'accès - Google Patents

Procédé et dispositif de contrôle d'accès Download PDF

Info

Publication number
EP2624223B1
EP2624223B1 EP13450007.3A EP13450007A EP2624223B1 EP 2624223 B1 EP2624223 B1 EP 2624223B1 EP 13450007 A EP13450007 A EP 13450007A EP 2624223 B1 EP2624223 B1 EP 2624223B1
Authority
EP
European Patent Office
Prior art keywords
access control
access
control device
identification medium
sam
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP13450007.3A
Other languages
German (de)
English (en)
Other versions
EP2624223A2 (fr
EP2624223A3 (fr
Inventor
Johannes Ullmann
Norbert Groissböck
Alexander Zapletal
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
EVVA Sicherheitstechnologie GmbH
Original Assignee
EVVA Sicherheitstechnologie GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by EVVA Sicherheitstechnologie GmbH filed Critical EVVA Sicherheitstechnologie GmbH
Publication of EP2624223A2 publication Critical patent/EP2624223A2/fr
Publication of EP2624223A3 publication Critical patent/EP2624223A3/fr
Application granted granted Critical
Publication of EP2624223B1 publication Critical patent/EP2624223B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00309—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys operated with bidirectional data transmission between data carrier and locks
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00857—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys where the code of the data carrier can be programmed
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/21—Individual registration on entry or exit involving the use of a pass having a variable access code

Definitions

  • the invention relates to a method for access control, in particular in buildings, in which bidirectional data transmission takes place between an electronic identification medium and an access control device and data processing, wherein the data transmission comprises the transmission of access right data from the electronic identification medium to the access control device, wherein the access right data in the access control device for Determining the access authorization to be evaluated and depending on the detected access authorization a blocking means for selectively enabling or blocking the access is controlled.
  • the invention relates to a device comprising an access control device with a blocking means for selectively enabling or disabling the access and a transmitting / receiving device to allow bidirectional data transmission between an electronic identification medium and the access control device, wherein the access control device data processing means for controlling the data transmission and the Determining the access authorization based on received access right data and the data processing means interact with the blocking means for selectively enabling or disabling the access.
  • RFID systems consist of an electronic identification medium, such as an electronic key, on which access rights data, such as an identification or access code and / or access conditions such as authorized access time, legitimate access, authorized access date a user and the like., are stored electronically and which is often referred to as a "transponder", and a reader.
  • the transponder is usually constructed without its own energy source and the required energy is obtained from the electromagnetic field of the reader.
  • radio systems are also known in which the electronic identification medium is an active transmitter with its own energy source (eg remote opening of the central locking system for motor vehicles).
  • the access authorizations for easier management are usually stored in an access control center.
  • the access control center usually has a database in which the individual locking units, the keys and the respective access authorizations can be managed.
  • the electronic identification media can be programmed in accordance with the respectively desired access authorizations with access right data.
  • the access right data is sent from the access control center to a wireless mobile telecommunications device of the respective desired user or key holder.
  • the access rights data received from the mobile telecommunication device can be made available to a suitable identification medium, which receives a key function in this manner.
  • a kind of "online key” is thus created, since the key can be reprogrammed via the mobile telecommunications network and the corresponding mobile terminal in order to change the access right data and thus the access authorization of the key holder in this manner.
  • the locking units can work as autonomous units after installation and initialization and in particular require no network connection.
  • Security critical attack points also provides the data transfer between the identification medium and the access control device.
  • the access control device itself can be the target of attacks for example, aimed at destroying the electronic components or circuits responsible for access control.
  • access control devices or closing units are to be understood as meaning electrical, electronic or mechatronic closing units, in particular locks.
  • Closing units may in this case comprise various components, such as e.g. Access devices for identification media, in particular electronic keys, a locking electronics and the like.
  • Access control devices or locking units serve in particular to block access to rooms depending on the access authorization or release and are accordingly intended for installation in doors, windows and the like.
  • mechanical clamping units e.g. to understand cylinder locks.
  • Mechatronic clamping units are e.g. electric motor driven locking devices, in particular e-cylinder.
  • Electric locking units are e.g. electric door opener.
  • a release agent e.g. a mechanically acting blocking element which can be moved between a blocking and a releasing position, a mechanical or magnetic coupling element comprising an actuating element, e.g. a handle coupled or decoupled with a locking member, or an electrically locking and / or releasable locking member, such as e.g. an electric door opener, to understand.
  • actuating element e.g. a handle coupled or decoupled with a locking member
  • an electrically locking and / or releasable locking member such as e.g. an electric door opener
  • the document US 2005/060555 A1 discloses an access control method wherein a mobile device has stored a plurality of private keys that are uniquely associated with different doors and that are also stored by the respective access control devices.
  • the document GB 2427055 A discloses a portable token for authenticating a user to various access control devices, wherein the access information is stored in the token and the user has the ability to manage that information.
  • the present invention therefore aims to increase the safety of electronically operating access control systems.
  • the data processing comprises an authentication of the electronic identification medium on the basis of at least one digital certificate and the data transmission comprises the use of a key exchange or derivation protocol, whereby the at least one secret, shared session key is accessed, whereupon the at least one session key is used to establish a secure transmission channel between the electronic identification medium and the access control device, and the access rights data are electronically transmitted over the secure channel Identification medium are transmitted to the access control device, wherein the at least one session key in the electronic identification medium and in the access control device based on an access control device individual access code is generated, preferably further based on a random number generated by the identification medium and an access control device and / or one of the identification medium and a run number generated by the access control device.
  • the electronic identification medium is authenticated on the basis of at least one digital certificate
  • non-system-aware and therefore non-certified or invalidly certified subscribers of the access control system can be identified.
  • the at least one digital certificate is issued by an access control center.
  • the at least one digital certificate is additionally signed by the access control center, so that the certificate can also be checked for authenticity and validity.
  • a digital certificate here is to be understood as a digital data record which confirms certain properties of the identification medium and whose authenticity and integrity can be tested by cryptographic methods.
  • this is a public-key certificate, which confirms the identification medium as the owner and other properties of a public cryptographic key. It is thus a proof that the public key of an asymmetric encryption method belongs to the identification medium.
  • the digital certificate is used as part of a dynamic asymmetric authentication method.
  • a 5x key exchange or derivation protocol is understood here to mean a process in cryptography in order to make two or more communication partners access a common, secret key without transmitting it in plain text. This can be done by someone transferring a key to all partners involved or by creating or deriving a new key during the execution of the protocol.
  • the key exchange or derivation protocol specifies the exact procedure.
  • the session key is then used to quadruple and decrypt the data transmitted between the identification medium and the access control device by means of a symmetric encryption method and to maintain their authenticity.
  • the at least one session key is generated or derived in the electronic identification medium and in the access control device on the basis of an access control device-specific access code, preferably on the basis of a random number generated by the identification medium and a random access number generated by the access control device and / or one of the identification medium and one run number generated by the access control device.
  • the transmission security can be further increased by the fact that the key exchange protocol, the generation of a cryptogram using the session key in the access control device and the transmission of the same the identification medium, wherein the cryptogram is verified in the identification medium using the session key.
  • the key exchange protocol comprises generating a cryptogram using the session key in the identification medium and transmitting it to the access control device, verifying the cryptogram in the access control device using the session key.
  • the advantage of the inventive method is that all data that does not serve the construction of the secure transmission channel are transmitted in this secure, session-specific channel, whereby the integrity, authenticity and confidentiality of the data is ensured.
  • the access rights data are transmitted via the secure channel, wherein a complementary authentication preferably succeeds by signing the access right data from an access control center and transmitting it together with the signature via the secure channel from the electronic identification medium to the access control device.
  • Another advantage of the procedure according to the invention is that the access control device neither to the access control center still be connected to a certification authority wireless or wired. Rather, the determination of the access authorization in the access control device, including the authentication of the electronic identification medium, the execution of the key exchange and the establishment of the secure transmission channel exclusively due to between the access control device and the electronic identification medium transmitted or once and permanently in the access control device stored data, such as a manufacturer-stored access control device identification.
  • a further increase in security succeeds in that the data transfer is purely passive by loading the electromagnetic field between the electronic identification medium and the access control device. This data transfer works only over a very limited range of about 10 cm, so that listening is difficult.
  • the data processing means comprise at least one microcontroller and a Secure Access Module (SAM), wherein the SAM is configured to perform cryptographic functions, and the transmitting / receiving device is arranged in a first area of the access control device and the SAM is arranged in a second area of the access control device.
  • SAM Secure Access Module
  • a dedicated component namely the Secure Access Module (SAM) are bundled, the SAM can be arranged in a separate from the transmitting / receiving unit area of the access control device.
  • the design here is such that the first area (in which the transmitting / receiving unit is arranged) an unprotected area and the second area (in which the SAM is arranged) is a structurally protected area. This ensures that the SAM is better protected against destruction or manipulation by force or other destructive influences, especially against physical attacks of all kinds.
  • the microcontroller is arranged in the second area.
  • the microcontroller is preferably connected so that it connects the transmitting / receiving device with the SAM.
  • the microcontroller is preferably arranged interchangeably in the access control device.
  • the access control device is designed for installation in a door and is provided with at least one first handle, such as a knob or a pusher, wherein the first portion of the first handle and the second portion of a for receiving in an opening of the door leaf provided area or a second, the first handle opposite, second handle is formed.
  • the SAM preferably includes authentication means to authenticate the electronic identification medium based on at least one digital certificate, and is programmed with a key exchange protocol. Furthermore, the SAM is preferably designed or programmed to set up a secure transmission channel between the electronic identification medium and the access control device. Furthermore, it is preferably provided that the SAM comprises an evaluation circuit for determining the access authorization on the basis of the received access right data.
  • the evaluation circuit can be designed as a hardware circuit or realized by software.
  • the SAM is particularly preferably designed as a microcontroller in chip card or SIM card design, in particular in IC design.
  • the SAM can be interchangeably accommodated in an interface, in particular in a slot, so that, for example, the encryption type and the encryption strength can be changed in a simple manner by exchanging the SAM or changing the application running in the SAM.
  • the identification medium is integrated in a mobile telecommunication device, in particular a mobile phone.
  • the training is in this case preferably further developed in that the transmitting / receiving device for the wireless, preferably inductive data transmission in particular according to the NFC or RFID standard (ISO / IEC 14443) is formed.
  • FIG. 1 the schematic structure of an access control system in a first embodiment
  • Fig. 2 a further training of an access control system
  • Fig. 3 a modified embodiment of an access control system
  • Fig. 4 a block diagram of an access control device used in an access control system according to the Fig. 1 . 2 or 3 can be used
  • Fig. 5 a diagram of the simplified protocol flow during a locking process.
  • Fig. 1 is an access control center labeled 1.
  • the objects to which the access is to be controlled by means of the access control system are designated 2 and schematically represented in the present case as houses.
  • the objects 2 each have a door with a closing unit based on RFID, for example.
  • An administrator 3 manages the access control center 1 and can assign access authorizations.
  • the access control center 1 is connected to a telecommunications network 4, such as a LAN, WLAN, GSM, GPRS or UMTS network and can send via the network 4 access rights data to mobile telecommunications equipment 5.
  • the mobile telecommunication devices 5 are, for example, mobile phones that are equipped with a key function.
  • the cell phones have, for example, an NFC or RFID module in whose memory the access rights data obtained from the access control center 1 can be written.
  • the access control center is again designated 1 and the administrator 3.
  • the access control center 1 has a database 6 or is connected to such a database on which the access right data is stored and managed.
  • the access control center 1 is further connected to a writing unit 7, which is designed, for example, as a writing instrument for RFID tags or transponders. With 8 an RFID transponder is shown, which can be described by the writing unit 7. This corresponds in principle to the conventional method of how RFID transponders can be programmed.
  • a data connection between a mobile telecommunication device 5 and the access control center 1 can now according to the illustration in Fig. 2 done in different ways.
  • a wireless connection via various connection protocols, such as WLAN, GSM or UMTS can be made with the Internet 9, wherein the access control center 1 is connected to the Internet 9.
  • an SMS gateway 10 may be provided so that the data exchange between the access control center 1 and the mobile telecommunication device 5 via a short message service or another push service.
  • the user 11 of the mobile telecommunication device 5 can in this case, as indicated by the line 12, access the access control center 1 and, if he has the required Has access rights to the access control center 1, manage the access rights. If the user 11 is not the administrator 3, the access granted to the access control center 1 is such that he can only manage and, if necessary, change his own access authorizations. Access to the access control center 1 can take place, for example, via a web interface so that the user 11 can manage his access authorizations with the aid of any internet-capable computer.
  • This in Fig. 2 denoted by 5 mobile telecommunications device may be a cell phone that is equipped with an NFC module.
  • the access rights data obtained from the access control center 1 are made available to the built-in NFC module, so that the access right data can be transmitted in the sequence via an NFC connection to the locking unit 13.
  • FIG. 2 another mobile telecommunication device 14 is shown, which itself does not perform a key function. Instead, the access rights data transmitted by the access control center 1 are transferred to an external RFID transponder 15. The RFID transponder 15 can then be used independently of the mobile telecommunication device 14 to block locking units 13.
  • a modified access control system is shown in which, as in the system according to Fig. 2 an access control center 1 via any communication connection, for example, via the Internet 9, mobile telecommunications devices 5 can provide access rights data. This can also be done via an SMS gateway 10 or another Push service done.
  • a client computer 16 of a user is also connected to the Internet 9 and can mediate access rights data issued by the access control center 1 as a proxy.
  • the client computer 16 is connected to a writing unit 17, which is designed, for example, as a writing instrument for RFID tags or transponders. 18, an RFID transponder is shown, which can be described by the writing unit 17.
  • a certification authority 19 is now additionally integrated into the access control system, which is connected to the access control center 1.
  • the provisioning of the components in the access control system is done as follows, which is usually only required once when a new component is added to the system.
  • the certification authority 19 creates a digital certificate (corresponds to "cert MK " in Fig. 5 )
  • the mobile telecommunication device 5 or arranged in this module or built-in module which performs the key function, such as a secure element, in particular a secure access module, or the SIM card of the telecommunication device 5.
  • the module is based on a unique in the system ID ("ID MK " in Fig. 5 ) identified.
  • the certification authority 19 creates a digital certificate (corresponds to "cert L " in Fig. 5 ) for a secure element, in particular a Secure Access Module, the access control device or closing unit 13.
  • the module of the access control device 13 is also based on a unique in the system ID ("ID L " in Fig. 5 ) identified.
  • the application of the access authorizations to the mobile telecommunication device 5 takes place as follows.
  • the access rights data to be transmitted to the mobile telecommunication device 5 are generated in the access control center 1.
  • the access rights data consist, for example, of a secret access control device-specific key (corresponds to "LT” in FIG Fig. 5 ) and a temporal permission restriction (corresponds to "Calendar” in Fig. 5 ).
  • This temporal authorization restriction is signed by the certification authority 19 (see “s c " in FIG Fig. 5 ) to ensure their authenticity.
  • the authorization restriction is transmitted from the access control center 1 to the certification authority 19, which then returns the signed authorization restriction to the access control center 1.
  • the individual access right data which consists of the access control device-specific key and the time restriction of authorization signed by the certification authority 19, are then summarized.
  • a secure connection is established via the mobile telecommunication device 5 with the aid of the digital certificates that were applied during the provisioning.
  • the mobile telecommunication device 5 serves only as a mediator (proxy).
  • the access control data is transmitted to the mobile telecommunications device 5 and stored in the module secured.
  • the access control device 13 has an unprotected area 20, eg an outside area, and a protected area 21, eg an inside area.
  • the transmitting / receiving unit 22 is arranged, which is designed, for example, as RFID read / write device and can exchange data with a passive RFID medium integrated in the mobile telecommunication device 5 or a passive RFID chip card 18.
  • the data transmission can be done, for example, in NFC card emulation mode expire.
  • a microcontroller 23, a Secure Access Module (SAM) 24, a circuit 25 for the electromechanical or electrical driving of a blocking means, not shown, and a hardware clock 26 are arranged.
  • the blocking means can in this case be moved between a locking position and a release position for selectively enabling or disabling the access.
  • the microcontroller 23 controls the basic functions of the access control device 13 and connects the SAM 24 with the transceiver unit 22.
  • the application protocol data unit (APDU) generally refers to a communication unit between a chip card and a chip card application (eg according to the ISO / IEC 7816 standard).
  • the SAM 24 contains the access control logic and a secure memory, as described in particular with reference to the description of Fig. 5 will be explained in more detail.
  • the microcontroller 23 cooperates with a schematically indicated acoustic and / or visual signal generator 27, such as a light ring and a buzzer, to signal the user various operating conditions.
  • Fig. 5 Now the basic sequence of communication between the electronic identification medium 5, in particular the secure module of the mobile telecommunication device 5 or the chip card 18, and the SAM 24 of the access control device 13 is shown. This is not the actual protocol, but a simplified representation of the underlying principles of the protocol. On the part of the access control device 13 is both the microcontroller 23 and the SAM are involved in the communication. On the secure module of the mobile telecommunication device 5 or the smart card 18 is in Fig. 5 with the keychain application 28.
  • a record of LT, Calendar and c s is the access rights data, each record of an access control device identification ID is assigned to L.

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Lock And Its Accessories (AREA)
  • Storage Device Security (AREA)

Claims (16)

  1. Procédé de contrôle d'accès en particulier dans des bâtiments dans lequel une transmission de données bidirectionnelle entre un support d'identification électronique et un dispositif de contrôle d'accès et un traitement de données ont lieu, dans lequel la transmission de données comprend la transmission de données de droit d'accès du support d'identification électronique au dispositif de contrôle d'accès, dans lequel les données de droit d'accès sont évaluées dans le dispositif de contrôle d'accès afin d'arrêter l'autorisation d'accès et un moyen de blocage servant à débloquer ou à bloquer au choix l'accès est piloté en fonction de l'autorisation d'accès arrêtée, caractérisé en ce que le traitement de données comprend une authentification du support d'identification électronique sur la base d'au moins un certificat numérique, et la transmission de données comprend l'utilisation d'un protocole d'échange ou de dérivation de clé, ce qui permet de rendre accessible au support d'identification électronique et au dispositif de contrôle d'accès au moins une clé de session secrète commune, l'au moins une clé de session étant après quoi utilisée pour établir un canal de transmission sûr entre le support d'identification électronique et le dispositif de contrôle d'accès, et que les données de droit d'accès sont transmises depuis le support d'identification électronique au dispositif de contrôle d'accès par l'intermédiaire du canal sûr, dans lequel l'au moins une clé de session est générée dans le support d'identification électronique et dans le dispositif de contrôle d'accès sur la base d'un code d'accès propre au dispositif de contrôle d'accès, de manière préférée par ailleurs sur la base d'un chiffre aléatoire généré par le support d'identification et d'un chiffre aléatoire généré par le dispositif de contrôle d'accès et/ou sur la base d'un numéro d'ordre généré par le support d'identification et d'un numéro d'ordre généré par le dispositif de contrôle d'accès.
  2. Procédé selon la revendication 1, caractérisé en ce que l'au moins un certificat numérique est signé par une centrale de contrôle d'accès.
  3. Procédé selon la revendication 1 ou 2, caractérisé en ce que le protocole d'échange de clé ou de dérivation de clé comprend la génération d'un cryptogramme en utilisant la clé de session dans le dispositif de contrôle d'accès et l'envoi dudit cryptogramme au support d'identification, dans lequel le cryptogramme est vérifié dans le support d'identification en utilisant la clé de session.
  4. Procédé selon l'une quelconque des revendications 1 à 3, caractérisé en ce que les données de droit d'accès sont signées par une centrale de contrôle d'accès et sont transmises conjointement avec la signature par l'intermédiaire du canal sûr du support d'identification électronique au dispositif de contrôle d'accès.
  5. Procédé selon l'une quelconque des revendications 1 à 4, caractérisé en ce que la transmission de données est effectuée de manière purement passive par la contrainte exercée par le champ électromagnétique entre le support d'identification électronique et le dispositif de contrôle d'accès.
  6. Dispositif, en particulier servant à mettre en oeuvre le procédé selon l'une quelconque des revendications 1 à 5, comprenant un dispositif de contrôle d'accès pourvu d'un moyen de blocage servant à débloquer ou bloquer au choix l'accès et d'un système d'émission/de réception afin de permettre une transmission de données bidirectionnelle entre un support d'identification électronique et le dispositif de contrôle d'accès, dans lequel le dispositif de contrôle d'accès présente des moyens de traitement de données servant à commander la transmission de données et servant à arrêter l'autorisation d'accès du fait des données de droit d'accès reçues et les moyens de traitement de données coopèrent avec le moyen de blocage servant à débloquer ou bloquer au choix l'accès, caractérisé en ce que les moyens de traitement de données comprennent au moins un microcontrôleur (23) et un modèle d'application sécurité ou SAM (Secure Access Module) (24), dans lequel le SAM (24) est mis au point pour exécuter des fonctions cryptographiques, et que le système d'émission/de réception (22) est disposé dans la première zone (20) du dispositif de contrôle d'accès (13) et le SAM (24) est disposé dans une deuxième zone (21) du dispositif de contrôle d'accès (13).
  7. Dispositif selon la revendication 6, caractérisé en ce que le microcontrôleur (23) est disposé dans la deuxième zone (21).
  8. Dispositif selon la revendication 6 ou 7, caractérisé en ce que le microcontrôleur (23) relie le système d'émission/de réception (22) au SAM (24).
  9. Dispositif selon la revendication 6, 7 ou 8, caractérisé en ce que la première zone (20) est une zone non protégée et la deuxième zone (21) est une zone à structure protégée.
  10. Dispositif selon l'une quelconque des revendications 6 à 9, caractérisé ne ce que le dispositif de contrôle d'accès (13) est réalisé pour être monté dans une porte et est pourvu d'au moins une première manette, telle qu'un bouton ou une poignée, dans lequel la première zone (20) est formée par la première manette et la deuxième zone (21) est formée par une zone destinée à être reçue dans un trou percé du battant de porte ou par une deuxième manette faisant face à la première manette.
  11. Dispositif selon l'une quelconque des revendications 6 10, caractérisé en ce que le module (24) comprend des moyens d'authentification afin d'authentifier le support d'identification (5) électronique sur la base d'au moins un certificat numérique, et est programmé avec un protocole d'échange de clé ou de dérivation de clé.
  12. Dispositif selon l'une quelconque des revendications 6 à 11, caractérisé en ce que le SAM (24) est réalisé ou est programmé pour établir un canal de transmission sûr entre le support d'identification (5) électronique et le dispositif de contrôle d'accès (13).
  13. Dispositif selon l'une quelconque des revendications 6 à 12, caractérisé en ce que le SAM (24) comprend un circuit d'évaluation servant à arrêter l'autorisation d'accès du fait des données de droit d'accès reçues.
  14. Dispositif selon l'une quelconque des revendications 6 à 13, caractérisé en ce que le SAM (24) est réalisé comme un microcontrôleur (23) sous la forme de cartes à puce ou de cartes SIM, en particulier sous la forme de IC.
  15. Dispositif selon l'une quelconque des revendications 6 à 14, caractérisé en ce que le SAM (24) peut être remplacé dans, une interface, en particulier est reçu dans un slot.
  16. Dispositif selon l'une quelconque des revendications 6 à 15, caractérisé en ce que le système d'émission/de réception (22) est réalisé pour la transmission de données sans fil, de manière préférée inductive en particulier selon la norme NFC (Near Field Communication - communication en champ proche) ou RFID (Radio Frequency Identification - radio-identification) (ISO/CEI 14443).
EP13450007.3A 2012-01-31 2013-01-29 Procédé et dispositif de contrôle d'accès Active EP2624223B1 (fr)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
ATA132/2012A AT512419A1 (de) 2012-01-31 2012-01-31 Verfahren und vorrichtung zur zutrittskontrolle

Publications (3)

Publication Number Publication Date
EP2624223A2 EP2624223A2 (fr) 2013-08-07
EP2624223A3 EP2624223A3 (fr) 2013-08-14
EP2624223B1 true EP2624223B1 (fr) 2017-09-20

Family

ID=47713999

Family Applications (1)

Application Number Title Priority Date Filing Date
EP13450007.3A Active EP2624223B1 (fr) 2012-01-31 2013-01-29 Procédé et dispositif de contrôle d'accès

Country Status (3)

Country Link
EP (1) EP2624223B1 (fr)
AT (1) AT512419A1 (fr)
ES (1) ES2653260T3 (fr)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102013216446A1 (de) * 2013-08-20 2015-02-26 Siemens Aktiengesellschaft Aktivieren eines Netzwerkknotens durch eine Nachricht
AT516288A1 (de) * 2014-09-19 2016-04-15 Evva Sicherheitstechnologie Verfahren und Vorrichtung zum Verwalten von Zutrittsberechtigungen
DE102016223684A1 (de) 2016-11-29 2018-05-30 Bundesdruckerei Gmbh Verfahren zur Zutrittskontrolle einer Personengruppe mittels mehreren Lesegeräten und mehreren Token
WO2019121336A1 (fr) * 2017-12-20 2019-06-27 Inventio Ag Système de contrôle d'accès avec authentification radio et acquisition de mot de passe
AT522608A1 (de) * 2019-05-16 2020-12-15 Evva Sicherheitstechnologie Verfahren zum Betreiben eines Zutrittskontrollsystems sowie Zutrittskontrollsystem
CN111057842A (zh) * 2019-12-28 2020-04-24 海城市鹏程镁矿有限公司 应用二氧化碳碳化法制备菱镁矿粉矿生球的方法
CN111057841A (zh) * 2019-12-28 2020-04-24 海城市鹏程镁矿有限公司 一种利用无机结合剂的菱镁矿粉矿造球方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5679945A (en) * 1995-03-31 1997-10-21 Cybermark, L.L.C. Intelligent card reader having emulation features
US7114178B2 (en) * 2001-05-22 2006-09-26 Ericsson Inc. Security system
DE10216396A1 (de) * 2002-04-12 2003-10-23 Scm Microsystems Gmbh Verfahren zur Authentisierung
US7389530B2 (en) * 2003-09-12 2008-06-17 International Business Machines Corporation Portable electronic door opener device and method for secure door opening
US20050138380A1 (en) * 2003-12-22 2005-06-23 Fedronic Dominique L.J. Entry control system
US9454657B2 (en) * 2004-12-03 2016-09-27 Bce Inc. Security access device and method
GB2427055A (en) * 2005-06-10 2006-12-13 Sharp Kk Portable token device with privacy control
US8245052B2 (en) * 2006-02-22 2012-08-14 Digitalpersona, Inc. Method and apparatus for a token
EP2063400A1 (fr) * 2007-11-23 2009-05-27 Gemalto SA Module d'accès de sécurité virtuel

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
AT512419A1 (de) 2013-08-15
EP2624223A2 (fr) 2013-08-07
ES2653260T3 (es) 2018-02-06
EP2624223A3 (fr) 2013-08-14

Similar Documents

Publication Publication Date Title
EP2624223B1 (fr) Procédé et dispositif de contrôle d'accès
EP2238576B1 (fr) Procédé et dispositif de commande du contrôle d'accès
EP3121795B9 (fr) Établissement d'une liaison de communication avec un dispositif utilisateur au moyen d'un dispositif de controle d'acces
EP2962439B1 (fr) Lecture d'un attribut enregistré dans un jeton id
EP3246839B1 (fr) Contrôle d'accès comprenant un appareil radio mobile
AT513461B1 (de) Verfahren zur Zutrittskontrolle
DE60319514T2 (de) Verfahren und anordnung zur zugangssteuerung
EP3156980B1 (fr) Procédé de programmation de supports de données d'une installation de contrôle d'accès
EP4128695B1 (fr) Mécanisme d'authentification personnalisé et pour un serveur spécifique
EP3135546B1 (fr) Clé d'automobile, système de communication et procédé associé
EP3848911A1 (fr) Procédé et dispositif d'authentification d'un utilisateur d'une boîte aux lettres
DE102013100756B3 (de) Verfahren und Vorrichtung zur Authentifizierung eines Nutzers
EP3739554A1 (fr) Procédé de fonctionnement d'un système de contrôle d'accès ainsi que système de contrôle d'accès
EP3882796A1 (fr) Authentification de l'utilisateur à l'aide de deux éléments de sécurité indépendants
DE102013001733A1 (de) Verfahren zum Zugriff auf einen Dienst eines Servers über eine Applikation eines Endgeräts
DE102021103997A1 (de) Nutzerauthentifizierung unter Verwendung zweier unabhängiger Sicherheitselemente
EP3530023B1 (fr) Dispositif de fermeture et/ou d'ouverture d'une fermeture d'un enclos ou d'un bâtiment ainsi que procédé de fonctionnement d'une fermeture d'un enclos ou d'un bâtiment
EP3336736B1 (fr) Jeton auxiliaire id destiné à l'authentification mulifacteur
DE102020123756B3 (de) Verfahren zur Nutzungsfreigabe sowie Funktionsfreigabeeinrichtung hierzu
DE102014110540A1 (de) Delegierbare Zugriffssteuerung
EP2880810B1 (fr) Authentication d'un document à un dispositif de lecture
DE102006022585A1 (de) Speichermedium mit einem integrierten Speicher und einem integrierten Controller, Verwendungen des Speichermediums und Verfahren zum Erzeugen von Schlüsselmaterial
EP4016339A1 (fr) Fourniture d'une appliquette de sécurité à un terminal mobile
DE102014211839A1 (de) Verfahren zum Authentifizieren einer Entität
EP4327511A1 (fr) Personnalisation d'un applet de sécurité sur un terminal mobile

Legal Events

Date Code Title Description
PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

RIC1 Information provided on ipc code assigned before grant

Ipc: G07C 9/00 20060101AFI20130705BHEP

17P Request for examination filed

Effective date: 20140212

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

17Q First examination report despatched

Effective date: 20160104

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTG Intention to grant announced

Effective date: 20170517

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 930710

Country of ref document: AT

Kind code of ref document: T

Effective date: 20171015

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: GERMAN

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 502013008389

Country of ref document: DE

REG Reference to a national code

Ref country code: CH

Ref legal event code: NV

Representative=s name: OK PAT AG PATENTE MARKEN LIZENZEN, CH

REG Reference to a national code

Ref country code: SE

Ref legal event code: TRGR

REG Reference to a national code

Ref country code: NL

Ref legal event code: FP

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 6

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171220

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2653260

Country of ref document: ES

Kind code of ref document: T3

Effective date: 20180206

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171220

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171221

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180120

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 502013008389

Country of ref document: DE

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

26N No opposition filed

Effective date: 20180621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180129

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20180131

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180131

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180129

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20130129

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

Ref country code: MK

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170920

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170920

REG Reference to a national code

Ref country code: CH

Ref legal event code: PFUS

Owner name: EVVA SICHERHEITSTECHNOLOGIE GMBH, AT

Free format text: FORMER OWNER: EVVA SICHERHEITSTECHNOLOGIE GMBH, AT

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230510

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: NL

Payment date: 20240126

Year of fee payment: 12

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 20240201

Year of fee payment: 12

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: AT

Payment date: 20231130

Year of fee payment: 12

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240129

Year of fee payment: 12

Ref country code: GB

Payment date: 20240129

Year of fee payment: 12

Ref country code: CH

Payment date: 20240202

Year of fee payment: 12

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: SE

Payment date: 20240127

Year of fee payment: 12

Ref country code: FR

Payment date: 20240125

Year of fee payment: 12