EP3065110B1 - Modular high security lock and update method for same - Google Patents

Description

The invention relates to a modular high security lock concept and especially to a high security lock for a safe according to the preamble of claim 1.

High security locks are used, for example, for ATMs or ATM cabinets. There they secure access to the bins and can only be opened by special security mechanisms such as the entry of a code, which is known, for example, an employee of the financial institution or a value service provider (hereinafter referred to as an authorized user).

One or more of these locks are located, for example, at the back of the ATM and are therefore not visible to the standard bank customer. In addition, they are usually inaccessible by additional security measures; For example, they can be covered by an additional metal sheet. Upon successful completion of the security measures, the authorized user can open the lock or locks and refill or withdraw money.

In general, such a high-security lock thus has two functions: on the one hand, an interface function for communicating with the authorized user with regard to carrying out the required security measures and, on the other hand, a security function with regard to the value contents of the ATM.

The interface function is represented, for example, by an operator terminal (also called operating unit or operating unit) or an input unit as the second module or operating module.

Furthermore, the security function is mapped, for example, by at least one mechanical and / or electronic security element of access to the money compartment as the first module or lock module. Often two security elements are arranged. The securing elements are advantageously present as mechanical closing devices or as mechanical and / or electronic or intelligent lock bolts.

In the equipment of ATMs and other safekeeping, manufacturers generally work with a large number of different high-security lock systems and lock types of different installation and function variety. This creates a high maintenance, logistics or cost. Electronic high-security lock systems are also being marketed as retrofits. In the case of retrofitting, not inconsiderable costs are incurred for the installation, which must be passed on to the end customer, for example via external service and installation service providers as well as value service providers and security services. In the manufacture of ATMs, the manufacturer for cost reasons, for example, only the standard model of the second module is installed, which has only the least number of technical equipment based on its hardware and / or software.

If a customer wants to use extended functionality on the high-security lock system at a later date, retrofitting is often difficult. For example, if the customer finds out during operation that the built-in model does not meet his requirements, it must necessarily be replaced. However, according to the current state of the art, the first and second modules, in terms of structure and / or wiring and / or programming, form one unit, i. that these can not be laboriously and time-consuming separated from each other at the factory or at the customer's expense. So it must be replaced the complete unit consisting of the first and second module; even if, for example, actually only the software / firmware of the second module to be replaced. It will be understood that such an approach is expensive and cumbersome.

Of course, this exchange can again be made only after passing through various security measures that can be the same or similar to those when opening the money compartment.

For example, the EP 1 260 659 A2 a lock with display, keyboard and data line connection. It is described that additional functions of the lock can be activated later are by either installed over the port or already available in a data memory of the lock not shown and activated.

From the US 2012/216726 A1 is also known a way to enable additional functions by means of a control unit of an ATM. During the process various codes are generated whose characters depend, among other things, on the serial number of the lock and the scope of the function to be unlocked. Also the US Pat. No. 7,234,636 B1 discloses methods for controlling the functionality of an ATM.

According to the US 2010/057703 A1 and the US 2011/061047 A1 In each case a license management system is described.

The aim of the invention is therefore to develop a concept to make the necessary exchange as cost-effective and as simple as possible.

This object is achieved by a high security lock (according to claim 1) and a method for software activation or deactivation of functions of modules of a high security lock (according to claim 5).

According to the invention, the high-security lock for a safe is characterized in that it comprises at least one mechanically functioning lock module and a control module equipped with a data reception interface. The lock module and the operating module are designed and intended to be separated from one another electronically and mechanically and / or connected to one another according to the plug-and-play principle. Furthermore, the lock module and the operating module each comprise a separate program memory with preinstalled subprograms, which encode functions of the lock module and / or the operating module. It is provided that the subprograms preinstalled in the program memory of the operating module only code the functions of the operating module and the subroutines preinstalled in the program memory of the lock module only the functions of the lock module. Furthermore, the data reception interface is set up and provided for transmitting a functionality code and separately a license key to the operating module and the lock module. In addition, the lock module and the operating module each comprise an evaluation unit. Both evaluation devices are set up and provided for this purpose, a comparison of a comparison license key which can be generated by means of a license algorithm with the license key and an evaluation of the functionality code perform and transmit at least one confirmation record for enabling or blocking at least one sub-program of the lock module to the program memory of the lock module and at least one sub-program of the control module to the program memory of the control module. The license key is a data record which is generated from at least three further data records, wherein among the further data records are a serial number of the operating module, a serial number of the lock module and the functionality code, the functionality code being dependent on the subroutines to be unlocked or disabled in the program memories ,

This makes it possible for a high-security lock for the first time, with different hardware different or extended functional scopes, unlock in particular for the control module and the lock module. In the opposite case, the functional scope can of course be locked. A cumbersome expansion of both components is thus eliminated; the exchange is therefore much cheaper than before.

Subroutines are to be understood as pre-installed software blocks or software modules, which advantageously represent a closed functional unit of the operating software. They consist for example of a sequence of processing steps and data structures and advantageously represent a function or sub-function. They can be called, for example, via a module-specific interface. However, the exact procedure for saving and calling subroutines is well known in the art and will not be discussed further here.

As mentioned above, it is provided that the subroutines preinstalled in the program memory of the operating module only code the functions of the operating module. Analogously, as mentioned above, it is provided that the subroutines preinstalled in the program memory of the lock module code only the functions of the lock module. An embodiment according to which the subprograms preinstalled in the program memory of the operating module code the functions of the operating module and of the lock module is therefore not part of the present invention. Likewise, an embodiment according to which the subroutines preinstalled in the program memory of the operating module code the functions of the operating module and of the lock module is not part of the present invention.

Depending on the requirement or customer request, different lock modules and operating modules can be used.

In the second module, it is conceivable, for example, that it is designed as an operator terminal similar to an ec card reader and thus comprises at least one number pad by means of which, for example, a security code can be entered. There are second modules without display or touch screen; However, a display and / or a touchscreen is advantageously arranged on the second module additionally. The second modules can therefore differ from one another with regard to the hardware and / or the software / firmware.

Security measures for opening the high-security lock include, for example, opening with a specific key, entering a PIN or a security code or the use of tags or RFID ("radio-frequency identification", identification with the aid of electromagnetic waves ") in the form of an authorized user's own RFID card in question. In addition, in addition, the input of the code may be possible only after a certain period of time after a performed action and then only for a certain period of time. For example, it is conceivable that the authorized user identifies himself to the machine and can enter the actual security code only 10 minutes after the successful identification, but the code again loses its validity 5 minutes later. Furthermore, the number of authorized authorized users may be limited and / or assigned to a master user. Some high-security locks (also referred to as locks below) additionally have network access or an alarm function in the event of unauthorized access, advantageously with an overrun message and subsequently blocking of the ATM by a suitable blocking device. Furthermore, it is advantageous if details of access such as time, location, user ID, etc. are logged. The closing of the ATM, so the locking of the at least one securing element after filling the money can be done manually, but preferably automatically. Combinations of the named security measures and / or equipment are also possible. The software of the lock is advantageously programmed so that different program modules are automatically loaded and / or retrievable, for example, depending on the time of day, depending on the default setting.

The power supply of the locks or high-security locks or the lock module and / or the operating module can be done via the ATM. Alternatively or additionally, a battery supply may be provided. Advantageously, the lock can be used in online and offline mode. For the configuration of the lock units, a uniform configuration software can be used for all variants, in particular for all second modules. The programming can advantageously be done via a PC and / or a laptop or via mobile devices such as smartphones and / or tablets.

According to a preferred embodiment, in the high-security lock, the first module is compatible with all available second modules. This compatibility refers to the electronics or the software and the mechanics or hardware. If, in fact, an exchange of individual modules, in particular of the second module, is necessary, this replacement can ideally take place in accordance with the Plug & Play principle (PnP), ie no further drivers are installed for commissioning the lock unit after the second module has been replaced or settings must be made. In this respect, the authorized user can now locally on the ATM, which is in operation and accordingly, for example, in a financial institution to carry out the necessary upgrade by electronically and mechanically disconnects the current second module from the first module and then install a new second module and connects mechanically and electronically with the first module.

In this respect, it is provided, as mentioned above, that the lock module and the operating module can be separated from one another electronically and / or mechanically and / or can be connected to one another according to the plug-and-play principle.

If only the firmware or software has to be replaced or its scope has to be extended, it is conceivable that for reasons of time a new second module with pre-installed firmware will be installed. Much cheaper, however, is when the current second module on site, a new firmware is installed.

However, most of the advantages are provided by the procedure if the new firmware is already blocked on the current second module and only needs to be unlocked, as described above. For example, at least the entry of a license key, that is a letter or number code, is necessary, as described above.

According to a preferred embodiment, the lock module and the operating module each comprise at least one of the following units: the evaluation unit, a data encryption unit, a data transmission unit and a data storage unit.

By means of the evaluation unit or the evaluation device, data can be processed and signals or data records can be sent to another unit. The type of processing or the transmission of data sets by the evaluation device can be done, for example, by means of a program or software are predetermined. The evaluation device can be present, for example, in the form of a processor (Central Processing Unit, CPU).

By means of the data encryption unit, records can be encrypted, for example by means of an algorithm, so as to contribute to increased security. It can be formed, for example, by the evaluation unit or a part of the evaluation unit. Alternatively, the data encryption unit can be formed by means of a separate unit from the evaluation unit.

By means of the data transmission unit, data records which are encrypted, for example, can be transferred from one unit to another or from one module to another. It may, for example, be in the form of a data transmission cable together with the corresponding interfaces.

Data records can be stored by means of the data storage unit. The data storage unit may be in the form of, for example, an Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), or flash memory.

From the prior art, further details on the use and function of evaluation units, data encryption units, data transmission units and also data storage units are well known and will therefore not be discussed further here.

All in all, a lock is obtained, which can be extended in terms of function by means of an intelligent upgrade procedure already at the initial configuration in the factory or later at the customer. At the same time, a standard lock bolt or standard lock module can be used as the first module, which is always installed ex works and no longer needs to be exchanged in the field for functional extensions. At the same time, this lock module also satisfies all common safety requirements such as the standards as well as the appropriate conversion regulations according to VdS and ECB-S, which in each case provide information on the defined security levels for safes. It should be mentioned in this context that an improper conversion in the worst case can lead to the loss of insurance coverage for the vault or its content. Of course, this is especially important if, after successful, improper conversion, the content of the safe or ATM is unlawfully stolen, for example, in the event of theft.

Furthermore, it is advantageous to resort to proven technology in the lock bolt as the first module.

Another advantage is that even at the factory and at the ATM / safe manufacturer, the variety of variants is contained, whereby a huge cost savings is possible. Since high disassembly and assembly costs are eliminated on site, the price advantage can be passed directly to the customer, which is likely to increase the number of retrofit orders for the manufacturer. This in turn strengthens customer loyalty and increases market share.

Overall, the intelligent lock concept allows new and more interesting cost models for software and maintenance contracts to be developed. In addition, the dependency on certified vanguard technicians for retrofitting is reduced, increasing flexibility.

An essential principle of the present invention is that advantageously in the lock bolt or lock module of the electronic high-security lock all currently known and necessary functionalities for current and future operation are already coded and stored in modular blocks in software; however, not all blocks but, for example, only the blocks currently required for the current functionality or operation are already activated.

At the same time all the currently known and common functions and processes of the customer applications of the market are coded and stored in modular blocks in the operating unit or in the operating module of the electronic high-security lock as well; Here too, however, only the blocks are activated, which are necessary for the current current range of functions.

This range of functions is determined by the currently used second module.

The activation of the necessary functionalities or software blocks is accomplished by calculating and entering a secure license key on the operating unit. The license key is automatically created and transmitted to the customer on request, stating device-specific data, such as serial number of the operating unit and serial number of the intelligent lock bolt. Alternatively, the customer can log on to the website of the manufacturer of the intelligent lock bolt in a personal area and enter the required data, after which a license key is generated automatically. For security reasons it is advantageous if the producer is subsequently informed of this generation query by e-mail.

In addition, for the calculation of the license key, advantageously, a functionality code is necessary, which is dependent on the upgrade process that is to be carried out in the specific case, and thus dependent on the functional blocks to be released in the program memory.

It is thus provided that the license key is a data record which is generated from at least three further data records, whereby among the further data records a serial number of the operating module, a serial number of the lock module and the functionality code are.

The data reception interface of the operating module can be, for example, a keyboard or a touchscreen, by means of which a manual input of the data or data records is possible. However, it is particularly advantageous if the lock unit or the high-security lock has at least one communication interface on the first and / or second module. A USB port is especially conceivable here, but the use of the Bluetooth function or an infrared interface is also possible. Advantageously, at least one of the following functions is implemented on the hardware in the first and / or the second module: functions from the field of Near Field Communication (NFC), RFID or an integrated circuit such as the "iButton". Thus, the term "data reception" means the receipt of data by means of a manual input, but also by means of an electronic transmission.

It is therefore advantageous if the data reception interface is a device for manually entering data records or an electronic interface for the wired transmission of data records or an electronic interface for the wireless transmission of data records.

To increase security, it is furthermore advantageous if a supervisor code can be stored in the lock module, which is comparable by means of the evaluation device with a supervisor code which can be transmitted to the operating module and the lock module by means of the data reception interface. It should be noted that even with an exchange of the operating module, as described above, the stored in the lock module supervisor code can advantageously remain the same, which reduces the effort in data management.

The object of the invention is further achieved by a method for software activation or deactivation of functions of modules of a high security lock for a safe, wherein the high security lock comprises at least one mechanically functioning lock module and equipped with a data receiving interface control module. Each of the lock module and the operating module has its own program memory with preinstalled subprograms which code the functions. It is further provided according to the invention that the lock module and the operating module are set up and intended to be separated electronically and mechanically from each other and / or connected to each other according to the plug-and-play principle, and that the preinstalled in the program memory of the operating module subroutines only the functions of the operating module and the subroutines preinstalled in the program memory of the lock module only code the functions of the lock module. In addition, the lock module and the operating module each comprise an evaluation unit.

1. a) Eingabe eines Funktionalitätscodes, welcher abhängig ist von freizuschaltenden oder zu sperrenden Unterprogrammen in den Programmspeichern, und separat davon Eingabe eines Lizenzkeys an der Datenempfangsschnittstelle, wobei der Lizenzkey ein Datensatz ist, welcher aus mindestens drei weiteren Datensätzen generiert wird, wobei unter den weiteren Datensätzen eine Seriennummer des Bedienmoduls, eine Seriennummer des Schlossmoduls und der Funktionalitätscode sind,
2. b) Vergleich eines mittels eines Lizenzalgorithmus' erzeugbaren Vergleichslizenzkeys mit dem Lizenzkey mittels beider Auswerteeinrichtungen,
3. c) Auswertung des Funktionalitätscodes mittels beider Auswerteeinrichtungen,
4. d) Übertragung mindestens eines Bestätigungsdatensatzes an den Programmspeicher des Schlossmoduls und an den Programmspeicher des Bedienmoduls, wenn Schritt b) eine Übereinstimmung der verglichenen Datensätze ergibt,
5. e) Freischaltung oder Sperrung mindestens eines Unterprogramms des Schlossmoduls und mindestens eines Unterprogramms des Bedienmoduls.

The method according to the invention comprises the following method steps:

1. a) inputting a functionality code which is dependent on subroutines to be enabled or disabled in the program memories, and separately inputting a license key at the data reception interface, the license key being a data set generated from at least three further data records, wherein among the further data records a serial number of the operating module, a serial number of the lock module and the functionality code,
2. b) comparison of a comparison license key which can be generated by means of a license algorithm with the license key by means of both evaluation devices,
3. c) evaluation of the functionality code by means of both evaluation devices,
4. d) transmission of at least one confirmation data record to the program memory of the lock module and to the program memory of the operating module if step b) results in a match of the compared data records,
5. e) activation or blocking of at least one subroutine of the lock module and at least one subroutine of the operating module.

Safety is increased if certain process steps are carried out not only in the operating module or in the lock module, but also in the other module. It is therefore provided, as mentioned above, that all three of steps b), c) and d) are carried out in both of the modules. It is also advantageous if the execution of the steps in each case in the order b), c) and d) follows one another and / or the execution of steps b), c) and / or d) takes place first in the lock module and then in the operating module.

Furthermore, the security of the method increases if, prior to step a) in step a0), an input of a supervisor code takes place, which is compared in step a2) before step b) by means of the evaluation device with a further data record stored in the lock module.

As mentioned above, it is provided that the license key is a data record which is generated from at least three further data records, whereby among the further data records a serial number of the operating module, a serial number of the lock module and the functionality code are.

In this case, the input of the data records in step a) and / or step a0) can be wired, such as via a hardware interface or wirelessly as by radio transmission.

Advantages and expediencies can be found in the following description in conjunction with the drawing.

Fig. 1

einen Geldautomaten in einer schematischen Darstellung;

Fig. 2a

in einer schematischen Darstellung die Zugangstür für die Geldfächer des Geldautomaten gemäß Fig. 1;

Fig. 2b

eine einzelne Schließeinheit wie gemäß Fig. 2a verwendet;

Fig. 3a

Hardwarekomponenten eines Standardmodells des zweiten Moduls;

Fig. 3b

Hardwarekomponenten eines erweiterten Modells des zweiten Moduls;

Fig. 4

eine Übersicht beispielhaft verfügbarer zweiter Module mit erstem Modul

Fig. 5

den Ablauf der Generierung des Lizenzkeys;

Fig. 6

einen Überblick über den Gesamt-Upgradeprozess;

Fig. 7

einen ersten Teilprozess des Gesamt-Upgradeprozesses;

Fig. 8

einen zweiten Teilprozess des Gesamt-Upgradeprozesses.

Show it:

Fig. 1

an ATM in a schematic representation;

Fig. 2a

in a schematic representation of the access door for the cash boxes of the ATM according to Fig. 1 ;

Fig. 2b

a single clamping unit as per Fig. 2a used;

Fig. 3a

Hardware components of a standard model of the second module;

Fig. 3b

Hardware components of an extended model of the second module;

Fig. 4

an overview of exemplarily available second modules with first module

Fig. 5

the process of generating the license key;

Fig. 6

an overview of the overall upgrade process;

Fig. 7

a first subprocess of the overall upgrade process;

Fig. 8

a second subprocess of the overall upgrade process.

In Fig. 1 is shown in a perspective view of an ATM 1, as it is available to bank customers, for example, in a financial institution for withdrawing funds. The control terminal for the bank customer with compartment for inserting the ec card, the numeric keypad for entering the PIN and the display for entering additional functions are arranged here as usual on the front side 1a of the ATM and play no role in the further invention. The back 1b of the ATM 1 is in Fig. 1 not to be seen. However, it is conceivable that, for example, one or two high-security locks according to the invention are arranged there. Depending on the embodiment of the ATM 1, the lock systems can also be mounted on the front side 1a under a covering door.

A possible configuration of a back side 1b of the ATM 1 shows Fig. 2a , There, a door 2 with door handle 2a can be seen, which is equipped with two locking units 6 as the first modules 3 and with these ensures access to the bins. The mechanical and / or electronic connection of the closing units 6 to the door 2 is illustrated here by way of example only. In the present case, the closing units 6 are designed as intelligent lock bolts 6.

Fig. 2b shows the closing unit 6 according to Fig. 2a in an enlarged view. An electronic high-security lock system consists inter alia of an input unit (see control panel 5 according to Fig. 3a / 3b ), at least one evaluation unit 18a and an actuating unit 17 (locking element). An evaluation unit 18a and the actuating unit 17 are combined, for example, in the lock bolt 6, which is why this is also referred to as intelligent lock bolt 6. In the present case, for example, by means of a displacement of the actuating unit 17, the door 2 can be unlocked and locked. However, neither the mechanism of this lock bolt 6 or the operating unit or the locking element 17 nor play the sequence of steps that allow the closing and opening of the door 2, for the present invention, a role. You will therefore learn in the further description no further consideration.

The FIGS. 3a and 3b show various second modules 4, which map the interface function to the user and in the present case are each designed as a control terminal or operating unit 5. Fig. 3a shows the standard model 7a of the second module 4, which via a numeric keypad 8 with number keys 8a (here exemplified by a number key), a confirmation key 8b and a clear key 8c. Fig. 3b 2 shows an expanded model of the second module 4 which, in addition to the elements 8, 8a, 8b, 8c present in the standard model 7a, has a display 9 and scroll or cursor keys 8d by means of which a user menu can be called up and displayed by means of the display 9 , The hardware equipment of the in Fig. 3b The extended model shown corresponds to the hardware configuration of models 7b, 7c and 7d.

In Fig. 4 By way of example, four second modules 4 are shown as models 7a, 7b, 7c, 7d, wherein the modules 7b, 7c, 7d each show the same hardware equipment, but differ in terms of their software equipment. For example, the models or modules of FIGS. 7a to 7d have increasing functionalities. The module 7a is installed, for example, in the factory. In order to exchange module 7a for module 7b, ie to carry out an upgrade 10a from model 7a to 7b, an exchange of the entire keyboard or numeric keypad 8 is therefore necessary. In contrast, an exchange of the module 7b against 7c or 7d or 7c against 7d (upgrade by means of arrow 10b1 or 10b2 or 10b3 shown) requires only one software upgrade with the help of a license key 15 (see Fig. 5 ). However, the illustrated first module 3 may be used in combination with all four second modules 7a, 7b, 7c, 7d shown.

Fig. 5 illustrates the generation 100 of a license key 15. For this purpose, the data relating to the serial number 12 of the smart lock bar 6, the serial number 13 of the operating unit 5 and a functionality code 14 are combined (step 101) and generated by using a suitable license algorithm, for example, an 8-digit license key 15 (Step 102).

Fig. 6 describes the entire upgrade process 200, for example from model 7b to 7c in individual process steps 201 to 214, wherein the individual steps are depicted in a preferred chronological order. As already mentioned above, in this upgrade process, no exchange of the control panel 5, but only an activation of coded software blocks 36a, 36b, 36c and 46a, 46b, 46c.

To start the upgrade process 200, the authorized user at the operating unit 5 enters the supervisor code 57 (step 201) in a specific menu item of the operating menu and then the function code 14 and the license key 15 (step 202). A request to enter these data 57, 14 and / or 15 can be displayed on the display 9, for example. These data are buffered in the operating unit 5 and encrypted (step 203) and encrypted in step 204 transmitted to the lock latch 6. This decrypts the data (step 205) evaluates the supervisor code (step 206) and compares the calculated license key to the received license key (step 207). If this comparison is satisfactory, the appropriate function blocks are enabled (step 208). There is a confirmation of the activation (step 209) and an encryption of the data (step 210). The encrypted data is then transmitted to the operating unit 5 (step 211) and decrypted there (step 212). Thereafter, the corresponding function block is unlocked in the keypad 5 (step 213), completing the upgrade process (illustrated at 214).

At least one so-called supervisor code 39 for activating the new function blocks 36a, 36b, 36c (see FIG Fig. 7 ) in the lock bolt 6 or 46a, 46b, 46c (see Fig. 8 ) stored in the control unit 5. These supervisor codes 39 may be changed upon installation of a system by the operator or the authorized user. Due to the fact that only the operating unit 5 must be exchanged, however, the code 39 can advantageously remain the same.

Fig. 7 illustrates a sub-process 200a of the upgrade process 200 according to FIG Fig. 6 and the involvement of various units in the expiration of the activation of the function blocks 36a, 36b, 36c in the program memory 36 of the intelligent lock bolt 6. The encrypted in step 203 data 31 are transmitted according to step 204 to a receiving device 32 of the lock bolt 6 and step 204a to the decryption device 33 transmitted. There, the data 31 are decrypted in plain text 40a (step 205), whereby they can be compared again with the received license key 15 and the functionality code 14. Subsequently, the plaintext data 40a are transmitted to the evaluation device 18a in step 205b. By means of the implemented license generator 37a, a comparison license key 38a is calculated (step 205a) and transmitted to the evaluation device 18a in step 205c. Also, starting from the code memory 34, the supervisor code 39 is transmitted to the evaluation device 18a (step 205d). In the evaluating device 18a, the received data 38a, 39, 40a or 38a, 39, 14, 15 are processed and compared on the basis of the device-specific data stored in the intelligent lock latch 6. If the currently calculated license key 38a corresponds to the received, decrypted license key 15, the corresponding software function block (here three blocks 36a, 36b, 36c) in the program memory 36 via a transfer of one or more confirmation records 48a, 48b, 48c or signals from the Evaluation unit 18a to the program memory 36 permanently enabled.

The confirmation of the activation is encrypted by means of confirmation data 41 sent back to the control unit 5 (see Fig. 8 ). These data 41 are received by a receiving device 42 of the operating part 5 in step 210a or transmitted encrypted in step 211 to a decryption device 43 of the operating unit 5. The rest of the following steps are analogous to those Fig. 7 However, each of the control unit 5 associated separate units such as evaluation 18b or license generator 37b are used: 212 analogous to 205, 212a analogous to 205a, 212b analogous to 205b (with plain text data 40b), 212c analogous to 205c, 212d analogous to 207, 213rd analogous to 208. It can be assumed that the license key 38a corresponds to the license key 38b. In the operating unit 5, the new functionality is accordingly enabled accordingly (via a transmission of one or more confirmation data sets 49a, 49b, 49c or signals from the evaluation unit 18b to the program memory 46).

Not all according to Fig. 6 shown steps are according to Fig. 7 and Fig. 8 shown. This also applies vice versa.

LIST OF REFERENCE NUMBERS

1

ATM

1a

front

1b

back

2

door

2a

door handle

3

first module

4

second module

5

operating unit

6

closing unit

7a

standard model

7b, 7c, 7d

extended model

8th

Numbers block

8a

number key

8b

confirmation key

8c

Clear key

8d

cursor

9

display

10a

Exchange of the numeric keypad

10b1, 10b2, 10b3

software upgrade

11

combination

12, 13

serial number

14

functionality code

15

license

17

operating unit

18a, b

evaluation

31

Encrypted data

32, 42

receiver

33, 43

decryption means

34

Code memory of the supervisor code

36, 46

program memory

36a, 46a

Function block A

36b, 46b

Function block B

36c, 46c

Function block C

37a, 37b

License generator

38a, 38b

Comparative license

39

Supervisor code

40, 40a, 40b

Plaintext data

41

confirmation data

45

High security lock

48a, 48b, 48c

Verification record

49a, 49b, 49c

Verification record

52a, 52b, 52c

function

53a, 53b

Data encryption unit

54a, 54b

Data transfer unit

55a, 55b

Data storage unit

56

Data reception interface

57

Supervisor code

100

Generation of the license key

101

combination step

102

Stock algorithm

200

upgrade process

200a

Upgrade subprocess in smart lock bolt

200b

Upgrade subprocess in the control unit

201

Enter the supervisor code

202

Enter the function code and the license key

203

Encryption of the function code and the license key

204

Encrypted transmission to the lock bolt

204a

Forwarding the data

205

Decryption of the data

205a

Calculation of the comparison license key

205b

Transmission of plain text data

205c

Transfer of the comparison license key

205d

Transmission of the supervisor code

206

Evaluation of the supervisor code

207

Comparison of calculated license key with received license key

208

Activation of the corresponding function block

209

Confirmation of the activation

210

Encryption of the data

210a

data entry

211

Encrypted transmission to the control unit

212

Decryption of the release data

212a

Calculation of comparison license key

212b

Transmission of plain text data

212c

Transfer of the comparison license key

212d

Comparison of calculated license key with received license key

213

Activation of the corresponding function block

214

Completion of the upgrade process

Claims (8)

1. High-security lock (45) for a secure storage unit (1),
   comprising at least one mechanically functioning lock module (3) and a control module (4) equipped with a data receiving interface,
   wherein the lock module (3) and the control module (4) are designed and provided to be electronically and mechanically separated from one another and/or connected to one another according to the plug-and-play principle,
   wherein the lock module (3) and the control module (4) each comprise their own program memory (36; 46) having preinstalled subprograms (36a, 36b, 36c; 46a, 46b, 46c) which encode functions of the lock module (3) and/or the control module (4), wherein the subprograms (46a, 46b, 46c) preinstalled in the program memory (46) of the control module (4) only encode the functions of the control module (4) and the subprograms (36a, 36b, 36c) preinstalled in the program memory (36) of the lock module (3) only encode the functions of the lock module (3),
   wherein the data receiving interface is designed and provided to transmit a functionality code (14) and, separately from that, a licence key (15) to the control module (4) and the lock module (3),
   wherein the lock module (3) and the control module (4) each comprise an evaluation unit (18a; 18b),
   and wherein the two evaluation units (18a; 18b) are designed and provided to compare a comparison licence key (38a; 38b) which can be generated by a licence algorithm with the licence key (15) and evaluate the functionality code (14), and to transfer at least one confirmation data record (48a, 48b, 48c) to the program memory (36) of the lock module (3) in order to unlock or lock at least one subprogram (36a, 36b, 36c) of the lock module (3), and to the program memory (46) of the control module (4) in order to unlock or lock at least one subprogram (46a, 46b, 46c) of the control module (4),
   wherein
   the licence key (15) is a data record which is generated from at least three further data records (12, 13, 14), wherein the further data records include a serial number (12) of the control module (4), a serial number (13) of the lock module (3) and the functionality code (14), wherein the functionality code (14) is dependent on the subprograms (36a, 36b, 36c; 46a, 46b, 46c) to be unlocked or locked in the program memories (36; 46).
2. High-security lock (45) according to claim 1,
   characterised in that
   the lock module (3) and the control module (4) each comprise at least one of the following units: a data encryption unit (53a; 53b), a data transmission unit (54a; 54b) and a data storage unit (55a; 55b).
3. High-security lock (45) according to either of the preceding claims,
   characterised in that
   the data receiving interface is a device (8) for manually entering data records or an electronic interface for wired transfer of data records or an electronic interface for wireless transfer of data records.
4. High-security lock (45) according to any of the preceding claims,
   characterised in that
   the lock module (3) is designed and provided such that a supervisor code (39) is stored in the lock module (3), the evaluation unit (18a) being designed and provided to compare the supervisor code (39) with a supervisor code (57) transmitted to the control module (4) and the lock module (3) by means of the data receiving interface.
5. Method (200) for the software-side activation or deactivation of functions of modules (3, 4) of a high-security lock (45) for a secure storage unit (1),
   the high-security lock (45) comprising at least one mechanically functioning lock module (3) and a control module (4) equipped with a data receiving interface,
   the lock module (3) and the control module (4) each comprising their own program memory (36; 46) with preinstalled subprograms (36a, 36b, 36c; 46a, 46b, 46c) which encode the functions,
   characterised in that
   the lock module (3) and the control module (4) are designed and provided to be electronically and mechanically separated from one another and/or connected to one another according to the plug-and-play principle, and in that the subprograms (46a, 46b, 46c) preinstalled in the program memory (46) of the control module (4) only encode the functions of the control module (4) and the subprograms (36a, 36b, 36c) preinstalled in the program memory (36) of the lock module (3) only encode the functions of the lock module (3), and in that
   the lock module (3) and the control module (4) each comprise an evaluation unit (18a; 18b),
   comprising the following method steps:

   a) inputting a functionality code (14) which is dependent on subprograms which are to be unlocked or locked (36a, 36b, 36c; 46a, 46b, 46c) in the program memories (36; 46), and separately from that inputting a licence key (15) at the data receiving interface, the licence key (15) being a data record which is generated from at least three further data records (12, 13, 14), the further data records including a serial number (12) of the control module (4), a serial number (13) of the lock module (3) and the functionality code (14),

   b) comparing a comparison licence key (38a; 38b) which can be generated by a licence algorithm with the licence key (15) by means of the two evaluation units (18a; 18b),

   c) evaluating the functionality code (14) by means of the two evaluation units (18a; 18b),

   d) transmitting at least one confirmation data record (48a, 48b, 48c; 49a, 49b, 49c) to the program memory (36) of the lock module (3) and to the program memory (46) of the control module (4) if step b) results in a match of the compared records (38a, 15; 38b, 15),

   e) unlocking or locking at least one subprogram (36a, 36b, 36c) of the lock module (3) and at least one subprogram (46a, 46b, 46c) of the control module (4).
6. Method (200) according to claim 5,
   characterised in that
   the steps are in each case carried out one after the other in the order b), c) and d), and/or steps b), c) and/or d) are first carried out in the lock module (3) and then in the control module (4).
7. Method (200) according to either claim 5 or claim 6,
   characterised in that
   a supervisor code (57) is input in a step a0) temporally before step a) and, in a step a2) before step b), is compared, by means of the evaluation unit (18a; 18b), with a further data record (39) stored in the lock module (3).
8. Method (200) according to any of claims 5-7,
   characterised in that
   the data records (14, 15) are input in step a) and/or step a0) via wire, such as via a hardware interface, or wirelessly, such as via radio transmission.

Images