EP3704674B1 - System and method for controlling the access of persons - Google Patents

Description

System and method for controlling access for people The invention relates to a system and method for controlling access for people in physical access areas.

For authentication in an access control system, e.g. in a building, physical media (RFID key, ID card) are usually used in connection with ID card readers or RFID readers or similar to authenticate a person who wants access. If the physical medium (e.g. a company ID card) is recognized and the corresponding authorization is available in the system, access is granted. If a pass is lost, anyone in possession of the pass will be granted access. This means there is a risk of unauthorized persons staying in a protected area.

The use of multi-factor authentication, in particular two-factor authentication (identification of a person using two different factors, e.g. ID card and PIN (pin number), does not always enable secure authentication, because both factors can be used by another person be illegally obtained to gain unauthorized access Furthermore, multi-factor authentication systems are often cumbersome and time-consuming for a user. US7360248B1 discloses a GPS-based method and apparatus for controlling access by verifying the location of an authorized user, the GPS-based method confirming that the appropriate user is physically present at the device's location.

It is therefore the object of the present invention to provide a mechanism for simple and secure authentication of a person in an access control system.

• ein Identifikationsmedium (z.B. Badge, Ausweis, RFID Chip), das einen einer Person zugeordneten Identifikationscode (z.B. ID-Nr., Identifizierungsnummer) aufweist;
• eine Lesevorrichtung (z.B. ein Kartenleser) zum Lesen des Identifikationscodes, wobei sich die Lesevorrichtung an einem physischen Zugangsbereich (z.B. Pforte, Tür) befindet, und wobei die Lesevorrichtung eingerichtet ist, den gelesenen Identifikationscode und die Ortsposition der Lesevorrichtung an einen Zutrittskontrollserver zu senden;
• eine Positionsbestimmungsvorrichtung (z.B. ein satellitengestützte Positionsbestimmungsvorrichtung, wie z.B. GPS oder Galileo, oder eine Indoor-Ortsbestimmungsvorrichtung, wie z.B. WLAN oder IBeacons) zum Bestimmen der Ortsposition (OPG) eines der Person zugeordneten mobilen Gerätes (z.B. mobiles Kommunikationsendgerät wie Smartphone, Tablet-Computer oder IPod);
• den Zutrittskontrollserver, wobei der Zutrittskontrollserver dazu eingerichtet ist, den Identifikationscode des Identifikationsmediums und die Ortsposition des mobilen Gerätes zu empfangen, die empfangene Ortsposition des mobilen Gerätes mit der Ortsposition der Lesevorrichtung zu vergleichen sowie eine Zutrittsautorisierung für die Person zu erstellen, falls die Ortsposition des der Person zugeordneten mobilen Gerätes und die Ortsposition der Lesevorrichtung übereinstimmen und falls eine positive Authentifizierung der Person auf Basis des Identifikationscodes festgestellt ist. Durch die Standortermittlung des mobilen Gerätes (z.B. Smartphone) der Zutritt suchenden Person wird automatisch eine Plausibilität zwischen dem Identifikationsmedium (z.B. Badge, Ausweis, RFID Chip) am Zugangsbereichen (z.B. Pforte, Tür) und dem Standort des mobilen Gerätes hergestellt. Dabei können verschiedene Technologien der Standortermittlung bzw. Positionsbestimmung verwendet werden, wie z.B. GPS-Koordinaten, Zelleninformation des mobilen Gerätes (z.B. Smartphone), oder WLAN-ID des WLAN-Access Point, welcher in der Nähe der entsprechenden Lesevorrichtung installiert ist. Mit Vorteil umfasst der Zutrittskontrollserver eine Korrelationstabelle zur Überprüfung, ob beide Faktoren der Authentifizierung (Identifikationscode und die Ortsposition der Lesevorrichtung) übereinstimmen. Mit Vorteil ist die Korrelationstabelle in einer In-Memory-Datenbank (IMDB) im Arbeitsspeicher des Zutrittskontrollserver hinterlegt. Dies ermöglicht u.a. schnelle Zugriffs- und Überprüfungszeiten.

The object is achieved by the system for access control claimed in claim 1 and the associated method according to claim 8. The present invention relates to a system for access control of people at physical access areas (e.g. gate, door), the system comprising:

• an identification medium (e.g. badge, ID card, RFID chip) which has an identification code (e.g. ID number, identification number) assigned to a person;
• a reading device (e.g. a card reader) for reading the identification code, the reading device being located at a physical access area (e.g. gate, door), and the reading device being set up to send the read identification code and the location of the reading device to an access control server;
• a position determination device (e.g. a satellite-based position determination device such as GPS or Galileo, or an indoor location determination device such as WLAN or IBeacons) for determining the location position (OPG) of a mobile device assigned to the person (e.g. mobile communication terminal device such as a smartphone, tablet computer or iPod);
• the access control server, wherein the access control server is set up to receive the identification code of the identification medium and the location of the mobile device, to compare the received location of the mobile device with the location of the reading device and to create an access authorization for the person if the location of the Person associated mobile device and the location of the reading device match and if a positive authentication of the person based on the identification code is determined. By determining the location of the mobile device (e.g. smartphone) of the person seeking access, a plausibility between the identification medium (e.g. badge, ID card, RFID chip) at the access areas (e.g. gate, door) and the location of the mobile device is automatically established. Various technologies can be used to determine the location or position, such as GPS coordinates, cell information from the mobile device (eg smartphone), or the WLAN ID of the WLAN access Point, which is installed near the corresponding reading device. The access control server advantageously includes a correlation table for checking whether both factors of authentication (identification code and the location of the reading device) match. The correlation table is advantageously stored in an in-memory database (IMDB) in the main memory of the access control server. This enables, among other things, fast access and verification times.

A building or a spatial area can have several physical access areas for people to enter. Each of these access areas is advantageously equipped with a corresponding reading device or a corresponding position determination device.

Advantageously, the identification medium (e.g. badge, ID card, RFID chip, identity card) and the identification code assigned to a person (e.g. ID number, identification number) are issued by a secure and trustworthy entity (e.g. appropriately set up office in the human resources department of a company) and the identification code assigned to a person is generated by secure mechanisms (e.g. by appropriate cryptographic or statistical methods) and stored on the identification medium in a forgery-proof manner.

Two-factor authentication for access control of people using the combination of two different and, in particular, independent components increases security because there is a high probability that unauthorized people will be denied access.

A first advantageous embodiment of the invention is that the access control server is implemented in a cloud infrastructure. The access authorization can thus eg as SaaS (Software-as-a-Service) for a service recipient (eg for a company that would like to set up a corresponding multi-way or two-way access authorization process for its company building or campus).

A further advantageous embodiment of the invention is that the position determination device is set up to send the location of the mobile device to the access control server. The position determination device can, for example, use the WLAN ID of a WLAN access point to determine the location of the mobile device and send it to the access control server via a corresponding secure communication link. Only the infrastructure of the access control system is used to determine the position and to transmit the position data to the access control server. This makes attacks by third parties (e.g. man-in-the-middle attacks) more difficult.

A further advantageous embodiment of the invention is that the mobile device is set up to send the location of the mobile device to the access control server. This is particularly advantageous if the mobile device is a service or company mobile phone that is equipped with appropriate software and security mechanisms.

A further advantageous embodiment of the invention lies in the fact that the position determination device is set up to carry out the determination of the spatial position of the mobile device assigned to the person using satellites (GPS, Galileo). A satellite-supported position determination can be used particularly suitably if the reading device is located outside of a building. Eg for access control to a fenced area (eg barracks).

A further advantageous embodiment of the invention is that the position determination device is set up to determine the location of the mobile device assigned to the person on the basis of the cell information of a mobile radio network (e.g. GSM). In cities and developed regions in particular, the cellular network is very dense. The determination of the location of a mobile device (e.g. mobile communication device, smartphone) is therefore possible with sufficient accuracy.

A further advantageous embodiment of the invention is that the position determination device is set up to determine the location of the mobile device assigned to the person on the basis of IPS data (indoor positioning, WiFi access points, iBeacons, Bluetooth, etc.). The location can thus be determined using the existing infrastructure in the access area to be controlled, or an indoor position determination device (WiFi access points, iBeacons, Bluetooth, etc.) can be installed very easily.

According to the invention, the access control server authorizes access for the person if the location of the mobile device assigned to the person and the location of the reading device match and the person has been authenticated positively on the basis of the identification code (ID no.), the location of the Person associated mobile device is provided by two different positioning devices. If the location of the mobile device assigned to the person is determined independently of one another by two different position determination devices and access is only granted if, in the case of a positively recognized identification code, the spatial positions determined independently of one another by the two different position-determining devices also match, access is denied to unauthorized persons with a very high degree of certainty or probability. Furthermore, a two-factor authentication can be easily extended to a three-factor authentication.

According to the invention, the two different position determination devices each determine the location of the mobile device assigned to the person on the basis of different technologies or different location determination methods. If the location of the mobile device assigned to the person is determined independently of one another by two different position determination devices, each of which is based on different technologies, and access is only granted if the location positions determined independently of one another by the two different position determination devices also match in the case of a positively recognized identification code , access is denied to unauthorized persons with a very high degree of certainty or probability. This also makes it very easy to expand a two-factor authentication to a three-factor authentication.

• Authentifizieren der Person auf Basis eines der Person zugeordneten Identifikationsmediums (Badge, RFID Chip) durch eine Zutrittskontrollvorrichtung;
• Bestimmen der Ortsposition eines der Person zugeordneten mobilen Gerätes (z.B. mobiles Kommunikationsendgerät wie Smartphone oder IPod);
• Übermitteln der Ortsposition des mobilen Gerätes an die Zutrittskontrollvorrichtung;
• Überprüfen der Ortsposition des mobilen Gerätes mit der Ortsposition des entsprechenden Zugangsbereiches durch die Zutrittskontrollvorrichtung, wobei eine Zutrittsautorisierung für die Person erfolgt, wenn die Ortsposition des der Person zugeordneten mobilen Gerätes und die Ortsposition des entsprechenden Zugangsbereiches übereinstimmen und eine positive Authentifizierung der Person auf Basis des der Person zugeordneten Identifikationsmediums (Badge, RFID Chip) erfolgt ist. Das Verfahren kann mit Infrastruktur, die an zu schützenden Zugangsbereichen (Pforte, Tor, etc.) sowieso schon vorhanden ist oder leicht nachrüstbar ist realisiert werden. Mit Vorteil wird das Verfahren mit handelsüblicher Hardware (Computer, Speicher, Kommunikationsmechanismen, etc.) bzw. Softwarekomponenten (z.B. Spread-sheets, Datenbanken) realisiert. Durch das Verfahren kann sehr leicht eine Zwei-Faktor-Authentifizierung für die Zugangskontrolle von Personen realisiert werden, die auch leicht zu einer Drei-Faktor-Authentifizierung bzw. Mehr-Faktor-Authentifizierung erweiterbar ist.

The present invention also relates to a method for controlling the access of people to access areas (e.g. gate, door), the method comprising:

• Authentication of the person on the basis of an identification medium assigned to the person (badge, RFID chip) by an access control device;
• Determining the location of a mobile device assigned to the person (eg mobile communication terminal such as a smartphone or IPod);
• Transmitting the location of the mobile device to the access control device;
• Checking the location of the mobile device with the location of the corresponding access area by the access control device, with access authorization for the person if the location of the mobile device assigned to the person and the location of the corresponding access area match and a positive authentication of the person based on the Person assigned identification medium (badge, RFID chip) is done. The method can be implemented with infrastructure that already exists at the access areas to be protected (gate, gate, etc.) or that can be easily retrofitted. The method is advantageously implemented using commercially available hardware (computers, memories, communication mechanisms, etc.) or software components (eg spreadsheets, databases). The method makes it very easy to implement two-factor authentication for access control for people, which can also easily be expanded to three-factor authentication or multi-factor authentication.

According to the invention, the spatial position of the mobile device assigned to the person is determined by two different position determination technologies or by two different position determination devices. If the location of the mobile device assigned to the person is determined independently of one another by two different positioning devices or by two different positioning technologies, and access is only granted if, in the case of a positively recognized identification code, the location positions determined independently of one another also match, access is denied to unauthorized persons with a very high degree of certainty or probability.

FIG 1

ein beispielhaftes System zur Zutrittskontrolle von Personen an physischen Zugangsbereichen, und

FIG 2

ein beispielhaftes Flussdiagramm für ein Verfahren zur Zutrittskontrolle von Personen an physischen Zugangsbereichen.

The invention and advantageous embodiments of the present invention are explained using the example of the following figures. show:

FIG 1

an exemplary system for access control of persons at physical access areas, and

FIG 2

an exemplary flowchart for a method for access control of people in physical access areas.

• ein Identifikationsmedium IM (z.B. Badge, Ausweis, RFID Chip) das einen einer Person P zugeordneten Identifikationscode IC (z.B. maschinenlesbarer eindeutiger Code) aufweist;
• eine Lesevorrichtung LV zum Lesen des Identifikationscodes IC, wobei sich die Lesevorrichtung LV an einem physischen Zugangsbereich T (z.B. Pforte, Tür) befindet, und wobei die Lesevorrichtung LV eingerichtet ist, den gelesenen Identifikationscode IC und die Ortsposition OPL der Lesevorrichtung LV an einen Zutrittskontrollserver ZKS zu senden;
• eine Positionsbestimmungsvorrichtung SAT, IPS zum Bestimmen der Ortsposition eines der Person P zugeordneten mobilen Gerätes MG (z.B. mobiles Kommunikationsendgerät wie Smartphone, Tablet-Computer oder IPod);
• einen Zutrittskontrollserver ZKS der eingerichtet ist den Identifikationscode IC des Identifikationsmediums IM und die Ortsposition des mobilen Gerätes MG zu empfangen, und wobei der Zutrittskontrollserver ZKS weiter eingerichtet ist, die empfangene Ortsposition OPG des mobilen Gerätes MG mit der Ortsposition OPL der Lesevorrichtung LV zu vergleichen, wobei durch den Zutrittskontrollserver ZKS eine Zutrittsautorisierung für die Person P erfolgt, wenn die Ortsposition OPG des der Person P zugeordneten mobilen Gerätes MG und die Ortsposition OPL der Lesevorrichtung LV übereinstimmen und eine positive Authentifizierung der Person P auf Basis des Identifikationscodes IC erfolgt ist.

figure 1 shows an exemplary system for access control of people at physical access areas (e.g. gates, doors). The example system includes:

• an identification medium IM (eg badge, ID card, RFID chip) which has an identification code IC assigned to a person P (eg machine-readable unique code);
• a reading device LV for reading the identification code IC, the reading device LV being located at a physical access area T (e.g. gate, door), and the reading device LV being set up to send the read identification code IC and the location OPL of the reading device LV to an access control server ZKS to send;
• a position determination device SAT, IPS for determining the spatial position of a person P assigned mobile Device MG (e.g. mobile communication terminal such as a smartphone, tablet computer or IPod);
• an access control server ZKS which is set up to receive the identification code IC of the identification medium IM and the location of the mobile device MG, and wherein the access control server ZKS is further set up to compare the received location OPG of the mobile device MG with the location OPL of the reading device LV, wherein the access control server ZKS authorizes access for the person P if the location OPG of the mobile device MG assigned to the person P and the location OPL of the reading device LV match and a positive authentication of the person P based on the identification code IC has taken place.

To determine the respective spatial position OPL, OPG, an e.g. an indoor positioning system (location determination system) IPS, such as BLE Beacon (Bluetooth Low Energy Beacon), RFID (Radio Frequency Identification), NFC (Near Field Communication), WLAN SSID ( Service Set Identifier) can be used, or a Global Positioning System (GPS, Galileo) SAT, which works with satellite support. A combined system, e.g. based on GPS and IPS, can also be used to determine the spatial position OPL, OPG. However, it is also possible for the indoor positioning system IPS and the global positioning system (GPS) SAT to work independently of one another, i.e. to determine the respective spatial position OPL, OPG independently of one another.

The physical access area can be an entrance to a building G or a room within a building, or an entrance to a closed (eg fenced) area (eg campus, barracks).

The identification medium IM for a person P can be, for example, a badge, ID or RFID chip assigned to this person. A mobile communication device (e.g. smartphone) assigned to the person and equipped with an app or credentials (proof of authorization, legitimation) could also be used as the identification medium IM.

An identification code IC that is unique for the respective person is assigned to the identification medium IM. E.g. an employee number or identification number. The identification code IC is advantageously encrypted and can be decrypted by appropriate software in the access control server ZKS. The identification code IC is advantageously machine-readable (e.g. barcode, QR code, chip on ID card).

To read the identification code IC, e.g. the identification medium IM (e.g. ID card as an IC card) can be inserted into the reading device LV in a corresponding receiving opening of the reading device LV. The reading of the identification code IC from the identification medium IM can be carried out by the reading device LV but also without contact (contactless), e.g. by a corresponding optical device (e.g. for reading barcodes or QR codes) or e.g. by a radio-based device (e.g. RFID reader) depending on the respective identification medium IM used or the identification code IC used.

The access control server ZKS is connected to the reading device LV, to the position determination device SAT, IPS, or to the mobile device MG by corresponding communication links KV1-KV3 for data or information exchange. The communication connections KV1-KV3 can be, for example, satellite-supported connections or radio connections act. The access control server ZKS is equipped with appropriate hardware and software components. The access control server ZKS advantageously includes a database DB, which contains a correlation table, for example, for checking whether the authentication factors (identification code, location of the reading device, location of the mobile device) match. The database DB can be, for example, an appropriately set up relational database.

However, the correlation table can also be stored in an in-memory database (IMDB) in the main memory of the access control server ZKS.

After successful authentication by the access control server ZKS, it sends a corresponding access authorization ZA (e.g. a corresponding signal (e.g. flag, credential) for opening the door T) to the reading device LV or directly to an access mechanism of the door T.

The ZKS access control server is advantageously implemented in a cloud infrastructure.

The position determination device SAT, IPS is advantageously set up to send the location OPG of the mobile device MG to the access control server ZKS.

The mobile device MG (e.g. smartphone) is advantageously set up to send the location OPG of the mobile device MG to the access control server ZKS.

The position determination device SAT, IPS is advantageously set up to determine the spatial position OPG of the person P associated mobile device MG satellite (eg by GPS or Galileo) to make.

The position determination device SAT, IPS is advantageously set up to determine the spatial position OPG of the mobile device MG assigned to the person P on the basis of the cell information of a mobile radio network (e.g. GSM).

The position determination device SAT, IPS is advantageously set up to determine the spatial position OPG of the mobile device MG assigned to the person P on the basis of IPS data (indoor positioning, WiFi access points, IBeacons).

An access authorization ZA for the person P is advantageously carried out by the access control server ZKS if the spatial position OPG of the mobile device MG assigned to the person P and the spatial position OPL of the reading device LV match and a positive authentication of the person P has taken place on the basis of the identification code IC, the spatial position OPG of the mobile device MG assigned to the person P being provided by two different position determination devices SAT, IPS.

Advantageously, the two different position determination devices each determine the spatial position of the mobile device MG assigned to the person P on the basis of different technologies. This increases the security of access control, ie there is a very high probability that unauthorized persons will be denied access.

figure 2 shows an exemplary flow chart for a method for access control of people at physical access areas (eg gate, door).

• (VS1) Authentifizieren der Person auf Basis eines der Person zugeordneten Identifikationsmediums (z.B. Badge, RFID Chip) durch eine Zutrittskontrollvorrichtung;
• (VS2) Bestimmen der Ortsposition eines der Person zugeordneten mobilen Gerätes (z.B. mobiles Kommunikationsendgerät wie Smartphone oder IPod);
• (VS3) Übermitteln der Ortsposition des mobilen Gerätes an die Zutrittskontrollvorrichtung;
• (VS4) Überprüfen der Ortsposition des mobilen Gerätes mit der Ortsposition des entsprechenden Zugangsbereiches durch die Zutrittskontrollvorrichtung, wobei eine Zutrittsautorisierung für die Person erfolgt, wenn die Ortsposition des der Person zugeordneten mobilen Gerätes und die Ortsposition des entsprechenden Zugangsbereiches übereinstimmen und eine positive Authentifizierung der Person auf Basis des der Person zugeordneten Identifikationsmediums (z.B. Badge, RFID Chip) erfolgt ist. Das Verfahren kann mit Infrastruktur, die an zu schützenden Zugangsbereichen (Pforte, Tor, etc.) sowieso schon vorhanden ist oder leicht nachrüstbar ist realisiert werden. Mit Vorteil wird das Verfahren mit handelsüblicher Hardware (Computer, Speicher, Kommunikationsmechanismen, etc.) bzw. Softwarekomponenten (z.B. Spread-sheets, Datenbanken) realisiert. Durch das Verfahren kann sehr leicht eine Zwei-Faktor-Authentifizierung für die Zugangskontrolle von Personen realisiert werden, die auch leicht zu einer Drei-Faktor-Authentifizierung bzw. Mehr-Faktor-Authentifizierung erweiterbar ist.

The access control procedure consists of the following steps:

• (VS1) authentication of the person on the basis of an identification medium assigned to the person (eg badge, RFID chip) by an access control device;
• (VS2) determining the location of a mobile device assigned to the person (eg mobile communication terminal such as a smartphone or IPod);
• (VS3) transmitting the location of the mobile device to the access control device;
• (VS4) Checking the location of the mobile device with the location of the corresponding access area by the access control device, with access authorization for the person if the location of the mobile device assigned to the person and the location of the corresponding access area match and a positive authentication of the person Based on the identification medium (e.g. badge, RFID chip) assigned to the person. The method can be implemented with infrastructure that already exists at the access areas to be protected (gate, gate, etc.) or that can be easily retrofitted. The method is advantageously implemented using commercially available hardware (computers, memories, communication mechanisms, etc.) or software components (eg spreadsheets, databases). The method makes it very easy to implement two-factor authentication for access control for people, which can also easily be expanded to three-factor authentication or multi-factor authentication.

The access control device can be implemented, for example, by a correspondingly set up server, which is advantageously located in a cloud infrastructure and is connected and communicates with the mobile device, the reading device or the position determination system in terms of data technology using appropriate communication mechanisms.

The spatial position of the mobile device assigned to the person is advantageously determined by two different position determination technologies or by two different position determination devices. If the position of the mobile device assigned to the person is determined independently of one another by two different position determination devices or by two different position determination technologies, and access is only granted if the independently determined positions also match in the case of a positively recognized identification code, a very high security or probability of unauthorized persons being denied access.

The identification medium (e.g. IC card, ID card) advantageously includes an identification code (e.g. unique ID number) which is uniquely assigned to the person and which can be read by a reading device and can be forwarded from the reading device to the access control device. The reading device can also be structurally integrated into the access control device. The reading device is advantageously located in the access area itself or in the immediate vicinity of the access area (e.g. in the range from 5 cm to 5 m, in particular 50 cm to 3 m).

Features and advantages of the invention are in particular:

By determining the location of the mobile device (e.g. smartphone) of the person seeking access, a plausibility between the location of a reading device (e.g. ID card reader on a door/gate) and the location of the mobile device is automatically established.

1. 1. GPS-Koordinaten, die z.B. auch via Telefon auf Anfrage an den Zutrittskontrollserver übermittelt werden können.
2. 2. Zelleninformation des mobilen Gerätes (z.B. Smartphone) die z.B. via Telefon auf Anfrage an den Zutrittskontrollserver übermittelt werden können.
3. 3. WLAN-ID des WLAN-Access Point, welcher in der Nähe der entsprechenden Lesevorrichtung (z.B. Zutrittlesers) installiert ist. Eine Korrelationstabelle die auf einem Zutrittskontrollserver abgelegt ist, überprüft automatisch, ob beide Faktoren der Authentifizierung oder weitere übereinstimmen.

Various technologies for location determination can be considered:

1. 1. GPS coordinates, which can also be transmitted to the access control server via telephone on request, for example.
2. 2. Cell information of the mobile device (e.g. smartphone) which can be transmitted to the access control server via telephone on request.
3. 3. WLAN ID of the WLAN access point that is installed near the corresponding reading device (e.g. access reader). A correlation table stored on an access control server automatically checks whether both authentication factors or others match.

Lost IDs are "automatically" invalid for correspondingly secured doors, since the 2nd feature is missing. There is no need to manually block the ID card in the system and create a new ID card for the person immediately. This increases the security against unauthorized access. Back doors in particular, where there is usually no porter present, are given increased security as a result.

If the ID card is found again later, it can be used again in connection with the other authentication methods.

A 2-way authentication is checked automatically in the system. No further entry or submission of a credential is necessary.

• wobei ein Authentifizieren der Person auf Basis eines der Person zugeordneten Identifikationsmediums (Badge, RFID Chip) durch eine Zutrittskontrollvorrichtung erfolgt;
• wobei eine Bestimmung der Ortsposition eines der Person zugeordneten mobilen Gerätes (z.B. mobiles Kommunikationsendgerät wie Smartphone oder IPod) erfolgt;
• wobei die Ortsposition des mobilen Gerätes an die Zutrittskontrollvorrichtung übermittelt wird;
• wobei ein Überprüfen der Ortsposition des mobilen Gerätes mit der Ortsposition des entsprechenden Zugangsbereiches durch die Zutrittskontrollvorrichtung erfolgt;
• wobei eine Zutrittsautorisierung für die Person erfolgt, wenn die Ortsposition des der Person zugeordneten mobilen Gerätes und die Ortsposition des entsprechenden Zugangsbereiches übereinstimmen und eine positive Authentifizierung der Person auf Basis des der Person zugeordneten Identifikationsmediums (Badge, RFID Chip) erfolgt ist.

System and procedure for access control of persons at access areas (e.g. gate, door),

• wherein the person is authenticated on the basis of an identification medium assigned to the person (badge, RFID chip) by an access control device;
• the spatial position of a mobile device assigned to the person (eg mobile communication terminal such as a smartphone or IPod) being determined;
• wherein the location of the mobile device is transmitted to the access control device;
• wherein the location of the mobile device is checked against the location of the corresponding access area by the access control device;
• Access authorization for the person takes place if the location of the mobile device assigned to the person and the location of the corresponding access area match and a positive authentication of the person has taken place on the basis of the identification medium (badge, RFID chip) assigned to the person.

Reference sign

SAT

satellite

LV

reading device

IP

positioning system

G

building

T

door

KV1 - KV3

communication link

MG

mobile device

IN THE

identification medium

IC

identification code

P

person

C

cloud

ZKS

access control server

DB

Database

OPG

Location of the mobile device

OPL

Location of the reading device

ZA

Access Authorization

VS1 - VS4

process step

Claims (8)

1. System for controlling the access of persons (P) at physical access regions (T), said system comprising:

   an identification medium (IM) having an identification code (IC) assigned to a person;

   a reading device (LV) for reading the identification code (IC), wherein the reading device (LV) is located at a physical access region (T), and wherein the reading device (LV) is configured to send the identification code (IC) read and the location (OPL) of the reading device (LV) to an access control server (ZKS);

   a positioning device (SAT, IPS) for determining the location (OPG) of a mobile device (MG) assigned to the person (P) ;

   the access control server (ZKS), wherein the access control server is configured to receive the identification code (IC) of the identification medium (IM) and the location (OPG) of the mobile device (MG), to compare the received location (OPG) of the mobile device (MG) with the location (OPL) of the reading device (LV), and to generate an access authorisation (ZA) for the person (P) if the location (OPG) of the mobile device (MG) assigned to the person (P) and the location (OPL) of the reading device (LV) match, and if a positive authentication of the person (P) on the basis of the identification code (IC) has been established,
   characterised in that an access authorisation (ZA) is provided for the person (P) by means of the access control server (ZKS) if the location (OPG) of the mobile device (MG) assigned to the person (P) and the location (OPL) of the reading device (LV) match, and a positive authentication of the person (P) on the basis of the identification code (IC) has occurred, wherein the location (OPG) of the mobile device (MG) assigned to the person (P) is provided by two different positioning devices (SAT, IPS),
   and that the two different positioning devices (SAT, IPS) determine the location (OPG) of the mobile device (MG) assigned to the person (P) in each case on the basis of different technologies or different positioning methods.
2. Access control system according to claim 1, wherein the access control server (ZKS) is realised in a cloud infrastructure (C).
3. Access control system according to one of the preceding claims, wherein the positioning device (SAT, IPS) is configured to send the location (OPG) of the mobile device (MG) to the access control server (ZKS).
4. Access control system according to one of the preceding claims, wherein the mobile device (MG) is configured to send the location (OPG) of the mobile device (MG) to the access control server (ZKS).
5. Access control system according to one of the preceding claims, wherein the positioning device (SAT, IPS) is configured to determine the location (OPG) of the mobile device (MG) assigned to the person (P) on the basis of satellites.
6. Access control system according to one of the preceding claims, wherein the positioning device (SAT, IPS) is configured to determine the location (OPG) of the mobile device (MG) assigned to the person (P) on the basis of the cell information of a mobile network.
7. Access control system according to one of the preceding claims, wherein the positioning device (SAT, IPS) is configured to determine the location (OPG) of the mobile device (MG) assigned to the person (P) on the basis of IPS data.
8. Method for controlling the access of persons (P) at access regions (T), said method comprising the following steps:

   (VS1) the person (P) is authenticated by means of an access control device (ZKS) on the basis of an identification medium (IM) assigned to the person (P);

   the location (OPG) of a mobile device (MG) assigned to the person (P) is determined;

   the location (OPG) of the mobile device (MG) is transmitted to the access control device (ZKS);

   the location (OPG) of the mobile device (MG) is checked with the location (OPL) of the corresponding access region (T) by means of the access control device (ZKS), wherein an access authorisation (ZA) is provided for the person (P) if the location (OPG) of the mobile device (MG) assigned to the person (P) and the location (OPL) of the corresponding access region (T) match and a positive authentication of the person (P) on the basis of the identification medium (IM) assigned to the person (P) has occurred,
   characterised in that an access authorisation (ZA) is provided for the person (P) by means of the access control server (ZKS) if the location (OPG) of the mobile device (MG) assigned to the person (P) and the location (OPL) of the reading device (LV) match, and a positive authentication of the person (P) on the basis of the identification code (IC) has occurred, wherein the location (OPG) of the mobile device (MG) assigned to the person (P) is provided by two different positioning devices (SAT, IPS), and that the two different positioning devices (SAT, IPS) determine the location (OPG) of the mobile device (MG) assigned to the person (P) in each case on the basis of different technologies or different positioning methods.

Images