GB2362188A - Security system for lockable enclosures - Google Patents

Abstract

A security system for a home delivery service comprises a plurality of lockable enclosures each having a lock with a unique secret release code stored in a non-volatile memory, means for entering a release request signal including the secret release code into the lock, the release request signal including other data by which the lock can verify the authenticity of the release request signal before acting to release the lock without requiring any feedback from the lock to an interface unit (by which the lock release request signal is transferred to the lock), or to a central monitoring station. Each authorised user is provided with an interface unit which is programmed to generate a lock-release code which, once used, cannot be used again to re-open the lock.

Description

2362188 A SECURITY SYSTEM The present invention relates generally to a

security system, and particularly to a security system suitable for use in association with home delivery services.

With the increasing use of electronic communications for commercial transactions such as retail purchases, there is an increasing need for delivery services to transfer purchases made from a remote location to a delivery address. However, with such transactions delivery times and dates cannot be predicted and there is, therefore, a strong possibility that upon arrival with goods previously ordered by a householder, there will be no one present at the delivery address at that time to take delivery. Since the goods ordered may be of significant value it is not appropriate for them to be left outside awaiting return of the householder, nor is it always possible to leave the goods with a neighbour.

It is proposed, consequently, that premises, especially domestic premises, should be provided with a security enclosure into which goods may be placed if delivered at a time when the premises are unoccupied, with a secure locking mechanism which ensures that the goods are retained securely against theft during the interval between delivery and return of a responsible or authorised person to the premises. Although such an enclosure may be left open, to be closed and locked by the person making the delivery, and requiring a key for subsequent release of the lock to open the enclosure, this does not accommodate the possibility that more than one delivery to a given address may be made on the same day, or at least before the householder or a 2 representative returns to the premises. In such circumstances, the subsequent arrival of further goods would be frustrated by the fact that the enclosure is already locked and containing goods previously delivered. Of course, the term "enclosure" does not necessarily means a special purpose structure and for the purposes of this description the term is to be understood to include such existing enclosures or may be adapted to the purpose, for example (but without limitation) pouches, garages, sheds, hallways or other such enclosed spaces with a lockable access door or hatch.

The present invention proposes a system by which a lock may be released more than once during a given time period to enable a plurality of deliveries to be made over a period of time. Security is maintained by identifying the person or persons authorised to open the lock so that an audit trail of users can if required be maintained to ensure security for previously-delivered goods upon subsequent release of the lock to allow further deliveries. As an alternative, of course, an enclosure with several compartments may be contemplated, but in view of the unpredictable nature of goods delivered, particularly their size and dimensions, it is presently considered impractical to limit the overall size of the enclosure by partitioning it into smaller compartments.

Lock systems which allow access to a plurality of potential users are known, for example, from the applicant's earlier European Patent 0 469 932, which describes a security lock for a closure member, having a memory for storing a release code, electronic signal receiving means for receiving a code signal from a portable lock releasing device; and electronic signal processing means including means for comparing the code signal received by the said electronic signal receiving means with 3 the release code stored in the memory, characterised in that the said portable lock releasing device includes a signal generating device having a key which can be operated by the user selectively to generate an input information signal determined solely by the operation of the key of the device by the user, and signal input means for transferring the signal generated by the signal generating devices to the signal receiving means for comparison with the release code stored in the memory, the signal generating device being operable selectively to generate other input locks for comparison with their respective release codes for enabling release thereof.

The lock releasing device forms part of the lock (indeed it may be a solenoid which unlocks the movement of a bolt) and may be releasably connected to the lock by a plug and socket connection. This earlier patent of the applicant also discloses the concept, especially useful in case of domestic security enclosure, of utilising the power from a hand-held unit connectable to the lock to drive the lock release. The is lock itself thus requires a separate source of power, but in the other had has no visible or manually accessible knob or handle for releasing the lock. It is thus more secure against vandalisation or corruption.

Another approach, providing remote security installations, is known from the applicant's own earlier British Patent 2 262 640 which describes a security installation comprising a closure member which can be opened from a closed position, and a lock for physically locking the closure member in its closed position, said lock being of a type which is arranged to receive release signals and which is enabled for unlocking by those signals when the lock recognises the signals as representing a release code 4 known to the lock, the security installation further comprising: first radio communication means for transmitting a request to a remote station that said lock be enabled for unlocking, second radio communication means for receiving release signals transmitted by said remote station in response to said request, and transfer means for transferring the release signal from the second communication means to said lock; the transfer means being such as to keep from any person present at said security installation, the identity of the release signal corresponding to said release code otherwise than for servicing the current request..

This enables a central control station to supervise the progress of a delivery/collection ram and to restrict the issue of access codes to requests which are judged to be legitimate. The release signals may be encrypted and various levels of security, including the provision of a sequence number which is changed for successive unlockings of the lock to ensure that the release signals which enable unlocking of the lock differ for each unlocking.

Another known remote locking system comprises a security lock suitable for an automatic teller-machine (ATM) which may require to be visited for refilling or servicing purposes, by one or more authorised operators. In view of the large sums of money involved, a very high degree of security is required, including means by which the lock generates a signal to ratify the fact that it has been closed after a release operation, which at the same time generates a fresh code which must be used by the next operator in order to gain access to the lock. This requires two-way communication with a remote central station and involves a considerable complexity in the structure of each lock and the communication means between it and the central station. For the purposes for the present invention it is desirable to Provide locks which are as simply and economical as possible, and capable of being operated independently of a power supply and without the need for communications to be established between the lock and a central operating station. Such a system as is described in European Patent 668423 is, therefore, entirely unsuitable for this purpose.

Another high security system for authorising access to a secured location such as the vault of a automated teller machine or the coin box of a pay telephone provides for a call for service or repair of an ATM or other secure device to be reported to a service technician, together with a unique and encoded access message generated for is the particular occasion. The technician may receive this access message by telephone or radio despatch, and this information is encrypted in order to conceal the information. The access message contains a personal identification code identifying that particular technician, the serial number or other unique identifier of the particular portable terminal which has been issued to him or her, and present and future access codes for the secure device all encrypted in the encoded access message. The technician carries a portable terminal and enters the access message along with his or her personal identification number following which the portable terminal verifies the access message was entered both into the correct terminal and by the correct technician. The technician then travels to the location of the ATM or other device 6 requiring service at which he or she connects the portable terminal to the secured device and again enters his or her personal identification number into the terminal in which a further verification check is performed in order to thwart unauthorised access in a situation where the technician may be abducted after having received a service call from the central station so that the portable terminal is loaded with authorising codes. With the portable terminal connected to the secured device, the encoded message is sent to the device in which a computer checks for the presence of correct information identifying the device, the authorising access code and the personal identification number before allowing access to the vault. Again, however, this system requires considerable complexity in the design and structure of the lock in order to effect two-way transmission of information allowing the access codes to be changed from time to time so that a corrupt technician cannot regain access covertly after a authorised access operation, in order to corrupt or steal the contents of the secured location.

is Such a system is, again, not suitable for the system of the present invention which requires the lock to be as simple and economical as possible in order to encourage acquisition of such devices by householders. By contrast the present invention provides a suitable level of security and the ability to authorise access to a secured location by means of a different code on each occasion, without requiring the lock to have highly sophisticated means for changing the authorised access codes after each access operation has taken place, but which nevertheless provides significant security to prevent re-entry even of an authorised user after the user has once gained legitimate access to the location.

7 According to one aspect of the present invention, therefore, a security system for a home delivery service comprising a plurality of lockable enclosures each having a lock with a unique secret release code stored in a non-volatile memory comprises means for entering a release request signal including the secret release code into the lock, the release request signal including other data by which the lock can verify the authenticity of the release request signal before acting to release the lock without requiring any feedback from the lock to an interface unit by which the lock release request signal is transferred to the lock, or to a central monitoring station.

In the system of the present invention each authorised user may be provided with an interface unit which is programmed to generate a lock release code which is one of several which will open the lock, but which, once used, cannot be used again to reopen the lock. In fact, the lock may be provided with timing means to allow a is certain "window" of time during which a given lock release code will be operative, the "window" starting upon first use of the lock release code so that, in practice, a legitimate user may make changes to the deliveries made if an error is detected shortly after having made the authorised opening. Typically, for example, such window may be only a few minutes long so that the operator, having made a delivery and, for 20 example, returning to the delivery van, discovering that the wrong goods had been delivered, would still be in time to make an appropriate exchange before the window closes.

According to an alternative aspect of the present invention there are provided locking 8 means for a security system comprising a bolt releasable (manually or automatically (which includes electrically, pneumatically, hydraulically or other)) upon energisation of bolt release means, means for storing a release code comprising a permanent part which identifies the lock, and means for generating a temporary part which identifies a lock-release event; means for comparing a lock release request signal with the permanent and temporary parts of the release code and operable to issue a release command signal upon detection of correspondence therebetween, and means for changing the temporary part of the lock release code whereby to provide subsequent release of the lock by entry of the lock release signal.

The temporary part of the lock release code may include an "issue" code which is cyclical within the lock and/or periodically reset so that a central station may reissue release codes containing a given temporary "issue" code during subsequent time periods. The time period may conveniently be twenty-four hours although other time periods may be appropriate. The issue codes may be stored, for example, in a shift register reset to zero on a daily basis so that the central station may issue the same issue code, albeit allied with other, different data which uniquely identifies the release event, more than once.

In this way a locking device will have a range of different effectively unpredictable release codes which will cause release of the lock, but which cannot be reused after the above-mentioned time window has elapsed.

In another aspect of the present invention a portable interface unit for a security 9 system comprising a plurality of lockable enclosures each having a respective lock releasable by a release code signal comprising a permanent part identifying the lock itself and a temporary part identifying the lock release event, has means for entering into the interface unit an initiation code received from an external source identifying a lockable enclosure to be released, means for generating from the input initiation code both the permanent and temporary parts of the lock release code signal, and means for transferring or transmitting the lock release code signal to the lock whereby to release the lock.

Such a portable interface unit may comprise no more than a mobile cellular telephone having a screen for display of numerical or text messages received from the central station.

The portable interface unit may, conveniently, be provided with plug and socket connector means by which it can be physically connected to a selected one of plurality of locks in order to transfer the lock release signal to it. The interface unit may itself have a power supply which energises the lock so that each lock requires only a non volatile memory for storing its own unique identification code and does not necessarily have a power supply of sufficient magnitude to energise a bolt-release solenoid. This provides another layer of security since only a low-power battery, sufficient to maintain a clock circuit in operation need be provided on the lock, this battery being too small to generate sufficient power to engersise the solenoid. In this way only possessors of authorised interface unit hand sets can provide both the authorisation signal for comparison with the secret release code and sufficient power to cause release of the bolt if such authorisation code is detected. It is envisaged that it may be possible to produce a portable interface unit of this type by suitable modification of a GSM telephone to add an output signal line by which appropriate output signals (and power if needed) may be transferred to a lock.

The "public" and "secret" parts of the release code need not necessarily appear in the release signal in a predetermined order, but rather may have a detectable form by which the circuit may identify which part of the release code is present, or there may be a part of the signal string which identifies the order in which the parts of the release signal are being delivered at any one time, enabling the lock circuit to route the relevant parts to appropriate comparison means.

The interface unit may not necessarily generate a signal which constitutes the predetermined release code for a lock, but may instead generate a signal having a determinable relationship with such code signals and the relationship itself being identified in another part of the signal code or being one of a plurality of predetermined relationships preliminarily stored in the lock.

The relationships and/or the codes identifying the "public" part of the code, which may be an address, typically a street address, identifying the enclosures to be released, may be transmitted to the interface unit from time to time, or may be loaded at commencement of a working period, either by remote transmission of data or directly by contact with a central station. The user may, therefore, have a plurality of address to travel to known in advance, or may not no more than the next delivery address, 11 requiring to transmit a "delivery made" signal to the central station before receiving the next delivery address and release code.

In a ftirther refinement the interface unit may be provided with geographical position sensitive means, for example using the known GPS system in order to verify its own position before appropriate release codes may be transmitted to it for forming part of the variable or temporary part of the release code. - In such a system the release codes may in fact be transmitted to the interface unit without requiring a specific request. In such a system the handset may have no more than a conventional ten digit keypad, the operator being required only to depress the keys in sequence upon commencement or completion of each delivery. Thus, for example, at the beginning of the day the hand set (which may be or include a modified GSM telephone) and thereby contain its own unique identifying codes) may depress key one in response to which a screen on the handset will display the street address of the first delivery to be made. Upon arrival at this street address the GPS component of the handset automatically transmits a "get code" request to the central station and the display on the screen changes from the street address to a four digit code release request code. The operator then plugs in the handset to the appropriate socket on the enclosure and by keying in this release request code transmits to the lock a (different) release code comprising a secret part (which has been transmitted from the central station and matches the secret part of the code stored in the lock) and a temporary part which is generated, for example, from the time of say, the sequence number issued by the central station and the date, together with other data, which may 12 include a "public" identification code printed or otherwise visible from the enclosure itself The system of the present invention lends itself to a distributed control arrangement and does not require a single centralised controlling authority. For example, there may be a plurality of control stations each issuing codes. Providing each station includes its own identifier in the codes issued there is no need to impose any constraints on them and otherwise identical code sequences can be used without risk of confusion or corruption.

Various embodiments of the present invention will now be more particularly described, by way of example, with reference to the accompanying drawings, in which:

Figure I is a block schematic diagram illustrating the main features of a 15 system formed as a first embodiment of the invention; Figure 2 is a schematic diagram illustrating the hand set and locked enclosure of an alternative embodiment of the invention; and Figure 3 is a farther schematic diagram illustrating another alternative embodiment of the invention.

Referring first to Figure 1 there is shown a schematic diagram illustrating a system for providing access to a plurality of delivery operators identified D 1, D2, D3 etc to a plurality of lockable enclosures identified L 1, L2, L3 etc in a secure manner. It is assumed that, in this example, the customer represented by the telephone symbol C 13 may place orders for the delivery of goods at a plurality of different stores S 1, S2, S3 etc by way of a retail transaction. The financial aspects of the transactions play no part in this invention. Assuming that the transactions have been completed, and it is intended to deliver the goods, the stores S I, S2, S3 transmit to a central security station 12 information containing the address of the lockable enclosures L I, L2, L3 to which the deliveries are intended to be made.

The lockable enclosures may be secure boxes placed at an accessible location outside a building, for example in the garden, or may be built into the building and be accessible through an opening in a wall. In any event the enclosures L I, L2, L3 each have a security lock SL l, SL2, SW each having a unique secret identification code which is stored at the central security station in association with the street address of the lockable enclosures L 1, L2, L3 in a highly secure environment. The stores S 1, S2, S3 are thus never privy to any additional information over and above the delivery is address of the customer C (which may of course itself be coded) and, of course, the necessary financial details to complete the transaction, for example by way of a credit card, in a known way.

Each store S 1, S2, S3 provides the delivery operator D 1, D2, D3 with a respective list of addresses at which it is intended that deliveries be made. These may be in sequence, or grouped in a given area, with the delivery operator having discretion on the order in which deliveries are made depending on the route chosen, traffic conditions encountered etc. Associated with each delivery address is a specific job number allocated by the store for that delivery operator, and the correspondence 14 between delivery address and job number is also transmitted to the central security station at the commencement of each delivery sequence. This may be, for example, at the commencement of each working day or throughout the working day as different delivery operators are loaded with the goods to be delivered and despatched.

The delivery operators may choose, for example, to take the jobs in sequence, and travel therefore to the first address in the list given to them. Each delivery operator is provided with a portable interface units H 1, H2, H3 which has means for remote communication with the central security station. The units H 1, H2, H3 may, for example, be modified GSM telephone handsets able to transmit by cellular radio communication over the existing cellular telephone network available for private and commercial telecommunications traffic. The radio communication may, however, take over a private radio system provided by an operator or owned by the security firm. Whatever the form of the handset it must be capable of remote communication without landline from different geographical addresses. Upon arriving at the first geographical address the operator transmits to the central station a code request, which may be simply transmission of a job number against which the street address has been collocated by a store, for example the store S 1 in transmitting the initial information to the central security station 12. In response to this request the central security station transmits a coded signal CS 1 which includes a secret code embedded in a permanent, non-volatile manner in the lock SL I, together with other data relating to the particular release event. This may be, for example, an "issue" code identifying the lock release event, as well as data such as the date and time. The lock SLI includes a programmable memory having a number of memory locations, for example is between 10 and 100, each of which is identified by a specific issue code. The coded signal CS 1 transmitted to the handset H 1 bears no apparent relation to the secret code in the lock SLI but, upon reception of the signal at the handset a processor incorporated in it operates in accordance with an algorithm (which may be unique to that handset H1) to generate an output release signal RS. In this embodiment the handset H 1 has a plug and socket connection by which it can be connected to the lock SLI so that the release signal RS is transmitted directly into the lock SLI without requiring any separate transmission means. In the lock SL1 the "issue code" is compared with the set of issue codes in the memory IMI and, if that issue code is available will transmit the remaining part of the release code to a comparator at which the secret identity code of the lock is compared with the transmitted secret code. The act of transmitting the signal for comparison disables the issue code from further use, at least until reset, so that the release signal generated by the handset H I cannot be used a second time to release the lock SI, I. Assuming that the secret code matches with that stored in the lock SI, 1 it will release allowing the enclosure L 1 to be opened for delivery of the goods. Thereafter the enclosure is closed and locked, and for additional security, an interlock may be provided which retains the handset H1 plugged into the enclosure whilst the cover or door is open, only allowing release of the handset once the lock is securely closed. Thereafter the same release signal as previously released the lock SI, I will not work again since the "issue code" used on that occasion is no longer available.

Later in the same time period the same sequence of operations may be performed by another delivery operator for example operator D2 utilising handset H2 at delivery 16 enclosure L I. In this case, however, the transmitted code signal CS2 from the central security station, although it will contain the same secret code for lock SL I will now contain, a different issue number. On presenting the handset H2 to the lock SLI, therefore, the transmitted release signal will again be passed by the memory IMI, 5 again cancelling the associated issue code.

Resetting of the issue codes may take place when the householder opens the cover of enclosure Ll, for example utilising a mechanical key or other authorisation device (which could be a fixed or removable keypad) in order to gain access to the goods deposited in the enclosure. Thereafter (assuming it is the same day) the handset H I would reopen the lock SLI if the delivery operator were to present the handset HI thereto, but since the goods have now been removed this does not present a security risk.

After having delivered goods to enclosure L 1 the delivery operator D 1 then travels to the next address, for example of the enclosure L2 and, having arrived, again transmits a code signal request to the central station 12. Upon receipt of this request the central security station 12 issues code signal CS3 which contains the secret code for lock SL2 and an issue number specific thereto. Arrival of signal CS3 also clears from the memory of the handset H 1 the release signal CS 1 so that this handset can no longer be used to open enclosure L 1.

Because the issue codes may be cancelled in any order it does not cause a problem if the delivery operators arrive in a different order than the sequential order of issue 17 codes, because the central security station issues a predetermined unique issue number to each handset in dependence on the information received from the stores S 1, S2, S3. The handsets themselves may each contain a suitable identification program consequent on the identification of the delivery operator Di by the store Si in transmitting the initial information to the central security station 12 so that only that handset can convert the received signals CS1, CS2, CS3 into appropriate release signals for the locks SL 1, SL2, SW. Any inadvertent or corrupt transmission of the code signal CS I, CS2, CS3 to another handset (H2 or H3 for example) will either result in the handset generating no release signal or in such release signal as is generatedbeing incorrect since its own embedded algorithm converts the received code signal CS 1, CS2, CS3 etc into a different code from that required to release the lock SL 1, SL2, SL3 at which the handset H 1, F12, H3 is present. Each lock, therefore, requires only a non-volatile memory storing the lock's secret identity code, a comparator for comparing the input signal with the code stored in the non-volatile is memory, and a register storing the issue codes, and acting as a gate through which the release signal must pass in order to reach the comparator. This offers an intermediate level of security with a very economical lock having a minimum number of components. Resetting of the issue code registers IM I, IM2, IM3 takes place when the owner of the enclosure opens it for removal of the goods delivered so that the same issue codes can be reused on a subsequent occasion. There is no need for the enclosures LI, L2, L3 etc to transmit this information to the central security station if a sufficiently large number of issue codes are included in the register since the central security station can simply cycle through these with the certainty that by the time the last issue code (for example 99) has been used the enclosure L I will certainly 18 have been emptied so that the issue codes zero and one are again available for reuse. Except in the case of the delivery of extremely small articles, it would be highly unlikely that one hundred deliveries could be made to a single enclosure without it becoming impossible for it to contain any more and for this anomalous situation to draw attention to itself either because there is a fault or because the owner may be away or ill and unable to open the enclosure.

An alternative embodiment is illustrated in Figure 2, having a number of additional levels of sophistication to obtain increased security. Referring now to Figure 2 there are schematically shown the essential components of a system similar to that illustrated in Figure 1, and in which the same or corresponding components have been identified with the same alpha numeric references. In this system it is not necessary for the stores S to communicate delivery information to the central security station 12 and these have therefore not been illustrated. It is to be assumed that a customer C has placed orders which are to be fulfilled by delivery of goods to a lockable enclosure LI by a delivery operator provided with an interface unit Hl. In this embodiment the lockable enclosure Ll has, as before, a secret identity code, a solenoid 14 for actuating a bolt 15 to release a closure member 16 and a clock 17 driven by a clock battery 18. In this embodiment the clock battery 18 is sufficient to power the clock but not sufficiently powerful to power the solenoid. The enclosure L I is, therefore, effectively devoid of power, containing only the non-volatile memory NVM1 storing the secret identity code, the comparator 19 for comparing the input signal with the secret identity code, and the register 20 storing the issue codes. In this embodiment, however, the clock is set to issue a reset signal to the register 20 every 19 24 hours so that the issue codes are reset to zero daily regardless of whether the lockable enclosure L l has been emptied of previous deliveries. In this embodiment the register 20 may contain only ten different issue codes.

The interface handset H 1 incorporates a battery 2 1, a lead 22 with a jack plug 23 at the free end, which can be introduced into a socket 24 in the lockable enclosure L 1 to transmit power to the solenoid 14 to energise this if the appropriate signal is issued by the comparator 19. The handset H I also includes a screen 25, a keyboard 26 and a GPS unit 27 as well as a "local" radio communication system, which may again be 10 a GSM telephone 28 or may be some other private radio communication system for communicating with the central security station 12. A processor 29 is linked to the two radio communication systems 27, 28 and the keyboard 26 and screen 25. In operation of this embodiment the delivery operator is provided solely with a is collection of addresses within a given region at which deliveries are to be made. The addresses are not placed in any sequence and there is no job number or other identification code associated with them. The only other information provided to the delivery operator is the relationship between the delivery addresses and the goods to be delivered. The operator is free to plan his or her route depending on traffic 20 conditions or other factors so that the deliveries will not be made in any particular order. Upon arrival at a delivery address the operator will introduce the jack plug 23 into the socket 24 and by use of the keyboard 26 transmit a "code requesC to the central security station 12. The GPS unit 27 acts to provide a location signal identifying the precise location of the handset H1, which is transmitted via the communications unit to the central security station 12. The operator also reads from the enclosure Ll a "public" identity code which may be embossed or otherwise permanently formed on the casing. At the central security station this public identity code and the information from the GPS signal is compared to ensure that they correspond, and if they do a coded signal CS I is transmitted to the communications unit 28 which, includes, in encoded or encrypted form, the secret identity code of the enclosure L I together with an issue code and/or other information specific to the enclosure L L A processor 29 converts the broadcast code signal CS I into a release signal train, decrypting or decoding the secret identity code of the enclosure L I and placing this in a string with the issue code and other data. The other date may include information concerning the order in which the units of information are presented in the signal so that the position of the various components and therefore their identity can be made difficult to identify. It is not possible, therefore, for a corrupt individual to tap into the wire 22 to take a reading of the signal being transmitted to the enclosure L I since the release event in question is the only time in which that signal will release the lock and it is not possible to identify which components are present in any particular part of the signal string to enable the corrupt individual to reassemble a valid release signal. The release signal generated by the handset H I passes first to the register 20 which identifies that part of the release signal containing the issue code, and then passes the signal onto the comparator, cancelling the used issue code in doing so. The comparator compares the signal with the secret identity stored in the non-volatile memory NVMI and, if they compare correctly, issues a signal to the solenoid 14 21 which, powered via the cable 22 leading from the handset power supply, releases the bolt 15 to allow the closure 16 to be opened and the goods delivered. The clock 17 maintains the output comparison from the comparator 19 for a predetermined time period after the correct insertion, during which time closure and opening of the closure 16 can take place more than once to accommodate the possibility that the delivery operator may incorrectly close the closure 16 before having introduced the goods, for example if these are too heavy to hold whilst going through the release procedure and are placed on the ground. If the closure 16 is sprung-loaded shut it may, therefore, happen that the operator might release the closure 16 in order to pick up the goods from the ground, and then, if the closure 16 could not be reopened, would be unable to make the delivery.

Alternatively, however, the clock 30 in the handset H1 may run a time "window" for which the correct release code may be reissued upon depression of an appropriate key on the keyboard 26 for the same purpose. Upon withdrawal of the plug 23 from the socket 24 the signal line circuit is opened triggering erasure of the data in the memory associated with the processor 29 so that the release signal cannot be generated again.

Turning now to Figures 3 and 3a, there is shown another alternative embodiment suitable for use by householders or others having no suitable place to locate a lockable enclosure at their premises. In this embodiment a plurality of lockable enclosures L 1 - LN are provided in a bank at a suitable secure, public location, for example at a garage or service station, railway station, supermarket or other shopping precinct.

22 To be suitable for this purpose the location must have electrical power available, represented by the input P, which enables the bank of secure enclosures Ll-LN to offer special facilities such as refrigeration. The bank of lockers has a keypad KP associated therewith by means of which each individual locker may be addressed and 5 information relating to it entered by a user.

Figure 3a illustrates the main components of a locker Ll, and in this figure those components which fulfil the same or similar functions as corresponding components in the embodiments of Figures 1 and 2 have been identified with the same reference numerals or letters. The locker L I contains a non-volatile memory NVM1 an output of which is connected to a comparator 19 the output from which feeds a solenoid SL I and also a non-volatile audit store 31 the fimction of which will be explained below.

In this embodiment the regoster 20 also includes an identity address which enables input signals from the keypad KP to be transmitted to all the enclosures LI-LN in the bank without requiring separate addressing hardware or software at the keypad. All enclosures L 1 -LN will therefore receive all signals through the line from the keypad, but only that enclosure the address of which matches the address component of the signal will be activated.

In order to verify the functioning of a refrigerated enclosure the temperature sensor DS is provided, this being connected to a sensor circuit 32 which supplies coded signals to the audit store 3 1. As before, a clock 17 is connected to the comparator 19, the register 20 and the audit store 3 1.

23 In use of the security system of Figure 3 a user must first "reserve" a lockable enclosure by entering his identity code in the keypad KP. Payment provisions for this service may be organised via a cash box, credit card recognition circuitry or the like (not illustrated). The precise enclosure allocated upon reservation is not necessarily known to the user, it being sufficient that one enclosure available at the site be reserved for deliveries expected for him. The circuitry associated with the keypad will, however, issue an authorisation code via a display KPI) which the user must record in a secure manner to allow future use for collection of deliveries made to the lockable enclosure reserved at this time.

This information will be stored in the address register 20 together with other data such as the enclosure address or identity, the issue codes and other verification data. When a delivery operator has been given the address of the bank of enclosures L 1 -LN to make a delivery, a suitable authorisation code is displayed in the display panel HSD of the handset HS, which in this case may be an unmodified cellular telephone capable of receiving text messages. By connecting the telephone to the central station 12 and making a "next code" request the operator receives the text message either simultaneously or shortly thereafter, and enters this text message in the keypad KP.

The coded signal, received from the central unit 12, will now include not only the issue code and locker I/D as in the previous embodiments, but also an address of the appropriate enclosure within the bank. This signal is applied to all the enclosures, but only that enclosure for which the address part of the signal matches in the address register 20 will pass the signal onto the comparator 19 where it is compared with the 24 stored signal in the non-volatile memory NVM I and, if correct, causes the generation of an output signal which releases the solenoid SL L The time at which this operation takes place is recorded in the audit store 31 via the clock 17 and at the same time the temperature within the enclosure is also recorded via the temperature sensor TS and sensing circuit 3 1. The suitability of the enclosure to receive frozen goods is therefore verified.

In an alternative embodiment (not shown) the circuit may be designed such that the non-volatile memory NVM 1 also includes or is associated with a processor capable of generating a new I/D code either upon each access to the enclosure Li or upon request. The output from the specific enclosure is displayed on the keypad KP and must be transferred to the central station 12 via the handset HS in order for the operator to verify that the delivery operation has been completed. This system is unchecked, however, in that the ability of the next delivery operator to release the lock securely has not been tested so that even if they have the correct code an error in the circuitry may result in a failure to release the lock. For this purpose an alternative system may be used, in which the entry of the correct ID incorporates a request for the ID code to be changed. This may be encoded in the transmission from the central station 12 so that the operator does not even know that a request to change the lock code has been made. Then, instead of releasing the solenoid SLI when a correct release signal is entered, the lock merely displays the new release code which the operator must enter again into the keypad to effect release. This then verifies that the new release code operates the circuitry and the operator can then transmit it back to the central station 12. In this explanation the term "release code" does not, of course, mean the entire code which releases the lock, but merely a part encrypted to allow public transmission. Because the issue code will be disabled upon closure of the enclosure even the correct entry (or rather re-entry) of the release code will no 5 longer effect release of the lock.

In another, alternative embodiment the keypad KP includes a processor allowing each individual locker Li to be addressed so that the signal is sent from the keypad only to that locker identified by the appropriate keypad entry.

One further level of security is required, that is to ensure against a corrupt operator opening the enclosure and subsequently closing it without placing the goods or all of the goods into the enclosure. For this purpose a system including wrapping and packaging the goods for delivery with a bar code label may be adopted. The handset HS is then provided with a bar code reader BR which will function only in association with the closed locker or enclosure, for example through a suitable window or access port. The protocol may then require that the barcode be read through the closed door before a new release code is issued. Alternatively, of course, the enclosures themselves may be provided with barcode readers and the goods wrapped with a mobile tag which can be positioned against the bar code reader of the enclosure to remain there as the door is closed. Any failure of the bar code reader to establish the presence of the goods by reading the bar code on the label as the door is shut will result in the door not locking so that, if the problem is merely inaccurate positioning, the operator may gain access to the goods to reposition them without being locked out 26 from the enclosure. The fact that the enclosure door will not lock in the absence of verification of the presence of the goods is not a security problem and, indeed, if the goods are not properly delivered the presence of a door swinging open will naturally draw attention to the security lockers from passers-by enabling the failed delivery to be identified more rapidly. This will also be identified at the central station since the confinnation of door closure after a lock release request should take place within a certain time window failing which an alarm may be operated to institute security procedures.

Finally, as illustrated in broken outline in Figure 3, the bank of locks Li may be provided with its own radio transmission system RT for direct communication with the central station enabling a lock release request from a handset to be answered by a signal transmitted directly to the receiver RT rather than to the handset HS, for example using a different signal frequency or, as in cellular telephones, using an 15 identification number to access the equipment.

Claims (17)

27 CLAIMS

1. Locking means for a security system comprising a bolt releasable upon energisation of bolt release means, means for storing a release code comprising a permanent part which identifies the lock, and means for generating a temporary part which identifies a lock-release event; means for comparing a lock release request signal with the permanent and temporary parts of the release code and operable to issue a release command signal upon detection of correspondence therebetween, and means for changing the temporary part of the lock release code whereby to provide 10 subsequent release of the lock by entry of the lock release signal.

2. Locking means as claimed in Claim 1, in which the temporary part of the lock release code includes an issue code which is cylical within the lock and/or periodically re-set so that a central station may reissue release codes containing the 15 given temporary issue code during subsequent time periods.

3. Locking means as claimed in Claim I or Claim 2, in which the issue codes are stored in a shift register re-set to zero periodically, for example on a daily basis, so that the central station may issue the same issue code together with other data which uniquely identifies the release event.

4. A portable interface unit for a security system comprising a plurality of lockable enclosures each having a respective lock releasable by a release code signal comprising a permanent part identifying the lock itself and a temporary part 28 identifying the lock-release event, including means for entering into the interface unit an initiation code received from an external source identifying a lockable enclosure to be released, means for generating from the input initiation code both the permanent and temporary parts of the lock release code signal, and means for transferring or 5 transmitting the lock release code signal to the lock whereby to release the lock.

5. A portable interface unit as claimed in Claim 4 in the form of a modified mobile cellular telephone having a screen for display of numerical or text messages received from the central station.

6. A portable interface unit as claimed in Claim 4 or Claim 5, further provided with plug and socket connector means by which it can be physically connected to a selected one of a plurality of locks in order to transfer a lock release signal thereto.

7. A portable interface unit as claimed in any of Claims 4, 5 or 6, including a power supply which energises the lock so that each lock requires only a non-volatile memory for storing its own unique identification code.

8. A security system comprising a plurality of lockable enclosures each having a lock with a release code stored in a non-volatile memory, interface means for entering a release request signal to the lock, the release request signal including the release code and other data by which the lock can verify the authenticity of the release request signal before acting to release the lock and means for changing at least part of the said other data after receipt of a valid lock release signal.

29

9. A system as claimed in Claim 8, in which the interface unit is programmed to generate a lock release signal including a temporary code which is one of several which will open the lock, but which, once used, cannot be used again to re-open the 5 lock.

10. A system as claimed in Claim 8 or Claim 9, in which the lock is provided with timing means operable to provide a time window during which a given lock release code will be operative, the window starting upon first use of the lock release code.

11. A system, interface unit or lock as claimed in any preceding claim, in which the public and secret parts of the release code do not appear in the release signal in a predetermined order, but have a detectable form by which the lock circuit may identify which part of the release code is present.

12. A system, interface unit or lock as claimed in any preceding claim, in which there is a part of the signal string which identifies the order in which the parts of the release signal are to be delivered at any one time, enabling the lock circuit to route the relevant part to appropriate comparison means.

13. A system, interface unit or lock as claimed in any preceding claim in which the interface unit is operable to generate a signal having a determinable relationship with code signals which constitute the predetermined release code for a lock, the relationship being identified in another part of the signal code or being one of a plurality of predetermined relationships preliminarily stored in the lock.

14. A system, interface unit or lock as claimed in Claim 13, in which the relationships and/or the codes identifying the public parts of the code (which may be unaddress identifying the enclosure to be released, are transmittable to the interface unit from time to time or are loaded commencement of a working period, either by remote transmission of data or directly by contact with a central station.

15. A system, interface unit or lock as claimed in any preceding claim, in which the interface unit is provided with geographical position-sensitive means, such as the GPS system, in order to verify its own position before appropriate release codes are transmitted to it for forming part of the variable or temporary part of the release code.

16. A system, interface unit or lock as claimed in any preceding claim, in which the release codes are transmitted to the interface unit without requiring a specific request.

17. A system, interface unit or lock substantially as hereinbefore described, with reference to and as shown in the accompanying drawings.