WO2001001356A1

WO2001001356A1 - Method for verifying and optionally providing access authorizations

Info

Publication number: WO2001001356A1
Application number: PCT/DE2000/001093
Authority: WO
Inventors: Manfred Bromba; Hans-Peter Weindl
Original assignee: Siemens Aktiengesellschaft
Priority date: 1999-06-23
Filing date: 2000-04-10
Publication date: 2001-01-04

Abstract

A method for verifying and optionally providing access authorizations for a fixed or mobile device (1), comprising several steps. Contact is made between an access authorization carrier (6) and the device (1), whereupon identification signals are transmitted to a monitoring center (5) which is physically separate from the access authorization carrier (6) and the device (1). An access authorization signal is transmitted from the monitoring center (5) to the device (1) according to the content of an access authorization table.

Description

description

Procedure for checking and, if necessary, granting access authorizations

The present invention relates to a method for checking and possibly granting access authorization to a fixed or mobile device. The term access is understood to mean both the permission to enter a certain room or a building and the possibility of using a certain device, for example a computer or a telephone.

Many different methods or devices for controlling are out of daily use

Access authorizations known. In the simplest form, a mobile device, for example a vehicle, has a lock, so that only those persons who have a key matching the lock can use the vehicle. This very simple and commonly used

However, the method has the disadvantage that a person who stole the key or possibly made a copy of it has unlimited access to the vehicle if it is not additionally protected, e.g. located in a locked garage.

Chip cards or SEM cards are often used today as a further development of the simple key. These contain an identification code on a small chip or in a magnetic stripe, which is of a suitable code

Readout device, such as a card reader, is evaluated. Furthermore, biometric security systems are also known, in which at least one biological characteristic of a user is recorded and compared with stored characteristics. The use of a biometric system to control access authorization to a mobile phone is described, for example, in German Patent Application No. 199 05 033.3. at The characteristic recorded is usually a person's fingerprint, but it is also possible, for example, to scan the iris of the eye.

These advanced security procedures primarily prevent unauthorized copies of the access authorization holder, i.e. the chip card or the finger, from being made. As with the use of the simple key, however, there is still a risk that the access authorization holder will be copied or stolen (albeit at great expense) and that a person who owns it will have free access to the device to be secured. Although it would be possible to invalidate the code or the fingerprint contained on the chip card, this is only possible if access to the readout or control device is still possible, since such information cannot otherwise be communicated to it.

A similar problem arises when using the security systems just described for an entrance door to a room or a house. If you want to subsequently declare a certain access authorization holder to be invalid, this is only possible when you are on site, for example to replace the locks or to be able to communicate the new information to the readout device.

It is therefore an object of the present invention to provide a method for checking the access authorization to a stationary or to a mobile device, which guarantees greater security compared to the known methods and can be used more flexibly.

This object is achieved by a method which has the features of claim 1. An essential feature of the method according to the invention is one of the Access authorization holder and the stationary or mobile device physically separate monitoring center, which both information about the status of the

Access authorization holder as well as via the device contains. During the verification process, identification signals are transmitted to the monitoring center both by the access authorization holder and by the stationary or mobile device. On the basis of these identification signals and information stored in an access authorization table, it is then decided in the monitoring center whether a final access authorization is granted or denied. A corresponding control signal is then transmitted to the stationary or mobile device. The use of the physically separate monitoring center offers the advantage that even in the event that personal access to the device and the appropriate access authorization holder is no longer possible, the contents of the access authorization table are changed and the access options are restricted or expanded to fixed or mobile devices can be.

Developments of the invention are the subject of the dependent claims. For example, to increase security, the exchange of control signals between the monitoring center and the access authorization holder and / or the device can be provided in order to reduce the risk of using a copy or forgery. A control signal transmitted from the monitoring center to the access authorization holder can be modified by a coding unit located in the access authorization holder and sent back to the monitoring center in the modified form. In an advantageous development, this modified signal is modified a second time in the monitoring center by a further coding unit, the calculation rules for modifying the signal being selected in this way can be that the twice modified signal again corresponds to the original control signal. In this case, the use of a random signal for the control signal can be provided.

Security can also be increased by additionally providing for the acquisition of biometric data of a user operating the access authorization holder. This can ensure that the person belonging to the access authorization holder actually operates it. The various signals can be transmitted wirelessly between the monitoring center and the device or the access authorization holder.

The invention will be explained in more detail below with reference to the accompanying drawing. Show:

1 shows a flow chart of the method according to the invention;

2 shows an exemplary embodiment of the method for checking the access authorization to a vehicle;

Fig. 3 shows another embodiment of the method for checking the access authorization to a house.

The simplest embodiment of the method consists of steps 100, 101 and 107 to 109 of the flow chart shown in FIG. 1. Basically, the process begins with the establishment of contact between the access authorization holder and the stationary or mobile device. In which

Access authorization bearers are preferably a simple portable device, for example a chip card or a specially designed key. Contact can be made, for example, by a corresponding one from the access authorization holder

Control signal is transmitted to the device. However, to initialize the review process Instead of the wireless connection, a physical connection between the access authorization holder and the device can also be provided, for example inserting or inserting the access authorization holder into a corresponding read-out device that is part of the fixed or mobile device.

In the second step 101, a first or a second identification signal is then transmitted both from the access authorization holder and from the device to the monitoring center, the two identification signals uniquely identifying the access authorization holder and the device. The identification signal of the access authorization bearer can be transmitted either by the latter itself or by means of the device. Such an identification signal can be, for example, a coded data signal or a comparable signal, and the transmission can take place wirelessly or also via a landline telephone. It is entirely possible that both identification signals use the same radio or landline connection.

The monitoring center contains a database with an access authorization table in which both information about the access authorization bearer and about the

Access authorization holder person as well as stored on the stationary or mobile device. If, for example, an access authorization holder or the device (eg the vehicle) has been reported as stolen, this information can be stored in the access authorization table. On the basis of the two identification signals and the information contained in the access authorization table, a decision is then made in step 107 as to whether or not access to the device is permitted with the present access authorization holder. If access is permitted based on the content of the access authorization table, the monitoring center makes a step 108 Access authorization signal transmitted to the device, whereby the access to this is released. If, however, the access authorization holder is reported as stolen or if there are other reasons that prevent the access authorization from being issued, access to the device is denied in step 109.

Since, in step 101 of the method, the first identification signal characterizing the access authorization bearer must be unambiguous, it cannot be ruled out that this signal is detected by a third party and then simulated. In order to avoid this possibility and thus further increase the security of the method, steps 102 to 106 can be used to extend the method. This extension provides for a further review of the access authorization holder.

After the two identification signals have been transmitted to the monitoring center in step 101, the monitoring center sends a control signal to the access authorization holder in step 102. This contains a coding unit which modifies the control signal in the subsequent step 103. The signal modified in this way is then sent back to the in step 104

Monitoring center sent. In step 105 there is a second modification by a further coding unit which is part of the monitoring center. The monitoring center assigns a separate coding unit or calculation rule for each access authorization holder

Modify the signal to, the calculation rule in the coding unit of the access authorization holder can be (and preferably is) different from the calculation rule of the coding unit of the monitoring center. The twice modified control signal is then evaluated in step 106. In a particularly advantageous embodiment, it can be provided as a condition for a positive result of the evaluation that the end signal, ie the twice modified signal, corresponds to the original control signal emitted by the monitoring center. In this case, it would be possible to use any signal, for example a random signal, as a control signal, so that it is difficult or almost impossible to determine the coding regulations of the access authorization holder by monitoring the data exchange between the monitoring center and the access authorization holder and thus to falsify it ,

If the result of the query in step 106 is negative, access to the device is denied in advance regardless of the content of the access authorization table, since it must be assumed that the identification signal of the access authorization holder has been falsified. However, if query 106 yields a positive result, the method continues with step 107, that is, according to FIG

Information in the access authorization table decides whether access is allowed or denied.

A first application example of the method according to the invention is shown in FIG. 2. In this example, the access authorization to a vehicle 1 is to be checked. A chip card 2 should initially be provided as the access authorization carrier, the vehicle 1 having a suitable card reader 3. The first step 100 of the method, that is to say the establishment of contact between the chip card 2 and the vehicle 1, takes place in this example in that the chip card 2 is inserted into the card reader 3. The second identification signal for identifying the vehicle 1 is then transmitted via the antenna 4 of the vehicle 1 to a remote monitoring center 5. In order to keep the size and the technological complexity of the chip card 2 as low as possible, the first is transmitted Identification signal of the chip card 2 in that it is read out by the card reader 3 and is also transmitted to the monitoring center 5 via the antenna 4 of the vehicle. In this case, both the vehicle 1 and the chip card 2 use the same radio connection to the monitoring center 5. In the same way, the vehicle 1 acts as an intermediate station during the exchange of the control signals in accordance with steps 102 to 105 of the flow chart ms in FIG. 1.

If the chip card 2 has actually been verified by the exchange of the control signals, it is then decided in the monitoring center 5 whether the vehicle 1 should be activated. For this purpose, the chip card 2 must "fit" to the vehicle 1 in accordance with the access authorization table of the monitoring center 5, and both the chip card 2 and the vehicle 1 must not be reported as stolen. It would also be conceivable that the access authorization table contains further information about the vehicle 1 and the holder of the chip card 2.

For example, it can be known in the monitoring center 5 that the holder of the chip card 2 is temporarily or permanently not authorized to drive a vehicle, or that no taxes or insurance fees have been paid for the vehicle 1. In this case, access to the vehicle 1 can be denied even if the chip card 2 should be valid.

If the position of the vehicle 1 is known (for example by means of a navigation or GPS system), the authorization can also be made dependent on the current location of the vehicle 1. As a rule, it can be determined solely on the basis of the data transmission with the aid of the antenna 4 of the vehicle 1 to the monitoring center 5 in which mobile radio cell the vehicle 1 is currently located. Thus, this method could also be used by vehicle rental companies are to be checked whether the vehicle 1 is in an area that is valid according to the rental agreement or not. If it is determined that the vehicle 1 is outside the permissible area, further access to it can be prevented.

The security against forgery of the chip card 2 can be increased in that it has a sensor for detecting the fingerprint of the user. At the same time, chip card 2 also contains stored cards in this case

Information about the legitimate cardholder's fingerprint. In this way, counterfeiting of the access authorization holder can almost be ruled out.

Instead of physical contact between the

Access authorization holders and the device, in this case the insertion of the chip card 2 into the card reader 3 of the vehicle 1, can also be made to initiate the checking process wirelessly. For example, the use of a would be conceivable

Mobile phone 6, which forwards the required signals to the antenna 1 of the vehicle 1. In this case, the identification and control signals can then be transmitted between the mobile telephone 6 and the monitoring center 5 separately from the radio link between the vehicle 1 and the monitoring center 5. In this case, too, it can be provided that the mobile telephone 6 has a sensor for biometric identification or that a pin code is required for proper functioning.

Should the vehicle 1 be in a closed space, for example in an underground car park, at the beginning of the checking process, it cannot be ruled out that a radio connection between the monitoring center 5 and the vehicle 1 and / or the cell phone 6 will not be established. In this case it can be provided that the vehicle 1 detects the identification signal of the chip card 2 or the mobile telephone 6 and checks whether the use of the vehicle 1 with this access authorization holder is at least in principle permitted. If this is the case, temporary access to the vehicle 1 can be made possible, so that it can at least be started and removed from the garage. It can then be agreed that after the specified time has elapsed or at the first possible point in time at which a connection is established between the vehicle 1 and the monitoring center 5, it is checked whether the information available to the monitoring center 5 for further use of the vehicle 1 conflict. If this is the case or if a connection to the monitoring center was still not possible, it can be provided that the vehicle deactivates itself.

The second application example shown in FIG. 3 relates to checking the access authorization to a building 7. Here, too, is the use of a chip card 2 and one

Card reader 3 is provided, which is attached to the outside of the building 7 near the entrance door 8. The transmission of the identification, control and control signals takes place here through a telephone 9 located in the building 7 and the landline connection 10 to the monitoring center 5. Here, too, both the access authorization bearer, ie the chip card 2 and the device - the building 7 - use the same Connection to the monitoring center 5. The transmission of the various signals and the verification of the chip card 2 and its user is carried out in the same way as in the example shown above with the vehicle 1.

Here too, the method according to the invention offers the possibility of changing information and data about the access authorization of a large number of people in a simple and quick manner. Furthermore is natural It can be determined at any time which person had access to Building 7 at what time.

Claims

claims

A method for checking and, if necessary, granting access authorization to a stationary or mobile device, comprising the following steps: a) establishing contact between an access authorization holder (6) and the fixed or mobile device (1); b) transmission of a first identification signal characterizing the access authorization carrier (6) to a monitoring center (5) physically separate from the access authorization carrier (6) and from the stationary or mobile device (1); c) transmission of the stationary or mobile device (1) characterizing the second identification signal to the

Monitoring center (5); d) comparison of the two identification signals with an access authorization table in the monitoring center (5); e) transmission of an access authorization signal from the monitoring center (5) to the stationary or mobile

Device (1) if access is authorized after the result of the comparison in step d).

2. The method according to claim 1, characterized in that before the comparison in step d) for checking the access authorization bearer (6) from the monitoring center (5) a control signal is transmitted to this that the control signal by a coding unit located in the access authorization bearer (6) modified, in the modified form sent back to the monitoring center (5) and evaluated by the latter, the access authorization signal being transmitted independently of the comparison in step d) only if the result of the evaluation is positive.

3. The method according to claim 2, characterized in that the modified control signal in the monitoring center (5) is modified by a further coding unit for evaluation.

4. The method according to claim 3, d a d u r c h g e k e n n z e i c h n e t that the control signal sent by the monitoring center (5) is a random signal.

5. The method of claim 3 or 4, so that the result of the evaluation is positive if the control signal modified twice by the coding unit of the access authorization holder (6) and by the coding unit of the monitoring center (5) again corresponds to the original control signal.

6. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e that the transmission of at least one of the signals is wireless.

7. The method according to any one of the preceding claims, characterized in that the access authorization bearer (6) has a detection device for biometric identification of a user operating the access authorization bearer, step a) of the method being initiated only when the biometric data recorded is included in the access authorization bearer ( 6) Stored data match.

8. The method according to claim 7, characterized in that a fingerprint of the user is recorded for biometric identification.

9. The method according to any one of the preceding claims, d a d u r c h g e k e n n z e i c h n e t that a time-limited access to the fixed or mobile device (1) is made possible if after the

Establishing contact between the access authorization holder (6) and the stationary or mobile device (1) in step a), there is no connection between the monitoring center (5) and the access authorization holder (6) or the stationary or mobile device (1).