Controlling access to a location

• US 10,181,231 B2
• Filed: 02/18/2014
• Issued: 01/15/2019
• Est. Priority Date: 02/18/2014
• Status: Active Grant

• Current Assignee: Bekey A/s (North Media A/S)
• Original Assignee: Bekey A/s (North Media A/S)
• Inventors: Kristensen, Torben, Lorenzen, Luis Rodas
• Primary Examiner(s): Pendleton, Dionne H
• Application Number:
  US15/117,586
• Publication Number:
  US 20160358397A1
• Time in Patent Office: 1,792 Days
• CPC Class Codes: G07C 2009/00412 the transmitted data signal being encrypted
• CPC Class Codes: G07C 2009/00769 with data transmission performed by wireless means
• CPC Class Codes: G07C 2009/00793 by Hertzian waves
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00571 operated by interacting with a central unit
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0471 Key exchange

Abstract

A method of controlling access to a location secured by a lock mechanism. An access control management system (ACMS) administrates electronic keys for multiple locations and users carrying mobile units. A lock mechanism controls the lock mechanism at the location. Each of data records associated with lock control units includes key generation data for generating an electronic key for a corresponding lock control unit. A generated key is communicated from the ACMS to the user mobile unit. The key indicates an access right to the location and has an associated lock control unit identifier. The key is communicated from the user mobile unit to the lock control unit at the location, which authenticates the key and, subject to successful authentication of the key, operates the lock mechanism. The key includes a data item cryptographically protected between the ACMS and the lock control unit using a cryptographic key unknown to the user mobile unit.

Claims

1. A method of controlling access to a location, the location being secured by a lock mechanism, the system comprising an access control management system adapted to administrate electronic keys for a plurality of locations and a plurality of users, a user mobile unit to be carried by a user, and a lock control unit operationally coupled to the lock mechanism at said location and adapted to control the lock mechanism, the method comprising:

storing, by the access control management system, a plurality of data records associated with respective lock control units, each data record comprising key generation data for generating an electronic key for a corresponding lock control unit;

communicating a generated electronic key from the access control management system to the user mobile unit, the electronic key being indicative of a predetermined access right to said location, the electronic key having associated with it a lock control unit identifier of the lock control unit at said location;

communicating the electronic key from the user mobile unit to the lock control unit at said location;

authenticating, by the lock control unit, the electronic key and, subject to successful authentication of the electronic key, operating the lock mechanism;

wherein the electronic key comprises a data item cryptographically protected between the access control management system and the lock control unit using a first cryptographic key unknown to the user mobile unit and wherein communicating the electronic key from the user mobile unit to the lock control unit at said location further comprises cryptographically protecting the electronic key using a second cryptographic key.

2. A method according to claim 1, wherein communicating the electronic key from the user mobile unit to the lock control unit comprises:

detecting, by the user mobile unit, one or more lock control units communicating via a wireless communications channel in a proximity of the user mobile unit;

identifying, based on the lock control unit identifier, the lock control unit associated with the location.

3. A method according to claim 2, wherein detecting one or more lock control units communicating via the wireless communications channel in a proximity of the user mobile unit comprises detecting all electronic devices communicating via the wireless communications channel within a communication range of the user mobile unit, and, for each detected device, determining whether the detected device is a lock control unit.

4. A method according to claim 2, wherein the data item comprises a validity period of the electronic key, and wherein authenticating the electronic key comprises obtaining, by the lock control unit, a current time and operating the lock mechanism subject to successful authentication of the electronic key and conditioned on the obtained current time falling within the validity period.

5. A method according to claim 3, wherein the electronic key comprises an operational parameter causing the lock control unit to operate the lock mechanism using the operational parameter.

6. A method according to claim 1, wherein the data item comprises a validity period of the electronic key, and wherein authenticating the electronic key comprises obtaining, by the lock control unit, a current time and operating the lock mechanism subject to successful authentication of the electronic key and conditioned on the obtained current time falling within the validity period.

7. A method according to claim 1, wherein the electronic key comprises an operational parameter causing the lock control unit to operate the lock mechanism using the operational parameter.

8. A method according to claim 7, wherein the electronic key comprises a duration parameter causing the lock control unit to keep the lock mechanism activated for a period of time specified by the duration parameter.

9. A method according to claim 8, wherein the electronic key comprises a delay parameter causing the lock control unit to delay operation of the lock mechanism by a period of time specified by the delay parameter.

10. A method according to claim 8, wherein the electronic key comprises a repetition parameter causing the lock control unit to repeat operation of the lock mechanism a number of times specified by the repetition parameter.

11. A method according to claim 7, wherein the electronic key comprises a delay parameter causing the lock control unit to delay operation of the lock mechanism by a period of time specified by the delay parameter.

12. A method according to claim 11, wherein the electronic key comprises a repetition interval parameter causing the lock control unit to repeat operation of the lock mechanism at a time interval specified by the repetition interval parameter.

13. A method according to claim 7, wherein the electronic key comprises a repetition parameter causing the lock control unit to repeat operation of the lock mechanism a number of times specified by the repetition parameter.

14. A method according to claim 7, wherein the electronic key comprises a repetition interval parameter causing the lock control unit to repeat operation of the lock mechanism at a time interval specified by the repetition interval parameter.

15. A method according to claim 1, wherein communicating the electronic key from the user mobile unit to the lock control unit comprises verifying, by the user mobile unit, the authenticity of the lock control unit based on the second cryptographic key and/or encrypting the communication between the user mobile unit and the lock control unit using said second cryptographic key.

16. A method according to claim 1, wherein communicating the electronic key from the access control management system to the user mobile unit comprises, authenticating, by the access control management system, a user of the user mobile unit.

17. A method according to claim 1, further comprising, receiving, by the user mobile unit, a message from the lock control unit indicative of at least one operational parameter of the lock control unit;

and sending a message indicative of the received operational parameter to the access control management system.

18. An access control management system for controlling access to a plurality of locations, each location being secured by a respective lock mechanism, each lock mechanism being controlled by a lock control unit, the lock control unit having associated with it a lock control unit identifier, the lock control unit comprising means for wireless communication via a wireless communications channel with a user mobile unit, and adapted to receive an electronic key from a user mobile unit, to verify a received electronic key and, subject to successful verification, to activate the lock mechanism, the access control management system being configured to send a message to a user mobile unit, the user mobile unit comprising means for wireless communication via the wireless communications channel with the lock control unit, the message comprising an electronic key, wherein at least a data item comprised in the electronic key is cryptographically protected between the access control management system and the lock control unit using a first cryptographic key unknown to the use mobile unit and wherein communication of the electronic key from the user mobile unit to the lock control unit is cryptographically protected using a second cryptographic key.

19. A lock control unit operationally connectable to a lock mechanism and adapted to control the lock mechanism for securing a location, the lock control unit having associated with it a lock control unit identifier and a key verification data item allowing verification of a data item cryptographically protected between an access control management system for distributing electronic keys to user mobile units and the lock control unit, and the lock control unit comprising a processing unit and first wireless communications means adapted to communicate with wireless communication means of the user mobile unit, the lock control unit being configured to receive an electronic key from a user mobile unit, to verify the received electronic key based on a cryptographic key stored in a memory of the lock control unit and, subject to successful verification, to activate the lock mechanism, wherein the electronic key comprises a data item that is cryptographically protected between the access control management system and the lock control unit using first cryptographic key unknown to the user mobile unit and wherein communication of the electronic key from the user mobile unit to the lock control unit is cryptographically protected using a second cryptographic key.