METHOD FOR CONTROLLING A DEVICE REQUIRING USER-RELATED PERMISSIONS VIA A MOBILE TERMINAL

• US 20160028727A1
• Filed: 04/29/2015
• Published: 01/28/2016
• Est. Priority Date: 07/25/2014
• Status: Active Grant

• Current Assignee: SKIDATA AG (Thales SA)
• Original Assignee: SKIDATA AG (Thales SA)
• Inventors: WENNINGER, CHRISTIAN, DUCHAC, BERND
• Granted Patent: US 9,648,017 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G07C 9/00571 operated by interacting with a central unit
• CPC Class Codes: G07C 9/38 with central registration
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

In a method for controlling a device requiring user-related permissions via a mobile terminal using a local data connection between the mobile terminal and the device to be controlled, the control commands requiring user-related permissions for the device to be controlled are generated by means of an interaction between the mobile device and an authentication server and/or a device management server and are transferred to the device to be controlled from the authentication and/or device management server via the mobile terminal. The control commands requiring user-related permissions for the device to be controlled are received by the mobile terminal and are thereafter transferred to the device to be controlled for the purpose of controlling the same and are not stored in the mobile terminal. The control commands received by the device to be controlled are not verified as to the permission of the user to utilize these control commands.

Claims

1. A method for controlling a device requiring user-related permissions via a mobile terminal using a local data connection between the mobile terminal and the device to be controlled, wherein the control commands requiring user-related permissions for the device to be controlled are generated by means of an interaction between the mobile terminal and at least one of an authentication server and a device management server and are transferred to the device to be controlled from said at least one authentication server and device management server via the mobile terminal, the improvement wherein the control commands requiring user-related permissions for the device to be controlled are received by the mobile terminal and are thereafter transferred to the device to be controlled for the purpose of controlling the same and are not stored in the mobile terminal, and wherein the control commands received by the device to be controlled are not verified as to the permission of the user to utilize the control commands.

2. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 1, wherein the local data connection between the mobile terminal and the device to be controlled is established via a Bluetooth low energy (“

BLE”

) standard.

3. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 2, wherein a control command can be generated, said method comprising the following steps:

opening a software app by the user on a mobile terminal;

carrying out a registration or login of the user using a connection between the mobile terminal and an authentication server wherein, after carrying out the login or registration, a user session ID is transmitted from the authentication server to the mobile terminal;

selecting a device to be controlled by the user via the mobile terminal, wherein in the course of a BLE interaction between the mobile terminal and a BLE module of the device to be controlled, a broadcast signal containing the hardware ID of the device to be controlled is transmitted from the BLE module to the mobile terminal;

establishing a connection between the mobile terminal and a device management server, wherein the status of the device to be controlled, which can be identified by means of a hardware ID, is requested, and transmitting a signal that indicates the controllability of the device to be controlled via the mobile device, from the device management server to the mobile terminal;

establishing a BLE data connection between the mobile terminal and the device to be controlled via the BLE module and a micro-controller of the device to be controlled, wherein in a next step the micro-controller signs a data string with a public key of the device management server and transmits it to the mobile terminal;

transmitting the signed data string together with the user session ID and the hardware ID of the device to be controlled to the device management serve, wherein the control command is requested;

verifying the user session ID of the device management server by means of an interaction h the authentication server and if the user session ID is valid requesting a data string response from the encryption module;

verifying by the encryption module of the data string signed by the micro-controller by means of a private key of the device management server and generating a data string response containing the control command, which together with the received data string is signed by the encryption module using a public key of the micro-controller;

transferring the signed data string response together with the signed contained data string to the device management server, wherein thereafter the signed data string response together with the signed contained data string is routed via a connection between the mobile terminal and the device management server, the mobile terminal and the BLE data connection between the mobile terminal and the micro-controller without storage in the mobile terminal to the micro-controller;

verifying the received signed data string response and the returned data string from the micro-controller by means of a private key and after the verification has been carried out, transmission of the control command for execution to the device to be controlled; and

executing the control command and transmitting status information via the BLE data connection between the mobile terminal and the device to be controlled via the BLE module, the mobile terminal and a connection between the mobile terminal and the device management server to the device management server.

4. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 2, wherein a plurality of control commands can be generated, said method comprising the following steps:

opening a software app by the user on a mobile terminal;

carrying out a registration or login of the user using a connection between the mobile terminal and an authentication server, wherein after carrying out the login or registration, a user session ID is transmitted from the authentication server to the mobile terminal;

selecting a device to be controlled by the user via the mobile terminal, wherein in the course of a BLE interaction between the mobile terminal and a BLE module of the device to be controlled, a broadcasting signal containing the hardware ID of the device to be controlled is transmitted from the BLE module to the mobile terminal;

establishing a connection between the mobile terminal and a device management server, wherein the status of the device to be controlled, which can be identified by means of a hardware ID, is requested, and transmitting a signal that indicates the controllability of the device to be controlled via the mobile device and additionally displays the possible control commands (“

command list”

), from the device management server to the mobile terminal;

the user selecting the desired control command to be generated from the plurality of possible control commands via the mobile terminal, wherein this information is sent from the mobile terminal to the device management server, which confirms the selection in a next step;

storing the selected control command in the device management server and associating the selected control command of the hardware ID of the device;

establishing a BLE data connection between the mobile terminal and the device to be controlled via the BLE module and a micro-controller of the device to be controlled, wherein in a next step the micro-controller signs a data string with a public key of the device management server and transmits it to the mobile terminal;

transmitting the signed data string together with the user session ID and the hardware ID of the device to be controlled to the device management server, wherein the control command is requested;

verifying the user session ID of the device management server by means of an interaction with the authentication server and if the user session ID is valid requesting a data string response that contains or corresponds to the desired selected control command from the encryption module;

verifying by the encryption module of the data string signed by the micro-controller by means of a private key of the device management server and generating a data string response containing the control command, which together with the received data string is signed by the encryption module using a public key of the micro-controller;

transferring the signed data string response together with the signed contained data string to the device management server, wherein thereafter the signed data string response together with the signed contained data string is routed via a connection between the mobile terminal and the device management server, the mobile terminal and the BLE data connection between the mobile terminal and the micro-controller without storage in the mobile terminal to the micro-controller;

verifying the received signed data string response and the returned data string from the micro-controller by means of a private key and after the verification has been carried out, transmission of the control command for execution to the device to be controlled; and

executing the control command and transmitting status information via the BLE data connection between the mobile terminal and the device to be controlled via the BLE module, the mobile terminal and a connection between the mobile terminal and the device management server to the device management server.

5. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 3, wherein the connection between the mobile terminal and the device management server is an Internet-based connection.

6. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 4, wherein the connection between the mobile terminal and the device management server is an Internet-based connection.

7. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 1, wherein the device to be controlled is at least one of a lock device for an item selected from the group consisting of a door, a bicycle depot, a lock box, a cabinet, a ski lock and a locker, and an access control device for people and an access control device for a vending machine for a plurality of specific goods.

8. The method for controlling a device requiring user-related permissions via a mobile terminal as defined in claim 1, wherein the local data connection between the mobile terminal and the device to be controlled is established via a known prior art standard for wireless or aired data communication and wherein, if no broadcasting signal is available, the hardware ID of the device to be controlled is requested actively by the mobile terminal.