Access control system, access control method and devices suitable therefor

• US 7,196,610 B2
• Filed: 01/23/2003
• Issued: 03/27/2007
• Est. Priority Date: 02/13/2002
• Status: Expired due to Fees

• Current Assignee: Zeit AG (Constellation Software Incorporated)
• Original Assignee: Swisscom AG (Government of Switzerland)
• Inventors: Straumann, Hugo, Baessler, Felix
• Primary Examiner(s): Zimmerman; Brian
• Assistant Examiner(s): BROWN, VERNAL U
• Application Number:
  US10/349,097
• Publication Number:
  US 20030151493A1
• Time in Patent Office: 1,524 Days
• Field of Search: 340/5.61, 340/825.72, 340/825.69, 340/5.1, 340/5.2, 340/5.6, 340/5.8, 340/5.33, 340/5.5, 340/5.64, 340/10.1, 340/10.42
• US Class Current: 340/5.61
• CPC Class Codes: G07C 2009/00793 by Hertzian waves
• CPC Class Codes: G07C 2009/00865 remotely by wireless communication
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00857 where the code of the data carrier can be programmed
• CPC Class Codes: G07C 9/21 having a variable access code
• CPC Class Codes: G07C 9/27 with central registration

Abstract

An access control system comprises a plurality of access control devices in each of which is stored an access code. Specific access codes and access rights for a plurality of access control devices are transmitted from an access control central unit over a mobile radio network to the mobile communication terminal of a user. Transmitted to the mobile communication terminal by an access control device to be passed is an access control device identification. In the mobile communication terminal, on the basis of the received identification, the access code and the access rights for the access control device to be passed are determined, and are transmitted to the access control device. The access control device clears the user for access if the received access rights suffice and the received access code agrees with the stored access code.

Claims

1. An access control method, in which an access code is assigned to an access control device and is stored in the access control device, in which an access code is stored in a mobile communication terminal, in which a unique access control device identification for each access control device, stored in each respective access control device, is transmitted from the access control device to the mobile communication terminal, and in which the access code for the access control device is determined in the mobile communication terminal, in that the access code is determined which is stored, assigned to the received unique access control device identification, in the mobile communication terminal, comprising:

generating a first digital certificate in the mobile communication terminal based on the determined access code and on access rights data, which are stored, assigned to the received unique access control device identification, in the mobile communication terminal, and which define access rights of the user for the access control device,

transmitting the first digital certificate from the mobile communication terminal together with the access rights data to the access control device,

generating a second digital certificate in the access control device based on the received access rights data and on the access code stored in the access control device,

comparing the generated second digital certificate with the received first digital certificate,

checking the received access rights data in the access control device, and

clearing access upon agreement of the digital certificates and with sufficient access right.

2. The access control method according to claim 1, further comprising:

generating and temporarily storing a random number in the access control device;

transmitting the random number from the access control device to the mobile communication terminal;

generating the first digital certificate in the mobile communication terminal based on the determined access code, on the access rights data stored in the mobile communication terminal and on the received random number; and

generating the second digital certificate in the access control device based on the received access rights data, on the access code stored in the access control device and on the temporarily stored random number.

3. The access control method according to claim 1, further comprising:

determining current time indications in the access control device; and

comparing the determined current time indications with the access rights data on authorized access times which are received from the mobile communication terminal.

4. The access control method according to claim 1, further comprising:

transmitting unique access control device identifications along with access codes and access rights data that are assigned to the unique access control device identifications from an access control central unit via a mobile radio network to the mobile communication terminal, the access fights data defining access fights of the user of the mobile communication terminal for an access control device; and

storing the received unique access control device identifications, access codes and access rights data in the mobile communication terminal correspondingly assigned to one another.

5. A computer program product comprising:

a tangible computer readable medium with computer program code means contained therein for control of a processor of a mobile communication terminal, said tangible computer readable medium comprising,

means for controlling exchange of data with an access control device to receive and accept a unique access control device identification for each access control device which is transmitted from a respective access control device to be passed, to determine an access code for the access control device to be passed in the mobile communication terminal, to assign the determined access code to the received unique access control device identification, and to store the determined access code in the mobile communication terminal, and

means for controlling the processor of the mobile communication terminal to generate a digital certificate in the mobile communication terminal based on the determined access code and access rights data which are stored and assigned to the received unique access control device identification in the mobile communication terminal, and to define access rights of the user of the mobile communication terminal for the access control device to be passed,

wherein the generated digital certificate is transmitted from the mobile communication terminal together with the access rights data to the access control device to be passed.

6. The computer program product according to claim 5, further comprising:

computer program code means for controlling the processor of the mobile communication terminal to receive a random number which is transmitted from the access control device to be passed, and to generate the digital certificate in the mobile communication terminal based on the determined access code, on the access rights data stored in the mobile communication terminal and on the received random number.

7. The computer program product according to claim 5, further comprising:

computer program code means for controlling the processor of the mobile communication terminal to receive from the access control central unit unique access control device identifications and access codes and access rights data, assigned in each case to the unique access control device identifications, the access rights data defining access rights of the user of the mobile communication terminal for an access control device, and to store the received unique access control device identifications, access codes and access rights data in the mobile communication terminal correspondingly assigned to one another.

8. An access control device in which an access code is stored, comprising:

communication means for exchange of data with a mobile communication terminal, and which comprises an identification module for transmitting a unique access control device identification for each access control device, stored in each respective access control device, to the mobile communication terminal;

means for receiving access rights data and a first digital certificate from the mobile communication terminal, which access rights data define access rights of the user of the mobile control device; and

an access control module configured to generate a second digital certificate based on the access rights data which have been received from the mobile communication terminal, and on the access code which is stored in the access control device,

wherein the access control module is configured to compare the generated second digital certificate with the received first digital certificate and to check the received access rights data, and

the access control module is configured to clear access upon agreement of the digital certificates and with sufficient access right.

9. The access control device according to claim 8, wherein the access control module is configured to generate and temporarily store a random number,

the access control device comprises means for transmitting the temporarily stored random number to the mobile communication terminal together with the unique access control identification, and

the access control module is configured to generate a second digital certificate based on the received access rights data, on the access code stored in the access control device, and on the temporarily stored random number.

10. The access control device according to claim 8, further comprising:

a time determination module for determining current time indications,

wherein the access control module is configured to compare the determined current time indications with access rights data on authorized access times which have been received from the mobile communication terminal.