Access control system

An apparatus comprising at least one processor and at least one memory that includes program code, wherein the memory and the program code are configured to cause the apparatus with the at least one processor to perform and/or control:

• a generating of first check information by performing cryptographic operations on one or more access authorization parameters using at least a first key of a symmetrical or asymmetrical key pair;
• a generating of access authorization information comprising at least the one or more access authorization parameters and the first check information;
• and
• an outputting of the access authorization information for storage on an access authorization proving apparatus configured to communicate the access authorization information to at least one access control apparatus in order to enable the latter to decide whether access is permitted to be granted on the basis of the communicated access authorization information, wherein necessary conditions for granting access are that a first checking, using at least the communicated access authorization parameters, the communicated first check information and a second key of the key pair, said second key being stored in the access control apparatus, whether the communicated first check information was generated by performing cryptographic operations on access authorization parameters corresponding to the communicated access authorization parameters using at least the first key of the key pair, yields a positive result and it is determined that at least one predefined set of the communicated access authorization parameters , in view of respective pieces of reference information present in the access control apparatus at least at the time of the first checking, respectively authorize for access;
• wherein the memory and the program code are further configured to cause the apparatus with the at least one processor to perform and/or control action group A or action group B as defined below:
• action group A:
• an encrypting of a fourth key using at least the first key of the key pair, wherein the fourth key can be used in an authentication of the access control apparatus vis-á-vis the access authorization proving apparatus, which communicates the access authorization information to the access control apparatus, or in the checking of the authenticity and/or integrity of information communicated to the access control apparatus,;
• a generating of information comprising at least the encrypted fourth key;
• and
• an outputting of the information for storage on the access authorization proving apparatus, which is configured to communicate the information at least to the access control apparatus in order to enable the latter to decrypt the encrypted fourth key using at least the second key of the key pair and to use said fourth key;
• action group B:
• an encrypting of a combination of a fourth key and an identifier for the access authorization information or for the access authorization proving apparatus, which communicates the access authorization information to the access control apparatus, using at least the first key of the key pair, wherein the fourth key can be used in an authentication of the access control apparatus vis-a-vis an access authorization proving apparatus, which communicates the access authorization information to the access control apparatus, or in the checking of the authenticity and/or integrity of information communicated to the access control apparatus,
• a generating of information comprising at least the encrypted combination, and
• an outputting of the information for storage on the access authorization proving apparatus, which is configured to communicate the information at least to the access control apparatus in order to enable the latter to decrypt the encrypted combination using at least the second key of the key pair, in order to obtain the fourth key and the identifier, wherein the identifier further constitutes one of the access authorization parameters, and wherein it is determined in the access control apparatus that the identifier contained in the communicated access authorization information authorizes for access if the identifier contained in the communicated access authorization information corresponds to the identifier obtained by decrypting the encrypted combination, or if the identifier contained in the communicated access authorization information corresponds to the identifier obtained by decrypting the encrypted combination and the identifier is not contained in a rejection list stored in the access control apparatus.

An apparatus comprising at least one processor and at least one memory that includes program code, wherein the memory and the program code are configured to cause the apparatus with the at least one processor to perform and/or control:

• a communicating of access authorization information comprising at least one or more access authorization parameters and first check information to an access control apparatus in order to enable the latter to decide whether access is permitted to be granted on the basis of the communicated access authorization information, wherein necessary conditions for granting access are that a first checking, using at least the communicated access authorization parameters, the communicated first check information and a second key of a symmetrical or asymmetrical key pair, said second key being stored in the access control apparatus, whether the communicated first check information was generated by performing cryptographic operations on access authorization parameters corresponding to the communicated access authorization parameters using at least a first key of the key pair, yields a positive result and it is determined that at least one predefined set of the communicated access authorization parameters , in view of respective pieces of reference information present in the access control apparatus at least at the time of the first checking, respectively authorize for access;
• wherein the memory and the program code are further configured to cause the apparatus with the at least one processor to perform and/or control action group A or action group B as defined below:
• action group A:
• a communicating to the access control apparatus of information comprising at least one fourth key that is encrypted using at least the first key of the key pair and that can be used in an authentication of the access control apparatus vis-a-vis the access authorization proving apparatus, or in the checking of the authenticity and/or integrity of information communicated to the access control apparatus, in order to enable the latter to decrypt the encrypted fourth key using at least the second key of the key pair and to use said fourth key;
• action group B:
• a communicating to the access control apparatus of information comprising at least one combination—encrypted using at least the first key of the key pair—of a fourth key and an identifier for the access authorization information or for the access authorization proving apparatus, wherein the fourth key can be used in an authentication of the access control apparatus vis-a-vis the access authorization proving apparatus or in the checking of the authenticity and/or integrity of information communicated to the access control apparatus, in order to enable the latter to decrypt the encrypted combination using at least the second key of the key pair, in order to obtain the fourth key and the identifier, wherein the identifier further constitutes one of the access authorization parameters, and wherein it is determined in the access control apparatus that the identifier contained in the communicated access authorization information authorizes for access if the identifier contained in the communicated access authorization information corresponds to the identifier obtained by decrypting the encrypted combination, or if the identifier contained in the communicated access authorization information corresponds to the identifier obtained by decrypting the encrypted combination and the identifier is not contained in a rejection list stored in the access control apparatus.