# US 8,482,378 B2 · Access control system and method for operating said system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,482,378 B2
- Document ID: US8482378B2
- Status: Granted
- Kind: B2
- Application number: 12/226,765
- Filed: 2007-04-24
- Published: 2009-07-23
- Granted: 2013-07-09
- Earliest claimed: 2006-04-28
- Assignees: Telcred AB
- Applicants: Babak Sadighi; Ling Cao; Ludwig Seitz
- Inventors: Babak Sadighi; Ling Cao; Ludwig Seitz
- Web page: https://patentgrep.com/patent/US8482378B2

## CPC

- G08C 17/02: using a radio link
- G07C 9/00309: {operated with bidirectional data transmission between data carrier and locks}
- G07C 9/00571: {operated by interacting with a central unit}
- G07C 9/27: with central registration
- H04W 12/082: using revocation of authorisation
- G07C 2009/00388: {code verification carried out according to the challenge/response method}
- G07C 2009/00412: {the transmitted data signal being encrypted}
- G07C 2009/00825: {remotely by lines or wireless communication}
- G07C 2009/00865: {remotely by wireless communication}
- G07C 2009/0088: {centrally}
- Y10T 70/625: Operation and control
- Y10T 70/70: Operating mechanism
- Y10T 70/735: Operating elements
- G08C: TRANSMISSION SYSTEMS FOR MEASURED VALUES, CONTROL OR SIMILAR SIGNALS (fluid pressure transmitting systems F15B; mechanical means for transferring the output of a sensing member into a different variable G01D5/00; mechanical control systems G05G)
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- Y10T: TECHNICAL SUBJECTS COVERED BY FORMER US CLASSIFICATION

## Abstract

The present invention relates to a system (10) operable to control access to different physical spaces, each provided with an electrical locking device (121, . . . , 12n), with the aid of a programmable, mobile unit (14). The system (10) comprises an authority means (16) operable to issue access rights connected to the programmable, mobile unit (14) in the form of an authorizing data (AD), which authorizing data (AD) is sent to an authorization means (18) connected to the authority means (16), and operable to generate an alpha-numerical key for the mobile unit (14), and to send the alpha-numerical key and a unique identifier of the mobile unit (14) to an operator (20), which is connected to the authorization means (18). The operator (20) is operable to send the alpha-numerical key to the mobile unit (14) identified by the unique identifier. An electrical locking device (12i), wherein 1≦i≦n, and the mobile unit (14) uses an authentication protocol with the alpha-numerical key to authenticate the mobile unit (14), wherein the mobile unit, if it has been authenticated, sends the authorizing data (AD) to the electrical locking device (12i), and if the authorizing data (AD) comprises an identifier of the electrical locking device (12i), the mobile unit (14) is able to open the electrical locking device (12i) with the aid of a communication means (22) comprised in the mobile unit (14) for communication in the near field.

## Claims

### Claim 1

A system operable to control access to different physical spaces, each space being provided with an electrical locking device, with the aid of a programmable, mobile unit, said system comprising:
an authority means operable to issue access rights connected to said programmable, mobile unit in the form of an authorizing data (AD),
the authorizing data (AD) being sent to an authorization means connected to said authority means and being operable to generate an alphanumerical key for said programmable, mobile unit and send said alphanumerical key and a unique identifier of said mobile unit to an operator,
the operator being connected to said authorization means and being operable to send said alphanumerical key to said mobile unit identified by said unique identifier,
said electrical locking device and said mobile unit using an authentication protocol with said alphanumerical key to authenticate each other,
said mobile unit, if said mobile unit and said electrical locking device have been authenticated, sending said authorizing data (AD) to said electrical locking device, and if said authorizing data (AD) comprises an identifier of said electrical locking device, said mobile unit is able to open said electrical locking device with the aid of a communication means comprised in said mobile unit for communication in the near field,
said unique identifier of said mobile unit being a number, and said authorizing data (AD) comprises an identification (ID1; . . . ; IDn) of each of said electrical locking device which said mobile unit should be able to open,
said alphanumerical key being an asymmetric key pair (privP, pubP), said authorization means also being operable to generate said asymmetric key pair (privP, pubP), a certificate (certP), and an authorizing data (AD) electronically signed by said authorization means private key (privA), (SignprivA (AD)) for said mobile unit, and to send said authorizing data (AD), said private key (privP) of said mobile unit, said certificate (certP), said public key (pubA) of said authorization means, said authorization data electronically signed by said authorization means private key (SignprivA (AD)), and said number of said mobile unit to said operator,
said electrical locking device communicating, during access control and management of access to said electrical locking device, only with said mobile unit.

### Claim 2 (depends on 1)

The system operable to control access to different physical spaces according to claim 1, wherein said operator also is operable to send said authorizing data (AD), said private key (privP) of said mobile unit, said certificate (certP), said public key (pubA) of said authorization means, and said authorization data electronically signed by said authorization means private key (SignprivA (AD)) to said mobile unit.

### Claim 3 (depends on 2)

The system operable to control access to different physical spaces according to claim 2, wherein said mobile unit also is operable to establish a communication channel in the near field with said electrical locking device, and to send said certificate (certP) to said electrical locking device, and to receive a certificate of said locking device containing its public key (certL) from said electrical locking device.

### Claim 4 (depends on 3)

The system operable to control access to different physical spaces according to claim 3, wherein said mobile unit and said electrical locking device are operable to authenticate each other using their certificates (certP, certL) and their private keys (privP, privL) with the aid of the authentication protocol, wherein the authentication protocol being a two-way Authentication protocol.

### Claim 5 (depends on 4)

The system operable to control access to different physical spaces according to claim 4, wherein said mobile unit also is operable, if said mobile unit and said electrical locking device have been authenticated, to send said authorizing data (AD) and said authorization data electronically signed by said authorization means private key (SignprivA (AD)) to said electrical locking device, which verifies said signature.

### Claim 6

A method for controlling access to different physical spaces, each provided with an electrical locking device, with the aid of a programmable, mobile unit and with the aid of a system, wherein said method comprises the steps:
an authority means comprised in said system issues access rights connected to said mobile unit in the form of an authorizing data (AD), said authorizing data (AD) comprising an identification (ID1; . . . ; IDn) of each of said electrical locking device which said mobile unit should be able to open;
to send said authorizing data (AD) to an authorization means comprised in said system and connected to said authority means;
said authorization means generates an alphanumerical key for said mobile unit;
to send said alphanumerical key and a unique identifier of said mobile unit to an operator which is connected to said authorization means, said unique identifier of said mobile unit being a number and said alphanumerical key being an asymmetric key pair (privP, pubP);
said operator sends said alphanumerical key to said mobile unit identified by said unique identifier;
wherein said electrical locking device, and said mobile unit use an authentication protocol with said alphanumerical key to authenticate each other;
if said mobile unit and said electrical locking device have been authenticated, said mobile unit sends said authorizing data (AD) to said electrical locking device;
to verify the validity of the authorization data (AD); and
if said authorizing data (AD) comprises an identifier of said electrical locking device, said mobile unit is able to open said electrical locking device with the aid of a communication means comprised in said mobile unit for communication in the near field;
with the aid of said authorization means, generating said asymmetric key pair (privP, pubP), a certificate (certP), and an authorizing data (AD) electronically signed by said authorization means private key (privA), (SignprivA (AD)) for said mobile unit; and
sending said authorizing data (AD), said private key (privP) of said mobile unit, said certificate (certP), said public key (pubA) of said authorization means, said authorization data electronically signed by said authorization means private key (SignprivA (AD)), and said number of said mobile unit to said operator; and
wherein said electrical locking device communicating, during access control and management of access to said electrical locking device, only with said mobile unit.

### Claim 7 (depends on 6)

The method for controlling access to different physical spaces according to claim 6, wherein said method also comprises the step:
with the aid of said operator, sending said authorizing data (AD), said private key (privP) of said mobile unit, said certificate (certP), said public key (pubA) of said authorization means and said authorization data electronically signed by said authorization means private key (Sign PrivA (AD)) to said mobile unit.

### Claim 8 (depends on 7)

The method for controlling access to different physical spaces according to claim 7, wherein said method also comprises the steps of:
with the aid of said mobile unit, establishing a communication channel in the near field with said electrical locking device;
sending said certificate (certP) to said electrical locking device; and
receiving a certificate of said locking device containing its public key (certL) from said electrical locking device.

### Claim 9 (depends on 8)

The method for controlling access to different physical spaces according to claim 8, wherein said method also comprises the step of:
with the aid of said mobile unit and said electrical locking device, authenticating each other using their certificates (certP, certL) and their private keys (privP, privL) with the aid of the authentication protocol, wherein the authentication protocol being a two-way Authentication protocol.

### Claim 10 (depends on 9)

The method for controlling access to different physical spaces according to claim 9, characterized in that said method also comprises the step of:
if said mobile unit and said electrical locking device have been authenticated, with the aid of said mobile unit, sending said authorizing data (AD), and said authorization data electronically signed by said authorization means private key (SignprivA (AD)) to said electrical locking device.

### Claim 11 (depends on 6)

At least one computer program stored on a non-transitory computer readable medium the at least one computer program comprising software code portions for performing the steps of claim 6 when executed by at least one computer.