Locking system and procedure for commissioning a key

Abstract

The invention relates to a locking system (100) with a physical key (30), with an electromechanical locking device (40) and with a computing unit (10), wherein the key (30) is designed to communicate with the locking device (40) via a first communication link, wherein the computing unit (10) comprises an electronic storage device, wherein a digital identifier (92) of a key holder (80-85) is stored in the memory, the following digital information is associated with the digital identifier (92) of the key holder (80-85) in the computing unit (10): • a digital representation of the key (30) of the key holder (80-85) with a key ID (53), • an authorization role (70, 71) to authorize actions of the key holder (80-85) in the locking system (100), wherein the computing unit (10) is configured to transfer a command message (50) for a configuration change of the locking device (40) to the key (30) of the key holder (80-85) whose authorization role (70, 71) allows a configuration change of a locking device (40).

Description

[0001] The present invention relates to a locking system comprising a physical key, an electromechanical locking device, and a computing unit. The key is designed to communicate with the locking device via a first communication link. The computing unit includes an electronic memory.

[0002] EP 2 821 970 A1 discloses a locking system for updating access rights for a locking cylinder. In this system, information for updating the locking device is sent from a remote computing unit to a physical key via a mobile device. The mobile device plays an active role, for example, by allowing the validity period of a key to be extended. Since a mobile device is susceptible to manipulation, the security of the locking system can be compromised in the event of such manipulation.

[0003] WO2024 / 083878 A1 also discloses a locking system with which a locking device can be put into operation. It does not disclose how the locking system can perform configuration changes after commissioning or how a key can be put into operation.

[0004] The object of the present invention is to provide a locking system and a method for commissioning a key with which configuration changes can be carried out in a particularly secure manner.

[0005] The problem is solved by the features of the independent claims. The dependent claims relate to preferred embodiments of the invention. Features and details described in connection with the locking system according to the invention also apply in connection with the method according to the invention, and vice versa. In particular, a method that leads to a locking system according to the invention according to any one of claims 1 to 7 and / or that can be carried out with a locking system according to any one of claims 1 to 7 and / or a locking system with which a method according to any one of claims 8 to 10 can be carried out is protected.

[0006] According to the invention, a digital identifier of a key holder is stored in the memory of the processing unit. The following digital information is associated with the digital identifier of the key holder in the processing unit: • a digital representation of the key holder's key with a key ID and • an authorization role to authorize actions of the key holder in the locking system.

[0007] An association can also be understood as a digital link or digital assignment of the key holder's identifier to the digital representation of the key and to the authorization role.

[0008] A key holder's identifier is understood to be a unique electronic identifier of the key holder, e.g. a name, an email address or a key holder ID.

[0009] The key ID refers to a unique electronic identifier of the key, such as a serial number.

[0010] Each key in the locking system is preferably assigned to exactly one user, who is referred to as the key holder.

[0011] The term authorization role refers to a type of authorization assigned to a key holder in a locking system. The authorization role determines which actions the key holder is permitted to perform with the key. These actions can include, for example, commissioning or decommissioning the locking device, decommissioning a key, updating the firmware of the key or locking device, updating the cryptographic information of the key or locking device, or unlocking a door.

[0012] A digital representation of the key is stored in the processing unit. Optionally, a digital representation of the locking device can also be stored in the processing unit. The term "digital representation" refers to a virtual representation of the key or locking device that is stored electronically in the processing unit. The digital representation can contain information about the physical key or locking device. The digital representation of the key includes at least the key ID. Optionally, further information about the key, such as cryptographic information, a history of transactions already carried out using the key, etc., can be stored in the digital representation.

[0013] According to the invention, the authorization role is used to determine which action the key holder performs using the key. This determination is made with the aid of the processing unit. A configuration change without the aid of the processing unit is not provided for.

[0014] It may be provided that the computing unit is trained to transfer a command message for a configuration change of the locking device to the key of the key holder whose authorization role allows a configuration change of a locking device.

[0015] The processing unit thus transfers a command message to at least one key to change the configuration of the locking device, provided the key holder associated with that key has the appropriate authorization role. This involves a selection or at least verification step within the processing unit to determine which key should be used to perform the configuration change of the locking device. The command message is not transferred to the key for changing the configuration of the locking device if the key holder's authorization role does not permit such a change. Therefore, the processing unit can only transfer the command message to at least one of the keys in the locking system, provided the key holder associated with that key has the appropriate authorization role.

[0016] Additionally or alternatively, the computing unit may be configured to transfer a key configuration change message when the key is modified. This transfer of the key configuration change message occurs specifically when the key owner has authenticated, or when a user other than the key owner, whose authorization role permits a key configuration change, has authenticated. This applies particularly to the decommissioning of the key.

[0017] Regarding a firmware update of the key, it may be stipulated that the foregoing also applies to a firmware update of the key. Alternatively, a firmware update of the key will be carried out, in particular exclusively, on the condition that the key holder has authenticated themselves.

[0018] The processing unit then transfers a key configuration change message to the key that is to undergo the configuration change. It is not strictly necessary for the key holder involved to have a specific authorization role. Rather, the configuration change can be initiated by either the key holder associated with the key undergoing the change or by a different user. However, this other user must then have the appropriate authorization role. This user could be, in particular, someone registered in the locking system who has access to a device that will be described in more detail later. For example, a different key could be assigned to this user.Therefore, the key configuration change message can be transferred provided that the key owner has authenticated, or that a user other than the key owner, whose authorization role allows a configuration change of the key, has authenticated. Of course, the key owner can also hold the authorization role that allows the configuration change of the key. However, this is not a prerequisite for changing the configuration, especially decommissioning, of the key.

[0019] Preferably, this involves a digital configuration change of the locking device or the key.

[0020] Preferably, the locking system is designed to carry out both the configuration change of the locking device according to the invention via the key specified or selected by the computing unit, and the configuration change of the key with the help of the key holder or another user, different from the key holder, who has the appropriate authorization role.

[0021] The invention has the advantage that the decision as to whether to change the electronic configuration of the locking device or the key is made by the processing unit, and in particular exclusively by the processing unit. Thus, it is only possible to change the configuration of the locking device or the key via the processing unit. Furthermore, this provides a particularly secure method for implementing the change in the configuration of the locking device or the key.

[0022] At the same time, different needs are given priority when configuring the locking device compared to changing the key configuration. For example, keys that are not assigned a key holder capable of decommissioning can be decommissioned by a user who is not the key holder. This could be the case, for instance, if the key holder has changed employers or is ill. However, when configuring the locking device, especially when decommissioning it, particular attention must be paid to security. Therefore, only keys whose assigned key holders have a specific authorization role can be used in this case.

[0023] Regarding the configuration change of the locking device, it should also be noted that the key in question is a device used exclusively within the locking system and can therefore be designed to be particularly secure. The mobile key can be transported by a keyholder to the locking device to perform the configuration change. This establishes a secure communication channel from the often remotely located processing unit to the locking device. After the configuration change is initiated by the processing unit, the process then proceeds largely or completely automatically.

[0024] The key preferably comprises a key shaft. The key shaft can be inserted into the locking device, preferably into a keyway of the locking device. The key and key shaft are preferably designed such that torque can be transmitted to the locking device via the key shaft. The mechanical movement of the locking device is thus preferably effected by the key.

[0025] It is preferably provided that the key, in particular via the key shaft, establishes an electrical connection to the locking device. The connection can be wireless or wired. The key and the locking device comprise corresponding transmission devices for this purpose. "Wired" (also referred to as non-wireless) means that the connection is made via at least one conductor in the key that can be brought into electrically conductive contact with electronic components of the locking device. The key and the locking device can comprise corresponding, mutually corresponding electrical contacts as transmission devices for this purpose.

[0026] The connection can be used to transmit digital data. Thus, the connection can correspond to the first communication link. Through the electrical connection, it is possible to exchange digital data, particularly not wirelessly, between the key and the locking device. Therefore, the key is designed to communicate electronically with the locking device. For this purpose, it is specifically intended that the key is inserted into a key slot of the locking device. Additionally, the transmission devices make it possible to transfer electrical energy (also referred to as electric current) from the key to the locking device.

[0027] The key includes an electronic device. The electronic device may include a processor and / or electronic memory. The key's ID may be stored in the electronic device.

[0028] The electromechanical locking device is preferably a cylinder lock, in particular a double or half cylinder, a furniture cylinder, a padlock, or a similar device. The electromechanical locking device, designed as a cylinder lock, can be inserted into a lock (for example, a mortise lock) on a door as a possible locking element. The padlock can, for example, be mounted on a door. The locking device can be mounted on or in various locking elements, such as gates, drawers, barriers, etc. The locking device preferably comprises the electromechanical actuator, for example, an electric motor, and a drive mechanism. The electromechanical actuator can be controlled by the locking device's electronics to move the drive mechanism from a non-rotating to a rotatable state.This allows the locking mechanism to be unlocked. The locking device electronics may include a processor and / or electronic memory.

[0029] Preferably, the locking device only activates the actuator during operation if access authorization exists. This access authorization is digital information that is verified in the key and / or in the locking device before the locking device activates the actuator. Preferably, the access authorization is stored in the key's memory.

[0030] Preferably, the key is free of mechanical coding. Thus, the key and / or the locking device only check electronically, in particular based on access authorization, whether the actuator should be activated. Therefore, the key is preferably an electronic key.

[0031] The locking device may include a locking device ID. The locking device ID is a unique electronic identifier for the locking device, such as a serial number. The locking device ID is preferably stored in the locking device's memory.

[0032] The computing unit can be, for example, a server. The server can also be virtual, particularly as a cloud server or as a virtual area of ​​a cloud server. In particular, a database is stored in the computing unit, especially in its memory. The computing unit can include at least one processor. The computing unit can include an input / output device, which, for example, an administrator can use to operate the computing unit.

[0033] The transfer or being transferred of electronic or digital data includes data transmission according to the push or pull principle, or polling. Receiving data involves transferring it from the receiving end.

[0034] The locking system preferably contains several locking devices. Furthermore, the locking system incorporates a specific access authorization concept. For example, multiple authorized users can be assigned to the locking system, with each authorized user having access to one or more of the locking devices.

[0035] Access rights can be divided into authorization groups. For example, the locking system might apply to an apartment building. One authorization group could be for the building manager, who is permitted to lock all doors except those on individual apartments. Another authorization group could be for the apartment owners, who are allowed, for example, to lock the doors on the building's main entrance and their own apartments.

[0036] In an alternative example, the locking system might affect critical infrastructure. One authorization group can unlock locking devices that secure a physical area or infrastructure device with a specific security level. Another authorization group, however, is not permitted to unlock these locking devices, but only those that do not secure an area or infrastructure device with that security level.

[0037] Preferably, the locking system comprises several locking devices that are assigned to, in particular, a locking system owner, e.g., a housing company, a critical infrastructure operator, facility manager or property manager.

[0038] Preferably, a locking system is additionally or alternatively characterized by the fact that it includes at least one list of blocked access authorizations and / or blocked keys, referred to as a blacklist. The blocked access authorizations and / or blocked keys may relate to one or more locking devices of the locking system. The at least one blacklist is preferably limited to a single locking system. In other words, different locking systems are distinguished by their respective blacklists.

[0039] The locking system can additionally or alternatively be characterized by the fact that it incorporates its own encryption information, e.g., its own encryption key and / or its own encryption algorithm. This encryption information can also be referred to as cryptographic information and / or the encryption key as a cryptographic key. Thus, different locking systems primarily differ in their encryption information.

[0040] In the context of this disclosure, an assignment is understood in particular to mean a logical assignment.

[0041] Preferably, each key is assigned to exactly one locking system.

[0042] In one embodiment of the invention, each key holder is assigned exactly one key. In an alternative embodiment, several keys can be assigned to one key holder. If several keys are assigned to one key holder, preferably each of the several keys belongs to a different locking system.

[0043] The command message and the key configuration change message are specifically digital messages.

[0044] Regarding the configuration change of the locking device, the command message may include a command. Upon receipt of the command message, it is preferably provided that the key commands the locking device to carry out the configuration change, provided the key and the locking device are electronically in communication.

[0045] After the key has instructed the locking device to perform the configuration change, the locking device preferably executes the command. It can be configured that the locking device only executes the command if at least one check step has been successfully completed beforehand. For example, it is checked whether the command is outdated. Additionally or alternatively, it can be checked whether the key transferring the command is listed on the blacklist stored in the locking device.

[0046] It may also be stipulated that the locking device and the key verify themselves before the electronic configuration is changed, in particular by means of cryptographic information from the locking system. This may also be a prerequisite for carrying out the configuration change in the locking device.

[0047] The "commanding" of the key to the locking device to perform the configuration change can involve the key transferring the received digital command to the locking device. The key can modify the command before transferring it. For example, the key can change the encryption of the command. For instance, the key can omit or add information to the command.

[0048] Thus, before the transfer, the key can generate at least one digital key command message, which the key can use to instruct the locking device to perform the configuration change. For simplicity, the term "one key command message" will be used below, even though this may involve multiple digital messages.

[0049] Preferably, the following digital information is associated with the digital identifier of the key holder in the computing unit: a transfer information of a device through which the computing unit communicates with the key.

[0050] The key can be configured to communicate with the device via a second communication link, particularly a wireless one. The device can be configured to communicate with the processing unit via a third communication link.

[0051] The device is preferably a mobile device, in particular a smartphone, tablet, or laptop. Alternatively, the device can also be a terminal that is mounted in or on the building, for example, on the wall, and is used for room and / or building control. In the case of a mobile device, the device preferably belongs to exactly one key holder. Preferably, the device is able to establish a connection to the internet and / or a telecommunications network. Preferably, the device can communicate with the computing unit via the internet or the telecommunications network as a third communication link. For this purpose, the device and the computing unit can include corresponding transmitting and receiving units. In particular, it is provided that the device communicates wirelessly with the computing unit, especially via the internet or a telecommunications network.

[0052] Preferably, the device includes input means; for example, a keyboard and / or a touchscreen. More preferably, the device includes output means; for example, a screen, in particular a touchscreen, and / or a loudspeaker. The device preferably comprises electronics. The electronics serve, in particular, to process inputs to the input means and / or to display a message on the output means and / or to communicate with the processing unit and the key. The electronics may include memory.

[0053] It is preferably provided that the device can communicate with the locking device element via the second communication link. The second communication link is preferably wireless. The second communication link is preferably implemented as a short-range wireless communication technology, e.g., NFC, Bluetooth Low Energy, or Ultra Wideband. For this purpose, the device and the key can include corresponding transmitting and receiving devices. The command message is thus received via the second and third communication links. Preferably, it is not necessary for the second and third communication links to be established simultaneously. Rather, the device can first buffer the command message.

[0054] Preferably, the first communication link, the second communication link and the third communication link are bidirectional.

[0055] Establishing a second communication link between the device and the key may require an action on the key. For example, the key may include a button, and pressing this button is necessary to establish communication via the second communication link, particularly a wireless one.

[0056] The device can contain the transfer information. This transfer information is used to transfer the command message to the device. The transfer information can, for example, correspond to the device's IP address or mobile phone number. Preferably, the transfer information is stored electronically in the processing unit as an identifier associated with the key holder and / or the key. The key holder's identifier and / or the digital representation of the key can be associated with the transfer information.

[0057] The processing unit is preferably configured to transfer the command message for the key to the device of the key holder of the corresponding key using the transfer information. If the key holder authenticates on a device whose transfer information differs from the transfer information stored as belonging to the key holder, the processing unit is preferably configured to change the transfer information belonging to the key holder accordingly or to propose such a change.

[0058] An application, i.e., a software application, may be installed on the device. This application is specifically required to transfer the command message and / or the key configuration change message from the processing unit to the key. The application is most likely a mobile app.

[0059] Ideally, the key holder must authenticate themselves within the application. This can be done, for example, by entering a password or PIN code, or by using biometric authentication. This authentication can be provided in addition to the authentication used to log into the device.

[0060] Preferably, the key can only receive the command or command message if the key holder has authenticated themselves in an application on the device. Specifically, the key holder must have authenticated themselves in the application, the application must be open, and the key and the device must be communicating simultaneously via the second communication link. This ensures that the key holder-key mapping, which is crucial for secure procedures, is maintained locally at the device. This can be particularly important if the command message or the key configuration change message is initially stored in the device and only transferred to the key after the communication link between the processing unit and the device has been closed.

[0061] It can be provided that the processing unit transfers the command message only to the at least one device whose assigned key holder or key has been designated by the processing unit to effect the configuration change of the locking device. Thus, the command message is only transferred to the device of the key holder whose key has been selected to receive the command message.

[0062] It may be configured that the key can only receive commands or command messages for changing the configuration of the locking device if these commands or messages belong to the key holder who is currently authenticated in the application. To this end, the device can digitally query the processing unit to determine whether the currently authenticated key holder is associated with the key currently communicating with the device. The processing unit can then check whether the key holder's identifier is stored as associated with the key ID within the processing unit. If the processing unit confirms the association, the key can receive the command; otherwise, communication between the device and the key is interrupted. The association of the key holder's identifier with the key ID can also be stored in the device for at least a predetermined period.If the device is not in communication with the computing unit, the association stored in the device can be used to decide whether the key is allowed to receive the command.

[0063] Particularly when multiple keys are assigned to a key holder, it may be possible to configure the key to receive only the command messages and / or key configuration change messages from the device that are specific to that key. For example, the device or the key may select only those command messages and / or key configuration change messages stored on the device that contain the key ID of the key currently communicating with the device. If only one key is assigned to a key holder, preferably the key can receive all command messages and / or key configuration change messages stored on the device once the second communication link between the device and the key is established.

[0064] If a key is to undergo a configuration change, in particular decommissioning, the key can receive the key configuration change message even if the device of the other user is in communication with the key. In this case, the device's request to the processing unit is exceptionally approved by the processing unit despite the fact that the authenticated user differs from the key holder assigned to the key, so that the second communication connection can be maintained.

[0065] The term "authenticated" in claim 1 refers in particular to authentication within the application. In this context, the key holder may have authenticated themselves on their mobile device. A user other than the key holder, whose authorization role permits configuration changes, can authenticate themselves within the application on their mobile device. In particular, if the device is configured as a terminal, the key holder or a user other than the key holder can authenticate themselves within the application on the same device.

[0066] Preferably, the configuration change of the locking device corresponds to commissioning (setting up) the locking device. Alternatively, the configuration change can correspond to digital maintenance of the locking device. Maintenance, also referred to as "maintenance," can involve a change to the configuration of the locking device that relates to its function as such. This can include, in particular, decommissioning the locking device, a firmware update of the locking device, or an update of cryptographic information of the locking device.

[0067] Changing the key's configuration may correspond to digital maintenance of the locking device, in particular decommissioning the key, updating the key's firmware, or updating the key's cryptographic information.

[0068] The term "firmware update" refers specifically to a process in which the firmware stored in the locking device or key is replaced or updated with a newer firmware version. Firmware is a special type of software embedded in the hardware of the locking device or key that controls its functions.

[0069] The term "decommissioning" refers in particular to a procedure at the end of which the locking device or the key no longer contains any sensitive data of the locking system in which the locking device was used or to which the key belonged.

[0070] Decommissioning the locking device or key can include resetting it to factory settings. In particular, decommissioning the locking device or key can involve deleting the cryptographic information of the locking system stored in the locking device or key. Preferably, activation is achieved using cryptographic information that is stored in the locking device or key during its manufacture. After decommissioning, the electromechanical actuator of the locking device can preferably be activated by any mechanically compatible key from the same manufacturer or by any mechanically compatible key of the security system.

[0071] At the end of the decommissioning process, the locking device or key is deactivated with respect to the locking system. Decommissioning the locking device or key can ensure that it can be reused in another locking system, provided it is functional. Decommissioning may include deactivating the digital representation of the locking device or key, including the locking device ID or key ID, from the locking system. During decommissioning, digital information linking to the digital representation of the locking device or key, and / or digital information restricting the locking device or key to a single locking system, may be deactivated or deleted from the locking device or key itself.

[0072] Optionally, the decommissioning of the locking device may include the physical removal of the locking device at its installation location.

[0073] Preferably, the key should be activated independently of the user role. This allows the key to be activated by any device or user of the locking system. During this process, the user is assigned to the key. Thus, during activation, the key holder's identifier is associated with the key ID in the processing unit. However, this association cannot yet be used to fulfill a prerequisite for activating the key.

[0074] Preferably, after the key receives the command message and the next time it communicates with the locking device via the first communication link, the key automatically commands the locking device to change its configuration. "Automatically" here means that the key commands the locking device to change its configuration without the keyholder having to perform any action on the device. Rather, it is sufficient for the keyholder to insert the key into the locking device. Of course, it can be provided that the key and the locking device verify each other beforehand. It is also conceivable that the locking device performs at least one verification step before carrying out the configuration change.

[0075] Additionally or alternatively, it can be provided that after the key receives the key configuration change message, the key automatically performs the configuration change. "Automatically" in this context means that the key performs the configuration change without the key holder or any other user having to take any action on the device. Rather, it is sufficient that the key has received the key configuration change message. It is conceivable that the key performs at least one verification step before executing the configuration change, for example, to avoid executing an outdated configuration change command.

[0076] It may be stipulated that a first authorization role includes authorizations for commissioning and decommissioning the locking device and / or the key. In particular, the first authorization role includes authorizations for commissioning and decommissioning the locking device and for commissioning and decommissioning the key. The first authorization role may correspond to a picker.

[0077] A second authorization role can include access permissions to unlock a physical area blocked by the locking device. This second authorization role can correspond to an authorized user. The authorized user can use the key to activate an actuator on the key, thereby gaining access to a physical space.

[0078] An optional additional authorization role can correspond to a firmware installer. The firmware installer can update the firmware of the locking device. However, it is also conceivable that the firmware installer does not have its own authorization role. For example, it could be stipulated that every key holder is allowed to update the firmware of the locking device. Alternatively, it could be stipulated that only the order picker is allowed to update the firmware of the locking device.

[0079] A picker and, if applicable, a firmware installer do not need access authorization. However, a picker may have access authorization. A firmware installer, on the other hand, must not have access authorization. Preferably, the authorization role for performing a decommissioning of the locking device is configured with more rights than the authorization role of an access-authorized person. This means, in particular, that a picker has more rights than an access-authorized person or, if applicable, a firmware installer. Thus, an access-authorized person may not perform the picking or decommissioning of locking devices.

[0080] The authorization roles “Authorized Access Person”, “Order Picker” and, if applicable, “Firmware Installer” are authorization roles of key holders who allow their keys to interact with the locking devices of the locking system.

[0081] Preferably, the key of the key holder in the first authorization role and the key of the key holder in the second authorization role are mechanically identical. It is also possible that key holders possess the same identical key, regardless of their authorization role. This means that the keys of key holders with different authorization roles have the same mechanical structure. The actions a key holder is permitted to perform depend solely on the authorization role stored in the processing unit. Similarly, the commands or configuration change commands that the key may receive and that the processing unit transmits to the key depend solely on the authorization role stored in the processing unit.

[0082] Preferably, at least one user role for performing an administrative task is defined in the computing unit, and at least one user identifier is associated with the user role. The user identifier can be, for example, a unique identifier of an administrative user of the locking system, such as an email address or the name of an administrator.

[0083] The locking system can provide at least one user role for administrative tasks. This user role can correspond to an administrator. The administrator is authorized to initiate the transfer of a command message and / or a key configuration change message from the processing unit to the key. The administrator is authorized to digitally create users, keys, and / or locking devices in the processing unit. The administrator is authorized to assign authorization roles to key holders. The administrator is authorized to grant access permissions.

[0084] Another user role can correspond to a firmware updater. The firmware updater could, for example, be a service technician from the manufacturer whose sole right is to roll out a firmware update. In this case, the firmware updater can, for example, select the locking devices that require a firmware update. Thus, at least one user role for performing a firmware update can be stored in the processing unit, and at least one service technician identifier can be associated with this user role.

[0085] An additional, optional authorization and / or user role can be assigned to a locking system owner. For example, the locking system owner can add an administrator to the locking system.

[0086] Regarding a configuration change of the locking device, the processing unit can automatically check whether a key is authorized to modify the electronic configuration of the locking device. For example, the processing unit knows which locking device is to undergo which configuration change. For instance, an administrator has selected at least one key that is to receive the command to change the electronic configuration of the locking device. The processing unit can then verify whether the key holder selected by the administrator has the required authorization role.Since each key is assigned to exactly one key holder, the administrator can select the key holder who is to perform the configuration change of the locking device, rather than the key itself. The processing unit then checks whether the key holder has the required authorization role. If the check reveals that the key holder or the key is not authorized, the processing unit does not generate a command message for the key. Thus, the processing unit can limit the selection of keys to receive the command message. Alternatively, the processing unit can display only those keys or assigned key holders with the appropriate authorization role for selection on the output device. This can also result in a limitation.

[0087] Regarding a configuration change of the locking device, the computing unit can be configured not only to allow the selection of the key based on the authorization role, but also to play a more active role, namely to actively propose at least one key or key holder with the appropriate authorization role, particularly to an administrator. The user can then accept or reject the proposal via the input device. In a further automation, the computing unit can itself execute the entire process of using at least one key that is to command the configuration change to the locking device.

[0088] Preferably, with regard to a configuration change of the locking device, the selection of which locking device is to be subjected to the electronic configuration change can be determined exclusively by the processing unit. Thus, it is not possible to select one or more locking devices for electronic configuration change without involving the processing unit. Therefore, the selection of the locking devices is performed in the processing unit, possibly with the involvement of an administrator or firmware updater. The selection of the at least one locking device on which the configuration change is to be performed can be stored in the processing unit, in particular by means of the locking device ID. Preferably, it is always necessary that the decision to change the configuration of the locking device is made by the processing unit, possibly with the involvement of an administrator or firmware updater.a decision is made with the involvement of an administrator or firmware updater, and a corresponding command is transferred from the computing unit to the key.

[0089] Particularly in the case of a firmware update for the locking device, the processing unit can select which locking devices require a firmware update from their digital representations. To do this, the processing unit can compare a firmware version number installed on the locking devices and stored in their digital representation with a firmware version number in the firmware update data package. The processing unit can then suggest the appropriate locking devices for the firmware update to the administrator and / or the firmware updater, or automatically select the locking devices.

[0090] The processing unit can receive an electronic request for permission to perform a configuration change on the locking device. The request preferably includes the locking device ID of the device whose configuration is to be changed and the key ID of the key that will command the configuration change to the locking device. If the processing unit receives the request to perform a configuration change on the locking device via the key, it can automatically verify whether the key holder of the key whose key ID is included in the request has the necessary authorization role. If this is not the case, the processing unit can automatically terminate the request and not send the corresponding command to the key.If the key holder has the required authorization role, the computing unit can propose the configuration change to the output device, particularly to the administrator. The proposal can be accepted or rejected via the input device, particularly by the administrator. Alternatively, the computing unit can automatically initiate the configuration change and transfer a corresponding command message to the key.

[0091] If a key configuration change, particularly a key decommissioning, is required, the computing unit can suggest the key holder or a user with the necessary authorization role on whose device the key decommissioning should be performed. The output device then displays only the user(s) authorized to perform the key decommissioning. The selection can be confirmed or rejected by input at the input device, particularly by the administrator. Alternatively, the computing unit can automatically select the user(s) on whose device the key decommissioning should be performed.

[0092] The computing unit can receive a request to decommission a key. This request preferably includes the key ID of the key to be decommissioned and the user requesting the decommissioning. Upon receiving the decommissioning request, the computing unit can automatically verify whether the requesting user is authorized to decommission the key. Specifically, the computing unit checks whether the user is the key owner or holds the necessary authorization role. If neither is the case, the computing unit can automatically terminate the request and not transfer any corresponding key configuration change message to the key.If the user is authorized to decommission the key, the computing unit can propose the decommissioning of the key on the output device, particularly to the administrator. The proposal can be accepted or rejected via the input device, particularly by the administrator. Alternatively, the computing unit can automatically initiate the decommissioning process and transmit a corresponding command to the key for decommissioning.

[0093] The processing unit is configured to transfer the command message or the key configuration change message to the key via the device. The processing unit is configured to encrypt the command, specifically to encrypt it in such a way that the key, but not the device, can decrypt the command.

[0094] The following describes in more detail the command message containing the command to change the configuration of the locking device and the key configuration change message containing the configuration change command to change the configuration of the key.

[0095] The command message or key configuration change message received by the key is a digital message. The command message and / or the key configuration change message is generated by the processing unit. The command message or the key configuration change message may include a portion that is readable by the device. In particular, the metadata of the command message or the key configuration change message is readable by the device. It may be configured that only the metadata is readable by the device.

[0096] The command message contains digital information that enables the key to instruct the correct locking device to make the correct configuration change. The command itself is part of the command message. The command preferably contains digital information that enables the key to instruct the correct locking device to make the correct configuration change. The command is, in particular, undecipherable for the device. The secure transfer of the command to the key can be reflected in the fact that the command is unreadable by the device. Specifically, the command is encrypted in such a way that the device cannot read it.

[0097] It may be provided that the command is encrypted in such a way that only the key selected to receive the command to change the configuration of the locking device can decrypt the command.

[0098] It may be intended that the locking device cannot decrypt the command.

[0099] Preferably, the command message includes the key ID of the key. Preferably, command messages can only be transferred to the key if the key ID of the command message and the key match. Additionally or alternatively, the key can only decrypt command messages if the key ID of the command message and the key match.

[0100] Preferably, the command message, in particular the command itself, includes the locking device ID of the locking device, and preferably a list of several locking device IDs on which the electronic configuration change is to be performed. Preferably, the command includes the locking device ID of the locking device. This ensures that the locking device ID is included in the part of the command message that is unreadable by the device. If several locking devices are to undergo the same electronic configuration change using the same key, the command message, in particular the command itself, can include a list of the corresponding locking device IDs.

[0101] The configuration change command is part of the key's configuration change message. The configuration change command preferably contains digital information that allows the key to perform the correct configuration change on itself.

[0102] The key configuration change message preferably includes the key ID. Secure transmission of the configuration change command to the key can be ensured by making the configuration change command unreadable by the device. Specifically, the configuration change command is encrypted in such a way that the device cannot read it.

[0103] It may be provided that the configuration change command is encrypted in such a way that only the key intended to receive the configuration change command can decrypt it. It may also be provided that the locking device cannot decrypt the configuration change command.

[0104] Preferably, key configuration change messages can only be transferred to the key if the key ID of the key configuration change message and the key match. Additionally or alternatively, the key can only decrypt the key configuration change message if the key ID of the key configuration change message and the key match.

[0105] The command message, in particular the command itself, or the key configuration change message, in particular the configuration change command, may contain information about the type of configuration change. Thus, the command message, in particular the command, or the key configuration change message, in particular the configuration change command, specifies, for example, whether a decommissioning of the locking device or key, a firmware update of the locking device or key, or, if applicable, an update of the cryptographic information of the locking device or key is to be performed. Preferably, the command or the configuration change command includes information about the type of configuration change. This information is thus provided in the part of the command message or the configuration change command that is unreadable by the device.

[0106] Additionally or alternatively, the command or configuration change command may include a configuration change number. For example, the configuration change number could be a sequential number for each type of configuration change. Using the configuration change number, a chronological sequence of commands or configuration change commands transferred by the computing unit can be tracked. This allows the locking device or key to check, as a verification step, whether the command or configuration change command is outdated. For this purpose, the locking device or key may store the corresponding configuration change number after the configuration change has been executed.

[0107] It may be provided that the locking device or key only performs the configuration change if the received configuration change number is greater than the stored configuration change number.

[0108] After the configuration change has been carried out, the locking device preferably reports the execution of the command back to the processing unit via the key and the device. In particular, the processing unit stores information about the changed configuration in the digital representation of the locking device. It may be provided that the processing unit stores the successful execution of the command in the digital representation of the key that commanded the configuration change.

[0109] Preferably, several keys are selected for executing the command to change the electronic configuration of the locking device, and this selection is stored in the computing unit, particularly in the digital representations of the selected keys. Thus, a command with the same information about the type of configuration change and / or the same configuration change number and / or the same locking device ID can be transferred to multiple keys. The command can be encrypted differently for different keys. The command can be embedded in different command messages that differ at least by their respective key IDs.

[0110] Once the configuration change has been reported back to the processing unit, it can be provided that each of the multiple keys to which the processing unit has transmitted a command for the same configuration change of the same locking device receives a message from the processing unit instructing them not to execute the command. The keys can then delete or deactivate the command. Such a message could, for example, be sent during the next key update.

[0111] If multiple keys have received the same command (possibly encrypted differently), it can be prevented that the same command is executed by different keys via the locking device by storing the configuration change number in the locking device and / or by deactivating or deleting the command in the multiple keys after execution.

[0112] Preferably, the key decrypts the command before it orders the configuration change to the locking device. This minimizes the time between inserting the key into the locking device and the configuration change being executed. The key can also check whether the command message, particularly the command itself, has been received incorrectly. In case of incorrect reception, the key can report the error to the processing unit via the device, whereupon the key receives the command again from the processing unit via the device. Because this process can occur before the key is inserted into the locking device, time is saved after the key is inserted.

[0113] The command message or the key configuration change message can include a firmware update data package if the configuration change corresponds to a firmware update. Thus, in addition to the command or configuration change command and the key ID, the firmware update data package can also be contained within the command message or the key configuration change message. Preferably, the firmware update data package in the command message is encrypted and can be decrypted by the locking device. Preferably, the firmware update data package in the key configuration change message can only be decrypted by the key. Most preferably, the firmware update data package cannot be decrypted by the device.

[0114] Optionally, the locking system includes at least one device belonging to at least one key holder, whereby the key can receive the command message and / or the key configuration change message via this device. If multiple keys of the locking system are configured to receive the command message, the locking system preferably includes the multiple devices of the key holders to whom the corresponding keys belong. The devices can be configured as described.

[0115] The object of the invention is also achieved by a security system with several locking systems according to the invention. The individual locking systems according to the invention can be designed as described within the scope of this disclosure.

[0116] Preferably, each key is assigned to exactly one locking system. Each key is preferably assigned to exactly one keyholder. In one embodiment of the invention, each keyholder is assigned to exactly one locking system. In an alternative embodiment of the invention, the keyholder can belong to several locking systems. For this purpose, the keyholder can belong to each locking system with one of the several keys assigned to him. The assignment of the keyholder to the key assigned to him in the respective locking system is stored in the processing unit of the respective locking system. Preferably, the keyholder's transfer information is also stored in each processing unit.

[0117] Computing units of several locking systems can together form a computing system, whereby in particular the individual computing units can form virtual areas of the computing system.

[0118] Preferably, a key holder can be assigned to different locking systems within the security system, with the key holder's authorization role varying across these systems. This allows administrators of the different locking systems to assign different authorization roles to the key holder.

[0119] The object of the invention is also achieved by a method for commissioning a physical key in a locking system. The locking system is configured, in particular, as specified in this disclosure. Thus, at the end of the key commissioning process, the locking system can be configured with the physical key, the electromechanical locking device, and the computing unit. The key can be configured to communicate with the locking device via the first communication link after commissioning. The computing unit comprises the electronic memory.

[0120] The digital identifier of the key holder is stored in the memory of the processing unit. Preferably, the key holder's identifier was stored during the key holder's registration in the locking system.

[0121] The digital identifier of the key holder has been associated with the authorization role for the key holder's actions in the computing unit's memory. This was also preferably done during the key holder's registration.

[0122] During the key activation process, the following digital information is associated with a digital identifier of the key holder in the computing unit: The digital representation of the key of the key holder with the key ID.

[0123] The commissioning method according to the invention thus achieves a digital link between the key ID and the digital identifier of the key holder and their authorization role. This creates a prerequisite for using the new key to change the configuration of the locking device. It also creates a prerequisite for being able to securely make configuration changes to the key itself.

[0124] Preferably, a key holder authenticates themselves within the application on the device, particularly at the beginning of the key activation process. The key ID can then be transferred via the device to the processing unit through the second and third communication links. Subsequently, the key ID can be associated with the key holder's identifier within the processing unit.

[0125] This allows the key holder to be linked to the key. Because the key holder has authenticated themselves within the application, the processing unit knows the key holder's identifier and can assign it to the key ID.

[0126] It can be provided that, after the processing unit receives the key ID, a digital configuration is transferred from the processing unit to the key. This digital configuration makes the key usable in the locking system.

[0127] For example, the digital configuration can include cryptographic information, in particular cryptographic information specific to the locking system. The configuration is preferably transferred to the key via the device.

[0128] Irrespective of the inventive concept set out in claims 1 and 8, the invention comprises a further independent inventive concept. The problem of providing the most secure possible locking system is solved by the following locking system: Locking system with a physical key, an electromechanical locking device and a computing unit, wherein the key is designed to communicate with the locking device via a first communication link, wherein the computing unit includes an electronic memory, in particular, a digital identifier of a key holder and associated key ID of the key are stored in the memory of the computing unit, wherein the locking system is designed such that a prerequisite for the transfer of a command message to change the configuration of the locking device is that the key holder authenticates himself, in particular at a device of the locking system.

[0129] The locking system can be configured as described in this disclosure. In particular, the key, the computing unit, the device, and the locking mechanism can be configured as described in this disclosure.

[0130] Preferably, the locking system, particularly the processing unit, stores information about which key holder authenticated themselves when the device transferred the command message to the key. This information can be stored, for example, in the digital representation of the key and / or the locking device undergoing configuration change. Specifically, it is stored in the digital representation of the key that received the command message.

[0131] The invention will now be described in more detail with reference to exemplary embodiments. Technical features with the same function are identified in the figures by identical reference numerals. These show: Fig. 1 a locking system according to the invention, Fig. 2. Authorization roles and user roles in the locking system of the Fig. 1, Fig. 3 two embodiments of a safety system according to the invention, Fig. 4 a first method for decommissioning a locking device which can be carried out by the locking system according to the invention, Fig. 5 a method for firmware update of a locking device which can be carried out by the locking system according to the invention, Fig. 6 a second method for decommissioning a locking device, which can be carried out by the locking system according to the invention, Fig. 7 a first method for decommissioning a key, performed by a locking system according to the invention, Fig. 8 a second method for decommissioning a key, performed by a locking system according to the invention, Fig. 9 a method according to the invention for picking a key in the locking system according to the invention, Fig. 10 an excerpt on stored S what is only 16 pages digital data in a computing unit of a locking system according to the invention.

[0132] Fig. Figure 1 shows a locking system 100 according to the invention. The locking system 100 according to the invention comprises a computing unit 10, which is configured as a cloud server or a section of a cloud server. The computing unit 10 further comprises a computer with a screen as an output device 11 of the computing unit 10 and with a keyboard as an input device 12 of the computing unit 10. The computing unit 10 is configured to communicate via a telecommunications network with a device 20, which is configured as a mobile phone.

[0133] Device 20 has a touch display that serves simultaneously as an input device 21 and an output device 22. Device 20 includes a mobile phone number as transfer information, enabling it to communicate wirelessly with the computing unit 10 via a third communication link. Device 20 includes electronic memory and an electronic processor. An application is stored on Device 20. A key holder can authenticate themselves within the application.

[0134] The locking system 100 according to the invention further comprises several keys 30, one of which is a key 30 in Fig. Figure 1 is shown. The locking system 100 according to the invention also comprises several locking devices 40, one of which is a locking device 40 in Fig. Figure 1 shows the key 30. The key 30 comprises a key shaft 31 that can be inserted into a key channel 41 of the locking device 40. The key shaft 31 includes a transmission element 32 that corresponds to a transmission element (not shown) of the locking device 40. Electrical energy and electronic data can be transmitted from the key 30 to the locking device 40 via the transmission element 32 of the key 30 and the transmission element of the locking device 40. This establishes an initial communication link. If the electronic data includes digital access authorization or the positive result of an access authorization check performed on the key, an electrical actuator of the locking device 40 is activated. This allows the key 30 to rotate an eccentric follower of the locking device 40, thus unlocking a door.Key 30 is designed without any mechanical coding.

[0135] It is also possible to transfer digital data from the locking device 40 to the key 30. The key 30 includes an electrochemical energy storage device that provides the electrical energy for the locking device 40. The transfer of electrical energy and electronic data is contact-based, via electrical contacts of the transmission elements.

[0136] Key 30 includes a button 33. When button 33 is pressed, a second communication connection to device 20 is established. This second wireless communication connection is, for example, a Bluetooth Low Energy (BLE) connection or another short-range communication method.

[0137] It can be provided that, after the key holder has authenticated in the application and device 20 has received a key ID 53 of key 30, device 20 verifies the association of the key with the currently authenticated key holder. For this purpose, device 20 can transfer the identifier of the currently authenticated key holder and the key ID 53 of key 30, which is in communication with device 20, to the processing unit 10, so that the processing unit 10 can check whether the identifier of the currently authenticated key holder and the key ID 53 are associated. The processing unit 10 informs device 20 of the result. If no association exists, the communication connection between key 30 and device 20 is interrupted; otherwise, the communication continues, so that key 30 can potentially receive a command 60.If device 20 is not in communication with computing unit 10, device 20 can perform the verification based on an association stored in device 20 between the key holder's identifier and key ID 53. In the case of key commissioning or decommissioning, this verification can be omitted or, in the case of key decommissioning, modified so that communication is also possible with a user other than the key holder whose authorization role permits a configuration change of key 30.

[0138] Thus, electronic data can be transmitted from the computing unit 10 to the device 20 via the telecommunications connection, to the key 30 via the second wireless communication connection, and to the locking device 40 via the transmission elements. Likewise, electronic data can be transferred from the locking device 40 to the computing unit 10 via the path described.

[0139] This method can be used to change the configuration of the locking device 40. For this purpose, the command 60 to change the configuration of the locking device 40 is transferred from the processing unit 10 via the device 20 to the key 30. This is a prerequisite for carrying out the configuration change of the locking device 40. In principle, every key 30 of the locking system 100 is identically equipped with regard to its hardware and can receive such a command. However, according to the invention, not every arbitrary key 30 of the locking system 100 receives such a command. Rather, one or more keys 30 are selected by the processing unit 10 based on an authorization role stored in the processing unit 10, and the key is then to command the configuration change to the locking device.The crucial function of key 30 lies in the fact that key 30 is designed to be more tamper-proof than device 20. Device 20 is used to bridge the considerable distance between key 30 and computing unit 10 for communication purposes. Because key 30 can be carried by the key holder, it is capable of transmitting commands for configuration changes to various locking devices 40 of the locking system 100.

[0140] In Fig. Figure 1 shows how the command 60 for changing the configuration of the locking device 40 is transmitted from the computing unit 10 to the locking device 40. A command message 50 includes metadata 52. The metadata 52 includes the key ID 53, which uniquely identifies the key 30 in the locking system 100. The metadata 52 is readable by the device 20 and the key 30. The command message 50 also includes the command 60, which can only be decrypted by the key 30. The command 60 includes information about the type of configuration change 61, a configuration change number 62, and at least one locking device ID 63. The locking device ID 63 serves to uniquely identify the locking function 40 in the locking system 100. In the case of a firmware update as a configuration change of the locking device 40, the command 60 also includes a firmware update data package 55.The firmware update data packet 55 is encrypted in such a way that only the locking device 40 can decrypt it. Because the command message 50 includes the key ID 53 and the locking device ID 63, the processing unit 10 already specifies which locking device 40 will be configured using which key 30. Since the command message 50 is largely undecipherable for the device 20, manipulation can be prevented. The command message 50 is transferred from the processing unit 10 to the device 20 via the telecommunications network.

[0141] To further enhance tamper resistance, key 30 can only receive the command message 50 stored in device 20 if the key holder has authenticated themselves in the application and the application is open during the communication connection between key 30 and device 20. Only the command messages 50 of the authenticated key holder are visible to key 30. Key 30 receives only the command message 50 that includes the corresponding key ID 53. If multiple command messages 50 for the same key 30 are present in device 20, key 30 receives all of them when the communication connection between key 30 and device 20 is established and the application is open after the key holder has authenticated.It is not necessary for the third communication link between the computing unit 10 and the device 20 and the second communication link between the key 30 and the device 20 to be established simultaneously. Rather, the command message(s) 50 can first be transferred to the device 20, and then, even if the communication link between the device 20 and the computing unit 10 is interrupted, the command message(s) 50 can be transferred to the key 30.

[0142] Command 60 is now decrypted and verified by key 30. An erroneous command 60 or command message 50 is reported back to processing unit 10 via device 20, after which processing unit 10 retransmits command message 50. Likewise, a successful transfer of command 60 or command message 50 from the key to processing unit 10 via device 20 is also reported back.

[0143] Key 30 generates a key command message 65 for the locking device 40. Key command message 65 contains information about the type of configuration change 61 and the configuration change number 62. If the configuration change is a firmware update, key command message 65 includes the firmware update data package 55, which remains encrypted and is decryptable only by the locking device 40.

[0144] Optionally, the key command message 65 can include the key ID 53. Using the key ID 53, the locking device 40 can check whether the key ID 53 is listed on a blacklist stored in the locking device 40. Optionally, it can be specified that the locking device 40 only executes command 60 if the key ID 53 is not on the blacklist.

[0145] Key 30 can encrypt key command message 65 so that key command message 65 can be decrypted by the locking device. Instead of a single key command message 65, the content of key command message 65 can also be split across multiple key command messages 65.

[0146] When key 30 is inserted into locking device 40, key 30 and locking device 40 mutually verify each other by exchanging cryptographic information from the locking system 100. Locking device 40 transmits its locking device ID 63 to key 30. This allows the key to check whether it has stored a key command message 65 for the locking device 40 that is in communication with it. If the check is successful, the key transmits at least one key command message 65 to locking device 40. This commands the locking device 40 to change its configuration.

[0147] For each type of configuration change, a configuration change number is electronically stored in the locking device 40. The stored configuration change number was saved by the locking device 40 during the last configuration change of the same type. The locking device 40 compares the stored configuration change number with configuration change number 62 of the key command message 65. Only if configuration change number 62 of the key command message 65 is higher than the stored configuration change number does the locking device 40 execute command 60. This prevents outdated commands from being executed.

[0148] How to Fig. Further conditions may apply before command 6 is executed by the locking device 40, as will be described in more detail in section 6.

[0149] The execution of command 60 is reported back by the locking device 40 to the computing unit 10 via the key 30 and the device 20. The computing unit 10 sends a message to the other keys 30, which have also received command 60 with the same information about the type of configuration change 61, the same configuration change number 62, and the same locking device ID 63. Upon receiving the message, the other keys 30 delete command 60.

[0150] The processing unit 10 has stored a digital representation for each key 30 of the locking system 100. The processing unit 10 has stored a digital representation for each locking device 40 of the locking system 100. The completed and reported change to the configuration of the locking device 40 is stored in the digital representation of the locking device 40. Likewise, the execution of the command 60 is stored in the digital representation of the key 30 that commanded the configuration change to the locking device 40. The identifier of the key holder who authenticated themselves in the application when the key 30 received the command message 50 is stored in the digital representation of the key 30.

[0151] The digital representation of key 30, which includes the key ID 53 of key 30, is digitally associated with the key holder's identifier in the processing unit. This assigns the key holder to key 30. The selection of the key(s) that transfer the command to change the configuration to the locking device 40 is determined using the key holder associated with key 30 in the processing unit 10. One criterion here is the authorization role 70, 71 that the key holder holds.

[0152] Fig. Figure 2 shows a concept for different roles 70, 71, 72, 73 within a locking system 100. Keyholders who possess a key in the locking system are shown in light colors and are assigned an authorization role 70, 71. The keyholders are on-site to interact with the locking devices 40 using their keys 30. Users who do not possess a key, or do not necessarily possess one, are shown in Fig. 2 shown in black. The users shown in black perform administrative tasks and are assigned user roles.

[0153] An authorization role 70 corresponds to the authorized role of an access user 70. The access user has at least one digital access authorization stored on the key for a locking device of the locking system. An access user 70 may not decommission the locking device 40. The access user may perform a firmware update of the locking device 40.

[0154] Authorization role 71 corresponds to the authorization role 71 of a picker. The picker is authorized to decommission the locking device 40. The picker is authorized to perform a firmware update of the locking device 40. The picker is authorized to decommission all keys 30 of the locking system 100. The picker may decommission both their own key 30 and keys 30 belonging to other key holders. The picker must have at least one access authorization stored on the key 30. However, it is not mandatory for the picker to have access authorizations stored on the key to perform the configuration changes. In particular, it is not necessary for the picker to have access authorization to the locking device to be decommissioned.

[0155] User role 72 corresponds to user role 72 of an administrator. Administrator 72 can select at least one key, provided the key holder's authorization role allows it, or confirm the selection of the computing unit 10 for a key that is to receive the command message to change the configuration of the locking device 40. Administrator 72 can select locking devices 40 on which the configuration change of the locking device 40 is to be carried out. Administrator 72 can select a key 30 to be decommissioned or confirm a request to decommission a key 30. Administrator 72 can assign authorization roles 70 and 71 to key holders. Administrator 72 may create keys 30 in the locking system 100 and assign access authorizations.Therefore, the administrator can, in principle, also be a key holder with the authorization role of access user or order picker. However, the administrator (72) does not necessarily have to be a key holder as well.

[0156] It is possible that only rollers 70, 71, 72 are provided in the locking system 100.

[0157] An optional user role 73 corresponds to the user role of a Firmware Updater 73. A Firmware Updater 73 may only select locking devices 40 on which a firmware update is to be performed and select the keys 30, taking into account the criteria, that are to receive the command message 50 with the firmware update for the locking device 40. Specifically, the Firmware Updater 73 is a service employee of the manufacturer of the locking system 100. The Firmware Updater 73 is not also a key holder.

[0158] Fig. Figure 3 shows two alternative concepts for a security system 1000, 1001. The security system 1000 according to the first concept and the security system 1001 according to the second concept each comprise several locking systems 100, 101, 102, here three locking systems 100, 101, 102 as examples, whose locking devices 40 Fig. 3 are not shown. Locking systems 101, 102, 103 are shown as an example circle. Each locking system comprises a computing unit 10, 10a, 10b, which represents a virtual area of ​​the cloud server. A shared area 10c of the cloud server is used to provide new firmware updates and is operated, for example, by the manufacturer of locking systems 100, 101, 102.

[0159] Keys 30, 30a, 30b, 30c, 30d, and 30e are each assigned to exactly one locking system 100, 101, and 102 in both security systems 1000 and 1001, which in Fig. 3 is represented by the arrangement of keys 30, 30a, 30b, 30c, 30d, 30e in the respective circles of locking systems 100, 101, 102. Furthermore, keys 30, 30a, 30b, 30c, 30d, 30e are each assigned to exactly one key holder 80, 81, 82, 83, 84, 85 in both security systems 1000, 1001. The assignment of key 30, 30a, 30b, 30c, 30d, 30e to key holder 80, 81, 82, 83, 84, 85 is shown in Fig. 3 represented by a line.

[0160] In security system 1000, all key holders 80, 81, 82, 83, 84, 85 are assigned to exactly one locking system 100, 101, which in Fig. 3 is represented by the arrangement of the key holder 80, 81, 82, 83, 84, 85 within the circle of the respective shooting system 100, 101, 102. Likewise, each key holder 80, 81, 82, 83, 84, 85 of the security system 1000 possesses only exactly one key 30, 30a, 30b, 30c, 30d, 30e. Key holders 80, 81, 82, 83, 84, and 85 have 1000 different authorization roles (70, 71) in the security system. Each key holder (80, 81, 82, 83, 84, 85) has exactly one authorization role (70, 71). Key holders 80 and 83 are authorized access users (70). Key holders 81, 82, 84, and 85 are order pickers (71).

[0161] In security system 1001, some key holders 81 and 82 are assigned to several locking systems 100 and 101. Other key holders 80 and 83, however, are assigned to only one locking system 100 or 102, with each of these key holders having exactly one authorization role 70 or 71, respectively. Key holder 81, who is assigned to locking systems 100 and 101, has the same authorization role as order picker 71 in both locking systems 100 and 101. However, key holders can have a different authorization role in each locking system 100, 101, or 102 of security system 1001. This is shown as an example for key holder 82. The key holder 82 acts with the key 30c in the locking system 101 as access authorised person 70 and with the key 30e in the locking system 102 as order picker 71.

[0162] In the Fig. Figures 4 to 8 depict different procedures for decommissioning or firmware updates of a locking device or decommissioning a key. Arrows indicate the transfer of digital data. A circle with arrows indicates digital processing steps in one of the involved devices 10, 20, 30, 40. From top to bottom, the Fig. Figures 4 to 8 each depict a time progression.

[0163] Fig. Figure 4 shows a first embodiment of a method 200 for decommissioning a locking device 40. In a first method step 201, a locking device 40 is selected for decommissioning using the input and output devices 11, 12. The selection is stored in the digital representation of the locking device 40. The computing unit 10 then proposes at least one key 30 of a picker 82 on the output device 11, who is to carry out the decommissioning on site. Here, the computing unit 10 considers the authorization role of the key holders of the keys 30 in question as a selection criterion. An administrator 72 confirms the selection of the key 30 via the input device 12. The task of decommissioning the selected locking device 40 is digitally stored in the digital representation of the selected key 30.A corresponding command message 50 is generated in encrypted form by the processing unit 10. A configuration change is only possible by means of such a generated command message 50, i.e., after selecting the locking device 40 whose configuration is to be changed and selecting the key as the tool for the configuration change using the processing unit 10.

[0164] In a second process step 202, the command message 50 is transferred via the telecommunications network using the mobile phone number of the device 20, which is stored in the computing unit 10 as belonging to the key holder of the selected key 30.

[0165] In a third process step 203, the command message 50 is transferred from the device 20 to the key 30. For this purpose, the key holder must authenticate himself in the application of the device 20 and establish the communication connection between the device 20 and the key 30 by pressing button 33.

[0166] In a fourth process step 204, the key 30 decrypts the command message 50 and reports the successful receipt of the command message 50 back to the computing unit 10 via the device 20.

[0167] In a separate message 90, the processing unit 10 sends the task of decommissioning the locking device 40 to the device 20 in a process step 205. The device 20 displays the message 90 on the output device 22. The order picker 82 then reads the message 90 with the task of decommissioning the locking device 40 and goes to the corresponding locking device 40.

[0168] On site, order picker 82 inserts key 30 into locking device 40 in process step 206. Key 30 and locking device 40 then verify each other. Additionally, the locking device transmits its ID 63 to key 30. If key 30 and locking device 40 cannot verify each other, process 200 is aborted.

[0169] In the event of successful verification, key 30 checks whether it has stored a command 60 for the locking device 40 with the locking device ID 63. Since this is the case, key 30 then automatically transmits the key command message 65 to the locking device 40 in a procedure step 207. The locking device 40 decrypts the key command message 65. Optionally, the locking device 40 checks whether key 30 is listed on the blacklist stored in the locking device 40. If the key is on the blacklist, the procedure is aborted. If the key is not on the blacklist, the procedure continues.

[0170] In a procedure step 208, the locking device 40 compares the configuration change number of the key command message 65 with a configuration change number for decommissioning stored in the locking device 40. Decommissioning D is performed only if the configuration change number of the key command message 65 is greater than the stored configuration change number.

[0171] In the next process step 209, decommissioning D is performed. For this purpose, the locking device 40 deletes the cryptographic information of the locking system 100. The locking device 40 activates the cryptographic information that was stored in the locking device 40 during its manufacture. Furthermore, the locking device 40 deletes a code that assigns the locking device 40 to its digital representation. The locking device 40 also generates a code that enables assignment to a digital representation in another locking system 100. The locking device 40 also deletes a code that assigns the locking device to a locking system 100. Finally, the locking device 40 generates a code that enables assignment to another locking system 101, 102.

[0172] During process steps 206 to 209, the key 30 must remain inserted in the locking device 40; otherwise, the process 200 is aborted. After the locking device 40 has been decommissioned D, a digital message 66, indicating that the locking device 40 has been decommissioned using the key 30, is sent via the key 30 and the device 20 to the computing unit 10 in a process step 210. This is processed in Fig. 4 is represented as a continuous arrow, although message 66 may also be stored for a longer period of time in key 30 and / or device 20.

[0173] Upon receiving message 66, the computing unit changes the status of the digital representation of the locking device 40 to "decommissioned" in a procedure step 211. The computing unit 10 deletes the code that links the digital representation to the locking device 40. If a new locking device 40 is put into operation at the same location, the digital representation of the locking device 40 can be reactivated with the code of the new locking device 40.

[0174] In procedure step 211, the processing unit 10 stores which key 30 ordered the decommissioning D of the locking device 40. If the processing unit 10 has sent the command 60 to multiple keys, it informs all keys that have stored the command 60 in a procedure step 212 to delete the command.

[0175] In Fig. Figure 5 describes a procedure 300 analogous to procedure 200, by which the locking device 40 is to receive a firmware update FU. In a first procedure step 301, a locking device 40 with a firmware version is selected for firmware update FU using the input and output devices 11 and 12. For this purpose, the processing unit 10 can compare a firmware version number stored in the digital representations of the locking devices 40 of the locking system 100 with a firmware version number of the firmware update data package to be installed. The processing unit 10 can propose locking devices 40 whose firmware version number stored in the digital representation is lower than the firmware version number of the firmware update data package to be installed for the firmware update. An administrator of the locking system 100 can confirm or reject the proposal.Alternatively or additionally, a firmware updater can confirm or reject the proposal. The selection is stored in the digital representation of the locking device 40.

[0176] The processing unit 10 then proposes at least one key 30 from the keyholder on the output device 11, who is to perform the firmware update locally. The administrator or the firmware updater confirms the selection of key 30 via the input device 12. The task of updating the firmware of the selected locking device 40 is stored in the digital representation of the selected key 30. A corresponding command message 50 is generated in encrypted form by the processing unit 10.

[0177] The following steps 302, 303 and 304 correspond to steps 202, 203 and 204 of the Fig. 4.

[0178] In a separate message 90, the computing unit 10 sends the task to the device 20 in a process step 305, in which it instructs the device 20 to perform a firmware update on the locking device 40. The device 20 displays the message 90 on the output device 22. After reading the message, the key holder goes to the selected locking device 40.

[0179] Procedure steps 306 and 307 correspond to procedure steps 206 and 207 from Fig. 4.

[0180] In step 308 of the procedure, the locking device 40 compares the configuration change number of the key command message 65 with a configuration change number for the firmware update stored in the locking device 40. It also compares the firmware version number stored in the locking device 40 with the firmware version number of the key command message 65. The firmware update FU is only performed if the configuration change number and the firmware version number of the key command message 65 are greater than the stored configuration change number and firmware version number, respectively.

[0181] In the next process step 309, the firmware update FU is performed. For this, the firmware update data package is decrypted, verified, and installed. The configuration number and the firmware version number of the key command message 65 are saved.

[0182] During process steps 306 to 309, the key 30 must remain inserted in the locking device 40; otherwise, the process is aborted. The key 30 includes a light device 34 (see figure). Fig. 1), where the execution of the firmware update FU is displayed.

[0183] After the firmware update FU has been performed, the key 30 changes the display of the indicator light 34. A message 66, indicating that the locking device 40 has undergone a firmware update FU with the aid of the key 30, is transmitted via the key 30 and the device 20 to the processing unit 10 in a process step 310, which is analogous to process step 210 of the Fig. 4 is trained, sent.

[0184] Upon receiving message 66, the computing unit 10 updates the firmware version number of the digital representation of the locking device 40. The computing unit 10 stores which key 30 of the locking device 40 ordered the firmware update FU. If the computing unit 10 has sent the command 60 to multiple keys 30, the computing unit 10 informs all keys with the command 60 in a procedure step 312 to delete the command 60.

[0185] Fig. Figure 6 shows an alternative procedure 400 for decommissioning D of the locking device 40. A picker 71 authenticates himself in the application and presses a decommissioning field 23 in a procedure step 401. The decommissioning field 23 is displayed on the output device 22 of the device 20 (see Figure 6). Fig. 1).

[0186] The output device 22 now displays an instruction that order picker 71 should establish the communication connection to key 30 by pressing button 33. It also displays an instruction that order picker 71 should insert key 30 into key slot 41. In process step 402, order picker 71 presses button 33 on key 30 and in process step 403 inserts key 30 into key slot 41. Key 30 and locking device 40 then verify each other. Additionally, the locking device transmits the locking device ID 63 to key 30. If key 30 and locking device 40 cannot verify each other, process 400 is aborted.

[0187] If a command 60 for decommissioning the locking device 40 with the transmitted locking device ID 63 has already been stored in the key 30, the key command message 65 can now be transferred to the locking device 40. The locking device 40 can then perform at least one test step, the decommissioning, and the feedback to the processing unit analogous to process steps 208, 209, and 210. From process step 403 until the end of decommissioning D, the key 30 must remain inserted in the locking device 40, analogous to process step 209. The processing unit 10 can then also perform process steps analogous to steps 211 and, if applicable, 212.It is also possible that the command 60 is stored in the device 20 and is first transferred to the key 30 before the key command message 65 is transmitted to the locking device 40 and only then do the remaining steps take place analogously to 208 to 211, possibly 212, as described.

[0188] If no command 60 for decommissioning D of the locking device 40 has been stored in the device 20 or in the key 30, the locking device ID 63 is reported from the key 30 to the device 20 in a procedure step 404.

[0189] According to the invention, it is not possible to decommission the locking device 40 without involving the computing unit 10. Therefore, in a process step 405, the device 20 sends a request A to the computing unit 10, stating that the locking device 40 should be decommissioned, along with the key ID 53 and the locking device ID 63. In a process step 406, the computing unit 10 processes request A. Here, the computing unit 10 checks the authorization role of the key holder of key 30 with the received key ID 53. If the authorization role does not permit decommissioning, the process 400 ends. If the authorization role permits the decommissioning of the locking device 40, the computing unit 10 proposes to the administrator that the decommissioning D be permitted. If the administrator refuses permission, the process 400 ends.If the administrator grants permission, the computing unit 10 sends the command message 50 via the device 20 to the key 30 in a procedure step 407, which is decrypted in the key 30.

[0190] Subsequently, a key command message 65 is transmitted to the locking device 40 in a process step 408. There, the configuration change number is checked in a process step 409, and the decommissioning D is performed in a process step 410. These process steps proceed as described in process steps 207, 208, and 209. Then, in a process step 411, a message 66 indicating that the locking device 40 has been decommissioned using the key 30 is sent via the key 30 and the device 20 to the processing unit 10 in a process step 411, analogous to process step 210. The processing unit 10 processes the message 66 in a process step 412, which proceeds analogously to process step 211. Between process steps 403 and 411, it is essential that the key remains inserted in the locking device.

[0191] The locking system 100 according to the invention is also designed to decommission a key 30 in methods 500, 600, as described in the Fig. 7 and Fig. 8 shown. In a first procedure 500 for the decommissioning DS of key 30 according to Fig. In a first process step 501, a key 30 for decommissioning DS is selected using the input and output device 11,12. The selection is stored in the digital representation of the key. Subsequently, the computing unit 10 on the output device 11 proposes at least one user to whose device 20 a key decommissioning command message 150 for decommissioning the key 30 is to be transferred.

[0192] Typically, the computing unit 10 proposes the key holder whose device 20 is to receive the key decommissioning command message 150. A picker can also be selected for this purpose, either additionally or alternatively. An administrator 83 confirms the user's selection via the input device 12. A corresponding key configuration change message, in this case formatted as key decommissioning command message 150, is generated by the computing unit 10 and sent to the selected user's device 20 in a process step 502 using the mobile phone number stored in the computing unit 10. The key decommissioning command message 150 includes at least the decommissioning information 61 that the key 30 is to be decommissioned, and a configuration change number 62.The decommissioning information 61 and the configuration change number 62 are encrypted such that the decommissioning information 61 and the configuration change number 62 are undecipherable for device 20 and decipherable for the key 30 to be decommissioned. Furthermore, the key decommissioning command message 150 contains the key ID of the key 30 to be decommissioned.

[0193] In a third process step 503, the key decommissioning command message 150 is transferred from device 20 to key 30. For this purpose, the user must authenticate in the application of device 20 and establish the communication connection between device 20 and key 30 by pressing button 33.

[0194] Key 30 compares the configuration change number 62 of the key decommissioning command message 150 with a configuration change number 62 for decommissioning stored in key 30 in procedure step 504, analogous to procedure step 208. Decommissioning DS is performed only if the configuration change number 62 of the key decommissioning command message 150 is greater than the stored configuration change number.

[0195] In the next process step 505, decommissioning DS is performed. For this purpose, the key deletes the cryptographic information of locking system 100 in the electronic memory of key 30. Key 30 activates the cryptographic information that was stored in key 30 during its manufacture. Furthermore, key 30 deletes a code that key 30 assigns to its digital representation. Key 30 also generates a code that allows assignment to a digital representation in another locking system 100. Key 30 also deletes a code that assigns key 30 to a locking system 100. Key 30 generates a code that allows assignment to another locking system 101, 102.

[0196] In process step 506, a message 166 regarding the successful decommissioning DS of key 30 is transferred to the computing unit 10. Upon receiving message 166, the computing unit 10 changes the status of the digital representation of key 30 to "decommissioned". In process step 507, the computing unit 10 deletes the code that associates the digital representation with key 30.

[0197] In an alternative procedure 600 for decommissioning the key 30 according to Fig. 8. If a user wants to decommission key 30 on site, the user presses a key decommissioning field 24 (see figure). Fig. 1) on the input and output devices 21, 22 in a process step 601. Furthermore, the user establishes the communication connection between the device 20 and the key 30 by means of the button 33 in a process step 602. The key 30 transfers the key ID 53 to the device 20 in a process step 603. In a process step 604, the device 20 sends a request A, together with the key ID 53, to the processing unit 10, requesting that the key 30 be decommissioned. The processing unit 10 processes request A in a process step 605. In doing so, the processing unit 10 checks whether the authorization role of the user who authenticated themselves in the device 20 allows the decommissioning of the key 30 or whether they are the key holder.If the authorization role permits the decommissioning of key 30, or if the administrator is the key holder, the computing unit 10 proposes to the administrator that decommissioning be allowed. If the administrator denies permission, procedure 600 terminates. If the administrator grants permission, the computing unit 10 sends the key configuration change message, here formatted as the key decommissioning command message 150, via device 20 to key 30 in procedure step 606, which is decrypted in key 30. The subsequent steps 607, 608, 609, and 610 correspond to procedure steps 504, 505, 506, and 507 from [reference missing]. Fig. 7.

[0198] In Fig. Figure 9 describes a method 700 for registering a new key holder and commissioning a new key in the locking system 100 according to the invention. In a method step 701, an administrator first adds a new key holder to the locking system 100 in the computing unit 10 by entering an identifier of the new key holder, e.g., their name or email address, using the input device 12. The administrator also assigns an authorization role 70, 71 to the new key holder via the input device 12 by selecting one of these roles. The computing unit stores the identifier of the new key holder and the authorization role 70, 71 as associated with each other.

[0199] In a second step (702), the new key holder is informed via message (91), e.g., an email, that they have been registered in the locking system (100) and can now define an authentication method for the application using their identifier. Once the key holder has selected an authentication method and, for example, set a password, they can then, in a process step (703), download the application to device 20 and authenticate themselves within the application. The transfer information from device 20, on which the key holder authenticated themselves within the application, is transferred to the processing unit (10) and associated with the key holder's identifier within the processing unit (10). This completes the key holder's registration.

[0200] As long as the key holder is authenticated in the open application using input device 21, the key holder can assign a new key 30. To do this, the key holder uses input device 21 in process step 704 to indicate that a new key 30 is to be assigned, for example, by using a key assignment field on output device 22. If the key holder is assigned to several locking systems 100, 101, 102, the key holder can select on output device 22 which locking system 100, 101, 102 the key 30 should belong to. This input indicating that a new key is to be assigned results in the device 20 subsequently establishing and maintaining a communication connection with the new key 30, even if no association between the key ID and the key holder's identifier is stored in the processing unit or in the device.

[0201] The key holder then activates button 33 of key 30 in process step 705. This transfers the key ID 53 of key 30 to device 20 in process step 706. The transfer occurs regardless of the authorization role 70, 71 held by the key holder.

[0202] In process step 707, the device 20 requests the processing unit to perform a picking operation (KS) on key 30 with key ID 53. The processing unit 10 checks whether key 30 with key ID 53 has already been picked. If not, in process step 708, the processing unit 10 associates key ID 53 with the identifier of the key holder sending the request. The processing unit 10 can then create the remaining digital representation of key 30 in the locking system 100, where further data for key 30 can be stored.

[0203] In process step 709, the computing unit 10 transmits configuration data to the key 30 via the device 20. The configuration data includes at least one cryptographic piece of information from the locking system 100. In process step 710, the key 30 receives the cryptographic information and deactivates cryptographic information that was stored in the key 30 during its manufacture.

[0204] Fig. Figure 10 shows the digital associations stored in the computing unit 10 in a pictorial, symbolic representation. Here, the key holder's identifier 92, the key holder's authorization role 70, 71, the key ID 53, and the transfer information TI 93 are digitally associated with each other. The association is represented by the double arrow. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] EP 2 821 970 A1

[0002] WO 2024 / 083878 A1

[0003]

Claims

[1] Locking system (100) with a physical key (30), with an electromechanical locking device (40) and with a computing unit (10), wherein the key (30) is designed to communicate with the locking device (40) via a first communication link, wherein the computing unit (10) comprises an electronic storage device, wherein a digital identifier (92) of a key holder (80-85) is stored in the memory, the following digital information is associated with the digital identifier (92) of the key holder (80-85) in the computing unit (10): • a digital representation of the key (30) of the key holder (80-85) with a key ID (53), • an authorization role (70, 71) to authorize actions of the key holder (80-85) in the locking system (100), wherein the computing unit (10) is configured to transfer a command message (50) for a configuration change of the locking device (40) to the key (30) of the key holder (80-85), whose authorization role (70, 71) allows a configuration change of a locking device (40), and / or wherein the computing unit (10) is configured to transfer a key configuration change message for a configuration change of the key (30), wherein the transfer of the key configuration change message is subject to the condition that the key holder (80-85) has authenticated or that a user other than the key holder (80-85), whose authorization role (70, 71) allows a configuration change of the key (30), has authenticated and / or Locking system (100) with a physical key (30), with an electromechanical locking device (40) and with a computing unit (100), wherein the key (30) is configured to communicate with the locking device (40) via a first communication link, wherein the computing unit (10) comprises an electronic memory, wherein in particular a digital identifier (92) of a key holder (80-85) and associated with it a key ID (53) of the key (30) is stored in the memory of the computing unit, wherein the locking system (100) is configured such that a prerequisite for the transfer of a command message (50) for the configuration change of the locking device (40) is that the key holder (80-85) authenticates himself, in particular at a device (20) of the locking system (100). [2] Locking system (100) according to claim 1, wherein the following digital information is associated with the digital identifier of the key holder (80-85): a transfer information of a device (93) via which the computing unit (10) communicates with the key (30), wherein the key (30) is configured to communicate with the device (20) via a second communication link, in particular wireless, wherein the device (20) is configured to communicate with the computing unit (10) via a third communication link. [3] Locking system (100) according to one of the preceding claims, wherein the configuration change of the locking device (40) corresponds to a commissioning of the locking device (40) or a digital maintenance of the locking device (40), in particular a decommissioning, a firmware update or an update of cryptographic encryption information and / or wherein the configuration change of the key (30) corresponds to a digital maintenance of the key (30), in particular a decommissioning, a firmware update or an update of cryptographic encryption information. [4] Locking system (100) according to one of the preceding claims, wherein the activation of the key (30) is independent of the user role (70, 71). [5] Locking system (100) according to one of the preceding claims, wherein, after the key (30) has received the command message (50) and when the key (30) next communicates with the locking device via the first communication link, the key (30) automatically commands the locking device (40) to perform the configuration change, and / or wherein, after the key (30) has received the key configuration change message, the key (30) automatically performs the configuration change. [6] Locking system (100) according to one of the preceding claims, wherein a first authorization role (70, 71) comprises authorizations for commissioning and decommissioning of the locking device (40) and / or the key (30) and a second authorization role (70, 71) comprises access authorizations for unlocking a physical area locked by the locking device, wherein the key (30) of the key holder (80-85) of the first authorization role (70, 71) and the key (30) of the key holder (80-85) of the second authorization role (70, 71) are mechanically identical. [7] Locking system (100) according to one of the preceding claims, wherein at least one user role (72, 73) is defined in the computing unit (10) for carrying out an administrative activity, wherein at least one identifier of a user is associated with the user role, wherein in particular at least one user role for carrying out a firmware update is stored in the computing unit (10) and wherein at least one identifier of a service employee is associated with the user role. [8] Method (700) for commissioning a physical key (30) in a locking system (100), wherein the locking system (100) is equipped with the physical key (30), with an electromechanical locking device (40) and with a computing unit (10), wherein the key (30) is designed to communicate with the locking device (40) via a first communication link, wherein the computing unit (10) comprises an electronic storage device, wherein a digital identifier (92) of a key holder (80-85) is stored in the memory, wherein a digital identifier (92) of the key holder (80-85) is associated with an authorization role (70, 71) to authorize actions of the key holder (80-85) in the memory, wherein in the procedure (700) the following digital information is associated in the computing unit (10) with a digital identifier (92) of the key holder (80-85): • a digital representation of the key holder's key (80-85) with a key ID (53). [9] Method (700) according to claim 8, wherein a key holder (80-85) authenticates himself in an application on a device (20), wherein the key ID (53) is then transferred via a second and third communication connection with the key (30) to the computing unit (10) via the device (20) and is associated with the identifier (92) of the key holder (80-85). [10] Method (700) according to claim 8 or 9, wherein, after the computing unit (10) has received the key ID (53), cryptographic information for the key (30) is transferred from the computing unit (10) to the key (30) via the device (20).

Images