METHOD FOR ACCESS CONTROLLING A GROUP OF PEOPLE USING MULTIPLE READERS AND MULTIPLE TOKENS

Description

[0001] The invention relates to a method for access control of a group of people by means of several readers and several tokens, as well as corresponding readers and tokens for carrying out the method.

[0002] Access control systems for securing buildings and facilities are known. These systems ensure that only individuals who can authenticate themselves to the access control system gain entry. To authenticate with an access control system, security tokens in the form of handy security or ID cards are often used, which must be held against a reader upon entry. Such a system is known, for example, from EP2624223 A3. For the readers to assign the tokens and grant access, the token must be identified by the reader. To identify themselves, the tokens send identifiers to the readers. This allows the readers to select the correct keys to decrypt the transmitted secrets, which comprise the token identifiers.

[0003] WO 2016 / 178081 A1 describes methods and devices for making access decisions in a secure access network. Access decisions are made by one or more portable credentials using data and algorithms stored on or received from two or more credentials. Because access decisions are made by the portable credential(s), non-networked or local hosts can be used, which do not necessarily need to be connected to a central access control system or database, thus reducing the costs of setting up and maintaining the secure access network.

[0004] DE 10 2014 105 246 A1 describes a locking unit for a housing, in particular for a container for objects, with at least two doors for locking respective housing openings, in particular compartments. The locking unit has a locking element module for each of the doors, comprising at least one locking element and a locking drive for actuating the locking element. The locking drive has a common drive element for the locking element modules, which is movable through an adjustment path and, in a first adjustment position, moves the locking element(s) for only one of the doors or only a first group of doors into an unlocked position, and in a second adjustment position, moves the locking elements for all doors into an unlocked position.Furthermore, a housing comprising such a locking unit and a method for unlocking one or more doors of such a housing are disclosed.

[0005] US Patent 2016 / 0035163 A1 describes methods, systems, and computer-readable media for tracking the positions of locking devices. A locking device comprises a wireless transceiver, a memory, an electronically controlled locking mechanism, a processor, and a position determination circuit configured to determine the position of the electronic locking device. The processor is configured to receive one or more position data elements indicating the position of the electronic locking device at one or more times, to store the one or more position data elements in the memory, and to transmit the one or more position data elements from the memory to a mobile device via the wireless transceiver.

[0006] The object of the invention is to create an improved method for access control of multiple persons using multiple readers and multiple authentication means, called tokens, wherein each person possesses a token. The access control method can preferably be used in protected or sensitive areas, for example, an industrial site, an office building, a factory, or similar areas and buildings with multiple entrances. According to the invention, this object is achieved by the method according to claim 1, the reader according to claim 11, the token according to claim 12, and the system according to claim 13.

[0007] Advantageously, according to one embodiment of the invention, the method is able to authenticate a person without sending a value from a token to a reader that is sufficient to identify a token.

[0008] The terms identification and authentication are used below. Identification refers to the assignment of an identity. For example, token identification is recognizing which token it is. The identification process is part of token authentication. Authentication refers to the recognition of properties, especially access rights to a protected object. This process grants a person access to the object.

[0009] Access to the protected area is granted once the person's token has successfully authenticated itself against a reader. This identification is necessary to verify the rights assigned to the token and, if necessary, compare them with stored permissions.

[0010] Furthermore, an authentication attempt refers to the successful or unsuccessful process of authenticating a token to a reader. The reason for authentication failure can include, for example, failed identification and / or other unspecified reasons.

[0011] The method is performed using one of the readers, the reader comprising internal memory, a processor, a wireless communication interface for wireless communication with a token, for example using radio frequency identification (RFID) or near field communication (NFC), and a control device for controlling locking devices, such as a turnstile, a lock, a barrier, a revolving door, or a security door. Furthermore, the method is performed using one of the tokens, which comprises non-volatile internal memory, a processor, and a wireless communication interface for wireless communication with the reader.

[0012] The reader's control mechanism activates the locking device when the reader grants release with respect to the token. The locking device includes, for example, a mechanical locking device such as the bolt of a turnstile or lock, or an electronic locking device such as a magnetic lock, an electric sliding door, a revolving door motor, or a compressor for the pneumatic locking of a pressure door.

[0013] The procedure can be used, for example, to control multiple access points to a building that many people enter and / or leave within a short period of time.

[0014] According to one embodiment of the invention, the method is used in a factory with shift work. At each shift change, a large number of people leave and enter the factory within a short period of time, which can quickly lead to queues forming at the entry points.

[0015] The use of the present method in a factory advantageously results in minimized waiting times for individual persons entering or leaving the factory, thereby minimizing the likelihood of queues forming at the factory's access points.

[0016] The token can be a portable device, such as a smartwatch, a chip or ID card, a USB stick, or a document, particularly a security or valuation document. In a particularly advantageous embodiment of the invention, the token is designed in a handy form. This handy form, among many other factors, enables rapid access for quickly verifying the identity of a large number of people. To prevent the need for frequent token replacement due to depleted batteries, the token can be battery-free. In this case, the token receives its operating voltage for the processor and the non-volatile internal memory from the reader via the wireless communication interface.

[0017] In embodiments of the invention, wireless communication between the reader and the token can be achieved via radio waves (RFID) or near-field communication (NFC) according to ISO 14443 or Bluetooth. The use of RFID or NFC advantageously ensures that the reader supplies power to the token and that the token is ready for use during every authentication attempt, independent of a battery.

[0018] According to one embodiment of the invention, the readers are distributed across several or all access points of the object to be controlled. It is possible for one or more entrances to be assigned the same or different security requirements. Areas with different security requirements are then assigned groups of readers, which require different access rights.

[0019] In a further embodiment of the invention, the readers are communicatively connected to a database. This connection can be established via the internet, a cable (LAN), or a wireless connection (WLAN). Using this communicative connection between the readers and the database allows for centralized token access control and centralized granting of access rights. The data stored on the readers' internal memory and / or in the non-volatile internal memory of the tokens can also be stored, and in particular mirrored, on the database. This advantageously results, on the one hand, in centralized and thus simplified data management, and on the other hand, in data security in the event that a token and / or a reader is damaged or if access to the respective internal memory is no longer possible for other reasons.

[0020] According to a further embodiment of the invention, the reading devices comprise sensors for capturing biometric data or an input device for entering a personal identification number (PIN).

[0021] In embodiments of the invention, the authentication method is carried out by a reader and a token and can be divided into four basic steps. Step A:

[0022] Sending identification features of the reader to the token. Step B:

[0023] Encrypting a secret and sending a return value from the token to the reader. Step C:

[0024] The reader identifies the token based on its return value. Step D:

[0025] Granting or denying access based on existing or missing access rights and controlling the locking mechanism.

[0026] The process is initiated as soon as the token is within the wireless communication range of the reader. According to the invention, this can be achieved, for example, by positioning the token within the wireless communication range of the reader, where the typical range of an exemplary RFID method is a few centimeters to a few meters. In such a method, the reader repeatedly sends out pulses which, as soon as a token is within the wireless communication range of the reader, are received by the token, causing the token to draw power from the transmitted wireless communication field, which is registered by the reader.

[0027] Once the reader detects that a token is within its wireless communication range, step A is performed. The reader transmits an initial value and a reader identification number (ID) via its wireless communication interface. The token receives the initial value and the reader's ID through its wireless communication interface.

[0028] According to the invention, the first value comprises a random number. The use of a random number advantageously increases the security of the method against an attacker who attempts to determine the locations of successful authentication of one or more specific tokens using "track and trace" techniques. Determining the authentication points of one or more specific tokens is made more difficult for the attacker because the attacker cannot know the first value, which comprises a random number, a priori.

[0029] According to the invention, the reader encrypts the first value with a symmetric key assigned to the reader and sends the first value thus encrypted to the token in step A.

[0030] Using the key assigned to the reader advantageously results in increased security of the procedure against an attacker who attempts to track a token using track & trace, since the attacker now needs to know the symmetric key of the reader to obtain the first value required to obtain the token's key, which would allow the token to be tracked.

[0031] Step B occurs after the first value is sent. In step B, the token receives the first value and the reader's ID via wireless communication through its wireless communication interface. The token identifies the reader using its processor by comparing the received ID with an ID stored in the token's non-volatile internal memory.

[0032] If, according to the invention, the first value has been encrypted and sent from the reader to the token, the token decrypts the first value using the symmetric key of the reader, which is stored together with the ID in the non-volatile internal memory of the token.

[0033] The first value is then encrypted using the symmetric key stored on and assigned to the token. The encrypted first value is then sent back to the reader via wireless communication through the wireless communication interfaces of both the token and the reader.

[0034] These embodiments of the invention are advantageous because sending the encrypted first value as the return value increases the security of the method against an attacker attempting to discover the token's authentication points using "track and trace." The attacker needs the token's symmetric key, in addition to the reader's symmetric key, to identify the token. This is because the token does not send its own identifying values, but rather encrypts the first value with the symmetric key that identifies the token. The token's identity is generally unknown, as the symmetric key is difficult to determine. Identifying the token is only possible once its symmetric key has been obtained.

[0035] According to the invention, the first value in step B comprises a random number and a shared secret between the reader and the token. In a further embodiment of the invention, the shared secret comprises an initial vector. In a further embodiment of the invention, the initial vector is prepended to the random number before encryption, in particular concatenated with it. In a further embodiment of the invention, the shared secret is synchronously modified during each authentication process in a method common to the reader and token, for example, according to a predefined pattern, in particular incremented, in order to change the shared secret after each use and thus further increase the security of the method.

[0036] The use of a shared secret advantageously increases the security of the process against an attacker attempting to track a token. The attacker would need to know the shared secret and, if applicable, the shared method used to synchronously modify it, in order to determine the identity or even the key of the token, which would not only allow the token to be tracked but also grant unauthorized access to the protected object.

[0037] Upon receiving the return value, the reader proceeds to step C. The reader attempts to decrypt the return value using the symmetric keys stored in its internal memory until a match is found between the return value and the initial value, or until all symmetric keys have been tried. If a match is found between the return value and the initial value, the token is identified by its key, as the reader can recognize the token based on the symmetric key that successfully decrypted the return value. This process can take varying amounts of time, depending on both the number and the storage location of the token's symmetric key within the reader's internal memory.If only a few keys need to be tried before the correct key is found, for example because the reader has only stored a few keys and / or used the correct key first, then the process time is short. However, if many keys need to be tried before the correct key is found, for example because the reader has stored many keys and / or used the correct key last, then the process time is long.

[0038] According to embodiments of the invention, such a search process can be shortened by assisting in the sorting of the symmetric keys in the reader's internal memory. By way of example, but not limited to, the keys could be sorted according to the "time of last successful authentication" or according to the applicable shift schedules of the employees using the tokens. In this embodiment of the invention, in addition to the token's symmetric key, information about when the token should be granted access is stored in the reader's internal memory. The sorting of the key list is then performed according to the next shift start time.

[0039] In a further embodiment of the invention, sorting is performed according to the frequency with which inputs are used, particularly in the case of an object to be protected with multiple inputs that require the same security rights. The aforementioned various sorting options can also be combined as desired, whereby the individual sorting parameters can have different priorities.

[0040] If the random number in step B was combined with the shared, common secret according to a said embodiment of the invention, the reading device does not compare the decrypted first value with the transmitted first value, but rather the decrypted first value without the shared, common secret with the transmitted first value.

[0041] Step D is performed upon verification that the decrypted return value matches the initial value. If the token is successfully authenticated, access is granted. The reader then communicates with the locking mechanism via the control device, which enables access.

[0042] In a further embodiment of the invention, access is granted after verification of the token's access rights. The token's access rights can be stored in the reader's internal memory, in a database with which the reader is communicatively connected, or in the token's non-volatile internal memory. Furthermore, the access rights can encompass authorizations for different security levels and / or different areas of the object to be protected.

[0043] Using the access rights assigned via the token offers the advantage of granting access rights to different groups of people within the protected area. For example, but not limited to, this could include doctors and cleaning staff in a hospital, or employees and visitors in a research institute. A first group of people, a, might be granted access rights to a first area, A. A second group of people, b, might be granted access rights to a second area, B. Areas A and B can be spatially separated or partially or completely overlapping. If, for example, area A completely encloses area B, and A is larger than B, then the second group of people, b, has full access to area A, since area B lies within area A.The first group of people a, however, does not have access to area B, but only to the shared area A.

[0044] In a further embodiment of the invention, the reader and / or the token includes an input device for entering a personal identification number (PIN) of a token holder. The input device can be a keyboard, a touchpad, a numeric keypad, a touchscreen, or something similar, such as a voice input device. Access to the protected object is granted after successful verification of the PIN entered on the input device of the reader and / or the token. The token holder's PIN is stored for verification in the internal memory of the reader, in a database with which the reader is communicatively connected, and / or in the non-volatile internal memory of the token.

[0045] In another embodiment, the reader and / or the token includes a sensor for capturing biometric characteristics of the token holder. The sensor includes, for example, an optical system, in particular a camera, a fingerprint sensor, a retina or iris scanner, a sensor for capturing facial geometry, a sensor for capturing hand geometry, a sensor for capturing palm ridge structure, a sensor for capturing hand vein structure, a sensor for capturing ear shape, a microphone for capturing voice, a DNA sensor, or a combination of the aforementioned sensors. Access to the protected object is granted after successful verification of one or more biometric characteristics of the token holder.The biometric characteristics of the token holder are stored for comparison in the internal memory of the reader, in a database with which the reader is communicatively connected, and / or in the non-volatile internal memory of the token.

[0046] Using the PIN and / or biometric characteristics of the token holder as a verification criterion for access control advantageously increases the security of the process against token forgery. Attackers would not only need to possess a potentially forged or stolen token, but also know the token holder's PIN and / or imitate the token holder's biometric characteristics to gain access to the protected area. The authentication thus becomes multi- or two-factor authentication.

[0047] In a further embodiment of the invention, the reader and / or the token has an interface for communication with external devices. Such an interface comprises a wireless communication interface or a wired interface, in particular, but not limited to, a USB port. Using such an interface, additional conditions of the object to be protected, which may serve as a criterion for a person's access, can be verified.

[0048] In a further embodiment of the invention, special conditions of the object to be protected, such as in a nuclear power plant, may occur. For example, a reader in the reactor area may have an interface for communication with a dosimeter and grant access, regardless of the person, only if a radiation value detected by a dosimeter is below a defined threshold.

[0049] By using data from external devices as an access criterion, conditions independent of persons and / or specific to the object to be protected will also be used as access control criteria.

[0050] In further embodiments of the invention, environmental conditions and / or the physiology of the token holder, for example the pulse and blood pressure, are recorded by means of a smartwatch.

[0051] Using a database with which the readers are communicatively connected offers the advantage of simplified management of access rights, PINs, and / or biometric data of a token holder. Furthermore, using the database eliminates the need to initiate a token on each reader individually, but only on a single reader. The exchanged secrets are then available to every reader within the network of readers and the database via the database. Additionally, access rights for a single token or a group of tokens can be quickly modified. For example, a group of employees who must perform a specific task or work a particular shift can be granted special rights. This could include, for instance, workers in a factory on the night shift, although not all workers are authorized to work the night shift.In particular, if the night shift only takes place according to production needs, access rights can be granted to workers with night shift permits. Furthermore, a central change or administration office can be operated to simplify access control management.

[0052] In another aspect, the invention relates to a method for pairing a token with a reader. The token, and optionally the token holder, must identify and authenticate themselves to the reader via a security anchor. This identification and authentication of the token holder is carried out via a trust anchor, which may, for example, comprise a certificate or the presentation of a security document, in particular an identity card of the token holder, to an authority responsible for access control.

[0053] By using the trust anchor, the token is able to grant read and write rights to reading devices, provided that the token holder has identified and authenticated themselves to the access control system.

[0054] During the pairing process, the token's symmetric key, the reader's ID, and, if applicable, the reader's symmetric key and the shared secret between the token and the reader are exchanged and stored in the token's non-volatile internal memory and the reader's internal memory or database, respectively.

[0055] For pairing a token with a reader, it is advantageous that the definition of the access control parameters can be outsourced from peak hours. This allows for an increased security factor during the pairing process, which is accompanied by more time-consuming computation. At the same time, outsourcing the definition of the access control parameters minimizes the disruption to access control for many people during peak hours, since no pairing takes place during this time. In a further embodiment of the invention, the pairing period can be freely selected, so that each token holder can decide when to pair their token with a reader.

[0056] The exchange of symmetric keys, the ID, and the shared secret is performed using an asymmetric cryptographic method. This cryptographic method includes, but is not limited to, terminal authentication and / or chip authentication.

[0057] In the terminal authentication process, the token is designed so that it only releases specific data for reading and / or writing if the reading device can prove explicit read or write authorization for precisely that data. To enable the token to verify this authorization, it stores a corresponding root certificate. This certificate forms the root of the PKI (Public Key Infrastructure), a hierarchy of authorization certificates for reading and writing sensitive data to the token.

[0058] In terminal authentication, the reader sends its read and write permissions to the token in the form of a certificate or a chain of certificates. The token verifies the authenticity and integrity of the transmitted certificates.

[0059] For the verification to be successful, all submitted certificates must be signed with the secret key of their predecessor, starting with a certificate derived from the root certificate. The token can verify this because the root's public key is stored in the token's non-volatile, internal memory during personalization.

[0060] Once the authenticity and integrity of the certificates sent by the reader have been successfully verified, the token must still ensure that the last transmitted certificate was indeed issued for that reader. Therefore, the token sends a random number to the reader, which signs it with the secret key belonging to the last transmitted certificate. The reader then sends the signed random number back to the token. Using the reader's public key, which is contained in the last transmitted certificate, the token can verify the signature of the random number and thus determine whether the reader possesses the secret key corresponding to the certificate. This proves the reader's authenticity to the token, and the read and write permissions requested in the certificate are granted by the token.

[0061] Chip authentication establishes a secure connection between a token and a reader. Each token that supports chip authentication stores a key pair specific to that token. This key pair consists of a private and a public key. The private key is stored in a specific area of ​​the token's non-volatile internal memory, from which it cannot be read. The token's public key is either known to the reader or is extracted from the token, provided it has been signed by a trusted authority. This signature allows the reader to verify the authenticity of the token's public key through "passive authentication."If a new key pair had been generated for a "cloned" token, this would be noticeable during passive authentication, since the public key is protected against unnoticed changes by a digital signature.

[0062] The reader also generates its own key pair, consisting of a public and a private key, for each read operation and sends its public key to the token. Both the token and the reader can then calculate the same secret key from their own private key, the other's public key, and a random number. This secret key ensures strong encryption of the data in subsequent communication between the token and the reader. Using the shared secret key, the reader can then verify that the token possesses the correct private key.

[0063] A "cloned" token cannot possess the original private key. If it were to simply use a different private key, the derived "shared" secret would not be identical, and the reader and the token would use different keys for the secure connection, causing communication to fail.

[0064] According to one embodiment of the invention, the access rights of the token are determined during the pairing process and / or, in another embodiment of the invention, are exchanged between the token and the reader during the pairing process.

[0065] In a further embodiment of the invention, the pairing process must be repeated after a time T' and / or after a certain number n' of authentication attempts of the token. The re-execution of the pairing process is initiated by the reader or the token. In a further embodiment of the invention, the pairing process between the token and the reader is repeated even if the pairing of the token and the reader is still valid.

[0066] Repeatedly pairing the token with the reader advantageously results in the regular setting of new parameters and regular verification of the token-token owner pairing. This, in turn, makes it more difficult for attackers to determine the token keys, as the symmetric key changes regularly.

[0067] In a further embodiment of the invention, one or more random numbers are generated in the reader before a token is brought within the wireless communication range of the reader. The first value, which comprises the random number and optionally the shared secret, is then encrypted using the token's symmetric key and stored in the reader's internal memory or in a database. This creates a list of encrypted first values, containing the encrypted first value for each token paired with the reader. In step C, the reader can then identify the corresponding token by comparing the token's return value with the encrypted first value in the reader's internal memory or the database, without having to decrypt the return value.

[0068] Comparing the returned value with the encrypted initial value from the reader's internal memory or the database advantageously minimizes the computational effort required by the reader's processor during verification and evaluation. Consequently, a large number of individuals can be authenticated within a short time, especially during peak periods.

[0069] In a further embodiment of the invention, the same random number is used until all tokens have used this random number for an authentication attempt and / or a time T has elapsed and / or a number n of authentication attempts have been made by a reader and / or a token has used the same random number a second time for identification. In embodiments of the invention, for example, but not limited to, T is on the order of one day or one week and n is on the order of 100 or 1000. The exact duration T and the exact number n are adjustable depending on the object to be protected and the expected number of people to be granted access. According to further embodiments of the invention, additional conditions, not listed here, that trigger the use of a new random number can be applied.

[0070] By using a random number for multiple tokens until one of the predefined conditions is met, the encryption for all tokens advantageously only needs to be pre-calculated for a single initial value. This reduces resource consumption, particularly by lowering the processing power and time of the reader's processor. Only when one of the predefined conditions is met is a new random number used. If the random number were to change every time a token was successfully identified, the initial value would have to be calculated for every token paired with the reader after each successful identification. This would result in an enormous computational burden, especially during peak times.

[0071] In a further embodiment of the invention, the identification of the token is repeated if the token has been identified a second time with the same random number.

[0072] Repeating the token identification process each time it identifies itself with the same random number has the advantageous advantage that an attacker who knows the return value of a token for a given random number cannot wait for that random number to be used again and / or cannot copy the return value to gain access. Since the identification is repeated, an attacker would also need to know the next return value.

[0073] In a further embodiment of the invention, several lists are pre-calculated which include encrypted first values ​​based on different random numbers.

[0074] Pre-calculating multiple lists of encrypted values ​​advantageously allows the reader to use a new random number when needed, without having to calculate an encrypted initial value for each token paired with the reader. Such a need might arise if all random numbers in a list have been used, or if the random number is changed for other reasons, and authentication attempts are still pending. The reader can then proceed to use the next random number, and thus the next list, without re-pre-calculating. This avoids a situation where the reader no longer has any pre-calculated random numbers stored.

[0075] In a further embodiment of the invention, the lists are pre-calculated when no authentication attempts are currently taking place and / or the entire system is operating outside of peak hours within a defined timeframe. This could be, for example, at night or during shifts, but is not limited to this. A further condition for pre-calculating lists is a depletion of the list supply. If the number of pre-calculated lists reaches a lower threshold, the reader begins to pre-calculate new lists, provided no authentication attempts are taking place.

[0076] Pre-calculating the lists under the aforementioned conditions advantageously means that the encryption and decryption of the first value does not occur during authentication, but rather is performed beforehand by the reader. The lists are not calculated during peak times, thus reducing the likelihood of high processing load for the reader's processor during peak hours. This, in turn, reduces the probability of long waiting times for individuals being checked.

[0077] The embodiments of the invention will now be explained in more detail with reference to the drawings. These show: Figure 1: An exemplary procedure for authenticating a token to a reader as a schematic flowchart; Figure 2: A schematic flowchart of a procedure in which the reader sends the first value W encrypted to the token; Figure 3a: A schematic setup and the components of a reader and a token; Figure 3b: Schematic connections of a reader with a token and a database or a central access management system, which is connected to other readers; Figure 4a: A schematic flowchart of a procedure for determining lists of encrypted random numbers before an authentication process; Figure 4b: A schematic flowchart of a procedure for determining whether or not a next random number needs to be determined; Figures 5a and 5b: Schematic flowcharts of variants of step C in which a reader identifies a token based on the return value.Figure 6 shows a schematic flowchart of step D, in which the locking device is controlled under different conditions.

[0078] Figure 1 Figure 1 shows a flowchart illustrating the authentication process of a token 50 against a reader 10. After pairing the token 50 with the reader 10, the reader 10 transmits its ID and an initial value W in step A via a wireless communication interface 16 of the reader 10, whereupon a wireless communication interface 56 of the token 50 receives the ID and the initial value W (S110). In step B, the token 50 identifies the reader 10 based on the received ID by matching the received ID with the IDs of readers 10, 10a, 10b, 10c, 10d, etc., stored in a non-volatile internal memory 54 of the token 50 (see Figure 110). Fig. 3b ) is compared (S120) until a match is found between the received ID and a stored ID.

[0079] Token 50 then encrypts the first value W with a symmetric key SK, which is assigned to token 50. The return value ENC(W, SK) is generated, whereby the first value W is encrypted by the processor 52 of token 50 to the return value ENC(W, SK) (S122). Finally, token 50 sends the return value ENC(W, SK) via its wireless communication interface 56 to the wireless communication interface 16 of the reader 10 (S124). In step C (S130), the reader 10 searches its internal memory 14 for a key SK until it identifies token 50. It then attempts to decrypt the return value ENC(W, SK) until a matching key SK is found and the decrypted return value DEC(ENC(W, SK), SK) corresponds to the first value W. The decryption of the return value ENC(W, SK) is performed by the processor 12 of the reader 10.If the first value W is obtained from the return value ENC(W, SK) by decryption, the reader 10 grants access to the token 50 (S140) and controls the locking device 30 accordingly in a step D by means of the control device 18 (S150).

[0080] Figure 2The diagram shows a flowchart. Before reader 10 sends its ID and the first value W to token 50, reader 10 encrypts the first value W with a symmetric key SK', which is assigned to reader 10 (S208). This results in the encrypted first value ENC(W, SK'). This encrypted first value ENC(W, SK') is sent to token 50 (S210). In step B, token 50 identifies reader 10 using the transmitted ID (S220) and decrypts the encrypted first value ENC(W, SK') with the key SK', which is stored in the internal memory 54 of token 50 (S221). Token 50 thus receives the first value W. Now, token 50 encrypts the first value W with a symmetric key SK, which is assigned to token 50, resulting in the return value ENC(W, SK) (S222). The return value ENC(W, SK) is sent to reader 10 (S224). Steps C and D are analogous to steps C and D of the Figure 1(cf. S130, S240 and S150 with S230, S240 and S250).

[0081] Figure 3a Figure 10 schematically shows the structure of a reader 10 and a token 50. The reader 10 comprises a processor 12 for generating and encrypting a random number RN and for decrypting a return value ENC(W, SK), a control device 18 for controlling a locking device 30, an internal memory 14 in which the symmetric keys SK of the tokens 50 paired with the reader are stored, and a wireless communication interface 16 for communication with the token 50.

[0082] The token 50 comprises a processor 52 for decrypting an encrypted first value ENC(W, SK') and for encrypting the return value ENC(W, SK), a non-volatile internal memory 54 on which the IDs of the readers 10, 10a, 10b, 10c, 10d (see Fig. 3b) and, if applicable, the corresponding keys SK' are stored, and a wireless communication interface 56 for communication with the reader 10. The wireless communication interface 16 of the reader 10 and the wireless communication interface 56 of the token 50 are configured to communicate with each other. Furthermore, the control means 18 of the reader 10 is able to control the locking means 30.

[0083] In a further embodiment of the invention, the processor 12 of the reader 10 and the processor 52 of the token 50 comprise one or more processor cores and / or several co-processors.

[0084] Figure 3bFigure 10 shows a reader connected to a database 100 or an access control system. Further readers 10a, 10b, 10c, and 10d are connected to the database 100 or the central access control system. The number of readers is not fixed and is shown here only as an example.

[0085] Figure 4aFigure 1 shows part of an authentication method in which initial values ​​W, comprising a random number RN, are stored in lists prior to an authentication process. First, the reader 10 checks whether an authentication attempt is currently pending. If not, a further embodiment of the invention allows verification of whether the current time t lies within a defined time interval between t1 and t2, with t2 following t1. The time t can be determined either by a clock implemented in the reader 10 or received from database 100, the central access control system, or another unspecified source. If the method according to the invention is applied in a factory, for example, t1 is the time after the end of the last shift of a day, and t2 is the time before the start of a shift of the following (working) day.

[0086] If the reader 10 is within such a time interval, a further embodiment of the invention allows a check to be performed to determine whether the number of available lists NL of encrypted first values ​​ENC(W, SK) is less than the number of a threshold value N th of encrypted first values ​​ENC(W, SK). If the number of available lists NL is less than a threshold value N th of encrypted first values ​​ENC(W, SK), a new random number RN is generated. The random number RN is then, optionally combined with the common secret shared between the token 50 and the reader 10, encrypted as the first value W with all keys SK, wherein the symmetric keys SK are each assigned to a token 50 paired with the reader 10. The resulting encrypted first values ​​ENC(W, SK i ) are then stored as a list. It is then checked whether a current authentication attempt is present.If an authentication attempt is currently pending, or if the current time t is outside the specified time interval between t1 and t2, or if the number of lists NL of encrypted first values ​​ENC(W, SK) is greater than the threshold of lists N th of encrypted first values ​​ENC(W, SK), then the reader 10 waits for the start of an authentication process with a token 50.

[0087] Figure 4bFigure 1 shows part of the method of a further embodiment of the invention. It checks which of the lists or which random number RN should be used by a reader 10 to identify token 50. Once the identification of token 50 is initiated, it is checked whether the last used random number RN has already been used with token 50. If this is not the case, it is checked whether the number n RN,j of authentication attempts with the random number RN is less than the number n of permissible authentication attempts with a random number RN. If this is also not the case, it is checked whether the time T' since the first use of the random number RN is less than a specified time T. If this is also not the case, the authentication of token 50 can begin with step A.If the last used random number RN with the token 50 has already been used, or if the time T' since the first use of the random number RN is greater than a permissible time T, or if the number n RN,j of uses of the random number RN is greater than a permissible number n of uses of the random number RN, then the next random number RN or the associated list is used to identify the token 50.

[0088] Figure 5aFigure 1 shows step C (S130, S230), in which the reader 10 searches for the correct symmetric key SK to identify token 50. In step B, token 10 sends the return value ENC(W, SK) to the reader 10. This return value ENC(W, SK) is decrypted by the reader 10 using an initial key SK i, where the counter i is initially 0, and the decrypted return value DEC(ENC(W, SK), SK i ). If the decrypted return value DEC(ENC(W, SK), SK i ) is equal to the initial value W, then the key SK i, or the identity i, can be assigned to token 50. Token 50 is thus identified. If the decrypted return value DEC(ENC(W, SK), SK i ) is not equal to the initial value W, then i is incremented by 1, and the reader 10 decrypts the return value using the key SK i+1 . Then it is checked again whether the decrypted return value DEC(ENC(W, SK), SK i ) corresponds to the first value W sent.

[0089] This process continues until either all keys SK have been tried or token 50 has been identified. The procedure then continues with step D. If no match can be found between the return value ENC(W, SK) and any of the symmetric keys SK, token 50 has failed to identify itself successfully, and the reader 10 denies access and does not activate the locking device 30.

[0090] Figure 5b Figure 1 shows another variant of the procedure for authenticating token 50 by the reader 10, corresponding to step C (S130, S230). The return value ENC(W, SK) that the reader 10 receives from token 50 is compared with the encrypted first values ​​ENC(W, SK) of a list stored in the internal memory 14 of the reader 10. Similar to the procedure that Figure 5aThe reader increments the counter i until the return value ENC(W, SK) matches the corresponding encrypted value ENC(W, SK i). If this is the case, token 50 is identified. The procedure continues with step D. If no match between the return value ENC(W, SK) and one of the symmetric keys SK can be found, token 50 has not successfully identified itself, and the reader 10 denies access and does not activate the locking device 30.

[0091] Figure 6A process is illustrated using a flowchart, which corresponds to a variant of sub-steps S140, S240 and S150, S250. If the reader 10 has successfully identified the token 50 in step C, the access rights assigned to token 50 are first determined. These access rights are stored either in the internal memory 14 of the reader 10, in the non-volatile internal memory 54 of token 50, or in a database 100 or a central access control system with which the reader 10 is communicatively connected. If access rights exist for token 50 for the entrance where the reader 10 is located, a check is performed to see if a PIN entered on the reader 10 or on token 50 matches a stored PIN assigned to token 50. The PIN is stored either in the internal memory 14 of the reader 10, in the non-volatile internal memory 54 of the token 50, or in a database 100 or 100.The biometric data of the token holder is stored in a central access control system with which the reader 10 is communicatively connected. If the entered PIN matches the stored PIN, the biometric data of the token holder is compared with the stored biometric data assigned to the token. The biometric data is stored either in the internal memory 14 of the reader 10, in the non-volatile internal memory 54 of the token 50, or in a database 100 or a central access control system with which the reader 10 is communicatively connected. If this verification is also successful, the reader controls the locking device 30 using the control device 18 and grants access. If any of the previous verifications fail, the reader 10 denies the token holder access.

[0092] Figure 7Figure 1 shows a flowchart illustrating the pairing process between token 50 and reader 10. When the token is brought within the wireless communication range of reader 10's wireless communication interface 16, either reader 10 sends a pairing request to token 10 (S310) or token 50 sends a pairing request to reader 10. The token holder then authenticates themselves to reader 10 (S320). This authentication can be performed, for example, by verifying an identity card or by visual inspection by a central access control system. In various embodiments of the invention, the authentication process can be arbitrarily complex and adapted to the security requirements of the object being protected.

[0093] If the token holder has successfully authenticated with reader 10, reader 10 sends its ID and, if applicable, its key SK' to token 50 (S330). Token 50 stores the ID and key SK' in its non-volatile internal memory 54 (S340) and then sends its key SK to reader 10 (S350). The reader stores the key SK in its internal memory 14 or, if reader 10 is connected to a database 100 or a central access control system, in a memory of the database 100 or the central access control system.

[0094] In a further embodiment of the invention, a shared, common secret is agreed upon and exchanged between the token 50 and the reader 10 during the pairing process. LIST OF REFERENCE SIGNS

[0095] 10: Reader 12: Processor 14: Reader's internal memory 16: Wireless communication interface 18: Control device 30: Locking device 50: Token 52: Processor 54: Memory 56: Wireless communication interface 100: Database S110: Sending the first value W and the reader ID from the reader to the token S120: Identifying the reader using the ID by the token S122: Encrypting W with symmetric key SK by the token S124: Sending the encrypted first value as a return value from the token to the reader S130: Reader searches for a key to identify the token S140: Reader grants / denies token access S150: Reader controls locking device S208: Reader encrypts the first value W with symmetric key SK' S210: Sending the first value W and the reader ID from the reader to the token S220: Identifying the reader using the ID by the token S221: Token decrypts encrypted first value W with SK' S222: Encrypts Wwith symmetric key SK via token S224: Sending the encrypted first value as the token's return value to the reader S230: Reader searches for a key to identify the token S240: Reader grants / denies token access S250: Reader activates locking mechanism S310: Reader sends an initialization request to the token S320: Token holder authenticates to the reader S330: Reader sends ID + key SK' to the token S340: Token stores ID and key SK' S350: Token sends key SK to the reader S360: Reader stores key SK DEC(ENC(W, SK), SK i ): decrypted return value ENC(W, SK): return value, encrypted first value ID: Reader identification number NL : count N th : threshold PIN: Personal identification number RN: random number SK: key SK': key T: time t: time T': time W: first value

Claims

1. A method for access control of a group of persons by means of a plurality of readers (10) and a plurality of tokens (50), wherein the readers (10) each have a processor (12), an internal memory (14), a wireless communication interface (16) for wireless communication with the tokens (50) and a control means (18) for actuating a locking means (30), wherein each reader (10) is assigned an identification number (ID) identifying the respective reader (10), wherein the tokens (50) each have a processor (52), a non-volatile, internal memory (54) and a wireless communication interface (56) for wireless communication with the readers (10), wherein a symmetric key (SK) is stored in each of the non-volatile, internal memories (54) of the tokens (50) and is assigned to the respective token (50), wherein the tokens (50) are paired with the readers (10), wherein the identification numbers (ID) of the readers (10) which are paired with the respective token (50) are respectively stored in the non-volatile, internal memories (54) of the tokens (50), and wherein the symmetric keys (SK) of the tokens (50) which are paired with the respective reader (10) are respectively stored in the internal memories (14) of the readers (10), wherein for pairing the token (50) with the reader (10) in a pairing process, the symmetric key (SK) that is assigned to the reader (10) and the identification number (ID) of the reader (10) are exchanged between the reader (10) and the token (50), wherein the pairing process is initiated by the reader (10) or the token (50), wherein the access control method comprises authenticating one of the tokens (50) by one of the readers (10), wherein the reader (10) is paired with the token (50), wherein the authenticating comprises the following steps: - recognising by the reader (10) that the token (50) is within wireless communication range of the reader (10), - sending the identification number (ID) of the reader (10) and an encrypted first value (W) from the reader (10) to the token (50) by means of the wireless communication via the wireless communication interfaces (16, 56) of the reader (10) and the token (50), wherein the first value (W) comprises a random number (RN), - identifying the reader (10) by the token (50) by means of the processor (52) of the token (50) using a comparison of the identification number (ID) of the reader (10) sent to the token (50) with the identification numbers (ID) of the readers (10), with which the token (50) is paired, stored in the non-volatile, internal memory (54) of the token (50), - generating a return value (ENC(W, SK)) by the token (50), wherein the return value (ENC(W, SK)) comprises the first value (W) encrypted, wherein the encryption of the first value (W) is performed by the processor (52) of the token (50) with the symmetric key (SK) identifying the token (50) and the symmetric key (SK) is stored in the non-volatile, internal memory (54) of the token (50), - sending the return value (ENC(W, SK)) from the token (50) to the reader (10) by means of wireless communication via the wireless communication interfaces (16, 56) of the reader (10) and the token (50), - identifying the token (50) by the reader (50) using the return value (ENC(W, SK)) by the processor (12) of the reader, wherein the reader (10) tries, one by one, the symmetric keys (SK) stored in the internal memory (14) of the reader (10) in order to decrypt the return value (ENC(W, SK)), wherein each symmetric key (SK) is in each case uniquely assigned to a token (50) paired with the reader (10), until a decrypted return value (DEC(ENC(W, SK), SK)) corresponds to the first value (W) sent to the token (50), - actuating the locking means (30) by the reader (10) by means of the control means (18) of the reader (10) under the condition that the identification of the token (50) was successful, wherein the readers (10) are each assigned one of the symmetric keys (SK'), wherein the symmetric keys (SK') of the readers (10), which are paired with the respective token (50), are respectively stored in the non-volatile, internal memories (54) of the tokens (50), wherein before the identification number (ID) and the first value (W) are sent from the reader (10) to the token (50) paired with the reader, the first value (W) is encrypted by the reader (10) by means of the processor (12) of the reader (10) with the symmetric key (SK') assigned to the reader (10), wherein the encrypted first value (W), after being received by the token (50), is decrypted by the token (50) using the symmetric key (SK') of the reader (10) which is assigned to the reader (10) and stored in the non-volatile, internal memory (54) of the token (50), wherein the decryption of the first value (W) is performed by the processor (52) of the token (50), wherein a shared, common secret is stored in the internal memory (14) of the reader (10) and in the non-volatile, internal memory (54) of the token (50), wherein the shared, common secret and the random number (RN) are jointly encrypted as a combined first value (W) by the processor (52) of the token (50) and generate the return value (ENC(W, SK)).

2. The method according to claim 1, wherein individual access rights are assigned to each token (50), wherein the access rights are stored in the non-volatile, internal memory (54) of the token (50) and the token (50) sends the access rights in encrypted form to the reader (10), or wherein the access rights are stored in the internal memory (14) of the reader (10) or in a database (100) to which the reader (10) is communicatively connected, wherein the reader (10) verifies the access rights of the token (50) before actuating the locking means (30) by means of the control means (18) of the reader (10) and the successful verification of the access rights is a further prerequisite for actuating the locking means (30) by the reader (10) by means of the control means (18) of the reader (10).

3. The method according to any one of the preceding claims, wherein a successful verification of biometric features of a token holder is a further prerequisite of the actuation of the locking means (30) by the reader (10) by means of the control means (18) of the reader (10), wherein the biometric features of the token holder are detected by a sensor means for detecting biometric features and the verification is performed by a comparison of stored biometric features of the token holder with the detected biometric features, wherein - the sensor means for detecting biometric features is comprised by the token (50), the stored biometric features of the token holder are stored in the non-volatile, internal memory (54) of the token, and the comparison of the detected biometric features with the stored biometric features is performed by the processor (52) of the token (50), wherein the result of the verification is sent encrypted to the reader (10) by means of the wireless communication; or - the sensor means for detecting biometric features is comprised by the token (50), the stored biometric features of the token holder are stored in the internal memory (14) of the reader (10) or in a database (100) to which the reader (10) is communicatively connected, wherein the detected biometric features are sent in encrypted form from the token (50) to the reader (10) by means of wireless communication and the comparison of the detected biometric features with the stored biometric features is carried out by the processor (12) of the reader (10) after the token (50) has been successfully identified by the reader (10); or - the sensor means for detecting biometric features is comprised by the reader, the stored biometric data is stored in the non-volatile, internal memory (54) of the token (50), and the comparison of the detected biometric features with the stored biometric features is performed by the processor (12) of the reader (10), wherein the stored biometric features are sent in encrypted form from the token (50) to the reader (10) by means of wireless communication; or - the sensor means for detecting biometric features is comprised by the reader, the stored biometric features are stored in the internal memory (14) of the reader (10) or in a database (100) to which the reader (10) is communicatively connected, and the comparison of the detected biometric features with the stored biometric features is performed by the processor (12) of the reader (10) after the token (50) has been successfully identified by the reader (10).

4. The method according to any one of the preceding claims, wherein a successful verification of a personal identification number of the token holder is a further prerequisite of the actuation of the locking means (30) by the reader (10) by means of the control means (18) of the reader (10), wherein the personal identification number of the token holder is detected by a sensor means for detecting identification numbers and the verification is performed by a comparison of a stored personal identification number of the token holder with the detected personal identification number, wherein - the sensor means for detecting identification numbers is comprised by the token (50), the stored personal identification number of the token holder is stored in the non-volatile, internal memory (54) of the token, and the comparison of the detected personal identification number with the stored personal identification number is performed by the processor (52) of the token (50), wherein the result of the verification is sent in encrypted form to the reader (10) by means of the wireless communication; or - the sensor means for detecting identification numbers is comprised by the token (50), the stored personal identification number of the token holder is stored in the internal memory (14) of the reader (10) or in a database (100) to which the reader (10) is communicatively connected, wherein the detected personal identification number is sent in encrypted form from the token (50) to the reader (10) by means of wireless communication and the comparison of the detected personal identification number with the stored personal identification number is carried out by the processor (12) of the reader (10) after the token (50) has been successfully identified by the reader (10); or - the sensor means for detecting identification numbers is comprised by the reader, the stored personal identification number is stored in the non-volatile, internal memory (54) of the token (50), and the comparison of the detected personal identification number with the stored personal identification number is performed by the processor (12) of the reader (10), wherein the stored personal identification number is sent in encrypted form from the token (50) to the reader (10) by means of wireless communication; or - the sensor means for detecting identification numbers is comprised by the reader, the stored personal identification number is stored in the internal memory (14) of the reader (10) or in a database (100) to which the reader (10) is connected, and the comparison of the detected personal identification number with the stored personal identification number is performed by the processor (12) of the reader (10) after the token (50) has been successfully identified by the reader (10).

5. The method according to any one of the preceding claims, wherein for pairing the token (50) with the reader (10) in the pairing process, the common secret shared between the reader (10) and the token (50) is exchanged between the reader (10) and the token (50).

6. The method according to any one of the preceding claims, wherein the symmetric key (SK) assigned to the token, the symmetric key (SK') assigned to the reader, the identification number (ID) of the reader (10) and / or the common secret shared between the reader (10) and the token (50) are negotiated in the pairing process by means of the wireless communication and using asymmetric cryptographic methods by means of the wireless communication, and / or wherein the pairing process of the token (50) with the reader (10) must be performed again when a fixed time T has elapsed since the previous pairing and / or a fixed number (n) of authentication attempts have been performed with the tokens (50).

7. The method according to any one of the preceding claims, wherein one or more random numbers (RN) are determined by the reader (10) in a step preceding the sending of the first value (W), and for each token (50) paired with the reader (10) the at least one first value (W) is stored in encrypted form in the internal memory (14) of the reader (10), wherein each first value (W) comprises one of the random numbers (RN).

8. The method according to claim 7, wherein the determination of the one or more random numbers (RN) and the storing of the at least one encrypted first value (W) for each token (50) paired with the reader (10) in the internal memory (14) of the reader (10) takes place in a fixed time window and / or at a time when no authentication attempts are performed.

9. The method according to any one of the preceding claims, wherein the reader (10) uses the random number (RN) for the access control method, until the same random number (RN) is used a second time for the identification of the token (50) and / or until all tokens (50) paired with the reader (10) have used this random number (RN) for an authentication attempt and / or until a time (T') has elapsed and / or until a predetermined number (n') of authentication attempts has been carried out with the random number (RN) and then a new random number (RN) is used for the access control method.

10. The method according to claim 9, wherein if the same random number (RN) is used for the identification of the token (50) for the second time, the identification of the token (50) is repeated with the new random number (RN).

11. A reader (10) for access control of a group of persons by means of a plurality of tokens (50), wherein the reader (10) comprises a processor (12), an internal memory (14), a wireless communication interface (16) for wireless communication with the tokens (50) and a control means (18) for actuating a locking means (30), wherein the reader (10) is assigned an identification number (ID) identifying the reader (10), wherein the tokens (50) are paired with the reader (10), wherein the identification number (ID) of the reader (10) paired with the respective token (50) is respectively stored in the non-volatile, internal memories (54) of the tokens (50), and wherein the symmetric keys (SK) of the tokens (50) paired with the reader (10) are stored in the internal memory (14) of the reader (10), wherein for pairing the token (50) with the reader (10) in a pairing process, the symmetric key (SK) that is assigned to the token (50), a symmetric key (SK') that is assigned to the reader (10), and the identification number (ID) of the reader (10) are exchanged between the reader (10) and the token (50), wherein the pairing process is initiated by the reader (10) or the token (50), wherein the reader (10) is configured to perform an access control method comprising authenticating one of the tokens (50) by the reader (10), wherein the token (50) is paired with the reader (10), wherein the authenticating comprises the following steps: - recognising that the token (50) is within wireless communication range of the reader (10), - sending the identification number (ID) of the reader (10) and an encrypted first value (W) to the token (50) by means of the wireless communication via the wireless communication interface (16) of the reader (10), wherein the first value (W) comprises a random number (RN), - receiving a return value (ENC(W, SK)), encrypted with the symmetric key (SK) of the token (50), from the token (50) by means of the wireless communication via the wireless communication interface (16) of the reader (10), wherein the return value (ENC(W, SK)) comprises the first value (W) in encrypted form, - identifying the token (50) using the return value (ENC(W, SK)) by the processor (12) of the reader (10), wherein the reader (10) tries, one by one, the symmetric keys (SK) stored in the internal memory (14) of the reader (10) in order to decrypt the return value (ENC(W, SK)), wherein each symmetric key (SK) is in each case uniquely assigned to a token (50) paired with the reader (10), until a decrypted return value (DEC(ENC(W, SK), SK)) corresponds to the first value (W) sent to the token (50), - actuating the locking means (30) by means of the control means (18) of the reader (10) under the condition that the identification of the token (50) was successful, wherein the readers (10) are each assigned one of the symmetric keys (SK'), wherein each of the non-volatile, internal memories (54) of the tokens (50) stores the symmetric key (SK') of the reader (10) which is paired with the token (50), wherein before the identification number (ID) and the first value (W) are sent from the reader (10) to the token (50) paired with the reader, the first value (W) is encrypted by the reader (10) by means of the processor (12) of the reader (10) with the symmetric key (SK') assigned to the reader (10), wherein a shared, common secret is stored in the internal memory (14) of the reader (10) and in the non-volatile, internal memory (54) of the token (50), wherein the shared, common secret and the random number (RN) are jointly encrypted as a combined first value (W) and generate the return value (ENC(W, SK)).

12. A token (50) for access control of a group of persons by means of a plurality of readers (10) and a plurality of tokens (50), wherein the token (50) comprises a processor (52), a non-volatile, internal memory (54) and a wireless communication interface (56) for wireless communication with a reader (10), wherein a symmetric key (SK) is stored in the non-volatile, internal memory (54) of the token (50), wherein the symmetric key (SK) is assigned to the token (50), wherein the token (50) is paired with the readers (10), wherein the identification numbers (ID) of the readers (10) which are paired with the token (50) are stored in the non-volatile, internal memory (54) of the token (50), and wherein each of the internal memories (14) of the readers (10) stores the symmetric key (SK) of the token (50) which is paired with the respective reader (10), wherein for pairing the token (50) with the reader (10) in a pairing process, the symmetric key (SK) that is assigned to the token (50), a symmetric key (SK') that is assigned to the reader (10), and the identification number (ID) of the reader (10) are exchanged between the reader (10) and the token (50), wherein the pairing process is initiated by the reader (10) or the token (50), wherein the token (50) is configured to perform an access control method, wherein the method comprises authenticating the token (50) by one of the readers (10), wherein the token (50) is paired with the reader (10), wherein the authenticating comprises the following steps: - coupling the token (50) into the wireless communication of the reader (10) and supplying the token (50) with an operating voltage for operating the processor (52) and the non-volatile, internal memory (54) by means of the wireless communication, - receiving the identification number (ID) of the reader (10) and an encrypted first value (W) from the reader (10) by means of the wireless communication via the wireless communication interface (56) of the token (50), wherein the first value (W) comprises a random number (RN), - identifying the reader (10) by the token (50) by means of the processor (52) of the token (50) using a comparison of the identification number (ID) of the reader (10) sent to the token (50) with the identification numbers (ID) of the readers (10), with which the token (50) is paired, stored in the non-volatile, internal memory (54) of the token (50), - generating a return value (ENC(W, SK)) by the token (50), wherein the return value (ENC(W, SK)) comprises the first value (W) in encrypted form, wherein the encryption of the first value (W) is performed by the processor (52) of the token (50) with the symmetric key (SK) identifying the token (50) and the symmetric key (SK) is stored in the non-volatile, internal memory of the TK, - sending the return value (ENC(W, SK)) from the token (50) to the reader (10) by means of wireless communication via the wireless communication interface (56) of the token (50) for identification of the token (50) by the reader (50) using the return value (ENC(W, SK)), wherein the reader (10) tries, one by one, the symmetric keys (SK) stored in the internal memory (14) of the reader (10) in order to decrypt the return value (ENC(W, SK)), until a decrypted return value (DEC(ENC(W, SK), SK)) corresponds to the first value (W) sent to the token (50), wherein the readers (10) are each assigned one of the symmetric keys (SK'), wherein the symmetric keys (SK') of the readers (10) that are paired with the token (50) are respectively stored in the non-volatile, internal memory (54) of the token (50), wherein the first value (W) received by the reader (10) is encrypted by the reader (10) with the symmetric key (SK') assigned to the reader (10), wherein the encrypted first value (W), after being received by the token (50), is decrypted by the token (50) with the symmetric key (SK') of the reader (10) assigned to the reader (10) and stored in the non-volatile, internal memory (54) of the token (50), wherein the first value (W) is decrypted by the processor (52) of the token (50), wherein a shared, common secret is stored in the internal memory (14) of the reader (10) and in the non-volatile, internal memory (54) of the token (50), wherein the shared, common secret and the random number (RN) are jointly encrypted as a combined first value (W) by the processor (52) of the token (50) and generate the return value (ENC(W, SK)).

13. A system for access control of a group of persons by means of a plurality of readers (10) and a plurality of tokens (50), wherein the readers (10) each have a processor (12), an internal memory (14), a wireless communication interface (16) for wireless communication with the tokens (50) and a control means (18) for actuating a locking means (30), wherein each reader (10) is assigned an identification number (ID) identifying the respective reader (10), wherein the tokens (50) each have a processor (52), a non-volatile, internal memory (54) and a wireless communication interface (56) for wireless communication with the readers (10), wherein a symmetric key (SK) is stored in the non-volatile, internal memories (54) of the tokens (50) and is assigned to the respective token (50), wherein the tokens (50) are paired with the readers (10), wherein the identification numbers (ID) of the readers (10) which are paired with the respective token (50) are respectively stored in the non-volatile, internal memories (54) of the tokens (50), and wherein the symmetric keys (SK) of the tokens (50) are respectively stored in the internal memories (14) of the readers (10), paired with the respective reader (10), wherein for pairing the token (50) with the reader (10) in a pairing process, the symmetric key (SK) that is assigned to the token (50), a symmetric key (SK') that is assigned to the reader (10), and the identification number (ID) of the reader (10) are exchanged between the reader (10) and the token (50), wherein the pairing process is initiated by the reader (10) or the token (50), wherein the system is configured to perform an access control method, wherein the method comprises authenticating one of the tokens (50) by one of the readers (10), wherein the reader (10) is paired with the token (50), wherein the authenticating comprises the following steps: - recognising by the reader (10) that the token (50) is within wireless communication range of the reader (10), - sending the identification number (ID) of the reader (10) and an encrypted first value (W) from the reader (10) to the token (50) by means of the wireless communication via the wireless communication interfaces (16, 56) of the reader (10) and the token (50), wherein the first value (W) comprises a random number (RN), - identifying the reader (10) by the token (50) by means of the processor (52) of the token (50) using a comparison of the identification number (ID) of the reader (10) sent to the token (50) with the identification numbers (ID) of the readers (10), with which the token (50) is paired, stored in the non-volatile, internal memory (54) of the token (50), - generating a return value (ENC(W, SK)) by the token (50), wherein the return value (ENC(W, SK)) comprises the first value (W) in encrypted form, wherein the encryption of the first value (W) is performed by the processor (52) of the token (50) with the symmetric key (SK) identifying the token (50) and the symmetric key (SK) is stored in the non-volatile, internal memory (54) of the token (50), - sending the return value (ENC(W, SK)) from the token (50) to the reader (10) by means of wireless communication via the wireless communication interfaces (16, 56) of the reader (10) and the token (50), - identifying the token (50) by the reader (50) using the return value (ENC(W, SK)) by the processor (12) of the reader, wherein the reader (10) tries, one by one, the symmetric keys (SK) stored in the internal memory (14) of the reader (10) in order to decrypt the return value (ENC(W, SK)), wherein each symmetric key (SK) is in each case uniquely assigned to a token (50) paired with the reader (10), until a decrypted return value (DEC(ENC(W, SK), SK)) corresponds to the first value (W) sent to the token (50), - actuating the locking means (30) by the reader (10) by means of the control means (18) of the reader (10) under the condition that the identification of the token (50) was successful, wherein the readers (10) are each assigned one of the symmetric keys (SK'), wherein the symmetric keys (SK') of the readers (10), which are paired with the respective token (50), are respectively stored in the non-volatile, internal memories (54) of the tokens (50), wherein before the identification number (ID) and the first value (W) are sent from the reader (10) to the token (50) paired with the reader, the first value (W) is encrypted by the reader (10) by means of the processor (12) of the reader (10) with the symmetric key (SK') assigned to the reader (10), wherein the encrypted first value (W), after being received by the token (50), is decrypted by the token (50) using the symmetric key (SK') of the reader (10) which is assigned to the reader (10) and stored in the non-volatile, internal memory (54) of the token (50), wherein the decryption of the first value (W) is performed by the processor (52) of the token (50), wherein a shared, common secret is stored in the internal memory (14) of the reader (10) and in the non-volatile, internal memory (54) of the token (50), wherein the shared, common secret and the random number (RN) are jointly encrypted as a combined first value (W) by the processor (52) of the token (50) and generate the return value (ENC(W, SK)).