ACCESS CONTROL SYSTEM WITH RADIO AND FACE RECOGNITION

Description

[0001] The technology described here generally relates to an access control system that grants an authorized user access to a restricted-access zone in a building or premises. Embodiments of the technology particularly relate to an access control system with a transmitting and receiving device and a method for operating such an access control system. Access control systems can be configured in a variety of ways. The configurations can, for example, relate to the manner in which users (persons) are to identify themselves as authorized to access, e.g., with a key, a magnetic, chip, or RFID card, or a mobile electronic device (e.g., a mobile phone). WO 2010 / 112586 A1 describes an access control system in which a mobile phone carried by a user sends an identification code to an access node.

[0002] If the identification code is recognized as valid, the access node sends an access code to the mobile phone, which displays the access code on a screen. If the user holds the mobile phone up to a camera so that the camera can capture the displayed access code, the access control system checks whether the captured access code is valid. If it is valid, the user is granted access. This access control system offers a certain level of user-friendliness because users do not have to carry credentials or traditional keys, and they do not have to remember an access code. Instead, the mobile electronic device, which many users already carry for communication purposes, functions as a credential or key.

[0003] These access control systems require users to manipulate keys, cards, or mobile devices. Especially in high-traffic areas of a building, such as an entrance hall, such manipulation can be cumbersome and disrupt the flow of people. Therefore, there is a need for a different, even more user-friendly technology.

[0004] US 2015 / 221151 A1 describes an access control system and method based on facial recognition, in which a biometric reference template is read from a database based on a received device identifier.

[0005] One aspect of the present invention relates to a method according to claim 1.

[0006] Another aspect of the present invention relates to a system according to claim 10.

[0007] The technology described here creates an access control system that does not require the user to handle the mobile electronic device, particularly when the user is already at or near the access point (e.g., a lock or barrier). A first phase of checking whether the user is authorized to access occurs when the user is still relatively far from the access point. For example, the user can move toward the entrance to the restricted-access zone while, in one embodiment, the user's mobile electronic device is already in communication with the transmitting and receiving device of the access control system or has already been. The transmitting and receiving device receives the identifier of the mobile electronic device and the user's reference template. If the user is registered in the access control system as authorized to access, a user profile is stored for the user.If the user enters the detection range of an access control system camera, the user's facial features are determined from a camera image in a second phase and defined as a real-time template. If the real-time template matches a stored reference template to a specified degree, the user is recognized, and a building action can be initiated for the user without the user having to use their mobile electronic device. An authorized user can thus enter the restricted access zone and take advantage of the building action virtually seamlessly.

[0008] The technology described here also creates an access control system that does not require central storage of facial templates in a user profile created for an extended period of time (e.g., months or years). A user's reference template is stored on the user's mobile device (and is therefore under the user's control) and is only transmitted to the access control system when the user is actually present, e.g., to enter a restricted area in a building and use a building action. Even in this case, the reference template is only temporarily stored in the access control system until the user either gains access or moves out of radio range.

[0009] The technology thus helps to adequately take into account a user’s interests regarding data protection and privacy.

[0010] A large number of users (e.g., several dozen or hundreds) may be authorized to access a restricted-access zone in a building or area. In such a situation, the transmitting and receiving device receives a large number of identifiers and reference templates, which are stored as data records in the storage device. Nevertheless, the technology described here offers the advantage of rapid matching because the real-time template generated on-site is only checked against the reference templates of the users actually present. A user who is present can thus enter the restricted-access zone without significant congestion or delay. This reduces the risk of a queue forming at the entrance, especially during periods of high traffic.

[0011] Not only does the technology offer faster verification, it can also be used when security requirements are high, for example, because authentication takes place via a secure (encrypted) radio connection. The identifier transmitted wirelessly must belong to a registered user in the system; this allows the user to be recognized and the rights assigned to the user (e.g., access rights) to be determined. In addition to the radio connection, optical recognition of the user's face is used as an additional channel. This optical channel makes it possible to determine which of the potentially numerous users present actually requests access, so that only this user is granted access and the building action assigned to this user is carried out.

[0012] The technology also reduces the effort required to manage user profiles. Since the reference templates are not stored centrally, there is no need to update them if, for example, a user's appearance has changed over time. Each user is responsible for storing the (current) reference template on their mobile device. Before using a mobile device for the first time according to the technology described here, the user creates an image of themselves, which is stored as a reference template on the mobile device. After that, each user can be reminded at regular intervals, for example, to take a new (current) image of themselves. This ensures that a user's real-time template closely matches the user's reference template.

[0013] With the technology described here, on the one hand, the match check is restricted to a limited set of reference templates. On the other hand, user authentication is based on the received identifier, which, in the case of an authorized user, is assigned to a stored user profile. For the image processing device, this means that relatively low requirements are placed on any image processing algorithm implemented therein, for example with regard to recognition accuracy. Compared to an image processing algorithm whose task is to identify a person with a high degree of recognition accuracy based on a relatively large number of facial features (i.e., the degree of match must be relatively high, for example greater than approximately 90%), with the technology described here it is sufficient to assign relatively few facial features to a reference template of a present user.Furthermore, the degree of agreement can be set, for example, between approximately 60% and approximately 90%. Therefore, a cost-effective image processing algorithm can be used, while still meeting security requirements.

[0014] According to the invention, checking for a match comprises generating a result signal. If a match is found, a building action is triggered. The building action is specific to the recognized user. To determine this building action, a user profile of the recognized user stored in the storage device is read; this profile may, for example, specify the floor to which the user is authorized to access. The user-specific building action may comprise unlocking a building door (e.g., an office or apartment door, including one or more doors located on the path from the access to the office or apartment door). In conjunction with an elevator system, the user-specific building action may also comprise registering a destination call to a destination floor specified for the user.This improves user experience because the user can go directly to an assigned elevator car without having to enter an elevator call themselves. The user-specific building action can also include a combination of unlocking a building door and registering a destination call.

[0015] Furthermore, the result signal indicates that the user has access to the restricted-access zone, while in case of a discrepancy, it indicates that the user does not have access to the restricted-access zone. As a function of the result signal, in one embodiment, a control signal can be generated to release a (physical) barrier (e.g., barrier, door, or turnstile). A barrier that is not released remains blocked. In another embodiment, the control signal activates an information device when access is denied. The information device can, for example, be used in conjunction with an access without a physical barrier. If an unauthorized user is detected at the access, in one case, the information device can generate an alarm that is perceptible (acoustic and / or visual) at the access.In another case, the control signal can alert a security service, which then checks the user who has been identified as not having access authorization.

[0016] In one embodiment, the wireless connection between the transmitting and receiving device and a user's mobile electronic device is established according to a Bluetooth standard or a WLAN / WiFi standard. This is advantageous because commercially available mobile phones or smartphones are already equipped with technology according to one of these standards, thus eliminating the need for special devices.

[0017] The technology described here also enables flexibility regarding the identification of a mobile device. The identifier of a mobile device can, for example, comprise a device identification number permanently assigned to the device or a telephone number assigned to the mobile device. In one embodiment, each mobile device is equipped with application-specific software that generates a unique and time-invariant identifier for the mobile device. The identifier (regardless of whether it comprises a device identification number or a telephone number or is generated by software) enables the unique identification of a mobile device.

[0018] In one embodiment, the image processing device has a modular design. An image processing module generates the real-time template from a camera image, and an evaluation module, connected to the image processing module and the storage device, generates a result signal indicating whether the real-time template matches a reference template. Such modularity allows for efficient adaptation of the modules to different requirements (e.g., implementation of a cost-effective image processing algorithm in the evaluation module).

[0019] In one embodiment, modularity is also provided with respect to a processor connected to the image processing device. Depending on the result signal, the processor generates a control signal to initiate reading of a user profile of the recognized user stored in the memory device, in order to subsequently initiate a user-specific building action. The processor also controls the access control system so that the user is granted or denied access.

[0020] Various aspects of the improved technology are explained in more detail below using exemplary embodiments in conjunction with the figures. In the figures, like elements have like reference numerals. They show: Fig. 1 shows a schematic representation of an application example of an access control system in connection with a building; Fig. 2 shows a schematic representation of an embodiment of an access control system; Fig. 3 shows a flowchart of an embodiment of an access control method as one aspect of a method for operating the access control system; and Fig. 4 shows an exemplary signal diagram illustrating an embodiment of a visitor registration method as one aspect of a method for operating the access control system.

[0021] Fig. 1 is a schematic representation of an application example of an access control system 1 in connection with a situation in a building, of which only some walls, rooms 4 and zones 8, 10 are shown for illustrative purposes. The rooms 4 can be, for example, offices, apartments, halls and / or elevator cars of an elevator system. In the Fig. 1 In the application of the access control system 1 shown, several users 2 carrying mobile electronic devices 6 (hereinafter also referred to as mobile devices 6) are located in zone 10. In this example, zone 10 is not subject to any access restrictions and is also referred to below as public zone 10. Public zone 10 can be an area inside or outside the building. An access 12 separates public zone 10 from zone 8, which is subject to access restrictions and borders rooms 4. Those skilled in the art will recognize that the access control system 1 is not limited to applications inside a building, but can also be used analogously to control access to a restricted-access zone on a site. The term "building" in this description refers to, for example, residential buildings, commercial buildings, sports arenas, shopping centers, and even ships.

[0022] The access control system 1 monitors access 12 so that only authorized users 2 can enter zone 8, for example, by blocking or releasing a door, a barrier, a turnstile, or another physical barrier or gate, by controlling (e.g., activating) an information device 38 in the case of access without a physical barrier when an unauthorized user 2 is detected, or by combining these measures. The information device 38 can, for example, trigger a visual and / or acoustic alarm or initiate notification of a security service. Fig. 1 For illustrative purposes, the access control system 1 is shown as being located in the entrance 12. Depending on the traffic volume for which the access control system 1 is intended, the entrance 12 consists of several individual locks; in Fig. 1 For example, each of the two turnstiles 36 can represent a lock. Those skilled in the art will recognize that, in a specific implementation, the access control system 1 or its components can be arranged in various ways.

[0023] The Fig. 1 The rooms 4 shown can, for example, belong to a group of elevators comprising, for example, six elevators (AF). If a user 2 is recognized at the entrance 12, this means in one embodiment that the user 2 wishes to be transported with one of the elevators to a destination floor specified for this user 2. Upon recognition of the user 2, a destination call is initiated, to which an elevator control system assigns an elevator. The assigned elevator is communicated to the user 2, for example, by means of a display unit. In the Fig. 1 In the situation shown, each turnstile 36 can be assigned a display unit. For example, if the user 2 uses one of the Fig. 1 shown turnstiles 36, the access control system 1 detects at which turnstile 36 the user 2 is located and controls the display unit arranged there to display the assigned elevator (e.g. "A").

[0024] As in Fig. 1 As indicated, the access control system 1 comprises a transmitting and receiving device 14 (in Fig. 1 shown as TX / RX) and a camera 16 as part of an image processing device; further components of the access control system 1 are shown in Fig. 2 shown. According to the invention, the transmitting and receiving device is designed to receive radio signals; it is also referred to below as a transceiver 14. The transceiver 14 communicates with the mobile electronic devices 6 when they are within radio range of the transceiver 14, i.e., a radio signal transmitted by a mobile device 6 has a signal strength at the location of the transceiver 14 (for example, expressed by an RSSI value (Received Signal Strength Indicator)) that is greater than a threshold value specified for reliable reception. Communication takes place, for example, via a near-field radio network such as a Bluetooth radio network, WLAN / WiFi, or a ZigBee radio network. Bluetooth is a standard according to IEEE 802.15.1, WLAN / WiFi is a standard according to IEEE 802.11, and ZigBee is a standard according to IEEE 802.15.4; Such radio networks according to these standards are used for the wireless networking of devices over a short distance of approximately a few meters to approximatelyOne hundred meters. The radio network forms the interface through which the mobile electronic device 6 and the transceiver 14 can communicate with each other.

[0025] In the Fig. 1 In the situation shown, the technology described here can be used advantageously to operate the access control system 1 with the least possible complexity and to grant the user 2 convenient access to the restricted access zone 8. Briefly and by way of example, the operation of the access control system 1 according to an embodiment is as follows: As soon as a user 2 is within radio range of the transceiver 14, his mobile device 6 communicates automatically with the transceiver 14 via a radio connection and the mobile device 6 sends its device-specific identifier to the transceiver 14. The mobile device 6 also sends facial parameters of the user 2 in the form of an electronic reference template to the transceiver 14. In the situation according to Fig. 1 The transceiver 14 receives a plurality of identifiers and reference templates. The access system 1 therefore "knows" how many mobile devices 6 are within radio range at a given time and, if their users 2 are registered users 2 for the building, to which users 2 the mobile devices 6 belong. At this time, the access control system 1 can check for each registered user 2 which rights are defined for the user in the building (e.g., access authorization to one or more rooms 4 and / or floors, including any time restrictions).

[0026] The users 2 recorded in this way represent a group of present users 2. If one of the present users 2 now wishes to access the restricted-access zone 8, the user 2 moves towards the entrance 12, which is detected by the access control system 1. The access control system 1 uses image processing or facial recognition to determine a data set with facial features (real-time template) of this user 2 and compares this real-time template with the stored reference templates assigned to the present users 2. This comparison is limited to the group of present users 2; thus, only the data records of this group are searched to determine whether the determined data record matches one of the stored data records. This makes it possible to determine which of the present users 2 actually wishes to access at this time and which rights this user 2 has.For this user 2, for example, a building action defined in a user profile can be initiated; for example, a destination call can be registered for user 2 and subsequently an elevator can be assigned that transports user 2 to the floor on which user 2's workstation is located.

[0027] Fig. 1 also shows a communication network 37, which in one embodiment is communicatively connected to a host system 39 and the access control system 1. Furthermore, it is indicated that a user 2 can communicate via the communication network 37 by means of a communication connection 40, for example, with the host system 39 or a web portal. Exemplary applications of the communication network 37 and the host system 39 are described in connection with Fig. 4 described.

[0028] Fig. 2 shows a schematic representation of an embodiment of the access control system 1. The access control system 1 is modular in one embodiment and comprises an image processing device which, in addition to the camera 16, has an image processing module 22 (image processing in Fig. 2 ) and an evaluation module 24 (evaluation in Fig. 2 ). In addition, the access control system 1 comprises the transceiver 14, a processor 20, a memory device 26 (memory in Fig. 2 ) and a buffer device 28 (buffer in Fig. 2 ). The person skilled in the art will recognize that at least one of the memory devices 26, 28 can also be assigned to the image processing device or that the function of the buffer device 28 can be performed by the memory device 26 and thus the buffer device 28 can be omitted in one embodiment.

[0029] The processor 20 has an output 32 for a control signal and an input 30 for a result signal generated by the evaluation module 24. Depending on the result signal, the processor 20 controls the access control system 1 so that access is granted or denied to the user 2. When access is granted, for example, a destination call can also be initiated, and the elevator assigned to this destination call can be displayed to the user 2. For example, if a physical barrier (e.g. turnstile 36 in Fig. 1 ) zones 8, 10, the control signal releases the barrier (for example, in conjunction with the display of the assigned elevator) or blocks it. If, however, the zone separation occurs without a physical barrier, the control signal, in the event of an unauthorized user 2, for example, activates the information device 38 to generate an alarm or alerts a security service. The information device 38 can also be activated in conjunction with a barrier to indicate to the user 2 or a security service that the barrier has been released or blocked.

[0030] The camera 16 creates a camera image of a user 2 (in particular their face) who is within the detection range of the camera 16 when the user 2 wishes to enter the restricted access zone 8 at the entrance 12. In one embodiment, the camera 16 comprises a digital camera with selectable and / or adjustable properties; in this embodiment, camera images are thus available as digital data records (digital camera images (also referred to as digital images)). The properties of the digital camera, for example, resolution (e.g., specified in megapixels), exposure, and focal length, are selected or adjusted such that a camera image (digital image) can be evaluated and the face of the user 2 can be recognized in the digital image with an evaluation quality. The digital image is available, for example, in a JPEG format, but it can also be available in another format, such as BMP or JPEG2000 format.

[0031] The camera 16 can be equipped with a sensor module or connected to a separate sensor module that activates the camera 16 when it detects the presence of a user 2 in the detection range of the camera 16. The sensor module can, for example, comprise a proximity sensor, which can be configured as an ultrasonic sensor, an infrared sensor, or an optical sensor (e.g., a light barrier, brightness sensor). Alternatively, in one embodiment, the presence of a user 2 in the detection range of the camera 16 can be detected by detecting changes in the detection range. For example, if the user 2 enters the detection range and the camera 16 is continuously in an active state, the camera 16 records changes against a substantially static background; these changes are interpreted as presence.

[0032] The transceiver 14 and the camera 16 (including other components of the image processing device) can be housed in a housing, for example as shown in Fig. 1 shown arranged in the access 12. Alternatively, the transceiver 14 and the camera 16 (including other components of the image processing device) can also be arranged separately from one another as separate units, for example spatially separated from one another in an area around the access 12, wherein the camera 16 is arranged such that essentially only the user 2 who actually requests access is detected. Depending on the design of the access control system 1, several cameras 16 can be present; for example, each barrier (e.g. turnstile 36) can be assigned a camera 16.

[0033] The evaluation module 24 is shown for illustrative purposes as a separate unit connected to the image processing module 22, the processor 20, and the buffer device 28. In one embodiment, the evaluation module 24 and the image processing module form a single unit. The storage devices 26, 28 are also shown as separate units for illustrative purposes; depending on the configuration, they may be combined in a storage device, where they occupy separate storage areas, for example. Irrespective of this, the storage devices 26, 28 may comprise, for example, a hard disk drive (HDD) or CD / DVD drive, a semiconductor drive / solid-state disk (SSD), or combinations thereof, or other storage devices for digital data.

[0034] The aforementioned unit, consisting of evaluation module 24 and image processing module 22, comprises at least one processor unit that executes a computer-assisted image processing method. Image processing methods are known, for example, from US Pat. No. 8,494,231 B2. A basic description of image processing for the purpose of facial recognition is described in the publication "Facial Recognition" by the German Federal Office for Information Security (available under the topic of biometrics at the internet address www.bsi.bund.de). This publication distinguishes between the three main steps: "generating a template," "generating a reference dataset," and "comparing facial images." To keep the comparison of two facial images as simple and fast as possible, the features of a face are determined and stored in the form of a feature dataset called a "template."Once a user's face has been identified and normalized in a user image, other features, including the eyes, nose, and mouth / chin area, are searched for, measured, and correlated. These extracted features are encoded, compressed, and saved as a feature dataset (template). To determine the similarity of the templates of two facial images, they are combined using a mathematical algorithm. This results in a degree of similarity between the templates. If the result lies within certain tolerance limits, the two templates, and thus the facial images on which they are based, are classified as identical.

[0035] According to the technology described here, the mobile device 6 sends its device-specific identifier and the electronic reference template of the user 2 to the transceiver 14 as soon as it is within radio range of the transceiver 14. The processor 20 controls the storage of the received identifier and the received reference template as a data record in the buffer device 28. In the Fig. 1 In the situation shown, several users 2 are in the public zone 10. It is assumed, by way of example, that the mobile devices 6 of the users 2 present are designed to use the technology described here, including sending an identifier and a reference template. Of the users 2 present, some may wish to access the restricted zone 8, some may be on their way from zone 8 to a building exit, and others may be on their way to another part of the building. In the situation shown, this means that not every user 2 who is in the public zone 10 actually wants to enter zone 8. From the perspective of the access control system 1, however, all users 2 present are potential users 2 who might wish to access sooner or later.

[0036] In such a situation, the buffer device 28 stores a data record for each present user 2, which contains the identifier of the mobile device 6 assigned to the user 2 and the reference template of the user 2. This can be both mobile devices 6 whose users 2 are registered as authorized users 2 in the access control system 1, and mobile devices 6 whose users 2 are not registered. If a user 2 leaves the public zone 10 so that the associated mobile device 6 is outside of radio range, the data record created for this user 2 is deleted in the buffer device 28, and the buffer device 28 is updated.

[0037] The access control system 1 determines the present users 2 with the help of the communication between the mobile devices 6 and the transceiver 14. In each mobile device 6, a radio module, for example a module according to a Bluetooth standard, is activated in order to be able to communicate with the transceiver 14 as soon as it is within radio range of the transceiver 14. The mobile device 6 is configured accordingly to send the device-specific identifier and the reference template. It can, for example, have an application-specific software application (also referred to as an app) that can be activated, for example, by the user 2. In one embodiment, the application-specific software application is used in connection with access control and the use of elevators. In one embodiment, the application-specific software generates an identifier that is unique and immutable over time for the mobile device 6.Such a software-generated identifier represents an alternative to the device identification number and a telephone number mentioned above.

[0038] For each registered user 2, a user profile is created in the access control system 1, i.e., it is stored as a data record in a database 34. In one embodiment, the database 34 is set up in the storage device 26. The user profile includes personal data of the user 2 (e.g., name, reason for authorization (resident, employee, external service provider, visitor)), access authorizations (e.g., specific rooms 4 and floors), and any time-based access restrictions (e.g., access from Monday to Friday, from 7:00 a.m. to 8:00 p.m.). In the user profile, at least one mobile device 6 is also assigned to the user 2. As an alternative to creating the user profile in the access control system 1, the user profile can be created in a database of a building management system, wherein the access control system 1 can access this database via a communications network.

[0039] If one of the present users 2 desires access to the restricted-access zone 8, the user 2 enters the detection range of the camera 16 arranged at the entrance 12, and the camera 16 generates one or more digital images or a video recording, each of which is available as a digital data set and temporarily stored for further processing. The image processing module 22 determines the real-time template from the data set, as explained elsewhere in this description. Once the real-time template has been determined, the evaluation module 24 starts a search algorithm to determine whether the real-time template in the buffer device 28 can be assigned to a present user 2. If the real-time template matches a stored reference template to a specified degree, the user 2 who desires access at that time is identified from the group of users 2.

[0040] The mobile device 6 can, for example, be a mobile phone, a smartphone, a tablet PC, or a smartwatch, whereby these devices are typically equipped with hardware that enables communication via a near-field radio network. However, the mobile device 6 can also be glasses with a miniature computer or another computer-based device worn on the body (also referred to as a "wearable device") if these devices are intended for near-field communication and for storing data (here: data from a reference template for facial parameters). Depending on the design of the mobile device 6, it can, for example, have a graphical user interface (GUI) to enable the mobile device 6 and its functions to be selectively activated and deactivated.

[0041] With the understanding of the principal system components and their functionalities described above, the following in connection with Fig. 3 a description of an exemplary access control method as one aspect of a method for operating the access control system 1. The description is made with reference to a user 2 who wishes to enter the restricted-access zone 8 at the access 12, for example, to use an elevator there. The user 2 carries the mobile device 6 with them and has activated its radio module (e.g., for Bluetooth communication). Furthermore, a reference template for facial features of the user 2 is already stored in the mobile device 6. An associated software application is also activated. The method begins in a step S1 and ends in a step S10.

[0042] If the user 2 is located with their mobile device 6 in the public zone 10 and within radio range of the transceiver 14, the transceiver 14 receives a device-specific identifier transmitted by the mobile device 6 in a step S2. The transceiver 14 and the mobile device 6 communicate according to the same communication standard, in this embodiment via a radio connection according to a Bluetooth standard. The transceiver 14 also receives a reference template for facial parameters of the user 2. The identifier and the reference template can be transmitted by the mobile device 6 essentially simultaneously or sequentially. Fig. 3 The identifier and the reference template are sent in one (common) step (step S2). In another representation, the reference template could also be sent in a separate step.

[0043] The received identifier and the received reference template are stored in a step S3. The identifier and the reference template are stored, for example, as a data record in the buffer device 28.

[0044] Steps S2 and S3 are carried out for each mobile device 6 that is within radio range of the transceiver 14 and operates according to the same communication standard as the transceiver 14. Depending on the number of users 2 in the public zone 10, a plurality of identifiers and associated reference templates, corresponding to a group of present users 2, can be stored in the buffer device 28 at a given time. Those skilled in the art will recognize that the buffer device 28 is updated when a mobile device 6 is no longer within radio range, e.g., because the associated user 2 has left the public zone 10 without requesting access to the restricted-access zone 8 or because the associated user 2 has already entered the restricted-access zone 8. The buffer device 28 thus stores the data records for users 2 who are present in the public zone 10 at a given time.

[0045] In step S4, it is determined whether one of the present users 2 wishes to access the restricted-access zone 8. According to one exemplary embodiment, the access control system 1 detects this request using the aforementioned sensor module or by detecting background changes. For example, the sensor module detects when the user 2 enters the detection range of the camera 16, whereupon the camera 16 is activated. If an access request is detected, the method proceeds along the "yes" branch to step S5. Otherwise, the method proceeds along the "no" branch back to step S2.

[0046] In step S5, the activated camera 16 generates a digital image depicting at least the face of the detected user 2, and the image processing module 22 generates a real-time template from the digital image, as explained elsewhere in this description.

[0047] In a step S6, the real-time template determined in step S5 is used to determine whether the real-time template can be assigned to a reference template stored in the buffer device 28.

[0048] During the determination according to step S6, a check is carried out in step S7 to determine whether the real-time template matches a reference template to a specified degree. In one exemplary embodiment, the real-time template and the reference templates each comprise a specified number of specified facial parameters and their values ​​(e.g., eye distance, mouth width, distance between the upper and lower edges of the lips, distance between the nose and lower edges of the lips, etc.). During the search, the parameter values ​​of the real-time template are compared with the parameter values ​​of the reference templates. A match exists if the degree of similarity of the templates corresponds at least to the specified degree. The specified degree indicates a percentage match between the facial parameters of the real-time template and the facial parameters of a reference template. Depending on the accuracy requirements, the specified degree can be selected, for example, between approximately 60% and approximately 90%.

[0049] If there is a match, the user 2 who wishes access at this time is identified from the group of users 2 present. In this case, the method proceeds along the yes branch to step S9, in which a user-specific building action is executed for this user 2. The building action can, for example, consist of triggering a destination call for user 2 (according to the data of the user profile existing for this user 2), assigning an elevator to this destination call, and displaying the assigned elevator to user 2 at access 12. The building action can also consist of unlocking one or more doors to which this user 2 is authorized to access. The person skilled in the art will recognize that these building actions can also be executed in combination.

[0050] If, however, there is no match, the method proceeds along the "No" branch to step S8, where a notification is generated. The notification can, for example, inform user 2 that an error has occurred and / or that user 2 should contact a building manager (e.g., reception staff, security personnel). Regardless of this, the security personnel can also be notified directly in step S8.

[0051] From the in connection with Fig. 3 From the description of an exemplary method for operating the access control system 1, it is clear that a user 2 does not have to handle his mobile device 6 in order to gain access to the restricted-access zone 8. Depending on the design of the access, ie with or without a physical barrier, the control of access authorization can take place without the user 2 noticing anything.

[0052] In one embodiment, the access control system 1 is connected to an elevator system, in particular to an elevator control system. Communication between the access control system 1 and the elevator control system can take place via the communication network 37. If access control takes place, for example, in the entrance hall of the building, which the users 2 must pass through to reach the elevators, a destination call can be initiated for the respective user 2 each time access is granted. The elevator control system of the elevator system processes the destination call and assigns them an elevator. The elevator assigned to the destination call can be displayed to the user 2, for example, via a terminal at the entrance 12 and / or communicated by voice. The user 2 can thus go directly to the assigned elevator without having to enter an elevator call.

[0053] In connection with Fig. 3 As described above, each user 2 is registered in the access control system 1 as an authorized user 2. Depending on the type of building, non-registered users 2 may also request access to the restricted zone 8, for example, visitors. Fig. 4 shows a signal diagram of an embodiment of a method that allows visitors to conveniently access the restricted zone 8. To illustrate an example scenario, Fig. 4 schematically illustrates interactions between a host or a host system 39 used by the host, a visitor or their mobile device 6, the access control system 1, the camera 16, and a building system to register the visitor using a registration process in the control system 1, to allow access, and to execute a specified building action. According to the technology described here, the visitor is thus also a user 2 (the reference numeral 2 will be used below for both the visitor and one or more users).

[0054] In this scenario, the host and visitor 2 agree on an appointment, i.e. a date and time or a period of time at which the host expects visitor 2. The host then creates an invitation, for example using the host system 39 (e.g. PC, notebook, tablet PC, smartphone or another electronic device) and a software application installed thereon (e.g. using Microsoft Outlook™< or similar application programs), and sends it to visitor 2, for example via the communication network 37 and the communication connection 40. The communication connection 40 can, for example, be made via a mobile radio communication system.

[0055] In addition to the appointment details, the invitation includes an identification number assigned to the invitation (in Fig. 4 referred to as "ID") and also information about a communication channel that the visitor 2 has to use to communicate with the access control system 1 for the purpose of registration. In one embodiment, the communication channel is the Internet; the information about the communication channel therefore includes an Internet address for a web portal (in Fig. 4 (referred to as a "link"). The Internet address can, for example, include a uniform resource locator (URL) that identifies and locates the web portal as a resource via the access method to be used (e.g., a network protocol used such as HTTP or FTP) and the location of the resource in a computer network. The web portal is assigned to a computer system of the access control system 1. In one embodiment, the invitation is transmitted via the communications network 37 using a signal DS1; it can, for example, be sent as a text message to the mobile device 6 of the visitor 2 or as an email to the email address of the visitor 2.

[0056] The host or host system 39 also sends the invitation data to the access control system 1 by means of a signal DS2, for example via the communications network 37 and essentially at the same time as the invitation is sent or at a later time. The access control system 1, controlled, for example, by the processor 20, creates a visitor profile for the received invitation data. In one exemplary embodiment, the invitation data includes, in addition to the appointment details, information about the host, for example, name, telephone number, floor and / or apartment or office number, and the visitor (for example, name). Furthermore, a time window can be specified within which the visitor 2 is to be granted access. The time window can, for example, specify that the visitor 2 will be granted access approximately half an hour before and after the start of the appointment in case the visitor 2 arrives early or is late.The visitor profile can be deleted after visitor 2 arrives or at a later time.

[0057] If visitor 2 accepts the invitation, the communication channel specified in the invitation is used to transmit the invitation's identification number and the identifier of mobile device 6 to access control system 1. Depending on the configuration, the visitor may be prompted to enter the identifier of mobile device 6 (e.g., telephone number or device identification number). If the visitor accepts the invitation using mobile device 6, in one embodiment, the identifier of mobile device 6 is also transmitted to access control system 1, e.g., automatically. If an application-specific software application is installed on mobile device 6, as described above, it supports visitor 2 in accepting the invitation. The identifier and the invitation's identification number are transmitted using a signal DS3, for example, via communication network 37 and communication connection 40.The DS3 signal can be transmitted using a known transmission protocol, such as TCP (Transmission Control Protocol), IP (Internet Protocol), and UDP (User Data Protocol). Access control system 1 stores the received data (ID and invitation identification number) in the visitor profile.

[0058] The technology described here can also utilize other communication channels. As an alternative to using a web portal, the invitation can request visitor 2 to transmit the invitation's identifier and identification number to a building management office. The building management office can, for example, manage the database 34 for the relevant building, in which the user profiles of the authorized users 2 are stored. Transmission to the building management office can, for example, be made to a building management email address or building management telephone number specified in the invitation, for example, via an SMS or MMS message. Building management staff can then initiate further processing of the received data.

[0059] The invitation also prompts the visitor to take a self-portrait (also known as a "selfie") of themselves, e.g., using the camera of their mobile device 6, and save it on the mobile device 6. An advantage of the technology described here is that Visitor 2 can create the selfie at a time of their choosing, as long as this occurs before the appointment. Visitor 2 can be geographically distant from the building or already in or near the building. The application-specific software application installed on the mobile device 6 also supports Visitor 2 in creating and saving the self-portrait as a reference template for Visitor 2.

[0060] Based on the created visitor profile, visitor 2 can be assigned the following information in connection with Fig. 3 The specified building action is executed according to the access control procedure described above when the visitor arrives in the building at the agreed time. As soon as the visitor enters the reception range of the transceiver 14 in the public zone 10, the transceiver 14 receives the identifier and the reference template transmitted by the mobile device 6. The reception of the identifier of the mobile device 6 and the reference template takes place as described above and is in Fig. 4 by means of a signal DS4. If the visitor subsequently enters the detection range of camera 16, camera 16 generates a digital image showing the visitor's face. The generation of the digital image by camera 16 and the subsequent generation of a real-time template are carried out as described above; in Fig. 4 This is represented by a signal DS5.

[0061] The access control system 1 checks whether the real-time template matches the reference template to a specified degree. In addition, the access control system 1 checks whether the visitor requests access within the time window specified in the visitor profile. If both conditions are met, the visitor is granted access and the building action is initiated; Fig. 4 This is represented by a signal DS6.

[0062] Depending on the building's design, access control system 1 can communicate with an elevator controller to generate a destination call for visitor 2 upon granting access, as an exemplary building action. The elevator controller assigns an elevator to the destination call, whereby the assigned elevator can be communicated to visitor 2 in the access area 12 via display or voice. The assigned elevator transports visitor 2 to the floor on which the host is located. The host's floor is stored, for example, in the visitor profile in conjunction with the invitation data. Visitor 2, especially when entering the building for the first time, thus does not need to bother entering the destination floor.Visitor 2 can also be provided with additional information to help them better orient themselves in the building. For example, visitor 2 can be informed in which direction (and possibly also how far) they should go after disembarking on the floor. Such guidance information can be communicated, for example, via visitor 2's mobile device 6 and / or displays on the floors or in the elevator car. In one embodiment, access control system 1 generates and sends a message to the host informing the host that the visitor has been granted access. The host can thus prepare promptly for the visitor's arrival.

Claims

1. Method for operating a system (1) for controlling access to a restricted access zone (8) in a building or on a site, wherein the system (1) comprises a transmitting and receiving device (14) for radio communication with mobile electronic devices (6) carried by users (2), a storage device (26, 28), and an image processing device (16, 22, 24) which has a camera (16) located at the entrance to the restricted access zone (8), wherein the method comprises: receiving, by the transmitting and receiving device (14), a device-specific identifier of a mobile electronic device (6) of a user (2) and an electronic reference template, transmitted by the mobile electronic device (6), for facial parameters of the user (2) as soon as the mobile electronic device (6) is within radio range of the transmitting and receiving device (14) in a public zone (10) from which the user (2) can request access to the restricted access zone (8); storing the received identifier of the mobile electronic device (6) and of the electronic reference template in the storage device (26, 28) as a data set belonging to a user (2) present, wherein a plurality of data sets relating to users (2) present can be stored in the storage device (26, 28) in order to store, for each user (2) present, in the data set belonging to the user (2) present, the identifier of the mobile electronic device (6) assigned to the user (2) present and the reference template of the user (2) present, wherein the data set belonging to a user (2) present is deleted and the storage device (26, 28) is updated as soon as this user (2) present leaves the public zone (10) and their mobile electronic device (6) is outside the radio range of the transmitting and receiving device (14); generating a real-time template for facial features of the user (2) as soon as the user (2) requests access to the restricted access zone (8) and comes into a detection range of the camera (16) located at the entrance to the restricted access zone (8), wherein the real-time template is generated from an image of the user (2) by the image processing device (16, 22, 24); determining whether the real-time template matches a reference template stored in the storage device (26, 28) to a specified degree, wherein, if there is a match, the user (2) is recognized as the user (2) requesting access; and generating a result signal which, if there is a match, prompts a building action to be carried out, wherein a control signal is generated depending on the result signal in order to prompt reading of a user profile, stored in the storage device (26, 28), of the user (2) requesting access in order to determine a user-specific building action.

2. Method according to claim 1, in which the user-specific building action involves unlocking a building door which the user (2) is authorized to access, or registering a destination call to a destination floor specified for the user (2), or a combination of unlocking a building door and registering a destination call.

3. Method according to claim 2, further comprising generating a control signal as a function of the result signal to release a barrier (18, 36) so that the user (2) can enter the restricted access zone (8).

4. Method according to any of the preceding claims, in which the image of the user (2) is generated by a camera (16) of the image processing device (16, 22, 24).

5. Method according to any of the preceding claims, in which the radio link between the transmitting and receiving device (14) and a mobile electronic device (6) of a user (2) takes place in accordance with a Bluetooth standard or a WLAN / WiFi standard, and wherein the transmitting and receiving device (14) receives the device-specific identifier and the reference template via the radio link when the mobile electronic device (6) is located within radio range of the transmitting and receiving device (14).

6. Method according to any of the preceding claims, in which the identifier is generated by application-specific software, which is active on the mobile device (6), wherein the identifier does not vary over time.

7. Method according to any of claims 1-6, in which the identifier comprises a device identification number or a telephone number assigned to a mobile device (6).

8. Method according to any of the preceding claims, in which the real-time template and the reference templates each comprise a specified number of specified facial parameters, and in which the specified degree is between approximately 60% and 90%, wherein the specified degree indicates a percentage match of the facial parameters of the real-time template with the facial parameters of a reference template.

9. Method according to any of the preceding claims, in which, when a plurality of mobile electronic devices (6) are located in the public zone (10), a data set is stored in the storage device (26, 28) for each mobile electronic device (6) of a user (2), which device transmits a device-specific identifier and an electronic reference template for facial parameters of the user (2).

10. System (1) for controlling access to a restricted access zone (8) in a building or on a site, wherein the system (1) comprises: a transmitting and receiving device (14) for radio communication with a mobile electronic device (6) carried by a user (2), which transmitting and receiving device is designed to receive a device-specific identifier of the mobile electronic device (6) and an electronic reference template, transmitted by the mobile electronic device (6), for facial parameters of the user (2), wherein the reception takes place as soon as the mobile electronic device (6) is within radio range of the transmitting and receiving device (14) in a public zone (10) from which the user (2) can request access to the restricted access zone (8); a storage device (26, 28), which is designed to store the identifier of the mobile electronic device (6), received from the transmitting and receiving device (14), and the reference template of the user (2) in a data set as belonging to a user (2) present in a public zone (10), wherein a plurality of user profiles of users (2) who are authorized to access and a plurality of data sets of users (2) present can be stored in the storage device (26, 28) in order to store, for each user (2) present, in the data set belonging to the user (2) present, the identifier of the mobile electronic device (6) assigned to the user (2) present and the reference template of the user (2) present, wherein the data set belonging to a user (2) present is deleted and the storage device (26, 28) is updated as soon as this user (2) present leaves the public zone (10) and their mobile electronic device (6) is outside the radio range of the transmitting and receiving device (14); an image processing device (16, 22, 24) comprising a camera (16), which is located at the entrance to the restricted access zone (8) and is designed - to generate, from an image of the user (2), a real-time template for facial features of the user (2) as soon as the user (2) requests access to the restricted access zone (8) and comes into a detection range of the camera (16), and - to determine whether the real-time template matches a reference template stored in the storage device (26, 28) to a specified degree, wherein, if there is a match, the user (2) is recognized as the user (2) requesting access; and a processor (20), which is connected to the image processing device (16, 22, 24) and which is designed to generate a control signal depending on the result signal in order to prompt reading of a user profile of the recognized user (2) stored in the storage device (26, 28) in order to determine a user-specific building action.

11. System (1) according to claim 10, in which the image processing device (16, 22, 24) comprises an image processing module (22), by means of which the real-time template can be generated from a camera recording, and an evaluation module (24), which is connected to the image processing module (22) and the storage device (26, 28), wherein the evaluation module (24) is designed to generate a result signal which, in the event of a match, prompts a building action to be carried out.

12. System (1) according to claim 11, further comprising a barrier (18, 36) which can be unlocked or blocked depending on the control signal.