Locking device element for use in an access procedure

Abstract

The invention comprises a locking device element (1), in particular a key, fitting or lock cylinder, for use in an access method 200 in which access to a physical area is granted or denied, wherein the locking device element (1) comprises a first time element (76), wherein the first time element (76) outputs a first time signal indicating a first time, wherein the locking device element (1) comprises an electronic processing device (72), wherein the electronic processing device (72) is configured to perform a verification step (201) based on the first time, and wherein the locking device element (1) is configured to perform at least one further step (202) depending on the outcome of the verification step (201).

Description

[0001] The invention relates to a locking device element, in particular designed as a key, fitting, or locking cylinder. The locking device element is designed for use in an access method. In this access method, access to a physical area is granted or denied. Furthermore, the present invention shows the access method using the locking device element.

[0002] EP 1 899 924 B1 discloses a known key for an electromechanical locking cylinder. The known key comprises a key blade on which electronics are arranged between two housing shells.

[0003] It is an object of the present invention to provide a locking device element and an associated access method which grant or deny particularly secure access to a physical area.

[0004] The object is achieved by the features of the independent claims. The dependent claims relate to preferred embodiments of the invention. The object is also achieved by a method according to claim 17. The method can be carried out using the locking device element according to the invention, in particular the locking device element according to one of claims 1 to 16. Furthermore, the locking device element can be designed to carry out the method according to the invention, in particular the method according to claim 16.

[0005] The invention shows a locking device element, which is particularly designed as a key, electromechanical fitting, or locking cylinder. The locking device element is designed for use in an access method. In this access method, access to a physical area is granted or denied. "Granted or denied" means, in particular, that access can be granted or denied, although these two states cannot occur simultaneously. If access authorization is present, access is granted. If, however, access authorization is not present, access is denied. To verify whether access authorization exists, at least one access condition is checked in an access decision step. Preferably, multiple access conditions are checked in multiple access decision steps.Access authorization exists when all access decision steps have been positively decided. In particular, if at least one access condition is denied during the access process, in which at least one access condition, preferably several access conditions, are reviewed, the entire access is denied. This denial of the access condition can, in particular, mean that an access decision is denied in one access decision step of the access process.

[0006] At least one access decision step may be performed by the locking device element.

[0007] "Access to a physical area" specifically describes that the access method using the locking device element makes the physical area accessible to a person, allowing the person to enter the physical area and / or at least open the physical area. For example, the physical area may also be the interior of a safe or cabinet, into which the person does not enter but gains access by opening a corresponding door. Likewise, access to a physical area may include, for example, opening a door to a room or building, or opening a barrier, turnstile, or turnstile barrier.

[0008] In particular, the blocking device element serves to carry out at least one access decision step for granting or denying access to the physical area. It is conceivable that the blocking device element makes the access decision completely or only partially. Alternatively or additionally, the blocking device element can provide data for at least one access decision step.

[0009] In particular, the locking device element is intended to be carried by a user or located outside the physical area to which access is to be granted or denied. Therefore, attempts to tamper with the locking device element may be made. The present invention counteracts such tampering attempts.

[0010] As will be described in more detail below, the locking device element is preferably designed as a key comprising a key blade that is inserted into a locking cylinder. The key contains electronics. The electronics can be used to perform an access decision step and / or to forward data for an access decision step to the locking cylinder. Upon access authorization, rotation of a driver of the locking cylinder is enabled. The locking device element is thus designed as an "electromechanical" key, since in addition to the electronics in the key, mechanical actuation of the locking cylinder—namely, by turning the key—also occurs.

[0011] Alternatively, the locking device element can be designed as an "electronic" key. Using the key's electronics, an access decision step can be performed and / or data for an access decision step can be sent to a lock, locking cylinder, reader, or fitting, so that the corresponding access can be granted.

[0012] If the locking device element is configured as a fitting, in particular an electromechanical fitting, or a locking cylinder, in particular an electromechanical locking cylinder, electronics are located in the fitting or the locking cylinder. The electronics can preferably perform at least one access decision step. A mechanism in the fitting or locking cylinder, controlled by the electronics, can grant or deny access; for example, by releasing the door handle of the fitting or remaining blocked, engaging or disengaging it, or by unlocking or locking a cylinder core in the locking cylinder, engaging the driver, or disengaging the driver.

[0013] The locking device element comprises a first time element. This first time element is thus located in the locking device element, for example, in the key. The first time element outputs a first time signal. This first time signal indicates a first time. This first time signal is output by the first time element, in particular continuously or at regular intervals. In a simple embodiment, the first time element outputs any signal with a defined frequency. This signal or frequency specifies a clock pulse that is counted in another element of the locking device, ultimately resulting in a count value. Before counting, the frequency can preferably be divided. Thus, the time signal can "indicate the first time" simply by oscillating at a defined frequency.

[0014] In a preferred embodiment, however, the first time element outputs a count value or a value based on the count value (e.g., time) as a time signal and thus as the "first time." The counting of the clock pulse and preferably also the preceding division of the frequency thus takes place in the first time element. Particularly preferably, the count value is interpreted in the first time element or in another element of the locking device element in conjunction with a start value, so that an actual time is ultimately obtained. Thus, the time can correspond to the first time.

[0015] The locking device element further comprises an electronic processing device. The electronic processing device is configured to perform a verification step on information from the first time element, in particular based on the first time. Particularly preferably, the processing device is located in a controller, in particular a microcontroller, of the locking device element. As will be shown in more detail, the processing device can also perform several of these verification steps.

[0016] Furthermore, the locking device element, in particular the electronic processing device, is designed to perform at least one further step that depends on the outcome, i.e., the result, of the verification step. If multiple verification steps are performed, the one further step can depend on the outcome of these multiple verification steps. Furthermore, it is also possible to perform different further steps based on the multiple verification steps.

[0017] An actual time, such as the time of day or a specific day of the week, can determine whether a specific person or group of people should be granted or denied access to the physical area. For example, certain people may enter a building during the day on weekdays, whereas a different group of people may do so on weekends or at night. Thus, an access authorization can only be valid for at least one specific access authorization time window. The access authorization time window is, in particular, recurring, thus encompassing specific time periods between the start and end of the access authorization validity period, for example, days or hours within a week.To make this functionality as tamper-proof as possible, the locking device element includes at least the first time element, so that the verification of access authorization does not depend, or at least not exclusively, on a time provided elsewhere. The first time element arranged in the locking device element allows the time to be determined within the locking device element.

[0018] Preferably, at least one access decision step performed by the blocking device element is performed using the first time signal, in particular the first (clock) time determined by the time signal. Additionally or alternatively, the data sent by the blocking device element so that another device performs an access decision step may include the first time signal, in particular the first time. For example, the access decision step may involve comparing an access authorization time window with the first time. If the first time lies within the access authorization time window, the access decision step is concluded with a positive result. If the first time lies outside the access authorization time window, the access decision step is concluded with a negative result.

[0019] Additionally or alternatively, it can be provided that the first time is compared with an access authorization validity start and / or an access authorization validity end. If the first time is before the access authorization validity start, this access decision step is concluded with a negative result. If the first time is after the access authorization validity start, this access decision step is concluded with a positive result. If the first time is before the access authorization validity end, the corresponding access decision step is concluded with a positive result. If the first time is after the access authorization validity end, the corresponding access decision step is concluded with a negative result. Thus, several different access decision steps that are carried out using the first time are conceivable.

[0020] Preferably, the processing device comprises an internal second time element. This internal second time element preferably has an internal RC element.

[0021] The internal second time element is preferably designed to generate a second time signal within the processing device. In particular, it is provided that the second time signal is generated in the processing device, preferably in the microcontroller.

[0022] The second time signal indicates a second time. The second time signal is generated, in particular, continuously or at regular intervals by the second time element.

[0023] In particular, the second time element generates any signal with a defined frequency. This signal or frequency specifies a clock pulse, which is counted in the second time element, i.e., in the processing device, ultimately resulting in a count value. The frequency can preferably be divided before counting. Particularly preferably, the count value is interpreted in the second time element or in another area of ​​the processing device in conjunction with a start value, ultimately resulting in an actual time. Thus, the second time can correspond to a second time.

[0024] Preferably, the first timing element is designed and arranged separately from the processing device; thus, it is preferably located outside the microcontroller. Preferably, the blocking device element contains a circuit board on which the first timing element is arranged separately from the microcontroller of the processing device. Preferably, the first timing element is electrically connected to the processing device for transmitting the first time signal, in particular the first time.

[0025] Particularly preferably, the first time element is a real-time clock (RTC) with an oscillating crystal. Particularly preferably, the real-time clock comprises, in addition to the oscillating crystal, a frequency divider and a frequency counter.

[0026] In order to prevent manipulation of the time information as far as possible, the first and second time elements are preferably used in the locking device element. By comparing the times of the two time elements, it can be checked whether one of the two time elements has been manipulated. For this purpose, the first and second time elements in the locking device element are particularly preferably positioned at different locations and / or designed differently. The first time element is preferably located outside the processing device, i.e. in particular outside the microcontroller. The second time element is preferably located inside the processing device, i.e. in particular inside the microcontroller. Furthermore, the first time element is preferably a real-time clock, which is considerably more difficult to manipulate in software terms than the second time element integrated into the processing device.On the other hand, the second time element, located inside the processing device, is significantly more difficult to physically manipulate than the first time element, which is located outside the processing device. The fact that the processing device contains both the second time element and performs the verification step makes tampering particularly difficult.

[0027] Preferably, the at least one access decision step performed by the blocking device element is performed by the processing device. As a result, in particular, the same controller that determines the second time is also used to perform the access decision step, in particular an access decision step that depends on a time. This can increase security against manipulation. Instead of the first time, the second time can be used additionally or alternatively. Thus, the blocking device element can check whether the second time lies within an access authorization time window and / or compare the second time with an access authorization validity start and / or an access authorization validity end.

[0028] Preferably, the processing device is configured to compare the first time with the second time as a verification step. Particularly preferably, the processing device is configured to compare the first time signal or a value based thereon with the second time signal or a value based thereon. The verification step can be performed periodically. Additionally or alternatively, the verification step can be performed during an access procedure.

[0029] The expression "comparing the first time with the second time" describes a comparison in which it is determined whether the two times differ from each other. For example, a first time is determined based on the first time and a second time is determined based on the second time, whereby a difference between these two times can be determined. However, such a comparison can also be performed without using actual times. For example, the two times can represent counts of a clock cycle, whereby a comparison of the two times is possible by taking into account the start times and the clock frequencies.

[0030] In the following, it is described in various contexts that the locking device element can be designed to deny access to the physical area. This denial is initiated by the locking device element, preferably carried out by the locking device element itself.

[0031] The locking device element can, in principle, initiate the denial of access. This "initiation" includes the locking device element itself denying access. If access is denied, the locking device element can abort the access procedure or terminate it with a negative result, or send a message about the denial to another element that terminates or aborts the access procedure with a negative result. If the locking device element is designed as an electromechanical key, for example, a driver of the locking cylinder cannot rotate if access is denied.

[0032] However, it is also possible that steps of the access process, in particular the verification of at least one access condition, take place in another element (e.g., in a server, in a cloud, in a connected smartphone, in the locking cylinder, etc.). In these cases, the locking device element can initiate a denial of access by not transmitting corresponding data, in particular the first and / or second time, to this other element; which the other element requires for an access decision step, in particular the first and / or second time. Therefore, the locking device element does not necessarily deny access itself.

[0033] Preferably, the expression that the blocking device element is configured to initiate, preferably itself, a denial of access to the physical area refers to all, i.e., future and possibly current, access procedures, at least until a revocation occurs. This means that the use of the blocking device element for all access procedures is denied—at least until a revocation occurs. Alternatively, the expression that the blocking device element is configured to initiate, preferably itself, a denial of access to the physical area can be limited to only the current access procedure, provided that the verification step takes place within the scope of an access procedure.In summary, the expression that the locking device element is designed to cause a denial of access to the physical area may mean to generally deny use of the locking device element for access methods for granting access to a physical area or to deny current access to the physical area.

[0034] It is preferably provided that the blocking device element is designed to initiate, preferably carry out itself, a refusal of access to the physical area based on the outcome of the checking step.

[0035] The verification step that leads to the denial includes, in particular, checking whether the first time and the second time differ by more than a stored first time difference. Thus, if the first time deviates too far from the second time, the blocking device element initiates the denial of access to the physical area. This verification step can be performed periodically, regardless of whether the blocking device element is currently in an access procedure. Additionally or alternatively, this verification step can be performed in each access procedure.

[0036] In particular, if the first time and the second time differ by more than a stored first time difference, access can no longer be granted for access procedures using the blocking device element – ​​at least until the first time difference is lifted. If the first time difference is detected to have been exceeded during a periodic check, access can no longer be granted for any subsequent access procedures – at least until the first time difference is lifted. If the first time difference is detected to have been exceeded in an access procedure, access can no longer be granted in the current and all subsequent access procedures – at least until the first time difference is lifted. The status of the blocking device element is preferably set to "manipulated." The blocking device element is thus "blocked."

[0037] If the locking device element corresponds to a key, no access procedure can be successfully completed with the key, granting access to different physical areas, at least until a revocation occurs. If an electromechanical key is used as the locking device element, no access procedure can be successfully completed on different locking cylinders.

[0038] Particularly preferably, the denial of access is only temporary. For this purpose, the blocking device element is designed to initiate, preferably independently, the revocation of the denial after receiving a positive approval message. This positive approval message can be sent, in particular, from a backend system to the blocking device element.

[0039] In the "tampered" state, the locking device element can, in particular, submit an unlock request to the backend system. If the backend issues a positive approval message, i.e., if the locking device element receives the approval message, the locking device element can remove the "tampered" state. This allows the locking device element to participate in access procedures that end with access being granted.

[0040] In the backend system, for example, a corresponding algorithm and / or user input can cause the locking of the locking device element to be lifted or the current access to be granted despite the large time difference between the first time and the second time.

[0041] The backend system preferably comprises software, in particular also the hardware on which the software runs. The backend system can run on a single computing unit or be distributed across multiple computing units and be at least partially cloud-based. Accordingly, the backend system preferably comprises at least one server and / or a building control unit.

[0042] The data connection between the backend system and the locking device element can be established in any manner, in particular wirelessly at least in some sections. It is particularly preferred that the data connection between the backend system and the locking device element be established via an electronic "device." This device is understood to be, for example, a portable computing unit, such as a smartphone, tablet, or laptop.

[0043] Preferably, the device can establish a connection to the backend system via the Internet and / or a telecommunications network. Preferably, the device can communicate with the locking device element via a wireless short-range connection, such as NFC, Bluetooth Low Energy, or Ultra Wide Band.

[0044] Furthermore, it is preferably provided that the locking device element is designed to carry out at least one of the two "further steps" described below based on the output of the checking step. During the checking step, it is checked in particular whether the first time and the second time differ by less than a stored second time difference. The second time difference is preferably equal to the first time difference or is smaller than the first time difference. In this checking step, it is checked in particular that the first time and the second time do not differ too much from each other, i.e., by less than the stored second time difference. If this is the case, it can be assumed that there has been no manipulation of the time, i.e., in particular, of the first time element or the second time element. (i) As a possible further step, it is provided that the locking device element is designed to perform an access decision step. In particular, this is an access decision step in which a time, in particular the first or second time, is compared with an access authorization time window and / or with an access authorization validity start or end date. The access authorization time window defines, for example, a time of day from 8 a.m. to 6 p.m. and / or, for example, specific weekdays on which access is to be granted. The access authorization validity start date describes, for example, a start date from which access authorization is generally valid.The end of validity of the access authorization describes, for example, an end date on which an access authorization regularly expires. For example, an access authorization can be granted for individual days, months or weeks and expires at a specific time. (ii) Additionally or alternatively, as a further step, the second time can be corrected based on the first time. This means, in particular, that the second time element is set after the first time. In doing so, particular account is taken of the fact that the first time element, in particular designed as a real-time clock, functions more precisely than the second time element. Therefore, unless manipulation is suspected, the second time element or the second time is corrected based on the first time element or the first time.

[0045] Furthermore, it is preferably provided that, as part of the checking step, the processing device receives and evaluates an error message from the first time element. Thus, the checking step can be based not only on the first time, but also on the error message. The information from the first time element can thus correspond to an error message. Depending on this error message, the blocking device element can - as a further step - initiate, in particular carry out, an at least temporary denial of access to the physical area. The first time element, in particular designed as a real-time clock, can, for example, detect that the crystal is no longer oscillating or is no longer oscillating properly. The first time element can then generate a corresponding error message and transmit it to the processing device.Such an error message can be used to conclude that the first time element has been tampered with or malfunctioned, which can then lead to denial of access to the physical area. Specifically, the status is changed to "tampered." Furthermore, the error message can also inform about other tampering with the first time element, which can then lead to denial of access. This represents the next step.

[0046] Furthermore, it is preferably provided that the backend system described above sends an update time signal to the locking device element. The update time signal can indicate an update time, in particular an update time. The update time signal can correspond to an update (clock) time. As already described, the data connection from the backend system to the locking device element is preferably established via the described device.

[0047] Particularly preferably, the locking device element is configured to receive the update time signal encrypted from the backend system and to decrypt it using encryption information. This encryption information, in particular the cryptographic key, is in particular individual to the locking device element. This means that only one locking device element can decrypt the update time signal. Particularly preferably, the backend system knows the public key of the locking device element, and the corresponding secret key of the locking device element is stored in the locking device element. Using this individual information, the communication between the backend system and the locking device element, in particular the transmission of the update time signal, can be encrypted.

[0048] The update time signal can be buffered in the described device. Accordingly, the backend system first transmits the update time signal to the device. There, the update time signal is buffered and forwarded to the locking device element. For this purpose, it is preferably provided that the locking device element is configured to receive a buffer time period with which the update time signal was buffered between the backend system and the locking device element, in particular on the device. The buffer time period is determined by the device.

[0049] Furthermore, the blocking device element is preferably designed to compare the update time corrected by the buffer storage time with the first time and / or second time as a checking step in the processing device.

[0050] Furthermore, the locking device element is preferably designed to set the first time element and / or the second time element based on the update time corrected by the buffering time duration, as a further step, if the update time corrected by the buffering time duration differs from the first time and / or second time by a smaller value than is specified in a stored limit value. The first time element and / or the second time element are therefore set based on the update time; however, only if the update time corrected by the buffering time duration does not deviate too far from the first or second time. This ensures that the update time, particularly in the device, has not been tampered with, since tampering would result in an excessive deviation.

[0051] However, if the update time, corrected by the buffering time, deviates too much from the first and / or second time, i.e., by more than the specified limit, the update time is not used to set the first or second time element. Instead, the update time is discarded.

[0052] The update time may be discarded if the buffer time was too long. To do this, the buffer time can be compared with a buffer threshold stored in the locking device element.

[0053] Regardless of whether the buffering is taken into account, it is preferably provided that the locking device element is configured to adjust the first and / or second time using the received update time. This adjustment can also be referred to as an update. Adjustment describes, in particular, that the first time element and / or the second time element is / are set after the update time. The update time corrected by the buffering time period can preferably be used.

[0054] Preferably, the verification step includes using the first time and / or the second time to determine a time period since the last adjustment, i.e., since the last update. This time period is compared with at least one stored update threshold. This verification step may result in the following further steps: (i) The blocking device element is designed such that, if the time period is greater than a first stored update threshold, a warning is issued as a further step to carry out the adjustment. This warning can be issued, for example, by an acoustic and / or optical signal from the blocking device element. Additionally or alternatively, issuing a warning also describes the transmission of a corresponding signal to the described device and / or the backend system. (ii) Preferably, the blocking device element is designed such that, if the time period is greater than a second stored update threshold, as a further step, it initiates, preferably itself, an at least temporary denial of access to the physical area.This refusal is temporary in that it will be lifted as soon as the first time and / or the second time have been adjusted using the update time.

[0055] Therefore, if the time is not updated for a certain period of time, only a warning can be issued. This preferably does not result in access being denied. However, if no update is performed for a longer period of time, i.e., longer than the second update threshold, access is preferably denied until the update is performed. This ensures that the first or second time is always accurate, so that existing access authorization can be determined more accurately and thus more reliably.

[0056] As already described, it is preferably provided that the locking device element is designed as a key. This key preferably comprises a, in particular rigid, key shaft for insertion into a locking cylinder. The processing device and the first timing element are preferably located in a key groove of the key.

[0057] Particularly preferably, the key shaft comprises a transmission device for transmitting energy and / or electronic data to the locking cylinder. This transmission device comprises, in particular, an electrical conductor as a connection from the processing device to the key shaft.

[0058] The transmission can be contact-based. In the area of ​​the key shaft, the transmission device is particularly designed to contact a corresponding electrically conductive contact inside the locking cylinder, thereby transmitting energy and / or data to the locking cylinder.

[0059] Particularly preferably, at least one locking cylinder ID is electronically stored on the key, wherein the key is configured to check, as an access condition, whether a locking cylinder ID received from a locking cylinder matches the stored locking cylinder ID. This corresponds to an access decision step.

[0060] Particularly preferably, the key is designed to receive the stored locking cylinder ID from the backend system in encrypted form and to decrypt it using encryption information specific to the key. In other words, only this single key can decrypt the received locking cylinder ID.

[0061] The invention preferably comprises an arrangement. Components of the arrangement are at least the locking device element, in particular designed as a key, and the device described above. The device is, as explained, in particular a smartphone, tablet, or laptop. The device is preferably designed to receive electronic data from the backend system and send it to the locking device element. The data can be, in particular, an update time and / or a locking cylinder ID. In particular, the data are encrypted such that only the locking device element, in particular only the key, can decrypt the data. Preferably, only a single locking device element, in particular only a single key, namely the correct recipient of the data, can decrypt the data. The locking device element is preferably designed to initiate, in particular to carry out, the refusal or granting.The locking device element, in particular the processing device, is particularly designed to perform at least one verification step and at least one further step. This can be at least one of the previously described verification steps and / or further steps.

[0062] The invention further comprises a method. This can be an access method in which access to the physical area is granted or denied. The previously described configurations of the locking device element and the associated subclaims are advantageously applied to the access method according to the invention.

[0063] The method uses a locking device element, in particular the locking device element described above.

[0064] Within the scope of the method, a time signal indicating a first time is output, in particular with the described first time element.

[0065] Furthermore, the method involves performing at least one verification step based on the first time or an error message of the first time element. In particular, this is performed in the electronic processing device of the locking device element.

[0066] In the third step of the method, a further step is carried out, in particular by the processing device, depending on the outcome of the verification process, in particular as previously described in the context of the blocking device element.

[0067] Preferably, the method provides that the processing device comprises an internal second time element, preferably with an internal RC element, wherein the second time element generates a second time signal indicating a second time within the processing device.

[0068] Preferably, the method provides that the first time element is designed and arranged separately from the processing device, preferably on a common circuit board, wherein the first time element transmits the first time signal to the processing device; in particular, wherein the first time element is designed as a real-time clock (RTC) with an oscillating crystal.

[0069] Preferably, the method provides that the processing device compares the first time with the second time, in particular compares the first time signal with the second time signal, as a checking step.

[0070] The method preferably provides that, based on the outcome of the verification step, the blocking device element, preferably when the first time and the second time differ by more than a stored first time difference, initiates, preferably itself, an at least temporary denial of access to the physical area as a further step. In particular, the blocking device element initiates, preferably itself carries out, a lifting of the denial after receiving a positive approval message, in particular from a backend system.

[0071] Preferably, the access method provides that the blocking device element, based on the output of the checking step, preferably if the first time and the second time differ by less than a stored second time difference, carries out an access decision step as a further step; in particular, the blocking device element compares a time, in particular the first and / or the second time, with an access authorization time window and / or with an access authorization validity start and / or with an access authorization validity end, to check the access condition.

[0072] Preferably, the method provides that the locking device element, based on the output of the checking step, preferably if the first time and the second time differ by less than a stored second time difference, corrects the second time based on the first time as a further step, in particular sets the second time element after the first time.

[0073] Preferably, the method provides that the checking step comprises the reception and evaluation of an error message of the first time element by the processing device, wherein the blocking device element, depending on the error message, initiates, preferably carries out itself, an at least temporary refusal of access to the physical area as a further step.

[0074] Preferably, the method provides that the locking device element receives an update time signal indicating an update time from a backend system, in particular via a wireless short-range communication with a device.

[0075] Preferably, the method provides that the locking device element receives the update time signal in encrypted form from the backend system and decrypts it using encryption information that is individual for the locking device element.

[0076] Preferably, the method provides that the locking device element receives a buffer time period with which the update time signal was buffered between the backend system and the locking device element, in particular on the device, as a checking step in the processing device compares the update time corrected by the buffer time period with the first time and / or second time, and as a further step, if the update time corrected by the buffer time period differs from the first time and / or second time by a smaller value than is defined in a stored limit value, the first time element and / or the second time element is set based on the update time corrected by the buffer time period, or if the update time corrected by the buffer time period differs from the first and / or second time by a greater value,than specified in a stored limit, the update time is discarded.

[0077] Preferably, the method provides that the locking device element adapts the first and / or second time by means of the received update time, in particular sets the first time element and / or the further time element after the update time, wherein the checking step includes that a time period since the last adaptation is determined by means of the first time and / or the second time and is compared with at least one stored update limit value.

[0078] Preferably, the access method provides that, if the time period is greater than a first stored update limit value, the locking device element issues a warning to carry out the adaptation by means of an update time as a further step.

[0079] Preferably, the access method provides that, if the time period is greater than a second stored update threshold value, the blocking device element initiates, preferably carries out itself, an at least temporary refusal of access to the physical area as a further step, in particular until the first time and / or the second time has been adjusted by means of the update time.

[0080] Preferably, the access method provides that the locking device element is designed as a key, wherein the key comprises a, in particular rigid, key shaft for insertion into a locking cylinder.

[0081] Preferably, the access method provides that the key shaft transmits energy and / or electronic data to the locking cylinder.

[0082] Preferably, the access method provides that at least one locking cylinder ID is electronically stored on the key, wherein the key checks, as an access condition, whether a locking cylinder ID received from a locking cylinder matches the stored locking cylinder ID; in particular, wherein the key receives the locking cylinder ID to be stored in encrypted form from the backend system and decrypts it using encryption information specific to the key.

[0083] The invention will now be described in more detail using an exemplary embodiment. In the following: Fig. 1 shows an arrangement according to the invention with a locking device element according to the invention for carrying out the method according to the invention according to an embodiment, Fig. 2 shows an exploded view of the locking device element according to the invention according to the embodiment, and Fig. 3 shows a schematic, general view of the method according to the invention according to the embodiment, Fig. 4 shows a first embodiment of the method according to the invention, Fig. 5 shows a second embodiment of the method according to the invention and Fig. 6 shows a third embodiment of a method according to the invention, wherein the methods of Figures 4 to 6 can also be combined with each other.

[0084] Fig. 1shows an arrangement 100. This arrangement 100 comprises a locking device element 1, here designed as an electromechanical key. Furthermore, the arrangement 100 comprises a locking cylinder 101, which can be actuated, in particular rotated, by means of the locking device element 1.

[0085] The arrangement 100 further comprises a device 103, designed as a smartphone, tablet, or laptop, and a backend system 104. The backend system 104 is, for example, a server.

[0086] The backend system 104 and the device 103 are connected to each other for data transmission. This data transmission can be wireless, at least in part. Furthermore, the locking device element 1 and the device 103 are connected to each other for data transmission, in particular via wireless near-field communication. The data transmission between the locking cylinder 101 and the locking device element 1 takes place in particular through direct electrically conductive contact, as will be described below.

[0087] The structure of the locking device element 1 results from Fig. 1 and the corresponding exploded view in Fig. 2Accordingly, the locking device element 1 comprises a key blade 2 formed by a housing 10. The housing 10 is composed of a first housing part 11 and a second housing part 12. The two housing parts 11, 12 are connected to one another by a frame 30. The frame 30 is composed of a first frame part 31 and a second frame part 32.

[0088] A key shank 50 of the locking device element 1 extends from the first frame part 31. The key shank 50 comprises a key shank base body 51, which is in particular formed monolithically with the first frame part 31.

[0089] An insert element 54 is inserted into the key shaft base body 51. At least one electrical conductor extends through this insert element 54 as part of a transmission device for transmitting energy and / or electronic data to the locking cylinder 101. The electrical conductor has at least one locking cylinder contact surface 56 at the tip of the key shaft 50 as part of the transmission device. When the locking device element 1 is inserted into the locking cylinder 101, the electrically conductive contact for energy and / or data transmission is established via this locking cylinder contact surface 56.

[0090] Furthermore, the insert element 54 has at least one circuit board contact surface 57, which is located inside the housing 10.

[0091] In particular Fig. 2illustrates an electronics 70 of the locking device element 1. This electronics 70 comprises a circuit board 71. On the circuit board 71 there is a processing device 72 which is designed as a microcontroller.

[0092] The electronics 70 comprises a first time element 76 and a second time element 77. The first time element 76 is located on the circuit board 71, but outside the processing device 72, and is preferably designed as a real-time clock. The second time element 77 is located inside the processing device 72, i.e. in particular inside the microcontroller. In the exemplary embodiment, it is provided that the first time element 76 outputs a first time signal indicating the first time t1. In the exemplary embodiment, it is provided that the second time element 77 is designed to generate a second time signal within the processing device 72 indicating the second time t2. A first time t1 is thus measured by the first time element 76. A second time t2 is thus measured by the second time element 77.

[0093] The first timing element 76 is electrically connected to the processing device 72 for transmitting the first timing signal. The first timing element 76 is designed, in particular, as a real-time clock (RTC) with an oscillating crystal.

[0094] Furthermore, Fig. 2 that the electronics 70 on the circuit board 71 includes a button 73. The button 73 can be actuated by pressing in the first housing part 11. The button 73 can, for example, connect the locking device element 1 to the device 103.

[0095] Furthermore, the electronics 70 comprises a socket 74, for example formed from a USB port, for charging an energy storage device 85 of the locking device element 1.

[0096] Fig. 2further shows that the electronics 70 includes a lighting device 75. This lighting device 75 can, for example, be used to output a warning message or indicate another state of the locking device element 1.

[0097] Fig. 2 further shows that the electronics 70 comprises a wireless communication module 78, with which in particular the data transmission with the device 103 is possible.

[0098] In order to be granted access to a physical space, an electrical actuator (not shown), in particular an electric motor, in the locking cylinder 101 must be energized. This enables a locking element (not shown) in the locking cylinder 101 to release a lock between a rotor 105 of the locking cylinder 101 and a stator 106 of the locking cylinder 101, so that the rotor 105 can rotate in the stator 106. This enables rotation of a driver 107 of the locking cylinder 101. A corresponding actuator and a corresponding locking element are disclosed, for example, in EP 4191004 A1. Alternatively, the rotor 105 can always be rotatable in the stator 106. When access is authorized, the rotor is connected to the driver 107 in a rotationally fixed manner by an actuator, thereby enabling rotation of the driver 107.

[0099] In order to energize the actuator, access authorization must first be determined. For this purpose, several access decision steps are performed. The processing device 72 compares an access authorization time window stored electronically in the processing device 72 with the first and / or second time. If the time used lies within the access authorization time window, the access decision step is concluded with a positive result; otherwise, it is concluded with a negative result. The processing device 72 also checks whether the first and / or second time lies after an access authorization validity start date stored electronically in the processing device 72. If this is the case, this access decision step is concluded with a positive result; otherwise, it is concluded with a negative result.The processing device 72 also checks whether the first and / or second time is before an access authorization validity end date stored electronically in the processing device 72. If this is the case, this access decision step is concluded with a positive result; otherwise, with a negative result.

[0100] In the exemplary embodiment, at least one locking cylinder ID can be electronically stored on the locking device element 1. The locking device element 1 is designed to receive the locking cylinder ID to be stored in an encrypted form from the backend system 104. The locking device element 1 can decrypt the locking cylinder ID using encryption information specific to the locking device element 1. The locking device element 1 is designed to check, as an access condition, whether a locking cylinder ID received from a locking cylinder 101 matches the stored locking cylinder ID; this also corresponds to an access decision step. If a stored locking cylinder ID matches the received locking cylinder ID, the access decision step is concluded with a positive result; otherwise, with a negative result.

[0101] If all access decision steps to be performed in the locking device element 1 have been checked with a positive result, this result is transmitted to the locking cylinder 101, e.g. in the form of an opening command.

[0102] At least one further access decision step can be performed by the locking cylinder 101. For example, the transmitted result is checked to determine whether it originates from an authorized locking device element 1, for example, by appropriate decryption. Additionally or alternatively, a key ID can be transmitted to the locking cylinder 101, with the locking cylinder checking, as an access decision step, whether the key ID is listed in a whitelist or blacklist stored in the locking cylinder 101. If all access decision steps have been completed with a positive result, the actuator is energized, and access is granted by the user rotating the driver 107.

[0103] As a further access decision step, it is conceivable to carry out a biometric verification of the user in the device.

[0104] Because the access decision steps, which require time, run in the locking device element 1, the system is particularly tamper-proof. The stored data for comparison in the access decision steps, such as the access authorization time window, access authorization validity start, access authorization validity end, and locking cylinder ID, are sent in encrypted form from the backend system 104 via the device 103 to the locking device element 1. The device 103 cannot decrypt the data. The data can be linked to one another; for example, different access authorization time windows can be assigned to different locking cylinder IDs.

[0105] The locking device element 1 is designed to receive an update time signal indicating an update time upt from the backend system 104 (see Figure 5), in particular via wireless short-range communication with device 103. In particular, an update time upt is sent from backend system 104 via device 103 to locking device element 1. The update time upt is encrypted in such a way that device 103 cannot decrypt the update time upt. Preferably, the update time upt is decrypted using encryption information specific to locking device element 1.

[0106] Pressing the button 73 can trigger the locking device element 1 to send a request to the backend system 104 via the device 103, e.g., to receive the update time upt and / or to update the data for comparison in the access decision steps.

[0107] By performing the time-requiring access decision steps in the locking device element 1 with the energy storage device 85, the time can be measured continuously. This eliminates the need to measure the time in the locking cylinder 101 and provide a corresponding energy storage device in the locking cylinder.

[0108] Fig. 3 shows purely schematically the steps of the access method 200 defined in the general part of the description with the checking step 201 and the further step 202 depending on the outcome of the checking step 201. The processing device 72 is designed to carry out the checking step 201 based on the first time, and wherein the locking device element 1 is designed to carry out at least one further step 202 depending on the outcome of the checking step 201.

[0109] The described time-dependent access decision steps can be considered an example of a verification step 201. A further step can be considered the transmission of the information to the locking cylinder 101.

[0110] The Figures 4 to 6 show further examples of checking steps 201 and further steps 202, which can each be carried out in the locking device element 1.

[0111] In the example, as in Figure 4 As shown, it is provided that the processing device 72 is designed to compare the first time t1 with the second time t2 as a checking step 201, in particular to compare the first time signal with the second time signal, e.g. by comparing the difference I t1 - t2 I with a stored time difference dt1.

[0112] Based on the outcome of verification step 201, preferably if the first time and the second time differ by more than a stored first time difference dt1 or corresponds to the stored first time difference dt1, a further step 202 initiates an at least temporary denial of access to the physical area by the processing device 72. In this case, the status of the locking device element 1 is set to "tampered."

[0113] Likewise, verification step 201 may include receiving an error message from the first timing element 76 by the processing device 72, for example, because the crystal is no longer oscillating. In this case, too, the status of the locking device element 1 is set to "tampered."

[0114] In the "tampered" state, it is not possible to use the locking device element 1 for an access procedure with a positive outcome. This means that the driver 107 cannot be rotated on any locking cylinder 101 using the locking device element 1 in the "tampered" state.

[0115] In the "manipulated" status, the locking device element 1 sends an unlocking request E to the backend system 104 via the device 103. This corresponds to a subsequent step 203. The locking device element 1 can then receive an approval message G from the backend system 104 in a step 204. In order to replace the manipulated time with a correct time ("reset") in a step 205, the update time upt is received from the locking device element 1 in addition to the approval message. Using this update time upt, the first time t1 can be set at the first time element 76 and / or the second time t2 can be set at the second time element 77.

[0116] As already mentioned, the update time upt is sent encrypted from the backend system 104 to the locking device element 1 such that the device 103 cannot manipulate the update time upt. In a first variant, the update time upt is only adopted if there is a continuous connection between the backend system 104 and the locking device element 1, so that the update time upt is not buffered in the device 103 for a long time and becomes inaccurate. For example, the time between the date of the unlock request E and receipt of the response G + upt can be used as a measure of the connection to the backend system 104. Additionally or alternatively, the device 103 adds a buffer time period zt, with which the update time upt was buffered between the backend system on the device 103, to the approval message. The first and / or second time t1, t2 is adjusted by the update time upt, which is corrected by the buffer time zt.In order to avoid manipulation, it can be provided that the adaptation only takes place if the buffer storage time zt does not exceed a time period stored in the processing device 72.

[0117] The check 201, in which the first and second times t1, t2 are compared, is carried out at regular intervals and as an access decision step in the context of an access procedure.

[0118] In the exemplary embodiment, the locking device element 1 can be configured to initiate, preferably carry out itself, a granting of access to the physical area taking into account at least one further access condition based on the output of the checking step 201, preferably when the first time t1 and the second time t2 differ by less than the stored first time difference dt1, as a further step 202; in particular, the locking device element 1 is configured to compare a time, in particular the first and / or the second time, with an access authorization time window and / or with an access authorization validity start and / or with an access authorization validity end, in order to check the access condition. This applies if the first and second times t1, t2 are compared within an access method.

[0119] In the exemplary embodiment, the locking device element 1 can be designed to correct the second time t2 based on the first time t1 as a further step 202, in particular to set the second time element 77 after the first time t1, based on the output of the checking step 201, preferably when the first time t1 and the second time t2 differ by less than the stored first time difference dt1.

[0120] As in Figure 5As shown, the locking device element 1 is designed to receive a buffer time period zt with which the update time upt between the backend system 104 and the locking device element 1 on the device 103 was buffered.As a checking step 201, the update time upt corrected by the buffering time zt is compared in the processing device 72 with the first time t1 and / or second time t2 (not shown). As a further step 202, if the update time upt corrected by the buffering time zt differs from the first time t1 and / or second time t1 by less (i.e., a lower value) than a stored limit value g, the first time element 76 and / or the second time element 77 is to be set ("sync") based on the update time upt corrected by the buffering time zt, or, if the update time upt corrected by the buffering time zt differs from the first and / or second time t1, t2 by more (i.e., a higher value) than a stored limit value g or corresponds to the limit value g, the update time upt is to be discarded ("no syn").

[0121] If the first and / or second time t1, t2 is set, a time period ZS is restarted (ZS=0). The time period ZS indicates how long ago the first and / or second time t1, t2 was set by an update time upt. If the limit value g is exceeded and the update time upt is discarded, the time period ZS is not restarted ("no reset ZS"). Alternatively, the time at which the first and / or second time t1, t2 was set after the update time upt can be stored in the processing device 72.

[0122] In Figure 6 Verification steps are shown to ensure that the first and / or second time t1, t2 are regularly set by the update time upt. The verification step 201 in Figure 6includes that by means of the first time t1 and / or the second time t2 a time period ZS since the last adjustment is determined and compared with at least one stored update limit value ZD1, ZD2.

[0123] If the time period ZS is greater than a first stored update limit value ZD1, a warning ("Warn.") is issued in a further step 202 to carry out the adjustment by means of an update time upt.

[0124] If the time period ZS is greater than a second stored update threshold ZD2, the status of the locking device element 1 is set to "inaccurate" in a further step 202. In the "inaccurate" status, it is not possible to perform an access procedure for the locking device element 1 with a positive outcome. This means that on no locking cylinder 101 can the driver 107 be rotated using the locking device element 1 in the "inaccurate" status. However, unlike in the "manipulated" status, the "inaccurate" status can be canceled by performing a time synchronization with the backend system 104. This is shown in the lower line of Figure 6 shown. In step 206, a request for an update time upt is first sent to the backend system 104, whereupon the update time upt is received by the backend system 104.

[0125] In this example the Figure 6The buffer time period zt is missing because it is ensured that the connection between the backend system 104, the device 103 and the locking device element 1 is established. Alternatively and in Figure 6 Not shown, the time synchronization with the backend system 104 can be performed using the buffer time period zt, as described above in connection with Figure 5 described.

[0126] In a step 208, the time synchronization is performed, which removes the status "inaccurate".

[0127] Alternatively, and not shown, the locking cylinder 101, for example, particularly if the locking cylinder 101 can be operated by means of a knob, can correspond to the locking device element 1 and communicate directly with the device 103 via short-range communication. Communication between the device 103 and the backend system 104 is maintained. In this case, the corresponding access decision steps are performed in the locking cylinder 101. Instead of the locking cylinder 101, an electromechanical fitting, a padlock, or a smart lock can function as the locking device element 1 and communicate directly with the device 103 and perform the corresponding access decision steps.

Claims

1. Locking device element (1), in particular a key (1), fitting or locking cylinder (101), for use in an access method (200) in which access to a physical area is granted or denied, • wherein the locking device element (1) comprises a first time element (76), wherein the first time element (76) outputs a first time signal indicating a first time (t1), • wherein the locking device element (1) comprises an electronic processing device (72), wherein the electronic processing device (72) is designed to carry out a checking step (201) based on information from the first time element (76), in particular the first time (t1), • wherein the locking device element (1) is designed to carry out at least one further step (202) depending on the outcome of the checking step (201).

2. Locking device element (1) according to claim 1, wherein the processing device (72) comprises an internal second time element (77), preferably with an internal RC element, wherein the second time element (77) is designed to generate a second time signal indicating a second time (t2) within the processing device (72).

3. The locking device element (1) according to claim 1 or 2, wherein the first time element (76) is formed and arranged separately from the processing device (72), preferably on a common circuit board (71), wherein the first time element (76) is electrically connected to the processing device (72) for transmitting the first time signal; in particular, wherein the first time element (76) is formed as a real-time clock (RTC) with an oscillating crystal.

4. Locking device element (1) according to one of claims 2 to 3, wherein the processing device (72) is designed to compare the first time (t1) with the second time (t2) as a checking step (201), in particular to compare the first time signal with the second time signal.

5. Blocking device element (1) according to one of the preceding claims, wherein the blocking device element (1) is designed, based on the output of the checking step (201), preferably when the first time (t1) and the second time (t2) differ by more than a stored first time difference (dt1), to initiate, preferably itself, an at least temporary refusal of access to the physical area as a further step (202); • in particular wherein the blocking device element (1) is designed to initiate, preferably itself, a lifting of the refusal after receiving a positive approval message, in particular from a backend system (104).

6. Locking device element (1) according to one of the preceding claims, wherein the locking device element (1) is designed, based on the output of the checking step (201), preferably when the first time (t1) and the second time (t2) differ by less than a stored second time difference (dt1), • as a further step (202) for checking the access condition, to compare a time, in particular the first and / or the second time (t1, t2), with an access authorization time window and / or with an access authorization validity start and / or with an access authorization validity end, • and / or as a further step (202) to correct the second time (t2) based on the first time (t1), in particular to set the second time element (77) after the first time (t1).

7. Locking device element (1) according to one of the preceding claims, wherein the checking step (201) comprises the reception and evaluation of an error message of the first time element (76) by the processing device (72), wherein the locking device element (1) is designed to initiate, preferably itself, an at least temporary refusal of access to the physical area as a further step (202) depending on the error message.

8. Locking device element (1) according to one of the preceding claims, wherein the locking device element (1) is designed to receive an update time signal indicating an update time (upt) from a backend system (104), in particular via a wireless short-range communication with a device (103).

9. The locking device element (1) according to claim 8, wherein the locking device element (1) is designed to receive the update time signal in encrypted form from the backend system (104) and to decrypt it using encryption information that is individual for the locking device element (1).

10. The locking device element (1) according to one of claims 8 or 9, wherein the locking device element (1) is configured to: • receive a buffer time period (zt) with which the update time signal was buffered between the backend system (104) and the locking device element (1), in particular on the device (103), • as a checking step (201) in the processing device (72), compare the update time (upt) corrected by the buffer time period (zt) with the first time (t1) and / or second time (t2), • and as a further step (202), if the update time (upt) corrected by the buffer time period (zt) differs from the first time (t1) and / or second time (t2) by less than a stored limit value, set the first time element (76) and / or the second time element (77) based on the update time (upt) corrected by the buffer time period (zt), or,If the update time (upt) corrected by the buffer time (zt) differs from the first and / or second time by more than one stored limit, the update time (upt) is to be discarded.

11. Locking device element (1) according to one of claims 8 to 10, • wherein the locking device element (1) is designed to adapt the first and / or second time (t2) by means of the received update time, in particular to set the first time element (76) and / or the second time element (77) after the update time (upt), • wherein the checking step (201) includes that a time period (ZS) since the last adaptation is determined by means of the first time (t1) and / or the second time (t2) and is compared with at least one stored update limit value (ZD1, ZD2).

12. Locking device element (1) according to claim 11, wherein, if the time period (ZS) is greater than a first stored update limit value (ZD1), the locking device element (1) is designed to issue, as a further step (202), a warning to carry out the adaptation by means of an update time (upt).

13. Blocking device element (1) according to claim 11 or 12, wherein, if the time period (ZS) is greater than a second stored update limit value (ZD2), the blocking device element (1) is designed to initiate, preferably carry out itself, an at least temporary refusal of access to the physical area as a further step (202), in particular until the first time (t1) and / or the second time (t2) has been adjusted by means of the update time (upt).

14. Locking device element (1) according to one of the preceding claims, wherein the locking device element (1) is designed as a key, wherein the key comprises a, in particular rigid, key shaft (50) for insertion into a locking cylinder (101).

15. Locking device element (1) according to claim 14, wherein the key shaft (50) comprises a transmission device (56) for transmitting energy and / or electronic data to the locking cylinder (101).

16. The locking device element (1) according to claim 14 or 15, wherein at least one locking cylinder ID is electronically stored on the locking device element (1), wherein the locking device element (1) is configured to check, as an access condition, whether a locking cylinder ID received from a locking cylinder (101) matches the stored locking cylinder ID; wherein the locking device element (1) is configured to receive the locking cylinder ID to be stored in encrypted form from the backend system (104) and to decrypt it using encryption information specific to the locking device element (1).

17. Method, in particular access method (200), in which access to a physical area is granted or denied, • Using a locking device element (1), in particular according to one of the preceding claims, and outputting a time signal indicating a first time (t1), in particular with a first time element (76) of the locking device element, • Carrying out a checking step (201) based on the first time (t1), in particular in an electronic processing device (72) of the locking device element (1), • Carrying out a further step (202) depending on the output of the checking step (201).

Images