Method for changing a configuration of a locking device

Abstract

The invention relates to a method (200, 300, 400) for changing the configuration of an electromechanical locking device after commissioning of the locking device (40), wherein the change of the configuration of the locking device (40) particularly comprises a firmware update or a decommissioning, wherein the method (200, 300, 400) is carried out by means of a key (30), wherein the key (30) is configured to communicate electronically with the locking device (40) via a first communication link, wherein the key (30) is configured to communicate with a device (20) via a wireless second communication link, wherein the device (20) is configured to communicate with a computing unit (10) via a third communication link, wherein the method (200, 300,400) comprising the following steps: a) The key (30) receives a command message (50) containing a command (60) to change the configuration of the locking device (40) from the computing unit (10) via the device (20), the receipt of the command message (50) occurring only if the key (30) has previously been selected by the computing unit to receive the command message (50) based on at least one criterion stored in the computing unit (10); b) The key (30) commands the locking device (40) to carry out the configuration change (61) when the key (30) and the locking device (40) are electronically in communication.

Description

[0001] The present invention relates to a method for changing the configuration of an electromechanical locking device after the locking device has been put into operation. Changing the configuration of the locking device involves, in particular, a firmware update of the locking device or a decommissioning of the locking device. The present invention further relates to a key for carrying out the method according to the invention, a locking unit comprising a key according to the invention and the locking device, a locking system, and a security system comprising multiple locking systems.

[0002] EP 2 821 970 A1 discloses a locking system for updating access rights for a locking cylinder. In this system, information for updating the locking device is sent from a remote computing unit to a physical key via a mobile device. The mobile device plays an active role, for example, by allowing the validity period of a key to be extended. Since a mobile device is susceptible to manipulation, the security of the locking system can be compromised in the event of such manipulation.

[0003] WO2024 / 083878 A1 also discloses a locking system with which a locking device can be put into operation. It does not disclose how the locking system can perform configuration changes after commissioning.

[0004] The object of the present invention is to provide a method, a key, a locking unit, a locking system and a security system with which configuration changes can be carried out in a particularly secure manner.

[0005] The problem is solved by the features of the independent claims. The dependent claims relate to preferred embodiments of the invention. Features and details described in connection with the method according to the invention also apply in connection with the key, locking unit, locking system, and security system according to the invention, and vice versa. In particular, a method that can be carried out with a key according to any one of claims 7 to 12 or with a locking system according to claim 15, and / or a key, locking unit, or locking system with which a method according to any one of claims 1 to 6 can be carried out, is protected.

[0006] According to the invention, the method is carried out by means of a key, wherein the key is configured to communicate electronically with the locking device via a first communication link, wherein the key is configured to communicate with a device via a second communication link, wherein the device is configured to communicate with a computing unit via a third communication link, wherein the method comprises the following steps: a) The key receives a command message containing a command to change the configuration of the locking device from the computing unit via the device, whereby the receipt of the command message only occurs if the key has previously been selected by the computing unit to receive the command message based on at least one criterion stored in the computing unit; b) The key commands the locking device to carry out the configuration change if the key and the locking device are in electronic communication link.

[0007] Accordingly, a key according to the invention is designed to communicate electronically with a locking device via a first communication link, and wherein the key is designed to communicate with a device, in particular a mobile device, via a second communication link. wherein the key comprises a key ID, wherein the key is configured to perform procedure steps a) and b). Thus, the key is configured to perform the following procedure steps sequentially: a) The key receives a command message containing a command to change the configuration of the locking device from the computing unit via the device, wherein the receipt of the command message only occurs if the key has previously been selected by the computing unit to receive the command message based on at least one criterion stored in the computing unit; b) The key commands the locking device to perform the configuration change if the key and the locking device are electronically in communication.

[0008] Changing the configuration is considered maintenance of the locking device. This can also be referred to as "maintenance." Therefore, it is a configuration change that relates to the function of the locking device itself. Thus, the configuration change does not relate to individual access permissions or to an update of a whitelist or blacklist that may be stored in the locking device.

[0009] Preferably, this involves a digital configuration change of the locking device.

[0010] Changing the configuration of the locking device could involve, for example, a firmware update or a decommissioning of the locking device. Additionally or alternatively, changing the configuration of the locking device could involve modifying cryptographic information stored within the locking device.

[0011] The invention has the advantage that the decision as to whether a change to the electronic configuration of the locking device is made by the processing unit, and in particular exclusively by the processing unit. The processing unit also determines which key of the locking device's security system should command the configuration change. Thus, a change to the locking device's configuration can only be achieved via the processing unit. Furthermore, a particularly secure method is chosen for implementing the configuration change. The device serves merely as a communication aid to transmit the command from the processing unit to the key, or possibly additionally for a security check or a query to the processing unit.The key in question (unlike conventional devices such as mobile phones) is a device used exclusively within the locking system and can therefore be designed with exceptional security. A keyholder can transport the mobile key to the locking device to perform configuration changes. This establishes a secure communication path from the often remotely located processing unit to the locking device. Once the configuration change has been initiated by the processing unit, the process then proceeds largely or fully automatically.

[0012] The key preferably comprises a key shaft. The key shaft can be inserted into the locking device, preferably into a keyway of the locking device. The key and key shaft are preferably designed such that torque can be transmitted to the locking device via the key shaft. The mechanical movement of the locking device is thus preferably effected by the key.

[0013] It is preferably provided that the key, in particular via the key shaft, establishes an electrical connection to the locking device. The connection can be wireless or wired. The key and the locking device comprise corresponding transmission devices for this purpose. "Wired" (also referred to as non-wireless) means that the connection is made via at least one conductor in the key that can be brought into electrically conductive contact with electronic components of the locking device. The key and the locking device can comprise corresponding, mutually corresponding electrical contacts as transmission devices for this purpose.

[0014] The connection can be used to transmit digital data. Thus, the connection can correspond to the first communication link. Through the electrical connection, it is possible to exchange digital data, particularly not wirelessly, between the key and the locking device. Therefore, the key is designed to communicate electronically with the locking device. For this purpose, it is specifically intended that the key is inserted into a key slot of the locking device. Additionally, the transmission devices make it possible to transfer electrical energy (also referred to as electric current) from the key to the locking device.

[0015] The key includes an electronic device. This electronic device may include a processor and / or electronic memory. The key ID may be stored in the electronic device. The key ID is a unique electronic identifier for the key, such as a serial number.

[0016] The electromechanical locking device is preferably a lock cylinder, in particular a double or half cylinder, a furniture cylinder, a padlock, or a similar device. The electromechanical locking device, designed as a lock cylinder, can be inserted into a lock (for example, a mortise lock) on a door as a possible locking element. The padlock can, for example, be mounted on a door. The locking device can be mounted on or in various locking elements, such as gates, drawers, barriers, etc. The locking device preferably comprises an electromechanical actuator and a follower. The electromechanical actuator can be controlled by the locking device's electronics to move the follower from a non-rotating to a rotatable state.The locking device electronics may include a processor and / or electronic memory.

[0017] Preferably, the locking device only activates the actuator during operation if access authorization exists. This access authorization is digital information that is verified in the key and / or in the locking device before the locking device activates the actuator. Preferably, the access authorization is stored in the key's memory.

[0018] Preferably, the key is free of mechanical coding. Thus, the key and / or the locking device only check electronically, in particular based on access authorization, whether the actuator should be activated. Therefore, the key is preferably an electronic key.

[0019] The locking device may include a locking device ID. The locking device ID is a unique electronic identifier for the locking device, such as a serial number. The locking device ID is preferably stored in the locking device's memory.

[0020] The device is preferably a mobile device, in particular a smartphone, tablet, or laptop. Alternatively, the device can also be a terminal that is mounted in or on the building, for example, on the wall, and is used for room and / or building control. In the case of a mobile device, the device preferably belongs to exactly one key holder. Preferably, the device is able to establish a connection to the internet and / or a telecommunications network. Preferably, the device can communicate with the computing unit via the internet or the telecommunications network as a third communication link. For this purpose, the device and the computing unit can include corresponding transmitting and receiving units.

[0021] The computing unit can be located anywhere. In particular, it is intended that the device communicates wirelessly with the computing unit, especially via the internet or a telecommunications network. The computing unit can, for example, be a server. The server can also be provided virtually, especially as a cloud server or as a virtual area of ​​a cloud server. In particular, a database is stored in the computing unit. The computing unit thus comprises at least one electronic memory. Preferably, information about which key has been selected to execute the command to change the electronic configuration of the locking device is stored in the electronic memory. The computing unit can comprise at least one processor. The computing unit can include an input / output device with which, for example, an administrator can operate the computing unit.

[0022] The processing unit can store a digital representation of the key and / or a digital representation of the locking device. The term "digital representation" refers to a virtual representation of the key or locking device that is stored electronically in the processing unit. The digital representation can contain information about the physical key or the physical locking device. Information indicating that the key has been selected to execute the command to change the electronic configuration of the locking device can be stored in the digital representation of the key.

[0023] Preferably, the device includes input means; for example, a keyboard and / or a touchscreen. More preferably, the device includes output means; for example, a screen, in particular a touchscreen, and / or a loudspeaker. The device preferably comprises electronics. The electronics serve, in particular, to process inputs to the input means and / or to display a message on the output means and / or to communicate with the processing unit and the key. The electronics may include memory.

[0024] The device is designed to communicate with the locking element via a communication link, preferably wireless, such as NFC, Bluetooth Low Energy, or Ultra Wide Band. The second communication link is therefore preferably a short-range wireless communication link. For this purpose, the device and the key can include corresponding transmitting and receiving devices. The command message in step a) is thus received via the second and third communication links. Preferably, it is not necessary for the second and third communication links to be established simultaneously. Instead, the device can first buffer the command message.

[0025] Preferably, the first communication link, the second communication link and the third communication link are bidirectional.

[0026] Establishing the second communication link between the device and the key may require an action on the key. For example, the key may include a button, and pressing this button is necessary to establish communication via the second wireless link.

[0027] The transfer or being transferred of electronic or digital data includes data transmission according to the push or pull principle, or polling. Receiving data involves transferring it from the receiving end.

[0028] The term "firmware update" refers specifically to a process in which the firmware stored in the locking device is replaced or updated with a newer firmware version. Firmware is a special type of software embedded in the locking device's hardware that controls its functions.

[0029] The term "decommissioning" refers in particular to a process at the end of which the locking device no longer contains any sensitive data of the locking system in which the locking device was used.

[0030] The locking system contains several locking devices. Furthermore, the locking system employs a specific access authorization concept. For example, multiple authorized users can be assigned to the locking system, with each authorized user having access to one or more of the locking devices.

[0031] In the context of this disclosure, an assignment is understood in particular to mean a logical assignment.

[0032] Access rights can be divided into authorization groups. For example, the locking system might apply to an apartment building. One authorization group could be for the building manager, who is permitted to lock all doors except those on individual apartments. Another authorization group could be for the apartment owners, who are allowed, for example, to lock the doors on the building's main entrance and their own apartments.

[0033] In an alternative example, the locking system might affect critical infrastructure. One authorization group can unlock locking devices that secure a physical area or infrastructure device with a specific security level. Another authorization group, however, is not permitted to unlock these locking devices, but only those that do not secure an area or infrastructure device with that security level.

[0034] Preferably, the locking system comprises several locking devices that are assigned to, in particular, a locking system owner, e.g., a housing company, a critical infrastructure operator, facility manager or property manager.

[0035] Preferably, a locking system is additionally or alternatively characterized by the fact that it includes at least one list of blocked access authorizations and / or blocked keys, referred to as a blacklist. The blocked access authorizations and / or blocked keys may relate to one or more locking devices of the locking system. The at least one blacklist is preferably limited to a single locking system. In other words, different locking systems are distinguished by their respective blacklists.

[0036] The locking system can additionally or alternatively be characterized by the fact that it incorporates its own encryption information, e.g., its own encryption key and / or its own encryption algorithm. This encryption information can also be referred to as cryptographic information and / or the encryption key as a cryptographic key. Thus, different locking systems primarily differ in their encryption information.

[0037] Decommissioning the locking device can include resetting it to factory settings. In particular, decommissioning the locking device can involve deleting the cryptographic information of the locking system stored in the locking device. Preferably, activation is achieved using cryptographic information that is stored in the locking device during its manufacture. This allows the electromechanical actuator of the locking device to be activated by any mechanically compatible key from the same manufacturer or by any mechanically compatible key of the security system.

[0038] At the end of the decommissioning process, the locking device is deactivated with respect to the locking system. Decommissioning the locking device ensures that it can be reused in another locking system, provided the locking device itself is functional. Decommissioning the locking device may include deactivating the digital representation of the locking device, including the locking device ID, from the locking system. During decommissioning, digital information linking to the digital representation of the locking device and / or digital information restricting the locking device's use to a single locking system may be deactivated or deleted from the locking device.

[0039] Optionally, the decommissioning of the locking device may include the physical removal of the locking device at its installation location.

[0040] The command message received by the key in step a) is a digital message. Specifically, the command message was generated by the processing unit. The command message contains digital information that enables the key to instruct the correct locking device to make the correct configuration change. The command itself is part of the command message. The command preferably contains digital information that enables the key to instruct the correct locking device to make the correct configuration change.

[0041] A mandatory prerequisite for the key to receive the command message is that at least one criterion is digitally stored in the processing unit. The processing unit uses this criterion to select at least one, preferably several, keys to command the locking device to change its configuration and thus become the recipients of the command message. For example, one criterion could be the type of configuration change. Since a firmware update closes a security vulnerability, whereas decommissioning a locking device poses a security risk, more keys in the locking system may be authorized to perform a firmware update than a decommissioning. In particular, for example, all keys in the locking system could be selected to perform a firmware update. An additional or alternative criterion could be membership in the locking system.

[0042] The procedural step b), in which the key commands the configuration change of the locking device, may depend on at least one condition. For example, the locking device and the key must first verify each other.

[0043] Thus, it can be provided that the locking device and the key verify themselves before the electronic configuration is changed, in particular by means of cryptographic information from the locking system.

[0044] After process step b), the locking device executes the command. It may be stipulated that the locking device only executes the command if at least one prior check has been successfully completed. For example, it is checked whether the command is not outdated. Additionally or alternatively, it can be checked whether the key transferring the command is listed on the blacklist stored in the locking device.

[0045] The "command" in step b) can involve the key transferring the received digital command to the locking device. The key can modify the command before transferring it. For example, the key can change the encryption of the command. It can also omit or add information to the command. Thus, before transferring the command, the key can generate at least one digital key-command message, which it can use to instruct the locking device to execute the configuration change. For simplicity, the term "one key-command message" is used below, even though this may involve multiple digital messages.

[0046] As already mentioned, the selection of the key in the computing unit and the secure transfer of the command to the key inherent in the locking system are essential to the invention.

[0047] The correct selection of the key can be reflected in the fact that the command is included in the command message, which contains the key ID. The secure transfer of the command to the key can be reflected in the fact that the command is unreadable by the device. In particular, the command is encrypted in such a way that the device cannot read it.

[0048] An additional or alternative formulation of step a) in the independent procedural claim and the independent claim directed to the key can therefore also be formulated as follows: a) The key receives a command message containing a command to change the electronic configuration of the locking device, in particular from the computing unit via the device, wherein the command message includes the command, wherein the command message includes the key ID of the key, and wherein the command is not readable by the device.

[0049] Preferably, each key is assigned to exactly one locking system.

[0050] Each key of the locking system is preferably assigned to exactly one user, who is referred to as the key holder. In one embodiment of the invention, each key holder is also assigned only exactly one key. In an alternative embodiment of the invention, several keys can be assigned to one key holder. If several keys are assigned to one key holder, each of the several keys preferably belongs to a different locking system.

[0051] It may be provided that the computing unit stores an association between a key holder's identifier and the key's digital representation. Additionally or alternatively, it may be provided that the computing unit stores an association between a key holder's identifier and the key's ID. An association can also be understood as a digital link or assignment of the key holder's identifier to the key's digital representation and / or the key ID. A key holder's identifier could be, for example, a name or a key holder ID.

[0052] Preferably, the procedure includes the following step: enabling the selection of the key as the recipient of the command message depending on an authorization role of the key holder as a stored criterion.

[0053] The term authorization role refers to a type of authorization assigned to a key holder in a locking system. The authorization role determines which actions the key holder is permitted to perform with the key.

[0054] For example, an authorization role might correspond to an authorized user. The authorized user can use the key to activate the actuator, thereby gaining access to a room. Another authorization role might correspond to a picker. The picker can decommission and commission (activate) locking devices.

[0055] An optional additional authorization role can correspond to a firmware installer. The firmware installer can update the firmware of the locking device. However, it is also conceivable that the firmware installer does not have its own authorization role. For example, it could be stipulated that every key holder is allowed to update the firmware of the locking device. Alternatively, it could be stipulated that only the order picker is allowed to update the firmware of the locking device.

[0056] A picker and, if applicable, a firmware installer do not need access permissions. However, a picker may have access permissions.

[0057] The authorization roles "Authorized Access Person", "Order Picker" and, if applicable, "Firmware Installer" are authorization roles of key holders who allow their keys to interact with the locking devices of the locking system.

[0058] The locking system can provide at least one user role for administrative tasks. This user role can correspond to an administrator. The administrator is authorized to initiate the transfer of a command from the processing unit to the key. The administrator is authorized to digitally create users, keys, and / or locking devices in the processing unit. The administrator is authorized to assign authorization roles to key holders. The administrator is authorized to grant access permissions.

[0059] Another user role can correspond to a firmware updater. The firmware updater could be, for example, a service technician from the manufacturer whose sole right is to roll out a firmware update. In this role, the firmware updater can, for example, select the locking devices that require a firmware update.

[0060] An additional, optional authorization and / or user role can be assigned to a locking system owner. For example, the locking system owner can add an administrator to the locking system.

[0061] Preferably, the authorization role for performing a decommissioning has more privileges than the authorization role for performing a firmware update. Specifically, this means that a commissioner has more privileges than an authorized access user or, if applicable, a firmware installer. For example, an authorized access user is not permitted to commission or decommission locking devices.

[0062] Preferably, key holders, regardless of their authorization role, should each possess the same key structure. This means that the keys of key holders with different authorization roles have the same mechanical structure. Which commands the key may receive, or which commands the processing unit transmits to the key, depends solely on the authorization role of the key holder stored in the processing unit.

[0063] Preferably, a digital association of the key holder's identifier with an authorization role of the key holder is stored electronically in the computing unit.

[0064] The process step of enabling key selection based on authorization role is preferably performed by the processing unit. "Enabling" here means that the processing unit automatically checks whether a key is permitted to modify the electronic configuration of the locking device. For example, the processing unit knows which locking device is to undergo which configuration change. For instance, an administrator has selected at least one key that is to receive the command to modify the electronic configuration of the locking device. The processing unit can then verify whether the key holder selected by the administrator has the required authorization role.Since each key is assigned to exactly one key holder, the administrator can select the key holder who is to perform the configuration change of the locking device, rather than the key itself. The processing unit then checks whether the key holder has the required authorization role. If the check reveals that the key holder or the key is not authorized, the processing unit does not generate a command message for the key. Thus, the processing unit can limit the selection of keys to receive the command message. Alternatively, the processing unit can display only those keys or assigned key holders with the appropriate authorization role for selection on the output device. This can also result in a limitation.

[0065] It is conceivable that the procedure includes the following step: automated suggestion or automated execution of the selection of at least one key depending on the authorization role of the key holder.

[0066] This process step is preferably performed by the computing unit. Thus, the computing unit can not only enable the selection of the key depending on the authorization role, but also play a more active role, namely proposing at least one key or key holder with the appropriate authorization role, particularly to an administrator. The proposal can then be accepted or rejected, especially by the administrator. In a further automation, the computing unit can itself fully execute the process of selecting at least one key that is to instruct the locking device to change its configuration.

[0067] The computing unit can optionally make the suggestion or the selection itself based on further criteria. For example, the computing unit can consider a work schedule or the key holder's location.

[0068] It's possible that an application, i.e., a software application, is installed on the device. This application is specifically needed to transfer the command and / or command message from the processing unit to the key. The application is most likely a mobile app.

[0069] Ideally, the key holder must authenticate themselves within the application. This can be done, for example, by entering a password or PIN code, or by using biometric authentication. This authentication can be provided in addition to the authentication used to log into the device.

[0070] Preferably, the key can only receive the command if the key holder has authenticated themselves in an application on the device. Specifically, the key holder must have authenticated themselves in the application, the application must be open, and the key and the device must be communicating simultaneously via the second communication link. This ensures that the key holder-key mapping, which is crucial for secure procedures, is maintained locally at the device. This can be particularly important if the command or command message is initially stored in the device and only transferred to the key after the communication link between the processing unit and the device has been closed.

[0071] Preferably, the locking system, in particular the computing unit, stores which key holder authenticated themselves when the key received the command message from the device. This information is stored, in particular, in the digital representation of the key and / or the locking device, preferably in the representation of the key itself.

[0072] The device can include transfer information. This transfer information is used to transmit the command message to the device. The transfer information can, for example, correspond to the device's IP address or mobile phone number. Preferably, the transfer information is stored electronically in the processing unit as an associated key holder and / or key. The key holder's identifier and / or the digital representation of the key can be associated with the transfer information. The processing unit can be configured to transfer the command message only to the device whose assigned key holder or key has been selected to initiate the configuration change of the locking device. Thus, the command message is only transferred to the device of the key holder whose key has been selected to receive the command message.

[0073] It may be configured that the key can only receive commands or command messages belonging to the key holder who is currently authenticated in the application. To this end, the device can digitally query the processing unit to determine whether the currently authenticated key holder is associated with the key currently communicating with the device. The processing unit can then verify whether the key holder's identifier is associated with the key ID and stored within it. If the processing unit confirms the association, the key can receive the command; otherwise, communication between the device and the key is interrupted. Furthermore, the association of the key holder's identifier with the key ID can be stored within the device for at least a predetermined period.If the device is not in communication with the processing unit, the association stored in the device can be used to determine whether the key is allowed to receive the command. Especially if multiple keys are assigned to a key holder, it can be configured that the key only receives the commands or command messages intended for that key from the device. For example, the device or the key can select only the command messages stored on the device that contain the key ID of the key currently in communication with the device. If only one key is assigned to a key holder, then preferably the key can receive all commands or command messages stored in the device once the second communication connection between the device and the key is established.

[0074] Preferably, the key is designed so that it only commands the locking device to change its configuration according to step b) if the key has previously received the corresponding command to change the locking device's configuration from the processing unit in step a). Thus, it is not possible to change the locking device's configuration locally without involving the processing unit. Rather, it is always necessary for the processing unit to transfer the command to the key in step a). That is, only the mandatory sequence of steps a) and b) leads to a configuration change of the locking device.

[0075] It may be provided that the command is encrypted in such a way that only the key selected to receive the command to change the configuration of the locking device according to step a) can decrypt the command.

[0076] Preferably, after step a), the key automatically commands the configuration change upon its next communication with the locking device. "Automatically" here means that the key commands the configuration change to the locking device without requiring any action from the key holder on the device. Rather, it is sufficient for the key holder to insert the key into the locking device. Of course, the condition can be checked before step b). For example, the key and the locking device can verify each other before step b). It is also conceivable that after step b), the locking device performs at least one check before implementing the configuration change.

[0077] It can be configured so that, for both decommissioning and firmware updates, the key can automatically initiate the configuration change upon its next communication with the locking device. Similarly, an update of the cryptographic information can be performed automatically upon the key's next communication with the locking device.

[0078] However, decommissioning the locking device poses a security risk. This can be addressed, as mentioned above, by allowing key holders with the commissioner role to decommission the locking device, but not authorized personnel or, if applicable, firmware installers.

[0079] However, firmware updates may preferably be performed by order pickers, authorized personnel, and, if applicable, firmware installers.

[0080] Additionally or alternatively, the procedure may differ on site at the locking device.

[0081] In the event that the change to the configuration and the locking device corresponds to a firmware update of the locking device, the key can automatically command the execution of the configuration change during the next communication between the key and the locking device.

[0082] In the event that changing the configuration of the locking device is equivalent to decommissioning the locking device, it may be stipulated that step b) can only be performed after input at the device's input device. Thus, in the case of decommissioning the locking device at the device, an additional action by the key holder is required. For example, the key holder must authenticate themselves in the application, and the second communication link between the key and the device must be established. Additionally or alternatively, it may be stipulated that the key holder must input a decommissioning release into the device using the input device. The device then receives the decommissioning release.

[0083] It may be provided, for example, that the decommissioning release generates an additional command which is transferred to the key.

[0084] To generate the decommissioning authorization, the key holder may be required to press a decommissioning button displayed on the device's output device. Preferably, the decommissioning button appears only after authentication in the application. Additionally or alternatively, a locking device name and / or the locking device ID may be displayed on the output device, requiring the key holder to authorize the decommissioning of the displayed locking device. If the key holder wishes to decommission multiple locking devices, they can select and authorize one from a list of possible devices to be decommissioned.

[0085] Preferably, it is necessary that the key is in communication link with both the locking device and the device when decommissioning takes place.

[0086] The command and the command message are described in more detail below. These features apply to the method according to the invention as well as to the key according to the invention.

[0087] It can be provided that the command message is received by the key along with the command. Preferably, the command message includes the key ID. Particularly preferably, the command is not readable by the device.

[0088] The command can be embedded in the electronic command message. The command can be formatted in a way that is unreadable to the device. In particular, the command is encrypted in such a way that only one key, specifically only the selected key that received the command, can decrypt it.

[0089] It may be intended that the locking device cannot decrypt the command.

[0090] The command message can include a portion that is readable by the device. In particular, the command message's metadata is readable by the device. It may be intended that only the metadata is readable by the device.

[0091] Preferably, the command message includes the key ID of the key. Preferably, command messages can only be transferred to the key if the key ID of the command message and the key match. Additionally or alternatively, the key can only decrypt command messages if the key ID of the command message and the key match.

[0092] Preferably, the command message, in particular the command, includes the locking device ID of the locking device, preferably a list of several locking device IDs on which the electronic configuration change is to be carried out.

[0093] Preferably, the command includes the locking device ID of the locking device. This ensures that the locking device ID is included in the part of the command message that is unreadable by the device. If several locking devices are to undergo the same electronic configuration change for the same key, the command message, and in particular the command itself, may include a list of the corresponding locking device IDs.

[0094] Preferably, the selection of which locking device is to undergo electronic configuration changes can only be received by the processing unit. Thus, it is not possible to determine one or more locking devices for electronic configuration changes without involving the processing unit. Therefore, the selection of the locking devices is performed in the processing unit, possibly with the assistance of an administrator or firmware updater. The selection of the at least one locking device for which the configuration change is to be performed can be stored in the processing unit. Preferably, it is always necessary that the decision to change the configuration of the locking device is made by the processing unit, possibly with the assistance of an administrator or firmware updater.a decision is made with the involvement of an administrator or firmware updater, and a corresponding command is transferred from the computing unit to the key.

[0095] The command message, and in particular the command itself, may contain information about the type of configuration change. Thus, the command message, and especially the command, specifies, for example, whether a decommissioning of the locking device, a firmware update of the locking device, or, if applicable, an update of the locking device's cryptographic information is to be performed. Preferably, the command includes information about the type of configuration change. This places this information in the part of the command message that is unreadable by the device.

[0096] Additionally or alternatively, the command may include a configuration change number. For example, the configuration change number could be a sequential number for each type of configuration change. Using the configuration change number, a chronological sequence of commands transferred by the processing unit can be tracked. This allows the interlock device to check, as a verification step, whether the command is outdated or not. To this end, the interlock device may store the corresponding configuration change number after the configuration change has been executed.

[0097] In particular, the information about the type of configuration change and / or the configuration change number is included in the key command message.

[0098] It may be provided that the locking device only performs the configuration change if the configuration change number received from the key is greater than the configuration change number stored in the locking device.

[0099] After the configuration change has been carried out, the locking device preferably reports the execution of the command back to the processing unit via the key and the device. In particular, the processing unit stores information about the changed configuration in the digital representation of the locking device. It may be provided that the processing unit stores the successful execution of the command in the digital representation of the key that performed step b).

[0100] Preferably, several keys are selected for executing the command to change the electronic configuration of the locking device, and this selection is stored in the computing unit, particularly in the digital representations of the selected keys. Thus, a command with the same information about the type of configuration change and / or the same configuration change number and / or the same locking device ID can be transferred to multiple keys. The command can be encrypted differently for different keys. The command can be embedded in different command messages that differ at least by their respective key IDs.

[0101] Once the configuration change has been reported back to the processing unit, it can be provided that each of the multiple keys to which the processing unit has transmitted a command for the same configuration change of the same locking device receives a message from the processing unit instructing them not to execute the command. The keys can then delete or deactivate the command. Such a message could, for example, be sent during the next key update.

[0102] If multiple keys have received the same command (possibly encrypted differently), it can be prevented that the same command is executed by different keys via the locking device by storing the configuration change number in the locking device and / or by deactivating or deleting the command in the multiple keys after execution.

[0103] Preferably, the key decrypts the command before performing step b). This minimizes the time between inserting the key into the locking device and the configuration change being implemented. The key can also check whether the command message, particularly the command itself, has been received incorrectly. In case of incorrect reception, the key can report the error to the processing unit via the device, whereupon the key receives the command again from the processing unit via the device. Because this process can occur before the key is inserted into the locking device, time is saved after the key is inserted.

[0104] Preferably, information regarding the output device is transmitted from the processing unit to the device in a separate transfer from the command message. This information may include, for example, which configuration change is to be made and / or at which locking device the configuration change is to be performed. This separate transfer can be carried out, for example, via a separate email or a separate text message.

[0105] The command message can include a firmware update data package if the configuration change corresponds to a firmware update. Thus, in addition to the command and the key ID, the firmware update data package can also be included in the command message. Preferably, the firmware update data package is encrypted and can be decrypted by the locking device. Even more preferably, the firmware update data package cannot be decrypted by the device. It can be provided that the firmware update data package cannot be decrypted by the key.

[0106] For example, the key can only store one firmware update data package at a time. This firmware update data package can include a firmware version number. It can be configured that the firmware update is only performed by the locking device if the received firmware version number is higher than the firmware version number stored in the locking device.

[0107] It may be provided that the firmware version number stored on the locking device is stored in the digital representation of the locking device in the computing unit, whereby the computing unit automatically suggests or selects at least one locking device based on the stored firmware version number on which the firmware update is to be carried out.

[0108] Preferably, the key can decommission itself. For this purpose, the key receives a decommissioning command from the computing unit via the device. Preferably, the key can only decommission itself if it has received the decommissioning command from the computing unit.

[0109] The key decommissioning command is preferably encrypted. Preferably, the key decommissioning command is unreadable by the device. Most preferably, the key decommissioning command is decryptable by the key, and especially only by the key, that is to be decommissioned.

[0110] A key decommissioning command message can include the command to decommission the key. The key decommissioning command message can include the key ID of the key to be decommissioned. The key decommissioning command message, specifically the command itself, can contain information indicating that the key is to be decommissioned. The key decommissioning command message, specifically the command itself, can include a configuration change number. Preferably, the key executes the key decommissioning command only if a stored configuration change number is less than the configuration change number of the received key decommissioning command. The key decommissioning command message is transferred from the computing unit to the key via the device.

[0111] Unlike decommissioning the locking device, key decommissioning preferably does not require the key decommissioning command message to be transferred to the key via the device of the key holder, who also holds the necessary authorization role. Instead, the computing unit can transfer the key decommissioning command via the device of the corresponding key holder or via another user who holds the authorization role that permits key decommissioning. This allows keys to be decommissioned even if no key holder capable of performing the decommissioning is assigned to them. For example, the key holder may have changed employers or become ill.

[0112] Thus, it can be provided that the key is trained to decommission itself when the key receives a command to decommission the key from the computing unit via the device, whereby the command to decommission the key can be received from a device of the key holder or from a device of another user with the required authorization role.

[0113] The user with the necessary authorization role to decommission the key is, for example, the order picker. An authorized access user and, if applicable, a firmware installer, on the other hand, typically do not have the necessary authorization role to decommission the key.

[0114] The object of the invention is also achieved by a locking unit. The locking unit comprises the key according to the invention and a locking device. The key is configured as disclosed in the description and / or claimed in claims 7 to 12. The locking device is configured to receive an electronic configuration change command from the key and to execute the configuration change.

[0115] The locking device is specifically designed to only perform the configuration change if the locking device and the key have previously verified each other, in particular through cryptographic information from the locking system.

[0116] The locking device can preferably be configured to perform the configuration change only if the key that commanded the locking device to change the configuration is not on the blacklist. The blacklist is stored electronically in the locking device.

[0117] It may be provided that the locking device only performs the configuration change if the configuration change number received in step b) is greater than a configuration change number stored in the locking device.

[0118] If the configuration change corresponds to a firmware update of the locking device, the locking device receives the firmware update data packet in step b). The locking device is preferably configured to decrypt the encrypted firmware update data packet. It can be provided that the locking device only performs the firmware update if the firmware version number of the received firmware update data packet is higher than a firmware version number stored in the locking device. The locking device is preferably configured to activate the received firmware update data packet.

[0119] If the configuration change corresponds to a decommissioning of the locking device, the locking device is preferably configured to delete the cryptographic information of the locking system after step b). Preferably, the locking device is configured to activate the cryptographic information that is stored in the locking device during its manufacture.

[0120] It may be provided that, upon decommissioning of the locking device, the locking device is configured to delete digital information, for example, a code that assigns the locking device to its digital representation. Alternatively or additionally, upon decommissioning, the locking device may be configured to generate digital information that enables its assignment to a digital representation in another locking system.

[0121] It may be additionally or alternatively provided that, upon decommissioning the locking device, the locking device is configured to delete digital information, for example, a code that assigns the locking device to a locking system. Alternatively or additionally, upon decommissioning the locking device, it may be configured to generate digital information that enables assignment to a different locking system.

[0122] The object of the invention is also achieved by a locking system. The locking system comprises at least one key according to the invention. The key is designed as specified in the description and / or as specified in claims 7 to 12.

[0123] As already mentioned, the locking system comprises several locking devices. The locking devices are designed in particular as described in this disclosure and / or as disclosed in claims 13 and 14 with respect to the locking unit.

[0124] The locking system can include multiple keys, particularly for authorized personnel. The locking system includes at least one key capable of reconfiguring the locking device according to steps a) and b). In the case of decommissioning the locking device, the locking system preferably includes at least one key belonging to a picker. Of course, the locking system can also include multiple keys capable of reconfiguring the locking device according to steps a) and b).

[0125] The locking system according to the invention comprises the computing unit. The computing unit is configured to communicate with the device, particularly wirelessly. Communication takes place, in particular, via the internet or the telecommunications network. The computing unit stores the selection of a key ID for at least one key to execute the command to change the electronic configuration of the locking device. The computing unit also stores at least one criterion for selecting the key that is to recommend the configuration change of the locking device. The computing unit is configured to transfer the command to change the electronic configuration of the locking device to the device.

[0126] From the perspective of the locking system, the inventive concept can be summarized as follows: The locking system is configured with at least one computing unit, a physical key, and a locking device, wherein the key and the locking device are configured to communicate via a first communication link, wherein the key is configured to communicate with a device via a second communication link, and wherein the computing unit is configured to communicate with the device via a third communication link, wherein a criterion for selecting at least one key to command a change in the configuration of the locking device is digitally stored in the computing unit, wherein the computing unit is configured to enable, based on the criterion, the selection of the at least one key to command a change in the configuration of the locking device, in particular to suggest or select the at least one key, wherein the computing unit is configuredto generate a command message containing a command to change the configuration of the locking device for the key and to transfer it to the key via the second and third communication links, wherein the key is configured to command the locking device to change the configuration by transferring a key command message containing a, in particular modified, command to change the configuration of the locking device via the first communication link to the locking device, wherein the locking device is configured to carry out the configuration change after receiving the key command message.

[0127] The computing unit is configured, in particular, as described in this disclosure. Specifically, the computing unit is configured to perform the method according to claim 2 or 3. The computing unit can thus be configured, for example, as the server, in particular as the cloud server or a virtual area of ​​a cloud server. In particular, the database containing digital data of the locking system is stored in the computing unit. The computing unit therefore comprises at least the electronic memory and / or the processor. Preferably, the digital representations of the keys and / or the locking devices of the locking system are stored in the electronic memory. It can be provided that the computing unit contains an association between the key holder's identifier and the digital representation of the key and / or the key ID.Preferably, the authorization roles of the key holders are stored in the computing unit and digitally associated with the key holder's identifier. The computing unit can include the input and output device with which, for example, the administrator can operate the computing unit. The input device can include, for example, a keyboard or a touchscreen. The output device can include, for example, a screen.

[0128] The process step of enabling key selection based on the authorization level is preferably performed by the computing unit. In particular, the computing unit automatically suggests or executes the selection of at least one key based on the key holder's authorization role. If a configuration change to the locking device is required, the computing unit can output the key holder or the key assigned to the key holder, preferably multiple key holders or their assigned keys, to the output device for execution of the configuration change. The output device displays only the key holder(s) who correspond to the authorization role required to perform the configuration change. The selection of the key holder(s) can be confirmed by input at the input device, particularly by the administrator.Alternatively, the computing unit can automatically select the key(s) based on the authorization roles of the assigned key holders who are to receive the configuration change command.

[0129] Particularly in the case of a firmware update for the locking device, the processing unit can select which locking devices require a firmware update from the digital representations. To do this, the processing unit can compare the firmware version number installed on the locking devices and stored in their digital representations with the firmware version number of the firmware update data package. The processing unit can then suggest the appropriate locking devices for the firmware update, or automatically select them, particularly to the administrator and / or the firmware updater.

[0130] The processing unit can receive an electronic request for permission to perform a configuration change on the locking device. The request preferably includes the locking device ID of the device whose configuration is to be changed and the key ID of the key that will command the configuration change to the locking device. If the processing unit receives the request to perform a configuration change on the locking device via the key, it can automatically verify whether the key holder of the key whose key ID is included in the request has the necessary authorization role. If this is not the case, the processing unit can automatically terminate the request and not send the corresponding command to the key.If the key holder has the required authorization role, the computing unit can propose the configuration change to the output device, particularly to the administrator. The proposal can be accepted or rejected via the input device, particularly by the administrator. Alternatively, the computing unit can automatically initiate the configuration change and send a corresponding command to the key.

[0131] If a key configuration change, particularly a key decommissioning, is required, the computing unit can suggest the key holder or a user with the necessary authorization role on whose device the key decommissioning should be performed. The output device then displays only the user(s) authorized to perform the key decommissioning. The selection can be confirmed or rejected by input at the input device, particularly by the administrator. Alternatively, the computing unit can automatically select the user(s) on whose device the key decommissioning should be performed.

[0132] The computing unit can receive a request to decommission a key. This request preferably includes the key ID of the key to be decommissioned and the user who wishes to perform the decommissioning. Upon receiving the decommissioning request, the computing unit can automatically verify whether the requesting user is authorized to decommission the key. Specifically, the computing unit checks whether the user is the key owner or possesses the necessary authorization role. If this is not the case, the computing unit can automatically terminate the request and not send the corresponding command to the key. If the user is authorized to decommission the key, the computing unit can propose the decommissioning of the key on the output device, particularly to the administrator.The proposal can be accepted or rejected via the input device, particularly by the administrator. Alternatively, the computing unit can automatically initiate the decommissioning process and transmit a corresponding command to the key to decommission it.

[0133] The processing unit is configured to generate the command message for changing the configuration of the locking device, namely a firmware update of the locking device or a decommissioning of the locking device, or the key decommissioning command message for decommissioning the key. The processing unit is configured to transfer the command message or the key decommissioning command message to the key via the device. The processing unit is configured to encrypt the command, in particular to encrypt it in such a way that the key, but not the device, can decrypt the command.

[0134] The processing unit is specifically designed to store the authorization roles of the key holders. Preferably, the processing unit is configured so that an administrator can define the authorization roles of the key holders using the input device. For example, when creating a new key holder, the possible authorization roles can be displayed for selection on the output device. The administrator can then preferably select the desired authorization role using the input device.

[0135] The processing unit is specifically configured to electronically store the transfer information for transferring the command message to the device. Preferably, the transfer information is stored electronically in the processing unit as belonging to the key holder and / or the key. That is, the transfer information is associated with the key holder's identifier and / or the key ID and / or the digital representation of the key. The processing unit is configured to transfer the command message for the key to the key holder's device using the transfer information. If the key holder authenticates on a device whose transfer information differs from the transfer information stored as belonging to the key holder, the processing unit is preferably configured to change the transfer information belonging to the key holder accordingly or to suggest such a change.

[0136] Optionally, the locking system includes at least one device belonging to at least one key holder, by means of which the key can receive the error message. If multiple keys of the locking system are configured to perform steps a) and b), the locking system preferably includes the multiple devices of the key holders to whom the corresponding keys belong. The devices can be configured as described.

[0137] The object of the invention is also achieved by a security system with several locking systems according to the invention. The individual locking systems according to the invention can be configured as described in this disclosure. In particular, the locking systems are each configured according to claim 15.

[0138] Preferably, each key is assigned to exactly one locking system. Each key is preferably assigned to exactly one keyholder. In one embodiment of the invention, each keyholder is assigned to exactly one locking system. In an alternative embodiment of the invention, the keyholder can belong to several locking systems. For this purpose, the keyholder can belong to each locking system with one of the several keys assigned to him. The assignment of the keyholder to the key assigned to him in the respective locking system is stored in the processing unit of the respective locking system. Preferably, the keyholder's transfer information is also stored in each processing unit.

[0139] Computing units of several locking systems can together form a computing system, whereby in particular the individual computing units can form virtual areas of the computing system.

[0140] Preferably, a key holder can be assigned to different locking systems within the security system, with the key holder's authorization role varying across these systems. This allows administrators of the different locking systems to assign different authorization roles to the key holder.

[0141] The invention will now be described in more detail with reference to exemplary embodiments. Technical features with the same function are identified in the figures by identical reference numerals. These show: Figure 1 a locking system according to the invention with a key according to the invention and with a locking unit according to the invention, Figure 2Authorization roles and user roles in the locking system of the Figure 1 , Figure 3 two embodiments of a safety system according to the invention, Figure 4 a first method according to the invention for decommissioning a locking device, Figure 5 a method according to the invention for updating the firmware of a locking device, Figure 6 a second method according to the invention for decommissioning a locking device, Figure 7 a first method for decommissioning a key, performed by a locking system according to the invention, Figure 8 a second method for decommissioning a key, performed by a locking system according to the invention, Figure 9 a method for picking a key in the locking system according to the invention, Figure 10 a section of stored digital data in a computing unit of a locking system according to the invention.

[0142] Figure 1Figure 1 shows a locking system 100 according to the invention. The locking system 100 according to the invention comprises a computing unit 10, which is configured as a cloud server or a section of a cloud server. The computing unit 10 further comprises a computer with a screen as an output device 11 of the computing unit 10 and with a keyboard as an input device 12 of the computing unit 10. The computing unit 10 is configured to communicate via a telecommunications network with a device 20, which is configured as a mobile phone.

[0143] Device 20 has a touch display that serves simultaneously as an input device 21 and an output device 22. Device 20 includes a mobile phone number as transfer information, enabling it to communicate wirelessly with the computing unit 10 via a third communication link. Device 20 includes electronic memory and an electronic processor. An application is stored on Device 20. A key holder can authenticate themselves within the application.

[0144] The locking system 100 according to the invention further comprises several keys 30, one of which is a key 30 in Figure 1 The locking system 100 according to the invention also comprises several locking devices 40, one of which is a locking device 40 in Figure 1The key 30 comprises a key shaft 31, which can be inserted into a key channel 41 of the locking device 40. The key shaft 31 includes a transmission element 32, which corresponds to a transmission element (not shown) of the locking device 40. Electrical energy and electronic data can be transmitted from the key 30 to the locking device 40 via the transmission element 32 of the key 30 and the transmission element of the locking device 40. This establishes an initial communication link. If the electronic data includes digital access authorization or the positive result of an access authorization check performed on the key, an electrical actuator of the locking device 40 is activated. This allows the key 30 to rotate an eccentric follower of the locking device 40, thus unlocking a door.Key 30 is designed without any mechanical coding.

[0145] It is also possible to transfer digital data from the locking device 40 to the key 30. The key 30 includes an electrochemical energy storage device that provides the electrical energy for the locking device 40. The transfer of electrical energy and electronic data is contact-based, via electrical contacts of the transmission elements.

[0146] Key 30 includes a button 33. When button 33 is pressed, a second communication connection to device 20 is established. This second wireless communication connection is, for example, a Bluetooth Low Energy (BLE) connection or another short-range communication method. It may be provided that, after the key holder has authenticated in the application and device 20 has received a key ID 53 from key 30, device 20 verifies the key's association with the currently authenticated key holder. To do this, device 20 can transfer the identifier of the currently authenticated key holder and the key ID 53 of key 30, which is in communication with device 20, to the processing unit 10, so that the processing unit 10 can verify whether the identifier of the currently authenticated key holder and the key ID 53 are associated.The processing unit 10 informs the device 20 of the result. If no association exists, the communication link between the key 30 and the device 20 is interrupted; otherwise, communication continues so that the key 30 can potentially receive a command 60. If the device 20 is not in communication link with the processing unit 10, the device 20 can perform the verification using an association stored in the device between the key holder's identifier and the key ID 53. In the case of commissioning or decommissioning a key, this verification can be omitted or, in the case of decommissioning, modified so that communication is also possible with a user other than the key holder whose authorization role permits a configuration change of the key 30.

[0147] Thus, electronic data can be transmitted from the computing unit 10 to the device 20 via the telecommunications connection, to the key 30 via the second wireless communication connection, and to the locking device 40 via the transmission elements. Likewise, electronic data can be transferred from the locking device 40 to the computing unit 10 via the path described.

[0148] According to the invention, this method can be used to change the configuration of the locking device 40. For this purpose, the command 60 to change the configuration of the locking device 40 is transferred from the computing unit 10 via the device 20 to the key 30. This is a prerequisite for carrying out the configuration change of the locking device 40. In principle, every key 30 of the locking system 100 is identically equipped with regard to its hardware and can receive such a command. However, according to the invention, not every arbitrary key 30 of the locking system 100 receives such a command. Rather, one or more keys 30 are selected by the computing unit 10 based on a criterion stored in the computing unit 10, and the selected key then commands the configuration change to the locking device.The crucial function of key 30 lies in the fact that key 30 is designed to be more tamper-proof than device 20. Device 20 is used to bridge the considerable distance between key 30 and computing unit 10 for communication purposes. Because key 30 can be carried by the key holder, it is capable of transmitting commands for configuration changes to various locking devices 40 of the locking system 100.

[0149] In Figure 1This illustrates how the command 60 for changing the configuration of the locking device 40 is transmitted from the computing unit 10 to the locking device 40. A command message 50 includes metadata 52. The metadata 52 includes the key ID 53, which uniquely identifies the key 30 in the locking system 100. The metadata 52 is readable by the device 20 and the key 30. The command message 50 also includes the command 60, which can only be decrypted by the key 30. The command 60 includes information about the type of configuration change 61, a configuration change number 62, and at least one locking device ID 63. The locking device ID 63 serves to uniquely identify the locking function 40 in the locking system 100. In the case of a firmware update as a configuration change of the locking device 40, the command 60 also includes a firmware update data package 55.The firmware update data packet 55 is encrypted in such a way that only the locking device 40 can decrypt it. Because the command message 50 includes the key ID 53 and the locking device ID 63, the processing unit 10 already specifies which locking device 40 will be configured using which key 30. Since the command message 50 is largely undecipherable for the device 20, manipulation is prevented. The command message 50 is transferred from the processing unit 10 to the device 20 via the telecommunications network.

[0150] To further enhance tamper resistance, key 30 can only receive the command message 50 stored in device 20 if the key holder has authenticated themselves in the application and the application is open during the communication connection between key 30 and device 20. Only the command messages 50 of the authenticated key holder are visible to key 30. Key 30 receives only the command message 50 that includes the corresponding key ID 53. If multiple command messages 50 for the same key 30 are present in device 20, key 30 receives all of them when the communication connection between key 30 and device 20 is established and the application is open after the key holder has authenticated.It is not necessary for the third communication link between the computing unit 10 and the device 20 and the second communication link between the key 30 and the device 20 to be established simultaneously. Rather, the command message(s) 50 can first be transferred to the device 20, and then, even if the communication link between the device 20 and the computing unit 10 is interrupted, the command message(s) 50 can be transferred to the key 30.

[0151] Command 60 is now decrypted and verified by key 30. An erroneous command 60 or command message 50 is reported back to processing unit 10 via device 20, after which processing unit 10 retransmits command message 50. Likewise, a successful transfer of command 60 or command message 50 from the key to processing unit 10 via device 20 is also reported back.

[0152] The key 30 generates a key command message 65 for the locking device 40.

[0153] The key command message 65 contains information about the type of configuration change 61 and the configuration change number 62. If the configuration change is a firmware update, the key command message 65 includes the firmware update data package 55, which remains encrypted and is only decryptable by the locking device 40.

[0154] Optionally, the key command message 65 can include the key ID 53. Using the key ID 53, the locking device 40 can check whether the key ID 53 is listed on a blacklist stored in the locking device 40. Optionally, it can be specified that the locking device 40 only executes command 60 if the key ID 53 is not on the blacklist.

[0155] Key 30 can encrypt key command message 65 so that key command message 65 can be decrypted by the locking device. Instead of a single key command message 65, the content of key command message 65 can also be split across multiple key command messages 65.

[0156] When the key 30 is inserted into the locking device 40, the key 30 and the locking device 40 verify each other by exchanging cryptographic information from the locking system 100. The locking device 40 transmits the locking device ID 63 to the key 30. This allows the key to check whether the key 30 has stored a key command message 65 for the locking device 40 that is in communication with it. If the check is successful, the key transmits at least one key command message 65 to the locking device 40. This commands the locking device 40 to change its configuration.

[0157] For each type of configuration change, a configuration change number is electronically stored in the locking device 40. The stored configuration change number was saved by the locking device 40 during the last configuration change of the same type. The locking device 40 compares the stored configuration change number with configuration change number 62 of the key command message 65. Only if configuration change number 62 of the key command message 65 is higher than the stored configuration change number does the locking device 40 execute command 60. This prevents outdated commands from being executed.

[0158] How to Figure 6 As will be described in more detail later, further conditions may apply before command 60 is executed by the locking device 40.

[0159] The execution of command 60 is reported back by the locking device 40 to the computing unit 10 via the key 30 and the device 20. The computing unit 10 sends a message to the other keys 30, which have also received command 60 with the same information about the type of configuration change 61, the same configuration change number 62, and the same locking device ID 63. Upon receiving the message, the other keys 30 delete command 60.

[0160] The processing unit 10 has stored a digital representation for each key 30 of the locking system 100. The processing unit 10 has stored a digital representation for each locking device 40 of the locking system 100. The completed and reported change to the configuration of the locking device 40 is stored in the digital representation of the locking device 40. Likewise, the execution of the command 60 is stored in the digital representation of the key 30 that commanded the configuration change to the locking device 40. The identifier of the key holder, who authenticated themselves in the application when the key 30 received the command message 50, is stored in the digital representation of the key 30.

[0161] The digital representation of key 30, which includes the key ID 53 of key 30, is digitally associated with the key holder's identifier in the processing unit. This assigns the key holder to key 30. The selection of the key(s) that transfer the command to change the configuration to the locking device 40 is determined using the key holder associated with key 30 in the processing unit 10. One criterion here is the authorization role 70, 71 that the key holder holds.

[0162] Figure 2Figure 1 shows a concept for different roles 70, 71, 72, 73 within a locking system 100. Keyholders who possess a key in the locking system are shown in light colors and are assigned an authorization role 70, 71. The keyholders are on-site to interact with the locking devices 40 using their keys 30. Users who do not possess a key, or do not necessarily possess one, are shown in Figure 2 Users shown in black perform administrative tasks and are assigned user roles.

[0163] An authorization role 70 corresponds to the authorized role of an access user 70. The access user has at least one digital access authorization stored on the key for a locking device of the locking system. An access user 70 may not decommission the locking device 40. The access user may perform a firmware update of the locking device 40.

[0164] Authorization role 71 corresponds to the authorization role 71 of a picker. The picker is authorized to decommission the locking device 40. The picker is authorized to perform a firmware update of the locking device 40. The picker is authorized to decommission all keys 30 of the locking system 100. The picker may decommission both their own key 30 and keys 30 belonging to other key holders. The picker must have at least one access authorization stored on the key 30. However, it is not mandatory for the picker to have access authorizations stored on the key to perform the configuration changes. In particular, it is not necessary for the picker to have access authorization to the locking device to be decommissioned.

[0165] User role 72 corresponds to user role 72 of an administrator. Administrator 72 can select at least one key, provided the key holder's authorization role allows it, or confirm the selection of the computing unit 10 for a key that is to receive the command message to change the configuration of the locking device 40. Administrator 72 can select locking devices 40 on which the configuration change of the locking device 40 is to be carried out. Administrator 72 can select a key 30 to be decommissioned or confirm a request to decommission a key 30. Administrator 72 can assign authorization roles 70 and 71 to key holders. Administrator 72 may create keys 30 in the locking system 100 and assign access authorizations.Therefore, the administrator can, in principle, also be a key holder with the authorization role of access user or order picker. However, the administrator (72) does not necessarily have to be a key holder as well.

[0166] It is possible that only rollers 70, 71, 72 are provided in the locking system 100.

[0167] An optional user role 73 corresponds to the user role of a Firmware Updater 73. A Firmware Updater 73 may only select locking devices 40 on which a firmware update is to be performed and select the keys 30, taking into account the criteria, that are to receive the command message 50 with the firmware update for the locking device 40. The Firmware Updater 73 is specifically a service employee of the manufacturer of the locking system 100. The Firmware Updater 73 is not also a key holder.

[0168] Figure 3Figure 1 shows two alternative concepts for a security system 1000, 1001. The security system 1000 according to the first concept and the security system 1001 according to the second concept each comprise several locking systems 100, 101, 102, here three locking systems 100, 101, 102 as examples, whose locking devices 40 Figure 3 The locking systems 101, 102, and 103 are shown as examples in a circle. Each locking system comprises a computing unit 10, 10a, and 10b, which represents a virtual area of ​​the cloud server. A shared area 10c of the cloud server is used to provide new firmware updates and is operated, for example, by the manufacturer of the locking systems 100, 101, and 102.

[0169] Keys 30, 30a, 30b, 30c, 30d, and 30e are each assigned to exactly one locking system 100, 101, and 102 in both security systems 1000 and 1001, which in Figure 3The arrangement of keys 30, 30a, 30b, 30c, 30d, 30e within the respective circles of locking systems 100, 101, 102 is shown. Furthermore, keys 30, 30a, 30b, 30c, 30d, 30e are each assigned to exactly one key holder 80, 81, 82, 83, 84, 85 in both security systems 1000, 1001. The assignment of key 30, 30a, 30b, 30c, 30d, 30e to key holder 80, 81, 82, 83, 84, 85 is shown in Figure 3 represented by a line.

[0170] In security system 1000, all key holders 80, 81, 82, 83, 84, 85 are assigned to exactly one locking system 100, 101, which in Figure 3This is represented by the arrangement of the key holders 80, 81, 82, 83, 84, 85 within the circle of the respective firing system 100, 101, 102. Likewise, each key holder 80, 81, 82, 83, 84, 85 of the security system 1000 possesses exactly one key 30, 30a, 30b, 30c, 30d, 30e. Key holders 80, 81, 82, 83, 84, and 85 have 1000 different authorization roles (70, 71) in the security system. Each key holder (80, 81, 82, 83, 84, 85) has exactly one authorization role (70, 71). Key holders 80 and 83 are authorized access users (70). Key holders 81, 82, 84, and 85 are order pickers (71).

[0171] In security system 1001, some key holders 81 and 82 are assigned to several locking systems 100 and 101. Other key holders 80 and 83, however, are assigned to only one locking system 100 or 102, with each of these key holders having exactly one authorization role 70 or 71, respectively. Key holder 81, who is assigned to locking systems 100 and 101, has the same authorization role as order picker 71 in both locking systems 100 and 101. However, key holders can have a different authorization role in each locking system 100, 101, or 102 of security system 1001. This is shown as an example for key holder 82. The key holder 82 acts with the key 30c in the locking system 101 as access authorised person 70 and with the key 30e in the locking system 102 as order picker 71.

[0172] In the Figures 4 to 8Different procedures for decommissioning or performing a firmware update of a locking device or key are shown. Arrows indicate the transfer of digital data. A circle with arrows shows digital processing steps in one of the involved devices 10, 20, 30, 40. From top to bottom, the Figures 4 to 8 Each time period is shown.

[0173] Figure 4Figure 1 shows a first embodiment of a method 200 for decommissioning a locking device 40. In a first method step 201, a locking device 40 is selected for decommissioning using the input and output devices 11, 12. The selection is stored in the digital representation of the locking device 40. The processing unit 10 then proposes at least one key 30 of a picker 82 on the output device 11, who is to carry out the decommissioning on site. The processing unit 10 considers the authorization role of the key holders of the keys 30 in question as a selection criterion. An administrator 83 confirms the selection of the key 30 via the input device 12. The task of decommissioning the selected locking device 40 is digitally stored in the digital representation of the selected key 30.A corresponding command message 50 is generated in encrypted form by the processing unit 10. A configuration change is only possible by means of such a generated command message 50, i.e., after selecting the locking device 40 whose configuration is to be changed and selecting the key as the tool for the configuration change using the processing unit 10.

[0174] In a second process step 202, the command message 50 is transferred via the telecommunications network using the mobile phone number of the device 20, which is stored in the computing unit 10 as belonging to the key holder of the selected key 30.

[0175] In a third process step 203, the command message 50 is transferred from the device 20 to the key 30. For this purpose, the key holder must authenticate himself in the application of the device 20 and establish the communication connection between the device 20 and the key 30 by pressing button 33.

[0176] In a fourth process step 204, the key 30 decrypts the command message 50 and reports the successful receipt of the command message 50 back to the computing unit 10 via the device 20.

[0177] In a separate message 90, the processing unit 10 sends the task of decommissioning the locking device 40 to the device 20 in a process step 205. The device 20 displays the message 90 on the output device 22. The order picker 82 then reads the message 90 with the task of decommissioning the locking device 40 and goes to the corresponding locking device 40.

[0178] On site, order picker 82 inserts key 30 into locking device 40 in process step 206. Key 30 and locking device 40 then verify each other. Additionally, the locking device transmits its ID 63 to key 30. If key 30 and locking device 40 cannot verify each other, process 200 is aborted.

[0179] In the event of successful verification, key 30 checks whether it has stored a command 60 for the locking device 40 with the locking device ID 63. Since this is the case, key 30 then automatically transmits the key command message 65 to the locking device 40 in a procedure step 207. The locking device 40 decrypts the key command message 65. Optionally, the locking device 40 checks whether key 30 is listed on the blacklist stored in the locking device 40. If the key is on the blacklist, the procedure is aborted. If the key is not on the blacklist, the procedure continues.

[0180] In a procedure step 208, the locking device 40 compares the configuration change number of the key command message 65 with a configuration change number for decommissioning stored in the locking device 40. Decommissioning D is performed only if the configuration change number of the key command message 65 is greater than the stored configuration change number.

[0181] In the next process step 209, decommissioning D is performed. For this purpose, the locking device 40 deletes the cryptographic information of the locking system 100. The locking device 40 activates the cryptographic information that was stored in the locking device 40 during its manufacture. Furthermore, the locking device 40 deletes a code that assigns the locking device 40 to its digital representation. The locking device 40 also generates a code that enables assignment to a digital representation in another locking system 100. The locking device 40 also deletes a code that assigns the locking device to a locking system 100. Finally, the locking device 40 generates a code that enables assignment to another locking system 101, 102.

[0182] During process steps 206 to 209, the key 30 must remain inserted in the locking device 40; otherwise, the process 200 is aborted. After the locking device 40 has been decommissioned D, a digital message 66, indicating that the locking device 40 has been decommissioned using the key 30, is sent via the key 30 and the device 20 to the computing unit 10 in a process step 210. This is processed in Figure 4 represented as a continuous arrow, although message 66 may also be stored for a longer period of time in key 30 and / or device 20.

[0183] Upon receiving message 66, the computing unit changes the status of the digital representation of the locking device 40 to "decommissioned" in a procedure step 211. The computing unit 10 deletes the code that links the digital representation to the locking device 40. If a new locking device 40 is put into operation at the same location, the digital representation of the locking device 40 can be reactivated with the code of the new locking device 40.

[0184] In procedure step 211, the processing unit 10 stores which key 30 ordered the decommissioning D of the locking device 40. If the processing unit 10 has sent the command 60 to multiple keys, it informs all keys that have stored the command 60 in a procedure step 212 to delete the command.

[0185] In Figure 5Procedure 300, analogous to procedure 200, is described, by which the locking device 40 is to receive a firmware update FU. In a first procedure step 301, a locking device 40 with a firmware version is selected for firmware update FU using the input and output devices 11 and 12. For this purpose, the processing unit 10 can compare a firmware version number stored in the digital representations of the locking devices 40 of the locking system 100 with a firmware version number of the firmware update data package to be installed. The processing unit 10 can propose locking devices 40 whose firmware version number stored in the digital representation is lower than the firmware version number of the firmware update data package to be installed for the firmware update. An administrator of the locking system 100 can confirm or reject the proposal.Alternatively or additionally, a firmware updater can confirm or reject the proposal. The selection is stored in the digital representation of the locking device 40.

[0186] The processing unit 10 then proposes at least one key 30 from the keyholder on the output device 11, who is to perform the firmware update locally. The administrator or the firmware updater confirms the selection of key 30 via the input device 12. The task of updating the firmware of the selected locking device 40 is stored in the digital representation of the selected key 30. A corresponding command message 50 is generated in encrypted form by the processing unit 10.

[0187] The following steps 302, 303 and 304 correspond to steps 202, 203 and 204 of the Figure 4 .

[0188] In a separate message 90, the computing unit 10 sends the task to the device 20 in a process step 305, in which a firmware update is to be performed on the locking device 40. The device 20 displays the message 90 on the output device 22. After reading the message, the key holder goes to the selected locking device 40.

[0189] Procedure steps 306 and 307 correspond to procedure steps 206 and 207 from Figure 4 .

[0190] In step 308 of the procedure, the locking device 40 compares the configuration change number of the key command message 65 with a configuration change number for the firmware update stored in the locking device 40. It also compares the firmware version number stored in the locking device 40 with the firmware version number of the key command message 65. The firmware update FU is only performed if the configuration change number and the firmware version number of the key command message 65 are greater than the stored configuration change number and firmware version number, respectively.

[0191] In the next process step 309, the firmware update FU is performed. For this, the firmware update data package is decrypted, verified, and installed. The configuration number and the firmware version number of the key command message 65 are saved.

[0192] During process steps 306 to 309, the key 30 must remain inserted in the locking device 40; otherwise, the process is aborted. The key 30 includes a light device 34 (see figure). Fig. 1 ), where the execution of the firmware update FU is displayed.

[0193] After the firmware update FU has been performed, the key 30 changes the display of the indicator light 34. A message 66, indicating that the locking device 40 has undergone a firmware update FU with the aid of the key 30, is transmitted via the key 30 and the device 20 to the processing unit 10 in a process step 310, which is analogous to process step 210 of the Figure 4 has been trained and sent.

[0194] Upon receiving message 66, the computing unit 10 updates the firmware version number of the digital representation of the locking device 40. The computing unit 10 stores which key 30 of the locking device 40 ordered the firmware update FU. If the computing unit 10 has sent the command 60 to multiple keys 30, the computing unit 10 informs all keys with the command 60 in a procedure step 312 to delete the command 60.

[0195] Figure 6 Figure 400 shows an alternative procedure 400 for decommissioning D of the locking device 40. A picker 71 authenticates himself in the application and presses a decommissioning field 23 in a procedure step 401. The decommissioning field 23 is displayed on the output device 22 of the device 20 (see Figure 401). Figure 1 ).

[0196] The output device 22 now displays an instruction that order picker 71 should establish the communication connection to key 30 by pressing button 33. It also displays an instruction that order picker 71 should insert key 30 into key slot 41. In process step 402, order picker 71 presses button 33 on key 30 and in process step 403 inserts key 30 into key slot 41. Key 30 and locking device 40 then verify each other. Additionally, the locking device transmits the locking device ID 63 to key 30. If key 30 and locking device 40 cannot verify each other, process 400 is aborted.

[0197] If a command 60 for decommissioning the locking device 40 with the transmitted locking device ID 63 has already been stored in the key 30, the key command message 65 can now be transferred to the locking device 40. The locking device 40 can then perform at least one test step, the decommissioning, and the feedback to the processing unit analogous to process steps 208, 209, and 210. From process step 403 until the decommissioning D is completed, the key 30 must remain inserted in the locking device 40, analogous to process step 209. The processing unit 10 can then also perform process steps analogous to steps 211 and, if applicable, 212.It is also possible that the command 60 is stored in the device 20 and is first transferred to the key 30 before the key command message 65 is transmitted to the locking device 40 and only then do the remaining steps take place analogously to 208 to 211, possibly 212, as described.

[0198] If no command 60 for decommissioning D of the locking device 40 has been stored in the device 20 or in the key 30, the locking device ID 63 is reported from the key 30 to the device 20 in a procedure step 404.

[0199] According to the invention, it is not possible to decommission the locking device 40 without involving the computing unit 10. Therefore, in a process step 405, the device 20 sends a request A to the computing unit 10, stating that the locking device 40 should be decommissioned, along with the key ID 53 and the locking device ID 63. In a process step 406, the computing unit 10 processes request A. Here, the computing unit 10 checks the authorization role of the key holder of key 30 with the received key ID 53. If the authorization role does not permit decommissioning, the process 400 ends. If the authorization role permits the decommissioning of the locking device 40, the computing unit 10 proposes to the administrator that the decommissioning D be permitted. If the administrator refuses permission, the process 400 ends.If the administrator grants permission, the computing unit 10 sends the command message 50 via the device 20 to the key 30 in a procedure step 407, which is decrypted in the key 30.

[0200] Subsequently, a key command message 65 is transmitted to the locking device 40 in a process step 408. There, the configuration change number is checked in a process step 409, and the decommissioning D is performed in a process step 410. These process steps proceed as described in process steps 207, 208, and 209. Then, in a process step 411, a message 66 indicating that the locking device 40 has been decommissioned using the key 30 is sent via the key 30 and the device 20 to the processing unit 10 in a process step 411, analogous to process step 210. The processing unit 10 processes the message 66 in a process step 412, which proceeds analogously to process step 211. Between process steps 403 and 411, it is essential that the key remains inserted in the locking device.

[0201] The locking system 100 is also designed to decommission a key 30 in procedures 500, 600, as in the Figure 7 and 8 depicted. In a first procedure 500 for the decommissioning of DS of key 30 according to Figure 7 In a first process step 501, a key 30 for decommissioning DS is selected using the input and output device 11,12. The selection is stored in the digital representation of the key. Subsequently, the computing unit 10 on the output device 11 proposes at least one user to whose device 20 a key decommissioning command message 150 for decommissioning the key 30 is to be transferred.

[0202] Typically, the computing unit 10 proposes the key holder whose device 20 is to receive the key decommissioning command message 150. A picker can also be selected for this purpose, either additionally or alternatively. An administrator 83 confirms the user's selection via the input device 12. A corresponding key decommissioning command message 150 is generated by the computing unit 10 and sent to the selected user's device 20 in a procedure step 502 using the mobile phone number stored in the computing unit 10. The key decommissioning command message 150 includes at least the decommissioning information 61 that the key 30 is to be decommissioned and a configuration change number 62.The decommissioning information 61 and the configuration change number 62 are encrypted such that the decommissioning information 61 and the configuration change number 62 are undecipherable for device 20 and decipherable for the key 30 to be decommissioned. Furthermore, the key decommissioning command message 150 contains the key ID of the key 30 to be decommissioned.

[0203] In a third process step 503, the key decommissioning command message 150 is transferred from device 20 to key 30. For this purpose, the user must authenticate in the application of device 20 and establish the communication connection between device 20 and key 30 by pressing button 33.

[0204] Key 30 compares the configuration change number 62 of the key decommissioning command message 150 with a configuration change number 62 for decommissioning stored in key 30 in procedure step 504, analogous to procedure step 208. Decommissioning DS is performed only if the configuration change number 62 of the key decommissioning command message 150 is greater than the stored configuration change number.

[0205] In the next process step 505, decommissioning DS is performed. For this purpose, the key deletes the cryptographic information of locking system 100 in the electronic memory of key 30. Key 30 activates the cryptographic information that was stored in key 30 during its manufacture. Furthermore, key 30 deletes a code that key 30 assigns to its digital representation. Key 30 also generates a code that allows assignment to a digital representation in another locking system 100. Key 30 also deletes a code that assigns key 30 to a locking system 100. Key 30 generates a code that allows assignment to another locking system 101, 102.

[0206] In process step 506, a message 166 regarding the successful decommissioning DS of key 30 is transferred to the processing unit 10. Upon receiving message 166, the processing unit 10 changes the status of the digital representation of key 30 to "decommissioned". In process step 507, the processing unit 10 deletes the code that associates the digital representation with key 30.

[0207] In an alternative procedure 600 for decommissioning the key 30 according to Figure 8 If a user wants to decommission key 30 on-site, the user presses a key decommissioning field 24 (see diagram). Figure 1) on the input and output devices 21, 22 in a process step 601. Furthermore, the user establishes the communication connection between the device 20 and the key 30 by means of the button 33 in a process step 602. The key 30 transfers the key ID 53 to the device 20 in a process step 603. In a process step 604, the device 20 sends a request A, stating that the key 30 should be decommissioned, together with the key ID 53 to the processing unit 10. The processing unit 10 processes request A in a process step 605. In doing so, the processing unit 10 checks whether the authorization role of the user who authenticated themselves in the device 20 allows the decommissioning of the key 30 or whether they are the key holder.If the authorization role permits the decommissioning of key 30, or if the administrator is the key holder, the computing unit 10 proposes to the administrator that decommissioning be allowed. If the administrator denies permission, procedure 600 terminates. If the administrator grants permission, the computing unit 10 sends the key decommissioning command message 150 via device 20 to key 30 in procedure step 606, which is decrypted in key 30. The subsequent steps 607, 608, 609, and 610 correspond to procedure steps 504, 505, 506, and 507 from [reference missing]. Figure 7 .

[0208] In Figure 9A method 700 for registering a new key holder and for commissioning (assigning) a new key in the locking system 100 according to the invention is described. In a method step 701, an administrator first adds a new key holder to the locking system 100 in the computing unit 10 by entering an identifier of the new key holder, e.g., their name or email address, using the input device 12. The administrator also assigns an authorization role 70, 71 to the new key holder via the input device 12 by selecting one of these roles. The computing unit stores the identifier of the new key holder and the authorization role 70, 71 as associated with each other.

[0209] In a second step (702), the new key holder is informed via message (91), e.g., an email, that they have been registered in the locking system (100) and can now define an authentication method for the application using their identifier. Once the key holder has selected an authentication method and, for example, set a password, they can then, in a process step (703), download the application to device 20 and authenticate themselves within the application. The transfer information from device 20, on which the key holder authenticated themselves within the application, is transferred to the processing unit (10) and associated with the key holder's identifier within the processing unit (10). This completes the key holder's registration.

[0210] As long as the key holder is authenticated in the open application using input device 21, the key holder can assign a new key 30. To do this, the key holder uses input device 21 in process step 704 to indicate that a new key 30 is to be assigned, for example, by using a key assignment field on output device 22. If the key holder is assigned to several locking systems 100, 101, 102, the key holder can select on output device 22 which locking system 100, 101, 102 the key 30 should belong to. This input indicating that a new key is to be assigned results in the device 20 subsequently establishing and maintaining a communication connection with the new key 30, even if no association between the key ID and the key holder's identifier is stored in the processing unit or in the device.

[0211] The key holder then activates button 33 of key 30 in process step 705. This transfers the key ID 53 of key 30 to device 20 in process step 706. The transfer occurs regardless of the authorization role 70, 71 held by the key holder.

[0212] In process step 707, the device 20 requests the processing unit to perform a picking operation (KS) on key 30 with key ID 53. The processing unit 10 checks whether key 30 with key ID 53 has already been picked. If not, in process step 708, the processing unit 10 associates key ID 53 with the identifier of the key holder sending the request. The processing unit 10 can then create the remaining digital representation of key 30 in the locking system 100, where further data for key 30 can be stored.

[0213] In process step 709, the computing unit 10 transmits configuration data to the key 30 via the device 20. The configuration data includes at least one cryptographic piece of information from the locking system 100. In process step 710, the key 30 receives the cryptographic information and deactivates cryptographic information that was stored in the key 30 during its manufacture.

[0214] Figure 10 The digital associations stored in the processing unit 10 are shown in a pictorial, symbolic representation. Here, the key holder's identifier 92, the authorization role 70, 71, the key ID 53, and the transfer information TI 93 are digitally associated with each other. The association is represented by the double arrow.

Claims

1. Method (200, 300, 400) for changing the configuration of an electromechanical locking device after commissioning of the locking device (40), wherein, in particular, the change of the configuration of the locking device (40) comprises a firmware update or a decommissioning, wherein the method (200, 300, 400) is carried out by means of a key (30), wherein the key (30) is configured to communicate electronically with the locking device (40) via a first communication link, wherein the key (30) is configured to communicate with a device (20) via a wireless second communication link, wherein the device (20) is configured to communicate with a computing unit (10) via a third communication link, wherein the method (200, 300,400) comprising the following steps: a) The key (30) receives a command message (50) containing a command (60) to change the configuration of the locking device (40) from the computing unit (10) via the device (20), the receipt of the command message (50) occurring only if the key (30) has previously been selected by the computing unit to receive the command message (50) based on at least one criterion stored in the computing unit (10); b) The key (30) commands the locking device (40) to carry out the configuration change (61) when the key (30) and the locking device (40) are electronically in communication.

2. Method (200, 300, 400) according to claim 1, wherein the computing unit (10) digitally stores an association of a key holder's identifier (80-85) with a digital representation of the key and an association of the key holder's identifier (80-85) with an authorization role (70, 71) of the key holder (80-85), wherein the method (200, 300, 400) comprises the following step, performed by the computing unit (10): enabling the selection of the key (30) as the recipient of the command message (50) depending on the authorization role (70, 71) of the key holder as a stored criterion.

3. Method (200, 300, 400) according to claim 2, wherein the method (200, 300, 400) comprises the following step, performed by the computing unit (10): Automated suggestion or execution of the selection of the at least one key (30) depending on the authorization role (70, 71) of the key holder.

4. Method (200, 300, 400) according to one of the preceding claims, wherein the key (30) can only receive the command (60) if the key holder (80-85) has authenticated himself in an application on the device (20).

5. Method (200, 300, 400) according to one of the preceding claims, wherein the key (30) exclusively commands the locking device (40) to change the configuration of the locking device (40) according to step b), if the key (30) has previously received the corresponding command to change the configuration of the locking device (40) from the computing unit (10) in step a).

6. Method (200, 300, 400) according to one of the preceding claims, wherein the key (30) automatically commands the execution of the configuration change (61) upon the next communication of the key (30) with the locking device (40).

7. A physical key (30) for a locking system (100), wherein the key (30) is configured to communicate with a locking device (40) via a first communication link and wherein the key (30) is configured to communicate with a device (20), in particular a mobile device, via a second communication link, wherein the key (30) comprises a key ID (53), and wherein the key (30) is configured to perform the method (200, 300, 400) according to one of claims 1, 4, 5 or 6.

8. Key (30) according to claim 7, wherein the command message (50) includes the key ID (53) of the key (30), wherein the command (60) is not readable by the device (20).

9. Key (30) according to claim 7 or 8, wherein the command (60) comprises a locking device ID of the locking device (40), preferably a list of several locking device IDs on which the configuration change is to be carried out, wherein the selection on which locking device (40) the configuration change is to be carried out can be received exclusively by the computing unit (10).

10. Key (30) according to one of claims 7 to 9, wherein the command (60) includes information about the type of configuration change (61) and wherein the command (60) includes a configuration change number (62).

11. Key (30) according to any one of claims 7 to 10, wherein the command (60) is encrypted, wherein the key (30) is configured to decrypt the command (60) before the key performs step b).

12. Key (30) according to any one of claims 7 to 11, wherein the key (30) is configured to decommission itself when the key (30) receives a command (60) to decommission the key (30) from the computing unit (10) via the device (20), wherein the command (60) to decommission the key (30) can be received from a device (20) of the key holder (80-85) or from a device (20) of another user with the required authorization role (71).

13. Locking unit with a key (30) according to one of claims 7 to 12 and with a locking device (40), wherein the locking device (40) is configured to receive a configuration change command from the key (30) and to execute the configuration change.

14. Locking unit according to claim 13, wherein the locking device (40) and the key (30) verify themselves before changing the configuration, in particular by means of cryptographic information of the locking system (100), and / or wherein the locking device (40) executes the command (60) only if the configuration change number (62) received in step b) is greater than a configuration change number (62) stored in the locking device (40).

15. Locking system (100) with a key (30) according to one of claims 7 to 12, with several locking devices (40) and with a computing unit (10), wherein the computing unit (10) is configured to communicate with the device (20), in particular wirelessly, via the third communication link, wherein a criterion for selecting at least one key (30) for executing the command (60) to change the configuration of the locking device (40) is stored in the computing unit (10), wherein the computing unit (10) is configured to transfer the command (60) to change the configuration of the locking device (40) to the device (20).

16. Security system with multiple locking systems (100), wherein the locking systems (100) are each configured according to claim 15, wherein a key holder (80-85) is assigned to different locking systems (100), wherein the authorization level of the key holder (80-85) varies in different locking systems (100).

Images