Locking system for one or more buildings

Abstract

A solution for setting access rights in a locking system comprising a plurality of electromechanical locks and a plurality of keys for users of the system is disclosed. Each key stores encrypted data defining the unlocking rights for a particular subset of the plurality of electromechanical locks, the subset of locks being assigned to a respective user. The system further comprises a service key that, as a default, does not store encrypted data for any of the subset of locks. The system further comprises a computer program product configured to receive a write authorization from a user of the particular subset of the plurality of electromechanical locks assigned to the user via a user interface of the user's personal electronic device. In response to the write authorization, unlocking rights of the service key are generated as encrypted data for the particular subset of the plurality of electromechanical locks, and after verifying that the user has access to the particular subset of the plurality of electromechanical locks, the generated encrypted data including the unlocking rights for the particular subset of the plurality of electromechanical locks is written to the service key. The service can then be used to open the subset of the plurality of electromechanical locks.

Description

[Technical field]

[0001] Various embodiments relate to a locking system for one or more buildings. [Background technology]

[0002] If a lock user loses the key to the lock, the key is stolen, or the user leaves the key inside, a locksmith needs to destroy the lock. Another solution to the lost key problem is the so-called master key. A master key operates a set of locks. Each of these master-keyed locks can be opened with a specific key (=change key) dedicated to that lock and the master key that operates all the locks in the set. However, master-keyed lock systems pose security risks. Furthermore, master-keyed locks are prohibited by law in some jurisdictions or are commercially unviable due to consumer preferences.

[0003] Electromechanical locks are emerging as an alternative to traditional mechanical locks. The problem of lost keys remains the same for electromechanical locks, and the master key solution has the same problems as mechanical locks. The keys for such locks can be of traditional design or in the form of a tag or key fob, and the key's access rights to a particular lock are stored in the key's memory as encrypted data, rather than mechanically machined into the bits (or blades) of the key. Summary of the Invention

[0004] According to one aspect, the subject matter of the independent claims is provided. The independent claims define several embodiments.

[0005] One or more examples are described in more detail in the accompanying drawings and description of embodiments. Certain embodiments will now be described with reference to the accompanying drawings, in which: [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 is a diagram showing a system to which the embodiments described below can be applied. [Diagram 2] FIG. 2 shows a signaling diagram of a procedure for setting unlocking rights according to an embodiment. [Diagram 3] FIG. 3 shows a signaling diagram of a procedure for setting the removal of unlocking rights according to an embodiment. [Figure 4] FIG. 4 shows a signaling diagram of a further embodiment for configuring unlocking rights for a service key. [Diagram 5] FIG. 5 illustrates components of a personal electronic device according to an embodiment. [Figure 6] FIG. 6 shows components of a reader / writer device according to an embodiment. [Figure 7] FIG. 7 illustrates yet another embodiment of a procedure for configuring unlocking rights. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] The following embodiments are merely illustrative. Although the present specification may refer to "an" embodiment in several places, this does not necessarily mean that each such reference is to the same embodiment(s) or that the feature applies only to a single embodiment. Single features of different embodiments may also be combined to provide other embodiments. Furthermore, the words "comprising" and "including" should not be understood to limit the described embodiment to consist only of the mentioned features, but such an embodiment may also include features / structures not specifically mentioned.

[0008] Reference numbers both in the description of the embodiments and in the claims serve to explain the embodiments with reference to the drawings, without limiting them only to these examples.

[0009] The embodiments and features disclosed in the following description (if any) that do not fall within the scope of the independent claims are to be construed as examples useful for understanding various embodiments of the invention.

[0010] FIG. 1 illustrates a system to which the embodiments described below may be applied. As mentioned above, the context of the present embodiment may be that a user 100 has a key 108 assigned to the user and configured to open one or more locks 106 assigned to the user. In the context of a residential building, the key 108 may be configured to open a lock to the user's home, e.g., an apartment in a residential building. The key 108 may further be configured to open one or more publicly accessible locks, e.g., an entrance lock 104 at the entrance to the building. As explained in the background, the user 100 may forget the key 108 in the apartment when the user 100 leaves the apartment. In such a case, the user must alert a service person in charge of the master key, who will arrive with the master key and open the lock 106 for the user 100. As explained in the "Background", having such a master key presents a security risk.

[0011] With reference to Fig. 1, a locking system for one or more buildings is comprised of a number of electromechanical locks 104, 106, each of which comprises a communication interface for exchanging encrypted data with a key, an actuator for setting the electromechanical lock to an open or closed state, and a processor for evaluating the encrypted data read from the key to determine whether to set the electromechanical lock to an open state or to leave it closed. Electromechanical locks can be mains, battery or self-powered. Self-powering is achieved either electromechanically when the key is inserted into the lock, thereby activating a generator in the lock, or by wirelessly providing power to the lock during the authentication operation.

[0012] The one or more buildings may form at least one of a residential building, a commercial building, an office building, a retail building, a hotel, an industrial building, a residential area, a campus, a factory, a hospital, and a complex. In each building, a user may assign to the user a subset of the electromechanical locks of the system, including at least one lock. The assigned lock may be the user's home or personal office space, a personal locker, a personal cabinet, or a similar asset. There may be at least one lock that only the user 100 (or a member of his / her family) can access. There may be at least one lock 106 that is configured such that only one key 108 (or two keys or a very limited set of keys) has unlocking rights.

[0013] The locking system further comprises a number of keys, e.g., key 108, each key including a memory for storing encrypted data defining unlocking rights for one or more of the plurality of electromechanical locks and an interface for exchanging the encrypted data with one or more of the plurality of electromechanical locks, each key being authorized to operate within the locking system. These keys may be so-called user keys. Each user of the system may have such a key configured to have unlocking rights for a specific subset of the electromechanical locks of the system. Each user may have unlocking rights for a unique subset of the electromechanical locks of the system. In most scenarios, the subsets of different users are mutually exclusive, meaning that neither one of the locks of one of the subsets belongs to one of the other subsets. However, there are scenarios where one lock is accessible to multiple users, and in such scenarios, a lock may belong to multiple subsets. However, it is possible that none of the locks in a subset may be accessible to all users of the system. Some locks of the system may be accessible to all users, e.g., the entrance lock 104. In other words, these user keys can store the encrypted data and the respective unlocking privileges in a static or persistent manner. In another embodiment, the user key is comprised of a wireless or wired transceiver that wirelessly exchanges the encrypted data with a reader / writer to program or reprogram the user key. In an embodiment, this transceiver is an interface that is also configured to exchange the encrypted data with the electromechanical lock to be accessed. In other words, no separate interface is required for programming the user key.

[0014] The system further includes one or more service keys 116 having the same hardware and software as the user keys described above. Additionally, the service key(s) 116 may have a wireless or wired transceiver as described above to receive encrypted data defining the unlocking rights for a particular lock or set of locks, and the service key(s) may be configured with reprogramming capabilities as described in the following embodiments. The memory of the service key may not, by default, have encrypted data defining the unlocking rights stored therein. In another embodiment, the service key is configured to have opening rights to one or more generally accessible locks of the locking system, e.g., the building entrance lock 104, or a storeroom lock accessible to all residents of a residential building. Even in such a case, the service key or keys 116 do not by default store encrypted data defining opening rights to a unique subset of the electromechanical locks of the system, i.e., locks that are personally accessible to a user of the system.

[0015] In an embodiment, the service key(s) are by default authenticated to operate within the locking system. Authentication may be done by storing a communication security key (encryption key) in the service key(s), meaning that the security key(s) have / have the ability to communicate with the locks of the system. The security key may be unique to the system, thus distinguishing the system from other locking systems.

[0016] The system may further include a server computer or server system 112 (e.g., a cloud server) accessible via the Internet or via a computer and / or communication network. The server system may include a database 112 storing information regarding the access rights of the user 100 to a particular subset of the plurality of electromechanical locks for a particular subset 106 of the plurality of electromechanical locks, the particular subset of the plurality of electromechanical locks being assigned to the user. Similar information may be stored in the database for other users of the system. The electromechanical lock may be online at least during an access operation in which a key attempts to access the particular electromechanical lock. The unlocked lock may communicate with the server while authenticating the accessing key. Another solution for online communication is to update the access rights or to perform a software / firmware update or upgrade on the lock, the respective operation may be implemented via communication with the server. The communication connection between the server and the online lock(s) may be via a gateway device that communicates with the lock according to a wireless communication protocol or a wired communication protocol and provides the lock with access to the server. In another embodiment, the lock is an offline lock that does not require a connection with the server at any stage. Authentication during access can be performed via device-to-device communication between the lock being accessed and the accessing key, via wired or near-field communication protocols.

[0017] The user may own a personal electronic device 110, which may be part of the system or may be external to the system. The personal electronic device may be a mobile phone or smart phone, or another smart device (such as a tablet computer) owned and carried by the user 100. However, the system may also include a computer program product that is readable by at least one processor of the personal electronic device 110 of the user 100 and configures the at least one processor to perform steps or functions described in the following embodiments in connection with the following authentication application. The computer program product may configure the at least one processor to execute an authentication application to perform the steps or functions. The computer program product may be, for example, a mobile application that can be downloaded and installed on any mobile device running a mobile operating system such as iOS® or Android®. The computer program product may store in the memory of the personal electronic device, partially or completely, the same unlocking rights of the user 100 as the database 114. Of course, the memory of personal electronic devices

[0018] The system may further include a reader / writer 102 configured to program the service key 116. The reader / writer 102 belonging to the system may be a separate electronic device in a casing with an input / output interface for communicating with the service keys and programming the service keys with the unlocking rights for the locks or a subset of the locks of the system. As described in the following embodiments, the reader / writer device may further comprise a (wireless) communication interface or transceiver for communicating with the server 112 and / or the personal electronic device. The reader / writer may be a peripheral device of the personal communication device. The reader / writer device may further include a processor or processing circuitry for performing application level communication with the server 112 and the personal electronic device 110 and for controlling the input / output interface to perform the programming.

[0019] In one embodiment, the reader / writer is configured in the personal electronic device. The computer program product can employ a reader / writer device readily present in a smart device, such as Near Field Communication (NFC) circuitry. As known in the art, NFC describes a technology for contactless data exchange at close range. In this embodiment, the key 108, 116 can also have NFC circuitry. The two NFC devices are connected via point-to-point contact over a distance of a few centimeters. This connection can be used to exchange data between the devices, which in the embodiment described herein constitutes the unlocking right as encrypted data. However, NFC is not the only possible reader / writer solution for smart devices, and alternatively, Bluetooth (or another protocol based on IEEE 802.15) circuitry in the personal electronic device and the key 108, 116 can be employed in the following embodiment to program the service key.

[0020] With reference now to FIG. 2, the operation of a computer-implemented process for programming a service key will now be described. With reference to FIG. 2, in block 200, a user 100 and one or more personal keys 108 assigned to the user are registered with the system. Block 200 may include storing, in a database, information regarding the user's access rights to a particular subset of the electromechanical locks of the system, where the particular subset of the electromechanical locks has been assigned to the user. As discussed above, the particular subset may include locks on the user's personal possessions, such as an apartment (home). Block 200 may be executed when the user purchases or rents an apartment or is otherwise assigned access to a particular subset of the electromechanical locks of the system.

[0021] In step 202, the user 100 inputs a write authorization to a particular subset of the plurality of electromechanical locks using a user interface of the personal electronic device, and correspondingly, an authentication application defined by the computer program product described above and executed by at least one processor of the personal electronic device 110 receives the write authorization input via the user interface of the personal electronic device 110 of the user 100 in step 202. Step 202 may be performed after 200, and the period between 200 and 202 may be long, e.g., days, weeks, or even years. Step 202 may occur when the user loses the personal key 108, leaves it behind the lock 106, or another unexpected event occurs. The write authorization may include a user instruction to authorize the programming of the service key, and further, the write authorization may indicate (explicitly or implicitly) one or more or all of the (subset of) electromechanical locks that can be opened with the programmed service key. A user may be associated with a particular subset of electromechanical locks in the database 114, and the write authorization may by default encompass all locks in the particular subset. In another embodiment, the user may manually enter or select one or more (but not all) electromechanical locks of the subset to be programmed into the service key. In practice, the user may operate a user interface of an authentication application running on the personal electronic device to open an authentication function of the authentication application. The authentication application may then present the subset of electromechanical locks to the user for selection. The list of presented locks may be filtered to consist of the subset of electromechanical locks, and electromechanical locks that are not included in the subset are not presented to the user. This is one way of controlling the user's inability to select locks to which they do not have access.

[0022] In an embodiment, the authentication application presents a list of service keys to the user and the user can select which of the service keys to program by entering a selection input through the user interface indicating the selected service key. Thus, the write authentication can indicate an identifier of the service key to be programmed.

[0023] In response to the write authorization in step 202, the authentication application may configure the reader / writer 102 to generate an unlocking right for a specific subset of the plurality of electromechanical locks as encrypted data (block 204). The authentication application may communicate an identifier for each electromechanical lock that must be unlockable with the programmed service key, and the reader / writer may generate the unlocking right and the encrypted data. Alternatively, the authentication application may generate the unlocking right and the encrypted data and communicate the encrypted data to the reader / writer 102. In yet another embodiment, the authentication application generates the unlocking right and the reader / writer encrypts the unlocking right into the encrypted data. In yet another embodiment, a server is used to generate the unlocking right, as described in the embodiment of FIG. 4, and either the server or the reader / writer can perform the encryption of the unlocking right into the encrypted data. The unlocking right may constitute a security token applicable to a specific electromechanical lock of the subset. The security token may consist of a cryptographic key, a password token, or a challenge-response token applicable to opening certain electromechanical locks. The security token may then be encrypted with a security key to generate encrypted data that is used for communication within the system. In some embodiments, the encrypted data is substantially similar to the encrypted data programmed into the user's own key 108. In some embodiments, the encrypted data is identical to the encrypted data programmed into the user's own key 108. Additionally, if the write authentication indicates a selected service key, the authentication application may deliver an identifier of the selected service key to the reader / writer 102.

[0024] Once the encrypted data is generated and configured by the authentication application (or server), in step 206 the reader / writer writes the generated encrypted data, including the unlocking rights, to the service key, which is stored in the memory of the service key. If the reader / writer receives an identifier of the service key to be programmed, the reader / writer may verify that the service currently communicating with the reader / writer has the received identifier before performing the programming. If the verification is positive, the programming may begin. If the service key communicates a different identifier to the reader / writer, the reader / writer may abort the programming and output an error notification to the authentication application. The writing is performed after checking in block 204 that the user has access to a specific subset of the plurality of electromechanical locks. After the writing, the subset of the plurality of electromechanical locks can be opened with the programmed service key. The unlocking can be performed via a state-of-the-art authentication procedure between the service key and the subset of electromechanical locks. When a subset of locks is accessed with a service key programmed with an unlocking right, encrypted data is exchanged between the service key and the lock, and in response to said exchange, the lock's processor sets the lock to an unlocked state using the lock's actuator. If the unlocking right is invalid, the lock's processor can refuse to unlock.

[0025] In an embodiment, the writing is performed after checking that the service key is authorized to operate in the locking system. This may be based on checking whether the reader / writer can communicate with the service key. When the selected service key is brought close to the reader / writer, a communication channel between the reader / writer 102 and the service key is established, and the reader / writer 102 can forward a query to the service key using the security key of the system. If the service key responds to the query with a meaningful response, for example by sending a message encrypted with a security key matching the security key of the system, the reader / writer can determine that the service key is authorized to operate in the system. In other words, the check may include checking whether the reader / writer and the service key are configured with matching encryption keys dedicated to the locking system, allowing encrypted communication between the reader / writer and the service key. In simple terms, the reader / writer may determine that the service key is authorized to operate in the system if the reader / writer is capable of encrypted communication with the service key. The check whether the user has access to a particular subset of the electromechanical locks can be performed in one of several instances. One instance is that the authentication application presents only the subset of electromechanical locks to the user for said authentication. Another example is that after receiving the user's input, the authentication application checks the database 114 or a database in the memory of the personal electronic device for the user's access rights. Yet another example is that the reader / writer receives an indication of the subset of locks from the authentication application, and the reader / writer can send the identifiers of the user's 100 and the identifiers of the subset of electromechanical locks provided by the authentication application to the server 112. The server can then check the database 114 for the user's 100 access rights to the provided lock identifier(s).If the user has access to all locks in the subset, the server may output an authorization to write the service key with the respective opening rights. If the user does not have access to one or more locks in the subset, the server may output an authorization denial message to the reader / writer, which may again inform the authentication application that programming the service key was denied.

[0026] In this way, a user can only have the right to issue write permissions on the locks that have been assigned to the user, and the assigned locks may form a subset of all locks in the system. In typical use cases, the subset will clearly form a minority of all locks in the system. The number of locks assigned to a user may be at least a decade less than the locks in the system. The number of locks assigned to a user may be one, two or three, but the number of locks in the system may be tens, hundreds or even thousands. This differs from solutions where a master user can have write permission on all locks in the system.

[0027] In embodiments where the reader / writer 102 is within the personal electronic device 110, communication between the authentication application and the reader / writer may occur through an application programming interface of the personal electronic device and / or through a firmware or software driver of the reader / writer. In embodiments where the reader / writer 102 is external to the personal electronic device, communication between the authentication application and the reader / writer may occur through a wireless transceiver of the personal electronic device and the reader / writer. The communication may be direct peer-to-peer communication over a single wireless link, while in other embodiments, the communication occurs over a communication network that includes at least two wireless links between the devices 102, 110.

[0028] In an embodiment, the unlocking right programmed into the service key is temporary, and the unlocking right may be configured to expire on its own, or the unlocking right may be cancelled via a reset. In an embodiment, the encrypted data programmed into the service key includes a period that defines the validity period of the unlocking right. The electromechanical lock records the time, performs authentication with the service key, and upon receiving information about the time period from the key, can check whether the time period is still running. If the period is still running and the unlocking right is valid, the electromechanical lock can open the lock. If not, the electromechanical key can refuse to open the lock. In another embodiment, the service key includes a timer, and the processor of the service key is configured to invalidate the encrypted data and the unlocking right upon expiration of the period. The invalidation may be performed by overwriting or blanking the memory area of ​​the service key that stores the encrypted data. FIG. 3 illustrates yet another embodiment of deleting the unlocking right from the service key.

[0029] In the embodiment of FIG. 3, the computer program product is configured to cause at least one processor of the personal electronic device to generate new encrypted data for the removal of the unlocking rights for a specific subset of the plurality of electromechanical locks and to write the new encrypted data including the removal of the unlocking rights to the service key using the reader / writer. Referring to FIG. 3, the authentication application can detect an authentication removal event (block 300) that triggers the removal of the unlocking rights from the service key programmed in step 206. In one embodiment, block 300 is based on receiving a removal authorization from the user 100 via a user interface of the personal electronic device. In another embodiment, the event of block 300 is timer-based, e.g., the authentication application can use a clock on the personal electronic device to measure the expiration date of the unlocking rights. Upon detecting the event, the authentication application can trigger a procedure to remove the unlocking rights. The procedure consists of configuring the reader / writer 102 to remove the unlocking rights from the service key (step 302). Step 302 may include identifying the service key to be reprogrammed in some manner. One way is to communicate the service key's identifier to the reader / writer. Another solution is to manually bring each service key close to the reader / writer. The reader / writer can then reprogram (step 304) the service key by removing or disabling the unlocking rights, for example by blanking as described above. The service key then returns to the default state described above.

[0030] One use case of programming in step 206 and reprogramming in step 304 is for the user to manually select a service key and bring it close to the reader / writer. The selection of the service key to be (re)programmed and the respective display of the selected service key are thus performed by controlled proximity of the service key. In embodiments where the communication range of the reader / writer is very small, for example a few centimeters, the service key to be (re)programmed can be explicitly identified to the reader / writer. Another solution is to provide the identifier of the service key as a label on the service key, and the user can specify the identifier of the service key to be programmed to the authentication application using the user interface of the authentication application on the personal electronic device.

[0031] In an embodiment, upon programming and / or reprogramming the service key, the user is notified of the successful (re)programming via the authentication application and the user interface of the personal electronic device. Upon (re)programming the service key, the reader / writer communicates the successful (re)programming to the authentication application, which may output a user notification.

[0032] In the above embodiment, the scenario is that the user initiates programming of a service key when, for example, the apartment key 108 is forgotten. In the embodiment, the service key is an emergency key that includes encrypted data in memory that does not define the opening rights during a storage period, whereas the emergency key includes encrypted data that defines the opening rights of a particular subset of the electromechanical locks during an emergency use period, the emergency key being in the storage period by default and only intermittently during the emergency use period. In this case, the authentication application can receive a request for access to the particular subset of the electromechanical locks from the server, and the authentication application can output a notification to the user via the user interface in response to the request. The notification can indicate an emergency situation and request the user to grant the opening rights. If the user authorizes to grant the opening rights, programming can be performed under the control of the server 112 according to the procedure of FIG. 4. In this case, the write authentication input in step 202 is an authentication from the user via the user interface.

[0033] Referring to FIG. 4, upon receiving a write authorization input via the user interface in step 202, the authentication application may send an authentication message to the server in step 400. Since the authentication application is registered with the server with the user's 100 credentials, which subset of locks to program may be implicitly known to the server. On the other hand, if only a subset of the electromechanical locks assigned to the user must be programmed, either the request from the server or the authentication in step 400 may identify the subset of electromechanical locks to be programmed with the unlocking rights. The authorization of the user to grant unlocking rights to the specified lock(s) may be verified in block 402. Each lock may be associated with a unique identifier (e.g., a string), and each user account in the server (and / or in the authentication application) may store the unique identifiers of the locks assigned to the user. In embodiments in which the server requests programming, block 402 may be executed by the server prior to sending the request by the user. In such a case, the server can first determine which electromechanical lock requires the unlocking rights, then access the database to find the respective user and send to the respective user, via the respective authentication application in the user's personal electronic device, a respective request for programming a service key with the unlocking rights.

[0034] Upon receiving authorization to program the service key with the unlocking right associated with the user 100 in step 400, the server may configure the reader / writer 102 to program the service key with the unlocking right. The unlocking right may, for example, be generated at the server and encrypted by the reader / writer. The process may then proceed as described above in step 206, and upon completing the programming, the reader / writer 102 may communicate notification of the programming (step 406) to the authentication application, either directly or via the server 112.

[0035] With regard to the above-mentioned programming of the service key, the service key may comprise at least one processor and at least one memory for storing computer program instructions of a computer program product for performing the programming in the service key and for communicating with the reader / writer or server during programming. In an embodiment where the server or authentication application directly controls and supervises the programming, the application layer communication regarding the programming is performed between the service key and the server (or authentication application), and the personal electronic device and the reader / writer are only used to provide the lower communication protocol layers. The reader / writer may perform encryption of the unlocking rights as part of the lower layer protocol. In other embodiments, the reader / writer 102 controls the programming at the application layer, and thus the communication during programming is only between the reader / writer and the service key.

[0036] In an embodiment, the system further comprises a key safe for storing a service key 116, the key safe comprising a mounting mechanism for fastening the key safe to a wall or floor of the building, a wall or floor of a hall or staircase of the building, a wall or floor of a locked space of the building, or a wall or floor of a service center. When the need arises, the user 100 or a service representative can access the key safe to obtain a service key for programming. The key safe can be configured to unlock one of the electromechanical locks of the system using a personal electronic device and the computer program product, or using a user device of the service representative of the locking system. In an embodiment, the computer program product, together with the personal electronic device, can act as a key for the key safe. Thus, the need for the key 108 can be avoided. The computer program product can use a memory of the personal electronic device to store an unlocking right for the key safe and use an NFC circuit or similar proximity transceiver circuit to deliver the unlocking right to the electromechanical lock of the key safe to open the key safe. In another embodiment, the user can operate a user interface of the authentication application to send a request to the server to open the key safe. If there are multiple key safes to which the user 100 has access, the request can define which key safe to open. The user may be required to, for example, enter a personal identification number (PIN) or perform authentication by biometric authentication (e.g., fingerprint) before proceeding with sending the request to the server. Upon receiving the request from the authentication application via the personal electronic device, the server can verify from the database 114 that the user has access to the key safe and, upon verifying valid access, send a command to the electromechanical lock of the key safe to open it. Other solutions for accessing the key safe are of course possible.

[0037] In an embodiment, at least one of the plurality of electromechanical locks of the system is an entrance electromechanical lock 104 at an entrance of a building, comprising a wireless interface for exchanging encrypted data with the computer program product via a personal electronic device, an actuator for setting the entrance electromechanical lock to an open or closed state, and a processor for evaluating the encrypted data read from the personal electronic device to determine whether to set the entrance electromechanical lock to an open state or to leave it closed. Similar to the solution described above in relation to the key safe, the memory of the personal electronic device can store a user's unlocking rights for opening the entrance electromechanical lock. The authentication application is then configured to cause the at least one processor of the personal electronic device to receive an authorization from the user to unlock the entrance electromechanical lock using the entrance unlocking rights in the encrypted data, for example, via a user interface, similar to the key safe embodiment described above. In response to the authentication, encrypted data including the entrance unlocking rights may be exchanged with the entrance electromechanical lock via the wireless interface of the lock. If the entrance unlock right is valid for the entrance electromechanical lock, the lock's processor uses an actuator to unlock the lock for the user.

[0038] The entrance electromechanical lock may include an interface for receiving electrical energy from a mains power source for operation of the entrance electromechanical lock's actuator and the entrance electromechanical lock's processor. Alternatively, the entrance electromechanical lock may comprise an interface for wirelessly receiving electrical energy from a wireless transceiver of a personal electronic device for operation of the entrance electromechanical lock's actuator and the entrance electromechanical lock's processor.

[0039] The components of the personal electronic device and the reader / writer will now be described with reference to Figures 5 and 6, respectively. Figure 5 shows a personal electronic device, which may be a portable smart device owned by a user 100, as described above. The personal electronic device may comprise at least one processor 10 and at least one memory 20 storing a computer program product (software) 24 as described above. The memory may further store the access rights of the user 100 in a database 26, as described above.

[0040] The computer program product may have been downloaded into the memory 20 from the server 112 or from another application server. Thus, the personal electronic device may initially be devoid of the authentication application and the respective computer program product, which may be installed on the device by the user. Upon receiving a user input to launch the authentication application, the processor 10 reads the computer program product and the respective computer program instructions and executes the authentication application 14. The authentication application may then configure the processor 10 to execute one or more of the above-mentioned embodiments of the authentication application. The authentication application may include an authentication module 16 configured to execute the processing (step 202) of the received write authentication input via a user interface (UI) 23 and the respective user interface controller module 12 of the processor, and further participate in the execution of the above-mentioned block 204. The authentication module may verify the access rights of the user, for example, to authorize the programming of a service key for a subset of the indicated electromechanical locks. If the authentication check is cleared, the authentication application can employ the service key programming module to generate an unlocking right and communicate the unlocking right to the reader / writer via the communication interface with the reader / writer.

[0041] As mentioned above, the reader / writer 22 may be part of the personal electronic device. In such an embodiment, the reader / writer may have dedicated hardware, such as NFC circuitry in the personal electronic device, and may further have software or firmware that allows the processor 10 to control the reader / writer. In other embodiments, the authentication application 14 may communicate the unlocking rights to an external reader / writer via wireless communication circuitry 21 of the personal electronic device. The wireless communication circuitry may support any one or more of known communication protocols for communicating the unlocking rights, for example, Bluetooth, WiFi (IEEE 802.11), or cellular communication protocols.

[0042] The authentication application may further comprise an authentication override module 17 configured to revoke the unlocking rights programmed into the service key upon detecting, for example, any one of the above-mentioned events that trigger the deactivation. Thus, the authentication override module may perform steps 300 and 302 of the process of FIG.

[0043] In one embodiment, the personal electronic device is configured with the locking system described above.

[0044] FIG. 6 shows components of the reader / writer 102, the described components being equally applicable to an external reader / writer and to a reader / writer configured within a personal electronic device. In the latter case, some components, such as the processor(s) 30, may be the processor(s) 10 or belong to the same processing circuit as the processor(s) 10. The reader / writer may include an input / output (I / O) interface 42 configured to program the service key by writing encrypted data constituting the unlocking right to the service key. The I / O interface may support, for example, the NFC protocol, or another wireless short-range or contactless communication protocol to program the service key. In another embodiment, which also applies to the above-mentioned embodiment, the service key and the corresponding communication interface (transceiver) of the reader / writer may support a wired communication protocol. For example, the key may be inserted into the reader / writer to bring the interfaces into physical (mechanical) contact, thereby realizing a wired connection between the two to perform the programming.

[0045] A key programming application 44 executed as a computer process by the processor 30 controls programming and, in the above-described embodiments, may control communication with the authentication application 14 and / or the server 112. The communication may be performed via wireless communication circuitry that may support any one or more of the above-described communication protocols. The key programming application 44 may be stored in the memory 40 of the reader / writer as a computer program product 46. The key programming application may perform at least some of the functions of steps 204, 206, 302, 304, and 404. In some embodiments where programming and respective communication with the service key are controlled and performed by a server or an authentication application, the key programming application may be provided within the server or as part of the authentication application, respectively. In such embodiments, the reader / writer may also have a processor configured to manage the lower communication protocol layers between the key programming application and the service key.

[0046] The processors mentioned above will cover all implementations of microprocessors known in the art, including simply single processors and multiple processors and parts of processors, e.g., implementations of one core of a multi-core processor, and the software and / or firmware associated therewith. The term will also cover, for example, application specific integrated circuits (ASICs), and / or field programmable grid array (FPGA) circuits for each of the above-mentioned devices, if applicable to the particular element. It should be noted that the processors of servers, personal electronic devices, reader / writer devices, and electromechanical locks may be structurally different due to different required processing power and capabilities.

[0047] Above, an embodiment was described for programming a service key to access a specific subset of locks assigned to a user. An equivalent embodiment is to use an authentication application to program a specific subset of locks to allow access to a general service key. This can be implemented in conjunction with an embodiment in which the locks are online or accessible by a server via a communication link, for example via a gateway. The server or authentication application can generate an encrypted unlocking right according to any one of the above-mentioned embodiments and distribute the unlocking right to the specific subset of locks, each of which can store the encrypted unlocking right upon receiving it. With this solution, no programming of the service key is required and a reader / writer can be omitted. Figure 7 shows a signaling diagram according to this embodiment.

[0048] Referring to FIG. 7, in response to the write authorization received in step 202, the authentication application may cause the service key's unlocking rights for a particular subset of the plurality of electromechanical locks (e.g., lock 106) to be generated as encrypted data, and the generated encrypted data including the unlocking rights may be written to the particular subset of the plurality of electromechanical locks after verifying that the user has access to the particular subset of the plurality of electromechanical locks. Either the authentication application or the server may perform and control the programming of the particular subset of the locks. For example, the authentication application may communicate an authentication message to the server in step 400 in response to the write authorization input, in the manner described above. The server may then check the user's access rights to authorize the programming of the subset of locks, in block 700, and generate the (encrypted) unlocking rights for the service key. The service keys may store the same security token, and the unlocking rights may include a definition to configure the subset of locks to unlock upon receiving the service key's security token. Thus, in this embodiment, all service keys may be programmed to open a subset of locks by configuring the locks in the manner described above. In step 702, the server communicates the encrypted unlocking rights to a subset of the locks (e.g., lock 106), which stores the unlocking rights in the service key in block 704. Once programming is complete, the server can communicate notification of successful programming to the authentication application in step 406, as described above. In a further embodiment, a check is performed by lock 106 as to whether the service key is authorized to operate in the system, in the sense that the service key can only communicate its security token to the lock if the service key and lock 106 can communicate with each other.

[0049] After programming, encrypted data is exchanged between the service key and one of a specific subset of the plurality of electromechanical locks. The encrypted data may consist of unlocking rights previously stored in the service key as a default. In response to said exchange, if the lock is configured with the service key's unlocking rights, the lock's actuator is set to an open state. If the service key's unlocking rights have not been programmed into the lock, the lock remains in a closed state.

[0050] The processes or methods described in Figures 2-4 and 7 or any of their embodiments may also be implemented in the form of one or more computer processes defined by one or more computer programs. In particular, the functionality of the authentication application and the personal electronic device may be defined by the above-mentioned computer programs. Similarly, the functionality of the server computer may be defined by a computer program product stored, read and executed on the server computer. The computer program may be in source code form, object code form or any intermediate form and may be stored on any carrier, which may be any entity or device capable of carrying a program. Such carriers include ephemeral and / or non-ephemeral computer media, such as recording media, computer memories, read-only memories, electrical carrier signals, electrical communication signals and software distribution packages. Depending on the processing power required, the computer program may be executed in a single electronic digital processing unit (processor) or distributed across several processing units. References to computer readable program code, computer program, computer instructions, computer code, or the like should be understood to represent software for a programmable processor, such as programmable content stored on a hardware device as instructions for a processor, or pre-configured or configurable settings for a fixed function device, gate array, or programmable logic device.

[0051] Although the present invention has been described with reference to one or more embodiments according to the accompanying drawings, it is clear that the present invention is not limited thereto, and some modifications are possible within the scope of the accompanying claims. All words and expressions should be interpreted broadly, and they are not intended to limit the embodiments, but to illustrate them. It will be obvious to those skilled in the art that with the advancement of technology, the concept of the present invention can be implemented in various ways.

Claims

1. 1. A locking system for one or more buildings, comprising: a plurality of electromechanical locks, each of which comprises a communication interface for exchanging encrypted data with a key, an actuator for setting the lock in an open or closed state, and a processor for evaluating the encrypted data read from the key to determine whether to set the lock in an open state or to leave it in a closed state; a plurality of keys, each key comprising: a memory for storing encrypted data defining unlocking rights for one or more of the plurality of electromechanical locks; and an interface for exchanging encrypted data with one or more of the plurality of electromechanical locks, each key having authority to operate within the locking system; a database storing information regarding a user of a particular subset of the plurality of electromechanical locks regarding the user's access rights to the particular subset of the plurality of electromechanical locks, the particular subset of the plurality of electromechanical locks being assigned to the user; a service key including a memory for storing unencrypted data defining default unlocking rights for a particular subset of the plurality of electromechanical locks, the service key further including a transceiver for receiving encrypted data from a reader / writer; a computer program product readable by at least one processor of a user's personal electronic device, the at least one processor being configured to at least: receive, via a user interface of the personal electronic device, a write authorization from a user for a particular subset of a plurality of electromechanical locks; in response to the write authorization, generate an unlocking right for the particular subset of the plurality of electromechanical locks as encrypted data; and, after verifying that the user has access to the particular subset of the plurality of electromechanical locks, write the generated encrypted data including the unlocking right to a service key using the reader / writer; A locking system comprising:

2. the service key is authorized to operate within the locking system by being configured with an encryption key of the locking system; The computer program product is configured to cause the at least one processor to check, before writing the generated encrypted data to a service key, whether the reader / writer and the service key are configured with matching encryption keys dedicated to a locking system, enabling encrypted communication between the reader / writer and the service key.

2. The locking system of claim 1.

3. the reader / writer further comprising a wireless transceiver for receiving encrypted data from the personal electronic device; A locking system according to claim 1 or 2.

4. the reader / writer is embedded in the personal electronic device; A locking system according to claim 1 or 2.

5. The computer program product comprises: and causing the at least one processor to generate new encrypted data indicating a deletion of unlocking rights for a particular subset of the plurality of electromechanical locks, and to write, using the reader / writer, the new encrypted data including the deletion of unlocking rights to the service key. A locking system according to any one of claims 1 to 4.

6. the computer program product is configured to cause the at least one processor to receive a deletion authorization from the user through the user interface before writing encrypted data including the deletion of the unlocking rights to the service key.

6. The locking system of claim 5.

7. the service key is an emergency key that includes encrypted data that does not define unlocking rights in the memory during a storage period, whereas the emergency key includes encrypted data that defines unlocking rights for a specific subset of the plurality of electromechanical locks during an emergency use period, the emergency key being in the storage period by default and intermittently only during the emergency use period; A locking system according to any one of the preceding claims.

8. a key safe for storing said service key, the key safe including a mounting mechanism for securing the key safe to a wall or floor within a building, a wall or floor of a hall or staircase of a building, a wall or floor of a locked space in a building, or a wall or floor of a service center; A locking system according to any one of the preceding claims.

9. the key safe comprises an electromechanical lock that can be unlocked using the personal electronic device and the computer program product or using a user device of a service representative of the locking system; 9. The locking system of claim 8.

10. At least one of the plurality of electromechanical locks is an entrance electromechanical lock at an entrance of a building, the entrance electromechanical lock comprising: a wireless interface for exchanging encrypted data with a computer program product via the personal electronic device; an actuator for setting the entrance electromechanical lock to an open state or a closed state; and a processor for evaluating the encrypted data read from the personal electronic device to determine whether to set the entrance electromechanical lock to an open state or to leave it closed; The computer program product causes at least one processor to receive authorization from a user to open the entrance electro-mechanical lock using the entrance opening right in the encrypted data, and to exchange encrypted data including the entrance opening right with the entrance electro-mechanical lock. A locking system according to any one of the preceding claims.

11. The entrance electromechanical lock comprises an interface for receiving electrical energy from a mains power source for the operation of the wired interface of the entrance electromechanical lock, the actuator of the entrance electromechanical lock and the processor of the entrance electromechanical lock, or an interface for wirelessly receiving electrical energy from a wireless transceiver of the personal electronic device for operation of a wired interface of the entrance electromechanical lock, an actuator of the entrance electromechanical lock, and a processor of the entrance electromechanical lock; 11. The locking system of claim 10.

12. the one or more buildings form at least one of a residential building, a commercial building, an office building, a retail building, a hotel, an industrial building, a residential area, a campus, a factory, a hospital, a building complex; A locking system according to any one of the preceding claims.

13. a number of electromechanical locks in the particular subset of the plurality of electromechanical locks is less than half of the plurality of electromechanical locks; A locking system according to any one of the preceding claims.

14. 1. A computer-implemented method for a locking system including a plurality of electromechanical locks and a plurality of keys, comprising: storing information regarding user access rights to a particular subset of the plurality of electromechanical locks in a database of users of the particular subset of the plurality of electromechanical locks, the particular subset of the plurality of electromechanical locks being assigned to the user; receiving a write authorization from a user via a user interface of the user's personal electronic device for a particular subset of the plurality of electro-mechanical locks; generating, in response to the write authentication, an unlocking right for a particular subset of the plurality of electromechanical locks as encrypted data; using the reader / writer when generating the encrypted data to write the generated encrypted data including the unlocking rights to a service key that does not store as a default the encrypted data defining the unlocking rights; exchanging encrypted data between the service key and one of the particular subset of the plurality of electro-mechanical locks, and in response to said exchange, setting one of the particular subset of the plurality of electro-mechanical locks to an unlocked state using an actuator of the one of the particular subset of the plurality of electro-mechanical locks; 16. A computer-implemented method for a locking system comprising:

15. 1. A locking system for one or more buildings, comprising: a plurality of electromechanical locks, each of the electromechanical locks comprising: a communication interface for exchanging encrypted data with a key; an actuator for setting the electromechanical lock to an open or closed state; and a processor for evaluating the encrypted data read from the key to determine whether to set the electromechanical lock to an open state or to remain in a closed state; a plurality of keys, each key comprising a memory for storing encrypted data defining unlocking rights for one or more of the plurality of electromechanical locks, and an interface for exchanging the encrypted data with one or more of the plurality of electromechanical locks, each key being authorized to operate within the locking system; a database storing information regarding a user of a particular subset of the plurality of electromechanical locks regarding the user's access rights to the particular subset of the plurality of electromechanical locks, the particular subset of the plurality of electromechanical locks being assigned to the user; a service key including a memory for storing unencrypted data defining default unlocking rights for a particular subset of a plurality of electromechanical locks, the service key further including a transceiver for receiving encrypted data from a reader / writer; a computer program product readable by at least one processor of a user's personal electronic device, the at least one processor configured to at least: receive, via a user interface of the personal electronic device, a write authorization from a user for a particular subset of the plurality of electro-mechanical locks; in response to the write authorization, generate service key opening rights for the particular subset of the plurality of electro-mechanical locks as encrypted data; and, after verifying that the user has access to the particular subset of the plurality of electro-mechanical locks, write the generated encrypted data to the service key; An electromechanical lock comprising:

Images