A secured parcel locker system with autonomous clusters of compartments

Abstract

To provide a parcel locker system which facilitates a user authentication and which has autonomous compartments clusters.SOLUTION: An electronic locker system for parcel deposit and pickup includes: a mobile device 102; a remote shipping system 106; and at least one parcel locker 100 including a locking module 120i which controls locking and unlocking of a door and which communicates locally with the mobile device 102. The mobile device 102 establishes a communication with the remote shipping system 106, the locking module 120i establishes short-distance communication sessions with the mobile device 102, and the mobile device 102 receives an encrypted authenticator from the remote shipping system 106. The mobile device 102 transmits a request including the authenticator to the locking module 120i, and the locking module 120i validates the request using a stored secret key.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system and method for the secure deposit of packages by couriers in electronic package lockers configured with lockable compartments, and for the safe subsequent retrieval of those packages. [Background technology]

[0002] Electronic parcel locker systems are used to deposit, store, and receive various types of parcels, such as parcels and packages. These parcel locker systems are typically used by carriers to deposit parcels, which are then retrieved from the parcel locker by recipients. Electronic parcel lockers have a user interface for the carrier or recipient to operate the parcel locker, which is used to deposit the parcel in the case of the carrier, or retrieve the parcel in the case of the recipient. This interface allows the user to input information to operate the parcel locker, and the parcel locker can return information to the user. In modern electronic parcel lockers, this function is typically achieved by a touch screen. The user interface is also used to capture information attached to the parcel or some user identification means. This function can be achieved by a barcode reader to read a printed barcode, or other technologies such as radio frequency or short field communication to read an RFID tag. Electronic parcel locker systems typically comprise a network of parcel lockers, all in direct communication with a remote delivery system that is responsible for managing the network of parcel lockers, and also ultimately managing the data exchange with the carrier information system. Communication between each parcel locker and the remote delivery system is carried out via long-distance communication technologies such as GSM or 3G / 4G.

[0003] FIG. 6 describes a prior art electronic parcel locker system including an electronic parcel locker 10 in communication with a remote delivery system 25 via a long distance communication network 20, which generates authorization codes to access the electronic parcel lockers, communicates these codes directly to the electronic parcel lockers, and manages data regarding parcels processed by the electronic parcel lockers. The electronic parcel locker comprises a series of compartments 30i of different sizes with electronically controlled doors. The operation of the electronic parcel lockers, and in particular the opening and closing of the compartment doors, is controlled by a central control unit 32. This central control unit 32 controls communication between the remote delivery system 25 and the parcel locker user interface, which typically includes a touch screen 34 and a barcode reader 36. When a carrier comes to deposit a parcel at the electronic parcel locker 10, the identification information 38 of each parcel 40 must be captured by the electronic parcel locker and associated by the central control unit with the compartment where the parcel is deposited. For tracking purposes, the identification information 38 may be in the form of a barcode label affixed to each parcel 40. Generally, the compartments have a standard width and are assembled vertically in rows 42 .

[0004] A first problem with such prior art electronic parcel locker systems is that the code authorizing use of the electronic parcel locker is typically manually entered by a user of the parcel locker. Since the ease of use of the electronic parcel locker is not impacted by a code that is too complex, the complexity of the authorization code is limited, thus limiting the security of parcel locker access.

[0005] More generally, prior art electronic parcel locker systems and associated architectures suffer from several problems: A power connection is required, which can often be difficult to set up; The need for long-distance communication between the electronic parcel lockers and the server of the remote delivery system forces the installation of physical communication cables connecting the electronic parcel lockers to a long-distance communication network, or the use of a wireless long-distance communication system; Another problem is the complexity and cost associated with prior art electronic parcel lockers that are assembled in a manufacturing plant and shipped as a complete unit to the installation site; The vertical rows of compartments are typically pre-assembled and partially pre-wired in a manufacturing plant; Such an architecture does not allow for easy replacement of compartments or for easy upgrade or modification of the configuration of the parcel lockers in the field.

[0006] Therefore, there is a need for a new generation of parcel lockers that allows for cost reduction and increased flexibility, including inter alia ensuring interchangeable compartments and increased security. Summary of the Invention [Problem to be solved by the invention]

[0007] SUMMARY OF THE PRESENT EMBODIMENT It is an object of the present invention to provide a parcel locker system with several autonomous compartment clusters, thus overcoming the above mentioned drawbacks. [Means for solving the problem]

[0008] This object is achieved by providing a method for operating at least one parcel locker, consisting of at least one autonomous cluster of compartments including at least one compartment and including a lock module, via at least one mobile device communicating with a remote delivery system via a long-range communication network, the method comprising the steps of: establishing communication between the at least one mobile device and the remote delivery system; periodically issuing, during a sleep mode, by the lock module, a broadcasted short message addressed to the at least one mobile device for establishing a short-range communication session with the at least one mobile device; receiving, by the at least one mobile device, from the remote delivery system, an authenticator generated by said remote delivery system and provided in encrypted form to said at least one mobile device, said authenticator being used by the at least one mobile device to send a request including the authenticator to the lock module; and decrypting the authenticator with a secret key stored in the lock module for automatic verification of the request, wherein no authentication code is generated and provided to the lock module for automatic verification of the request. Advantageously, the authenticator is unique or substantially unique. As a result of the broadcast of the short message, any unauthorized mobile device in the vicinity of the partition cluster may receive the broadcasted short message and attempt to establish communication and access the partition. The authorization method of the present invention based on the insertion of an authenticator in each request ensures the connection of authorized mobile devices with the partition cluster, and the locking module does not need to store the authenticator since it is provided with each request addressed to the locking module.

[0009] In a preferred embodiment, the authenticator is generated by the remote distribution system, associated with the lock module, and encrypted with a cluster secret key that matches the secret key. Preferably, the cluster secret key is unique and uniquely associated with the lock module.

[0010] According to a feature of the invention, the automatic verification is performed by comparing the signature attached to the authenticator with a signature calculated by a cryptographic algorithm installed in the lock module on the basis of the authenticator after decryption. Advantageously, the signature is a hash. According to another feature of the invention, the automatic verification is performed by verifying the format and content of the authenticator following decryption, or by identifying the cryptographic salt contained in the authenticator. The security of the communication via the mobile device and the access to the compartment is thus improved by said verification.

[0011] In a particular embodiment, the request is further verified by checking whether the authenticator's expiration date has been reached, in which case the request is not allowed, resulting in a disconnection between the lock module and the mobile device. Advantageously, the expiration date is calculated based on the authenticator's validity duration, which depends on the user category of the at least one parcel locker, thus limiting the authenticator's validity duration for security reasons. Preferably, the validity duration is set manually or defined by a program running in the remote delivery system, the authenticator's validity duration generally corresponding to the duration from when the authenticator is generated until when it can be used.

[0012] In another embodiment, the request is further verified by checking whether the authenticator identification information contained in the authenticator matches the identification information of another authenticator stored in a blacklist, and if so, the request is not allowed, resulting in a disconnection between the locking module and the mobile device. The blacklist allows the authenticator to be used only once to prevent any unauthorized reuse of the authenticator, and in particular to prevent the risk of the authenticator being captured by an unauthorized person who may then reuse the authenticator to establish unauthorized communication with the locking module.

[0013] According to a feature of the invention, if the request is granted, the locking module stores and associates the authenticator identification and the authenticator expiration date in a blacklist. Advantageously, the locking module stores and associates the authenticator identification and the expiration date in the blacklist following a disconnection request from the mobile device.

[0014] According to another feature of the invention, the locking module stores and associates the authenticator identification information and the authenticator expiration date in a blacklist after a disconnection timeout is reached following an unintentional disconnection of short-range wireless communication between at least one mobile device and the locking module, thus minimizing the number of authenticators generated.

[0015] In certain embodiments, when the expiration date is reached, the authenticator identity and expiration date are removed from the blacklist, thus minimizing data storage in the lock module.

[0016] In a preferred embodiment, the authenticator is reused for all requests within an established short-range communication session between at least one mobile device and the lock module, thus minimizing the number of generated authenticators used for all requests within the communication session to one.

[0017] In another embodiment, when the at least one mobile device requests a disconnection, the authenticator identification information and the expiration date are stored in a blacklist by the locking module. Preferably, in the event of an unintentional disconnection, the at least one mobile device reuses the authenticator to re-establish a connection with the locking module before the disconnection timeout is reached, thus minimizing the number of authenticators generated.

[0018] According to a feature of the present invention, the unique authenticator includes a privilege mask generated by the remote delivery system based on the user's credentials, and the at least one autonomous partition cluster uses the privilege mask to verify access to functions permitted to the user, and preferably the at least one autonomous partition cluster compares the locking modules, identifies the function subject to the request in the function table, and checks whether the function is permitted by the privilege mask.

[0019] In certain embodiments, the authenticator identification information is unique and corresponds to a unique randomly generated string, an incremental number, or the time of generation of the authenticator by the remote delivery system.

[0020] According to another feature of the present invention, at least one mobile device is used as part of a network of mobile devices for establishing asynchronous bidirectional multi-channel communication between a remote delivery system and at least one autonomous partition cluster of at least one parcel locker, thus necessitating the robust security process of the present invention through the use of authenticators.

[0021] In a preferred embodiment, once a communication session with a mobile device is permitted by the lock module, requests from other mobile devices are denied.

[0022] Preferably, the at least one mobile device is used as a user interface for operating at least one compartment of the at least one parcel locker, and advantageously, a program installed on the at least one mobile device for operating the at least one parcel locker is instantiated according to a user category established based on login of a user of the at least one parcel locker.

[0023] In another embodiment, the method further includes the steps of requesting an authenticator by the remote delivery system from the at least one mobile device to establish communication with the at least one autonomous partition cluster after capturing the first broadcasted short message including the first unique cluster identification information, and identifying the at least one parcel locker by the remote delivery system based on the first unique cluster identification information received from the at least one mobile device.

[0024] According to a feature of the invention, the authenticator is generated by the remote distribution system and includes or is transmitted along with the second unique cluster identification information and includes a partition index, and the firmware is configured to associate the partition index with at least one partition.

[0025] In certain embodiments, to establish communication or grant access, at least one autonomous partition cluster verifies the authenticator received from the at least one mobile device and compares the second unique cluster identification information with the first unique cluster identification information stored in the lock module.

[0026] In a preferred embodiment, an initial setup is performed via at least one mobile device to generate a secret key with the lock module and store the secret key in the lock module, preferably the secret key is stored in encrypted form, so that the setup can occur anywhere.

[0027] In another embodiment, the secret key is randomly generated and replaced with other secret keys, if similar, generated by other lock modules upon command from the remote distribution system.

[0028] According to another feature of the invention, at least one mobile device requests a public key from the remote distribution system to secure the transmission of the secret key from the lock module to the remote distribution system.

[0029] Preferably, the remote distribution system generates a public key and a corresponding private key, stores and associates the public and private keys in a database, and the private and public keys ensure confidential and secure transfer of the keys.

[0030] According to a feature of the invention, the public key is transmitted by the remote distribution system to at least one mobile device and temporarily stored on the mobile device.

[0031] According to another feature of the invention, at least one mobile device receives a short message broadcast from the lock module, short-range wireless communication is established, and the at least one mobile device requests generation of a secret key and transmits a public key to the lock module.

[0032] In a preferred embodiment, the request for the generation of the secret key and the transfer of the public key are included in the same request to minimize the number of exchanges and so that no check needs to be made as to whether the public key has been sent. Preferably, the lock module encrypts the secret key with the public key and transmits the secret key in encrypted form to the mobile device.

[0033] In a particular embodiment, the secret key is transmitted in encrypted form by the at least one mobile device to the remote distribution system, decrypted by the remote distribution system with the private key, stored in the remote distribution system as a cluster secret key and uniquely associated with the lock module in a database, so that the secret key can subsequently be used for encrypting data to be transmitted to the lock module, in particular for encrypting the authenticator, and for decrypting data received from the lock module. Advantageously, the cluster secret key is stored in encrypted form in the remote distribution system.

[0034] In a particular embodiment, when the parcel is due to be deposited in the at least one compartment, the at least one mobile device receives an authentication code from the remote delivery system, generated by the remote delivery system, and transmits the authentication code to the at least one autonomous compartment such that a parcel recipient without a mobile device can receive the parcel by entering the authentication code via a lock interface, preferably the authentication code is unique and uniquely associated with the parcel's unique parcel identification information, and advantageously the authentication code is a one-time code that can be used only once by the parcel recipient.

[0035] According to a feature of the invention, an authentication code is requested by at least one mobile device at the time of deposit of the parcel after the parcel has been identified for deposit.

[0036] According to another feature of the invention, an authentication code is generated by the remote delivery system and communicated to the at least one mobile device for temporary storage before or when the carrier schedules a daily delivery to the at least one parcel locker.

[0037] The present invention also relates to an electronic locker system for depositing and receiving parcels, the system comprising: a remote delivery system; at least one mobile device communicating with the remote delivery system via a long-range communication network; and at least one parcel locker comprising at least one autonomous partition cluster including at least one compartment with a door and including a lock module electronically controlling locking and unlocking of the door and communicating locally with the at least one mobile device via short-range communication, the lock module comprising: an energy management module configured to manage energy mode transitions and enable the at least one partition to operate in a sleep mode; a wireless transceiver module with an antenna; and at least one processor configured to periodically emit short messages with the wireless transceiver module during the sleep mode broadcasted towards the at least one mobile device; and an encryption module configured to decrypt an authenticator generated and encrypted by the remote delivery system and included in a request sent by the at least one mobile device with a secret key stored in a non-volatile memory.

[0038] According to another feature of the invention, the lock module is configured to generate a secret key with the encryption module and store the secret key in the non-volatile memory. Preferably, the encryption module is configured to generate a unique secret key or a substantially unique key.

[0039] In certain embodiments, the locking module is configured for automatic validation of the request based on decryption of the authenticator, and no authentication code is generated and provided to the locking module for automatic validation.

[0040] In another embodiment, the locking module includes a non-volatile memory storing a function table including functions available to at least one autonomous partition cluster and executable by at least one processor, and advantageously the unique authenticator includes a privilege mask identifying functions among the functions in the function table that are permitted for operating at least one autonomous partition cluster, preferably the privilege mask being composed of a series of bits, one bit of the series of bits corresponding to a function in the function table, and a value of the bit indicating whether the function is permitted.

[0041] According to a feature of the invention, the remote delivery system is configured to receive and store credentials of a user of at least one parcel locker, generate a unique authenticator, and generate a privilege mask based on the user credentials.

[0042] In a preferred embodiment, the authenticator includes an expiration date that limits the validity duration of the authenticator.Advantageously, the authenticator includes authenticator identification information generated by the remote delivery system.

[0043] According to another feature of the invention, when the request is verified, the locking module includes in the non-volatile memory a blacklist including authenticator identities associated with expiration dates matching the authenticator identities and authenticator expiration dates.

[0044] In a preferred embodiment, the encryption module is configured to encrypt a secret key with the public key and to encrypt data with the secret key for transmission via the at least one mobile device to the remote distribution system.

[0045] In certain embodiments, the encryption module comprises a symmetric Advanced Encryption Standard (AES) algorithm for generating and managing secret keys, and an RSA2018 asymmetric encryption algorithm or an Elliptic Curve Digital Signature Algorithm (ECDSA) for decrypting messages with a public key.

[0046] In another embodiment, the remote distribution system is associated with the lock module and includes a cluster secret key in a database that matches the secret key. Preferably, the remote distribution system includes a remote encryption module, and the public key and associated private key are generated by the remote encryption module. The public key and the private key are used to transfer the secret key in encrypted form between the lock module and the remote distribution system.

[0047] According to a feature of the invention, the broadcasted short message includes a first unique cluster identification associated with at least one autonomous partition cluster.

[0048] According to another feature of the invention, a request from the at least one mobile device to establish local communication with the locking module via short-range communication includes an authenticator that includes or is transmitted along with the second unique cluster identification, and the at least one processor is configured to check for a match between the first unique cluster identification and the second unique cluster identification stored in the locking module.

[0049] In certain embodiments, some of the at least one compartment cluster are mechanically fixed to each other to form a row, and preferably some of the row of at least one autonomous compartment cluster are mechanically fixed to each other to form at least one parcel locker, thus allowing for easy installation and configuration upgrades and servicing, including replacement of compartment clusters.

[0050] In another embodiment, the authenticator comprises a partition index, and the processor is configured to associate the partition index with the at least one partition.

[0051] In a preferred embodiment, the lock module includes a lock interface and an authentication code uniquely associated with a unique parcel identification corresponding to a parcel deposited in the at least one compartment, thus enabling a parcel recipient without a mobile device to receive the parcel by entering the authentication code via the lock interface, and the remote delivery system is configured to generate, store, and transmit the authentication code to the lock module via the mobile device.

[0052] Advantageously, the at least one mobile device is fixedly mounted adjacent to or directly on the at least one parcel locker and connected to a local electrical network, and said at least one processor may include a high energy processor module, a low energy processor module and an ultra-low energy processor module.

[0053] Other aspects, features, and advantages of the teachings of the present invention will become apparent to those of ordinary skill in the art upon review of the following description in conjunction with the accompanying drawings. [Brief description of the drawings]

[0054] [Figure 1] FIG. 1 illustrates an architecture of a parcel locker system according to one embodiment of the present invention. [Diagram 2] FIG. 2 illustrates the architecture of a lock module according to an embodiment of the present invention. [Diagram 3] FIG. 2 illustrates an embodiment of an authenticator of the present invention. [Figure 4] FIG. 1 illustrates a process according to one embodiment of the present invention for setting up a lock module. [Diagram 5] FIG. 2 illustrates a process for validating a request from a mobile module by a lock module according to one embodiment of the present invention. [Figure 6] FIG. 1 illustrates a prior art electronic parcel locker system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0055] According to the present invention, an autonomous cluster of compartments is disclosed that interacts locally with a mobile device via short-range wireless communication to avoid the need for power connections and long-range communication and to allow for easy installation and configuration upgrades. FIG. 1 shows an embodiment of the inventive parcel locker system comprising a parcel locker 100 and a mobile device 102 that communicates via a long-range communication network 104 based on technologies such as 3G-4G or GSM with a remote delivery system 106 that manages authorized access to the parcel locker 100 and manages data regarding shipments processed by the parcel locker 100. The parcel locker 100 is composed of autonomous compartment clusters 110i that may comprise several compartments 112j. The compartments 112j and the autonomous compartment clusters 110i that have the same width may have different heights to accommodate optimal matching with different parcel sizes. Such a compartment cluster typically comprises two or three compartments, or eventually only one large compartment. The compartment clusters can be stacked and mechanically fixed to form a row 114. The row 114 can then be mechanically fixed to form a larger parcel locker unit. The autonomous compartment cluster is characterized by a design without any power connection or long-range communication, allowing for easy installation and configuration upgrades. Each compartment 112j is equipped with a hinged door 116j at the front, which can be opened to deposit or retrieve a parcel 118j into or from the compartment. Each autonomous compartment cluster 110i is equipped with a communication lock module 120i that electronically controls the locking and unlocking of each door of the compartment of the cluster. Each lock module 120i can establish local communication with nearby mobile devices 102 via short-range wireless communication 122i, such as WIFI, IR, or Bluetooth. Although preferably a mobile device such as a smartphone or PDA, the device 102 may also be a fixed computerized device such as a PC or laptop with some short-range wireless communication capabilities compatible with the short-range communication capabilities of the lock module.

[0056] The mobile device 102 can be a smartphone or a personal digital assistant (PDA), or any computerized mobile device having some short-range wireless communication capabilities compatible with the short-range communication capabilities of the lock module and some long-range communication capabilities compatible with the long-range communication capabilities of the remote delivery system 106. According to the present invention, the mobile device is used as a user interface for operating the parcel locker compartments, replacing the central user interface of the prior art parcel lockers, which is therefore not necessary for the parcel lockers of the present invention. More generally, the mobile device is used as a channel for communication between the remote delivery system and the lock modules of the parcel lockers, allowing the establishment of an asynchronous two-way multi-channel communication. As a result, the remote delivery system may transfer, for example, instructions for blocking the operation of a compartment via any mobile device, or the lock module of a compartment cluster may transfer information, such as events regarding the operation in the compartments of the compartment cluster, to the remote delivery system via any mobile device. Therefore, it is essential to secure the communication via the mobile device, as well as the access to the compartments via the mobile device.

[0057] Different categories of users can interact with the parcel locker compartments via mobile devices, including parcel recipients, site owners, or carriers, who may generally use a PDA. Preferably, especially in the case of parcel recipients, the mobile device is a smartphone, so that the parcel recipients can use their personal smartphone. A mobile parcel locker application (MPL application) for locally operating the parcel locker compartments may be installed on the mobile device or, preferably, downloaded from a remote server, for example via an application store. To provide the easiest and most widespread access to the parcel locker service, the MPL application may be downloaded from a standard application store, such as Google Play or the App Store. The MPL application includes subprograms for installing or servicing parcel lockers, generally for site owners, or for delivering parcels, generally for carriers, or for receiving parcels or receiving notifications, generally for parcel recipients. Preferably, the MPL application is instantiated according to the user category. In the case of a carrier's PDA, the MPL application may be integrated into a carrier software module installed on the PDA for delivering parcels. Such simple and open access to MPL applications requires that communications via the mobile device be secured and also access to the partition via the mobile device, and system security is addressed by the authentication functions and processes of the present invention, as described below.

[0058] In order to prevent any communication from an unauthorized device and ultimately any access to the compartment, an authenticator, preferably a unique authenticator, needs to be provided as part of the request from the mobile device to establish a communication session, which is checked by the lock module of the compartment cluster to allow the establishment of the communication session and ultimately any request from the mobile device. The authenticator is provided to the authorized mobile device by the remote delivery system in an encrypted form. The authenticator is then provided by the mobile device to the lock module to establish the communication session, and the authenticator is decrypted by the lock module to verify the request. As a result, the authenticator can be automatically sent by the mobile device of the parcel recipient to access the parcel locker compartment when the recipient is near the parcel locker. There is no need to enter an authentication code via the user interface of the parcel locker as in the prior art, thus improving access security and user experience.

[0059] The remote delivery system comprises a database system 130, which may include several databases that are ultimately installed on several server systems operated by the carrier or by a service company that owns or manages the parcel locker park. The database system 130 stores the configurations of all parcel lockers 100 to be controlled by the remote delivery system. Each parcel locker configuration (PL configuration) includes a unique parcel locker identification 132 and, for each parcel locker compartment cluster 110i, a unique cluster identification 134i and preferably a unique cluster secret key 136i. The PL configuration also includes, for each compartment cluster, a cluster broadcast table 138i that includes repetition time period parameters, listening time window parameters, and power emission parameters that correspond to optimized parameters for the lock module to broadcast short messages towards mobile devices. Each compartment of the compartment cluster is identified by a compartment index, which is also stored in the database 130, indexing the compartment among the compartments of the compartment cluster. The association of the unique cluster identification and the compartment index allows the unique identification of the compartment (unique compartment identification). Further, the PL configuration includes, for each parcel 112j, a parcel identifier 140j that is replicated in the parcel cluster as a visual identifier of the user, a parcel size 142j, and a unique parcel identification 144j if a parcel is deposited in the parcel 112j. The database system 130 also stores the credentials of the parcel locker user and information for communicating with the parcel locker user, such as a telephone number and an email address. In particular, the database system 130 stores, for each parcel recipient, a unique authentication code 150j that may be necessary for the parcel recipient to receive the parcel and that is generated by the remote delivery system for each parcel deposited in the parcel. The unique authentication code 150j is associated with the recipient's credentials and is uniquely associated with the parcel identification 144j of the corresponding parcel.

[0060] The public key 152 is stored in the database 130 and is used to transfer the secret key between the lock module and the remote delivery system. A private key 154 associated with the public key 152 is also stored in the database and is used to decrypt data encrypted with the private key. The remote delivery system comprises a remote encryption module 156 configured to generate the associated private and public keys, in particular to transmit the secret key, to decrypt data with the private key, to encrypt data with the secret key, for example to transfer data to the lock module via the mobile device, and to decrypt data with the secret key, for example data received from the lock module via the mobile device. The remote encryption module is equipped with an asymmetric encryption algorithm, preferably an Elliptic Curve Cryptography (ECC) type algorithm such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or the RSA2018 algorithm for generating and managing public and private keys, and a symmetric encryption algorithm, preferably an Advanced Encryption Standard (AES) algorithm for encrypting and decrypting messages with the secret key.

[0061] The use of autonomous partition clusters offers simplicity and flexibility, in particular since it avoids the need for any electrical wiring around the partition cluster or any power connection. However, there is an important requirement to minimize the power consumption of each partition cluster, and therefore the lock module to minimize communication and data exchange, which are important sources of energy consumption, and data storage within the lock module. One way to minimize power consumption is to implement low energy or sleep modes for the operation of the lock module. In parallel, there is a need to optimize the usability of the parcel locker, in particular including ensuring that the user does not have to wait for long periods of time in front of the parcel locker, for example for long data exchanges. These aspects are addressed by the present invention, as will be described in more detail below.

[0062] FIG. 2 shows a lock module 120i of a compartment cluster 110i, comprising a processor or group of processors 210 and associated volatile memory 212, which controls the main components of the lock module via a bus 214 or direct control lines. Short-range wireless communication is performed by a radio transceiver module 216 with an antenna 218. The radio transceiver module may contain several registers or may have access to dedicated registers in the lock module memory. These registers dedicated to the radio transceiver module contain configuration data for the operation of the radio transceiver module and the antenna, as well as data related to the initial or broadcast short messages sent by the lock module to initiate communication with a mobile device or several mobile devices. The door of each compartment of the compartment cluster is equipped with an electric lock 220n. Locking of the electric lock is performed via a power stage 221, which notably supplies power to the electric lock under the control of the processor 210 and is directly controlled by the processor 210. A sensor 222n may be provided per compartment to determine the status of the electric lock (locked / unlocked) or the status of the door (open / closed) or whether the compartment is empty or full. The power supply of the sensor and the measurements performed by the sensor are provided via the sensor input / output port (I / O) 223 of the lock module. A visual indicator 224n, such as a light emitting diode (LED), may be attached to each compartment and controlled by the processor, for example to indicate which compartment should be used for depositing or receiving a parcel. The power supply to the indicator is provided via the indicator input / output port (I / O) 225 of the lock module. Preferably, when the door is unlocked, the door opens automatically, for example thanks to a spring mechanism, thus indicating which compartment should be used without the need for any visual indicator. Although the system is designed to be operated by a mobile device such as a smartphone by the parcel recipient, it may also be operated using a pin pad or other devices of the art, so that a parcel recipient who does not have a mobile device in his possession can access the compartment by entering an authentication code at the lock interface. A lock interface 226, such as another interface known in the art, is also provided to the recipient of the parcel. A parcel identifier, such as a number, may be attached to a visible portion of each parcel, such as a door, so that a user may identify a particular parcel. Thus, a recipient who does not own a mobile device may identify the parcel where the parcel needs to be received and the associated lock interface that is near the parcel. Alternatively, a cluster identifier, such as a number, may be attached to a visible portion of each parcel cluster, so that a user may identify a particular parcel cluster and the associated lock interface. Thus, a recipient who does not own a mobile device may identify the parcel cluster where the parcel needs to be received and use the corresponding lock interface to open the parcel.

[0063] The lock module is powered by a power source 228, which may be a replaceable battery or a rechargeable battery via a solar panel or an energy harvesting device or any other electrical energy supply. To minimize power consumption, an energy management module 230 manages the transition of energy modes, allowing the partition cluster 110i to operate in different low energy modes or different sleep modes. Each energy mode defines the peripherals or components available and limits the amount of current consumed by the peripherals or components. For example, the energy management module may power off or on unused blocks of the volatile memory 212 or turn off or on the wireless transceiver module. The energy management module may include a voltage regulator and a timer to switch between energy modes.

[0064] A non-volatile memory 240 controlled and directly accessible by the processor stores firmware executed by the processor 210 and data received from a remote delivery system via a mobile device or generated within the partition cluster 110i, such as operational events. The data stored in the non-volatile memory 240 includes a cluster identification 250 that uniquely identifies the partition cluster, a partition index 252n used to index each partition among the partitions of the partition cluster, a secret key 254, a blacklist 256 for managing the establishment of communication with a mobile device, and a disconnection timeout 258 for managing the unintentional disconnection of the short-range wireless communication between the mobile device and the lock module. The non-volatile memory 240 also stores a function table 260 corresponding to all functions available for partition cluster operation and that can be executed by the processor 210 upon request by an authorized mobile device, and may store, for each partition of the partition cluster, a unique authentication code 270n that may be requested from a recipient to receive a parcel in the partition, and may store a cluster broadcast table 272.

[0065] The lock module also comprises an encryption module 256 configured to generate a secret key 254, to encrypt data with the secret key, e.g. for data received from the remote delivery system via the mobile device, to decrypt the data with the secret key, and in particular to encrypt the generated secret key for transfer to the remote delivery system via the mobile device, to encrypt data with the public key 152. During the parcel locker setup phase, each lock module preferably generates and stores a unique secret key, which is then transmitted to the remote delivery system and stored in the remote delivery system as a cluster secret key 136i uniquely associated with each particular lock module and cluster. Encryption of data with a specific secret key by either the lock module or the remote delivery system allows for a secure and confidential exchange via the mobile device. The encryption module 256 is provided with a symmetric encryption algorithm, preferably an Advanced Encryption Standard (AES) algorithm, for generating and managing secret keys, and an asymmetric encryption algorithm, preferably an Elliptic Curve Cryptography (ECC) type algorithm such as the Elliptic Curve Digital Signature Algorithm (ECDSA) or the RSA2018 algorithm, for decrypting messages with a public key.

[0066] The secret key 254 may be randomly generated by the encryption module 256 with a very low probability of similarity to keys randomly generated by other lock modules, and therefore is substantially unique. For example, for an AES256 encryption module that randomly generates keys, the probability of similarity is lower than a 1 in 10 chance. In such cases, the remote delivery system checks for similarity and directs some secret key changes to ensure the uniformity of the secret keys.

[0067] To communicate with the lock module 120i via short-range wireless communication, the mobile device 102 also includes a radio transceiver module with an antenna controlled by a processor running associated short-range wireless communication software. In particular, the mobile device 102 includes a scanning function to discover different partition clusters with which it may need to communicate. Such hardware and software components are commonly available in smartphones or PDAs.

[0068] When the partition cluster is not in use, the locking module is in a deep sleep mode, i.e., a very low energy mode to minimize the power consumption of the partition cluster. In such a deep sleep mode, the energy level of the partition cluster is less than 10% of the average energy consumption when the partition cluster is awake and fully operational. Only very limited functionality is available, in particular the wireless transceiver module is asleep and the locking module cannot communicate with and be woken up by mobile devices in the vicinity of the partition cluster. When in the deep sleep mode, the locking module temporarily partially wakes up to broadcast short messages in order to be able to initiate a communication session with the mobile device. This partial wake-up, which corresponds to the low energy sleep mode, can be controlled by an energy management module, which can comprise a low energy sleep timer 280 for activating the wireless transceiver module and triggering the transition to the sleep mode. In the sleep mode, the additional functionality is limited to sending broadcasted short messages and waiting for responses, compared to the deep sleep mode. The operation of the lock module can be controlled by a processor composed of several processor modules, including a high energy processor module 210A that controls high level functions including communication management and access permission management, which is deactivated in sleep mode, a low energy processor module 210B that controls the radio transceiver module for sending broadcasted short messages and waiting for responses, which is deactivated in deep sleep mode, and a very low energy processor module 210C for minimal control. An energy management module manages the switching between these modes and the associated energy consumption. The operation of the lock module can also be controlled by separate processors that work together and whose activities and energy consumption are managed by the energy management module. For example, a particular processor may control the radio transceiver module and may be specifically activated during sleep mode.

[0069] To minimize power consumption, the locking module is generally maintained in a deep sleep mode. To enable communication with the mobile device, a low energy sleep timer 280 periodically triggers a transition from the deep sleep mode to a sleep mode according to a repeating time period. Once in the sleep mode, the locking module transmits a broadcasted short message and actively listens for a response from the mobile device during a limited listening time window. The end of the listening time window is triggered by a listening time window timer 282, which may be included in the energy management module. A mobile device that is in close proximity to a partition cluster and has activated short-range wireless communication has a scanning function to listen for a short message broadcast from the locking module. When the mobile device captures the broadcasted short message from the locking module, if it needs to establish communication with the locking module, it immediately transmits a response message to the locking module to establish communication, so that the response message can be captured within the limited listening time window of the locking module.

[0070] Receiving the response message from the mobile device by the wireless transceiver module triggers the full wake-up of the lock module. The energy management 230 activates the processor high-level functions by activating the high energy processor module 210A that controls the high-level functions, or by activating the corresponding processor in case of an architecture with separate processors that cooperate with each other. In order to establish communication with the mobile device, the full wake-up of the lock module is necessary because in sleep mode the lock module cannot perform authentication of the communication session with the mobile device and cannot complete the establishment of communication. Once communication is established, the mobile device then behaves as a client that initiates requests and commands and accepts responses from the lock module. The lock module behaves as a server that receives requests and commands, performs the requested actions, and returns responses. As a result, any unauthorized mobile device in the vicinity of the partition cluster may receive the short message broadcast from the partition cluster and attempt to establish communication and access the partition. The authorization method of the present invention based on the use of authenticators secures the connection between authorized mobile devices and partition clusters.

[0071] If a response from the mobile device to the broadcasted short message is not captured by the wireless transceiver module within a limited listening time window, the listening time window timer 282 triggers an exit from the sleep mode and the energy management 230 manages a return to the deep sleep mode and deactivates the wireless transceiver module and the low energy processor module 210B.

[0072] When a mobile device receives a short message broadcast from a particular partition cluster, the mobile device may need to establish a communication session with that particular partition cluster, for example, to forward events stored in the partition cluster to the remote delivery system, to deposit parcels in partitions of the partition cluster, to receive parcels from partitions of the partition cluster, etc. To prevent any communication and ultimately any access to the partition cluster from unauthorized devices, a preferably unique authenticator generated by the remote delivery system needs to be provided as part of the request from the mobile device to establish a communication session.

[0073] The authenticator includes or is sent with a unique cluster identification that is checked by the locking module to ensure that the request is directed to the appropriate partition cluster, and includes a partition index that identifies the partition associated with the communication session being established (e.g., for deposit to or pick-up from that particular partition). A request from the mobile device to establish a communication session may be received by other partition clusters, but is rejected because there is no match in the cluster identification. Once a communication session by a partition cluster with the mobile device is permitted, requests from other mobile devices are rejected. During the communication session, any request from the mobile device to a partition cluster may need to include an authenticator. The authenticator is generated by the remote distribution system and provided to the mobile device by the remote distribution system.

[0074] FIG. 3 illustrates one embodiment of an authenticator 300 of the present invention. To minimize the number of exchanges between the lock module 120i and the mobile device 102, the authenticator includes several key data so that the lock module does not need to request it later from the mobile device. The authenticator includes a partition index 310 that identifies the partition associated with the established communication session (e.g., depositing to or receiving from that particular partition), and a privilege mask 312 that identifies the functions that are allowed among all the functions available in the function table 260. The generation of the privilege mask by the remote delivery system depends on the user, and in particular on the user category. The remote delivery system then provides the privilege mask in the authenticator to the mobile device. The privilege mask and the authenticator are generated by the remote delivery system when the user logs into the MPL application, which is installed on the mobile device to interact with the parcel locker partitions, and automatically requests the authenticator from the remote delivery system. Following the establishment of the communication session, the privilege mask received by the partition cluster is used for the partition cluster to provide access to the functions that are allowed for the particular user. The privilege mask is stored in a volatile memory and addressed by firmware executed by the locking module to check the functions allowed for a particular user. To help minimize the size of the privilege mask and therefore the data volume exchanged with the locking module, the privilege mask is composed of a series of bits, preferably a 32-bit or 64-bit series, each bit corresponding to a particular function of one of the function tables 260. The bit value indicates whether the function is allowed or not. For example, a bit set to 1 may indicate that the function is allowed and a bit set to 0 may indicate that the function is not allowed. Such a format of the privilege mask allows for compression of information and convenient incorporation of the privilege mask into the authenticator, which eliminates the need for additional communication between the partition cluster and the mobile device to define the allowed functions. The authenticator also includes an expiration date 314 after which the authenticator is no longer valid.The expiration date limits the validity duration of the authenticator for security reasons. In general, the validity duration of an authenticator corresponds to the duration between the time the authenticator is generated and the time it can be used, for example, for picking up the parcel by the recipient or depositing the parcel by the courier, and can be up to several days. The expiration date is calculated by the remote delivery system based on the validity duration, which depends on the user category or other usage conditions and can be configured in the remote delivery system. For a parcel recipient, the validity duration corresponds to the time given to the recipient to pick up the parcel before the carrier removes the parcel to free up some compartment space, and can be between 2 and 5 days. For a carrier, the validity duration corresponds to the maximum time planned for the carrier to deliver the parcel at the parcel locker, and can vary depending on the carrier's organization. The validity duration may be set manually by a server administrator or may be adjusted or defined by a program running in the remote delivery system. Each authenticator also includes an authenticator identification 316, which is generated by the remote delivery system when the authenticator is generated. The authenticator identification is generated randomly by the remote encryption module 156 and has a very low probability of similarity with other authenticator identifications generated for other authenticators, and is therefore practically unique. For example, for an AES encryption module generating a 32-bit random integer, the probability of similarity is less than 1 in 4 billion. In such a case, the remote delivery system checks for similarity and excludes authenticator identifications that have already been generated. Preferably, the authenticator identification is unique, and the remote delivery system may include a remote encryption module that generates random and unique authenticator identifications.

[0075] In order to minimize resource, and especially energy, consumption, the authenticator is minimal in size because the locking module processes it during communication with the mobile device or during internal processing. In particular, the authenticator does not include an authentication code, which is typically exchanged as part of a message within a communication session following a request from the locking module.

[0076] To minimize data exchange between the mobile device and the lock module, the authenticator generated to allow the mobile device to establish a communication session with a particular lock module is encrypted with a cluster secret key corresponding to that particular lock module. To authorize a communication session with the mobile device, the lock module uses its secret key to check the authenticator. Thus, no specific verification code needs to be provided by the mobile device, since authorization is based on encryption performed with the cluster secret key corresponding to the particular lock module.

[0077] When a mobile device sends an authenticator to establish communication with the lock module, there is a risk that the authenticator may be captured by an unauthorized person who may then reuse the authenticator to establish unauthorized communication with the lock module. To prevent any unauthorized reuse of the authenticator, the lock module allows the authenticator to be used only once to establish communication. When the lock module allows the establishment of communication with a mobile device based on the authenticator provided by the mobile device, the lock module stores and associates the authenticator identification and the authenticator's expiration date in the blacklist 256. Thereafter, when the authenticator identification of the authenticator provided by the mobile device is already stored in the blacklist 256, the lock module refuses to establish a connection, resulting in a disconnection between the lock module and the mobile device. To minimize data storage in the lock module, when the expiration date is reached, the authenticator identification associated with the expiration date is removed from the blacklist along with the corresponding expiration date.

[0078] The invention provides several checks to ensure access to a compartment and communication with the corresponding lock module. First, the establishment of communication with the lock module is allowed based on the decryption of an authenticator by a secret key, preferably unique, generated by the lock module and associated with the lock module. Then the validity of the authenticator is checked with respect to its expiry date and whether it has already been used via a blacklist. Then the action request is checked based on the privileges granted to the user. Furthermore, once a communication session by the lock module with a mobile device is allowed, requests from other mobile devices are rejected. During the communication session, any request from the mobile device to the lock module must include an authenticator, and each of the above checks is performed. A new authenticator may be required for each request. However, in order to minimize the number of authenticators generated, the same authenticator may be used for all requests within the communication session. In this case, the storage of the authenticator identification and the associated expiry date in the blacklist is performed by the lock module upon disconnection by the mobile device.

[0079] System security is also improved by the uniqueness or quasi-uniqueness of the authenticator. Each authenticator generated by the remote distribution system combines a privilege mask specific to a user category, an expiration time specific to the time of the authenticator's creation, and an authenticator identification that is substantially unique since it is randomly generated by the remote encryption module. Furthermore, each authenticator is encrypted with a secret key that is substantially unique to a particular lock module. Thus, each authenticator is substantially unique. To ensure the uniqueness of the authenticator, the remote distribution system may generate a unique authenticator identification, for example, by eliminating any similar authenticator identification or by generating a random and unique authenticator identification.

[0080] In contrast to prior art parcel lockers that include a central control unit that monitors, stores and controls the status of different compartments of the parcel locker, the parcel locker of the present invention, which is composed of autonomous compartments, does not include any central control unit. In the parcel locker system of the present invention, monitoring and storage of the status of the compartments is performed by a remote delivery system that delegates local control of the compartments to the MPL application. All necessary data is transmitted by the remote delivery system to the mobile device for operating the parcel locker. In particular, when the deposit of a parcel in the parcel locker of the present invention is initiated by the carrier, a PL configuration is provided by the delivery remote server to the carrier's MPL application. The PL configuration includes all cluster identification information and parcel identification information of the parcels that are deposited in the parcel locker compartments. The PL configuration is essential to allow the user to operate the parcel locker via the mobile device, for example to allow the carrier to select the compartment in which the parcel can be deposited. Preferably, the PL configuration is requested by the MPL application to the remote delivery system following the reception by the mobile device of the first broadcasted short message from the compartment cluster.

[0081] Based on the unique cluster identification information 250 included in the broadcasted short message and forwarded to the remote delivery system in the PL configuration request, the remote delivery system identifies in its database system 130 the corresponding parcel locker and provides the PL configuration to the mobile device. Once the PL configuration is received by the mobile device, the MPL application identifies a parcel available for deposit, and the mobile device can establish a communication session with the parcel cluster including that parcel for parcel deposit. The parcel availability is set based on the cluster status table 136i included in the PL configuration provided by the remote delivery system for whether the parcel identification information is associated with a parcel of the parcel cluster, i.e., associated with the parcel identification. Based on the event restrictions 252 received from the parcel cluster by the broadcasted short message, the MPL application sets that an update of the PL configuration may be required. In an alternative embodiment, the PL configuration is received from the remote delivery system before the carrier arrives near the parcel locker and the parcel deposit can be initiated before the broadcasted short message is received by the mobile device from all the parcel locker's parcel clusters, thus minimizing the carrier's delay.

[0082] Based on the PL configuration, the MPL application can set the number of compartment clusters that make up the parcel locker and check that the broadcasted short message is received from all compartment clusters of the parcel locker. The efficiency of the deposit of parcels by the carrier depends on the accuracy of the PL configuration provided by the remote delivery system. Therefore, it is important that events related to the parcel locker compartments are forwarded to the remote delivery system as soon as possible. Preferably, the events are forwarded as part of any user operation on the parcel locker via the user's mobile device. However, some parcel recipients may receive parcels without using a mobile device, or some operations may not allow the events to be forwarded to the mobile device. Therefore, any events related to the compartment cluster during user operations such as deposit or during compartment cluster internal operations such as low power situations are stored in the event table 255 so that they can be forwarded to the remote delivery system via any mobile device that performs an event upload to the remote delivery system.

[0083] In one aspect of the invention, the parcel locker system of the invention allows the establishment of asynchronous bidirectional multi-channel communication between a remote delivery system and a partition cluster of a portion of the parcel locker, where a plurality of mobile devices constitute a multi-channel network. Following the establishment of a communication session between the mobile device and the partition cluster, an asynchronous communication is established in the direction from the partition cluster to the remote delivery system via the mobile device to transfer data, such as, for example, an event, from the partition cluster to the remote delivery system. The mobile device temporarily stores the data until the transfer to the remote delivery system can be completed. This transfer can be performed via any mobile device that has the MPL application installed and activated for operating the parcel locker, so that the data can be uploaded via the first mobile device that establishes communication with the partition cluster. In the other direction, the remote delivery system communicates data, such as an authenticator, or an instruction, for example, to block the operation of the partition, to the partition cluster via the mobile device. The data or request is temporarily stored on the mobile device until the transfer to the partition cluster can be completed. This asynchronous communication can be performed via any mobile device that has the MPL application installed and activated.

[0084] Preferably, the remote delivery system selects a number of preferred mobile devices for communicating with the partition cluster according to a pre-set rule. The pre-set rule may be that communication from the remote delivery system to a particular partition cluster is addressed only to the mobile device making a request to the remote delivery system for a particular partition cluster, such as for an upcoming deposit of a parcel. Such a rule ensures that communication from the remote delivery system is channeled only through the mobile device that is most likely to establish communication with the particular partition cluster. The two-way communication may be established based on Web Socket technology. According to the present invention, a mobile device having an MPL application for operating parcel lockers installed thereon constitutes a multi-channel asynchronous network for communicating between the remote delivery system and the partition cluster, thus optimizing the efficiency of communication, while the present invention also enables the operation of parcel lockers in areas not covered by long-range wireless communication. Data or requests from the remote delivery system may be conveyed and temporarily stored in the mobile device before entering an area not covered by long-range wireless communication, and data from the partition cluster is temporarily stored in the mobile device until the mobile device leaves the area not covered by long-range wireless communication to complete the transfer to the remote delivery system.

[0085] Establishing asynchronous two-way multi-channel communications via an untrusted mobile device, i.e., any mobile device that has downloaded the MPL Application, requires the robust security process provided by the present invention through the use of the authenticators and checks described above.

[0086] The system is designed to be operated by parcel recipients who have mobile devices such as smartphones or who do not have mobile devices, as some parcel recipients may not own or want to use mobile devices to operate the parcels. Parcel recipients may own mobile devices that do not have short-range wireless communication capabilities or may not want to activate them. Thus, the parcel locker system of the present invention must be able to be operated by parcel recipients both remotely by a mobile device and manually by a lock interface, such as a pin pad for entering a unique authentication code. However, automatically accessing the parcel locker by a mobile device is the main objective of the present invention, and manually accessing the parcel locker is a mitigating procedure. Operating the parcel locker by a mobile device provides a superior user experience, since no authentication code needs to be entered. For the purposes of this preferred embodiment of the present invention, access permission by the parcel cluster is automatically provided by the recipient's mobile device and is granted by checking an authenticator that is initially generated by the remote delivery system.

[0087] To support manual access mitigation procedures, an authentication code is systematically provided to each recipient. For security reasons, the authentication code provided to the recipient to receive a parcel is preferably a one-time authentication code, uniquely associated with the specific parcel to be received, such that the one-time authentication code cannot be used again. The one-time authentication code is generated and managed by the remote delivery system. For each parcel received from a compartment, the recipient must provide the one-time authentication code to the compartment cluster that contains that compartment before coming to receive the parcel. In one embodiment, the authentication code is requested by the carrier's MPL application upon parcel delivery by the carrier, after the parcel has been identified for deposit, for example, by scanning the parcel identification information attached to the parcel. Alternatively, in another embodiment, the authentication code is generated in advance by the remote delivery system and communicated to the MPL application for temporary storage before or when the carrier plans its daily delivery to the parcel locker. Thus, the carrier can operate the parcel locker even when standing in an area not covered by long-range wireless communication.

[0088] Upon receiving the authentication code request, the remote delivery system generates an authentication code, which is temporarily replicated to the mobile device. When the parcel is deposited, the authentication code is transferred from the mobile device to the partition cluster, associated with the partition of the partition cluster where the parcel was deposited (i.e., partition index), and the remote delivery system is notified of the deposit via a partition cluster event upload. The remote delivery system then notifies the recipient that they need to collect their parcel, for example, via SMS or email. If the recipient does not have the MPL application installed, the notification provides the recipient with the location of the parcel locker, the partition identifier 140j, and the authentication code that they need to enter to open the partition. If the recipient has the MPL application installed, the notification only informs the recipient of the location of the parcel locker and reminds them that they need to use the MPL application to open the partition.

[0089] More generally, the benefits of operating a parcel locker with a mobile device apply to any user, including a site owner or a carrier: access authentication by the parcel cluster is provided automatically by the user's mobile device, by checking an authenticator that is initially generated by the remote delivery system, thus replacing manual authentication entry, for example via a keypad or barcode scan.

[0090] In addition to meeting the needs of a new generation of parcel lockers as mentioned above, the autonomous compartment cluster of the present invention provides additional advantages. Unlike conventional parcel lockers, where a malfunctioning central control unit blocks the operation of the entire parcel locker and must immediately intervene if a compartment cluster lock module malfunctions and is not able to communicate any more, all other compartment clusters can continue to operate and communicate. With the parcel locker of the present invention, a simple replacement of the malfunctioning compartment cluster can be performed when it is most appropriate. Another user advantage of the present invention is that each user operates the compartment cluster of the present invention on his / her mobile device, thereby allowing multiple users to access several compartment clusters in parallel. During busy periods, multiple recipients may receive parcels in parallel or even carriers and recipients may interact with the parcel locker compartment cluster in parallel. Such parallel operation is made possible by the system architecture of the present invention, which provides a lock module that broadcasts short messages, stores operation events, and updates PL configuration information of the mobile device and the remote delivery system.

[0091] FIG. 4 shows an embodiment of the present invention for setting up a lock module. The main purpose of the setup is to ensure a confidential and secure transfer of the secret key for encrypting and decrypting data exchanged between the remote delivery system 106 and the lock module 120i of the parcel locker, in particular for encrypting and decrypting the authenticator. According to the present invention, the setup can be performed via any mobile device, such as a smartphone or PDA, and therefore can be performed anywhere, including on-site where the parcel locker is installed. However, when the setup is performed in a warehouse or customization center, typically just before final shipment before installation on-site, the setup can also be performed via a fixed computerized device, such as a PC or laptop, that has short-range wireless communication capabilities compatible with the short-range communication capabilities of the lock module. The MPL application installed on the mobile device (or fixed computerized device) is instantiated according to a user category that has credentials to perform the setup of the lock module, and all functions for performing the setup are made available to the user in the mobile application. Preferably, the user is guided through a wizard program to perform the setup that may cover all the lock modules of the parcel locker.

[0092] In step 402, the user initiates the setup of the lock module by performing a login on the mobile device to access the MPL Application functions required for the setup. The login procedure requires the capture of the user's credentials, which may include user identification information and / or the user's personal password and may be captured via any means known in the art, such as manual entry via the mobile device interface (e.g., by keying an identifier into the keypad or touch screen of the mobile device), an identification barcode read by the mobile device, or the capture of the identification by the mobile device via imaging or biometric or radio frequency technology. The mobile application sends a login request including the user's credentials to the remote delivery system. After verifying the login request and in particular the user credentials based on the credentials stored in the database system 130, the remote delivery system grants the user access to the MPL Application setup functions on the mobile device.

[0093] Following login, the MPL application is instantiated according to the user category and the user selects the setup program to start the setup of the lock module (step 404). The mobile device requests a public key 152 from the remote delivery system to secure the transmission of the secret key 254 (step 406). If the remote delivery system has not yet generated a public key (step 408), the remote delivery system generates several public keys 152 and corresponding private keys 154 and stores and associates these public and private keys in the database 130 (step 410). These public and private keys are used to transfer the secret key in an encrypted form from the lock module to the remote delivery system. They may be periodically changed by the remote delivery system. For example, a new pair of public and private keys may be generated for each parcel locker to be set up. In step 412, the remote delivery system sends the public key to the mobile device, which stores it temporarily. In step 414, the mobile device performs a first connection with the lock module. Upon receiving from the lock module a broadcasted short message including a unique cluster identification 250 associated with the lock module, the mobile device sends a request to establish a first connection with the lock module. This first connection request is allowed if it does not include any authenticator and if no secret key is stored in the non-volatile memory 240 of the lock module. After validating the first connection request, the lock module establishes a short-range wireless communication with the mobile device. The mobile device then requests the lock module to generate a secret key and transfers the public key (step 416). Preferably, the request for the generation of the secret key and the transfer of the public key are included in the same request to minimize the number of exchanges and so that no check needs to be made as to whether the public key has been sent. The secret key generation request is the only request including the first connection request that can be allowed without including an authenticator. After validating the secret key generation request, the lock module's By checking that the secret key is not already stored in the non-volatile memory 240, the lock module preferably generates a unique secret key 254 and stores it locally in the non-volatile memory 240 (step 418). The secret key may be generated randomly by the encryption module 256 with a very low probability of similarity to keys randomly generated by other lock modules and is therefore substantially unique. In such a case, the remote delivery system checks the similarity and directs some secret key modifications to ensure the uniqueness of the secret key. Preferably, the lock module comprises an encryption module that generates a random and unique secret key. In a preferred embodiment, the lock module stores the secret key in encrypted form. In step 420, the lock module encrypts the secret key with a public key and sends the encrypted secret key to the mobile device.

[0094] In step 422, the mobile device sends a request to the remote distribution system for registration of the lock module, transmitting the secret key in encrypted form. Thereby, the generation of the secret key is made secure and confidential, and the secret key is transferred securely and confidentially through the mobile device. After validating the registration request, in particular by checking that no secret key is already recorded in the database system 130 of the remote distribution server for that particular lock module, the remote distribution system decrypts the transmitted encrypted secret key with its private key and registers the lock module (step 424). As part of the registration, the remote distribution system stores the secret key, preferably in encrypted form, as a cluster secret key 136i and associates the cluster secret key with the lock module (i.e. the unique cluster identification 134i) in the database 130, so that the secret key can be used later for encryption of data to be transmitted to the lock module, in particular for encryption of the authenticator, and for decryption of data received from the lock module.

[0095] After the first connection to the lock module and after transmission of the secret key, new requests from the mobile device to the lock module must include an authenticator generated by the remote delivery system and encrypted with the cluster secret key corresponding to the lock module. In addition to securing the communication, including the authenticator in each request avoids the lock module having to remember the authenticator, as it is provided with each request addressed to the lock module. In particular, when the generation of a new secret key is required (e.g., for security reasons), requests addressed to the lock module will include the authenticator encrypted with the cluster secret key currently associated with the lock module.

[0096] During the setup procedure, after the secret key is sent, other parameters are transferred from the remote distribution server to the locking module, such as the disconnection timeout 258 and the cluster broadcast table 272. This may be done via a request that includes the authenticator. The disconnection timeout is configured on the remote distribution server prior to setup and may be set between 30 seconds and 30 minutes, with 5 minutes being a typical maximum. If necessary, the disconnection timeout may be changed later via instructions sent by the remote distribution server to the locking module via the mobile device.

[0097] Figure 5 shows an embodiment of the present invention for validation of a request from a mobile module by a lock module. Each time a mobile device sends a request to the lock module of a parcel locker, the following steps are applied to secure communication with the lock module and access to the parcel locker compartments. This process applies in particular in the case of a request from a mobile device to establish communication with the lock module.

[0098] Once the registration of the lock module is complete, any request from the mobile device to the lock module shall be preceded by the mobile device logging into the remote delivery system to request and receive at least one authenticator to establish short-range wireless communication with the lock module. A request including an authenticator 300, preferably encrypted with a cluster secret key 136i that uniquely corresponds to the lock module, is sent by the mobile device to the lock module (step 510). The request is associated with a function (or group of functions) supported by the lock module, and once the request is verified, the function (or group of functions) is executed by the lock module. Preferably, the request corresponds to only one function, to minimize the complexity of the code in the lock module or to minimize the size of the request. However, depending on the carrier process and the configuration of the parcel locker system, it may be necessary to group several functions in a request to minimize the number of exchanges. The authenticator includes a compartment index 310, a privilege mask 312 that defines the user rights on the lock module, an expiration date 314, and a unique authenticator identification 316. In step 512, the lock module decrypts the authenticator with a secret key 254 that matches the cluster secret key used by the remote delivery system to encrypt the authenticator. A positive check of this decryption is the first step to allow the request (step 514). This first check is preferably performed by verifying the format and content of the decrypted authenticator. By such a method, a minimum size of the authenticator and the request is guaranteed. Alternatively, this first check can be performed by identifying a cryptographic salt included in the encrypted authenticator, or by comparing a signature, such as a hash, attached to the authenticator with a signature calculated based on the authenticator decrypted by a cryptographic algorithm installed in the lock module and installed on the remote delivery server, corresponding to the cryptographic algorithm that encrypted the hash attached to the authenticator. However, these methods result in a larger size of the request.In case of a negative check of the decryption, the locking module returns a decryption exception message to the mobile device (step 516). Authentication is based on successful decryption of the authenticator using a cluster secret key corresponding to a particular locking module, without the need for a particular verification code to be provided by the mobile device. In step 518, the locking module checks whether the authenticator identification 316 matches an authenticator identification stored in the blacklist 256. In case of a match (i.e., the authenticator is blacklisted), the locking module returns a blacklist exception message to the mobile device (step 520). If the authenticator is not blacklisted, the locking module proceeds to step 522, where the expiration date 314 is checked. If the expiration date has been reached, the authenticator is no longer valid and the locking module returns an expiration exception message to the mobile device (step 524). Otherwise, the locking module proceeds to step 526, where the locking module verifies whether the functionality (or group of functionality) that is the subject of the request is authorized for the user. The locking module identifies the function (or group of functions) that is the subject of the request in the function table 260 and checks whether the function (or group of functions) is permitted by the privilege mask 312. If the function (or group of functions) is not permitted by the privilege mask, the locking module returns a function exclusion message to the mobile device (step 528). Otherwise, the locking module allows the request and proceeds according to the request (step 530). Whenever any of the above exclusions occur, the request is disallowed by the locking module (step 532). The above checks of expiration, blacklist, or privileges may be performed in any order.

[0099] If a new authenticator is required for each request, after completion of the request, the locking module stores the authenticator identification and the associated expiration date of the currently used authenticator in the blacklist. However, in order to minimize the number of generated authenticators, the same authenticator may be used for all requests within the communication session. In this case, the storage of the authenticator identification and the associated expiration date in the blacklist is performed by the locking module following a disconnection request from the mobile device. In case of an unintentional disconnection of the short-range wireless communication between the mobile device and the locking module, after the disconnection timeout 258 is reached, the authenticator identification and the associated expiration date of the latest authenticator used are stored in the blacklist. Preferably, in case of an unintentional disconnection, the mobile device can use the same authenticator to re-establish a connection with the locking module before the disconnection timeout 258 is reached in order to minimize the number of generated authenticators. The countdown to reach the disconnection timeout is started after the latest request received by the locking module, i.e. the countdown is restarted after every verified request received by the locking module.

[0100] In a particular embodiment of the invention, a mobile device may be provided locally next to the parcel locker. This local mobile device may be used by any user to operate the parcel locker. In particular, it may be used by any parcel recipient without any smartphone or any carrier with a malfunctioning mobile device. The local mobile device may also be used by carrier organizations that do not want to temporarily or permanently integrate the MPL application into the mobile device used to deliver parcels. The MPL application is ultimately installed on the local mobile device via download from a remote server at the time of on-site installation of the parcel locker and is instantiated according to the user category when a user logs on to the local mobile device. The local mobile device may be operated in parallel with the aforementioned network of mobile devices or, in some applications, may simply replace the network of mobile devices. In one embodiment, the local mobile device is fixedly mounted on a pedestal next to the parcel locker or on a bracket mounted on a wall next to the parcel locker or directly attached to the compartment cluster of the parcel locker. The local mobile device may be powered in an autonomous manner similar to the lock module. In some applications, the local mobile device may be connected to a local electrical network when it becomes available. However, the bay cluster remains self-contained for easy installation of parcel lockers, easy replacement of bays, and easy upgrade or change of parcel locker configuration in the field. Finally, a local mobile device can operate multiple parcel lockers in the same area. In a preferred embodiment, the local mobile device may be integrated into existing parcel lockers that support short-range communication capabilities.

[0101] The parcel locker system and method of the present invention described above includes parcel lockers that are comprised of autonomous compartment clusters assembled together. However, in another embodiment of the present invention, a single compartment cluster may be used alone in a standalone configuration without being assembled as part of a parcel locker, or a single compartment, i.e., a single compartment cluster including a single compartment, may be used alone in a standalone configuration, as will be readily understood by those skilled in the art. Such a single standalone compartment cluster or a single standalone compartment may be used for home delivery or a single point delivery system. In another embodiment of the present invention, a compartment cluster may also be reduced to a single compartment with its own lock module and assembled as part of a parcel locker, as will be readily understood by those skilled in the art. Such an architecture does not benefit from the cost savings of using a single lock module for multiple compartments assembled in a cluster, but it does provide a more modular and more flexible solution. [Explanation of symbols]

[0102] 10 Electronic Luggage Lockers 20 Long-distance communication networks 25 Remote Delivery System 30i Section 32 Central Control Unit 34 Touchscreen 36 Barcode Reader 38 identification 40 Parcels 42 columns 100 Luggage Lockers 102 Mobile Devices 104 Long-distance communication networks 106 Remote Delivery System 110i Autonomous Partitioned Cluster Section 112j 114 columns 116j hinged door 118j Parcel 120i Communication Lock Module 122i Short Range Wireless Communication 130 Database System 132 Luggage Locker Identification 134i Cluster Identification Information 136i Cluster Secret Key 136i Cluster Status Table 138i Cluster Broadcast Table 140j Parcel Identifier 142j Plot size 144j Parcel Identification Information 150j authentication code 152 Public Key 154 Private key 156 Remote Encryption Module 210 Processor 210A High Energy Processor Module 210B Low Energy Processor Module 210C Very Low Energy Processor Module 212 Volatile Memory 214 Bus 216 Wireless Transceiver Module 218 Antenna 220n Electric lock 221 Power Stage 222n Sensor 223 Sensor input / output port (I / O) 224n Visual Indicators 225 Indicator Input / Output Port (I / O) 226 Lock Interface 228 Power supply 230 Energy Management Module 240 Non-volatile memory 250 Cluster Identification Information 252 Event Limit 252n Partition Index 254 Secret Key 255 Event Table 256 Blacklist 256 encryption module 258 Disconnection Timeout 260 Function Table 270n Authentication Code 272 Cluster Broadcast Table 280 Low Energy Sleep Timer 282 Listening Time Window Timer 300 Authenticator 310 Partition Index 312 Privilege Mask 314 Expiration Date 316 Authenticator Identifier

Claims

1. A method for operating at least one parcel locker (100) comprising at least one autonomous partition cluster (110i) including at least one partition (112j) and including a lock module (120i) via at least one mobile device (102) communicating with a remote delivery system (106) via a long-range communication network (104), the lock module comprising an energy management module (230) and a wireless transceiver module (216) having an antenna (218), the energy management module (230) configured to manage energy mode transitions and enable the at least one autonomous partition cluster to operate in a sleep mode, the method comprising: establishing a communication session between the at least one mobile device and the remote delivery system; periodically issuing, during a sleep mode, a broadcast short message addressed to the at least one mobile device to establish a short-range communication session with the at least one mobile device, by the locking module; receiving, by the at least one mobile device, from the remote distribution system, an authenticator (300) generated by the remote distribution system and provided in encrypted form to the at least one mobile device, the authenticator being used by the at least one mobile device to send a request to the lock module including the authenticator, the authenticator including a partition index (310), a privilege mask (312) defining user rights with respect to the lock module, an expiration date (314), and a unique authenticator identification (316); decrypting the authenticator for automatic verification of the request using a secret key (254) stored in the lock module, where an authentication code is not generated and provided to the lock module for the automatic verification of the request, and where the authentication code is a one-time code that can be used only once by the parcel recipient; and during the sleep mode, the locking module (120i) is partially awakened to broadcast short messages and the wireless transceiver module (216) is activated and controlled by the energy management module (230).

2. 2. The method of claim 1, wherein the authenticator is unique or substantially unique, encrypted with a cluster secret key (136i) associated with the lock module and matching the secret key (254), the cluster secret key being unique and uniquely associated with the lock module.

3. 3. The method according to claim 1 or 2, characterized in that the automatic verification is performed by verifying the format and content of the authenticator following the decryption, or the automatic verification is performed by identifying a cryptographic salt contained in the authenticator, or the automatic verification is performed by comparing a signature attached to the authenticator with a signature calculated by a cryptographic algorithm installed in the lock module based on the authenticator after decryption, the signature being a hash.

4. 4. The method according to claim 1, wherein the request is further verified by checking whether an expiration date (314) of the authenticator has been reached, and if so, the request is not allowed, resulting in a disconnection between the lock module and the at least one mobile device, and wherein the expiration date is calculated based on a validity duration of the authenticator which depends on a user category of the at least one parcel locker, and wherein the validity duration is set manually or defined by a program running in the remote delivery system.

5. validating said request by checking whether an authenticator identification (316) contained in said authenticator matches an identification of another authenticator stored in a blacklist (256); If there is a match, the request is not allowed, resulting in a disconnection between the locking module and the at least one mobile device; storing and associating, by the locking module, the authenticator identity and an expiration date in the blacklist following a disconnection request from the at least one mobile device; storing and associating, by the locking module, the authenticator identification information and an expiration date (314) of the authenticator in the blacklist after a disconnection timeout (258) is reached following an unintentional disconnection of short-range wireless communication between the at least one mobile device and the locking module; deleting the authenticator identification information and the expiration date from the blacklist when the expiration date is reached; reusing the authenticator for all requests within an established short-range communication session between the at least one mobile device and the lock module; storing, by the locking module, the authenticator identity and the expiration date in the blacklist when the at least one mobile device requests a disconnection; In the event of an unintentional disconnection, reusing the authenticator to re-establish a connection with the locking module before the disconnection timeout is reached; The method of any one of claims 1 to 4, further comprising:

6. including in said authenticator a privilege mask (312) generated by said remote delivery system based on the credentials of a user of said at least one parcel locker; validating the request based on the privilege mask that defines capabilities permitted to the user; identifying the function in a function table (260) that is the subject of said request; checking whether the function is permitted by the privilege mask; The method of any one of claims 1 to 5, further comprising:

7. 7. The method of claim 5 or 6, wherein the authenticator identification information is unique and corresponds to a unique randomly generated string, or an incremental number, or a time of generation of the authenticator by the remote delivery system.

8. 8. The method of claim 1, wherein the at least one mobile device is used as part of a network of mobile devices for establishing asynchronous two-way multi-channel communication between the remote delivery system and the at least one autonomous partition cluster of the at least one parcel locker, and when a communication session with a mobile device is permitted by a lock module, requests from other mobile devices are denied, and the at least one mobile device is used as a user interface for operating the at least one partition of the at least one parcel locker, and programs installed on the at least one mobile device for operating the at least one parcel locker are instantiated according to a user category established based on login of a user of the at least one parcel locker.

9. after capturing a first of the broadcasted short messages including a first unique cluster identification (250), requesting the authenticator from the at least one mobile device by the remote delivery system to establish communication with the at least one autonomous partition cluster; identifying, by the remote delivery system, the at least one parcel locker based on the first unique cluster identification (250) received from the at least one mobile device; generating, by the remote distribution system, the authenticator or transmitting the authenticator together with a second unique cluster identification (134i), the authenticator including a partition index, the partition index being associated with the at least one partition; verifying the authenticator received from the at least one mobile device and comparing the second unique cluster identification with the first unique cluster identification (250) stored in the lock module to establish communication or to grant access; The method of any one of claims 1 to 8, further comprising:

10. performing an initial setup via the at least one mobile device; requesting, by said at least one mobile device, a public key (152) from said remote distribution system for secure transmission of said secret key from said lock module to said remote distribution system; generating, by the remote delivery system, the public key and a corresponding private key (154); storing and associating said public key and said private key in a database (130); transmitting, by the remote distribution system, the public key to the at least one mobile device; temporarily storing the public key on the at least one mobile device; receiving, by the at least one mobile device, a short message broadcast from the lock module and establishing a short-range wireless communication; requesting generation of the secret key and transferring the public key to the lock module by the at least one mobile device, the request for generation of the secret key and the transfer of the public key being included in the same request; generating, by the lock module, the secret key, the secret key being randomly generated and replacing, if similar, other secret keys generated by other lock modules upon command from the remote distribution system; storing said secret key in said lock module in encrypted form; encrypting the secret key with the public key; transmitting said secret key in encrypted form to said at least one mobile device; transmitting, by the at least one mobile device, the secret key in encrypted form to the remote delivery system; decrypting, by the remote delivery system, the secret key with the private key; storing said secret key in encrypted form in said database of said remote distribution system as a cluster secret key (136i); uniquely associating said secret key with said lock module in said database; 10. The method of any one of claims 1 to 9, comprising:

11. receiving, by the at least one mobile device, from the remote delivery system an authentication code (270n) generated by the remote delivery system when a parcel is due for deposit in the at least one compartment, and transmitting the authentication code to the at least one autonomous partition cluster such that a parcel recipient without a mobile device may retrieve the parcel by entering the authentication code via a lock interface (230), wherein the authentication code is unique and uniquely associated with the parcel's unique parcel identification information (144j), and wherein the authentication code is a one-time code that may be used only once by the parcel recipient; after the parcel has been identified for deposit, requesting, by the at least one mobile device, the authentication code upon deposit of the parcel; generating said authentication code; communicating, by the remote delivery system, the authentication code to the at least one mobile device for temporary storage before or when a carrier schedules a daily delivery to the at least one parcel locker; The method of any one of claims 1 to 10, further comprising:

12. 1. An electronic locker system for depositing and receiving parcels, comprising: A remote delivery system (106); at least one mobile device (102) in communication with the remote delivery system via a long distance communication network (104); at least one parcel locker (100) including at least one compartment (112j) with a door (116j) and configured with at least one autonomous compartment cluster (110i) including a lock module (120i), said lock module (120i) electronically controlling the locking and unlocking of said door and communicating locally with said at least one mobile device via short-range communication (122i); wherein the lock module comprises: an energy management module (230) configured to manage energy mode transitions and enable the at least one autonomous partition cluster to operate in a sleep mode; a wireless transceiver module (216) having an antenna (218); at least one processor (210; 210A, 210B, 210C) configured to periodically issue a broadcast short message with the wireless transceiver module (216) to the at least one mobile device (102) during the sleep mode to establish a short-range communication session with the at least one mobile device; an encryption module (256) configured to decrypt an authenticator (300) generated and encrypted by the remote delivery system and included in a request sent by the at least one mobile device with a secret key (254) stored in a non-volatile memory (240); and during said sleep mode, said lock module (120i) is partially awakened to broadcast short messages, said wireless transceiver module (216) is activated and controlled by said energy management module (230), and said authenticator includes a compartment index (310), a privilege mask (312) defining user rights with respect to said lock module, an expiration date (314), and a unique authenticator identification (316).

13. 13. The system of claim 12, wherein the locking module is configured to generate the secret key in the encryption module and store the secret key in the non-volatile memory in a unique or substantially unique format, the locking module is configured for automatic verification of the request based on decryption of the authenticator, an authentication code is not generated and provided to the locking module for the automatic verification, and the authentication code is a one-time code that can be used only once by the parcel recipient.

14. 14. The system of claim 12 or 13, wherein the lock module includes a feature table (260) in the non-volatile memory including features available to the at least one autonomous partition cluster and operable by the at least one processor, the authenticator includes a privilege mask (312) identifying features in the feature table that are authorized for operating the at least one autonomous partition cluster, the privilege mask being comprised of a series of bits, one bit in the series of bits corresponding to a feature in the feature table, and a value of the bit indicating whether the feature is authorized or unauthorized, and the remote delivery system is configured to receive and store credentials of a user of the at least one parcel locker, generate the authenticator, and generate the privilege mask based on the credentials.

15. 15. The system of claim 14, wherein the authenticator includes an expiration date (314) limiting a validity duration of the authenticator and an authenticator identification (316) generated by the remote delivery system, and wherein the locking module includes in the non-volatile memory a blacklist (256) including an authenticator identification associated with an expiration date matching the authenticator identification and the expiration date of the authenticator when a disconnection request from the at least one mobile device occurs or a disconnection timeout (258) is reached following an unintended disconnection of short-range wireless communication between the at least one mobile device and the locking module.

16. 16. The system of claim 15, wherein the locking module includes in the non-volatile memory, when the request is validated, a blacklist (256) including an authenticator identification associated with an expiration date that matches the authenticator identification, and the expiration date of the authenticator.

17. 17. The system of claim 12, wherein the encryption module is configured to encrypt the secret key with a public key (152) and to encrypt data with the secret key for transfer to the remote distribution system via the at least one mobile device, the encryption module comprises a symmetric Advanced Encryption Standard (AES) algorithm for generating and managing the secret key, and comprises an RSA2018 asymmetric encryption algorithm or an Elliptic Curve Digital Signature Algorithm (ECDSA) algorithm for decrypting messages with the public key, the remote distribution system includes a cluster secret key (136i) in a database (130) that is associated with the lock module and matches the secret key, and includes a remote encryption module (156), wherein the public key and associated private key (154) are generated by the remote encryption module.

18. 18. The system of claim 17, wherein the broadcasted short message includes a first unique cluster identification (250) associated with the at least one autonomous partition cluster, and the request from the at least one mobile device to establish local communication with the locking module via the short-range communication includes a second unique cluster identification (134i) or includes the authenticator sent together with the second unique cluster identification (134i), and the at least one processor is configured to check for a match between the first unique cluster identification and the second unique cluster identification stored in the locking module.

19. 19. The system of claim 12, wherein the lock module includes a lock interface (226) and an authentication code (270n) uniquely associated with a unique parcel identification (144j) corresponding to a parcel deposited in the at least one compartment, such that a parcel recipient without a mobile device can retrieve the parcel by entering an authentication code via the lock interface (226), and the remote delivery system is configured to generate, store, and transmit the authentication code to the lock module via the at least one mobile device.

20. 20. The system of claim 12, wherein the at least one mobile device is fixedly mounted next to or directly at the at least one parcel locker and connected to a local electrical network, and the at least one processor includes a high energy processor module (210A), a low energy processor module (210B), and an ultra-low energy processor module (210C).

Images