WO2009010637A1

WO2009010637A1 - Electromechanical lock and key

Info

Publication number: WO2009010637A1
Application number: PCT/FI2008/050434
Authority: WO
Inventors: Seppo Lohiniva; Mika Pukari
Original assignee: Iloq Oy
Priority date: 2007-07-18
Filing date: 2008-07-16
Publication date: 2009-01-22
Also published as: EP2017794A1

Abstract

An electromechanical lock is provided. The lock comprises a validation input (114) configured to have two or more states and an electronic circuit (112) configured to read access data from an external source (100); read the state of the validation input (114), determine validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; and issue an open command provided that the access data matches a predetermined criterion; and the validation data matches the state of the validation input provided such a match was required. The lock further comprises an actuator (110) to receive the open command and to set the lock in a mechanically openable state.

Description

Electromechanical lock and key

Field

The invention relates to electromechanical locks.

Background Various types of electromechanical locks are replacing the traditional mechanical locks. Electromechanical locks require an external supply of electric power, a battery inside the lock, a battery inside the key, or means for generating electric power within the lock making the lock user- powered. Electromechanical locks provide many benefits over traditional locks. They provide better security and the control of the keys or security tokens is easier.

In addition, most electromechanical locks and/or keys and tokens are programmable. It is possible to program the lock to accept different keys and decline others. One problem associated with electromechanical locks is the burdensome programming of locks for different keys, especially when some keys are only used in certain situations.

Brief description

According to an aspect of the present invention, there is provided an electromechanical lock comprising: a validation input configured to have two or more states; an electronic circuit configured to read access data from an external source; to read the state of the validation input, to determine validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; and to issue an open command provided that the access data matches a predetermined criterion; and the validation data matches the state of the validation input provided such a match was required; and an actuator to receive the open command, and to set the lock in a mechanically openable state. According to another aspect of the present invention, there is provided a key for an electromechanical lock, comprising: an electronic circuit configured to store access data with validation data indicating access groups the key belongs to and the access groups which require checking the state of the validation switch; and a contact arrangement to communicate with the electromechanical lock.

According to another aspect of the present invention, there is provided a method for operating an electromechanical lock, comprising: reading access data from an external source; reading the state of a validation input; determining validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; matching the access data against a predetermined criterion; and the validation data against the state of the validation input provided such a match was required; issuing an open command a match or matches are found; setting the lock in a mechanically openable state in response to the open command.

According to another aspect of the present invention, there is provided an electromechanical lock comprising: input means configured to have two or more states; means for reading access data and validation data from an external source; means for reading the state of the input means, means for determining validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; and means for issuing an open command provided that the access data matches a predetermined criterion; and the validation data matches the state of the input means provided such a match was required; and means for receiving the open command, and setting the lock in a mechanically openable state.

The invention has several advantages. The proposed solution minimizes the need to change lock data. In varying situations, necessary changes can be made to key data. The usage of a validation input provides conditional access which does not require lock reprogramming.

Embodiments of the invention may be applied to electromechanical locks having an external power supply, a battery inside the lock or the key or user-powered electromechanical locks.

List of drawings

Embodiments of the present invention are described below, by way of example only, with reference to the accompanying drawings, in which Figure 1 illustrates an example of a user-powered electromechanical lock; Figures 2 and 3 illustrate examples of battery-powered electromechanical locks;

Figures 4A and 4B illustrate examples of the realization of a validation input; Figures 5A and 5B illustrate embodiments of the invention;

Figure 6 is a flowchart illustrating an embodiment;

Figures 7A, 7B, and 7C illustrate examples of different embodiments; and

Figures 8A and 8B illustrate other examples of different embodiments.

Description of embodiments

The following embodiments are exemplary. Although the specification may refer to "an", "one", or "some" embodiment(s) in several places, this does not necessarily mean that each such reference is made to the same embodiment(s), or that the feature only applies to a single embodiment. Features of different embodiments may also be combined to provide other embodiments.

With reference to Figure 1 , an example of the structure of an electromechanical lock 106 is explained. The lock 106 comprises an electronic circuit 112 configured to read access data from an external source 100, and match the data against a predetermined criterion. The electronic circuit 112 may be implemented as one or more integrated circuits, such as application- specific integrated circuits ASICs. Other embodiments are also feasible, such as a circuit built of separate logic components, or a processor with its software. A hybrid of these different embodiments is also feasible. When selecting the method of implementation, a person skilled in the art will consider the requirements set on the power consumption of the device, production costs, and production volumes, for example. The external source 100 may be an electronic circuit configured to store the data. The electronic circuit may be an iButton® (www.ibutton.com) of Maxim Integrated Products, for example; such an electronic circuit may be read with 1-Wire® protocol. The electronic circuit may be placed in a key or a token, for example, but it may be positioned also in another suitable device or object. The only requirement is that the electronic circuit 112 may read the data from the electronic circuit. The data transfer from the electronic circuit to the electronic circuit 112 may be performed with any suitable wired or wireless communication technique. In user-powered locks, produced energy amount may limit the used techniques. Magnetic stripe technology or smart card technology may also be used as the external source. Wireless technologies may include RFID (Radio-frequency identification) technology, or mobile phone technology, for example. The external source may be a transponder, an RF tag, or any other suitable memory type capable of storing data.

The data read from the external source is used for authentication by matching the data against the predetermined criterion. The authentication may be performed with SHA-1 (Secure Hash Algorithm) function, designed by the National Security Agency (NSA). In SHA-1 , a condensed digital representation (known as a message digest) is computed from a given input data sequence (known as the message). The message digest is to a high degree of probability unique for the message. SHA-1 is called "secure" because, for a given algorithm, it is computationally infeasible to find a message that corresponds to a given message digest, or to find two different messages that produce the same message digest. Any change to a message will, with a very high probability, result in a different message digest. If security needs to be increased, other hash functions (SHA-224, SHA-256, SHA-384 and SHA-512) in the SHA family, each with longer digests, collectively known as SHA-2 may be used. Naturally, any suitable authentication technique may be used to authenticate the data read from the external source. The selection of the authentication technique depends on the desired security level of the lock 106 and possibly also on the permitted consumption of electricity for the authentication (especially in user-powered electromechanical locks).

Figure 1 shows an external source such as a key 100 comprising an electronic circuit 102 connected to a contact arrangement 104 and a key frame. The electronic circuit 102 may comprise a memory unit. The electromechanical lock 106 of Figure 1 is a user-powered lock. The lock 106 comprises power transmission mechanics 120 which transforms mechanic energy from a user to an electric generator 108 powering the electronic circuit 112 when the key 100 is inserted into the lock 106. In this example, the electronic circuit 112 is configured to communicate with the electronic circuit 102 of the key through a contact arrangement 116 and the contact arrangement 104 of the key. The communication may be realized as a wireless connection or by physical conductivity. The lock of Figure 1 further comprises a validation input 114. In this example, the input is realized with a switch configured to have two states, '0' and "T. The switch may be realized with a push button, a level switch or a rotating switch. Also other realizations are possible as one skilled in the art is well aware.

The electronic circuit 112 is configured to read access data from the electronic circuit 102 of the key 100 upon the key insertion and read the state of the validation input 114. The electronic circuit 112 is further configured to determine validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation switch state is required, and to issue an open command provided that the access data matches a predetermined criterion and the validation data matches the state of the validation switch provided such a match was required. The predetermined criterion may be stored in the electronic circuit as will be explained later.

The lock of Figure 1 further comprises an actuator 110 configured to receive the open command, and to set the lock in a mechanically openable state. The actuator may be powered by the electric power produced with the generator 108. The actuator 110 may be set to the locked state mechanically, but a detailed discussion thereon is not necessary to illuminate the present embodiments.

When the actuator 110 has set the lock in a mechanically openable state a bolt mechanism 118 can be moved by rotating the key 100, for example. The mechanical power required may also be produced by the user by turning a handle or a knob of a door (not shown in Figure 1 ). Other suitable turning mechanisms may be used as well.

The electronic circuit 112 may be configured to recognize the following states: the lock is in the mechanically openable state; the lock is closed and the data read from the key does not match the predetermined criterion; and the lock is closed and there is not enough electric energy to read the data from the key and to check the match of the data by the electronic circuit or to place the lock in the mechanically openable state by the actuator.

The electronic circuit 112 may be configured to provide a signal for the key 100 if the open command is not issued because the data does not match the predetermined criterion, so that the key 100 may inform the user that the data did not match the predetermined criterion. As a further improvement, the electronic circuit 112 may be configured to provide electric power for the key 100. An advantage of this is that the key 100 may inform the user with the electric power received from the electronic circuit 112. The key 112 may inform the user with a visual or an audio indicator, for example. Figure 2 illustrates another example of the structure of an electromechanical lock 106. In this example, the lock 106 comprises a battery 200 which provides the electric power required for the operation of the lock. The battery provides power for the electronic circuit 112 and the actuator 110. In addition, the battery 200 provides electric power for the electronic circuit 102 of the key through the contact arrangement 116 of the lock and the contact arrangement 104 of the key. In this embodiment, the power transmission mechanics 120 and the electric generator 108 of Figure 1 are not required.

Figure 3 illustrates another example of the structure of an electromechanical lock 106. In this example, the key 100 comprises a battery 300 which provides the electric power required for the operation of the key and the lock. The battery 300 provides power for the electronic circuit 102 of the key. In addition, the battery 300 provides power for the electronic circuit 112 and the actuator 110 of the lock through the contact arrangement 116 of the lock and the contact arrangement 104 of the key. In this embodiment, the power transmission mechanics 120 and the electric generator 108 of Figure 1 are not required.

Figures 4A and 4B illustrate examples of the realization of the validation input. In Figures 1 , 2 and 3 the validation input was realized with a simple two-state switching arrangement. Figure 4A illustrates an example where three switches are used. The signals S1 , S2, S3 and COM may be connected to the electronic circuit 112. The signals are active when contacts S1 , S2, S3 are closed to COM. The amount and type of switches may vary.

Figure 4B illustrates an example where control signals 1 and 2 are connected to lock input signals S1 and S2 through relays 400, 402. In this embodiment, key validation may be controlled by an external control system, such as a clock, an alarm system, an access control system, or a building automation system.

Figure 5A illustrates an example of an embodiment. The figure illustrates an example of data stored in the electronic circuit 102 of an external device or a key 100 and in the electronic circuit 112 of the electromechanical lock. The key and the electronic circuit 112 communicate through contact arrangements 104 and 116.

In an embodiment, the electronic circuit 102 of key 100 stores a data structure 500 comprising a key ID or key identification 504 and an access group data with a validation data 506. In addition, the key may store a security hash operation SHA-1 data 502. The access group data comprises one or more access groups the key belongs to. In the example of Figure 5A, the key 102 belongs to four access groups, A, B, C, and D.

In an embodiment, a key may open a lock if it belongs to an access group to which an access is allowed or if the key has a key identification ID to which an access is allowed.

Each key has a unique identification ID 504 which may be used to identify the key.

With the access groups, the organization of keys is greatly enhanced. A key may be provided with several access groups to allow access to different locations. For example, the same key may provide access to an apartment (access group 1 ), a cellar (access group 2), a garage (access group 3), and a waste bin shelter (access group 4). A user may then provide a waste management company with a key comprising only the access group 4. Thus, the company may be provided an access to the waste bin shelter but the key does not authorize access to other parts of the building.

Each access group may be attached with validation data. The validation data comprises information whether the state of the validation input 114 of the electromechanical lock 106 is to be checked when determining whether a key is allowed to open a lock.

The validation data may also comprise information about what is the desired state of the validation input. In the simplest case, the validation data may be expressed with one bit, having a value 'on' or 'off'. The value 'off' indicates that the state of the validation input is not to be checked. The value 'on' indicates that the state of the validation input is to be checked and it should be 'on'. When the validation input comprises more than two possible states, the validation data may indicate the desired value. Also in this case, the value 'off' or '0' may indicate that the state of the validation input is not to be checked. Any other value may indicate that the state should be checked and it should match the value indicated by the validation data. In the example of Figure 5A, access groups A and D require checking the state of the validation input. Access groups B and C do not require such a check.

In an embodiment, the electronic circuit 112 of the electro- mechanical lock 106 comprises a memory comprising fields 516, 518, 520 and 524. The memory stores access group data 524, access identification data 516, blacklist data 518 and access log data 520. In addition, the circuit may store SHA-1 operation data 512, and validation input data 510. The electronic circuit 112 may comprise control logic 508 connected to the memory and to the contact arrangement 116. The control logic 508 performs communication between the lock and the key and performs required data processing. The control logic may issue an open command to the actuator 110.

The access group data 524 contains the access groups to which the lock allows access. In this example, the electronic circuit 112 is configured to open the lock for keys belonging to access groups A, C, G, H and F provided that other required conditions match. The access identification data 516 contains the identifications of the keys which may open the lock. Thus, a key with a suitable ID may be used to open a lock even if the key does not belong to any access group. In this example, the electronic circuit 112 is configured to open the lock for keys having identifications 6, 9 and 22.

The blacklist data 518 contains the access groups and key identifications which may not open the lock even if other conditions are fulfilled. The blacklist data may be used to block a key from an otherwise allowed access group. For example, if a user has lost a key, the identification of the lost key may be added to the blacklist data and the key will become useless. In this example, the electronic circuit 112 is configured to block the access for keys having identifications 16, 19 and access group J.

The SHA-1 operation data 512 together with the respective data 502 stored in a key may be used to authenticate the key. The validation input data 510 comprises information on the state of the validation input 114. In this example, the input may have two different values, on and off, or "T and ¹O'. The usage of a validation input provides conditional access which does not require reprogramming of the lock.

For example, a key with an access group to the lock of an apartment may be given to a cleaner who is scheduled to come once a week on a predetermined weekday. The key stores validation data which requires to check the state of the validation input.

The owner of the apartment may switch the validation input to 'on' state only on the predetermined weekdays and at other times let the switch be in 'off' position. When the cleaner arrives and uses the key, the lock reads the access data and validation data from the key. The lock determines that the key has the access group which allows the lock to be opened. However, the lock also reads the validation data of the key and determines that the state of the validation input is to be checked. On the predetermined weekdays the input is in 'on' state and the lock opens. On other weekdays the input is in 'off' state and the lock does not open.

In an embodiment, the validation switch is a simple mechanical switch in the lock. It is easy to use and no reprogramming of the lock is required. In an embodiment, the electronic circuit 112 of the electromechanical lock 106 stores each action to an access log data 520. Thus, each attempt to open the lock may be viewed later. In this example, the access log shows that keys with identifications 3, 9 and 22 have accessed the lock.

Figure 5B illustrates an example of another embodiment. The figure illustrates an example of data stored on the electronic circuit 102 of the external device or the key 100 and on the electronic circuit 112 of the electromechanical lock. The electronic circuit stores access group data 514 which contains the access groups in which the lock may be opened. In this example, the electronic circuit 112 is configured to open the lock for keys belonging to access groups A, C, G, H and F provided that other required conditions are fulfilled.

In this embodiment, the access group data stored on the electronic circuit 112 comprises the validation data for each access group. The access groups A, H and F require checking of the state of the validation input. Access groups C and G do not require such a check. In this embodiment, the access data 522 stored in the key does not comprise validation data. This embodiment gives the possibility to set a validation requirement lock by lock within same access group.

Figure 6 is a flowchart illustrating an embodiment. As default the lock is in a locked state and it remains in the locked state until set to an openable state. The process starts in step 600 when a key 100 is connected to the electronic circuit 1 12 of the lock 106 through contacts 104 and 1 16.

In step 602, the electronic circuit 1 12 authenticates the key using a strong authentication method, for example SHA-1 . If authentication fails, the process is interrupted in step 604 and the lock is kept in a locked state 624.

In step 606, the electronic circuit 1 12 reads access data from the key 102.

In step 608, the data read from the key is checked against a blacklist 518 stored in the lock.

In step 610, the process is interrupted and the lock is kept in a locked state 624 if the key identification or any access groups of the key is found from blacklist data.

In step 612, the state 51 O of the validation input 1 14 is read. In step 614, validation data is determined from the access data and a predetermined criterion, the validation data comprising information whether a check of the validation input state is required.

In step 616, the access data read from the key is compared against the access group data 524 and the access identification data 516. In addition, if validation data required checking the state of the validation input, such a check is made.

In step 618, the process is interrupted if the comparisons fail and the lock is kept in a locked state 624.

In step 620, log data is written to access log data 520. In step 622, the lock is set to an openable state by sending an open signal to the actuator 1 10.

The process ends in 626.

Figures 7A, 7B, 7C, 8A and 8B and illustrate examples of different embodiments. In Figure 7A, a key 102 has data 500 with key identification ID 5 and only one access group, Access A, with validation data indicating that the state of the validation switch must be checked.

In this example, an electronic circuit 1 12 of the lock has several access groups in the access group data 514 including Access A. A key ID 5 is not included in the access ID list 516. Neither ID 5 nor Access A is found in the blacklist data 518. The validation switch 1 14 is turned off and therefore the validation status 510 is false. The control logic 508 of the electronic circuit 1 12 determines that the key does not have access because the process is interrupted due to the wrong state of the validation input. When the validation switch 1 14 is turned on, the key will have access.

Fig 7B illustrates another example where a key 102 has data 500 with key identification ID 5 and only one access group, Access B, with validation data indicating that the state of the validation switch need not be checked.

In this example, an electronic circuit 1 12 of the lock has several access groups in the access group data 514 including Access B. A key ID 5 is not included in the access ID list 516. Neither ID 5 nor Access B is found in the blacklist data 518. The validation switch 1 14 is turned off and therefore the validation status 510 is false. However, the control logic 508 of the electronic circuit 1 12 determines that the key does have access despite the validation status 510 because Access B does not require validation. Fig 7C illustrates another example where a key 102 has data 500 with key identification ID 5 and two access groups, Access A with validation requirement and Access B without validation requirement.

In this example, an electronic circuit 1 12 of the lock has several access groups in the access group data 514 including Access A and Access B. A key ID 5 is not included in the access ID list 516. Neither ID 5 nor Access B is found in the blacklist data 518. The validation switch 1 14 is turned off and therefore the validation status 510 is false. However, the control logic 508 of the electronic circuit 1 12 determines that the key does have access despite the validation status 510 because Access B does not require validation. Fig 8A illustrates an example where a key 102 has data 500 with key identification ID 5 and one access group, Access A.

An electronic circuit 1 12 of the lock has in the access group data 524 an access group Access A with validation data indicating that the state of the validation switch must be checked. A key ID 5 is not included in the access ID list 516. Neither ID 5 nor Access B is found in the blacklist data 518. Validation switch 1 14 is turned off and therefore the validation status 510 is false. The control logic 508 of the electronic circuit 1 12 determines that the key does not have access because the process is interrupted due to the wrong state of the validation input. When the validation switch 1 14 is turned on, the key will have access. Fig 8B illustrates an example where a key 102 has data 500 with key identification ID 5 and one access group, Access A.

In this example, an electronic circuit 112 of the lock has in the access group data 524 an access group Access A with validation data indicating that the state of the validation switch need not be checked. A key ID

5 is not included in the access ID list 516. Neither ID 5 nor Access B is found in the blacklist data 518. Validation switch 114 is turned off and therefore the validation status 510 is false. However, the control logic 508 of the electronic circuit 112 determines that the key does have access despite the validation status 510 because Access A does not require validation.

The steps and related functions described above are in no absolute chronological order, and some of the steps may be performed simultaneously or in an order differing from the given one. Other functions can also be executed between the steps or within the steps. Some of the steps or part of the steps can also be left out or replaced by a corresponding step or part of the step.

It will be obvious to a person skilled in the art that, as technology advances, the inventive concept can be implemented in various ways. The invention and its embodiments are not limited to the examples described above but may vary within the scope of the claims.

Claims

1. An electromechanical lock comprising: a validation input (114) configured to have two or more states; an electronic circuit (112) configured to read access data from an external source (100); to read the state of the validation input (114), to determine validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; and to issue an open command provided that the access data matches a predetermined criterion; and the validation data matches the state of the validation input provided such a match was required; and an actuator (110) to receive the open command, and to set the lock in a mechanically openable state.

2. The electromechanical lock of claim 1 , comprising a validation switching arrangement (1 14) mechanically switchable between two or more states.

3. The electromechanical lock of any preceding claim, wherein the electronic circuit (1 12) comprises a memory for storing data.

4. The electromechanical lock of claim 3, wherein the memory is configured to store data on access groups and access identifications to which the opening of the lock is allowed.

5. The electromechanical lock of claim 3, wherein the memory is configured to store data on access groups and access identifications to which the opening of the lock is disallowed.

6. The electromechanical lock of any one of the preceding claims, wherein the lock comprises a contact arrangement (116) to communicate with an external source.

7. The electromechanical lock of any one of the preceding claims, wherein the contact arrangement (116) is configured to be in a wireless connection with the external source.

8. The electromechanical lock of any one of the preceding claims, wherein the memory is configured to store data regarding which access groups and access identifications require checking the state of the validation switch.

9. The electromechanical lock of any one of the preceding claims, comprising an electric generator (108) configured to generate electric power from mechanical power.

10. The electromechanical lock of any one of the preceding claims 1 to 7, comprising a battery (202).

11. The electromechanical lock of any one of the preceding claims 1 to 7, comprising a contact arrangement (116) to receive electric power from an external source.

12. The electromechanical lock of any one of the preceding claims, wherein the validation switching arrangement (1 14) comprises one or more push buttons, one or more level switches or a rotating switch.

13. The electromechanical lock of any one of the preceding claims, wherein the validation switch (1 14) comprises one or more relays with control inputs.

14. The electromechanical lock of any preceding claim, wherein the validation data comprises information about the desired state of the validation input (1 14).

15. A key for an electromechanical lock, comprising: an electronic circuit (102) configured to store access data with validation data indicating access groups the key belongs to and the access groups which require checking the state of the validation switch; and a contact arrangement (104) to communicate with the electromechanical lock.

16. The key of claim 15, comprising a battery (300).

17. The key of claims 15 or 16, wherein the contact arrangement (104) is configured to transfer electric power to the electromechanical lock.

18. The key of claims 15 or 16, wherein the contact arrangement (104) is configured to be in a wireless connection with the electromechanical lock.

19. A method for operating an electromechanical lock, comprising: reading access data from an external source (100); reading the state of a validation input (114); determining validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; matching the access data against a predetermined criterion; and the validation data against the state of the validation input provided such a match was required; issuing an open command if a match or matches are found; setting the lock in a mechanically openable state in response to the open command.

20. An electromechanical lock comprising: input means (114) configured to have two or more states; means for reading access data and validation data from an external source (100); means for reading the state of the input means (114), means for determining validation data from the access data and a predetermined criterion, the validation data comprising information whether checking the validation input state is required; and means for issuing an open command provided that the access data matches a predetermined criterion; and the validation data matches the state of the input means provided such a match was required; and means for receiving the open command, and setting the lock in a mechanically openable state.