Key security store.

The invention relates to a key security store.

Such a key security store can be seen from the DE-OS 29 02 193 in connection with a security lock. It is understood, however, that the terms "key" and "lock" are not restricted to special formations but are to be understood in the widest sense and include even modern substitute forms such as magnetic cards or other non-mechanical keys and locks fitting them.

Key stores should keep keys ready for use in an ordered and controllable manner. Keys for regular users may be needed as well as those which serve for special purposes such as master keys for fire brigades, police etc. Thus an extensive distribution of keys can be avoided and a continuous monitoring of the keys can be arranged.

In the case of a key store which is more or less easily accessible, the possibility of removal by unauthorized persons must be reliably guarded against. Accordingly, it is an object of the invention to provide a key depot which gives security against unauthorized removal of keys.

The present invention is a key security store for at least one key which is kept in a fitting lock and can be taken out of the lock only in response to a special electrical release signal, the key store comprising an input device for a code signal and an electrical code evaluator in which the code signal is stored internally and after first being used is inaccessible from outside and unalterable and which delivers the release signal after comparison of the code signal fed in with the one stored.

A code signal with a suitable input device such as a digital keyboard, provides convenient and reliable handling possibilities which are available to those who know the code. The code should not be accessible by technical means from the outside or be noted in manufacturer's documents, user lists or the like, otherwise the protection of the code is not ensured and cannot be monitored adequately and protected against passing on. The best possible protection against unauthorized removal thus appears to be provided if the code signal is only stored in the key depot and in the memory of the authorized user and otherwise remains inaccessible from the outside and unalterable after a first use has taken place.

The code signal is preferably produced by the switching on of a random generator, which cannot be influenced, in the key depot on the first use but it may be determined in another non-decodable manner, in the device or be fed in by the authorized person on the first use.

In any case, an output device, for example in the form of a visual display and/or a printing mechanism, may appropriately be provided in order to make the code signal recognisable on the first use. Since a later output of the code signal is out of the question, it is up to the user alone to keep the code signal secret.

On the first use, use may appropriately be made of an electrical key monitoring means which delivers a reliable identification and presence signal on the first insertion and enclosure of a security key in a suitable lock. The first appearance of this signal then releases the storage and/or output of the code signal. It is understood that a first use can also be effected in that a key already previously kept in the lock is removed for the first time or that a first-use signal is fed into the code evaluation in any other manner, for example, through a special key.

The electrical presence signal can further be used to record all key removals if the key store is equipped with a suitable recording device. In addition, it is of interest to record code inputs and signal outputs in order to be able to reconstruct all important operations in the key store if necessary.

As a security against attempts at manipulation, it may appropriately be provided that inputs of wrong codes set off alarms, either with an open alarm which is also perceived by the person causing it or with a silent alarm, for example via a monitoring line to the police, to a monitoring institute or to other persons responsible for the case of alarm. A separate alarm signal may appropriately be provided as an emergency signal in the case where the authorized person is forced to obtain the key. For this case, an emergency code signal may appropriately be provided which, in order to facilitate identification for example, is derived from the code signal, e.g. as a reversal of the sequence of a digital code signal. Also other permutations of a digital sequence or the replacement of individual digits by special emergency signal digits may be suitable to provide an emergency signal which is constantly present. The code evaluation can be adapted to this for monitoring by means familiar to the expert. The emergency signal is then generally only passed on, as a hidden signal, to receivers provided for the purpose.

An embodiment of the present invention will now be described, by way of example, with reference to the accompanying drawing, the single figure of which is a flow diagram for the commissioning and the regular use of a key security store.

The key store according to the embodiment is to be understood from the structural point of view as a wall cabinet or wall safe with a service panel in which a plurality (N) of lock cylinders for security keys are countersunk as far as their end face as when installed in doors. Below the lock cylinders arranged in a raster field, the service panel comprises an input device with a digital keyboard and disposed further up is an output device with an electronical digital display on a digital printing mechanism.

The lock cylinders are such as are also used for doors and with which the insertion and removal of the key is possible in a position usually provided with a vertical insertion slot which is hereinafter called the "removal position" while another position turned through 90° does not permit any removal of the inserted and turned key and will be designated as the "locking position".

Acting on each of the lock cylinders is an electromagnetically actuated key bolt so that the lock cylinder with the key can only be turned back out of the locking position into the removal position when the key-bolt sets this movement free.

Each lock cylinder is further equipped with a key monitoring means which here consists, in a particularly simple manner, of an electric contact which closes on the changeover of the lock cylinder from the removal position to the locking position. This leads to a position monitoring for the lock cylinder which, with the reliable mechanical identification of the key by the lock cylinder, ultimately also represents a key monitoring means.

The parts described above are connected to an electrical code evaluation which is in a position to check a code signal coming in from the input device and to give out a release signal to the electromagnetic key-bolt of the lock cylinder in question. In the course of this, the key monitoring means delivers additional signals, the evaluation of which will be returned to later.

The taking into use, particularly the first use, is of particular importance for the security of the key depot. With this, the code signal is fixed and from then on remains stored inaccessible and unalterable. In order to secure against unauthorized access to the electrical part of the key depot, this is not only disposed in a closed and bricked up portion of the depot, but also reinforcements are provided as for safes, the walls being secured by additional electrical burglary monitoring means.

In order to commission the store (after assembly and installation) a start signal (see flow diagram) is fed in which may be effected via the digital keyboard and then leads to a system message to indicate readiness for operation. Then a further input may be made to generate the system, after which the determination of the code signals is effected.

Here an initial condition for the first use is that all the keys are taken out. If a key is now inserted by its owner in the associated lock cylinder and turned from the removal position into the locking position, then a report signal for the key placing goes to the code evaluation. This has a code generator with a random control which does not need to concern all the digits of the code but nevertheless contains so many freedoms of choice that the random chance of an unauthorized third party hitting on the code signal by experiment is extremely small. The code signal thus produced by the code generator is conveyed to the output device where it is indicated and printed out so that the user receives a data card with which he can impress the code reliably on his mind at the beginning. At the same time, the code is also stored in the code evaluation. After that, the code signal is cleared both in the code generator and in the output device so as to exclude any unauthorized access.

It is understood that during use, only one key code at a time, that is to say one code signal for the particular key inserted for the first time is given out. The operation is repeated as soon as another key is inserted and turned for the first time.

The removal of the key fixed in the locking position is only possible on input of the code signal via the input device. The electrical code evaluation compares the signal fed in with the stored code signal and delivers a release signal to the electromagnetic key-bolt, after which the key can be turned into the release position and removed. After the removal of the key, the key-bolt, which is constructed in the form of a spring catch, is brought into its locking position so that, when the key is returned, after insertion and turning, the key engages behind the key-bolt and is locked. A non self-locking key-bolt would have to be controlled electrically to return to its locking position on the key delivery, as soon as the key is turned.

The code evaluation is effected with simultaneous recording of the operations in a time record, for which purpose these operations are stored with appropriate identification means and the associated time of day, as noted in the flow diagram under "time record". The time record also records the signals delivered by the electrical key monitoring means so that the use of the key can be reproduced. The recording medium is accessible without intervention in the screening of the code evaluation.

The time record presupposes a clock or the like timer with which additional security means can also be provided, for example in that at certain times certain keys are all locked against removal, for example if the use of a key only comes into question at general working hours or only outside working hours, and these working hours are programmed in for a long time in advance in an unalterable manner in order to make manipulation more difficult.

In case an incorrect code signal is fed in, an alarm output is provided. Thus if the code evaluation detects a wrong signal input (which in any case is recorded), it sets off an alarm. Furthermore, the output of an emergency signal on the input of an altered code signal is possible in the case where the authorized user of the key is forced to remove the key. In such cases, no general alarm is usually indicated but a very special, secret signal as a "kidnap alarm" at a competent place. The emergency code signal may appropriately consist of a modification or an amplification of the code signal. In the present case, it is provided that the sequence of digits in the code signal is fed in backwards. During the code checking in the evaluation, the checking is first effected independently of direction so that even an input of the code in the backwards direction does not set off any general alarm. A following direction check, however, leads to a "kidnap alarm" in addition to the release of the key in the event of a code fed in backwards.

This alarm possibility serves to protect the authorized person who, with sole knowledge of the code, has a particularly responsible position which may also be more dangerous.