Method and arrangement for controlling access

FIELD

[0001] The invention relates to a method and an arrangement for controlling access in locations wherein access is restricted by a lock mechanism.

BACKGROUND

[0002] In order to access locked premises, such as home or work, keys or key cards, for example, are still required for unlocking locks. For safety reasons, it is also increasingly common that people lock the doors and gates to backyards, housing sites or commercial buildings. This can be problematic when, for example, persons should have access to locked premises to which they do not have physical keys. Such a situation may occur when, for example, a resident is away from home and somebody, e.g. a cleaning service worker or a plumber, should have access to the locked premises. Such situations have usually been solved e.g. using master keys, hiding keys or, in the case of an electronic lock, for example, using ad hoc key codes.

[0003] Handing over conventional keys or cards to outsiders does, however, involve an increased safety risk. Keys may easily be lost, which means that the locks would have to be changed. Furthermore, even if e.g. a serviceman had a key, the key could be used for only as long as a corresponding lock is in use. It is also difficult to deliver extra keys e.g. to persons who only visit locked premises once, such as chimney sweepers. The use of electronic key codes is also problematic. Key codes are difficult to remember, and such codes require separate procedures in order to be activated. Furthermore, situations occur daily wherein somebody who has been authorized to conduct a task has not informed anybody about his or her visit in advance, so it has thus not been even possible to deliver a key or a code to such a person in advance. Furthermore, taking safety aspects into account considerably complicates the cooperation between people. For example, handing over a key code on the telephone to somebody asking for access would of course be possible, but the provider of the code would then immediately have to have the codes changed so as to prevent the particular person from using the same code later and entering the locked premises or from forwarding the code. A situation wherein access to locked premises is directly remotely controllable through a remote-controllable locking system, for example, would also involve a safety problem; in such a case, the remotely-situated controller of the locking system could not be sure of the identity of the person who wishes to be let in, nor whether it would be safe to grant access to such a person.

BRIEF DESCRIPTION

[0004] An object of the invention is thus to provide a method and an arrangement so as to avoid the above-mentioned problems. This is achieved by a method for controlling access in a telecommunication system comprising a first transmitter-receiver unit, a second transmitter-receiver unit and a remote-controllable server. The method of the invention comprises establishing a telecommunication connection from the first transmitter-receiver unit to the remote-controllable server; transmitting an electric form from the first transmitter-receiver unit to the remote-controllable server in order to unlock a lock, the form including a digital signature and a certificate indicating the authenticity of a user of the first transmitter-receiver unit; transmitting a message from the remote-controllable server to the second transmitter-receiver unit to indicate that the electric form has been received, the message including the certificate indicating the authenticity of the user of the first transmitter-receiver unit; transmitting a command to unlock the lock from the second transmitter-receiver unit to the remote-controllable server, and unlocking at least one lock by means of the remote-controllable server on the basis of the command to unlock the lock transmitted by the second transmitter-receiver unit.

[0005] The invention further relates to an arrangement for controlling access, the arrangement comprising a first transmitter-receiver unit which includes means for establishing a telecommunication connection, means for supporting a public key infrastructure; a second transmitter-receiver unit which includes means for supporting a public key infrastructure, means for establishing a telecommunication connection; a remote-controllable server to be used as a communications device between the first and the second transmitter-receiver unit, the remote-controllable server including means for establishing telecommunication connections and means for unlocking a lock. In the arrangement of the invention, the first transmitter-receiver unit is configured to transmit an electric form to the remote-controllable server in order to unlock the lock, the electronic form including a digital signature and a certificate indicating the authenticity of a user of the first transmitter-receiver unit; the remote-controllable server is configured to transmit a message from the remote-controllable server to the first transmitter-receiver unit to indicate that the electric form has been received, the message including the certificate indicating the authenticity of the user of the first transmitter-receiver unit, and to unlock the lock on the basis of the command to unlock the lock transmitted by the second transmitter-receiver unit; the second transmitter-receiver unit is configured to transmit the command to unlock the lock to the remote-controllable server.

[0006] Preferred embodiments of the invention are disclosed in the dependent claims.

[0007] The method and arrangement of the invention provide several advantages. One of the advantages of the invention is that the authenticity of a person asking for access is indicated by including a certificate granted by a certificate authority in the communication of an arrangement comprising mobile stations and a locking system operating therebetween. The solution of the invention thus provides a safe and easy-to-use way to ensure that access to locked premises will be granted to reliable persons only. Another advantage of the invention is, for example, that no keys or codes need to be delivered to persons external to the system in connection with one-time visits to locked premises.

LIST OF DRAWINGS

P-0008[0008] The invention is now described in closer detail in connection with the preferred embodiments and with reference to the accompanying drawings, in which

P-0009[0009]FIG. 1 is a diagram illustrating the structure of a telecommunication system according to the invention,

P-0010[0010]FIG. 2 is a diagram showing an arrangement according to the invention for controlling access,

P-0011[0011]FIG. 3 is a flow diagram illustrating a method of the invention.

DESCRIPTION OF EMBODIMENTS

P-0012[0012] The preferred embodiments of the invention can be applied to telecommunication systems that include a remote-controllable server, one or more base transceiver stations and a plurality of terminals communicating with one or more base transceiver stations. The essential parts of the structure of the telecommunication system may resemble those shown in FIG. 1. The telecommunication system comprises a base transceiver station <b>100</b> and a plurality of transmitter-receiver units <b>102</b>, <b>106</b> having a duplex connection <b>110</b>, <b>116</b> to the base transceiver station <b>100</b>. The base transceiver station <b>100</b> transmits the connections of the transmitter-receiver units <b>102</b>, <b>106</b> to a base station controller <b>101</b>, which forwards the connections to other parts of the system and to a fixed network. The base station controller <b>101</b> controls the operation of one or more base transceiver stations. The telecommunication system further includes a remote-controllable server <b>104</b> having a duplex connection <b>108</b>, <b>112</b>, <b>114</b> to the transmitter-receiver units <b>102</b>, <b>106</b> and to the base transceiver station <b>100</b>.

P-0013[0013]FIG. 2 shows an arrangement according to an embodiment of the invention for controlling access. FIG. 2 shows a first transmitter-receiver unit <b>102</b>, a second transmitter-receiver unit <b>106</b> and a remote-controllable server <b>104</b>. The transmitter-receiver units <b>102</b>, <b>106</b> and the remote-controllable server <b>104</b> share a duplex telecommunication connection <b>108</b>, <b>114</b>. The arrangement of FIG. 2 further comprises a certificate authority <b>119</b> having a duplex connection <b>118</b> with the second transmitter-receiver unit <b>106</b>.

P-0014[0014] Today, various methods are known which enable the mutual trust of different parties that communicate in telecommunication systems to be improved. One such method is a so-called Public Key Infrastructure (PKI), which enables a safe way of communicating in a public network, such as the Internet. The PKI enables the mutual trust between communicating parties to be enhanced by means of trusted third parties. In practice, this is implemented using a Public Key Cryptography (PKC), digital signatures and certificates that tie the public keys to the communicating parties. Certificate Authorities (CA), which grant digital certificates and confirm the authenticity of the certificates to be used, serve as Trusted Third Parties (TTP).

P-0015[0015] The creation of digital signatures utilizes private keys and asymmetric encryption algorithms known per se. The certificates, in turn, tie the name to a public key, thus providing a way to indicate the authenticity of a holder of a public key. The certificates, which are based on the IETF standard X.509, for example, include at least a public key, the name of the holder of the key, the name of the certificate authority (certificate granter), the serial number and validity time of the certificate, and the digital signature of the certificate authority. The idea of the certificate is that if a communicating party knows the public key of the certificate authority and trusts the certificate authority, the communicating party can also trust the material the certificate authority has signed.

P-0016[0016] In an embodiment of the invention according to FIG. 2, the first transmitter-receiver unit <b>102</b> includes means <b>103</b>, such as a Bluetooth chip or a transmitter-receiver function implemented by means of a WLAN or infrared connection, for establishing a short-range telecommunication connection. The first transmitter-receiver unit <b>102</b> also comprises means <b>105</b> for supporting a public key infrastructure PKI and means <b>103</b> for establishing a telecommunication connection. The first transmitter-receiver unit <b>102</b> may be e.g. a mobile telephone or another device which includes similar telecommunication equipment, such as a portable computer.

P-0017[0017] Similarly, the second transmitter-receiver unit <b>106</b> shown in FIG. 2 comprises means <b>105</b> for supporting a public key infrastructure PKI and means <b>103</b> for establishing a telecommunication connection. Similarly, the second transmitter-receiver unit <b>106</b> may be e.g. a mobile telephone or another device which includes similar telecommunication equipment, such as a portable computer or a palm-sized computer.

P-0018[0018] In the example of FIG. 2, the remote-controllable server <b>104</b> comprises a communications unit <b>120</b>, a control unit <b>122</b> and a lock controller <b>124</b>, which controls a lock mechanism <b>126</b>, such as a lock of a door or a gate. The controller of the remote-controllable server <b>104</b> may transmit commands to the remote-controllable server <b>104</b> through the second transmitter-receiver unit <b>106</b>. The communications unit <b>120</b> of the remote-controllable server <b>104</b> is responsible for receiving and transmitting signals and for establishing short-range connections, such as Bluetooth or infrared connections, and long-range connections, such as the Internet, CSD and GPRS ones, between the server <b>104</b> and the devices connected thereto. The basic functions of the remote-controllable server <b>104</b> are controlled by the control unit <b>122</b>, which is typically implemented by means of a microprocessor and software or separate components. The lock controller <b>124</b> is connected to the lock mechanism <b>126</b> e.g. by an electric or mechanical connection or by a wireless telecommunications link.

P-0019[0019] Examine the function of the system according to FIG. 2 by means of an example. In the example, the first transmitter-receiver unit <b>102</b> is to ask the remote-controllable server <b>104</b> controlled by the second transmitter-receiver unit <b>106</b> to unlock the lock <b>126</b>. First, the means <b>103</b> of the first transmitter-receiver unit <b>102</b> for establishing a short-range telecommunication connection establish a short-range telecommunication connection, such as a Bluetooth or infrared connection, to the remote-controllable server <b>104</b>. Next, controlled by the communications unit <b>120</b> and the control unit <b>122</b>, the server <b>104</b> sends the first transmitter-receiver unit <b>102</b> an enquiry, such as an electric form or the like, to be filled in. Alternatively, the first transmitter-receiver unit <b>102</b> may already be provided with electric forms for different situations from among which an appropriate one can be selected and filled in at the first transmitter-receiver unit <b>102</b>.

P-0020[0020] Next, at the first transmitter-receiver unit <b>102</b>, the information required in the electric form, such as the name of a visitor or the reason of a visit, is filled in. Furthermore, at the PKI unit <b>105</b> of the first transmitter-receiver unit <b>102</b>, the digital signature of the visitor is included in the form. A digital signature is a character string, which is formed using cryptographic methods known per se so as to enable the identity of the transmitter and the integrity of the transmitted material to be ensured. In addition to the digital signature, a certificate to indicate the authenticity of the visitor is included in the form at the PKI unit <b>105</b>, the certificate including the visitor's name and public key, the name of the certificate authority, i.e. the granter of the certificate, the serial number and validity time of the certificate, and the digital signature of the certificate authority. Next, the first transmitter-receiver unit <b>102</b> transmits the electric form, including the digital signature and the certificate attached thereto, to the server <b>104</b>.

P-0021[0021] Next, the remote-controllable server <b>104</b> sends the second transmitter-receiver unit <b>106</b> a message, such as a push message, indicating that the electric form has been received; the server <b>104</b> has also included the certificate received from the first transmitter-receiver unit <b>102</b> into the message. Since the second transmitter-receiver unit <b>106</b> is thus provided with the certificate which is signed by a trusted certificate authority and which comprises the visitor's name and public key, it is safe to trust that the holder of the public key, i.e. the visitor, is provided with exactly the same name as indicated in the certificate. Next, the authenticity of the visitor's name is confirmed at the PKI unit <b>105</b> of the second transmitter-receiver unit <b>106</b> by using the public key provided in the certificate. Next, if the holder of the second transmitter-receiver unit <b>106</b> accepts the reason of the visitor's call, a command to unlock the lock can be transmitted from the second transmitter-receiver unit <b>106</b> to the remote-controllable server <b>104</b>.

P-0022[0022] The certificate authority <b>119</b> releases Certification Revocation Lists (CRL) in order to prevent unauthorized use of the certificates. Those who have misused their certificate are listed in a CRL. Those who have been granted a certificate may check the CRL before trusting the certificate. Therefore, before transmitting the command to unlock the lock, a telecommunication connection, such as an Internet connection, can first be established from the second transmitter-receiver unit <b>106</b> to the certificate authority <b>119</b> to make sure that the visitor's certificate is not on the CRL. Information about the authenticity of the certificate can be provided e.g. on the display of the second transmitter-receiver unit <b>106</b> by means of the protocol used by the certificate authority <b>119</b>, such as protocols called Online Certificate Status Protocol (OCSP), Simple Certificate Validation Protocol (SCVP) or XML Key Management Specification (XKMS).

P-0023[0023] When the remote-controllable server <b>104</b> has received the command to unlock the lock transmitted by the second transmitter-receiver unit <b>106</b>, the lock <b>126</b> is unlocked, controlled by the lock controller <b>124</b> and the control unit <b>122</b>.

P-0024[0024] Let us next view a method according to an embodiment of the invention shown in FIG. 3 by means of a flow diagram. For the sake of clarity, the method steps carried out by the first transmitter-receiver unit <b>102</b>, the second transmitter-receiver unit <b>106</b> and the remote-controllable server <b>104</b> are separated into their own areas by using double lines in FIG. 3.

P-0025[0025] In step <b>300</b> in FIG. 3, a telecommunication connection is established from the first transmitter-receiver unit, such as mobile equipment or a portable computer, to a remote-controllable server. The telecommunication connection to be established is e.g. a wireless short-range connection, such as a Bluetooth or infrared connection. Alternatively, the first transmitter-receiver unit establishes a telecommunication connection by using e.g. a mobile telephone network or a Short Message Service (SMS). Next, in step <b>302</b>, an electric form requesting a lock to be unlocked is transmitted from the first transmitter-receiver unit. The form is provided with the required information, such as the reason of a visitor's call. Furthermore, the form is provided with the digital signature of the visitor, i.e. the user of the first transmitter-receiver unit, and a certificate indicating the authenticity of the visitor. The electric form can be provided in the menus of the first transmitter-receiver unit, wherefrom it can be selected and shown on the display of the unit. Alternatively, in step <b>304</b>, the electric form can be requested from the remote-controllable server which, on request, transmits the electric form to the first transmitter-receiver unit. The arrows and steps circumscribed by broken lines in FIG. 3 are used for depicting alternative method steps.

P-0026[0026] As distinct from the example of FIG. 3, it is possible in step <b>300</b> either to send a text message or set up a voice or video connection from the first transmitter-receiver unit to the second transmitter-receiver unit and use the established connection for explaining the reasons of the visit. A text, voice and/or video message and a digital signature may also be combined into one multimedia message (MMS). Such a multimedia message can be transmitted either directly via a telecommunication network, or via a remote-controllable server.

P-0027[0027] In step <b>306</b>, a message, such as a push message, indicating that the electric form has been received is transmitted from the remote-controllable server to the second transmitter-receiver unit. The push message indicates the reason of the visit and that the visitor using the first transmitter-receiver unit is requesting the lock to be unlocked. The push message further contains the digital certificate of the visitor. Since the holder of the second transmitter-receiver unit controlling the remote-controllable server can trust the certificate signed by a trusted certificate granter and the digital signature, next, the process may directly proceed to step <b>310</b>, wherein a decision is made about whether or not to accept the request to unlock the lock. Alternatively, the process may further proceed from step <b>306</b> to step <b>308</b> to confirm the state of the visitor's certificate. In step <b>308</b>, a telecommunication connection, e.g. an Internet connection, is established to a certificate authority in order to check that the visitor's certificate is not on a Certification Revocation List, CRL. In step <b>308</b>, it is possible to transmit a message to the certificate authority and ask the certificate authority to send the second transmitter-receiver unit a reply indicating whether or not the visitor's certificate is authentic.

P-0028[0028] If, in step <b>310</b>, for one reason or another, the visitor's request is not to be accepted, the process moves to step <b>312</b>, wherein the request to unlock the lock is rejected. Information about the rejection is transmitted to the remote-controllable server, which may e.g. transmit a message indicating the rejection to the first transmitter-receiver unit. If, on the other hand, in step <b>310</b> a decision is made to accept the request to unlock the lock, the process moves to step <b>314</b>, wherein a command to unlock the lock is transmitted to the remote-controllable server. Information about the acceptance of the request to unlock the lock can also be transmitted to the first transmitter-receiver unit e.g. as a text message. The communication between the second transmitter-receiver unit and the remote-controllable server can utilize identification methods between, server and client known per se in order to encrypt the communication therebetween and to ensure the authenticity of the server and the transmitter-receiver unit. The command to unlock the lock may include the digital signature of the holder of the second transmitter-receiver unit and a time stamp. The digital signature can be used for ensuring that no one that has gained unauthorized access e.g. to the second transmitter-receiver unit is able to use it for unlocking the lock. When the digital signature is used, the remote-controllable server must also be provided with equipment to enable the identification systems to be used. The use of a time stamp also prevents outsiders from monitoring and copying the command to unlock the lock and using this command to unlock the lock later.

P-0029[0029] In step <b>318</b>, the remote-controllable server unlocks the lock on the basis of the received command to unlock the lock. Alternatively, the server may also unlock several locks in a specific order, should the locked premises reside behind several locked doors. In such a case, the first transmitter-receiver unit and the remote-controllable server can agree upon which lock is to be unlocked at a given time; however, the authorization granted by the second transmitter-receiver unit is valid only for a predetermined, limited period of time.

P-0030[0030] Although the invention has been described above with reference to the example according to the accompanying drawings, it is obvious that the invention is not restricted thereto but can be modified in many ways within the scope of the inventive idea disclosed in the attached claims.