EP1653415A1 - Process and equipment of management of access control badges - Google Patents

Abstract

The method involves reading a loss index, of a chip (40), representing a number of loss declarations for an authenticated badge and comparing the index with a loss index stored in a database (14). The database is modified to take into account the index or data is modified and/or deleted from the chip to invalidate the badge, if the index represents the number of declarations greater or lower than that of the index of the database. An independent claim is also included for an equipment of managing access control contactless badges.

Description

The present invention relates to access control, and more particularly to a method and an equipment for managing access control badges by using read-write phases.

In the prior art, non-contact tags have appeared read-write that can both be read remotely by a reader device but also likely under certain conditions to be reprogrammed. Changes in the programming of badges can be made using the Residor software from Immotec Systèmes and terminals such as the Palm Pilot or other PDA (Personal Digital Assistant) or the Mifare® contactless badge encoder.

The technology of these badges, also known as "transponders", is based on a radio dialogue in frequencies typical of 125 kHz for the most common badges (readable but not written) and 13.56 MHz for badges. readind, writing. An ISO 14443 standard describes the principle of these badges, the frequency and the communication rate of which allow a data transfer generally sufficient for most current applications.

It is known methods of access control with invalidation of the lost badge, requiring the establishment of a wired network. To invalidate a badge, these methods stipulate the obligation to have access to all readers; each reader separately recognizing the invalidation of the badge. These methods are mostly based on loss indices: when a badge is lost, the newly created badge has a loss index incremented by one. When the user uses it, it indicates to the badge reader that the old badge, at the lower index, must be refused if it is presented in front of the reader by a person who has found it.

The disadvantage of this method is that it is necessary to present the new badge on each of the readers concerned if one wants to be sure that the old badge will not work on any of them. And in the case of important sites with many doors, this task can be very long and putting. This may result in insufficient security by these conventional methods.

Document WO 02/091311 also discloses a method for controlling access to smart cards making it possible to prevent the access terminals from communicating with a central computer and to minimize the cost and management of the computer. whole system. However, the access terminals use a lot of information that has to be regularly updated, such as identification data and black lists of prohibited access cards. The invalidation of smart cards can not then be performed very efficiently without the need for sophisticated smart card readers.

The present invention therefore aims to overcome one or more of the disadvantages of the prior art by defining a method of managing contactless access control badges offering optimum security and making it possible to easily modify the information of the badge, in particular relating to access permissions.

• une étape de lecture, par les moyens de communication de la borne de contrôle d'accès, d'un indice de perte de la puce du badge représentatif d'un nombre de déclarations de perte pour le badge authentifié ;
• une étape de comparaison réalisée par un module de gestion installé dans la borne de contrôle d'accès pour comparer ledit indice de perte avec un indice de perte analogue stocké dans ladite base de données correspondant au badge authentifié ; et
• si l'étape de comparaison révèle que l'indice de perte lu sur la puce du badge représente un nombre de déclarations de perte supérieur à celui prévu selon l'indice de perte de la base de données, une étape de modification de la base de données pour tenir compte de l'indice de perte lu sur le badge authentifié ; et
• si l'étape de comparaison révèle que l'indice de perte lu sur la puce du badge représente un nombre de déclarations de perte inférieur à celui prévu selon l'indice de perte de la base de données, une étape de modification et/ou effacement de données de la puce du badge pour invalider le badge.

To this end, the invention relates to a method for managing access control badges intended to facilitate the updating of information on contactless badges each including an electronic chip provided with a radio or optical communication element, using access equipment comprising a plurality of access control terminals each provided with radio or optical communication means allowing at least reading data from the badge chip, at least one database being available to each terminal of access control, in which at least one communication without radio or optical contact is established between one of the access control terminals and a contactless badge, said contactless communication comprising a step of authenticating the badge by reading data identification keys stored in the chip of the badge, characterized in that said contactless communication comprises:

• a step of reading, by the communication means of the access control terminal, a loss index of the badge chip representative of a number of loss declarations for the authenticated badge;
• a comparison step performed by a management module installed in the access control terminal to compare said loss index with a similar loss index stored in said database corresponding to the authenticated badge; and
• if the comparison step reveals that the loss index read on the chip of the badge represents a number of loss declarations greater than that predicted according to the index of loss of the database, a step of modifying the database of data to take into account the loss index read on the authenticated badge; and
• if the comparison step reveals that the loss index read on the chip of the badge represents a number of reports of loss less than that predicted according to the index of loss of the database, a step of modification and / or erasure badge chip data to invalidate the badge.

• une étape de lecture, par les moyens de communication de la borne de contrôle d'accès, de données de profil mémorisées par la puce du badge représentatives d'un profil d'utilisation du badge ;
• une étape de comparaison réalisée par le module de gestion pour comparer les données de profil lues avec des données de profil correspondant aux données d'identification dans ladite base de données ; et
• en cas de non correspondance entre données de profil comparées, une étape de modification des données sur la puce utilisant en premier lieu ledit module de gestion et lesdits moyens de communication pour transmettre à la puce du badge les données de profil considérées comme nouvelles et utilisant en second lieu des moyens d'écriture de ladite puce pour remplacer les données de profil stockées dans une mémoire de la puce par les données nouvelles transmises via les moyens de communication de la borne de contrôle d'accès.

According to another particularity of the invention, if the comparison step reveals that the loss index read on the badge chip represents a number of loss reports greater than or equal to that predicted according to the loss index of the base of data, said contactless communication comprises:

• a step of reading, by the communication means of the access control terminal, profile data stored by the badge chip representative of a profile of use of the badge;
• a comparison step performed by the management module for comparing the read profile data with profile data corresponding to the identification data in said database; and
• in case of non-correspondence between profile data compared, a data modification step on the chip first using said management module and said communication means to transmit to the badge chip the profile data considered as new and using in secondly means of writing said chip to replace the profile data stored in a memory of the chip by the new data transmitted via the communication means of the access control terminal.

Thus, it can be advantageously carried out card data changes for example to update or invalidate an active badge used in an access control system.

According to another particularity of the invention, the badge authentication step comprises a reading step using the access control terminal communication means for reading identification data associated with a signature on the chip of the access control terminal. badge and a comparison step between signatures using the management module installed in the access control terminal to compare the signature data calculated by the terminal with the signature data transmitted from the chip.

According to another particularity, each of the contactless badges is initialized by a badge encoding apparatus during a personalization step, the encoder apparatus transmitting in a non-volatile memory reprogrammable of the badge chip at least one identification data of the badge and profile data representative of a badge usage profile.

According to another feature, an encryption step is performed by the badge encoder apparatus for storing at least one identification data of the badge in the form of an encrypted signature in a memory area of the contactless badge.

According to another feature, said badge authentication step comprises a prior transmission from the control terminal to the badge of a request to send a badge identification data, the contactless communication being established between terminal and contactless badge in case of receipt by the badge of said request. The authentication step of the badge then comprises the reception of said identification data with its associated signature, the reading of the identification data of the badge by the management module of the access control terminal, at least one key associated with said identification data being used by the management module for firstly calculating said signature calculated from the transmitted signature by the badge in response to said request, and secondly compare said calculated signature with the signature transmitted by the badge with said identification data in response to said request.

According to another feature, the method according to the invention comprises an encryption step using a read key stored in a sector of the memory of the badge for encrypting information of said sector before the transmission of this information to an access control terminal and a decryption step using a write key stored in a sector for decrypting the information received from a terminal and intended for said sector, the memory of the badge comprising a determined number of sectors each including a read key and a key of writing.

According to another particularity, a stopping of the contactless communication is triggered via the management module and the communication means of the terminal when the comparison between signatures gives no result.

According to another particularity, each data modification step on the chip comprises a step of transmission by the terminal to the chip of the badge of an encrypted information with a key corresponding to a determined sector of the memory of the badge then a decryption step using a write key associated with the determined sector of the badge memory to decode the information corresponding to this sector.

In another feature, the profile data of the database is updated through a profile data update module.

In another feature, the update module provides, for each of the contactless badges, badge identification data and profile data to a local database of at least one access control terminal.

According to another feature, the communication is of the radio type and is carried out at a determined frequency in a restricted area having a radius less than 12 meters around the communication means of the access control terminal.

Another object of the invention is to provide a solution to one or more of the problems encountered in the prior art by defining a contactless access control card management equipment enabling the parameters of the badges to be modified automatically. .

• un module de mise à jour de données de badge représentatives notamment d'une identification et d'un indice de perte, agencé pour fournir à au moins une base de données des données mises à jour, à chaque badge géré par ledit équipement étant associé un unique jeu de données de badge ;
• un module de gestion installé dans chaque borne de contrôle d'accès et associé aux moyens de communication de la borne pour comparer des données de badge lues par les moyens de communication avec des données de badge associées stockées dans la base de données, le module de gestion incluant des moyens de sélection pour sélectionner dans la base de données les données associées à un badge déterminé, et des moyens de décision du remplacement d'au moins une partie des données dudit badge déterminé ; et
• des moyens de transmission dans lesdits moyens de communication de chaque borne de contrôle d'accès pour transmettre à une puce d'un badge des données de remplacement sélectionnées par l'intermédiaire du module de gestion, le module de gestion étant agencé pour effacer au moins un champ de données de façon à invalider un badge par transmission parmi lesdites données de remplacement d'au moins un champ de données correspondant à l'effacement de l'indice de perte du badge.

This goal is achieved by contactless card management equipment for access control, intended to facilitate the updating of information contained in an electronic badge chip, comprising a plurality of access control terminals each provided with means radio or optical communication device for reading data from the chip of a badge, characterized in that it comprises:

• a module for updating badge data representative in particular of an identification and a loss index, arranged to provide at least one database with updated data, to each badge managed by said equipment being associated with a unique badge data set;
• a management module installed in each access control terminal and associated with the communication means of the terminal for comparing badge data read by the communication means with associated card data stored in the database; management including selection means for selecting in the database the data associated with a given badge, and decision means for replacing at least a portion of the data of said determined badge; and
• transmission means in said communication means of each access control terminal for transmitting to a chip of a badge replacement data selected via the management module, the management module being arranged to erase at least a data field so as to invalidate a badge by transmission among said replacement data of at least one data field corresponding to the erasure of the badge loss index.

In another feature, the badge data includes profile data representative of a badge usage profile.

• le(s) numéro(s) d'un ou plusieurs sites autorisés ;
• le nom de l'usager ;
• le numéro d'appartement ;
• la catégorie du personnel ou le niveau hiérarchique ;
• les droits d'accès,
• le numéro de badge,
• l'indice de perte ;
• les dates de validité ;

chacune de ces informations étant destinée à un secteur spécifique de la mémoire du badge utilisant une clé d'écriture ou de lecture associée.According to another particularity, the profile data is at least one of the following information:

• the number (s) of one or more authorized sites;
• the name of the user;
• the apartment number;
• the category of the staff or the hierarchical level;
• access permissions,
• the badge number,
• the loss index;
• the dates of validity;

each of these information being intended for a specific sector of the memory of the badge using an associated writing or reading key.

According to another particularity, a badge encoder apparatus is provided for initializing and personalizing each of the contactless badges, the encoder apparatus having transmitting means for transmitting to a memory of the chip of a badge at least one data item. identification of the badge and profile data representative of a profile of use of the badge.

According to another particularity, the communication means are connected to the management module for, on the one hand, transmitting via said transmission means a badge identification request, and on the other hand receiving at least one piece of data. identification of a badge.

According to another particularity, the management module comprises decryption and reading means of the type using at least one key for decrypting data of an encrypted sector received by the communication means of the terminal.

According to another particularity, interactive means including an input interface are connected to the update module to enable the input of access data, the update module comprising in storage means, for each of the badges managed by equipment, a table access data representative of access authorizations corresponding specifically to defined terminals of the equipment.

According to another feature, the update module is provided with storage means for storing a central database gathering for each of the contactless badges badge identification data and profile data, said central database. being connected to a plurality of access control terminals.

According to another particularity, each of the access control terminals comprises a local database, the update module being connected to each of said local databases.

• les figures 1 et 2 représentent une vue d'ensemble schématique d'un équipement selon l'invention avec respectivement un réseau non câblé et un réseau câblé ;
• la figure 3 présente un type de communication permis par l'équipement dans un mode de réalisation de l'invention ;
• la figure 4 représente schématiquement le principe d'autorisation d'accès d'un badge en fonction d'un indice de perte ;
• la figure 5 représente schématiquement une mémoire d'un badge utilisé dans un mode de réalisation de l'invention,
• la figure 6 représente un logigramme correspondant à un mode de réalisation du procédé selon l'invention.

The invention, with its features and advantages, will emerge more clearly on reading the description given with reference to the appended drawings in which:

• Figures 1 and 2 show a schematic overview of an equipment according to the invention with respectively a non-wired network and a wired network;
• Figure 3 shows a type of communication enabled by the equipment in one embodiment of the invention;
• FIG. 4 schematically represents the access authorization principle of a badge as a function of a loss index;
• FIG. 5 schematically represents a memory of a badge used in one embodiment of the invention,
• FIG. 6 represents a logic diagram corresponding to an embodiment of the method according to the invention.

The invention will now be described with reference to Figures 1 and 2. The type of frequency used for radio communications is preferably that specified in ISO 14443, amounting to 13.56 MHz. The badge is powered by the energy of the message transmitted at such a frequency, no battery being then necessary. The invention can also be transposed to other radio frequencies for which badges have been designed or for optical communication modes.

The method for managing access control badges according to the invention has the particular feature of facilitating the invalidation of lost badges as well as the updating of information on contactless badges (4) by using a read-write functionality. writing available for these badges. Each of these badges (4) comprises in a chip (40) a memory (44) non-volatile reprogrammable type EEPROM (Electrically Erasable Programmable Read Only Memory) or a flash memory. At least one identification data of the badge (4) and profile data representative of a profile of use of the badge (4) are stored in this memory (44) of the chip (40).

The method of the invention proposes to modify some of these data, for example by erasing the data necessary to obtain an access authorization for badges identified as having been lost or stolen. With reference to FIGS. 1 and 2, the card management equipment (1) has several access control terminals (2, 3, 10, 20, 30) each equipped with radio communication means (11). for reading data from the chip (40) of a badge (4). In one embodiment, a badge data update module (13) is provided for providing at least one database (14) including updated profile data. The profile data representative of a badge usage profile as well as identification and badge loss index data can be stored in the same way in the database, with an update carried out by the user. module (13) update. It is therefore permissible with this module (13) to update, for example, access data to some of the terminals (10, 20, 30). In a preferred embodiment of the invention, a single set of profile data is associated with each badge (4) managed by said equipment (1).

The update module (13) may be provided with storage means (130) for storing a database gathering for each of the contactless badges (4) badge identification data and profile data. This database can be central and connected to a plurality of access control terminals (10, 20, 30), which makes it possible to focus, for example in the same place, a plurality of access control terminals (10, 20, 30). To facilitate the updating of information contained in the electronic badge chip, each access control terminal (10) can be provided with a management module (12) associated with the radio communication means (11). With this management module (12) installed in the terminal (10), it is possible to compare profile data of a badge (4) read by the radio communication means (11) with profile data associated with it. badge (4) stored in said database (14). In the embodiment of FIGS. 1 and 2, the access control terminals (2, 3, 10, 20, 30) comprise a local database (14) including said profile data as well as data enabling identify the badges (4), for example in the form of an authentication table. The equipment (1) may also comprise a single centralized database comprising a list of identification data badges (4) of the serial number type or the like and a table of correspondence between these numbers and authorizations for different checks of access (A1, A2, A3). This centralized database is stored in the storage means (130) of the updating module (13).

In the example of FIG. 1, separate zones (101, 102, 103) each have a different access (A1, A2, A3). The use of the equipment (1) makes it possible to assign to a user access authorizations for one or more of these zones (101, 102, 103). Each terminal (2, 3, 10) assigned to one of these zones may have, for example, a local database (14). When the accesses (A1, A2, A3) are used for the control of the same zone (100) as illustrated in FIG. 2, it may be envisaged either to connect by a network (6) the terminals (10, 20, 30) to the update module (13), or to connect one or a few terminals (10) controlling a main access (main access door).

The interactive means (15) illustrated in FIGS. 1 and 2 allow the input of access data, an operator being able to use an interface for inputting these interactive means (15) to modify certain data or to delete / create new rights of access. 'access. These interactive means (15) are connected to the updating module (13). The storage means (130) of this module (13) store, for each of the badges (4) managed by the equipment (1), an access data table representative of access authorizations. For each badge (4), the authorizations then specifically correspond to well-defined accesses controlled by defined terminals of the equipment (1). The access possibilities may therefore vary according to the profile of the user.

In one embodiment of the invention, the management module (12) of each terminal (10, 20, 30) comprises selection means for selecting in the database (14) available to the terminal, the data associated with a given badge. The module (12) further comprises decision means for replacing at least part of the data of said determined badge (4).

In other words, for the operations of modifying the configuration of a badge (4), an access control terminal (10) equipped with the management module (12) and having an updated database (14). by the update module (13) can be used to selectively modify the data of an old badge (4). Thus, for an operation of invalidation of a badge (4) lost or stolen, the equipment (1) according to the invention is able to selectively erase the data of the badge (4) or perform a loss index regression . For this purpose, transmission means are provided in the radio communication means (11) of each access control terminal, in particular for transmitting to the chip (40) a replacement data badge selected via of the management module (12). To initiate the radio communication (5), the radio communication means (11) connected to the management module (12) transmit via said transmission means a badge identification / authentication request (4). Such a request can be sent every 2 to 7 seconds. One or more identification data of a badge (4) can be received via these communication means (11) and transmitted to the management module (12). The radio communication (5) is carried out at a determined frequency in a restricted area having for example a radius less than 12 meters around the radio communication means (11) of the access control terminal (10, 20, 30) .

With reference to FIG. 4, the principle of the loss index is illustrated to represent a known way of invalidating a badge, by taking the example simple of a user having lost a badge (4) which allowed him to access several buildings (B1, B2). When this user loses his badge (4), the manager uses interactive means (15) and an encoder apparatus (17) to provide another (4 ') which has a loss index incremented by one. Subsequently, the user passes his new badge (4 ') on the readers (R) most used, indicating that the previous badge (4) has been lost. If a third person finds this old badge (4) and tries to enter a building (B1, B2) by "badging" one of these readers (R), he will certainly be refused access but the old badge (4) ) remains likely to allow access via readers (R) who have not read the new badge (4 '). To remedy this type of disadvantage, the equipment (1) of the invention implements a different process: indeed, the loss index is automatically erased and the old badge (4) can not open any of the other access attributed to him, even those that the user had not validated with his new badge (4 ').

The invention consists in providing access control terminals (10, 20, 30) not only of the reading function of the badge but also of the writing function, the terminals (10, 20, 30) memorizing association with the identifier of the badge the associated data (name of the bearer, right of access, profile of the users including a time profile, etc.) and the loss index. This information contained in the terminals (10, 20, 30) is used during the presentation of a badge, and if the loss index read in the badge (4) reveals that the number of loss declarations announced by the badge (4) is less than that predicted according to the index of loss of the database available to the terminal, the terminal erases for example the loss index. If, on the other hand, this number of loss declarations is greater than that predicted according to the index of loss of the database, the database (14) is modified to take into account the loss index. read on the authenticated badge.

It is understood that the equipment (1) may comprise conventional readers (R) and access control terminals (10, 20, 30) provided with the management module (12) allowing the data replacement functionality on the chip (40) of the badge (4). These terminals (10, 20, 30) can be installed in priority to the places most likely to be used by the person who would have recovered the old badge (4): for example a main access door (A1).

In one embodiment of the invention, the equipment (1) can use a technology of MIFARE® type conforming to ISO 14443 for reading either the serial number of the badge, or a badge number contained in one of the 16 sectors (S) of the memory (44, FIG. 5) of the badge (4). In the latter case, the badge number can be encrypted for more security. Each of the contactless badges (4) is initialized by a badge encoder apparatus (17) during a personalization step which may include an encryption phase. The encoder apparatus (17) transmits in a reprogrammable non-volatile memory (44) of the chip (40), via radio transmission means, at least one identification data of the badge (4) and data representative of a profile of use of the badge (4). The badge encoder apparatus (17) comprises for example an encryption module and is arranged to transmit in the form of an encrypted signature at least one identification data of the badge (4) to a memory zone (442). , Figure 3) of the contactless badge (4).

Non-contact badges (4) for reading and writing integrate, in association with their radio communication device (41), writing means (42) arranged in the electronic chip (40). New profile data can be transmitted to the chip (40) of the badge (4) and stored in memory (44) through these write means (42) so as to replace obsolete profile data. Among the profile data, a data field may be provided to represent the loss index of the badge (4). In the access control terminal (10), the management module (12) is able to erase this data field to invalidate the badge (4) by transmission among said replacement data of a data field representing the data field. erasure of the badge loss index.

In the embodiment of FIG. 3, a memory zone (442) of the contactless badge (4) can store an encrypted signature. The protection of the data of the badge (4) by using an authentication procedure of an encrypted signature provides a strong security. Each badge (4) has a memory zone (441) for the data (name of the bearer, access rights, etc.) and another (442) for an encrypted signature. This signature is a code generated using an RSA algorithm or other signature algorithm from the badge identification data (these data being recorded in the badge). The RSA algorithm is a complex process that uses the data of the badge (4), a public key stored in a central system of the equipment (1) and a secret key that only the provider of the equipment (1) has. Thus, when a user passes his badge (4) in front of an access control terminal (10), the management module (12) of this terminal (10) decrypts the signature by inverse algorithm, and compares this which is obtained with the data actually recorded in the badge (4). If the two pieces of information are not strictly identical, the terminal (10) denies access to the user.

In the example of FIG. 3, the management module (12) can have decryption and reading means of the type using at least one key for decrypting an encrypted identification data item received by the radio communication means (1). . The decryption means may be included in the management module (12) or provided from a central system. With reference to FIG. 3, the management module (12) compares, during the radio communication (5), the decrypted identification data with badge identification data associated with said access control terminal (10) in the database (14).

Another type of protection with key security can be used. The memory of each badge, for example of the EEPROM type, may be composed of 16 sectors (S) as shown in FIG. 5. Each of the sectors (S) is provided with a coded key (Kr) on for example 6 bytes in reading and another key (Kw) in writing. In one embodiment of the invention, only a central system connected to the terminals (10, 20, 30) and the encoder apparatus (17) hold these keys (which allow them to identify the badge), so that an evil person can not get them. It is understood that it is possible to perform an encryption by using a read key (Kr) stored in a sector (S) of the memory (44) of the badge (4) to encrypt information of said sector (S) before the transmission of this information to an access control terminal (10) and to perform a decryption by using a write key (Kw) stored in a sector (S) to decipher the information received from a terminal (10) and intended for said sector (S).

An exemplary badge management process according to the invention will now be described with reference to FIGS. 1 and 6.

In the example of FIG. 1, the badges (4) contain in memory (44) the information necessary for an optimal access control and can be of several types (Resident, Pass, Tertiary) each having their own characteristics: as a non-limitative example, some of them, such as the number of the site or sites, the name of the user, the apartment number, the category of the staff or the hierarchical level, the access rights, the number badge, loss index, validity dates. Each of these pieces of information is intended for a sector (S) specific to the memory (44) of the badge (4) using an associated write (Kw) or read (Kr) key. Badges data (4), mainly user profile data, time profiles and door access rights, are commonly modified. The modification operations are simplified thanks to the invention.

With reference to FIG. 6, the step (50) of authentication of the badge (4) by the access control terminal (10) starts with a prior transmission (500) from the control terminal (10) to the badge (4) of a request to send at least one identification data of the badge (4), the radio communication (5) being established between terminal (10) and contactless badge (4) in case receipt by the badge (4) of said request. After the required identification data has been transmitted (501) by the badge (4) in response to said request, the badge authentication step (50) continues with the receipt (502) of said data item. identification with its associated signature, and the reading (503) of the identification data of the badge (4) by the management module (12) of the access control terminal (10). At least one key associated with said identification data is used by the management module (12) to first calculate (504) said signature calculated from the signature transmitted by the badge (4) in response to said request , And on the other hand comparing (505) said calculated signature with the signature transmitted by the badge (4) with said identification data in response to said request. The comparison (505) by the management module (12) completes the authentication step (50). When the comparison (505) with the database identification data (14) gives no result, a stop (506) of the radio communication (5) is triggered via the management module (12) and radio communication means (11) of the access control terminal (10).

In a conventional manner, in case of identification of the badge during the identification step (50), the unlocking of an access (A1, A2, A3) can be actuated via a control signal coming from the management module (12) to an access blocking / unlocking device. Otherwise, no command signal is sent and access is denied.

As soon as the authentication of the badge (4) is performed, the method according to the invention provides a step (51) of reading the loss index declared by the badge (4). The management module (12) can erase the data field corresponding to the badge loss index during a badge invalidation step (54) (4) if a prior comparison step (52) reveals a difference for this data field.

A step (53) of memorizing a new loss index is performed when the terminal (10) reads for the first time a replacement badge of a lost badge. After checking the badge loss index, if the authenticated badge (4) is not a badge declared lost / replaced, the communication (5) continues with a step (510) of reading, by the means communicating (11) the access control terminal (10), profile data stored in the chip (40). A comparison step (520) is then performed by the management module (12) of the access control terminal (10) to compare the read profile data with profile data corresponding to the identification data in the database. data (14). If this comparison step (520) reveals at least one difference, there follows a step (540) of data modification on the chip (40) using firstly the management module (12) and the radio communication means (11) to transmit (541) at the chip (40) of the badge of the profile data considered as new and secondly the writing means (42) of said chip (40) for replacing (542) profile data stored in a memory (44) of the chip (40) by the new data transmitted via the radio communication means (11) of the access control terminal (10). The database used to store the data associated with the badges (4) can be local or remote (centralized database).

As a variant, said comparison step (520) may consist in the consultation by the management module (12) of an indication data of the need to modify the data of the badge (4). This indication data can be, for example, a 0 bit if the central system has not noticed any update made since the last "badging" and a 1 bit if, on the contrary, new data has been entered in the database. storing profile data.

The invention therefore makes it possible to carry out operations such as the change of the name of the user, the date of validity of the badge, the calculation of the times of presence, or the temporary or definitive access to access more quickly and simply. a door. In one embodiment of the invention, the update module (13) makes it possible to modify parameters on the number of badges (4) desired using dedicated Residor software or similar reprogramming software. . The modifications are taken into account for example by wired network (6) or by means of an intermediate badge programmed with said software and the encoder apparatus (17). The update module (13) transfers the information to the access control terminal equipped with the management module (12). Thus, when the user passes his badge (4) in front of the terminal (10) badge reader, the slightest change is automatically achieved through the integrated write function in the transmitter of said terminal (10). If this transmitter is placed in the access control terminal (10) of the main entrance, the entire park can be updated in a short period of time, for example in 24 hours.

In one embodiment of the invention, each data modification step (54, 540) on the chip (40) includes a step of transmission by the terminal (10) to the chip of the badge (4) of an encrypted information with a key corresponding to a sector (S) determined from the memory (44) of the badge (4) and a decryption step using a key writing (Kw) associated with the determined sector (S) of the memory (44) of the badge (4) for decrypting the information corresponding to this sector (S). The use of encryption / decryption keys provides security of the communication protocol between an access control terminal (10) and a badge (4).

When no modifications are necessary, the comparison step (520) is followed by an end of communication step (55) accompanied, for example, by the unblocking of an access (A1, A2). , A3). In one embodiment of the invention, the management module (12) can for example control an electromagnet (40) of an electric strike to unlock an access door. The management module (12) can also control, in another example, a remote control, an actuator, etc. In exemplary embodiments of the invention, at least one radio receiver of the radio communication means (11) of the terminal (10) is associated with a clock recording the hours of arrival and departure of the users and makes it possible to manage the working hours.

One of the advantages of the invention lies in the simplicity of implementation, the updates being performed automatically. The management of the badge park is thus simplified and the users are no longer obliged to return their badge when the manager has to make changes. In addition, security of the identification data can be ensured since a lost or stolen badge can not be used fraudulently.

It should be obvious to those skilled in the art that the present invention allows embodiments in many other specific forms without departing from the scope of the invention as claimed.

Claims (22)

A method of managing access control badges for facilitating the updating of information on contactless badges (4) each including an electronic chip (40) having a radio or optical communication element (41), said method using access equipment (1) having a plurality of access control terminals (10, 20, 30) each provided with radio or optical communication means (11) for reading data from the chip (40) of the badge (4), at least one database being available to each access control terminal (10, 20, 30), wherein at least one radio or optical contactless communication (5) is established between a access control terminals and a contactless badge (4), said contactless communication (5) comprising a step (50) for authenticating the badge (4) by reading identification data stored in the chip (40). ) of the badge, characterized in that said contactless communication (5) com take : a step (51) of reading, by the communication means (11) of the access control terminal (10), of a loss index of the chip (40) of the badge representative of a number of declarations loss for the authenticated badge; a comparison step (52) performed by a management module (12) installed in the access control terminal (10) for comparing said loss index with a similar loss index stored in said database corresponding to the badge authenticated; if the comparison step (52) reveals that the loss index read on the chip (40) of the badge represents a number of loss declarations greater than that predicted according to the index of loss of the database, a step (53) of modifying the database to take into account the loss index read on the authenticated badge; and if the comparison step (52) reveals that the loss index read on the chip (40) of the badge represents a number of declarations of loss less than that provided according to the index of loss of the database, a step (54) for modifying and / or erasing data from the chip (40) of the badge to invalidate the badge (4). The method of claim 1, wherein, if the comparing step (52) reveals that the loss index read on the chip (40) of the badge (4) represents a number of loss reports greater than or equal to that expected according to the index of loss of the database, said contactless communication (5) comprises: a step (510) of reading, by the communication means (11) of the access control terminal (10), of profile data stored by the chip (40) of the badge representative of a usage profile badge (4); a comparison step (520) carried out by the management module (12) for comparing the profile data read with profile data corresponding to the identification data in said database; and in case of non-correspondence between profile data compared, a step (540) for modifying data on the chip (40) firstly using said management module (12) and said communication means (11) for transmitting (541 ) to the chip (40) of the badge the profile data considered as new and secondly using write means (42) of said chip (40) to replace (542) the profile data stored in a memory (44); ) of the chip (40) by the new data transmitted via the communication means (11) of the access control terminal (10). Method according to claim 1 or 2, wherein the step (50) for authenticating the badge (4) comprises a reading step (503) using the communication means (11) of the access control terminal (10). ) for reading identification data associated with a signature on the chip (40) of the badge (4) and a step (505) for comparing signatures using the management module (12) installed in the access control terminal (10) for comparing the calculated signature data (504) by the terminal (10) with the signature data transmitted from the chip (40). Method according to one of Claims 1 to 3, in which each of the non-contact badges (4) is initialized by a badge encoding apparatus (17) during a personalization step, the encoder apparatus (17) transmitting in a non-contact memory reprogrammable volatile chip (40) of the badge (4) at least one badge identification data (4) and profile data representative of a badge usage profile (4). A method according to claim 4, wherein an encryption step is performed by the badge encoder apparatus (17) to store at least one identification data of the badge (4) as an encrypted signature in a memory area (442) non-contact badge (4). Method according to claim 5, wherein said step (50) for authenticating the badge (4) comprises a prior transmission (500) from the control terminal (10) to the badge (4) of a sending request at least one identification data of the badge (4), the contactless communication (5) being established between the terminal (10) and the contactless badge (4) when the badge (4) receives said request , the step (50) of authentication of the badge then comprising the reception (502) of said identification data with its associated signature, the reading (503) of the identification data of the badge (4) by the module of management (12) of the access control terminal (10), at least one key associated with said identification data being used by the management module (12) to first calculate (504) said calculated signature to from the signature transmitted by the badge (4) in response to said request, and secondly compare (505) said signa calculated with the signature transmitted by the badge (4) with said identification data in response to said request. Method according to one of claims 2 to 6, comprising an encryption step using a read key (Kr) stored in a sector (S) of the memory (44) of the badge (4) for encrypting information of said sector (S) before the transmission of this information to an access control terminal (10) and a decryption step using a write key (Kw) stored in a sector (S) for decrypting the information received from a terminal (10) and destined for said sector (S), the memory (44) of the badge (4) comprising a determined number of sectors (S) each including a read key (Kr) and a write key (Kw). Method according to one of claims 3 to 7, wherein a stop (506) of the contactless communication (5) is triggered via the management module (12) and the communication means (11) of the terminal (10). ) when the comparison (505) between signatures gives no result. Method according to one of claims 2 to 8, wherein each data modification step (54, 540) on the chip (40) comprises a step of transmitting by the terminal (10) to the chip of the badge (4) a encrypted information with a key corresponding to a determined sector (S) of the memory (44) of the badge (4) and a decryption step using a write key (Kw) associated with the determined sector (S) of the memory (44). ) of the badge (4) for decrypting the information corresponding to this sector (S). Method according to one of claims 2 to 9, wherein the profile data of the database (14) is updated via a profile data update module (13). The method of claim 10, wherein the update module (13) provides, for each of the contactless badges (4), badge identification data and profile data to a local database (14). at least one access control terminal (10). Method according to one of claims 1 to 11, wherein the communication is of the radio type (5) and is carried out at a determined frequency in a restricted area having a radius of less than 12 meters around the communication means (11) of the terminal access control (10, 20, 30). Contactless badge management equipment (1) (4) for access control, intended to facilitate the updating of information contained in an electronic chip (40) of the badges, comprising a plurality of terminals access control (10, 20, 30) each provided with radio or optical communication means (11) for reading data from the chip (40) of a badge (4), characterized in that it comprises: an update module (13) for representative badge data, in particular an identification and a loss index, arranged to use data for updating a database (14), at each badge; (4) managed by said equipment (1) being associated with a single set of badge data; a management module (12) installed in each access control terminal (10) and associated with the communication means (11) of the terminal (10) for comparing card data read by the communication means (11) with associated card data stored in the database, the management module (12) including selection means for selecting in the database the data associated with a given badge, and decision means for replacing the card. least part of the data of said determined badge; and transmission means in said communication means (11) of each access control terminal (10, 20, 30) for transmitting to a chip (40) of a badge replacement data selected via the management module, the management module (12) being arranged to erase at least one data field so as to invalidate a badge (4) by transmission among said replacement data of at least one data field corresponding to the erasure of the badge loss index. Equipment according to claim 13, wherein the badge data comprises profile data representative of a badge usage profile. Equipment according to claim 14, wherein the profile data is at least one of the following information: - the number (s) of one or more authorized sites; - the name of the user; - the apartment number; - the category of the staff or the hierarchical level; - access permissions, - the badge number, - the loss index; - the validity dates; each of these information being intended for a sector (S) specific to the memory (44) of the badge (4) using an associated write or read key. Equipment according to one of claims 13 to 15, wherein a badge encoder apparatus (17) is provided for initializing and personalizing each of the non-contact badges, the encoder apparatus (17) having transmitting means for transmitting into a memory ( 44) of the chip (40) of a badge (4) at least one identification data of the badge (4) and profile data representative of a profile of use of the badge (4). Equipment according to claim 16, in which the badge encoder apparatus (17) comprises an encryption module and is arranged to transmit in the form of an encrypted signature at least one identification data of the badge (4) destined for a memory zone (442) of the contactless badge (4). Equipment according to one of Claims 13 to 17, in which the communication means (11) are connected to the management module (12) for transmitting, via said transmission means, a badge identification request ( 4), and on the other hand receive at least one identification data of a badge (4). Equipment according to claim 17 or 18, wherein the management module (12) comprises decryption and reading means of the type using at least one key to decrypt data of an encrypted sector received by the communication means (11). Equipment according to one of claims 14 to 19, in which interactive means (15) including an input interface are connected to the updating module (13) to enable access data input, the update module ( 13) comprising in memory means (130), for each of the badges (4) managed by the equipment (1), an access data table representative of access authorizations corresponding specifically to defined limits of the equipment (1). Equipment according to one of claims 14 to 20, wherein the update module (13) is provided with storage means (130) for storing a central database gathering for each of the contactless badges (4) information data. badge identification and profile data, said central database being connected to a plurality of access control terminals (10, 20, 30). Equipment according to one of claims 13 to 20, wherein each of the access control terminals (10, 20, 30) comprises a local database (14), the update module being connected to each of said databases (14) local.

Images