Secured method for controlling the opening of lock devices from messages implementing a symmetrical encryption
A management site ( 10 ) generates an encrypted message by a public-key symmetrical encryption algorithm, the algorithm and the key being selected by the management site among a memorized list. The message (DKE), which includes an identifier of the encryption algorithm and key used, is transmitted to a portable device ( 16 ), which stores it. For the use, the message is transmitted to a secured module ( 20 ) that decrypts it, checks its compliance with an internal reference, and generates a digital accreditation controlling the unlocking of a lock device ( 18 ). The decryption is operated with the algorithm and the key recognized based on the identifiers of the message, selected among a list memorized by the secured module.
1. A method in secured module comprising a lock device, the method comprising:
during an initialization operation of the secure module, storing plural encryption algorithms and plural encryption keys in a memory of the secure module but not in a portable device;
during a lock management operation:
wirelessly receiving from the portable device a message comprising digital data encrypted at a management site by a management site-selected one of the plural encryption algorithms and with a management site-selected one of the plural encryption keys, the message comprising:
(1) an indicator of an encryption method which refers to the management site-selected one of the plural encryption algorithms;
(2) an encryption key which is the management site-selected one of the plural encryption keys; and
(3) the encrypted digital data;
using the indicator to select among the plural encryption algorithms a selected encryption algorithm which is the management site-selected one of the plural encryption algorithms;
applying the encryption key to the selected encryption algorithm to perform a decryption of the encrypted digital data so that the decryption is performed at the secure module and not at the portable device; and,
managing the lock device in accordance with the message;
the secured module receiving plural messages from the portable device, with each of the plural messages including a sequence number which differs from the sequence number of its successor,
the secured module checks conformity of the received messages using the sequence number and a counter maintained by the secured module; and
wherein the secured module is connected to plural lock devices, and wherein the method further comprises receiving plural sequence numbers for each of the plural lock devices.
2. The method of claim 1 , wherein the lock management operation comprises a lock opening operation, and wherein managing the lock device comprises opening the lock device.
3. The method of claim 1 , further comprising during the lock management operation obtaining from the encrypted digital data information for updating the plural encryption keys stored in the memory.
4. The method of claim 3 , further comprising using the information to replace existing encryption keys stored in the memory.
5. The method of claim 1 , further comprising using the information to add new encryption keys to existing encryption keys stored in the memory.
6. The method of claim 1 , wherein the information obtained from the encrypted digital data comprises new encryption keys.
7. The method of claim 1 , wherein the information obtained from the encrypted digital data comprises an identifier of a function; and wherein the method further comprises using the function to modify existing encryption keys stored in the memory to obtain new encryption keys.
8. The method of claim 1 , further comprising the secured module receiving plural messages from respective plural portable devices, with each of the sequence numbers including an indication of the respective one of the plural portable devices with which it is associated.
9. A secured module for use with a lock device, the secured module comprising:
a memory configured to storing plural encryption algorithms and plural encryption keys during an initialization operation of the secure module;
a receiving circuit configured to wirelessly communicate with a portable device which does not store the plural encryption algorithms and plural encryption keys and to receive from the portable device a message comprising digital data encrypted at a management site by a management site-selected one of the plural encryption algorithms and with a management site-selected one of the plural encryption keys, the message comprising:
(1) an indicator of an encryption method which refers to the management site-selected one of the plural encryption algorithms;
(2) an encryption key which is the management site-selected one of the plural encryption keys; and
(3) the encrypted digital data;
a controller configured, during a lock management operation:
to use the indicator to select among the plural encryption algorithms a selected encryption algorithm which is the management site-selected one of the plural encryption algorithms;
to apply the encryption key to the selected encryption algorithm to perform a decryption of the encrypted digital data so that the decryption is performed at the secure module and not at the portable device;
to manage the lock device in accordance with the message;
to receive plural message from the portable device, with each of the plural messages including a sequence number which differs from the sequence number of its successor, and
to check conformity of the received messages using the sequence number and a counter maintained by the secured module; and
wherein the secured module is connected to plural lock devices, and wherein the controller is further configured to receive plural sequence numbers for each of the plural lock devices.
10. The secured module of claim 9 , wherein the lock management operation comprises a lock opening operation, and during the lock opening operation the controller is configured to open the lock device.
11. The secured module of claim 9 , wherein during the lock management operation the controller is configure to obtain from the encrypted digital data information for updating the plural encryption keys stored in the memory.
12. The secured module of claim 11 , wherein the controller is configured to use the information to replace existing encryption keys stored in the memory.
13. The secured module of claim 9 , wherein the controller is further configured to use the information to add new encryption keys to existing encryption keys stored in the memory.
14. The secured module of claim 9 , wherein the information obtained from the encrypted digital data comprises new encryption keys.
15. The secured module of claim 9 , wherein the information obtained from the encrypted digital data comprises an identifier of a function; and wherein the controller is further configured to use the function to modify existing encryption keys stored in the memory to obtain new encryption keys.
16. The secured module of claim 9 , wherein the controller is further configured to receive plural messages from respective plural portable devices, with each of the sequence numbers including an indication of the respective one of the plural portable devices with which it is associated.