Patent Description:
Lock devices and key devices are evolving from the traditional pure mechanical locks. These days, there are wireless interfaces for electronic lock devices, e.g. by interacting with a key device. For instance, Radio Frequency Identification (RFID), Bluetooth Low Energy (BLE) etc. can be used for the communication between lock device and key device.

However, situations of duress, i.e. threatening situations, can occur. A user can be attacked and forced to open a lock device using a key device in possession.

<CIT> discloses executing commands provided during user authentication. <CIT> discloses a mobile communications device with security features. <CIT> discloses enhanced handling of duress situations. <CIT> discloses coercion-against alarm method, coercion-against alarm device and system using coercion-against alarm device. <CIT> discloses invisible indication of duress via a wearable.

It is an object to provide an efficient way to signal duress from a user being at risk.

According to a first aspect, it is provided a method performed by a key device for supporting duress signalling according to claim <NUM>.

The step of determining that a user is under distress may comprise determining that the user is under distress unless a user input indicating non-distress is detected.

The step of exiting the wait state and establishing a wireless communication channel may be triggered when the key device comes into wireless communication range with the lock device.

The step of determining that a user is under duress may comprise detecting a predetermined movement pattern using an accelerometer in the key device.

The step of determining that a user is under duress may comprise detecting a user interface interaction by the key device.

The step of generating the duress signal may comprise setting a duress indicator in an access control message.

According to a second aspect, it is provided a key device for supporting duress signalling according to claim <NUM>.

The instructions to determine that a user is under distress may comprise instructions that, when executed by the processor, cause the key device to determine that the user is under distress unless a user input indicating non-distress is detected.

The key device may further comprise instructions that, when executed by the processor, cause the key device to trigger the instructions to exit the wait state and establish a wireless communication channel when the key device comes into wireless communication range with the lock device.

The instructions to determine that a user is under duress may comprise instructions that, when executed by the processor, cause the key device to detect a predetermined movement pattern using an accelerometer in the key device.

The instructions to determine that a user is under duress may comprise instructions that, when executed by the processor, cause the key device to detect a user interface interaction by the key device.

The instructions to generate the duress signal may comprise instructions that, when executed by the processor, cause the key device to set a duress indicator in an access control message.

According to a third aspect, it is provided a computer program for supporting duress signalling according to claim <NUM>.

The invention will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

Embodiments presented herein are based on using a communication channel intended for access control communication also for signalling a duress situation.

<FIG> is a schematic diagram showing an environment in which embodiments presented herein can be applied. Access to a physical space <NUM> is restricted by an openable physical barrier <NUM>, which is selectively unlockable. The barrier <NUM> stands between the restricted physical space <NUM> on the inside of the barrier <NUM> and an accessible physical space <NUM> on the outside of the barrier <NUM>. Note that the accessible physical space <NUM> can be a restricted physical space in itself, but in relation to this particular barrier <NUM>, the accessible physical space <NUM> is accessible. In other words, the restricted physical space <NUM> is inside the barrier <NUM> and the accessible physical space <NUM> is outside the physical barrier <NUM>. In order to unlock the barrier <NUM>, a lock device <NUM> is provided. The lock device <NUM> is controllable to be set in an unlocked state or locked state.

The lock device <NUM> communicates with a key device <NUM> over a wireless communication channel <NUM>. The key device <NUM> is any suitable device portable by a user and which can be used for authentication over the wireless communication channel <NUM>. The key device <NUM> is typically carried or worn by the user <NUM> and may be implemented as a mobile phone, a smartphone, a key fob, wearable device, smart phone case, etc. Using wireless communication over the communication channel <NUM>, using any suitable wireless interface, e.g. using Bluetooth or Bluetooth Low Energy (BLE), ZigBee, any of the IEEE <NUM>. 11x standards (also known as WiFi), etc., the authenticity and authority of the key device <NUM> can be checked in an unlock procedure. Based on the result, the lock device <NUM> grants or denies access. As described in more detail below, the communication between the key device <NUM> and the lock device <NUM> can be exploited for also communicating a duress signal.

The lock device <NUM> can also communicate with an external server <NUM> using a communication network <NUM>. The communication network can e.g. form part of the Internet and/or a cellular communication network.

When access is granted, the lock device <NUM> is set in an unlocked state. When the lock device <NUM> is in an unlocked state, the barrier <NUM> can be opened and when the lock device <NUM> is in a locked state, the barrier <NUM> cannot be opened. In this way, access to the inside <NUM> of the barrier <NUM> is controlled by the lock device <NUM>. It is to be noted that the lock device <NUM> can be mounted in a surrounding structure <NUM> (e.g. wall) by the physical barrier <NUM> (as shown) or in the physical barrier <NUM> (not shown).

If the user <NUM> is in a threatening situation, the user <NUM> is said to be under duress. For instance, the user <NUM> could be threatened by an attacker <NUM> to gain access to the restricted physical space <NUM>. A problem is then how the user <NUM> could signal this duress while keeping safe. This is solved according to the embodiments of the method described below.

<FIG> is a flow chart illustrating embodiments of methods for supporting duress signalling, performed in the key device of <FIG>.

In a determine that a user is under duress step <NUM>, the key device determines that a user is under duress.

In one embodiment, the user is under determined to be under distress unless a user input indicating non-distress is detected. In other words, duress is then the default situation and the user needs to perform a certain action to deactivate the duress state. In this way, if the user does not deactivate the duress, duress is assumed and appropriate further measures are taken (e.g. alarming security personnel). With this embodiment, no special signalling is needed for duress (other than the absence of duress deactivation) whereby security for the user under duress is increased, since the attacker does not know that distress is signalled.

In one embodiment, the key device determines that a user is under duress by detecting a predetermined movement pattern using an accelerometer in the key device. For instance, the user can in this way signal duress by moving the key device in a circle, or tapping the key device against a leg a predetermined number of times or using a predetermined pattern, or any other suitable predetermined movement.

Alternatively or additionally, the key device can determine that a user is under duress by detecting a user interface interaction. For instance, the user can in this way signal duress by performing a long press or hard press on a user interface element (such as a button on a touch screen or a hard key). This user interface element is optionally used for regular interaction to unlock the lock device, when the user interacts with this user interface element in a normal (i.e. not hard, long, etc.) way. In this way, it is difficult for the attacker to see that the user is signalling duress, which increases security for the user.

In an enter wait state step <NUM>, the key device enters a wait state after it has been determined that the user is under duress. In this way, the detection of duress can occur in advance to any access control signalling with the lock device. The wait state is a state where the method waits until a trigger causes the key device to exit the wait state.

In an exit wait state and establish communication channel step <NUM>, the key device exits the wait state and establishes a communication channel with a lock device. This step can be triggered when the key device comes into communication range with the lock device. Alternatively or additionally, this step can be triggered by receiving a user input indicating that the user requests the lock device to be unlocked. By using the wait state and only exiting the wait state when access control is triggered, the duress determination can occur in advance to requesting access, i.e. seconds or minutes prior to requesting access. In this way, when access is requested, if the user is under duress, the user does not need to do anything out of the ordinary to signal duress, which might otherwise raise suspicion with the attacker and compromise personal security for the user under duress. The communication channel is intended to be used (also) for access control signalling.

In a generate duress signal step <NUM>, the key device generates a duress signal. The duress signal can be a separate signal or the duress signal can be a duress indicator (e.g. a flag or parameter value) in an access control message. When the duress signal is a duress indicator in the access control message, signalling is reduced. The access control message can e.g. be a message to request access or a message used in the access control procedure as known in the art per se. It is to be noted that this step can equally well be performed before step <NUM> or even before step <NUM>.

In a transmit duress signal step <NUM>, the key device transmits, over the communication channel, the duress signal to the lock device. By using the communication channel, which is used for regular access control also, existing structures are used for the duress signalling. This improves reliability of the duress signalling, since the person threatening the user of course needs the user to unlock the lock device to enter the restricted physical space. In other words, the communication channel which is necessary for unlocking the lock device is also used for signalling duress.

After, or combined with, step <NUM>, the key device communicates with the lock device for access control signalling as known in the art per se.

For instance, the access control can be based on delegations, where, when the key device is presented for a lock device, the lock device checks that there is a valid delegation path from the lock device to the key device. The delegation path contains a plurality of chain linked delegations which starts in the lock device and ends in the key device. Each delegation is a delegation of an access right for the lock device from a delegator to a receiver. The delegation path can contain delegation(s) being locally stored by the lock device and delegation(s) communicated from the key device. The delegation path can contain an arbitrary number of delegations. Some or all delegations can be authenticated using a digital signature.

Using the delegation path, great flexibility is achieved in how access rights are provided. Since no central point of control is needed, massive scalability is achieved. Moreover, there is no single point of failure, which improves reliability.

<FIG> is a flow chart illustrating embodiments of unclaimed methods for supporting duress signalling, performed in the lock device of <FIG>.

In an establish communication channel step <NUM>, the lock device establishes a communication channel with a key device, the communication channel being intended to be used (also) for access control signalling. This step corresponds to step <NUM> described above.

In a receive duress signal step <NUM>, the lock device receives, over the communication channel, a duress signal from the lock device. This step corresponds to step <NUM> described above.

In a perform duress action step <NUM>, the lock device performs a duress action. The duress action can comprise transmitting a duress signal to an external server, without triggering an audible alarm. The external server can e.g. be a server of an alarm company, the employer of the user, etc. In other words, the duress action can be used to signal a threatening situation to the external server, which can trigger a response, e.g. to send someone to help the user.

<FIG> is a schematic diagram illustrating components of the unclaimed lock device <NUM> and the key device <NUM> of <FIG>. A processor <NUM> is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions <NUM> stored in a memory <NUM>, which can thus be a computer program product. The processor <NUM> could alternatively be implemented using an ASIC, FPGA, etc. The processor <NUM> can be configured to execute the method described with reference to <FIG> (for the key device <NUM>) and <FIG> (for the lock device <NUM>) above.

The memory <NUM> can be any combination of random access memory (RAM) and/or read only memory (ROM).

An I/O interface <NUM> is provided for communicating with external and/or internal entities. Optionally, the I/O interface <NUM> also includes a user interface.

Other components are omitted in order not to obscure the concepts presented herein.

<FIG> shows one example of a computer program product <NUM> comprising computer readable means. On this computer readable means, a computer program <NUM> can be stored, which computer program can cause a processor to execute a method according to embodiments described herein. In this example, the computer program product is an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu-Ray disc. As explained above, the computer program product could also be embodied in a memory of a device, such as the computer program product <NUM> of <FIG>. While the computer program <NUM> is here schematically shown as a track on the depicted optical disk, the computer program can be stored in any way which is suitable for the computer program product, such as a removable solid state memory, e.g. a Universal Serial Bus (USB) drive.

<FIG> is a schematic diagram illustrating units of the key device <NUM> of <FIG> according to one embodiment. The units are implemented using circuits adapted for the functionality described herein. For instance, the units can be implemented using any one or more of an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), a processor or discrete logical circuits.

A determining unit <NUM> is configured to determine when a user is under duress. In one embodiment, the determining unit <NUM> determines that a user is under duress by detecting a predetermined movement pattern using an accelerometer <NUM> in the key device. For instance, the user can in this way signal duress by moving the key device in a circle, or tapping the key device against a leg a predetermined number of times or using a predetermined pattern, or any other suitable predetermined movement.

Alternatively or additionally, the determining unit <NUM> can determine that a user is under duress by detecting a user interface interaction. For instance, the user can in this way signal duress by performing a long press or hard press on a user interface element (such as a hard key or a button on a touch screen) of a user interface <NUM>. This user interface element is optionally used for regular interaction to unlock the lock device, when the user interacts with this user interface element in a normal (i.e. not hard, long, etc.) way. In this way, it is difficult for the attacker to see that the user is signalling duress, which increases security for the user.

A generating unit <NUM> is configured to generate a duress signal. The duress signal can be a separate signal or the duress signal can be a duress indicator (e.g. a flag or parameter value) in an access control message. When the duress signal is a duress indicator in the access control message, signalling is reduced. The access control message can e.g. be a message to request access or a message used in the access control procedure as known in the art per se.

A wireless communication unit <NUM> is configured to establish a communication channel with a lock device. The communication channel is intended to be used (also) for access control signalling. The wireless communication unit <NUM> can employ any suitable wireless communication standard in the communication with the lock device. For instance Bluetooth or Bluetooth Low Energy (BLE), ZigBee, any of the IEEE <NUM>. 11x standards (also known as WiFi), etc..

The wireless communication unit <NUM> is further configured to transmit, over the communication channel, the duress signal to the lock device. By using the communication channel, which is used for regular access control also, existing structures are used for the duress signalling. This improves reliability of the duress signalling, since the person threatening the user of course needs the user to unlock the lock device to enter the restricted physical space. In other words, the communication channel which is necessary for unlocking the lock device is also used for signalling duress.

A user interface unit <NUM> comprises one or more components for providing a user interface. For instance, the user interface unit <NUM> can comprise a display, optionally a touch screen, physical buttons, microphone, speaker, etc. The user interface unit <NUM> received input from the user <NUM> and provides output to the user <NUM>.

The key device <NUM> is also configured to communicate with the lock device for access control signalling as known in the art per se. For instance, the access control can be based on delegations, where, when the key device is presented for a lock device, the lock device checks that there is a valid delegation path from the lock device to the key device. The delegation path contains a plurality of chain linked delegations which starts in the lock device and ends in the key device. Each delegation is a delegation of an access right for the lock device from a delegator to a receiver. The delegation path can contain delegation(s) being locally stored by the lock device and delegation(s) communicated from the key device. The delegation path can contain an arbitrary number of delegations. Some or all delegations can be authenticated using a digital signature.

Other components of the key device <NUM> are omitted in order not to obscure the concepts presented herein.

<FIG> is a schematic diagram illustrating units of the unclaimed lock device <NUM> of <FIG> according to one embodiment. The units are implemented using circuits adapted for the functionality described herein. For instance, the units can be implemented using any one or more of an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), a processor or discrete logical circuits.

A wireless communication unit <NUM> is configured to establish a communication channel with a key device, the communication channel being intended to be used (also) for access control signalling.

The wireless communication unit <NUM> is further configured to receive, over the communication channel, a duress signal from the lock device.

An action determining unit <NUM> is configured to performs a duress action when a duress signal has been received (by the wireless communication unit <NUM>). The duress action can comprise transmitting a duress signal to an external server, without triggering an audible alarm. The external server can e.g. be a server of an alarm company, the employer of the user, etc. In other words, the duress action can be used to signal a threatening situation to the external server, which can trigger a response, e.g. to send someone to help the user.

By using the communication channel, which is used for regular access control also, existing structures are used for the duress signalling. This improves reliability of the duress signalling, since the person threatening the user of course needs the user to unlock the lock device to enter the restricted physical space. In other words, the communication channel which is necessary for unlocking the lock device is also used for signalling duress.

The lock device <NUM> is also configured to communicate with the key device <NUM> for access control signalling as known in the art per se. For instance, the access control can be based on delegations, where, when the key device is presented for a lock device, the lock device checks that there is a valid delegation path from the lock device to the key device. The delegation path contains a plurality of chain linked delegations which starts in the lock device and ends in the key device. Each delegation is a delegation of an access right for the lock device from a delegator to a receiver. The delegation path can contain delegation(s) being locally stored by the lock device and delegation(s) communicated from the key device. The delegation path can contain an arbitrary number of delegations. Some or all delegations can be authenticated using a digital signature.

Claim 1:
A method performed by a key device (<NUM>) for supporting duress signalling, the key device being portable and usable for authentication over a wireless communication channel with a lock device, the method comprising the steps of:
determining (<NUM>) that a user (<NUM>) is under duress;
entering (<NUM>) a wait state after the step of determining (<NUM>) that a user (<NUM>) is under duress;
exiting (<NUM>) the wait state and establishing a wireless communication channel (<NUM>) with a lock device (<NUM>), the wireless communication channel being intended to be used for access control signalling;
generating (<NUM>) a duress signal;
transmitting (<NUM>), over the wireless communication channel (<NUM>), the duress signal to the lock device (<NUM>); and
wherein the step of exiting (<NUM>) the wait state and establishing a wireless communication channel is triggered by receiving a user input indicating that the user requests the lock device to be unlocked to gain access to a restricted physical space.