Patent Description:
Locks and keys are evolving from the traditional pure mechanical locks. These days, electronic locks are becoming increasingly common. For electronic locks, no mechanical key profile is needed for authentication of a user. The electronic locks can e.g. be opened based on a PIN (Personal Identification Number) code and/or an electronic key stored on a special carrier (fob, card, etc.) or in a smartphone. The electronic key and electronic lock can e.g. communicate over a wireless interface. Such electronic locks provide a number of benefits, including improved flexibility in management of access rights, audit trails, key management, etc..

For current electronic locks, a credential, e.g. in the form of a PIN code or electronic key being a card, a wearable device or smartphone, can be used for authentication. However, such credentials can be learned or stolen by an attacker to thereby gain access to the physical space secured by the electronic lock.

In the solutions available today, when an attacker gains access to the credential, the original owner of the credential needs to inform the lock of this breach of security, to e.g. blacklist the compromised credential. However, the original user may not even be aware of the attacker's possession of the credential. <CIT> and <CIT> are relevant prior art documents.

One object is to improve security for electronic locks when a credential has been compromised.

According to a first aspect, it is provided a method for controlling access to a physical space secured by an electronic lock. The method is performed in an access evaluator and comprises: obtaining one or more input parameters relating to a user requesting access to the restricted physical space; evaluating a first access condition based on a credential presented by the user; evaluating a second access condition using a machine-learning model, based on the one or more input parameters; unlocking the electronic lock when both the first access condition and the second access condition are evaluated to be true; evaluating a third access condition when the first access condition is evaluated to be true and the second access condition is evaluated to be false; unlocking the electronic lock when both the first access condition and the third access condition are evaluated to be true; and training the machine learning model with the one or more input parameters when both the first access condition and the third access condition are evaluated to be true.

The one or more input parameters may include an input parameter based on detecting body movement of the user.

The one or more input parameters may include an input parameter based on how the user presents the credential for the evaluation of the first access condition.

The one or more input parameters may include an input parameter based on how a PIN, personal identification number, code is entered, in which case the first access condition is evaluated based on the entered PIN code.

The one or more input parameters may include an input parameter based on a duration between the user stops and when the PIN code is entered.

The one or more input parameters may include an input parameter based on a distance to the user detected by a distance sensor mounted in proximity to the electronic lock.

The one or more input parameters may include an input parameter based on a time of day of the user requesting access.

The evaluating a first access condition may comprise evaluating an electronic key presented by the user.

According to a second aspect, it is provided an access evaluator for controlling access to a physical space secured by an electronic lock. The access evaluator may comprise: a processor; and a memory storing instructions that, when executed by the processor, cause the access evaluator to: obtain one or more input parameters relating to a user requesting access to the restricted physical space; evaluate a first access condition based on a credential presented by the user; evaluate a second access condition using a machine-learning model, based on the one or more input parameters; and unlock the electronic lock when both the first access condition and the second access condition are evaluated to be true; evaluate a third access condition when the first access condition is evaluated to be true and the second access condition is evaluated to be false; unlock the electronic lock when both the first access condition and the third access condition are evaluated to be true; and train the machine learning model with the one or more input parameters when both the first access condition and the third access condition are evaluated to be true.

The instructions to evaluate a first access condition may comprise instructions that, when executed by the processor, cause the access evaluator to evaluate an electronic key presented by the user.

According to a third aspect, it is provided a computer program for controlling access to a physical space secured by an electronic lock, the computer program comprising computer program code which, when executed on an access evaluator causes the access evaluator to: obtain one or more input parameters relating to a user requesting access to the restricted physical space; evaluate a first access condition based on a credential presented by the user; evaluate a second access condition using a machine-learning model, based on the one or more input parameters; and unlock the electronic lock when both the first access condition and the second access condition are evaluated to be true; evaluate a third access condition when the first access condition is evaluated to be true and the second access condition is evaluated to be false; unlock the electronic lock when both the first access condition and the third access condition are evaluated to be true; and train the machine learning model with the one or more input parameters when both the first access condition and the third access condition are evaluated to be true.

<FIG> is a schematic diagram illustrating an environment in which embodiments presented herein can be applied. Access to a physical space <NUM> is restricted by an openable physical barrier <NUM> which is selectively unlockable. The physical barrier <NUM> stands between the restricted physical space <NUM> and an accessible physical space <NUM>. Note that the accessible physical space <NUM> can be a restricted physical space in itself, but in relation to this physical barrier <NUM>, the accessible physical space <NUM> is accessible. The barrier <NUM> can be a door, gate, hatch, cabinet door, drawer, window, etc. An electronic lock <NUM> is provided in order to control access to the physical space <NUM>, by selectively unlocking the barrier <NUM>.

The electronic lock <NUM> can be provided in a structure <NUM> (such as a wall) surrounding the barrier <NUM> (as shown) or the electronic lock <NUM> can be provided in the barrier <NUM> itself (not shown). The electronic lock <NUM> is controllable to be in a locked state or in an unlocked state.

A first access condition is evaluated based on a credential presented by the user. The credential can e.g. be a PIN code entered by the user <NUM> and/or an electronic key <NUM> presented by the user. The PIN code can be a sequence of digits, entered on a keypad. Alternatively or additionally, the credential is based on biometrics, such as fingerprint detection or iris detection. When the credential is an electronic key <NUM>, the electronic lock <NUM> is able to receive and send signals from/to the electronic key <NUM> over a communication channel which may be a short-range wireless interface. Optionally, the electronic lock <NUM> comprises a separate unit, also known as an access control reader, for communicating with the electronic key <NUM> and evaluating access. The electronic key <NUM> is implemented using any suitable device that is portable by a user <NUM> and which can be used by the electronic lock <NUM> as the first access condition used in evaluating whether to grant access or not, by communicating over the communication channel. The electronic key <NUM> can comprise digital cryptographic keys for electronic authentication. The electronic key <NUM> can be carried or worn by a user <NUM> and may be implemented as a smartphone, wearable device, key fob, smartcard (RFID and/or galvanic), etc..

The communication interface between the electronic key <NUM> and the electronic lock <NUM> can be a radio frequency wireless interface and could e.g. employ ultra-wideband (UWB), Bluetooth, Bluetooth Low Energy (BLE), ZigBee, Radio Frequency Identification (RFID), any of the IEEE <NUM> standards, any of the IEEE <NUM> standards, wireless Universal Serial Bus (USB), etc. Alternatively, the communication interface is based on a galvanic connection. Using the communication channel, the identity of the electronic key <NUM> can be obtained and the first access condition can be evaluated.

A sensor <NUM> is optionally provided by the electronic lock <NUM>. The sensor <NUM> is used to generate one or more input parameters relating to a user <NUM> requesting access to the restricted physical space <NUM>. The one or more input parameters are used in a machine learning model to evaluate a second access condition. The result (or prediction) of the machine learning model forms the second access condition which is used to evaluate whether access is to be granted and the electronic lock is to be unlocked.

This access process is coordinated by an access evaluator. As shown in <FIG> and described below, the access evaluator can be provided as part of the electronic lock <NUM>, a server <NUM> or as a stand-alone device.

The access evaluator has access to a machine-learning model. The access evaluator can comprise the machine-learning model or the machine-learning model can be provided in a separate device in communication with the access evaluator.

The machine-learning model is thus used to evaluate the second access condition. The one or more input parameters can be any suitable input parameter(s) relating to the user requesting access. For instance, a sensor <NUM> can be used to capture data relating to the user <NUM> when requesting access. The sensor <NUM> can e.g. be any one or more of a camera, lidar, distance sensor, proximity sensor, microphone to capture data of the user, optionally also based on duration. The one or more input parameters can also include time, e.g. current time and/or day from a clock, or how credentials (e.g. PIN code) are presented.

Using the one or more input parameters, detected characteristic behaviour of the user <NUM> is used by the machine-learning model to evaluate the second access condition. Optionally, the second access condition is a combination of separate sub-conditions, e.g. relating to different sets of input parameters and/or different machine-learning models of the same parameters.

Using the machine-learning model and the one or more input parameters, the evaluation of the second access condition can e.g. be based on an input parameter detecting body movement of the user and/or how a PIN code is entered, e.g. the duration between the user stopping and when the PIN code is entered. Alternative or additional input parameters include distance to the user <NUM>, or time of day that the user requests access.

When both the first and second access conditions are true, the access control by access evaluator results in granted access, and the electronic lock <NUM> is set in an unlocked state. When the electronic lock <NUM> is in the unlocked state, the barrier <NUM> can be opened and when the electronic lock <NUM> is in a locked state, the barrier <NUM> cannot be opened. In this way, access to a restricted space <NUM> is effected by the electronic lock <NUM>.

The electronic lock <NUM> optionally contains communication capabilities to connect to a server <NUM> via a communication network <NUM>. The communication network <NUM> can be a wide area network, such as the Internet. The server <NUM> can be implemented in a single computer or in multiple computers, also known as being in the cloud.

<FIG> are schematic diagram illustrating embodiments of where the access evaluator <NUM> can be implemented.

In <FIG>, the access evaluator <NUM> shown as implemented in the electronic lock. The electronic lock is thus the host device for the access evaluator <NUM> in this implementation. This allows for short latency for communication since the communication is local.

In <FIG>, the access evaluator <NUM> shown as implemented in the server <NUM>, also known as in the cloud. The server is thus the host device for the access evaluator <NUM> in this implementation.

In <FIG>, the access evaluator <NUM> is shown as implemented as a stand-alone device. The access evaluator <NUM> thus does not have a host device in this implementation. The access evaluator <NUM> can be provided in proximity to the electronic lock or in any other suitable location.

<FIG> is a flow chart illustrating embodiments of methods for controlling access to a physical space. The methods are performed in the access evaluator.

In an obtain input parameter(s) step <NUM>, the access evaluator obtains one or more input parameters relating to a user requesting access to the restricted physical space.

In an evaluate first access condition step <NUM>, the access evaluator evaluates a first access condition based on a credential presented by the user. For instance, the credential can be a PIN code entered by the user and/or an electronic key presented by the user and/or biometrics of the user. It is to be noted that this step can be performed after the evaluate second access condition step <NUM> or before the obtain input parameter(s) step <NUM>.

In an evaluate second access condition step <NUM>, the access evaluator evaluates a second access condition using a machine-learning model, based on the one or more input parameters.

In one embodiment, the one or more input parameters include an input parameter based on detecting body movement of the user, e.g. detected by a sensor in the form of a camera and/or lidar. This can be used by a machine-learning model e.g. to detect a posture or gait associated with the user.

In one embodiment, the one or more input parameters include an input parameter based on how the user presents a credential for the evaluation of the first access condition. For instance, the one or more input parameters can include an input parameter based on how a PIN code is entered, and wherein the first access condition is evaluated based on the entered PIN code. For example, the one or more input parameters can include an input parameter based on a duration between the user stops and when the PIN code is entered. This can be one characteristic used to evaluate the second access condition.

In one embodiment, the one or more input parameters include an input parameter based on a distance to the user detected by a distance sensor mounted in proximity to the electronic lock. This distance over time to the user can then be used to evaluate the second access condition.

In one embodiment, the one or more input parameters include an input parameter based on a time of day of the user requesting access.

Two or more input parameters can be used in a single machine-learning model, e.g. to evaluate distance to the user over time, combined with the delay until the user presents the credential (e.g. as a PIN code or an electronic key). In one embodiment, the machine-learning model considers delay between individual key presses when the PIN code is entered to determine the second access condition indicating if the user is a legitimate user.

The machine-learning model used is associated with a particular user, which can be identified e.g. using the credential used in step <NUM>.

Other types of situations for the user that the machine-learning model can be trained to include in the second access condition include usual times of access requests for the electronic lock, frequency of access requests for the electronic lock, group of users visiting at the same time, duration of entering the credential (e.g. PIN code), type of credential used (if several credential types are supported).

The machine-learning model can be pre-trained with data collected through surveys, research and/or from previous implementation. The data can be classified based on various parameters like age, height of user, gender, type of premises, accessibility to lock etc. This pre-trained model can thus serve as an initial user-specific model based on the characteristics of the user. As explained below, the machine-learning model can then be improved and tailored for the user based on the one or more input parameters obtained for the user.

Optionally, the second access condition is a combination of separate sub-conditions, e.g. relating to different sets of input parameters and/or different machine-learning models of the same parameters.

In a conditional <NUM>st and <NUM>nd access conditions true step <NUM>, the access evaluator determines whether both the first access condition and the second access condition are evaluated to be true. When this is the case, the method proceeds to an unlock step <NUM>. Otherwise, the method ends, or, in one embodiment, proceeds to an evaluate <NUM>rd access condition step <NUM>.

In the unlock step <NUM>, the electronic lock is unlocked. This can be implemented by transmitting an unlock signal to the electronic lock.

In the evaluate 3rd access condition step <NUM>, the access evaluator evaluates a third access condition. The third access condition can e.g. be biometric data, a one-time password transmitted to a mobile, a PIN code (if the second condition is not based on PIN code), etc..

In an optional conditional <NUM>nd and <NUM>rd access conditions true step <NUM>, the access evaluator determines whether both the first access condition and the third access condition are evaluated to be true. When this is the case, the method proceeds to a unlock step <NUM>. Otherwise, the method ends. By using the third access condition, a legitimate user can still gain access if the machine-learning based second access condition for some reason is negative.

In the unlock step <NUM>, the access evaluator unlocks the electronic lock. This can be implemented in the same way as the previously mentioned unlock step <NUM>.

In an train model step <NUM>, the access evaluator trains the machine learning model with the one or more input parameters when both the first access condition and the third access condition are evaluated to be true. Since the third access condition is true in this case, it is considered that the user is a legitimate user. Hence, the second access condition was incorrectly determined to be false. This incorrect evaluation (of the machine learning model) thus constitutes a valuable training condition, where the machine-learning model is trained in step <NUM> to reduce the risk of the same type of incorrect false first condition evaluation to occur in the future.

Using the training, the system adapts to each user. Over time this results in a convenient yet secure system, where only deviations in the machine-learning model based second access condition (based on the machine-learning model) requires evaluation of the third access condition. An attacker is likely to fail the second access condition evaluation which is trained and tailored for the specific user using steps <NUM> and <NUM>. Moreover, since the training is performed based on these conditions evaluated by the access evaluator, no manual involvement in the training is needed, ensuring that the training occurs and in an efficient manner.

Using embodiments presented herein, if an attacker is able to force a positive evaluation of the first access condition, e.g. by learning the PIN code or stealing the electronic key, the attacker is likely prevented from gaining access, since the attacker is likely to fail the evaluation of dynamic access policy. Additionally, the embodiments presented herein prevent access by an attacker without the legitimate user needing to inform the access system; the evaluation of the second access condition will likely prevent the attack in any case. This is of a great use, since the legitimate user may not be aware of the attacker gaining access to the credential, e.g. by stealing a bag or learning a PIN code by watching the user entering the PIN code.

<FIG> is a schematic diagram illustrating components of the access evaluator of <FIG>. It is to be noted that one or more of the mentioned components can be shared with the host device. A processor <NUM> is provided using any combination of one or more of a suitable central processing unit (CPU), graphics processing unit (GPU) , multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions <NUM> stored in a memory <NUM>, which can thus be a computer program product. The processor <NUM> could alternatively be implemented using an application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc. The processor <NUM> can be configured to execute the method described with reference to <FIG> above.

The access evaluator further comprises an I/O interface <NUM> for communicating with external and/or internal entities. Optionally, the I/O interface <NUM> also includes a user interface.

Other components of the access evaluator are omitted in order not to obscure the concepts presented herein.

<FIG> shows one example of a computer program product <NUM> comprising computer readable means. On this computer readable means, a computer program <NUM> can be stored, which computer program can cause a processor to execute a method according to embodiments described herein. In this example, the computer program product is in the form of a removable solid-state memory, e.g. a Universal Serial Bus (USB) drive. As explained above, the computer program product could also be embodied in a memory of a device, such as the computer program product <NUM> of <FIG>. While the computer program <NUM> is here schematically shown as a section of the removable solid-state memory, the computer program can be stored in any way which is suitable for the computer program product, such as another type of removable solid-state memory, or an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a Blu-Ray disc.

Here now follows a list of embodiments, enumerated with roman numerals.

Claim 1:
A method for controlling access to a physical space (<NUM>) secured by an electronic lock (<NUM>), the method being performed in an access evaluator (<NUM>) and comprising:
obtaining (<NUM>) one or more input parameters relating to a user requesting access to the restricted physical space;
evaluating (<NUM>) a first access condition based on a credential presented by the user;
evaluating (<NUM>) a second access condition using a machine-learning model, based on the one or more input parameters;
unlocking (<NUM>) the electronic lock when both the first access condition and the second access condition are evaluated to be true
evaluating (<NUM>) a third access condition when the first access condition is evaluated to be true and the second access condition is evaluated to be false;
unlocking (<NUM>) the electronic lock when both the first access condition and the third access condition are evaluated to be true; and
training (<NUM>) the machine learning model with the one or more input parameters when both the first access condition and the third access condition are evaluated to be true.