EP0494472A1

EP0494472A1 - Locks

Info

Publication number: EP0494472A1
Application number: EP91203320A
Authority: EP
Inventors: Evert Nieuwkoop
Original assignee: Chubb Lips Nederland BV
Current assignee: Chubb Lips Nederland BV
Priority date: 1991-01-04
Filing date: 1992-01-01
Publication date: 1992-07-15
Also published as: GB9126846D0; GB9100141D0; GB2251453B; NO920008D0; FI916061A; GB2251453A; NO920008L; FI916061A0

Abstract

A lock has a DC electromechanical actuator (17) for enabling retraction of its bolt in response to the recognition of a correct code input to a microprocessor (22). In order to reduce the possibility of the lock being circumvented by "blowing" the microprocessor by the application of high voltage or heat, to leave a closed circuit to the actuator, an interface circuit is provided comprising at least one solid state switch (T1;T2) controlled by a respective drive circuit (R1,R2,C1,D1; R3,R4,C2,D2) which must be fed with an alternating signal of selected high frequency in order to close the switch and supply power to the actuator.

Description

The present invention relates to locks of the kind which employ a DC electromechanical actuator to effect, or enable, movement of a bolt or other such locking member to its unlocking condition. A great variety of such locks are known, employing diverse forms of code entry and recognition (the details of which do not form part of the present invention) with the ultimate purpose of generating an electrical output for operation of the electromechanical actuator (of which diverse forms are also known) and thereby unlocking the door or other element to which the lock is fitted. Purely by way of example, forms of such lock with which the invention may be employed are described in our copending European patent applications nos 0392596 and 0392597.
An aim of the invention is to enhance the security of a lock of this kind against the effects of attacks upon, or faults in, the circuits through which its electromechanical actuator is energised. By way of example, with electronic locks which employ microprocessors to control the code-recognition and actuator-energisation functions, instances can arise, e.g. by means of the application of high voltage (electrostatic discharge) or heat to the microprocessor, in which the integrated circuits of the processor can be damaged or destroyed so as effectively to leave a closed circuit to the actuator. It might therefore be possible to energise the actuator to unlock the door or the like surreptitiously without having to gain access directly to the actuator (which, it is assumed, will itself be in a physically secure location within the lock structure). Unintentional operation of the lock could also occur in the event of some "innocent" fault which leaves a short circuit to the actuator.
In one aspect the present invention seeks to overcome problems of this nature and accordingly resides in a lock comprising a DC electromechanical actuator to effect, or enable, movement of a bolt or other such locking member to its unlocking condition; processing means for controlling the energisation of said actuator in response to the recognition of a valid code input; and an interface through which the actuator is arranged to be energised under the control of said processing means; said interface including means for the application of a DC voltage across the actuator, switch means associated with at least one terminal of the actuator which are normally in a non-conductive state whereby to prevent energisation of the actuator, and a respective frequency-responsive switch drive circuit associated with the or each said switch means which is adapted to cause the respective switch means to conduct in response to the input of an alternating signal above a selected frequency; the processing means being arranged, upon the recognition of a valid code input, to apply a respective alternating signal to the or each said switch drive circuit of a frequency or frequencies sufficient to cause the corresponding switch means to conduct.
By virtue of the aforesaid interface, irrespective of the condition of the processing means it will not be possible for the DC electromechanical actuator to become energised by the injection of current to any part of the preceding circuitry, unless it is applied as one or more alternating signals of sufficient frequency(ies) to the correct input(s) of the interface corresponding to the aforesaid switch drive circuit(s). This will make it extremely difficult to circumvent the lock by deliberately damaging or destroying the processor or by otherwise attempting to induce an effective energising current into the circuitry from outside, and at the same time of course protects the lock from inadvertent operation in the event of an accidental short circuit to the interface. This interface should itself be in a physically secure location within the lock structure.
In a preferred embodiment there are two said switch means in series with the actuator, each independently controlled by a respective drive circuit. In this way the lock can be protected from inadvertent operation also in the event of any single component failure in the interface itself. It is furthermore preferred in such a case to arrange the switch means and their drive circuits in such a way that the actuator can only be energised if alternating signals of opposite polarity (phase) are applied to the respective inputs of the two drive circuits. This will increase still further the practical difficulty of compromising the lock by an attack upon the electronics. Yet another improvement can be obtained if the interface is provided with means to limit the maximum frequency which can be used to cause energisation of the actuator, i.e. if the switch drive circuit(s) exhibit a bandpass character. It will then only be possible to energise the actuator by applying signal(s) with a frequency falling within a selected narrow band.
An exemplary embodiment of the invention will now be more particularly described with reference to the accompanying drawings, in which:-

Figure 1 shows one example of a lock to which the present invention may be applied;
Figure 2 is an interior view of the lock of Figure 1;
Figures 3A, 3B and 3C are block diagrams illustrating the principle of a security interface circuit for the lock of Figures 1 and 2;
Figure 4 is a circuit diagram of a preferred embodiment of security interface circuit for the lock of Figures 1 and 2; and
Figure 5 indicates typical voltage waveforms at the input and output terminals of the interface circuit of Figure 4 during energisation of the electromechanical actuator.

With reference to Figures 1 and 2 the illustrated lock is of mortice style having a casing 1 and a forend 2 through which extend a deadbolt 3 and a latch bolt 4. Extension and retraction of the dead bolt 3 is in response to rotation in an appropriate sense of an internal thrower 5 having a radial lug 6 which drives the bolt through the agency of a runner 7 moving along an arcuate track, the geometry of the runner/bolt relationship being such as to deadlock the bolt against end pressure when thrown. Retraction of the latch bolt 4 is in response to the turning of a cam 8 by means of external handles (not shown) and is likewise accomplished, via a linkage 9, by rotation of the thrower 5 to withdraw the dead bolt. As thus far described, the mechanism is of conventional design much practised by the present applicants.
Mounted externally to respective sides of the lock case 1 are a pair of cylinder units 10. Each such unit has a rotatable barrel 11 with a keyway 12 and, at its inner end, a drive socket 13 whereby to turn the thrower 5. Associated with the keyway in each cylinder unit 10 are means for transducing a code signal from a proper key when inserted therein. In principle, any known form of electronic key code recognition can be employed although in a preferred embodiment of the illustrated lock code transduction is by way of an inductively-coupled transponder method e.g. as described in International patent application no. W088/03594. In any event, when a coded key is inserted into either keyway 12 its code signal is transmitted via a plug connector 14 in the rear of the cylinder unit and a respective socket 15 in the lock case to a PCB 16 inside the lock which mounts the processing electronics which serve to determine if the key code is valid, and if so the coil of an electromagnet 17 is energised. This electromagnet is the operative part of an electromechanical release mechanism full details of the construction and operation of which are to be found in our copending European patent application no. 0392596. Suffice it to say for the purposes of the present application, while the electromagnet 17 remains de-energised the thrower 5 is blocked by a lever 18 from turning far enough to shift the bolt(s), but when the electromagnet is energised such turning of the thrower is enabled as the lever 18 is cammed away together with another lever 19 upon which the electromagnet is mounted.
Electrical energy for the processor and release mechanism is supplied via a lead 20 from a battery pack (not shown) housed in another mortice in the door.
Additional physical protection for the bolt runner 7, release mechanism 17/18/19 and at least that part 16A of the PCB 16 which mounts the interface circuit described below is provided by hardened steel anti-drill plates 21 located to each side of the lock case 1. The interface circuit on PCB part 16A is directly connected with the electromagnet 17 by a cable (not shown) situated between these anti-drill plates.
Turning to Figure 3A, this shows the operating principle of a security interface circuit disposed between the gate array of the processor 22 on PCB 16 and the electromagnet 17 (actuator) of the release mechanism. This comprises a solid state switch 23 in series with the actuator and an associated switch drive circuit 24 which causes the switch 23 to conduct and energise the actuator only when fed by the processor with an alternating signal of a selected frequency. For greater robustness in terms of security against unauthorised operation and in protecting the lock from inadvertent operation in the event of any single component failure in the interface circuit there are preferably two such switches 23 controlled independently by respective drive circuits 24, as shown in Figure 3B or Figure 3C. Furthermore, it is preferred that the signals required by the two drive circuits 24 in order to close the switches 23 together are of opposite polarity (phase) to increase even further the difficulty of achieving unauthorised energisation of the actuator.
The circuit diagram of a preferred security interface circuit operating in accordance with Figure 3C is shown in Figure 4, the two switch means being constituted by transistors T1 and T2. A DC power supply of typically +5V for energising the magnet 17 is applied across the illustrated GND and VCC lines. In order for this potential difference to appear across the output terminals OUT0 and OUT1 to which the magnet is connected, however, it is necessary to apply two alternating signals in opposite phase to the input terminals IN0 and IN1, as typified in Figures 5A and 5B.
To explain, while no AC signal is applied to IN0 and IN1, the resistors R2 and R4 will determine the base voltages of the transistors T1 and T2 associated with the respective output terminals OUT0 and OUT1, which will be approximately equal to zero and VCC respectively. Therefore neither T1 nor T2 will conduct and the magnet will remain de-energised. When an AC voltage is applied to IN0, however, during the high phase of this signal a current will flow through R1 and C1 into the base of T1, so that during this phase T1 will conduct and therefore force OUT0 to 0 volts. Similarly, when an AC voltage is applied to IN1, during the low phase of the signal T2 will conduct and force OUT1 to VCC volts. Only when T1 and T2 are conducting simultaneously will a potential difference occur across OUT0 and OUT1 so that a current can flow through the magnet 17. Therefore in order to energise the magnet and release the lock the signals at IN0 and IN1 need to be of opposite phase and, of course, of the same frequency. The capacitor C3 across the output terminals is provided to store sufficient charge during conduction of T1 and T2 to maintain the magnet energised during the other phase of the AC signals, i.e. when T1 and T2 are not conducting.
Figures 5C and 5D show typical voltage waveforms at the respective output terminals OUT0 and OUT1, and Figure 5E shows the resultant waveform across those terminals, following the application of the Figures 5A and 5B waveforms to the input terminals IN0 and IN1.
The diodes D1 and D2 are necessary to restore the charge which is fed into the bases of T1 and T2. In the absence of these diodes, T1 and T2 would only conduct during a limited number of cycles of the signals fed into IN0 and IN1. This is because the average voltage at the base of T1 would otherwise decrease and that at the base of T2 would increase until the average base currents of T1 and T2 would become equal to the average currents through R2 and R4 respectively, and would therefore become too small to ensure good conduction of T1 and T2 (R2 and R4 being considered as relatively high ohmic resistors compared to R1 and R3).
It can be shown that if R2 is large compared to R1 then the injected base current of T1 will rapidly decrease with input frequencies below 1/(2π .R1.C1). Similarly, if R4 is large compared to R3 the injected base current of T2 will rapidly decrease with input frequencies below $1/(2π .R3.C2)$
. For input frequencies above approximately ${(Ug/Ub)-1}/{4π.R1.C4}$
the injected base current of both T1 and T2 will also rapidly decrease, where Ug is the voltage at 1NO (5V) and Ub is the voltage at the base of T1 (typically 1.3V). Accordingly, by giving suitable values to R1,R3,C1, C2 and C4 the security interface will show a bandpass behaviour. A possible combination of component values for R1, R2, R3, R4, C1, C2 and C4 could be :-
R1=R3=1KΩ ; R2=R4=100KΩ; C1=C2=22nF; C4=1nF;
leading to a frequency band between approximately 7 and 200 KHz. Outside this band the base current of T1 and T2 will rapidly decrease, and finally become so low that it will no longer be possible to energise the actuator.
If for any reason the circuitry preceding the illustrated security interface circuit becomes defective in such a way that a DC voltage appears at IN0 and IN1, for each combination of DC voltages the capacitors C1 and C2 will serve as DC-blocking elements, so that T1 and T2 will not conduct and the lock will stay in the secure condition.
The security interface circuit is itself protected against high voltages applied to the lock, by the illustrated fuse F and Zener diode D3. If a high voltage should enter the interface via the VCC line, D3 will limit the maximum local supply voltage to a safe level of, say, 7.5V. This Zener diode is preferably a so-called "transient suppressor" which can handle a high current for a short time and with a fast response time. Fuse F, however, which may be in the form of a thin wire on the PCB 16, is aimed to "blow" if the current through D3 due to the high supply voltage remains for a longer period.
It will be appreciated from Figure 4 that the illustrated circuit is symmetrical with a path from IN0 to OUT0 and a path from IN1 to OUT1 which are quite independent. This means that it is itself resistant to single component failures, in the sense that if any one of its components should fail by becoming either a short circuit or open circuit the magnet 17 will not be energised.
In conclusion, the illustrated security interface circuit requires that two input signals of opposite phase and of a frequency within a narrow band must be applied to IN0 and IN1 in order to energise the magnet 17 for opening the lock. It follows that if any of the preceding electronics becomes defective, whether as a result of a deliberate attack or an "innocent" fault, no combination of DC voltages applied to the input terminals, nor AC signals unless of opposite phase and within the correct frequency band, will achieve energisation of the magnet. As previously noted, the interface circuit is itself protected from the effects of high voltages and will remain secure notwithstanding the failure of any one of its own components.

Claims

A lock comprising a DC electromechanical actuator (17) to effect, or enable, movement of a locking member (3) to its unlocking condition; processing means (22) for controlling the energisation of said actuator (17) in response to the recognition of a valid code input; and an interface (16A) through which the actuator is arranged to be energised under the control of said processing means (22); characterised in that said interface (16A) includes means for the application of a DC voltage across the actuator (17), switch means (23) associated with at least one terminal of the actuator (17) which are normally in a non-conductive state whereby to prevent energisation of the actuator (17), and a respective frequency-responsive switch drive circuit (24) associated with the or each said switch means (23) which is adapted to cause the respective switch means (23) to conduct in response to the input of an alternating signal above a selected frequency; the processing means (22) being arranged, upon the recognition of a valid code input, to apply a respective alternating signal to the or each said switch drive circuit (24) of a frequency or frequencies sufficient to cause the corresponding switch means (23) to conduct.
A lock according to claim 1 comprising two said switch means (23) in series with the actuator (17), each independently controlled by a respective said switch drive circuit (24).
A lock according to claim 2 wherein said switch drive circuits (24) are adapted to cause the respective switch means (23) to conduct in response to the respective input of alternating signals of the same frequency but opposite phase to one another.
A lock according to any preceding claim further comprising means (C4) limiting the maximum frequency which will enable a said switch drive circuit (24) to cause the corresponding switch means (23) to conduct.
A lock according to any preceding claim wherein said frequency or frequencies lie within a range up to 200 KHz.