Patent Application
20050237957
The present invention relates to the field of actuator remote-control and notably wireless control of actuators employed in home automation systems providing comfort and security in buildings, for example for lighting, opening and closing windows, solar protection, ventilation and air conditioning systems, and so on.
In the current design of such systems, such actuators and/or associated sensors forming command receivers or slave units, are remotely controlled by control units or command points forming command transmitting stations or master units; nevertheless, actuators or sensors and control units are capable of communicating just as well in send as well as in receive mode via a two-way link, typically a radio link. We can then qualify generically such actuators or sensors or control units as “bidirectional objects”. Direct radio frequency communication is also possible between two command transmitting points, as well as between two command receivers. Each element is viewed as a point or a node on the communication network thus constituted. Actuators or sensors are frequently located in areas difficult to access by the installer and even more so by the user.
Control points are one-way or two-way, mobile or fixed. Frequently, a fixed control point is itself battery-powered, which avoids wiring. When a control point is fitted with a transceiver, the receive function may only be activated upon command or intermittently, to limit power consumption.
Matching makes it possible to associate a common identifier to a pair formed by an actuator and a control point. The fact of sharing a common identifier then makes it possible for the actuator to recognize commands originating from the control point in order to respond thereto. Matching can be duplicated in order to control several actuators from a single control point or yet again to get a single actuator to respond to several control points.
In view of the existence of actuators for elements having a closing or locking function it is important for communication between command issuing and receiving points to be authenticated. Each element in the network carries an identifier which is specific to it, plus an identifier specific to the installation, called the “house key” or common key. A description of such a system can be found in International application WO-A-02 47038 or in applicant's International application WO-A-03 081352.
A command issuing point also contains the list of identifiers of several command receivers with which it is matched, in other words to which it is authorized to issue commands, and which are ready to execute such commands. For the sake of simplicity, we shall consider here that the list of identifiers carries all information concerning the control of a particular command receiver by a particular command transmitter. This can consequently also involve an encryption key specific to this pair of elements or any confidential data useful for transmission or execution of a command.
To make it easy for several users to make use of units remote-controlled by command receivers without having to again go through a whole series of individual matching operations, it is necessary to be able to transfer all or part of confidential information (house key, list of identifiers, etc) from a command transmitter already forming part of the network to a new command transmitter.
The prior art discloses various means for direct duplication between command transmitters.
U.S. Pat. No. 4,652,860 discloses a mode of transferring information for remote controls for automobile door opening. Communication between control points is for example by infra-red and over very short distances (control points side-by-side). Transfer is consequently made secure without a hacker some distance away being able to get at the information transmitted and then duplicate it in an identical command transmitter specific to him, without the authorized user being aware. Nevertheless, this solution is costly as it involves communication means that are specific to this single phase of duplicating from one command transmitter to another.
Where it is desired to be able to economically employ one single radio frequency communication means for transferring confidential information or for sending commands to command receivers, it is appropriate to take measures against the danger of the information being received by an ill-intentioned third party. The reception of confidential information at the precise moment where it is being transferred is however infinitely improbable except where a highly sophisticated piece of recording equipment has been hidden within range over a long period of time to collect all the information transmitted over a communication network. Duplication of the information from an old remote-control to a new one is indeed a rare event. Loss or theft of a remote control is, on the contrary, an event which is much more frequent.
International application WO-A-030 81352 proposes reducing the consequences of such violation of security by a procedure for modifying the house key, but this is a remedy and not a preventive measure.
This remedy is nevertheless effective and simple to perform provided loss or theft are quickly detected by the owner of the premises. Knowing this latter fact, a burglar who had managed to hide a command transmitter giving access to the house has every interest in allaying a fear of theft, to avoid the owner changing the house key. Consequently, he will arrange to “return” the command transmitter as rapidly as possible so it will be quickly found, leading it to be believed that it fell from the owner's pocket or got put somewhere else through absent-mindedness.
In the meantime, the burglar has obviously duplicated the confidential codes in a new command transmitter or at least one without any security key, which he obtained from some other source, putting himself in a position to come back, possibly several weeks after the facts when the owner is away. This risk should all the more be taken into consideration seeing that command transmitters operating on the same standard and using the same communication protocol are freely available.
There is consequently always a problem of security when all or part of confidential information is being transferred between bidirectional objects and costs are always involved in such transfer.
To solve this problem, the invention provides a method for transferring information between a first bidirectional command transmitter and a second bidirectional command transmitter, the method comprising the steps of:
The third object may be a command receiver. The command receiver then is responsible for controling an actuator for an openable member such as a door or a blind.
The third object may also be a third command transmitter.
The method can further comprises a prior step in which said third object is designated, during which the third command transmitter issues a command that designates it as being a third object for the remaining command transmitters.
In one embodiment, during said transfer step, part of the information is transferred from the first command transmitter to the second command transmitter via said third object.
Alternatively, all the information can be transferred from the first command transmitter to the second command transmitter during the transfer step.
The method can further comprise a second authentication step. The second authentication step can consists in analysing biometric data of a user, or in analysing a manual action performed by the user, the analysis being for example performed within said third object.
The information that is transferred can be object configuration information such as a common key and/or bidirectional object identifier A communications network is also provided, comprising
A bidirectional command transmitter is also provided, comprising an authentication routine with another bidirectional object and an information transfer routine to another bidirectional command transmitter, said transfer routine only being able to be implemented when said authentication routine has yielded a positive result. The information that is transferred can be object configuration information such as a common key and/or bidirectional object identifier.
The command transmitter can include a memory storing an identifier for the bidirectional object with which said authentication routine is performed.
Other features and advantages of the invention will become more clear from the detailed description that follows of some embodiments provided solely by way of example and with reference to be attached drawings.
We shall describe the invention below on the basis of an example applying to matching in home automation systems; the invention is not limited to such systems. We shall use below the terms “command transmitter” and “command receiver” to designate objects the function of which is to send or receive instructions given by a user; a command transmitter is also commonly called a control unit, while a command receiver is a sensor that controls an actuator for opening something, or operating for example a roller blind. These designations are not representative of “transmitter” or “receiver” functionalities which, from a signal point of view, are capable both of transmitting as well as receiving. This is why we can talk about “bidirectional objects” in other words objects able to transmit and receive. For the sake of clarity of explanation, we shall use the words “transmitter” or “receiver” but these only represent the specific purpose to which a given bidirectional object has been assigned.
A bidirectional object can involve an initialization step adapted to initialize transfer of information to other objects or certain ones of the latter, and an authentication step adapted to authenticate objects that come into contact with said object and a logic unit that runs the initialization and authentication stages. The object also comprises a memory containing the programs implemented in the logic unit and notably the object's operating programs. As explained below, an object's memory can also contain at least one common key; the object can also contain matching information, for example the identifiers of other objects stored in its memory.
Command receiver 10 may also contain information inputting means 104. Such means are for example a push-button or end-of-travel switch, or yet again a proximity detector or another device the function of which in normal operation may differ from the function in a particular matching or programming mode. Not all command receivers of necessity contain the information inputting means 104. We shall see that it is also possible for all command receivers to contain these means.
Finally, command receiver 10 is designed to actuate a load 106 identified as LD #1, to which it is connected by a wire link 105 transmitting command instructions and/or the electrical power necessary for operating the load, such as a roller blind. The power source is not shown, nor are the electrical switching means making it possible to power the load.
Command receiver SL #2, designated by 20, is identical to the preceding one with the sole difference that it does not contain information inputting means. Further, receiver 20 has a different identifier ID #2, located at the second memory location. The first memory location contains the same common key IDM as command receiver SL #1. Command receiver SL #3, identified by 30, is identical to command receiver 10 except for the identifier which is ID #3.
On
By way of example, in this 4th memory location 403 we find identifiers ID #1 and ID #3, in other words command transmitter 40 is adapted to separately or simultaneously control the loads LD #1 and LD #3 via command receivers 10 and 30. Command transmitter 40 is, on the other hand, not programmed to operate on a load LD #2 via command receiver 20, as this command transmitter does not carry identifier ID #2 at location 403. This is clearly just an example of a configuration.
Command transmitter 40 may also contain means 404 for inputting commands, for example a keyboard KB linked to the microcontroller.
We have also shown a second command transmitter MA #X, reference numeral 50, of the same type as the first command transmitter. However, the first command transmitter 40 already belongs to the network whereas the second command transmitter 50 is a new device to be installed on the network. Also, the third memory location 502 and 4th memory location 503 are consequently empty.
For the purposes of describing the invention, we shall suppose that we require to give the second command transmitter identical rights to those of the first.
To avoid this particular type of command transmitter getting mixed up with others, it has a specific shape. It can finally contain a specific keyboard 604 and/or a biometric recognition sensor 605.
Upon receiving this command, command receiver 10, 30 starts a first authentication step SL-S1 where it is determined whether the command to be executed requires authentication. If the answer is yes, receiver 10, 30 chooses a random number CHL that it sends to transmitter 40. Receiver 10, 30 then starts a calculation step SL-S2 of a result, employing a particular algorithm and random number CHL. The particular algorithm is derived from a general algorithm and the house key: it is consequently specific to all the elements belonging to the network. Via
In parallel, upon receiving random number CHL, transmitter 40 starts, in its turn, a calculation step MA-S2 for a result, using the same algorithm and the random number CHL, and the result RES is sent to receiver 10, 30 at the end of calculation step MAE-S2. Upon receiving result RES, the slave unit starts a comparison step SL-S3 RES with its own result. If the two results agree, an acknowledgement ACK is sent to transmitter 40, signifying successful authentication.
In an improved version, the process is repeated in the opposite direction so as to achieve cross-identification. The algorithm can also derive elements previously exchanged between command transmitter and command receiver and thus becomes specific to each pair involved.
In certain circumstances, the authentication process may also only be performed in the reverse manner, in other words it is command transmitter 40 that asks command receiver 10, 30 to authenticate itself, as shown in
The relatively elaborate authentication procedure has little bearing on understanding of the invention, the important thing being that this procedure does sufficiently guarantee the identity of the command transmitter and/or receiver.
The remainder of the procedure will be explained with reference to command receiver 30 as the third party, corresponding to the first embodiment “alternative embodiment 1”. Here, instruction receiver 30 is adapted to receive commands from command transmitter 40.
The process comprises a first authentication step between the first command transmitter 40 and the third bidirectional object 30 such as command receiver 30. This step is performed at S-11 by the first command transmitter 40 and at step S-31 by command receiver 30. This authentication step makes it possible to ensure command receiver 30 is present before information is transferred. This rules out the possibility of transferring information to a bidirectional object that is not authorized. The authentication step can be carried out as per the description accompanying
The procedure then comprises a configuration information CONF transfer step from first receiver 40 to the second object 50. During this step, confidential information concerning the configuration of transmitter 40 is transmitted to transmitter 50 to configure the latter. In
Transfer can involve duplicating or copying information from one object to another. This is the case when several command transmitters are required which will control the network in identical fashion. The transfer of information from one command transmitter to another may also be involved, command transmitter 40 then losing the information transferred and command transmitter 50 becoming the only object able to control the network. This is the case when it is required to have a new command transmitter available, the former one becoming obsolete.
The information can be configuration information for objects on the network. The configuration information makes it possible to recognize the identity of objects (identifier ID ##) and to recognize whether objects belong to a given network (house key or common key IDM). The information transferred is confidential in the sense that it allows control of the network. The information allows for example things to be opened such as roller blinds or garage doors, which typically can give access to a house.
The procedure then comprises a step in which the information is stored in the second command transmitter 50. This step has the effect of making the second command transmitter 50 operational in the sense that it is now matched with command receivers 10, 30 with which the first command transmitter 40 was matched. On
The procedure consequently makes it possible to transfer information from one command transmitter to another in a secure manner. This is advantageous when the user wishes to replace an old command transmitter by a new one as he can himself match the new command transmitter with receivers on the network in a simple manner. The user may also wish to transfer the information in order to match a second command transmitter, allowing two users to control the network. Transmission is at least cost, as the information is transmitted between objects by means already implemented in the object, i.e. by RF and not by implementation of supplementary means such as infra-red.
To improve the efficiency of this first embodiment “alternative embodiment 1” in which a command receiver is employed as a third party, it is preferable for the command receiver 30 to be unique, and provided inside the house. We can for example suppose that only one particular model of command receiver contains the information inputting means 104.
Nevertheless, to avoid having different product references and for preventing the particular command receiver being identifiable, all command receivers may be fitted with such means. In this case, a hardware or software procedure is employed for disenabling the means on command receivers that are accessible from outside the dwelling, or yet again one could disenable the means on all command receivers except one.
One can also avoid this disenabling procedure by registering, on each command transmitter belonging to the network, the identifier of that command receiver which will be employed as the third party. Registration can be done in a specific memory or, as in the case of
We shall now describe the transmission procedure in more detail. In the embodiment of
According to one embodiment, cross-authentication is employed. For this, not only the first command transmitter 40 is authenticated by command receiver 30, but also receiver 30 is authenticated by transmitter 40. This step ensures the presence and the identity of objects belonging to a network. This enhances transfer security.
Advantageously, the procedure also includes a second authentication step. Optionally, this second step is only implemented when the first authentication step has been successful. Indeed, it is advantageous to guarantee the presence of a particular command receiver while, in general, authentication is more specifically designed to validate the identity of a command transmitter. It is consequently possible that, for reasons of simplicity, the protocol employed does not include the reverse and/or cross-authentication functions. As a way of overcoming this shortcoming, and to ensure a supplementary degree of security, a second authentication process is provided for. This is shown at the second authentication step S-32, where a third user action USA3 is tested.
The second authentication step is, depending on the various embodiments, of varying degrees of sophistication. It can involve biometric analysis such as analysis of the user's fingerprint; it can involve analyzing a manual act performed by the user for example using the inputting means of command receiver 30, such as its push-button PB. These analyses are implemented in a simple manner. Preferably, the user operates on the third party object. This ensures that the user will physically act on the latter thereby preventing information transfer at a place where the third party object is not present. This contributes to enhancing security. Depending on the desired degree of security, a user's identification code can even be transmitted by the user using this means, but the simple fact of requiring simple action on a pre-defined command receiver already is sufficient to avoid the majority of the risks discussed above.
At the end of this second authentication step, a second acknowledgment signal ACK2 can be sent by command receiver 32 to the first command transmitter which, after having tested it during the second test step S-13, can declare a transfer valid if the second test is successful (reverse- or cross-authentication and -acknowledgement are possible).
At this stage, shown by a dash-dot horizontal line TRF VALID, the confidential configuration information transfer step can take place. Various embodiments can be envisaged for performing the transfer and storage steps. In a first embodiment shown below the TRF VALID line in
The second embodiment “alternative embodiment 2” of the procedure consists in adopting a command transmitter as the third party. It is completely possible to take a standard type of command transmitter in other words identical to the first or second command transmitter but, preferably, a specific command transmitter MAS as described above is adopted; this is shown in
The procedure is similar to that described with reference to
One advantage of choosing a command transmitter of the particular type is that it avoids having to provide information inputting means on the command receivers, and, generally speaking, it avoids creating an overall cost overhead for the command receivers by optionally adding means allowing a second authentication.
Since a the command transmitter of the particular type MAS is, in principle, unique in the installation, it can include sophisticated elements such as a special keyboard KBS having a greater number of keys than a normal command transmitter, which facilitates the user entering a confidential code, and/or it may include a biometric recognition sensor thereby guaranteeing high security of use.
The use of a command transmitter of the particular type can be implemented after the installation has already been operating in non-secured mode. For example, command transmitters are normally able to be duplicated as in the prior art up to the point where they receive a particular command which can only be issued by a transmitter of the particular type and which will be ignored by the command transmitters of the installation except where the command transmitter of the particular type contains the common key. Upon receiving this particular command, the command transmitters of the installation cease to be able to be duplicated, and become able to be duplicated according to the second alternative embodiment of the invention, the third party being the command transmitter of the particular type which issued the said particular command.
Where a command transmitter of the particular type MAS is employed, it can also be envisaged for the procedure to comprise a prior step in which a third object is designated. During this step, the third command transmitter 60 of the particular type sends a command which designates it as the third object for the other command transmitters 40, 50. This step is particularly advantageous where a command transmitter of the particular type is put into service after the installation has already been operating in a non-secured manner. In this case, the identifier of the third command transmitter is registered in a specific memory or as first identifier stored in the 4th memory 403 of each command transmitter already belonging to the network. It can also be envisaged for the object that acts as the third party to be a “universal” object; this can for example be a programming bidirectional object which is possessed by the seller or the installer, allowing the information transfer procedure to be implemented. Nevertheless, this object is in no case available commercially.
The invention also covers the above communications network comprising the above bidirectional objects, two of the objects being able to be command transmitters. In this network, the information of one of the transmitters can be transferred to the other, with a third object intervening, as described above. One of the command transmitters stores the information received. Transfer is in secured mode within the network.
The invention also covers a bidirectional command transmitter such as transmitter 40. The transmitter may include an information transfer initialization routine. Through this, the object is put into a position to carry out the procedure discussed above. The transmitter comprises an authentication routine with another bidirectional object, allowing the presence and identity of objects participating in the transfer procedure to be checked. Said other object is the third party previously described, which can be a command transmitter or receiver. The transmitter also comprises an information transfer routine to another bidirectional command transmitter, the transfer routine only being able to be implemented when the authentication routine has succeeded or gave a positive result. Further, command transmitter 40 may include a memory 403 that stores an identifier for the bidirectional object with which the authentication routine is implemented.
The transmitter is in particular provided for transmitting information such as a common key or bidirectional object identifier uniquely following the procedure discussed. Further, the routines described above can be part of an operating program for the command transmitter 40.
Obviously, this invention is not limited to the embodiments given above. We have only taken radio transmission between a transmitter and receiver as an example, and this can be modified. The invention applies notably regardless of whether the transmitters and receivers employ a single frequency or each transmit at their own frequency, or employ frequency hopping or with different modulations. The procedure applies whenever the command transmitters or receivers are “bidirectional objects” capable of transmitting and receiving.
One can clearly encode or encrypt the messages or identifiers, using techniques known in the art.
Specific embodiments of method for transmitting information between bidirectional objects according to the present invention have been described for the purpose of illustrating the manner in which the invention may be made and used. It should be understood that implementation of other variations and modifications of the invention and its various aspects will be apparent to those skilled in the art, and that the invention is not limited by the specific embodiments described. It is therefore contemplated to cover by the present invention any and all modifications, variations, or equivalents that fall within the true spirit and scope of the basic underlying principles disclosed and claimed herein.
| Number | Date | Country | Kind |
|---|---|---|---|
| FR 04 03 993 | Apr 2004 | FR | national |
