Abstract: Methods (500) of a network node (111) for creating and joining secure sessions for members (111-114) of a group of network nodes are provided. The methods comprise receiving an identity certificate and an assertion for the network node as well as a secret group key for the group. The method for creating a session further comprises creating (501) a session identifier and a secret session key for the session, and sending (502) an encrypted and authenticated broadcast message comprising the session identifier. The method for joining a session further comprises sending an encrypted and authenticated discovery message comprising the identity certificate and the assertion, and receiving an encrypted and authenticated discovery response message from another network node which is a member of the group. The disclosed combined symmetric key and public key scheme is based on the availability of three credentials at each node, i.e.

Abstract: Methods (500) of a network node (111) for creating and joining secure sessions for members (111-114) of a group of network nodes are provided. The methods comprise receiving an identity certificate and an assertion for the network node as well as a secret group key for the group. The method for creating a session further comprises creating (501) a session identifier and a secret session key for the session, and sending (502) an encrypted and authenticated broadcast message comprising the session identifier. The method for joining a session further comprises sending an encrypted and authenticated discovery message comprising the identity certificate and the assertion, and receiving an encrypted and authenticated discovery response message from another network node which is a member of the group. The disclosed combined symmetric key and public key scheme is based on the availability of three credentials at each node, i.e.

Abstract: A system uses a mobile unit to control access to physical spaces with electrical locking devices. An authority means connected to the mobile unit issues authorizing data (AD) access rights, which are sent to an authorization means connected to the authority means, generate a mobile unit alpha-numerical key and send the key and the mobile unit's unique identifier to an operator connected to the authorization means. The operator sends the alpha-numerical key to the mobile unit identified by the unique identifier. An electrical locking device and the mobile unit use an authentication protocol with the alpha-numerical key to authenticate the mobile unit, which, when authenticated, sends the authorizing data (AD) to the electrical locking device. If the authorizing data (AD) comprises an identifier of the electrical locking device, the mobile unit can open the electrical locking device using a communication means in the mobile unit for near field communication.

Abstract: A system uses a mobile unit to control access to physical spaces with electrical locking devices. An authority means connected to the mobile unit issues authorizing data (AD) access rights, which are sent to an authorization means connected to the authority means, generate a mobile unit alpha-numerical key and send the key and the mobile unit's unique identifier to an operator connected to the authorization means. The operator sends the alpha-numerical key to the mobile unit identified by the unique identifier. An electrical locking device and the mobile unit use an authentication protocol with the alpha-numerical key to authenticate the mobile unit, which, when authenticated, sends the authorizing data (AD) to the electrical locking device. If the authorizing data (AD) comprises an identifier of the electrical locking device, the mobile unit can open the electrical locking device using a communication means in the mobile unit for near field communication.

Abstract: The present invention relates to a system (10) operable to control access to different physical spaces, each provided with an electrical locking device (121, . . . , 12n), with the aid of a programmable, mobile unit (14). The system (10) comprises an authority means (16) operable to issue access rights connected to the programmable, mobile unit (14) in the form of an authorizing data (AD), which authorizing data (AD) is sent to an authorization means (18) connected to the authority means (16), and operable to generate an alpha-numerical key for the mobile unit (14), and to send the alpha-numerical key and a unique identifier of the mobile unit (14) to an operator (20), which is connected to the authorization means (18). The operator (20) is operable to send the alpha-numerical key to the mobile unit (14) identified by the unique identifier.

Abstract: The present invention relates to a system (10) operable to control access to different physical spaces, each provided with an electrical locking device (121, . . . , 12n), with the aid of a programmable, mobile unit (14). The system (10) comprises an authority means (16) operable to issue access rights connected to the programmable, mobile unit (14) in the form of an authorizing data (AD), which authorizing data (AD) is sent to an authorization means (18) connected to the authority means (16), and operable to generate an alpha-numerical key for the mobile unit (14), and to send the alpha-numerical key and a unique identifier of the mobile unit (14) to an operator (20), which is connected to the authorization means (18). The operator (20) is operable to send the alpha-numerical key to the mobile unit (14) identified by the unique identifier.