TAMPER EVIDENT LOCK

This invention relates to a tamper-evident lock, particularly a tamper-evident loclTFor use with containers in which it is important to retain a forensic record of locking and unlocking of the container as well as providing evidence of tampering with a locked container for example inflight catering trolleys and a method of detecting tampering with such containers.

The ability to lock and secure containers for example in-flight catering trolleys and containers has long been a cause for concern to the airline industry particularly to avoid theft and detect theft of contents of the trolley and for safety and security. There is a clear need to take measures to reduce the risk of surreptitious attack by placing explosive devices on for example aircraft by concealing within an airline trolley and to prevent the theft of contents of the trolley which typically contains high value duty-free goods. It is particularly important to provide protection when the aircraft is on the ground having just arrived from a journey or when awaiting departure when the aircraft may be being cleaned or restocked.

At present containers, for example airline trolleys are locked typically with an external padlock used in conjunction with a plastic seal that has to be broken in order to open the trolley door so providing an indication of unauthorised access. However, both these methods of securing are unsatisfactory in that a small padlock and a plastic seal offer little resistance to a determined thief. Furthermore, these devices rely on the efficiency of the cabin crew to secure them before leaving the aircraft and are therefore susceptible to human error or dishonesty and may present a security risk. There are many recorded instances when aircrew forget to secure the trolleys. An unlocked or unsealed container may be readily susceptible to theft by workers in contact with it and there is little chance of apportioning blame or identifying the responsible party.

Currently air-line service companies endure considerable losses from the theft of high value duty-free goods and the present invention addresses this problem by providing a new and efficient lock a container, typically a trolley, integrated with a pseudo-random number generator that produces a unique number each time the trolley is locked.

In a first aspect the invention provides a tamper-evident locking apparatus for use with a container to be locked comprising a lock housing adapted to be fitted to the container and comprising a locking mechanism for locking and unlocking the container; a device within the lock housing for generating an output upon locking and/or unlocking the locking mechanism; recording means for recording the output and optionally recording information relating to the

time of the generation of the output; means for detecting or displaying the output externally of the lock housing whereby the output is recordable remotely of the locking apparatus.

The container is suitably locked or unlocked using a key although other means, for example a security code and keypad may be employed as desired. Preferably, the locking apparatus is self-contained and, optionally, does not require additional or external components except for a key in the case of a mechanical lock. As the container is successively locked and unlocked the security code is changed on each locking operation and the output comprises the new security code. Information relating to the date and time of the locking and unlocking operation is suitably recorded and transferable remotely of the locking apparatus.

The container to be locked may comprise any form of device for holding contents including a vehicle, an airline trolley, a cage or canister and the locking apparatus may be integral to the container to be locked or separate and used to lock the container.

Preferably the output generated is random or is quasi-pseudo-random by which the output appears random to the user. By "quasi-pseudo-random" is meant a system which generates numbers in a manner which precludes the generation of the same number in succession. This is advantageous as known random number generators may generate the same number successively as the power supply diminishes.

Preferably the locking apparatus is manufactured from solid plastic or aluminium and desirably the internal components are sealed inside the lock housing, preferably using specialist potting compound preferably a flexible, water-impervious, electrically, inert, sealing compound so as to protect the mechanism from outside contamination. Suitably the lock apparatus is able to withstand extremely low temperatures, for example lower than -50 ⁰ C and preferably lower than -60 ⁰ C, as such temperatures may be experienced, for example in aircraft holds. Desirably, the apparatus is also able to withstand temperatures of at least 80 ⁰ C ad preferably at least 100 ⁰ C.

The locking apparatus suitably comprises electronic and or magnetic sensors which provide an indication of attack by electronic or magnetic means which, desirably is recorded to provide evidence of tampering. Preferably the components of the locking apparatus are operably connected using means which are not susceptible to electronic attack, for example by magnetic switches. Suitably the apparatus comprises sensor magnets which upon detection of an external magnet trigger generation of a new output code and recordal of that

fact and information relating to the time of generation of the new code thereby alerting the user to the possibility of an attempt at unauthorised access through magnetic attack.

The locking mechanism may be any suitable known locking mechanism but a cylinder lock is preferred.

The device in the lock housing for generating the output preferably comprises a microcontroller. In a preferred embodiment the locking/unlocking key comprises a multi-number code. The device in the lock housing suitably comprises a pre-programmed multi-digit code device of preferably five or more digits any of which can be numbered from zero to nine.

The operation of the device may be controlled by at least two switches, preferably infra-red sensors, each switch being located in an indentation in the device in such a way that if the first sensor is touched so that an infra-red beam is broken which in turn links to a micro controller in the locking apparatus the micro controller suitably successively generates a number followed by the successive single digit number every time the infra-red beam is broken by activating the infra red switch. Once the preferred first digit of the locking key number shows in the display window, the second indentation in the body of the device is touched so as to break the infra-red beam in this indentation which sends a signal to the micro controller indicating that the preferred number displayed in the display window should be locked in place. The next digit may then be selected in the same manner and the sequence of events repeated until the pre-programmed security code is generated after which time the lock will open.

In a preferred embodiment, the device for generating the output comprises a microcontroller linked to a pre-programmed multi-digit code device and means for displaying the output, the operation of the device for generating the output is controlled by at least two manually operable switches comprising a first switch which on operation generates a new number from 0 to 9 which is displayed in a given location and on successive operation of the switch generates and displays the next successive number in the given location and a second switch which on operation fixes the number in the given location and displays a further new number in a further given location which may be cycled by operation of the first switch and means for unlocking the locking mechanism upon fixing numbers which correspond to the pre-programmed multi-digit code.

Suitably the device is controlled by a battery, preferably having a long life and which draws very little power, for example a "non-breathing battery" which doers not require access to

open air and may be sealed safely. The battery is such that the element of randomness or pseudo-randomness is retained at low battery voltage. Suitably the battery has at least 100000 cycles and preferably at least 200000 cycles that is it is able to record and/or display output from at least 100000 and preferably at least 200000 locking and unlocking operations

The output preferably comprises a multi-digit number or alphanumeric code and may indicate the status of the lock, for example "open" or "closed". In a preferred embodiment, the output comprises time and date information.

The output is suitably recorded in a manner which provides for simple transference to a remote location, preferably down-loading to an external computer for example a hand held computer. The transference may be carried by any suitable means but is preferably carried out by infra red or other wireless transfer. Suitably the tamper evident locking apparatus further comprises means by which the output is transferable externally of the apparatus for recording externally.

The means for detecting the output externally of the lock housing preferably comprises a visual, preferably digital display, for example a digital LED display, whereby the user may observe the output and record it as appropriate, for example in a procedure for ensuring securing and locking of the container during flight.

In a preferred embodiment, the display comprises five digits, each digit being a seven segment LED display. In a particularly preferred embodiment, not more than ten, preferably not more than five and desirably not more than one segment for the display, that is not more than one in thirty five segments, is illuminated at any given time. The segments are illuminated in rapid succession to provide the appearance of the security code number. By this means the battery life is greatly extended and avoids the risk of generation of the same number in succession due to failing battery power.

The display is suitably activated as or shortly after the user locks the locking apparatus and the output remains visible to the user to permit recording. Suitably, the output information is then removed from detection for example by ceasing to illuminate the display, but is still recorded in the apparatus to provide an audit trail. As desired, the output information may be displayed again on demand from the user.

In a particularly preferred embodiment, the device for generating the output comprises a micro-controller inside the lock housing which generates the output on locking the container

and illuminates in a display window a multi-digit number, preferably pseudo-random in origin which will remain in operation although not illuminated unless recalled by operating a switch, preferably an infra-red beam. Suitably the beam is located in an indentation on the side of the lock and preferably the number will reappear on the screen for a pre-determined length of time before ceasing to be illuminated again but will remain active and be recorded by an audit trail facility built into the lock housing storing data showing the day date and time the lock was operated either to lock or unlock the mechanism. The data is suitably stored in such a manner as to be recoverable from the lock apparatus by downloading this information via direct link but preferably an infra-red link, into a computer data storage system. This system will preferably hold the information until it is downloaded into an external printer, or computer linked to a printer, so that the said information can be used as evidence as to when the lock was operated.

The lock apparatus is suitably operated by a key which preferably is unique to the user and issued by a secure source. Preferably the key is issued to the user for a journey or series of journeys in which the container to be locked is under the custody of the user. The cross- reference of the key to the user so identifying the user with any particular opening or clocking of the apparatus is suitably kept remotely of the container. By this means, the body responsible for the container may clear for example for security purposes, users for issuance with a key, the key is then issued to a group or individual user at which time the container may be locked or unlocked using the key and the device for recording the locking and unlocking of the container preferably also records the identity of the key employed for the locking or unlocking operation. Upon completing a journey, the user will lock the container, record the output information, for instance on a cargo manifest as required by law in at least some countries, and the key may be returned to the issuing authority and so discharge the key-holder of further responsibility. If the key is a key code or some other for of electronic key, this may at that time be reprogrammed.

The locking mechanism may comprise a rotating cam which when in the locked position overlays the door of the container thereby preventing it from opening. In a further embodiment the locking mechanism comprises a locking arrangement internally of the container for example a locking member actuated by the locking cylinder. This advantageously avoids modifying the external shape of the container thereby enabling the apparatus to be retro-fitted to existing containers and allowing containers to be located or stowed in tight-fitting locations and the locking apparatus to remain operable.

The invention provides in a second aspect a tamper-evident method of securing or releasing a container comprising; i) locking or unlocking a container using a locking apparatus preferably in a secure environment; ii) generating an output upon locking and/or unlocking the locking apparatus preferably which output is indicative of the time and date of the locking or unlocking operation; iii) recording the output and optionally information relating to the time of its generation; iv) detecting the output externally of the locking apparatus; v) optionally recording the output remotely of the locking apparatus; vi) repeating at least once steps i) to v) wherein the output generated for each repeat sequence is random or pseudo-random and is retained to provide a body of recorded output data and provides a means of identifying the time and date of each locking and unlocking operation.

In a preferred embodiment the locking apparatus comprises a locking mechanism and a device for generating the output which comprises a microcontroller linked to a preprogrammed multi-digit code device and means for displaying the output and operation of the device for generating the output is controlled by at least two manually operable switches. Suitably the method of the invention further comprises: i) operating the first switch whereby a new number from 0 to 9 is generated and displayed in a given location on an output display and on successive operation of the switch the next successive number is generated and displayed in the given location; ii) on reaching the first digit corresponding to the first digit of the multi-digit security code, operating the second switch which fixes the number in the given location and displays a further new number in a further given location; iii) repeating steps i) and ii) for the new number to fix numbers which correspond to the pre-programmed multi-digit code whereupon the lock opens or closes so releasing or securing the container and upon next closing the lock a new security code is generated, recorded and temporarily displayed.

Suitably, the multi-digit security code may be recalled and displayed temporarily to allow the user to record the code at their convenience.

Preferably, the method also comprises the steps of issuing a user with a key unique to the user and which is identifiable with the user, the locking or unlocking the container using the

key on each repeat sequence of steps i) to v) above and recording information identifying the key with each unlocking or locking operation.

The present invention is advantageous in that by following correct in-flight procedures, aircrew cannot avoid, whether intentionally or otherwise, locking individual containers as it is necessary to record an identity number on the cargo manifest and the number becomes available for recording only upon locking the container.

Suitably, the lock is also equipped with an audit trail facility which records information relating to the time the container has been locked or unlocked, typically including a "Day Date and Time" record, when a new identity number is generated.

Advantageously, in the event that operatives, for example aircrew fail to follow the correct procedure, the audit trail monitor will record that the trolley remained unlocked after use so that culpability can be allocated to the responsible organisation. This provides protection for users against wrongful accusations of theft.

The apparatus may be reused for many locking and unlocking cycles. Typically an airline container may be subject to tens of thousands of cycles for example at least 40000 and each operation requires a new plastic seal and padlock to be applied. The cost of the seals over a large number of cycles is disadvantageous as is the need to store the seals in a manner which allows ordered usage and recordal of seal references. The present invention avoids the need for such cost and complications in use and storage.

In the event of a straight forward theft or attempt at surreptitious entry into the trolley the lock cannot be attacked without showing clear evidence of the attack. In addition, the audit trail facility will automatically record information relating to the time when the container was attacked and opened and therefore which organisation was responsible for the safety of the container at the time. The tamper-evident lock is designed to show clear evidence that the container has been attacked by unauthorised persons thus allowing the container to be rejected or removed from the aircraft pending further investigation.

In a further aspect of the invention there is provided a container comprising a tamper-evident lock according to the present invention. Suitably the tamper-evident lock is adapted to fit all known makes of containers in which evidence of tampering and a record relating to the time of the tampering is required, for example airline cabin trolleys and desirably is secured to the container by bolts only accessible when the trolley door is unlocked. The tamper-evident

lock may be retro-fitted to existing containers or may be included as part of the construction of new containers.

The lock is manually operable. Any suitable means may be employed to operate the lock including a key, for example a mechanical key or a key pad. Suitably all other internal functions of the lock are electronic apart from the actual locking cylinder and desirably there are no further mechanical components. Preferably, t he lock is resistant to magnetic or electronic attack from either power surge or electronic spike which may be employed, for example in an attempt to destroy the electronic sensors within the printed circuitry thus rendering the identity number generator inoperative.

In a preferred embodiment, the tamper-evident lock generates a pseudo-random number which looks random but is in reality a number generated through a computed mathematical formula which prevents the previous number from being reselected.

Suitably all signals used to cause the generation of pseudo-random number are generated by way of an electronic beam projected through the outer casing of the tamper-evident lock with the arrangement being such that there is no direct connection between the locking cylinder and the pseudo-random number generator.

The invention is illustrated in the accompanying drawings in which:

Figure 1 shows an airline service trolley 1 with the cabinet door 2 and the locking apparatus 3 fitted to the trolley 1 with a locking latch 4 operated by the locking mechanism 5 in the locked position. The pseudo random security code is displayed in window 6.

Figure 2 shows an airline service trolley 1 with the cabinet door 2 and the locking apparatus 3 fitted to the Trolley with a locking latch 4 operated by the locking mechanism 5 in the unlocked position. The pseudo random security code is displayed in window 6. Upon locking the mechanism 5, the device within the lock housing for generating an output upon locking the locking mechanism 5 will generate and display a new pseudo-random security code. The code will be recorded by the recording means within the lock housing and optionally together with information relating to the time of the generation of the output.

Figure 3 shows the locking apparatus 3 with a cam latch 4 in the open or up position thus allowing the cabinet door 2 in Figures 1 and 2 to open. The latch 4 is unlocked by the key cylinder 5 causing the display window 6 to read OPEN. An infra red port 7 is provided by

means of which information recorded relating to the security code for any previous locking exercise together with the time and date of that exercise and of any unlocking exercise may be transferred to a remote device or location.

Figure 4 shows the locking apparatus 3 with the latch 4 in the locked or down position thus preventing the door 2 in Figures 1 and 2 from opening. The latch 4 is controlled by the key cylinder 5 and upon locking causing the display window 6 to show a multi-digit Pseudo- Random Identification Number.

Figure 5 shows a flow diagram setting out the steps of an illustrative method of the invention involving issuing a key to a use where the key is identified with the user. The container is locked or sealed and a security code is associated with the container and which optionally may be recalled by the user. Upon unlocking the container with the authorised key, recording means records the fact that the lock has been unlocked, the date and time and optionally the security code pertaining at that time. The display displays "OPEN" to the user indicating the status of the container. Upon locking the container, the device for generating an output generates a new security code and this is suitably recorded together with information relating to the time and date of the locking process. This code is then displayed temporarily whereby the user may record the code remotely, for example in completing a cargo manifest. The code is not generated or displayed until the container has been locked. As required, the user may temporarily recall the code to the display for later remote recordal. The unlocking and locking procedure may be repeated as often as required until such time that responsibility for the container is transferred. At that time, the key is suitably returned to safe storage and responsibility for the container discharged. At that time or subsequently, the recorded information relating to the locking and unlocking procedures, the time and date and the code for each procedure may then be transferred remotely so providing an audit trail for the container while in the care of the user.