DE202007007611U1 - Device for presence detection and / or access control - Google Patents

Abstract

contraption for presence detection and / or access control, with at least a network server (2), one connectable to the network server (2) Detection device (3) for contactless detection of the presence of a mobile data device (6) in a local communication area of the detection device (3), an identification device connected to the detection device (3) (8) for the identification of the respective mobile data device as well as a control device (9) for controlling at least one predetermined functionality of the network server (2) depending the identification of the respectively recorded mobile data device (6), characterized in that the detection device (3) is a permanent and / or has cyclically Inquiries deducting Bluetooth module (4), when a mobile data device (6) is detected in its communication area, which has a Bluetooth module (7) operated in inquiry scan mode, detects the Bluetooth address of the detected mobile data device (6), in that the identification device (8) uses the detected mobile data device (6) identifies the Bluetooth address and that the predetermined functionality of the network server (2) controlled by the control device (9) based on the Bluetooth address is.

Description

The The present invention relates to a presence detection apparatus and / or access control, with at least one network server, one Detection device connectable to the network server for non-contact Recording the presence a mobile data device in a local communication area of the detection device, an identification device connected to the detection device to identify the captured mobile device as well as a control device for controlling at least one predetermined functionality of the network server in dependence the identification of the respective recorded mobile data device. The relevant data of the identification device, as well as the control device are located themselves in the central network server and can be changed there.

nowadays Employees are recorded in a variety of systems and thus in the context of the local Conditions assigned to certain functionalities. That's the way it is, for example Known access controls to buildings or specific spaces within to perform a building over magnetic cards, the be pulled through appropriate card readers, so that dependent on for example, the data read from the magnetic cards certain rooms be unlocked or kept locked. In a similar way Employee time attendance systems are operated that limit the presence an employee over the reading of appropriate electronic or magnetic working Record stamp cards and the attendance times along with the save collected employee data. For devices, such as workstations, password certifications are checked at login.

The Variety of attendance surveys and access controls leads to a almost inflationary accumulation corresponding magnetic cards, passwords to be remembered and their use at the various locations within a company building. moreover the operation is frequent improved, because of the user often module-specific knowledge for the operation of the module. As access controls are in general also to consider alarm systems which prevent the unauthorized access of Persons in areas of buildings (or on open ground) via motion detectors and thereby trigger (even silent) alarm when the alarm system is "armed" and is thus on alert.

Of these, The present invention is based on the object, to provide an improved device of the type mentioned, the Disadvantages of the prior art avoids and the latter in an advantageous Way further education. in particular, a reliable working and easy-to-use presence detection and / or access control be achieved.

These The object is achieved by a Device according to claim 1 solved. Preferred embodiments of the invention are the subject of the dependent claims.

It Thus, the presence detection and / or access control is proposed via Bluetooth data transmission to accomplish and to identify each of them mobile data device or its carrier on the the respective data device assigned Bluetooth address, which is a worldwide unique Address that is inserted by the manufacturer in the corresponding Bluetooth module. According to the invention the detection device a permanent and / or cyclic Inquiries in bluetooth format deducting bluetooth module, which on acquisition a mobile data device in his communication area, which is an inquiry-scan mode operated Bluetooth module, the Bluetooth address of the recorded mobile data device detected, wherein the identification means the detected mobile Data device based the Bluetooth address identifies and the controller the predetermined functionality of the Network server based on the identified Bluetooth address controls. Bluetooth is a known data transmission standard, which especially for short distances of 10 cm to 100 m is suitable. The transfer takes place between 2.402 and 2.480 GHz in the ISM, d. H. Industrial-Scientific-Medical band. The Bluetooth specifications are from the SIG, the so-called Special Interest Group, and are generally available. There are 79 channels each 1 MHz wide to disposal, being for one possible safe and trouble-free transmission the data is encrypted and the transmission the packages over each one of the channels selected according to the frequency hopping provided becomes. From the used clock of 0.625 ms for the change of the channel result in about 1600 frequency jumps per second. Bluetooth allowed the formation of ad-hoc networks in micro-cellular cells, so-called piconets, are organized. A Bluetooth device can do several Belong to piconets. Takes over a machine doing a bridge function, thus becomes the union of two piconets formed thereby called scatternet.

By means of inquiry, a Bluetooth device can determine whether other devices ready for communication are in its transmission range. After an Inquiry procedure are the Bluetooth addresses of the found Bluetooth devices and their clocks before. In addition, the In quiry answers Information about the membership of a device class. However, the information provided is only a very inaccurate description of the actually supported Bluetooth profiles.

One ready to communicate device is here in the so-called inquiry-scan mode. It listens to certain Frequencies at intervals of 1.28 ms on Inquiry Requests. The initiator of the Inquiry can too one of the found devices then establish a connection. For this purpose he is now leading the one for that necessary paging procedure. It comes as a result of an Inquiry procedure to a connection, the initiator of the inquiry then takes the Role of the master.

paging indicates the procedure of establishing a connection between two Bluetooth devices. The connection is initiated by means of a page message. Before, however, the sender of the Page message must have performed an Inquiry procedure, so that he knows the communication-ready devices in his environment are. This procedure is unnecessary himself, if he has the address of his desired communication partner already knows.

In order to a machine to respond to a Page message, it must be in Page Scan mode, So be ready to connect. As with the Inquiry can be limit the period of time when paging, by connecting a bluetooth device to connection requests from other devices waiting. For the willingness to connect is the visibility of a device no Requirement.

To the Establishing a connection between two Bluetooth devices, must undergo a three-stage process of mutual acquaintance become. This process involves the phases Inquiry communication-ready devices), Paging (Request and Record Connection) and Pairing (Negotiation the safety-relevant connection parameter). Following will be negotiated the shared Bluetooth profiles.

The thus formed Bluetooth mini cell may be referred to as piconet become.

The dependent on the identified Bluetooth address-controlled functionality can in this case in particular be a registration function, so based on the Bluetooth address a mobile data device its presence in a predetermined sector, essentially through the communication area of the Bluetooth module of the detection device or possibly the summary communication area of several such Bluetooth modules is determined, which determines the presence detection Advantageously, the detection of the time or the duration including presence. For this purpose, the network server with be connected to a registration device in which the Bluetooth address the respective recorded mobile data device together with time data, the the time period and / or the time of detection of the mobile data device in the Specify the communication range of the detection device stored become.

The Registration device can basically have different shape be. According to an advantageous embodiment of the invention, the Registration device part of an employee time recording device form. The corresponding "time clock" is, for example via a Handy of the respective employee actuated, the time recording device via a for example, at the building entrance placed Bluetooth module of its capture device the Bluetooth address of the respective mobile phones are recorded and together with the time of entry of the building stores.

alternative the registration device may also be a part of a roadmap detection device form over the Bluetooth module of its detection device, which constantly the abovementioned inquiries sent, passing vehicles or the with them mobile data devices and their Bluetooth address detected.

A introduced on a legal basis road toll for cars can provide that each car equipped with a bluetooth transmitter is whose unique Bluetooth address is an attribute of the official Identification and thus the owner is identified. In which Bluetooth encoder is a cost-effective module, which z. B. in radio keyboards and wireless PC mice, but also in mobile phones and in the operation of a car is permanently active.

These Device in conjunction with fixed Bluetooth modules on the motorway access and exits, also offers the possibility z. B. Ghost driver deliberately already when driving on a wrong To warn track of light signals, or stolen as registered Passenger cars at national borders, at "grid squares the police "or clearly recognizable from a police vehicle when the car the Bluetooth module happens.

Furthermore, by detecting a time difference when passing to remotely located Bluetooth modules, section control with average speed determination is much simpler and cheaper than currently practicable proven - feasible.

A Substantial simplification results in the Italian toll system. Bluetooth modules installed at toll stations identify this Vehicle registered motorway user (with Bluetooth transmitter installed or over one-time mobile phone registration) and forward the data of the Bluetooth address as well as the registered ones Location of the Bluetool module via forward a procedure to a server. A settlement (possibly also a existing credit card number) is then z. Monthly, for example. Thus arise no, as usual waiting times.

The Use of parking garages is simplified by the fact that the car already identified when reaching the entry or exit barriers is when he is registered. The registry can once z. B. by e-mail or SMS to an operator (eg APCOA - Autoparking GmbH), which activates the Bluetooth address in all APCOA parking garages.

According to one further advantageous embodiment According to the invention, said registration means may also have a Part of a building supervisor form, with the help of which the premises be monitored by security-sensitive entities such as banks. An attached in, for example, a counter room of a bank Detection device with a Bluetooth module of the type mentioned captures the Bluetooth addresses of mobile data devices used by Bank customers or robbers be brought along and store them in a corresponding, especially temporary Storage.

alternative or additionally can as functionality Also an access control or control are performed and a corresponding access control function may be provided. For this the network server can be connected to an access control device be that dependent the detected Bluetooth addresses access to a room and / or to a device releases or locks. In particular, the access control device a door lock include or drive to keep them open or locked.

The Control device can in this case advantageously a functional memory have, in the predetermined Bluetooth addresses previously registered Users and associated functionality identifications are stored. By means of a comparator, the one each recorded Bluetooth address compares with the stored Bluetooth addresses and if they match the respectively recorded Bluetooth address with one of the pre-stored Bluetooth addresses identify the functionality associated with the latter, can in the presence of the corresponding mobile device in the detection area the detection device enabled the data assigned to this device functionality become.

A offer essential application Alarm systems, in particular wrinkle monitors, their motion detectors additionally equipped with Bluetooth modules or already as integrated Module in the form of a motion detector with built-in Bluetooth module be installed. Currently, when you enter alarm-secured buildings while the proper alertness sometimes the alarm systems for certain areas "disarmed" switched, so z. Outside of service or at weekends one (individual) employee urgent Can or can do work. This is unfavorable when it comes to large objects, which then Mostly stay unguarded.

With Bluetooth modules equipped or integrated motion detector offer the possibility permanently switched on, d. H. "Sharp" alarm system, the Bluetooth address z. B. the mobile phone of an employee to a set Detecting distance and the over to trigger a motion detector Suppress alarm. In other places there are people in the building who are not identified can be the alarm is triggered. An attendance for A certain alarm-protected period can be found in the LDAP directory each registered or deleted.

Of the Network server can basically be structured differently. According to an advantageous embodiment of As a network server, the invention is in particular an LDAP server, i. H. a lightweight directory access protocol server, provided, in its Active Directory - as Attribute of the user - the Bluetooth addresses registered mobile data devices stored are, wherein advantageously in said Active Directory the LDAP server also with the Bluetooth addresses associated functionalities or Permissions are stored.

The LDAP is an application protocol that handles the query and the Modification of information of a directory service (an in Network distributed hierarchical database) over the TCP / IP network allowed.

LDAP is a client-server model-based application protocol used in directory services. It describes the communication between the so-called LDAP client and the directory (Directory Server). Out of such Directory object-related data, such. As personal data, computer configurations, etc. are read. The communication is query-based.

To the For example, the directory may contain an address book: in its E-mail client encounters a user the action Search for the mail adress of Joe User. Of the E-mail client formulates an LDAP query to the directory (directory server) that hosts the Provides address information. The directory formulates the Answer and submitted they to the client, z. For example: joe.user@browser.com.

The Protocol provides all the functions necessary for such communication necessary: login to the server (so-called bind), the search query (search I would like any information about the user named 'Joe User') and the modification the data (For the user 'Joe Cool 'please change the password).

Around an overview of the Functioning of an LDAP architecture, it is appropriate that one between the organization of the LDAP directory and the protocol LDAP is different.

• – Personen können in Zweigen unterhalb dieser Wurzel hinterlegt werden: ou = Personen, o = acme
• – Gruppen können in anderen Zweigen unterhalb der Wurzel hinterlegt werden: ou = Gruppen, o = acme

The data structure of an LDAP directory is given by a hierarchical tree with roots, branches and leaves. The root (root, suffix) is the highest data object, below it are the higher structures branching out. Example: If an LDAP directory is used in a company with the name ACME, the organization (o = acme) can be defined as a root:

• - Persons can be deposited in branches below this root: ou = persons, o = acme
• - Groups can be deposited in other branches below the root: ou = groups, o = acme

In order to the organization of the data does not happen completely arbitrarily, Each LDAP directory uses a particular preferably standardized one and possibly extended structure. The structure is used by the Scheme defined. An LDAP schema defines object classes with their attributes, eg. For example, the class person or the class organization.

The directory entries be called LDAP objects. Every object belongs to at least one, but usually to several classes. So are for the data a person, their e-mail address and their passwords about three objects necessary, but the same object belongs to three Classes. These could In this example, the name is Person, inetOrgPerson, and posixAccount.

It There are three types of object classes: Since an object is at least belong to a structural class must, this is the default. There are also help classes, which can be used Assign the same attributes to different objects. Last but not least exist still abstract base classes, of which no objects, but only subordinate base classes can be generated.

each Object is independent and composed of attributes. A single object becomes unique identified by the Distinguished Name (DN), e.g. Eg uid = juser, ou = People, ou = webdesign, c = de, o = acme. This one sits down composed of single Relative Distinguished Names (RDN). Another Spelling for the DN is the canonical name, which has no attribute tags (ou, c etc.) contains and where the separation between the RDNs is by slashes he follows. Furthermore starts the order, in contrast to dn, with the top entry, So z. Acme / de / webdesign / People / juser.

The Objects are stored in a hierarchical structure that reflects political, geographical or organizational boundaries. The largest units are placed at the top of the directory tree, which follows fanning down further and further down. While Objects that contain objects themselves are called container objects will be called the "ends" of the tree leaf objects.

If single LDAP server for individual parts of the directory tree are responsible, we speak of Partitions. If a client makes a request for which the server is not responsible, the server can refer the client to another server. LDAP server can be set up redundantly. For this purpose, a master-slave configuration is often used. A client tries to change data on a slave server he referred to the master. The changes on the master server are then passed on to all slave servers.

There many different schemes in different versions in use is the notion of a "global" all-embracing LDAP directory not real. LDAP servers are used as a central directory service for various purposes used in different sizes, however, the object hierarchy usually remains with an organization limited.

• • bind: Mit der bind -Direktive vermittelt man dem Directory-Server über eine dn, wer den Zugriff durchführen möchte (entweder anonym, per Password-Authentifizierung oder anders)
• • baseDN: Die BaseDN definiert, wo im Verzeichnisbaum abwärts die Suche nach bestimmten Objekten gestartet werden soll. Diese Suche kann festgelegt werden auf eine Suche über: – genau dieses Objekt (base) – dieses Objekt und alles darunter (sub) – eine Ebene unterhalb des BaseDNs (one)

The LDAP protocol is located above the transport layer (TOP) according to the ISO / OSI reference model and works by means of precisely specified access processes:

• • bind: With the bind directive one communicates with the directory server via a dn who wants to perform the access (either anonymously, per Password authentication or otherwise)
• • baseDN: The BaseDN defines where in the directory tree downwards the search for certain objects should be started. This search can be set to a search on: - exactly this object (base) - this object and everything below it (sub) - one level below the BaseDN (one)

Otherwise apply the necessary search specifications such as search operator (example (& (mail = joe *) (ou = People))), server naming. In development of the invention only one entry of the user, for example with first name and / or mobile phone number, what about a master can be done in the Active Directory of the LDAP server intended. Unique here is the mobile data device of the user Added the unique Bluetooth address and associated it with appropriate security groups. This can happen when using a wireless connection server that is in radio communication with the mobile data device stands, automatically by synchronization in the designated field of the Active Directory in the LDAP server.

By an individual schema extension is provided here in particular, that the Bluetooth module as an object, such as a door created and a user group the permission in the Active Directory of the LDAP server, for example, an authorized IT user group the permission to open the server room door are given.

advantageously, Here is the Bluetooth module of the detection device such extended that over it a country. H. a Local Area Network, or WAN, d. H. a wide area Network, about one Landline or wireless connection to the LDAP server. It is thus being able to periodically retrieve from the LDAP Directory the relevant To accept Bluetooth addresses and save. The object data on your part concern only the functionality for example the magnetic switch of a door, module in the form of Bluetooth addresses.

Around when capturing a mobile device, its Bluetooth module works in inquiry scan mode, its associated Bluetooth address, the Bluetooth address does not necessarily have to be in the mobile device itself be filed. In development of the invention may, depending on the training the mobile device, the Bluetooth address of the mobile data device in one with it in radio communication be stored data server, from which the Bluetooth address to the detection device or their Inquiries sending Bluetooth unit becomes.

The Bluetooth Address is a globally unique address used by the Manufacturer is inserted into the Bluetooth module and for a unequivocal identification the Bluetooth devices provides.

There The complete Bluetooth data frame is built in Little Endian format is, are also in the 48-bit Bluetooth address the Most Significant Bits (MSB) at the end. The 24th sent at the beginning Bit comprehensive Lower Address Part (LAP) forms with the middle one 8 bits of the address, the upper address part (UAP) the essential Part of the Bluetooth address. That means that out of the 32 available Address bit already 2exp32 different addresses are generated can.

The remaining 16 address bits are provided with Nonsignificant Address Part (NAP).

The Invention will be described below with reference to a preferred embodiment and an associated one Drawing closer explained. In the drawing shows:

1 : A schematic representation of a device for access control of a building and the function of an alert system in alarm alert system according to an advantageous embodiment of the invention.

1 shows the company building 1 the company X, which has its headquarters in Vienna. The central data processing is located there, being a network server 2 with a detection device 3 at the entrance (automatic door) of the company building 1 connected is. The detection device is advantageously with a permanently Inquiries emitting Bluetooth module 4 Mistake.

The building of the company branch in Innsbruck 10 owns the same access control ( 3 . 4 ) like the headquarters in Vienna.

A sales representative 5 The company X is on weekdays in his sales area on the go and is also looking for his company branch in Innsbruck 10 on. In the Bluetooth module 4 are the data of the mobile phone 6 of the employee 5 already over LAN / WAN both in the control center 1 as well as in the branch 10 saved. Via the Bluetooth address of the mobile phone 6 detects the Bluetooth module 4 its local presence at the company building 10 , The door to enter the company building 10 in the period from for example 8 o'clock in the morning to 6 o'clock in the evening is open weekdays.

On Saturday, the sales representative returns to Vienna and works at the headquarters 1 to do important work. The central office will be open every Friday from 6 pm to Monday 6 am through an alarm secured.

The object "automatic door Central-Vienna / Saturday" is the employee 5 also assigned, also belongs to the object "warning system / room A-C" hierarchically to the object "corridor / ground floor". Via the Bluetooth address of the mobile phone 6 detects the Bluetooth module 4 its local presence at the company building 1 on Saturday. The door to enter the company building 1 will be opened. After entering the company building 1 solve the installed and with bluetooth modules 4 equipped motion detector 12 in the corridor of the ground floor and in the rooms A-C no alarm, as long as the coworker 5 his cellphone 6 and the registered residence time is not exceeded, for example, from 9 o'clock in the morning to 4 o'clock in the afternoon.

Under LAN is to be understood as a so-called Local Area Network.

Such local networks are systems for the high-performance information transfer, which makes it a number of equal Enable users using a fast transfer medium partnership-oriented communication of high quality.

One LAN is in most cases designed as a diffusion network and reaches transfer rates up 10 Gbps (10 Gigabit Ethernet).

LANs can wired work like the standardized local networks Ethernet, Token Ring and FDDI and also wireless like 802.11 wireless networks.

Of the Partnership-oriented exchange of information can be considered as delimitation be understood as a hierarchically organized exchange and is another characteristic that has the flexibility of a LAN clarifies: on an equal partnership basis Message exchange system can namely, if necessary, a build hierarchical or semi-hierarchical structure.

One WAN (Wide Area Network), in German as a wide area network or Also known as wide area network, is a computer network that is unlike a LAN or MAN over a very large geographical Range extends.

The Number of connected computers is not on a specific number limited. WANs extend over countries or even continents. WANs are used to connect different LANs, but also to network individual computers together. Some WANs belong certain organizations and are used exclusively by them. Other WANs are built or expanded by internet service providers to to offer access to the Internet.

One WAN works on the physical layer and the link layer of the OSI reference model. Because of the large number The connected computer is the unaddressed sending of information (Broadcasting) to all computers hardly efficient to call. Therefore Data is only sent to the recipients Posted.

The following requirements apply to the design of a local network:
A high bandwidth of the transmission medium for rapid network access and fast message transmission, a suitable topology to achieve the objectives addressed, including high reliability and high modularity, appropriate communications protocol agreements (network protocols), appropriate functional and procedural tools for optimal use of the transmission equipment and Protocols given by the users and an open system architecture for the promotion of modularity, expandability, flexibility and acceptance.

nowadays Employees are recorded in a variety of systems and thus in the context of the local Conditions assigned to certain functionalities. (eg: access control via magnetic cards, Time recording systems, password certification when registering a PC, etc.)

In Development of the invention is in this case only one entry (via a Master) of the user with first / last name, MobTelefon-Nr. in AD (Active Directory) of the LDAP server necessary. Once, the user's mobile phone will have the unique Bluetooth address (BD-Addr) added and associated security groups. This happens at Use of a BES server (which is in radio communication with the MobTelefon stands) automatically by synchronization in the designated field of the AD (Active Directory) in the LDAP server.

By an individual schema extension it is possible the bluetooth module as Object (eg: door) create a user group and set the permissions in AD (Active Directory) (eg: authorized IT user group to open the Server room door)

The existing BlueHome ^® Bluetooth module has been enhanced in terms of hardware so that each module is connected to an LDAP server via a LAN / WAN (fixed or wireless connection). It is thus able to periodically take over and store the relevant Bluetooth addresses (BD-Addr) from an LDAP directory. The ob jektdaten in turn concern only to the functionality (eg, magnetic switch a door) of the module specific data group in the form of Bluetooth addresses.

provides Bluetooth standard over ISM frequencies by permanently Inquiries deducting module the Bluetooth address of a mobile phone and this code will be in the dataset of the module identifies, an application-oriented procedure is started. (eg: release (or blocking) of the magnetic switch of a door, only on weekdays, in the time from / to).

1

Company building the Company X in Vienna

2

Network Server

3

detector on automatic door

4

Bluetooth module

5

Sales Representative

6

mobile phone

7

Inquiry scan mode

8th

identification device

9

control device for object door

9.1

control device for object Motion detector room A

10

Company building the Company X Branch Innsbruck

11

functionality memory

12

motion detector connected to or integrated in bluetooth module

13

comparator

14

BES server

15

LAN / WAN

Claims (17)

Device for presence detection and / or access control, with at least one network server ( 2 ), one with the network server ( 2 ) connectable detection device ( 3 ) for the non-contact detection of the presence of a mobile data device ( 6 ) in a local communication area of the detection device ( 3 ), one with the detection device ( 3 ) identification device ( 8th ) for identifying the respectively recorded mobile data device and a control device ( 9 ) for controlling at least one predetermined functionality of the network server ( 2 ) depending on the identification of the respectively recorded mobile data device ( 6 ), characterized in that the detection device ( 3 ) a permanently and / or cyclically Inquiries deducting Bluetooth module ( 4 ), which is detected when a mobile data device ( 6 ) in its communication area, which is a Bluetooth module operated in inquiry-scan mode ( 7 ), the Bluetooth address of the detected mobile data device ( 6 ) detects that the identification device ( 8th ) the detected mobile data device ( 6 ) is identified by the Bluetooth address and that the predetermined functionality of the network server ( 2 ) by the control device ( 9 ) is controlled by the Bluetooth address. Device according to the preceding claim, wherein between the network server ( 2 ) and the detection device ( 3 ) a landline or radio connection ( 15 ) in the form of a LAN / WAN is provided. Device according to one of the preceding claims, wherein the network server ( 2 ) with a registration device in which the Bluetooth address of the detected mobile data device ( 6 ) along with time data representing the time period and / or the time of acquisition of the mobile data device ( 6 ) in the communication area of the detection device ( 3 ), can be stored, is connectable. Device according to one of the preceding claims, wherein the network server ( 2 ) with an access control device ( 10 ), for example automatic door ( 3 ) or motion detector ( 12 ) via an optionally integrated Bluetooth module ( 4 ) which, depending on the detected Bluetooth address, enables or blocks the corresponding access to a room and / or to a device. Apparatus according to claim 3, wherein the registration means Part of a road toll detection device is. Apparatus according to claim 3, wherein the registration means Part of a building supervisor is. Device according to one of the preceding claims, wherein the Bluetooth module ( 4 ) is assigned to an alarm system whose function depends on the detected Bluetooth address of the detected mobile data device ( 6 ) is controllable. Device according to the preceding claim, wherein the alarm system comprises at least one motion detector ( 12 ) to which the Bluetooth module ( 4 ) and / or into which the Bluetooth module ( 4 ), wherein when the Bluetooth module ( 4 ) a predetermined Bluetooth address of a corresponding mobile data device ( 6 ), the alarm triggering by the said motion detector ( 12 ) is suppressible. Device according to the preceding claim, wherein the Bluetooth module ( 4 ) has a reception area which covers the detection area of the assigned motion detector ( 12 ) slightly exceeds. Device according to one of the preceding claims, wherein the control device ( 9 ) a functional memory ( 11 ), are stored in the predetermined Bluetooth addresses and associated therewith each functionality data, and a comparison device ( 13 ), which compares a respectively detected Bluetooth address with the stored Bluetooth addresses and identified in accordance with the respectively detected Bluetooth address with one of the stored Bluetooth addresses that associated with the latter functionality data has. Device according to the preceding claim, wherein the registration device part of an employee time recording device is. Device according to one of the preceding claims, wherein the network server ( 2 ) is an LDAP server in whose Active Directory the Bluetooth addresses of registered mobile data devices ( 6 ) is stored. Device according to the preceding claim, wherein in the Active Directory of the LDAP server with the Bluetooth addresses respectively linked functionalities and / or Permissions are stored. Device according to one of the preceding claims, wherein the Bluetooth address of one in the communication area of the detection device ( 3 ) recorded mobile data device ( 6 ) from one with this mobile data device ( 6 ) radio communication server ( 14 ) is readable and the detection device ( 3 ) Control means for initiating the mobile data device ( 6 ) for reading and transmitting the Bluetooth address from the wireless connection server ( 14 ) having. Device according to one of the preceding claims, wherein the detection device ( 3 ) and / or its Bluetooth module ( 4 ) has a network interface and via a local network, in particular a LAN ( 15 ) or over a wide area network, in particular WAN ( 15 ), connected to an LDAP server. Device according to the preceding claim, wherein the detection device ( 3 ) and / or its Bluetooth module ( 4 ) is designed such that periodically relevant Bluetooth addresses are taken from an LDAP directory of said LDAP server and / or stored. Device according to one of the preceding claims, wherein the detection device ( 3 ) and / or its Bluetooth module ( 4 ) is connected to a local memory in which relevant Bluetooth addresses and / or functionality control data associated with relevant Bluetooth addresses are storable.