WO1988007240A1

WO1988007240A1 - Controlling security access

Info

Publication number: WO1988007240A1
Application number: PCT/AU1988/000068
Authority: WO
Inventors: Roger Burrett Arnold
Original assignee: Siemens Ltd.
Priority date: 1987-03-12
Filing date: 1988-03-11
Publication date: 1988-09-22

Abstract

A method and system for controlling security access to an installation, such as a host computer, via a communication link such as a telephone line from a calling data processing device, such as a remote terminal or computer. The system comprises a first security access controller (4) adapted to interconnect the host computer to telephone line (7) via a first modem (6), an a companion security access controller (10) adapted to interconnect the remote terminal or computer to the telephone line (7) via a second modem (8). When the first controller (4) detects a call originating from the remote terminal or computer it initiates a multistep dialog between the called controller (4) and the calling companion controller (10), in which various security codes are requested, transmitted and compared before the called controller (4) enables access to the host computer. If any code received from the calling controller (10) does not match the code stored in the called controller (4) it instructs modem (6) to disengage the call. Each controller (4 and 10) is provided with a unique means for randomly generating an recovering a selected security code.

Description

CONTROLLING SECURITY ACCESS

Field of the Invention

The present invention relates to control of security access to an installation via a communication link such as a telephone line from a remote terminal or computer or other data processing device, and relates particularly, but not exclusively, to controlling authorized access to a host computer. Discussion of Prior Art It is common practice, when the need arises for transferring data from one computer to another remotely located computer, to utilize the public telephone network. In order to convert the data signal to a format suitable for transmission over telephone lines each computer is provided with a .modem which modulates the digital base band bits for transmission over a band near the middle of the voice channel (around 1500 to 2500 Hz) using, for example, frequency shift keying - the use of two frequencies to represent the 0 and 1 states respectively. With the advent of the personal and portable computer it is becoming increasingly popular for users of home computers to access larger main frame computers, microcomputers and data bases from a remote location via the public telephone network using a modem. Many service providers, such as banks, travel agents, libraries and retailers are now providing access to their facilities on-line.

It has become necessary, in order to prevent unauthorized access to a host computer, for service providers to issue users with an identification number which the user must punch in via his keyboard before the main computer will allow the user access to the service. This type of security is normally built-in to the main computer software and for this reason is often open to abuse. The so-called computer hacker, who understands how the software has been written, can evade or penetrate the built-in security measures and obtain unauthorized access.

Summary of the Invention The present invention was developed with a view to providing control of security access via a communication link such as a telephone line to a host computer, or other installation, independently of the installation and its own built-in security measures. According to one aspect of the present invention there is provided a security access controller for controlling access to an installation via a communication link such as a telephone line from a calling data processing device, said controller comprising: control logic means for controlling access to said installation in response to a selected security code requested from a companion controller connected to the calling data processing device; memory means for storing said selected security code for comparison with a security code received from said companion controller; and interface means for interfacing said controller to the installation and to the communication link; wherein, in use, said logic control means only enables access to the installation when the security code received from the companion controller matches the code stored in said memory means.

According to another aspect of the present invention there is provided a system for controlling security access to an installation via a communication link such as a telephone line from a calling data processing device, the system comprising: a first' security access controller adapted to interconnect said installation to the communication link; and, a companion security access controller adapted to interconnect said calling data processing device to said communication link; wherein said first security access controller comprises : control logic means for controlling access to said installation in response to a selected security code requested from the calling companion security access controller; and memory means for storing a selected security code for comparison with a security code received from said companion controller; wherein, in use, said control logic means only enables access to said installation when the security code received from the calling companion controller matches the selected code stored in said memory means. According to a further aspect of the present invention there is provided a method of controlling security access .via a communication link such as a telephone line to an installation from a calling data processing device using a system comprising a first security access controller adapted to interconnect said installation to the communication link and a companion security access controller adapted to interconnect said calling data processing device to the communication link, the method comprising: the first controller requesting a selected security code from the companion controller; the companion controller sending a security code to the first controller in response to said request; the first controller receiving the security code and comparing the received security code with the selected security code stored in the first controller; the first controller enabling access to the installation by the calling terminal or computer if the received security code matches the stored selected security code, or refusing access if the received security code does not match the stored selected security code.

Brief Description of the Drawings In order that the invention can be more clearly ascertained preferred embodiments will now be described, by way of example only, with reference to the accompanying drawings, wherein:

Figure 1 is a block diagram illustrating the way in which a primary controller and a companion controller of the security access system are preferably in use;

Figure 2 is a flow chart illustrating a preferred embodiment of the method of controlling security access using the system of Figure 1; Figure 3 is a functional block diagram of a preferred embodiment of a security access controller; and,

Figure 4 is a circuit diagram for one embodiment of the controller of Figure 3.

Description of Preferred Embodiment

Referring to Figure 1 there is illustrated in block diagram form the manner in which the system for controlling security access is preferably connected in use. The system comprises a primary security access controller 4 and a companion security access controller 10. The companion controller 10, of which there may be one or more at various locations remote from the host computer, is connected to a remote terminal or computer and to a second modem 8 to enable receiving and transmission of data over the telephone line 7. The primary controller 4 is connected to a host computer, for example a microcomputer, and to a first modem 6. Although the primary controller 4 and companion controller 10 of the system are illustrated as separate from the modems 6 and 8, it will be appreciated that each controller can be manufactured either as a self-standing unit which can be connected externally to a modem, or as a plug-in board which will fit inside the modem in a board connector provided for that purpose, or each controller can be provided with its own on-board modem.

The operation of the system will now be described generally with reference to Figure 1. The primary controller 4, when operating as the called controller, can operate in one of two modes: (i) an UNATTENDED MODE; and, (ii) an ATTENDED MODE. In the UNATTENDED MODE the primary controller 4 will only allow access to the host computer via the telephone line if it receives the correct security code. The host computer can therefore be left unattended with the knowledge that only authorized users will be able to obtain access on-line. In the ATTENDED MODE the controller 4 is always transparent to the host computer and/or modem 6 thus allowing them to operate normally, except when the primary controller detects a security violation at which point it causes modem 6 to disengage the telephone line. Each mode of operation will be described with reference to a microcomputer as the host computer. It will be obvious that the called host computer need not be a computer at all but could, for example, be an automated machine or process, such as a numerically controlled machine or industrial process or an industrial robot, a utility meter reading interface, a security alarm system or some other installation. Likewise the calling terminal or computer may be any data processing device capable of communicating with the installation, such as a personal computer, point of sale (POS) terminal, electronic teller machine or other data input/output device.

UNATTENDED MODE

A preferred method of controlling security access with the primary controller 4 acting as a called controller in the UNATTENDED MODE will now be described with reference to Figures 1 and 2.

The primary controller 4 responds to modem 6 when modem 6 answers an incoming call on telephone line 7 by requesting a pre-specified identification (ID) code from the calling companion controller 10. Controller 10 answers by sending its pre-specified ID code to the primary controller 4 via its modem 8. The called controller 4 receives the ID code and compares it with the ID code stored in its own memory. If correct ID code is received the called controller requests the calling controller to send a pre-specified user code. Calling controller 10 responds by sending its pre-specified user code to the called controller 4. The called controller 4 receives the user code and compares the code with a list of pre-specified user codes stored in its own memory.

If the correct user code is received, the called controller 4 requests the calling controller 10 send a randomly generated access code. The step of requesting an access code is somewhat different from the two previous steps of requesting a security code. Both the ID code and the user code are a fixed string of characters which remain unchanged from the time the security access controllers are initialized, when they are issued to the user company or institution, and are programmed into the respective memories of the controllers to suit the needs of the user. The ID code could, for example, identify the user company or institution and could be the same for each of the controllers issued with that system, the user code could be unique to each companion controller and would identify a companion controller as corresponding to the primary controller of the system, and the access code could be used by the primary controller to confirm that a calling companion controller is authorized to access the microcomputer.

It is remotely possible that an intruder tapping the telephone line between the modems could discover the ID and user codes and use these to convince the primary controller that an authorized user is originating the call. However, the access code will be different virtually every time a call is made and therefore it will be near impossible to access the microcomputer even if the first two security codes have been cracked. It should be borne in mind that at all times both security access controllers are "transparent" to the remote user of the terminal or computer - normally the only way anyone can break-in to the dialog between the two parts of the controller is by tapping the telephone line 7. The manner in which the access code is randomly generated is typically as follows:

Both the primary controller 4 and a companion controller 10 have stored in their respective memories a page of say 2000 characters, which may typically be a combination of any of the characters in the ASCII code. The page in respective memories of corresponding controllers of the security access system is identical, whereas the pages in the respective memories in corresponding controllers of a different system would of course be different. The primary controller 4 generates a first random number N., say between 20 and 200, representing the number of characters in the security access code, and a second random number N„ representing an offset address i.e. an address randomly offset from the page base address. These two numbers N, , N~ represent a randomly selected character string embedded in the 2000 character page. The primary controller 4 then combines the numbers N, and ₂ into a combination code number and sends it to the companion controller 10. The process of combining numbers N, and N_ may itself involve encrypting the numbers. Furthermore the combination code number may itself be used to produce a third random number N_, say using every second bit in the combined code number, which may be used by the controllers as a key for encryption of the data transmission that occurs after access to the installation has been attained. The controllers may each be equipped with an encryption device using a standard encryption algorithm such as DES. In this way security is maintained during transmission as well as during accessing. An advantage of this system is that a different key will be generated for every call thus maintaining a very high level of security. Such a high level of security for accessing and transmitting data is often required where sensitive information is involved, for example in high level electronic funds transfers. The controllers may also be provided with a proprietary encryption system for low level security transmission, such as for example a system of ORing a byte of the combination code number with every string of characters transmitted. Whatever form of encryption is employed, both the primary controller and its companion will be able to determine the randomly generated key for that call following a successful attempt by the calling controller to access the installation to which the called controller is connected, and thus be able to decrypt the data transmission.

The companion controller 10 deciphers the combination code number and determines from the numbers N. and N» how many characters in the access code and where-abouts in its page of characters to find the corresponding character string; it then sends this string, which is the security access code, to the primary controller 4. The primary controller 4 compares the received character string (access code) with the corresponding code in its own memory.

In all three steps involving a comparison between the received security code and the security code stored in the primary controller memory, when no match is obtained on the first attempt the primary controller 4 instructs modem 6 to disengage telephone line 7 and to return to its auto-answer mode, and then resets itself to its initial state. The remote caller will then need to re-dial the number of the microcomputer if he wishes to try again. Furthermore each request for a security code from the calling party is subject to a predetermined time limit so that if no code is received from the calling party within the time limit the controller 4 times out, instructs modem 6 to disengage telephone line 7 and resets itself to its initial state.

However, if the correct ID code, user code and access code are all received the primary controller 4 sends an instruction via companion controller 10 to the calling terminal or computer to wait on-line until the microcomputer comes on-line, and primary controller 4 then sends a control signal to power-up the microcomputer. When the microcomputer starts sending data the primary controller 4 echoes the data to the companion controller 10 which then echoes the data to the calling terminal or computer and vice-versa. Both the primary controller 4 and the companion controller 10 normally remain transparent to either the microcomputer or the calling terminal or computer once a data link is established.

Both the primary controller 4 and the companion controller 10 can be provided with a standard error detection and correction (EDAC) facility whereby retransmission of data is requested if an unacceptable number of errors in the data transmission is detected due to noisy telephone lines or other disturbances. The primary controller 4 is also capable of continually monitoring the data from the microcomputer and if it detects a special code which indicates violation of security on the microcomputer, the primary controller 4 will instruct modem 6 to disengage the telephone line 7 and to return to its auto-answer mode. The primary controller 4 then instructs the microcomputer to run its log-off sequence by sending another special code to the microcomputer, and waits for confirmation from the microcomputer that it has finished its log-off procedure. The primary controller 4 will then power down the microcomputer and reset itself ready to start the cycle again from its initial state. If the companion controller 10 ever detects that modem 8 has lost the carrier (as would happen if the primary controller 4 had instructed modem 6 to disconnect the line) the companion controller 10 sends a message to the remote terminal or computer display indicating that the call has been terminated. The companion controller 10 then resets itself to its initial state ready to respond to the next ID request from the primary controller. In the reset state the companion controller 10 echoes any data from the remote terminal or computer to modem 8 and vice versa, and will only start its security sequence of operation if it detects an ID request from the primary controller, thus allowing the remote terminal or computer to access other terminals or computers without restriction.

ATTENDED MODE When the primary controller is switched to its

ATTENDED MODE it maintains power to the microcomputer at all times and echoes data from the microcomputer to modem 6 and vice versa, thus being transparent to the microcomputer and/or the modem 6 and allowing the microcomputer and modem 6 to function normally. However the primary controller continues to monitor the data from the microcomputer and if it detects the special code indicating a security violation it instructs modem 6 to disengage the telephone line and enter the modem default state. The primary controller then sends a code to - li ¬ the microcomputer to indicate that it has disconnected the call due to a security violation and resets itself to its initial state in the ATTENDED MODE.

Throughout the above description we have assumed that the call originated from the remote terminal or computer and that the companion controller 10 was the calling controller and the primary controller 4 was the called controller. However, it is also possible for the host computer to initiate a call in which case the primary controller 4 becomes the calling controller and the companion controller 10 becomes the called controller. Exactly the same method of controlling security access can be employed with the roles of the controllers reversed. When the companion controller 10 detects an incoming call on telephone line 7 it would request the calling primary controller 4 to send the first pre-specified security code and it would then compare this with the pre-specified code stored in its memory. The process would continue as described above, assuming the companion controller 10 was switched to its UNATTENDED MODE. It will be apparent therefore that both the primary controller 4 and its one or more companion controllers are preferably manufactured as substantially identical units, each unit capable of operating as a called or calling controller depending on whether the call originates from the installation or data processing device to which it is connected, or from the telephone line. However, there may be some applications where the companion controllers will never be required to operate as a called controller in which case they need not be identical to the primary controller and will function simply as calling controllers.

The configuration of a preferred embodiment of a security access controller will now be described with reference to Figures 3 and 4. Figure 3 is a functional block diagram of a preferred embodiment of a security access controller, which includes a control logic means 12, memory means 14, decoding means 16 and I/O interface means 18. The control logic means 12 typically comprises a microprocessor which performs all of the arithmetic, logical and control functions for the controller. It provides the "intelligence" for the controller which enables it not only to discriminate whether an authorized companion controller is calling but also controls entry into the memory means 14. Only the manufacturer will possess knowledge of the appropriate control parameters that will allow access to the memory means 14. Once the controller unit leaves the factory no one will be able to gain access to memory means 14 without first destroying the contents of the memory thus requiring reinitialization. Memory means 14 is typically a combination of ROM and RAM and includes memory work space - "scratch pad" - for the control logic means 12, storage space for the main control program, and storage space for the security codes including the page of 2000 characters for randomly generating an security access code. Decoding means.-16 is provided for decoding memory addresses in each of the different types of memory in memory means 14, as well as deciding which section of the I/O interface means 18 the control logic means 12 is addressing. The decoding means 16 also optionally has at least one output 17 on which a control signal, that can be used to control the installation can be provided, e.g. to switch on the power to a microcomputer.

The input/output (I/O) interface means 18 typically includes first and second ports for connecting the controller to a modem and an installation (or data processing device) respectively, means for converting the data on the parallel data bases within the controller to a serial format suitable for transmission over the telephone line or in parallel format to the installation or data processing device, and vice versa, and performs other functions that allow the controller to connect to the outside world.

INITIALIZATION

Initialization of the prima-y controller and its companion controllers may take place at the point of manufacture where the manufacturer programs the controllers to store each of the pre-specified security codes (ID code and user code) and the page of 2000 characters in memory means 14. More preferably, however, initialization occurs on-site after sale of the system to a user and involves running a specially written initialization program on a computer connected to the controllers . This proprietary software would enable the system.user to nominate his own security codes and to store a unique page of randomly generated characters in each controller. In order to maintain a high level of security the generation of the random character page is performed in the following way.

Each controller is provided with at least one free-running digital counter/timer which is connected to the system clock. The proprietary software will go to the counter/timer in the controller and use the current count as a random seed to generate the random character page which is then channelled into the memory means 14 by the controllers own processor (the user never knows where the page is stored). In this way the generation of the random character page will be different everytime the security access system is initialized and third parties including the user cannot discover what the contents of a random character page will be from the software alone.

A further advantage of performing initialization on-site is that the controller units can be mass produced, since each unit will not require initialization at the point of manufacture.

Referring to Figure 3 there is shown an exemplary circuit diagram for a security access controller, indicating the interconnection of standard I.C.s to perform the various functions described above. Control logic means 12 comprises a Z80C Microprocessor 22 with a system clock 23 to regulate the execution of instructions by the Microprocessor 22. Control logic means 12 may of course employ any suitable processing chip and is not limited to using a Z80 microprocessor. In an alternative embodiment, control logic means 12 comprises a National Semiconductor Microcontroller such as the HPC 16083/16043/16003 or an Intel 80C51. These are customized CMOS chips that come with additional built-in memory which reduces the number of IC^rs required on the controller board and significantly simplifies manufacture. The low power consumption of these CMOS microcontrollers allows the security access controllers to be battery operated, greatly enhancing their portability and application.

Control logic means 12 preferably also comprises one or more free running digital counter/timers (not shown) , connected to the system or alternate clock, which the control logic means 12 uses to obtain the first and second random numbers N. and N_ described above. The microprocessor 22 reads the current count of the counter/timer and converts this to a suitable number N,, between prescribed upper and lower limits, representative of the length of the character string comprising the security access code. The microprocessor 22 also reads the current count of another counter/timer and ponverts this to a suitable number N.- representative of an offset address in the page of 2000 random characters. It then combines these numbers N, and N_ to form the combination code number, as described above, which is representative of the randomly generated selected security code.

Memory means 14 comprises an erasable programmable read only memory (EPROM) 24 which is non-volatile for storing the main control program, an electrically erasable programmable read only memory (EEPROM) 25 or battery backed CMOS RAM which is also non-volatile for storing the pre-specified security codes such as the ID code and user code and the special code for security violation as well as other control parameters, and a static random access memory (RAM) 26 which is volatile and provides a work space for the Microprocessor 22, temporarily storing for example the program stack. The EPROM 24 or the battery backed Ram also stores the page of 2000 characters which is used to randomly generate the access code - this portion of the memory is always inaccessible to the user. However, a special provision is made for user access to the EEPROM 25 or a part of the battery backed RAM which enables the user to lock out a companion controller in the event that one of the companion controllers is misplaced or stolen. This will be described further below. The decoding means 16 comprises a decoding device 27 which requires two inverters on the output lines to the baud rate generator 28 since the latter operates on inverted bit polarity. Another output 17 of the decoding device 27 provides a control signal for controlling the installation to which the controller is connected. In this case the control signal is supplied to a switching means 21, which consists of an intelligent relay device for providing 110/240 volt A.C. power at its output on receipt of the control signal. Switching means 21 could be used, for example, to power up an unattended microcomputer. I/O interface means 18 comprises a baud rate generator 28 which controls the speed at which serial data is transmitted from the serial input/output device (SIO) 29. SIO device 29 can operate in asynchronous or synchronous mode and converts data from parallel to serial format and vice versa. Operation of the SIO device 29 is also regulated by the system clock 23. I/O interface means 18 further comprises a standard RS232C Port A for connection to an installation, such as a host computer, and an RS232C Port B for connection to a modem. The input and output lines from/to Ports A and B are suitably configured by MAX232 driver/receiver devices 30 which also provide voltage doubling and inversion as required.

D.C. power for the controller circuit is provided by power supply 20 which comprises a bridge 32 providing full wave rectification of the AC secondary voltage from the transformer 31, a smoothing capacitor C3 and voltage regulator 34 to give +5V DC regulated output voltage.

The memory devices in memory means 14 of the controller are preferably CMOS devices in order to minimize power consumption. It is therefore possible to use a battery power supply to power either part of the controller, which is particularly advantageous when the remote part is used in connection with say a lap-top computer used by a company executive to access his company computer from his car using a mobile telephone.

The provision for locking out a companion controller in the event that it is lost or stolen will now be described. One of the companion controllers, say the master controller issued-to the Company Director, has special provision which enables the user of the terminal or computer connected to the master controller to access the EEPROM 25 or battery backed RAM in memory means 14 of the corresponding primary controller, and either delete the user code of the lost companion controller or insert a marker which will indicate to the primary controller that the companion controller calling with that user code is no longer authorized. Should anyone attempt to access the installation using the lost companion controller they will find they cannot get through. Furthermore, when the primary controller receives the user code from the lost companion controller it will also instruct the control logic means in the companion controller concerned to automatically disable the modem to which it is connected thus making it impossible to use that controller again until it is returned to the manufacturer to be reconfigured.

In the system and method of controlling security access described thus far the security access controllers remain transparent to the user during normal operation. However, in an alternative embodiment it is possible to program the control logic means 12 of the controller so that when it operates as a calling controller it first requests the user key-in a personal identification number (PIN) , on the data processing device to which it is connected, which the controller verifies before initiating the above multi-step security access dialog with the called controller. The controller is provided with a listing of authorized PIN's stored in memory means 14 with which it can compare the keyed in PIN and verify that the user is authorized to use the controller to obtain security access via the telephone line to the installation. If the calling controller does not receive an authorized PIN it will not respond to the called controller when the called controller requests it to send the first pre-specified security code. However, the calling controller will not prevent the user from connecting to the telephone network to access other on-line facilities such as bulletin boards, Viatel, etc.

Now that preferred embodiments of the security access controller and a system and method for controlling security access has been described in detail, it will be apparent to those skilled in the electronics and computer arts that many variations and modifications may be made, other than those already described, without departing from the essential inventive concepts of the apparatus and method. For example, the primary controller need not provide a separate control signal and may be configured simply for data communication. On the other hand, the primary controller need not be configured to enable data communication with the installation at all, but may simply provide one or more control signals for controlling operation of the installation once authorized access has been established. The system may therefore be used for remotely controlling automated factory processes and plant.

The system may also be used to enable domestic users to call their residence and remotely control appliances or other electronically controlled installations in their residence via the telephone network. The appliances or other installations could be connected to a security access controller to prevent unauthorized persons from activating or controlling the appliances or other installations via the telephone network.

A further application of the system and method of security access according to the present invention, is to provide security meter reading by public and private utilities, such as the gas, electricity and water authorities, to individual meters via the public telephone network.

Various meter reading encoders are available, or are being developed, which convert a meter reading to a digital format that can be read by the utility using a portable computer or other data processing device. Clearly, connecting each meter to a security access controller as described herein and connecting the controller to the telephone network would enable a utility to access the meter and obtain the meter reading from a remote location without fear of unauthorized persons obtaining access to the meter via the telephone network. Using the same system, the utility could also control the supply of electricity (or gas or water) to a particular dwelling or location by using the controller to activate a solenoid controlled valve or switch. The control signal on output line 17 in Figures 2 and 4 could be used for this purpose.

Meters belonging to two or more utilities could be connected to the same security access controller with each utility having its own security codes for obtaining access to its meter reading encoder. The controller could be provided with two or more pages of random characters, each page being identical to a corresponding page in a companion controller owned by the respective utilities, but each page being different from the others in the controller so that one utility cannot gain access to another utility's meter reading encoder.

Although the method of controlling security access described involves a multi-step dialog in which three security codes are requested, transmitted, received -and compared, it is to be understood that any number of security codes may be employed. It is envisaged that initially the portion of memory means 14 in which the control program and the 2000 character page are stored will consist of EPROM 24 to enable modifications and improvements to the security control program as the need for these become evident in use. Eventually EPROM 24 will be replaced by a ROM giving added security to the controller. The above description of preferred embodiments was given with reference to a telephone line as the communication link between the installation and the data processing device. Obviously, however, the invention is applicable using any communication link such as a microwave, radio, satellite, optical fibre link or other private telephone or data link. All such modifications and variations, including those not specifically described, are to be considered within the scope of the invention, the nature of which is to be determined from the foregoing description and appended claims.

Claims

CLAIMS :

1. A security access controller for controlling access to an installation via a communication link such as a telephone line from a calling data processing device, said controller comprising: control logic means for controlling access to said installation in response to a selected security code requested from a companion controller connected to the calling data processing device; memory means for storing said selected security code for comparison with a security code received from said companion controller; and interface means for interfacing said controller to the installation and to the communication link; wherein, in use, said logic control means only enables access to the installation when the security code received from the companion controller matches the code stored in said memory means.

2. A security access controller as claimed in Claim 1, wherein said control logic means causes a modem connected to the controller to disengage the communication link when the security code received from the calling controller does not match the code stored in said memory means.

3. A security access controller as claimed in Claim 2, wherein said selected security code is randomly selected by the control logic means so as to change every time a calling companion controller attempts to gain access to the installation.

4. A security access controller as claimed in Claim 3, wherein said memory means includes means for storing a page of code characters from which said selected security code is generated, said page of characters being identical to a corresponding page of characters stored in a companion controller.

5. A security access controller as claimed in Claim 4,wherein said control logic means includes means for generating a first random number N, representing the length of a character string within said character page comprising the selected security code.

6. A security access controller as claimed in Claim 5, wherein said control logic means includes means for generating a second random number N-, representing a random offset address in said character page whereby, in use, the random numbers N, and N₂ can be combined to form a combination code number, representing a randomly selected character string forming the selected security code embedded in said character page; and, means for sending the combination code number to the calling companion controller to enable it to determine and send back the requested selected security code.

7. A security access controller as claimed in Claim 6, wherein said memory means includes means for storing a plurality of pre-specified security codes which are identical to a plurality of pre-specified security codes in a companion controller.

8. A security access controller as claimed in any one of the preceding claims, wherein said controller is substantially identical to said companion controller and is capable of originating a call from said installation to said data processing device and of responding to said companion controller when it requests a selected security code.

9. A system for controlling security access to an installation via a communication link such as a telephone line from a calling data processing device, the system comprising: a first security access controller adapted to interconnect said installation to the communication link; and, a companion security access controller adapted to interconnect said calling data processing device to said communication link; wherein said first security access controller comprises: control logic means for controlling access to said installation in response to a selected security code requested from the calling companion security access controller; and memory means for storing a selected security code for comparison with a security code received from said companion controller; wherein, in use, said control logic means only enables access to said installation when the security code received from the calling companion controller matches the selected code stored in said memory means.

10. A system for controlling security access as claimed in Claim 9, wherein said companion security access controller is one of a plurality of companion controllers, each companion controller being capable, in use, of gaining access to said installation via the communication link.

11. A system for controlling security access as claimed in Claim 10, wherein each companion controller is substantially identical to said first controller and is provided with memory means for storing a page of code characters from which said selected security code can be generated, said page of characters being identical to a corresponding page of characters stored in the first controller.

12. A system for controlling security access as claimed in Claim 11, wherein said control logic means includes means for generating a first random number representative of the length of a character string, embedded within said character page, comprising the selected security code.

13. A system for controlling security access as claimed in Claim 12, wherein said control logic means includes means for generating a second random number representing a random offset address in said character page; means for combining said first and second random numbers to form a combination code number, representing a randomly selected character string, embedded in said character page, forming the selected security code; and means for sending the code number to a calling companion controller to enable the companion controller to determine and send back the requested selected security code.

14. A system for controlling security access as claimed in Claim 13, wherein each companion controller is provided with control means including means for deciphering said combination code number in order to obtain said first and second random numbers; and, means for retrieving from its character page the character string forming the selected security code represented by the code number whereby, in use, the companion controller can send back the selected security code when requested to do so by the first controller.

15. A method of controlling security access via a communication link such as a telephone line to an installation from a calling data processing device using a system comprising a first security access controller adapted to interconnect said installation to the communication link and a companion security access controller adapted to interconnect said calling data processing device to the communication link, the method comprising: the first controller requesting a selected security code from the companion controller; the companion controller sending a security code to the first controller in response to said request; the first controller receiving the security code and comparing the received security code with the selected security code stored in the first controller; the first controller enabling access to the installation by the calling data processing device if the received security code matches the stored selected security code, or refusing access if the received security code does not match the stored selected security code.

16. A method of controlling security access as claimed in Claim 15, wherein said step of the first controller requesting a selected security code from the companion controller comprises: the first controller randomly generating said selected security code and storing said selected security code; and the first controller sending a code number representative of said selected security code and requesting the companion controller to send back the selected security code represented by the code number.

17. A method of controlling security access as claimed in Claim 16, wherein said step of the first controller randomly generating said selected security code comprises: the first controller randomly generating a first number representative of the length of a character string comprising said selected security code, and randomly generating a second number representative of the location of the character string in a page of characters stored in the first controller; and, the first controller combining said first and second numbers to generate said code number for sending to the companion controller.

18. A method of controlling security access as claimed in Claim 17, wherein said step of the companion controller sending a security code to the first controller in response to said request comprises: the companion controller receiving said code number and extracting said first and second numbers to identify the length and location of the character string comprising said selected security code in a page of characters stored in the companion controller which is identical to the page stored in the first controller; and the companion controller retrieving said character string comprising the selected"security code and sending the selected security code to the first controller.

19. A method of controlling security access as claimed in Claim 18, wherein prior to said step of the first controller requesting a selected security code from the companion controller the method comprises the further steps of: the first controller requesting one or more pre-specified security codes from the companion controller; the companion controller sending one or more security codes to the first controller in response to said request; the first controller receiving the security codes and comparing the received security codes with the pre-specified security codes stored in the first controller; the first controller proceeding to the next step in the method of controlling security access if the received security codes match the stored pre-specified security codes, or disengaging the communication link if anyone of the received security codes does not match the stored pre-specified security code.

20. A method of controlling security access as claimed in any one of Claims 16 to 19, wherein said code number also contains a key for encryption of data transmitted after the first controller enables access to the installation by the calling data processing device.