Digital credential with embedded authentication instructions

• US 10,212,144 B2
• Filed: 03/14/2014
• Issued: 02/19/2019
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Guthery, Scott B., Belin, Ronny
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Corum, Jr., William A
• Application Number:
  US14/772,882
• Publication Number:
  US 20160028708A1
• Time in Patent Office: 1,803 Days
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Methods and systems are provided for sending messages in a security system. In particular, a new message syntax can include one or more positive assertions that may be verified. The receiver of the message or credential may verify all the positive assertions. In other configurations, one or more nodes that relay the message from the sender to the receiver can verify the positive assertions or may create one or more of the positive assertions. In this way, the network or entities used to relay the message can also be checked.

Claims

1. A method for transmitting a message including credential information, comprising:

generating credential information at a sender;

creating a first positive assertion that is associated with a first intermediate bearer node between the sender and a receiver of the credential information;

encapsulating the credential information and the positive assertion into a first packet, wherein the encapsulated credential information comprises;

a first credential class comprising a first access rule; and

an authentication device content class that comprises information for authenticating a device and for verifying that the device is authorized to receive and/or forward the encapsulated credential information; and

sending the first packet to the receiver thereby enabling the receiver to trust and utilize the credential information in connection with maintaining security of a door lock, wherein the receiver corresponds to the door lock, wherein the first intermediate bearer node comprises a mobile phone, wherein the first positive assertion requires the mobile phone to provide the credential information to the door lock, wherein the sender creates the first positive assertion, and wherein the sender creates a second positive assertion for a second intermediate bearer node.

2. The method of claim 1, further comprising before sending the first packet, the sender encapsulating the second positive assertion with the first packet to create a second packet, wherein the encapsulated credential information further comprises a second credential class comprising a second rule species that comprises a second positive assertion directed to the second intermediate bearer node.

3. The method of claim 2, further comprising the sender sending the second packet to the receiver via a second intermediate bearer node.

4. The method of claim 3, further comprising:

the second intermediate bearer node de-capsulating the second packet;

verifying the second packet by conducting a first operation associated with the second positive assertion of the second credential class; and

if the second packet is verified, the second intermediate bearer node sending the first packet to the first intermediate node.

5. The method of claim 1, further comprising the second intermediate bearer node encapsulating the second positive assertion with the first packet to create a second packet.

6. The method of claim 5, further comprising the second intermediate bearer node sending the second packet to the receiver.

7. A device, comprising:

a memory;

a processor in communication with the memory, the processor operable to execute one or more modules, the modules comprising;

an encapsulator/de-capsulator operable to;

receive the first message, wherein the first message comprises;

a credential class comprising an access rule that includes a first positive assertion; and

an authentication device content class that comprises information for authenticating and for verifying that the device is authorized to receive and/or forward information contained in the first message;

de-capsulate the first message to read the first positive assertion in the first message;

provide the first positive assertion to a verifier/authenticator;

the verifier/authenticator operable to;

read the first positive assertion;

analyze the authentication device content class; and

based on the first positive assertion and the analysis of the authentication device content class, conduct an operation associated with the first positive assertion to verify the first message, wherein the first message further comprises credential information for a receiver that that is associated with a door lock, wherein if the first message is verified, the credential information is determined to have successfully passed from a reservation system to the door lock and is, therefore, useable by the receiver to control security of the door lock wherein the verifier/authenticator is further operable to create a second positive assertion, wherein the encapsulator/de-capsulator is further operable to receive the second positive assertion from the verifier/authenticator; and

encapsulate the credential information and the second positive assertion into a second message.

8. The device of claim 7, wherein the device is one of an intermediate bearer node or the receiver.

9. The device of claim 8, wherein the modules further include an identifier operable to:

read the first message;

determine if the first message is recognized;

if the first message is recognized, sending the first message to the encapsulator/de-capsulator; and

if the first message is not recognized, forwarding the first message to one of a second intermediate bearer node or the receiver.

10. The device of claim 9, wherein the first message further comprises one or more of:

a digital key value content class; and

a supported key identifiers class.

11. A non-transitory computer readable medium, stored in a memory and read by a processor of a first intermediate bearer node, comprising:

a first message comprising;

a first encapsulation comprising;

an authentication device content class that comprises information for authenticating and for verifying that a predetermined user'"'"'s mobile device is authorized to receive and/or forward information contained in the first message; and

a first credential class, the first credential class comprising;

a first access rule species including a first positive assertion, the first positive assertion, when read by the processor, causes the processor to conduct a first operation to verify the authenticity of the first message;

a second encapsulation comprising a second credential class, the second credential class comprising;

a second access rule species including a second positive assertion, the second positive assertion directed to a second intermediate bearer node; and

a credential that is useable by a reader associated with a door lock to control security of the door lock as long as the authenticity of the first message is verified, the predetermined user'"'"'s mobile phone was authenticated and verified as authorized to receive and/or forward the information contained in the first message, and the first message is confirmed to have followed a communication path that includes the predetermined user'"'"'s mobile phone and the door lock.

12. The computer readable medium of claim 11, wherein the first encapsulation further comprises one or more of:

a digital key value content class; and

a supported key identifiers class.

13. The computer readable medium of claim 12, wherein a sender generates the first and second encapsulations.

14. The computer readable medium of claim 13, wherein, if the processor of the first intermediate bearer node verifies the authenticity of the first message, the processor sends the first message, without the first encapsulation, to the second intermediate bearer node.