Assignment and Distribution of Access Credentials to Mobile Communication Devices

• US 20110271331A1
• Filed: 04/26/2011
• Published: 11/03/2011
• Est. Priority Date: 04/29/2010
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Adams, Neil Patrick
• Granted Patent: US 8,819,792 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 88/04 adapted for relaying to or from another terminal or user
• CPC Class Codes: H04W 92/18 between terminal devices

Abstract

A server storing a pool of unassigned access credentials selects an access credential from the pool, assigns it to an individual, identifies a mobile communication device associated with the individual, and pushes the access credential to the mobile communication device over a secure and authenticated channel such that the access credential is receivable by the mobile communication device. If the mobile communication device supports a proximity technology and is proximate to an access node that supports the proximity technology, the mobile communication device employs the proximity technology to present the access credential to the access node.

Claims

1. A method comprising:

selecting an access credential from a pool of unassigned access credentials;

assigning the access credential to a specific individual; and

transmitting the access credential over a secure and authenticated channel to a mobile communication device that is associated with the specific individual, such that the access credential is receivable by the mobile communication device.

2. The method as claimed in claim 1, further comprising:

importing one or more of the unassigned access credentials into the pool from an external source of unassigned access credentials.

3. The method as claimed in claim 2, wherein the external source comprises a smart card and importing the one or more unassigned access credentials comprises accessing the smart card via a smart card reader.

4. The method as claimed in claim 1, further comprising:

informing an access system of the assignment of the access credential to the specific individual.

5. The method as claimed in claim 1, wherein transmitting the access credential to the mobile communication device over the secure and authenticated channel comprises pushing the access credential to the mobile communication device over the secure and authenticated channel.

6. The method as claimed in claim 1, further comprising:

receiving from the mobile communication device an indication of the proximity technology or technologies supported by the mobile communication device.

7. The method as claimed in claim 1, further comprising:

receiving from the mobile communication device an indication that a secondary device is accessible by the mobile communication device and an indication of the proximity technology or technologies supported by the secondary device.

8. The method as claimed in claim 7, wherein the access credential is intended for use by the secondary device.

9. The method as claimed in claim 1, further comprising:

identifying the mobile communication device.

10. The method as claimed in claim 1, further comprising:

receiving a request to participate in access control from the mobile communication device; and

identifying the specific individual that is associated with the mobile communication device;

wherein transmitting the access credential to the mobile communication device over the secure and authenticated channel occurs in response to receiving the request.

11. The method as claimed in claim 1, wherein the access credential is a physical access credential.

12. The method as claimed in claim 1, wherein the access credential is a logical access credential.

13. A method for a mobile communication device that supports a proximity technology, the method comprising:

receiving from a server over a secure and authenticated channel an access credential assigned to an individual with which the mobile communication device is associated; and

when the mobile communication device is proximate to an access node that supports the proximity technology, employing the proximity technology to present the access credential to the access node.

14. The method as claimed in claim 13, further comprising:

prior to receiving the access credential, transmitting to the server an indication of the proximity technology or technologies supported by the mobile communication device.

15. The method as claimed in claim 13, further comprising:

requiring successful user authentication in order to permit employing the proximity technology to present the access credential to the access node.

16. The method as claimed in claim 15, wherein the successful user authentication involves a secret known to an authorized user of the mobile communication device.

17. The method as claimed in claim 15, wherein the successful user authentication involves a biometric of an authorized user of the mobile communication device.

18. The method as claimed in claim 13, wherein the proximity technology comprises radio frequency identification.

19. The method as claimed in claim 13, wherein the proximity technology comprises near field communication.

20. A method for a mobile communication device, the method comprising:

receiving from a server over a secure and authenticated channel an access credential assigned to an individual with which the mobile communication device is associated; and

transmitting the access credential in a manner receivable by a secondary device that supports a proximity technology.

21. The method as claimed in claim 20, wherein transmitting the access credential comprises transmitting the access credential via a wireless personal area network interface of the mobile communication device.

22. The method as claimed in claim 20, further comprising:

prior to receiving the access credential, transmitting to the server an indication of the proximity technology or technologies supported by the secondary device.

23. A server configured to:

select an access credential from a pool of unassigned access credentials;

assign the access credential to a specific individual; and

transmit the access credential to the mobile communication device over a secure and authenticated channel to a mobile communication device that is associated with the specific individual, such that the access credential is receivable by the mobile communication device.

24. A mobile communication device configured to:

receive from a server over a secure and authenticated channel an access credential assigned to an individual with whom the mobile communication device is associated,

wherein the mobile communication device supports a proximity technology, the mobile communication device further configured, when the mobile communication device is proximate to an access node that supports the proximity technology, to employ the proximity technology to present the access credential to the access node.

25. A mobile communication device configured to:

receive from a server over a secure and authenticated channel an access credential assigned to an individual with whom the mobile communication device is associated; and

transmit the access credential in a manner receivable by a secondary device that supports a proximity technology.

26. A system comprising:

a server arranged to store a pool of unassigned access credentials, the server coupled to a network;

a mobile communication device that is able to communicate over a secure and authenticated channel with the server via the network; and

an access system comprising an access node that supports a proximity technology and controls access to a controlled element,

wherein the server is arranged to select an access credential from the pool, is arranged to assign the access credential to a specific individual with whom the mobile communication device is associated, is arranged to transmit the access credential to the mobile communication device over the secure and authenticated channel, and is arranged to inform the access system of the assignment of the access credential to the specific individual,

wherein the mobile communication device is arranged to receive the access credential, and

wherein access to the controlled element is permitted or denied by the access system based, at least in part, on an analysis of the access credential presented to the access node.

27. The system as claimed in claim 26, wherein the mobile communication device supports the proximity technology and is arranged to employ the proximity technology to present the access credential to the access node when the mobile communication device is proximate to the access node.

28. The system as claimed in claim 26, further comprising:

a secondary device that supports the proximity technology and that is accessible by the mobile communication device,

wherein the mobile communication device is arranged to transfer the access credential to the secondary device, and

wherein the secondary device is arranged to employ the proximity technology to present the access credential to the access node when the secondary device is proximate to the access node.