CREDENTIAL MANANGEMENT SYSTEM

• US 20130212660A1
• Filed: 02/13/2013
• Published: 08/15/2013
• Est. Priority Date: 02/13/2012
• Status: Abandoned Application

• Current Assignee: Schlage Lock Company LLC (Allegion PLC)
• Original Assignee: Xceedid Corporation (Allegion PLC)
• Inventors: Neafsey, Jeffrey Scott, Vitali, Rocco, Andrini, Alberto
• Application Number:
  US13/766,668
• Publication Number:
  US 20130212660A1
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G07C 2009/00206 the keyless data carrier being hand operated
• CPC Class Codes: G07C 9/00182 operated with unidirectional data transmission between data carrier and locks
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 41/24 using dedicated network management hardware
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A server may communicate with a mobile device and/or a reader device via an Internet connection. The server may be configured to generate a credential and transmit the credential to the mobile device. The mobile device may use the credential in an access control system, a payment system, a transit system, a vending system, or the like.

Claims

1. A method, comprising:

receiving a notification with a mobile device;

utilizing, with the mobile device, information in the notification to request a server to generate a credential;

receiving, with the mobile device, a package from the server;

extracting the credential from the package; and

storing the credential in a secure element of the mobile device.

2. The method of claim 1, wherein the notification is at least one of an email, a text message, and a push notification.

3. The method of claim 1, wherein the package is at least one of a JSON object and an XML-formatted message.

4. The method of claim 1, further comprising:

decrypting the credential before storing the credential in the secure element.

5. The method of claim 1, wherein the information includes a uniform resource locator.

6. The method of claim 5, further comprising:

authenticating the mobile device with the server based on an argument string in the URL.

7. The method of claim 1, wherein the mobile device is a mobile phone.

8. A method, comprising:

transmitting, from a reader device, a request for a server to generate a reader key, wherein the request includes a specifier;

receiving the reader key from the server; and

storing the reader key in a secure access module of the reader device.

9. The method of claim 8, further comprising:

utilizing, with the reader device, the reader key to communicate with a mobile device to receive at least a portion of a mobile device credential from the mobile device.

10. The method of claim of 9, further comprising:

transmitting, from the reader device, a request for the server to transmit one or more reader device credentials to the reader device;

receiving, with the reader device, the one or more reader device credentials from the server; and

storing the one or more reader device credentials in the secure access module of the reader device.

11. The method of claim 10, further comprising:

determining, with the reader device, whether to grant an action request based on analysis of the at least a portion of the mobile device credential and one or more of the reader device credentials.

12. A system, comprising:

a server configured with non-transitory computer executable instructions to generate a credential based on a unique device identifier and a master key, to encrypt the credential, and to encapsulate the encrypted credential in a package; and

a mobile device in communication with the server, wherein the mobile device is configured with non-transitory computer executable instructions to authenticate with the server, to transmit the unique device identifier to the server, and to download the package from the server.

13. The system of claim 12, wherein the server is further configured with non-transitory computer executable instructions to generate a reader key based on a specifier and the master key.

14. The system of claim 13, further comprising:

a reader device in communication with the server, the reader device configured with non-transitory computer executable instructions to authenticate with the server, to transmit the specifier to the server, and to download the reader key from the server.

15. The system of claim 14, wherein the mobile device comprises a NFC communication module configured to transmit at least a portion of the credential to a NFC communication module of the reader device.

16. The system of claim 14, wherein the reader device includes a secure access module to store the reader key.

17. The system of claim 12, wherein the system is one of an access control system, a payment system, a transit system, and a vending system.

18. The system of claim 12, wherein the server includes a plurality of credential generators, wherein each of the credential generators is configured to generate a different type of credential.

19. The system of claim 18, wherein the mobile device is configured to receive and store a plurality of credentials, wherein each of the plurality of credentials is a different type of credential.

20. The system of claim 12, wherein the mobile device is a mobile phone.