Dual Interface Device For Access Control and a Method Therefor

• US 20140304509A1
• Filed: 06/19/2014
• Published: 10/09/2014
• Est. Priority Date: 04/14/2011
• Status: Active Grant

• Current Assignee: Yubico AB
• Original Assignee: Yubico, Inc. (Yubico AB)
• Inventors: Ehrensvrd, Jakob
• Granted Patent: US 9,462,470 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 2213/0038 System on Chip
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G07C 9/00817 where the code of the lock can be programmed
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules

Abstract

The invention provides a low-cost access control device for identification and authentication in both the “digital” and “physical” worlds by contact-bound respectively contact-less interfaces and where individual users of the device can securely update access control credentials and cryptographic keys from a remote system without the need for any additional hardware or specialized software. The access control credentials and the at least one cryptographic key shall be readable by an access control system via the contact-less interface of the device, thereby enabling or denying the holder of the device access.

Claims

1. An access control device having dual interfaces comprising:

a contact-bound interface for communication with a remote system, the contact-bound interface comprising a USB interface with a USB type A plug and configured to receive access control credentials and cryptographic keys transmitted as files to the access control device; and

a contact-less interface for communication with an access control system using an emulated RFID card;

wherein the access control device further comprises a cryptographic processor, a virtual file system comprising a USB Mass Storage Device file system, a pre-configured unique identifier and a cryptographic key allowing for authentication and verification of access control credentials and cryptographic keys, the access control credentials and cryptographic keys stored in a storage upon acceptance, and being accessible to the emulated RFID card for transmission via the contact-less interface to the access control system; and

wherein the files of access control credentials and cryptographic keys are handled as blocks of wrapped and/or Authenticated Encryption with Associated Data (AEAD) files.

2. The access control device in accordance with claim 1, wherein the blocks of AEAD files are encrypted by symmetric encryption.

3. The access control device in accordance with claim 1, wherein the blocks of AEAD files are encrypted by asymmetric encryption.

4. The access control device according to claim 1, wherein the access control device functions as a USB Human Interface Device (HID) responsive to the access control device being attached to a remote system via the contact-bound interface, the USB HID providing an activation switch for resetting the access control device to expose the USB Mass Storage Device file system.

5. The access control device according to claim 1, wherein the USB Mass Storage Device file system is removable media which by default is not mounted to a host computer and responsive to an explicit command of a holder of the device pressing an activation switch, the device sends a digital signal to the host computer, thereby causing the file system to be mounted and visible to the remote system.

6. The access control device in accordance with claim 1, wherein data derived from an access control credential and encryption key is transmitted over the contactless interface in the form of NFC Data Exchange Format (NDEF) records.

7. The access control device in accordance with claim 6, wherein the contactless interface is a Near Field Communication (NFC) interface.

8. A method for secure communication with an access control device, comprising:

receiving access control credentials and cryptographic keys transmitted as files to the access control device over a contact-bound interface, the contact-bound interface comprising a USB interface with a USB type A plug; and

communicating data derived from an access control credential and cryptographic key to an access control system over a contact-less interface using an emulated RFID card;

wherein the access control device comprises a cryptographic processor, a virtual file system comprising a USB Mass Storage Device file system, a pre-configured unique identifier and a cryptographic key allowing for authentication and verification of access control credentials and cryptographic keys, the access control credentials and cryptographic keys stored in a storage upon acceptance, and being accessible to the emulated RFID card for transmission via the contact-less interface to the access control system; and

wherein the files of access control credentials and cryptographic keys are handled as blocks of wrapped and/or Authenticated Encryption with Associated Data (AEAD) files.

9. The method of claim 8, further comprising:

encrypting the blocks of AEAD files by at least one of symmetric encryption and asymmetric encryption.

10. The method of claim 8, further comprising:

providing USB Human Interface Device (HID) functions responsive to the access control device being attached to a remote system via the contact-bound interface, the USB HID providing an activation switch for resetting the access control device to expose the USB Mass Storage Device file system.

11. The method of claim 8, further comprising:

responsive to an explicit command of a holder of the access control device pressing an activation switch, sending a digital signal to a host computer, thereby causing the USB Mass Storage Device file system of the access control device to be mounted and visible to the remote system, wherein the USB Mass Storage Device file system is removable media which by default is not mounted to the host computer.

12. The method of claim 8, further comprising:

transmitting the data derived from an access control credential and cryptographic key over the contactless interface of the access control device in the form of NFC Data Exchange Format (NDEF) records.

13. The method of claim 12, wherein the contactless interface is a Near Field Communication (NFC) interface.