PRESENCE-BASED CREDENTIAL UPDATING

• US 20150200925A1
• Filed: 07/26/2013
• Published: 07/16/2015
• Est. Priority Date: 07/27/2012
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Lagerstedt, Stig, Berg, Daniel, Bailin, Daniel, Robinton, Mark, Davis, Michael Lawrence
• Granted Patent: US 10,050,948 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

Methods, systems, and devices for updating access permissions of users in an access control system are described. The access permissions are capable of being updated based on rules and thresholds that include as at least one variable presence or contextual information associated with a user. The presence or contextual information associated with a user may be analyzed to trigger a credential update process for that user or other users within the access control system.

Claims

1. A method, comprising:

receiving contextual information regarding a first user;

based on the received contextual information, determining a credential update to perform in connection with at least one device associated with the first user;

generating a first message that contains at least one instruction to update at least one credential; and

transmitting the first message to the at least one device associated with the first user.

2. The method of claim 1, wherein the at least one device comprises a user device that is capable of exchanging messages via a communication network.

3. The method of claim 2, wherein the first message is transmitted to the at least one device via the communication network in at least one of an SMS message, an email, and an HTTP request.

4. The method of claim 2, wherein the user device comprises an NFC-enabled smart phone.

5. The method of claim 4, wherein the user device further comprises a secure element that stores the at least one credential as sensitive data.

6. The method of claim 5, wherein the secure element corresponds to at least one of a SIM card, microSD card, removeable IC, and embedded IC.

7. The method of claim 1, wherein the at least one device comprises a local host that is protecting at least one asset.

8. The method of claim 1, wherein the at least one instruction to update the at least one credential comprises an instruction to at least one of modify, add, remove, activate, and deactivate a logical credential on the at least one device.

9. The method of claim 1, wherein the contextual information regarding the first user comprises presence information.

10. The method of claim 1, wherein the contextual information regarding the first user comprises location information.

11. The method of claim 1, wherein the contextual information regarding the first user comprises information regarding the first user'"'"'s usage of the at least one device.

12. The method of claim 1, further comprising:

based on the received contextual information, determining a credential update to perform in connection with at least one device associated with a second user, the second user being different than the first user;

generating a second message that contains at least one instruction to update at least one credential for the second user; and

transmitting the second message to the at least one device associated with the second user.

13. The method of claim 1, further comprising:

generating a second message that contains the at least one instruction to update the at least one credential; and

transmitting the second message to a local host within an access control system, the local host protecting at least one asset and conditioning availability of the at least one access to users that present a physical credential having a valid logical credential stored thereon.

14. A computer-readable medium comprising processor-executable instructions that, when executed by a processor, perform the method of claim 1.

15. An access control system, comprising:

a credential control authority configured to receive at least one of presence information and contextual information associated with a first user of the access control system and then determine whether a credential update process is to be performed for at least one device associated with the first user, the credential control authority further configured to invoke the credential update process upon determining that the first user has crossed at least one of a physical and logical threshold based on the received at least one of presence information and contextual information.

16. The system of claim 15, wherein the at least one of a physical and logical threshold corresponds to a predetermined distance away from a predetermined location.

17. The system of claim 15, wherein the at least one of a physical and logical threshold corresponds to a predetermined action of the first user detected at the at least one device associated with the first user.

18. The system of claim 15, further comprising one or more local hosts configured to control access to one or more assets.

19. The system of claim 18, wherein the one or more assets include at least one of a physical and logical asset.

20. The system of claim 18, wherein the one or more local hosts correspond to an RFID reader, wherein the at least one device associated with the first user comprises an NFC-enabled communication device, and wherein the credential update process includes transmitting a first credential update message to the one or more local hosts as well as transmitting a second credential update message to the at least one device associated with the first user.

21. A credential control authority configured to communicate with a contextual information source and based on information received from the contextual information source, determine whether a credential update process is to be performed for at least one device associated with a first user, the credential control authority further configured to invoke the credential update process upon determining that the first user has crossed at least one of a physical and logical threshold based on the information received from the contextual information source.

22. The credential control authority of claim 21, wherein the contextual information source is executed on a server that is separate from a server on which the credential control authority is operated.

23. The credential control authority of claim 22, wherein the contextual information source is connected with the credential control authority via a communication network.

24. The credential control authority of claim 21, wherein the information received from the contextual information source includes at least one of presence information, communication context information, location context information, group context information, and calendar information.