SYSTEM AND METHOD FOR REMOTELY ASSIGNING AND REVOKING ACCESS CREDENTIALS USING A NEAR FIELD COMMUNICATION EQUIPPED MOBILE PHONE

• US 20150222622A1
• Filed: 03/31/2015
• Published: 08/06/2015
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Lowe, Peter R.
• Granted Patent: US 11,093,589 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The present invention is generally directed toward a mobile device that can be used in a secure access system. More specifically, the mobile device can have credential data loaded thereon remotely updated, enabled, disabled, revoked, or otherwise altered with a message sent from, for example, a control panel and/or controller in the system.

Claims

1. A method, comprising:

attempting authentication between a reader and a credential in an access control system;

determining that the attempted authentication between the reader and the credential has failed;

determining that a holder of the credential corresponds to an authorized user in the access control system; and

in response to the failed attempted authentication and in response to determining that the holder of the credential corresponds to an authorized user in the access control system, initiating a credential update process that causes at least one of the reader and credential to receive new credential information.

2. The method of claim 1, wherein the new credential information replaces previous credential information stored on the at least one of the reader and credential.

3. The method of claim 1, wherein both the reader and the credential receive the new credential information.

4. The method of claim 3, wherein the reader receives a first key unique to the reader and wherein the credential receives a second key unique to the credential.

5. The method of claim 4, wherein at least one of the first and second keys correspond to an encryption key.

6. The method of claim 1, wherein only the credential receives the new credential information.

7. The method of claim 6, wherein the credential receives the new credential information via a cellular communication network.

8. The method of claim 7, wherein the new credential information is received via TCP/IP.

9. The method of claim 1, wherein the new credential information is pushed to the credential in response to the failed attempted authentication.

10. The method of claim 1, wherein the new credential information is requested by the credential in response to the failed attempted authentication.

11. The method of claim 1, wherein the failed attempted authentication occurred due to a credential update at the reader that was not received at the credential prior to the attempted authentication.

12. The method of claim 11, wherein the reader requests the initiation of the credential update process.

13. The method of claim 1, wherein the credential update process causes a plurality of credentials to have new credential information generated therefor.

14. The method of claim 1, wherein the credential corresponds to a mobile communication device.

15. The method of claim 1, wherein the reader corresponds to a stand-alone reader.

16. The method of claim 1, wherein the attempted authentication corresponds to a mutual authentication.

17. The method of claim 1, wherein the attempted authentication corresponds to a one-way authentication.

18. An access control system, comprising:

a reader configured to attempt authentication with a credential, determine that the attempted authentication with the credential has failed, determine that a holder of the credential is an authorized user in an access control system in which the reader is a part, and, in response to determining that the holder of the credential corresponds to an authorized user in the access control system, initiate a credential update process that causes at least one of the reader and credential to receive new credential information.

19. A credential for use in an access control system configured to attempt authentication with a reader, determine that the attempted authentication with the reader has failed, determine that a holder of the credential is an authorized user in the access control system, and, in response thereto, initiate a credential update process that causes at least one of the reader and credential to receive new credential information.