Method of controlling access to a reserve zone with control of the validity of an access entitlement installed in the memory of a mobile terminal

• US 20170019413A1
• Filed: 03/03/2015
• Published: 01/19/2017
• Est. Priority Date: 03/12/2014
• Status: Active Grant

• Current Assignee: Thales SA
• Original Assignee: Thales SA
• Inventors: Dailly, Philippe
• Granted Patent: US 10,491,600 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/045 using payment protocols involving tickets
• CPC Class Codes: G06Q 20/0457 the tickets being sent electronically
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07B 15/02 taking into account a variable factor such as distance or time, e.g. for passenger transport, parking systems or car rental systems G07B15/06 takes precedence; taximeters G07B13/00; parking meters per se G07F17/24; car rental systems per se G07B15/00
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

The method comprises the following steps: presentation of a mobile terminal to an access control point, capture of an image carried by the access control point, and representative of an encoded item of computer data, by a camera of the terminal, and decryption, by the terminal of the of the image captured by the camera, so as to deduce therefrom the encoded item of computer data, which is a unique identifier of the access control point, by the mobile terminal, by the unique identifier of the access control point decrypted, transmission to the access control point broadcast, by the mobile terminal, of an entitlement for access to the reserve zone, which entitlement is stored in its memory, via the wireless connection, and control of the validity of the data of the access entitlement by the access control point.

Claims

1. A method of controlling access to a reserve zone via a system for controlling access to the reserve zone, the method comprising the following steps:

presenting a mobile terminal to an access control point of the access control system,

capturing an image carried by the access control point, representative of an encoded item of computer data, using a camera of the mobile terminal, and

decrypting, via the mobile terminal, the image captured by the camera, to deduce the encoded computer data therefrom,

wherein the encoded item of computer data is a unique identifier of the access control point, and in that the method further comprises the following steps;

establishing a wireless connection between the mobile terminal and the access control point, by the mobile terminal, using the unique identifier of the decrypted access control point,

sending the access control point, via the mobile terminal, an access entitlement to the reserve zone stored in its memory, via a wireless connection, the access entitlement comprising an expiration timestamp and a transportation contract,

first check of the validity of the data of said access entitlement by the access control point, said check comprising the following sub-steps;

reading the expiration timestamp of the access entitlement, and

comparing said expiration timestamp with the date-time of the presentation moment of the mobile terminal to the access control point,

second check of the validity of the data of the access entitlement, and

if it is concluded that said data of the access entitlement is valid as part of the second check, replacing the expiration timestamp of the access entitlement with a later expiration date-time.

2. The access control method according to claim 1, comprising an additional step for updating the access entitlement via the access control point, in the memory of the mobile terminal, via a wireless connection.

3. The access control method according to claim 2, wherein the update step comprises a sub-step for time stamping the access entitlement.

4. The access control method according to claim 2, wherein the update step comprises a sub-step for incrementing a first counter comprised in the access entitlement, the method further comprising a step for storing a copy of said counter in a central server of the access control system

5. The access control method according to claim 4, wherein the second check of the validity of the data of the access entitlement comprises a sub-step for checking the compliance of the value of the counter before incrementation with that of the copy of the counter saved on the central server, the data of the access entitlement only being declared valid if such compliance is verified.

6. The access control method according to claim 1, comprising a step for connecting the mobile terminal to the central server via the Internet, the second check of the validity of the data of the access entitlement being done by the central server.

7. The access control method according to claim 6, wherein the second check of the validity of the data of the access entitlement comprises a sub-step for verifying the integrity of the data of the access entitlement, the access entitlement only being declared invalid if the integrity of said access entitlement is verified.

8. The access control method according to claim 6, wherein the second check of the validity of the data of the access entitlement comprises a sub-step for performing a comparison between a first unique identifier comprised in the access entitlement and a second identifier specific to the mobile terminal), for example a unique network identifier of the mobile terminal, in particular a MAC address of the mobile terminal, the access entitlement only being declared valid if the first and second identifiers match.

9. The access control method according to claim 1, wherein, if the expiration timestamp is before the date-time of the presentation moment of the mobile terminal to the access control point, the access entitlement is declared invalid.

10. The access control method according to claim 1, wherein, if the expiration timestamp is before the date-time of the presentation moment of the mobile terminal to the access control point, the access control point performs the second check of the validity of the data of the access entitlement.

11. The access control method according to claim 1, wherein the first check of the validity of the data of the access entitlement comprises a sub-step for verifying the integrity of the data of the access entitlement, the access entitlement only being declared invalid if the integrity of said access entitlement is verified.

12. The access control method according to claim 1, wherein the first check of the validity of the data of the access entitlement comprises a sub-step for performing a comparison between a first unique identifier comprised in the access entitlement and a second identifier specific to the mobile terminal, for example a unique network identifier of the mobile terminal, in particular a MAC address of the mobile terminal, the access entitlement only being declared valid if the first and second identifiers match.

13. The access control method according to claim 7, wherein the access entitlement comprises a digital signature to verify its integrity, said signature depending on an identifier specific to the mobile terminal, for example a unique network identifier of the mobile terminal, in particular a MAC address of the mobile terminal.

14. The access control method according to claim 11, wherein the access entitlement comprises a digital signature to verify its integrity, said signature depending on an identifier specific to the mobile terminal, for example a unique network identifier of the mobile terminal, in particular a MAC address of the mobile terminal.