Architecture For Access Management

• US 20180077151A1
• Filed: 05/15/2017
• Published: 03/15/2018
• Est. Priority Date: 09/09/2016
• Status: Active Grant

• Current Assignee: Johnson Controls Tyco IP Holdings LLP (Johnson Controls International plc)
• Original Assignee: Tyco Integrated Security LLC (Johnson Controls International plc)
• Inventors: Campero, Richard, Davis, Sean, Jarvis, Graeme, Rumble, Terezinha
• Granted Patent: US 11,010,754 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 17/142 Fast Fourier transforms, e.g. using a Cooley-Tukey type algorithm
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G07C 9/00 Individual registration on entry or exit
• CPC Class Codes: G07C 9/00182 operated with unidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07F 7/0826 Embedded security module
• CPC Class Codes: G08B 13/19682 Graphic User Interface [GUI] presenting system data to the user, e.g. information on a screen helping a user interacting with an alarm system
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/107 : wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/06 : the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/08 : Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0825 : using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 : using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3242 : involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/068 : using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/084 : using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/021 : Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

Disclosed are techniques that use devices with corresponding identity wallet applications that execute on an electronic processor device of the devices, and which identity wallets store identity information and encrypt the stored identity information. A distributed ledger system, and a broker system that interfaces to the wallet and the distributed ledger are used for various information exchange cases pertaining to access to facilities. In particular, disclosed is a registration process to register an identity wallet with a facility.

Claims

1. A method comprises:

listening by a guest user device for a beacon from a security system, the beacon including a message;

initiating by the guest user device a transaction with a kiosk in response to the message that causes a user wallet to send a user public key stored in the user wallet to the security server;

requesting by the user wallet from a security wallet of the security system an access code having a facility public key and a universal identifier credential exchange mechanism that allows a guest user wallet to verify the facility under control of an entity that issues its own credentials, by the facility having a unique certificate;

testing the facility public key and the universal identifier to determine whether they are legitimate;

sending by the user wallet a user profile corresponding the user associated with the user device to the security server when the public key and identifier are determined to be legitimate; and

receiving an access status message.

2. The method of claim 1 further comprising:

storing the transaction in a distributed ledger system that is a sequential transaction database that comprises plural distributed database systems and network interface device that stores records of personally identifiable information;

3. The method of claim 1 further comprising:

storing the facility public key and universal identifier on the user device, with the user device, with facility public key being embedded in a code.

4. The method of claim 1 wherein the security access code having the embedded facility public key is in a matrix barcode.

5. The method of claim 1 wherein the facility public key and facility universal identifier are specific to a single physical facility.

6. The method of claim 1 wherein the universal identifier is based on a Universally Unique Identifier (UUID) identifier standard that uses a 128-bit value.

7. The method of claim 1 further comprising:

sending a challenge message that comprises tokens that assert a claim and which tokens are signed.

8. The method of claim 7 wherein the challenge message is a JWT message that follows the JSON Web Token (JWT) format.

9. The method of claim 8 wherein the JWT message is used by the door reader to cause access to be granted.

10. The system of claim 7 wherein the tokens are signed by a private key associated with the user'"'"'s public key, such that the door application is able to verify that the tokens are legitimate.

11. The system of claim 7 wherein the tokens are claims that are used to pass identity of authenticated users between an identity provider that is the user device and a service provider that is the door app.

12. A system comprises:

a device that issues a beacon, the beacon including a message to cause a user device to initiate a transaction with a kiosk in response to the message with the message causing a user wallet to send a user public key stored in the user wallet to the security server;

send in response to a request by the user wallet, an access code having a facility public key and a universal identifier credential exchange mechanism from a security wallet of the security system, which allow the user wallet to verify the facility under control of an entity that issues its own credentials, by the facility having a unique certificate;

testing the facility public key and the universal identifier to determine whether they are legitimate;

sending by the user wallet a user profile corresponding the user associated with the user device to the security server when the public key and identifier are determined to be legitimate; and

receiving an access status message.