METHOD AND APPARATUS FOR MAKING A DECISION ON A CARD

• US 20180270214A1
• Filed: 05/25/2018
• Published: 09/20/2018
• Est. Priority Date: 08/09/2006
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Caterino, Mark Anthony, Einberg, Fredrik Carl Stefan, Hoyer, Philip, Berg, Daniel, Davis, Masha Leah, Wamsley, Robert, Hulusi, Tam
• Granted Patent: US 10,742,630 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Method and devices for making access decisions in a secure access network are provided. The access decisions are made by one or more portable credentials using data and algorithms stored on or received by two or more credentials. Since access decisions are made by the portable credential or credentials, non-networked hosts or local hosts can be employed that do not necessarily need to be connected to a central access controller or database, thereby reducing the cost of building and maintaining the secure access network.

Claims

1-20. -20. (canceled)

21. A method, comprising:

presenting a first and/or a second credential to a reader, said reader being associated with an access control system;

said reader transmitting data comprising at least one of a host identifier and timestamp to the first and/or second credential;

analyzing, with the first and/or second credential, the at least one of a host identifier and timestamp;

making an access control decision based on the analysis of the at least one of a host identifier and timestamp, the access control decision comprising a determination as to whether or not the first and/or second credential is allowed access to an asset protected by said reader;

generating, with the first and/or second credential, a first message containing results of said access control decision; and

sending, with the first and/or second credential, said first message to said reader.

32. An access control system, comprising:

at least one local host for controlling access to an asset;

comprising first credential, comprising;

a memory for storing an access decision application that is capable of making an access decision for the first credential based on data received, either directly or indirectly, from the at least one local host, the access decision comprising a determination as to whether or not the first credential and/or a second credential is allowed access to the asset protected by said at least one local host; and

a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of causing a message to be generated after executing said access decision application and causing said message to be transmitted to the at least one local host, and wherein said message comprises results of said access decision for said credential.

37. A credential for use in a secure access system, comprising:

a memory for storing an access decision application that is capable of making an access decision based on data received from a local host, the access decision comprising a determination as to whether or not the credential and/or a second credential is allowed access to an asset protected by the local host; and

a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of generating a message after executing said access decision application and causing said message to be transmitted to the local host, and wherein said message comprises results of said access decision for said credential.