DIGITAL CREDENTIALS AS GUEST CHECK-IN FOR PHYSICAL BUILDING ACCESS

• US 20190319940A1
• Filed: 03/26/2019
• Published: 10/17/2019
• Est. Priority Date: 03/27/2018
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: Workday Incorporated
• Inventors: Hamel, Bjorn, Ruggiero, Jonathan David, Mangino, Scott
• Granted Patent: US 11,792,181 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system for credential authentication includes an interface and a processor. The interface is configured to receive a create indication to create a guest credential representing a guest badge associated with a visitor and receive a claim indication from an authentication device to claim the guest credential. The processor is configured to provide the guest credential to the authentication device in response to the claim indication, provide a proof request to the authentication device, receive a proof response from the authentication device, validate the proof response, determine a visitor tracking system associated with a request from the authentication device to authenticate entry, and provide a check-in indication to the visitor tracking system that the visitor has checked in.

Claims

1. A system for credential authentication, comprising:

an interface configured to;

receive a create indication to create a guest credential representing a guest badge associated with a visitor; and

receive a claim indication from an authentication device to claim the guest credential; and

a processor configured to;

provide the guest credential to the authentication device in response to the claim to indication;

provide a proof request to the authentication device;

receive a proof response from the authentication device;

validate the proof response using a distributed ledger;

determine a visitor tracking system associated with a request from the is authentication device to authenticate entry; and

provide a check-in indication to a visitor tracking system that the visitor has checked in.

2. The system of claim 1, wherein the create indication to create a guest credential is associated with an email address, a user ID, or a user account.

3. The system of claim 1, wherein the claim indication from the authentication device to claim the guest credential comprises a one-time token being used that causes generation of a DID keypair, wherein the private key component is stored on the authentication device and the public key component is stored on the distributed ledger, and that causes providing the guest credential to the authentication device.

4. The system of claim 1, wherein the processor is further configured to verify the guest credential is associated with the authentication device.

5. The system of claim 4, wherein verifying the guest credential is associated with the authentication device comprises comparing a guest credential email address with an authentication device email address.

6. The system of claim 1, wherein the proof request is provided in response to a request to authenticate entry received from the authentication device.

7. The system of claim 6, wherein the request to authenticate entry is provided by the s authentication device in response to an authentication request from the guest check-in site.

8. The system of claim 7, wherein the authentication request from the guest check-in site is provided in response to a check-in request from the authentication device.

9. The system of claim 8, wherein the check-in request from the authentication device is provided automatically upon detection of proximity of the authentication device to the guest check-in site.

10. The system of claim 7, wherein the authentication device and the guest check-in site communicate using a wireless protocol.

11. The system of claim 10, wherein the wireless protocol comprises Bluetooth, NFC, or Zigbee.

12. The system of claim 6, wherein the request to authenticate entry from the authentication device comprises a check-in site identifier.

13. The system of claim 1, wherein the proof response comprises the guest credential.

14. The system of claim 1, wherein the proof response is signed with an authentication device private key.

15. The system of claim 1, wherein validating the proof response using the distributed ledger comprises determining that the guest credential is satisfactory to authenticate check-in, determining that a guest credential signature is valid, determining that the guest credential is not expired, or determining that the guest credential is not revoked by looking in the distributed ledger.

16. The system of claim 1, wherein validating the proof response comprises determining that the visitor has a scheduled appointment or an employee authorization to enter.

17. The system of claim 1, wherein the create indication to create a guest credential is provided by a human resources system guest setup process.

18. The system of claim 1, wherein the claim indication from an authentication device to claim the guest credential is provided in response to an authentication device digital identification app setup.

19. The system of claim 18, wherein the authentication device digital identification app setup is in response to an email sent as part of a human resources system guest setup process.

20. A method for credential authentication, comprising:

receiving a create indication to create a guest credential representing a guest badge associated with a visitor;

receiving a claim indication from an authentication device to claim the guest credential;

providing, using a processor, the guest credential to the authentication device in response to the claim indication;

providing a proof request to the authentication device;

receiving a proof response from the authentication device;

validating the proof response using a distributed ledger;

is determining a visitor tracking system associated with a request from the authentication device to authenticate entry; and

providing a check-in indication to the visitor tracking system that the visitor has checked in.

21. A computer program product for credential authentication, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving a create indication to create a guest credential representing a guest badge associated with a visitor;

receiving a claim indication from an authentication device to claim the guest credential;

providing the guest credential to the authentication device in response to the claim indication;

providing a proof request to the authentication device;

receiving a proof response from the authentication device;

validating the proof response using a distributed ledger;

determining a visitor tracking system associated with a request from the authentication device to authenticate entry; and

providing a check-in indication to the visitor tracking system that the visitor has checked in.