Secure Wiegand communications

• US 8,943,562 B2
• Filed: 11/29/2012
• Issued: 01/27/2015
• Est. Priority Date: 08/11/2008
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Guthery, Scott B., Robinton, Mark, Davis, Michael Lawrence, Andresky, David
• Primary Examiner(s): Lemma, Samson
• Application Number:
  US13/689,088
• Publication Number:
  US 20130117827A1
• Time in Patent Office: 789 Days
• Field of Search: 726/5, 726/14, 726/2, 380/270, 380/260, 380/46, 713/182, 713185-186
• US Class Current: 726/5
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

The present invention is directed toward secure access systems. Specifically, a method and system is provided that enhances the security of unidirectional communication protocols used in access control systems, such as the Wiegand protocol. The enhancements may include obfuscation of data, a two-way packet-mode communications, and blind synchronization of pseudo-random number generators.

Claims

1. A communication method, comprising:

operating a credential reader in a first mode of operation, the credential reader comprising at least one of a microprocessor and firmware that enable the credential reader to operate in the first mode of operation;

receiving, at a communication interface of the credential reader, a message from an upstream device;

determining, by the credential reader, that the message was transmitted by the upstream device; and

based on determining that the message was transmitted by the upstream device, transitioning the credential reader from the first mode of operation to a second mode of operation, wherein the first mode comprises a non-secure Wiegand mode and wherein the second mode comprises at least one of a secure Wiegand mode and a packet-mode.

2. The method of claim 1, wherein the credential reader is in communication with an upstream device utilizing a unidirectional communication protocol.

3. The method of claim 2, wherein the unidirectional communication protocol is the Wiegand protocol.

4. The method of claim 1, wherein the message transmitted by the upstream device comprises an alteration of a control line signal between the reader and upstream device for a predetermined amount of time.

5. The method of claim 4, wherein the predetermined amount of time is less than 10 ms.

6. A non-transitory computer-readable medium comprising processor-executable instructions, the processor-executable instructions comprising:

instructions configured to cause a credential reader to operated in a first mode of operation;

instructions configured to receive a message at the reader, the message being received from an upstream device;

instructions configured to determine that the message was transmitted by the upstream device; and

instructions configured to transition the credential reader from the first mode of operation to a second mode of operation, wherein the transition from the first mode of operation to the second mode of operation occurs based on determining that the message was transmitted by the upstream device, wherein the first mode comprises a non-secure Wiegand mode and wherein the second mode comprises at least one of a secure Wiegand mode and a packet-mode.

7. The non-transitory computer-readable medium of claim 6, wherein the credential reader is in communication with an upstream device utilizing a unidirectional communication protocol.

8. The non-transitory computer-readable medium of claim 7, wherein the unidirectional communication protocol is the Wiegand protocol.

9. The non-transitory computer-readable medium of claim 6, wherein the message transmitted by the upstream device comprises an alteration of a control line signal between the reader and upstream device for a predetermined amount of time.

10. The non-transitory computer-readable medium of claim 9, wherein the predetermined amount of time is less than 10 ms.

11. A credential reader comprising at least one of a microprocessor and firmware that enable the reader to operate in a first mode of operation, receive a message from an upstream device, determine that the message was transmitted by the upstream device, and, in response thereto transition the credential reader from the first mode of operation to a second mode of operation, wherein the transition from the first mode of operation to the second mode of operation occurs based on determining that the message was transmitted by the upstream device, wherein the first mode comprises a non-secure Wiegand mode and wherein the second mode comprises at least one of a secure Wiegand mode and a packet-mode.

12. The credential reader of claim 11, wherein the credential reader is in communication with an upstream device utilizing a unidirectional communication protocol, and wherein the unidirectional communication protocol is the Wiegand protocol.

13. The credential reader of claim 11, wherein the message transmitted by the upstream device comprises an alteration of a control line signal between the reader and upstream device for a predetermined amount of time.

14. The credential reader of claim 13, wherein the predetermined amount of time is less than 10 ms.