System and method for remotely assigning and revoking access credentials using a near field communication equipped mobile phone

• US 9,483,631 B2
• Filed: 03/31/2015
• Issued: 11/01/2016
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Lowe, Peter R.
• Primary Examiner(s): Doan, Kiet
• Application Number:
  US14/674,094
• Publication Number:
  US 20150220711A1
• Time in Patent Office: 581 Days
• Field of Search: 455/551, 455/556.1, 455/41.1, 455/41.2, 455/558, 726/5, 726/6, 726/19, 726/18, 726/4, 709/204, 709/223, 340/5.61, 340/539.22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The present invention is generally directed toward a mobile device that can be used in a secure access system. More specifically, the mobile device can have credential data loaded thereon remotely updated, enabled, disabled, revoked, or otherwise altered with a message sent from, for example, a control panel and/or controller in the system.

Claims

1. A method of controlling physical access to a secure asset, comprising:

transmitting, by a reader of a physical access control system associated with a physical access point of the secure asset, an interrogating radio frequency (RF) signal to a mobile device, the interrogating RF signal comprising a first credential that is unique to the reader;

receiving, at the reader from the mobile device, an RF response to the interrogating RF signal, the RF response comprising;

a second credential that is unique to the mobile device, and

data associated with an access control decision by the mobile device with respect to the reader; and

controlling the physical access point, with the reader, to permit or deny a holder of the mobile device access to the secure asset based on the RF response to the interrogating RF signal.

2. The method of claim 1, wherein the first credential corresponds to a first key and wherein the second credential corresponds to a second key.

3. The method of claim 2, wherein at least one of the first or second keys correspond to an encryption key.

4. The method of claim 1, wherein the second credential is received at the mobile device via a mobile communications network.

5. The method of claim 4, wherein the mobile device receives the second credential via a Short Message Service (SMS) message.

6. The method of claim 1, wherein the second credential is received at the mobile device via the reader.

7. The method of claim 1, wherein, when the reader denies the holder of the mobile device access to the secure asset, the method further comprises:

generating a log entry at an access control log maintained on the reader; and

reporting the log entry via a communication network.

8. The method of claim 1, wherein the physical access point includes a door of a building and the secure asset includes a room within the building.

9. The method of claim 1, wherein the data comprising the second credential in the RF response includes data that is wirelessly updated, at the mobile device, by a remote server.

10. The method of claim 1, wherein the physical access point of the secure asset includes a lock controlling access to the secure asset.

11. The method of claim 1, wherein at least one of the first or second credentials comprises an identifier.

12. A system, comprising:

a reader of a physical access control system associated with a physical access point of a secure asset, wherein the reader is configured to perform operations comprising;

transmitting an interrogating radio frequency (RF) signal to a mobile device, the interrogating RF signal comprising a first credential that is unique to the reader;

receiving, from the mobile device, an RF response to the interrogating RF signal, the RF response comprising;

a second credential that is unique to the mobile device, and

data associated with an access control decision by the mobile device with respect to the reader; and

controlling the physical access point to permit or deny a holder of the mobile device access to the secure asset based on the RF response to the interrogating RF signal.

13. The system of claim 12, wherein the first credential corresponds to a first key and wherein the second credential corresponds to a second key.

14. The system of claim 13, wherein at least one of the first or second keys correspond to an encryption key.

15. The system of claim 12, wherein the second credential is received via a mobile communications network.

16. The system of claim 15, wherein the mobile device receives the second credential via a Short Message Service (SMS) message.

17. The system of claim 12, wherein the second credential is received via the reader.

18. The system of claim 12, wherein, when the reader denies the holder of the mobile device access to the secure asset, the reader is further configured to generate a log entry at an access control log maintained on the reader and report the log entry via a communication network.

19. The system of claim 12, wherein at least one of the first or second credentials comprises an identifier.

20. An access control system, comprising:

a processor; and

memory comprising processor-executable instructions that, when executed by the processor, enable the processor to perform operations comprising;

receiving, at a mobile device, an interrogating radio frequency (RF) signal from a reader of a physical access control system associated with a physical access point of a secure asset, the interrogating RF signal comprising a first credential that is unique to the reader;

in response to receiving the interrogating RF signal, performing an access control decision by the mobile device with respect to the reader; and

transmitting, from the mobile device to the reader, an RF response to the interrogating RF signal, the RF response comprising;

a second credential, and

data associated with the access control decision by the mobile device with respect to the reader,

wherein the physical access point is controlled by the reader to permit or deny a holder of the mobile device access to the secure asset based on the RF response to the interrogating RF signal.

21. The access control system of claim 20, wherein the first credential corresponds to a first key and wherein the second credential corresponds to a second key.

22. The access control system of claim 21, wherein at least one of the first or second keys correspond to an encryption key.

23. The access control system of claim 21, wherein at least one of the first or second credentials comprises an identifier.