Detecting and responding to an atypical behavior

• US 9,548,973 B2
• Filed: 09/23/2013
• Issued: 01/17/2017
• Est. Priority Date: 08/24/2007
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Hulusi, Tam, Wamsley, Robert, Davis, Michael L.
• Primary Examiner(s): Nguyen, Nam V
• Application Number:
  US14/034,404
• Publication Number:
  US 20140053248A1
• Time in Patent Office: 1,212 Days
• Field of Search: 340/5.2, 726/23, 726/22, 455/411, 713/200, 713/168
• US Class Current: 1/1
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/00896 specially adapted for particular uses
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, devices, and systems are provided for optimizing the dissemination of information in various types of systems such as an access control system. More specifically, there are provided herein various mechanisms to provide a modified agent path such that an agent following the modified agent path, may update at least one non-networked reader. The update of the at least one non-networked reader not occurring if the agent follows an unmodified agent path.

Claims

1. A method, comprising:

creating a number of records each associated with a presentation of a credential device to a reader for authentication, wherein the reader, at least in part, controls access to the interior of a secure premises and wherein, in response to the presentation of the credential device to the reader by a user, access to the interior of the secure premises was granted to the user;

analyzing, by a processor, at least two of the number of records to determine a predicted behavior from the analyzed number of records; and

setting an indicator upon the analysis further determining that at least one of the number of records indicates a behavior atypical of the determined predicted behavior.

2. The method of claim 1, further comprising, in response to the indicator being set, performing at least one of requiring a secondary authentication, denying access to the interior of the secure premises, indicating the user associated with the credential device may warrant additional scrutiny, placing an indicia of the atypical behavior on the credential device, alerting other personnel, and triggering an alarm.

3. The method of claim 1, wherein the analysis further comprises determining that the at least one of the number of records indicates the behavior atypical of the determined predicted behavior excluding an acceptable amount of deviation.

4. The method of claim 1, wherein, the number of records is further associated with a plurality of credential devices.

5. The method of claim 1, wherein the atypical behavior is associated with a different reader controlling access to the interior of the secure premises.

6. The method of claim 1, wherein the atypical behavior is determined by a deviation from the predicted behavior comprising at least one of a time of day, day of the week, day of the month, day of the year, and operational status of a site comprising the reader.

7. The method of claim 1, wherein the atypical behavior is determined by at least a first portion of the number of records that were created within a unit of time deviating from a second portion of the number of records, associated with the predicted behavior, that were created during the unit of time.

8. The method of claim 1, wherein the atypical behavior is determined by the location of a second reader different from the reader.

9. The method of claim 1, wherein the predicted behavior is determined by analysis of a number of the records associated with a plurality individuals having a similar predicted behavior.

10. A system, comprising:

a reader, at least in part, controlling access to the interior of a secure premises, and operable to read a credential device;

a storage medium; and

a processor operable to;

create a number of records, ones of the records being associated with the presentation of the credential device to the reader and wherein, in response to the presentation of the credential device to the reader by a user, access to the interior of the secure premises was granted to the user,

store the records in the storage medium,

analyze at least two of the number of records to determine a predicted behavior from fields of the number of records, and

set an indicator upon the analysis further determining that at least one of the records deviates from the determined predicted behavior.

11. The system of claim 10, further comprising:

an indicator reader operable to read the indicator; and

a response processor operable to respond to the indicator.

12. The system of claim 11, wherein the response processor responds to the indicator by performing at least one of requiring a secondary authentication, denying access to a resource, indicating a user associated with the credential device may warrant additional scrutiny, and triggering an alarm.

13. The system of claim 10, wherein the processor determines the predicted behavior from fields of the number of records associated with at least one of time of day, day of the week, day of the month, and day of the year.

14. The system of claim 10, wherein the processor determines the predicted behavior from fields of the number of records associated with the location of the reader.

15. The system of claim 10, wherein the processor determines the predicted behavior from fields of the number of records associated with a quantity of the number of records created within a unit of time.

16. The system of claim 10, wherein the processor determines the predicted behavior from fields of the number of records associated with a plurality individuals having a similar predicted behavior.

17. A portable credential device, comprising:

a storage medium; and

a processor operable to;

create a number of records, each record associated with the presentation of the credential device to the reader and wherein, in response to the presentation of the credential device to the reader by a user, access to the interior of the secure premises was granted to the user,

store the records in the storage medium,

analyze at least two of the number of records to determine an predicted behavior from fields of the number of records, and

set an indicator upon the analysis further determining that at least one of the records deviates from the determined predicted behavior.

18. The portable credential device of claim 17, wherein the processor is operable to:

upon determining the indicator is set, block the authentication such that the portable credential device is not authenticated.

19. The portable credential device of claim 18, wherein the processor is further operable to:

require a secondary authentication, and

make a decision to remove the block upon the secondary authentication being determined to be successful.

20. The portable credential device of claim 19, wherein the secondary authentication is a code entered by the user on at least one of the portable credential device and the reader.