System and method for remotely assigning and revoking access credentials using a near field communication equipped mobile phone

• US 9,710,625 B2
• Filed: 02/24/2012
• Issued: 07/18/2017
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Lowe, Peter R.
• Primary Examiner(s): DOAN, KIET M
• Application Number:
  US13/404,915
• Publication Number:
  US 20120157058A1
• Time in Patent Office: 1,971 Days
• Field of Search: 455411, 4554142, 455 305, 455558, 455468, 455268, 235449, 235451, 235492, 235494, 713185, 713153, 713186, 713158, 382103, 3482112, 340 56, 340 561, 719310
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The present invention is generally directed toward a mobile device that can be used in a secure access system. More specifically, the mobile device can have credential data loaded thereon remotely updated, enabled, disabled, revoked, or otherwise altered with a message sent from, for example, a control panel and/or controller in the system.

Claims

1. A method of relaying information relating to activities in a physical access control system associated with a lock coupled to a physical access point to a secure asset, comprising:

detecting an activity at a reader of the physical access control system, the activity comprising an access control decision executed by a first mobile device based on exchanged communications of credential information between the reader and the first mobile device;

storing information relating to the detected activity in one or more log files, the information relating to the detected activity including access decision information corresponding to at least one of a user identity, a time of access decision, a location of access decision, and an access decision identifier;

receiving, with one or more servers of the physical access control system, the one or more log files via the first mobile device, the one or more servers being separate and remote from the first mobile device;

selecting, with the one or more servers, a second mobile device that is different than the first mobile device for receiving the one or more log files; and

sending, with the one or more servers, the one or more log files to the selected second mobile device.

2. The method of claim 1, wherein the detected activity further includes at least one of:

a power indication, a power interference, an access granted decision, or an access denied decision.

3. The method of claim 1, wherein the one or more log files are at least temporarily stored in a memory associated with the reader.

4. The method of claim 1, wherein the one or more log files are at least temporarily stored in a memory associated with a controller communicatively coupled to the reader.

5. The method of claim 1, wherein the one or more log files are at least temporarily stored in a memory associated with the first mobile device, and wherein the one or more log files are relayed to the one or more servers from the first mobile device.

6. The method of claim 1, wherein selecting the second mobile device comprises accessing at least one of rules, access rights, or mobile device identities stored in a memory associated with the one or more servers.

7. The method of claim 1, wherein the one or more log files are sent via a short message service (SMS) message.

8. The method of claim 7, wherein the SMS message includes a link to a downloadable log file.

9. The method of claim 7, wherein the SMS message includes the information relating to the detected activity stored in the one or more log files by the reader.

10. The method of claim 1, wherein the information relating to the detected activity includes access decision information corresponding to a time of access decision.

11. A non-transitory computer readable medium having stored thereon computer executable instructions that, when executed by a processor, perform a method comprising:

receiving, via a first mobile device, one or more log files containing information relating to a detected activity at a reader of a physical access control system associated with a lock coupled to a physical access point to a secure asset, the activity comprising an access control decision executed by the first mobile device based on exchanged communications of credential information between the reader and the first mobile device, the information relating to the detected activity including access decision information corresponding to at least one of a user identity, a time of access decision, a location of access decision, and an access decision identifier;

selecting a second mobile device that is different than the first mobile device for receiving the one or more log files; and

sending the one or more log files to the selected second mobile device.

12. The computer readable medium of claim 11, wherein the information relating to the detected activity includes access decision information corresponding to a time of access decision.

13. The computer readable medium of claim 11, wherein the detected activity further includes at least one of:

a power indication, a power interference, an access granted decision, or an access denied decision.

14. The computer readable medium of claim 11, wherein selecting the second mobile device comprises accessing a database comprising at least one of rules, access rights, or mobile device identities stored in a memory.

15. The computer readable medium of claim 11, wherein sending the one or more log files comprises sending a short messages service (SMS) message.

16. A physical access control system associated with a lock coupled to a physical access point to a secure asset, comprising:

a first mobile device;

at least one reader configured to interact with the first mobile device, the interaction between the first mobile device and the at least one reader comprising an access control decision executed by the first mobile device based on exchanged communications of credential information between the reader and the first mobile device; and

one or more servers separate and remote from the mobile device, and operable to;

receive, via the first mobile device, one or more log files including information relating to a detected activity at the reader comprising the interaction, the information relating to the detected activity including access decision information corresponding to at least one of a user identity, a time of access decision, a location of access decision, and an access decision identifier;

select a second mobile device that is different from the first mobile device for receiving the one or more log files, and

send the one or more log files to the selected second mobile device.

17. The system of claim 16, further comprising:

a database for maintaining information related to the system, wherein the one or more servers are configured to refer to the database to select the second mobile device.

18. The system of claim 17, wherein the database comprises at least one of rules, access rights, or mobile device identities.

19. The system of claim 16, wherein the information relating to the detected activity includes access decision information corresponding to a time of access decision.

20. The system of claim 16, wherein the one or more servers are operable to send the one or more log files via a short message service (SMS) message.