System and method for remotely assigning and revoking access credentials using a near field communication equipped mobile phone

• US 9,721,076 B2
• Filed: 03/31/2015
• Issued: 08/01/2017
• Est. Priority Date: 04/05/2005
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Lowe, Peter R.
• Primary Examiner(s): DOAN, KIET M
• Application Number:
  US14/674,175
• Publication Number:
  US 20150222613A1
• Time in Patent Office: 854 Days
• Field of Search: 4555542, 455 412, 455411, 455558, 455403, 4554122, 370352, 370328, 705 39, 705 37, 709204, 709223, 726 26, 726 5, 726 19, 726 6, 726 2, 340 561, 340 432, 340 565
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

The present invention is generally directed toward a mobile device that can be used in a secure access system. More specifically, the mobile device can have credential data loaded thereon remotely updated, enabled, disabled, revoked, or otherwise altered with a message sent from, for example, a control panel and/or controller in the system.

Claims

1. A method of operating a physical access control system associated with a physical access point to a secure asset, comprising:

receiving, at a server system, an indication that a reader operatively coupled to the physical access point has conducted an interaction with a first mobile device, the interaction comprising a transmission, by the first mobile device, of credential information to the reader, the physical access point comprising a lock;

obtaining, with the server system, information related to the interaction between the reader and the first mobile device, the information related to the interaction comprising one or more of a date or a time corresponding to access to the secure asset;

identifying, with the server system, a second mobile device that is different from the first mobile device and enabled to receive interaction information relative to the reader; and

routing, with the server system, the obtained information to the second mobile device via a mobile communications network.

2. The method of claim 1, wherein the reader communicates the obtained information to the server system via the mobile communications network.

3. The method of claim 1, wherein the server system obtains the information related to the interaction via the mobile communications network.

4. The method of claim 1, wherein the interaction corresponds to the reader granting access to a holder of the first mobile device.

5. The method of claim 1, wherein the obtained information is communicated to the second mobile device via email.

6. The method of claim 1, wherein the obtained information is communicated to the second mobile device via a Short Message Service (SMS) message.

7. The method of claim 1, wherein the obtained information is communicated to the second mobile device via TCP/IP.

8. The method of claim 1, wherein the interaction corresponds to a failed authentication between the reader and the first mobile device.

9. The method of claim 1, wherein the interaction corresponds to a key failure.

10. The method of claim 1, wherein the obtained information includes location information describing a location of the interaction.

11. The method of claim 1, wherein the first mobile device is associated with a first user and the second mobile device is associated with a second user different from the first user.

12. The method of claim 1, wherein obtaining, with the server system, the information related to the interaction comprises:

obtaining the information related to the interaction from at least one of the reader or the first mobile device.

13. The method of claim 1, wherein the information related to the interaction includes one or more of a data or time corresponding to access to the secure asset.

14. The method of claim 1, wherein the physical access point to the secure asset includes a lock associated with the physical access point.

15. A system of operating a physical access control system associated with a physical access point to a secure asset, comprising:

a controller that is configured to perform operations comprising;

receiving an indication that a reader operatively coupled to the physical access point has conducted an interaction with a first mobile device, the interaction comprising a transmission, by the first mobile device, of credential information to the reader, the physical access point comprising a lock;

obtaining information related to the interaction, the information related to the interaction comprising one or more of a date or a time corresponding to access to the secure asset;

identifying a second mobile device that is different from the first mobile device and enabled to receive interaction information relative to the reader; and

routing the obtained information to the second mobile device via a mobile communications network.

16. The system of claim 15, wherein the interaction corresponds to the reader granting access to a holder of the first mobile device.

17. The system of claim 15, wherein the obtained information is communicated to the second mobile device via email.

18. The system of claim 15, wherein the obtained information is communicated to the second mobile device via a Short Message Service (SMS) message.

19. The system of claim 15, wherein the obtained information is communicated to the second mobile device via TCP/IP.

20. The system of claim 15, wherein the interaction corresponds to a failed authentication between the reader and the first mobile device.

21. The system of claim 15, wherein the first mobile device is associated with a first user and the second mobile device is associated with a second user different from the first user.

22. The system of claim 15, wherein obtaining, with the controller, the information related to the interaction comprises:

obtaining the information related to the interaction from at least one of the reader or the first mobile device.

23. The system of claim 15, wherein the information related to the interaction includes one or more of a data or time corresponding to access to the secure asset.

24. The system of claim 15, wherein the physical access point to the secure asset includes a lock associated with the physical access point.

25. A reader, comprising:

a processor; and

a storage medium storing instructions that, when executed, are configured to cause the processor to perform operations comprising;

receiving, at the reader from a first mobile device, credential information associated with the first mobile device;

conducting an interaction with the first mobile device based on the credential information, where the interaction is associated with a physical access point to a secure asset, the reader operatively coupled to the physical access point, the physical access point comprising a lock; and

communicating information related to the interaction to a server system via a mobile communications network, the information related to the interaction comprising one or more of a date or a time corresponding to access to the secure asset,

wherein the server system is configured to identify a second mobile device that is different from the first mobile device and enabled to receive interaction information relative to the reader, and route the information of the interaction to the second mobile device via the mobile communications network.

26. The reader of claim 25, wherein the information of the interaction includes location information describing a location of the interaction.

27. The reader of claim 25, wherein the first mobile device is associated with a first user and the second mobile device is associated with a second user different from the first user.

28. The reader of claim 25, wherein the server system is configured to obtain the information of the interaction from at least one of the reader or the first mobile device.

29. The reader of claim 25, wherein the information related to the interaction includes one or more of a data or time corresponding to access to the secure asset.

30. The reader of claim 25, wherein the physical access point to the secure asset includes a lock associated with the physical access point.

31. A system of operating a physical access control system associated with a physical access point to a secure asset, comprising:

a first mobile device storing credential information;

a second mobile device; and

a controller that is configured to perform operations comprising;

receiving an indication that a reader operatively coupled to the physical access point has conducted an interaction with the first mobile device, the interaction comprising a transmission, by the first mobile device, of credential information to the reader, the physical access point comprising a lock;

obtaining information related to the interaction, the information related to the interaction comprising one or more of a date or a time corresponding to access to the secure asset;

identifying, the second mobile device as being enabled to receive interaction information relative to the reader; and

routing the obtained information to the second mobile device via a mobile communications network.