Method and apparatus for making a decision on a card

• US 9,760,705 B2
• Filed: 03/25/2015
• Issued: 09/12/2017
• Est. Priority Date: 08/09/2006
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Davis, Masha Leah, Wamsley, Robert, Hulusi, Tam
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US14/668,464
• Publication Number:
  US 20150213247A1
• Time in Patent Office: 902 Days
• Field of Search: None
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Method and devices for making access decisions in a secure access network are provided. The access decisions are made by a portable credential using data and algorithms stored on the credential. Since access decisions are made by the portable credential non-networked hosts or local hosts can be employed that do not necessarily need to be connected to a central access controller or database thereby reducing the cost of building and maintaining the secure access network.

Claims

1. A method of controlling physical access to a secure access to a secure asset with a physical access control system including a mobile device and a stand-alone reader associated with a physical access point to the secure asset, comprising:

receiving, at the mobile device, from the stand-alone reader, a communication associated with a status of the stand-alone reader, the status comprising a locked or unlocked status of the physical access point;

in response to receiving the communication, storing, on the mobile device, the status of the stand-alone reader; and

communicating, with the mobile device, the stored status of the stand-alone reader to at least one other component of the physical access control system that is not connected to the stand-alone reader by a communication network, wherein the at least one other component comprises a second stand-alone reader associated with the second secure asset.

2. The method of claim 1, wherein the status includes an active or inactive status.

3. The method of claim 1, wherein the status includes additional information stored on the stand-alone reader.

4. The method of claim 3, wherein the additional information includes a list of devices and/or users that are allowed to access an asset protected by the stand-alone reader.

5. The method of claim 1, wherein the stand-alone reader is battery powered.

6. The method of claim 1, wherein the status includes a list of devices that have access to an asset protected by the stand-alone reader.

7. The method of claim 1, further comprising:

determining location information for the mobile device;

communicating the location information for the mobile device to the reader; and

enabling the reader to use the location information in connection with determining whether to permit or deny a holder of the mobile device access to an asset protected by the reader.

8. An access control system, comprising:

a reader configured to protect one or more assets;

a mobile device capable of communicating with the reader; and

a blacklist stored on at least one of the reader and the mobile device, the blacklist containing information related to at least one of;

(i) readers to which the mobile device is not allowed to obtain access and (ii) mobile devices to which the reader is not allowed to grant access;

wherein at least one of the reader or the mobile device is configured to make an access control decision associated with the one or more assets based at least in part on the blacklist,

wherein the reader is configured to communicate a status of the reader to the mobile device, the status comprising a locked or unlocked status, and

wherein the mobile device is configured to communicate the status of the reader to at least one other component of the access control system that is not connected to the reader by a communication network, wherein the at least one other component comprises a second reader associated with a second asset.

9. The access control system of claim 8, wherein the blacklist is stored on the mobile device and contains information related to readers that the mobile device is not allowed to obtain access.

10. The access control system of claim 8, wherein the blacklist is stored on the reader and contains information related to mobile devices that the reader is not allowed to grant access.

11. The access control system of claim 8, wherein the mobile device is configured to make an access control decision for itself based on information obtained from the reader.

12. The access control system of claim 11, wherein additional authentication rules are maintained on the mobile device.

13. The access control system of claim 8, wherein the mobile device comprises a mobile phone.

14. The access control system of claim 8, wherein the blacklist is updated periodically.

15. The access control system of claim 14, wherein the blacklist is updated in response to detection of one or more events.

16. A phone, comprising:

a communication interface enabling the phone to communicate with a reader associated with a secure asset and obtain status information from the reader, the status information comprising a locked or unlocked status;

memory configured to store the status information from the reader; and

a controller configured to enable the phone to communicate the status of the reader to at least one other component of a physical access control system that is not connected to the reader by a communication network, wherein the at least one other component comprises a second reader associated with a second secure asset.

17. The phone of claim 16, wherein the status information includes an active or inactive status.