Method and apparatus for making a decision on a card

• US 9,767,267 B2
• Filed: 03/25/2015
• Issued: 09/19/2017
• Est. Priority Date: 08/09/2006
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Davis, Masha Leah, Wamsley, Robert, Hulusi, Tam
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US14/668,517
• Publication Number:
  US 20150220721A1
• Time in Patent Office: 909 Days
• Field of Search: None
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Method and devices for making access decisions in a secure access network are provided. The access decisions are made by a portable credential using data and algorithms stored on the credential. Since access decisions are made by the portable credential non-networked hosts or local hosts can be employed that do not necessarily need to be connected to a central access controller or database thereby reducing the cost of building and maintaining the secure access network.

Claims

1. A method of operating a physical access control system protecting a secure asset, comprising:

determining location information associated with a mobile device;

determining, with the mobile device, an identity of a reader of the physical access control system proximate the mobile device based on the location information; and

executing, with the mobile device, an access control decision in connection with determining whether to permit or deny a holder of the mobile device access to the secure asset based at least in part of the determined identity of the reader, wherein at least a portion of the location information is provided to the reader from the mobile device and wherein the location information corresponds to location information provided to the mobile device by a second reader that previously received credential information from the mobile device.

2. The method of claim 1, wherein the location information is used by the mobile device, the reader, and at least one additional component of the physical access control system to implement at least one of a pseudo-man-trap and man-trap security feature.

3. The method of claim 2, wherein the mobile device further carries status information regarding an interaction between the mobile device and the second reader and provides the status information to the reader for use by the reader in connection with determining whether to permit or deny a holder of the mobile device access to the asset.

4. The method of claim 3, wherein the status information corresponds to an indication of whether or not a second door associated with the second reader is locked.

5. The method of claim 3, wherein the status information includes a key shared between a door associated with the reader and a second door associated with the second reader.

6. The method of claim 1, wherein the location information is provided to the reader from a central host.

7. The method of claim 1, wherein the location information is provided to the reader via a communication network.

8. The method of claim 1, wherein the mobile device comprises a cellular phone.

9. The method of claim 1, further comprising:

selectively communicating, with the mobile device, credential information to the reader, the credential information selected based at least in part on the determined reader identity; and

determining, with the reader, whether to permit or deny a holder of the mobile device access to the secure asset based on the credential information.

10. The method of claim 1, further comprising:

performing mutual authentication between the mobile device and the reader.

11. An access control system protecting a secure asset, comprising:

a mobile device configured to interact with a reader of the access control system, the mobile device comprising;

a receiver;

a transmitter; and

a processor operable to perform operations comprising;

determining location information associated with the mobile device;

determining an identity of the reader based on the location information; and

executing an access control decision in connection with determining whether to permit or deny a holder of the mobile device access to the secure asset based at least in part on the determined identity of the reader, wherein the operations further include communicating at least a portion of the location information to the reader and wherein the location information corresponds to location information provided to the mobile device by a second reader that previously communicated with the mobile device.

12. The access control system of claim 11, wherein the location information is used by the mobile device, the reader, and at least one additional component of the access control system to implement at least one of a pseudo-man-trap and man-trap security feature.

13. The access control system of claim 12, wherein the mobile device carries status information regarding an interaction between the mobile device and the second reader, and wherein the operations further comprise providing the status information to the reader for use by the reader for use by the reader in connection with determining whether to permit or deny a holder of the mobile device access to the asset.

14. The access control system of claim 13, wherein the status information corresponds to an indication of whether or not a second door associated with the second reader is locked.

15. The access control system of claim 13, wherein the status information includes a key shared between a door associated with the reader and a second door associated with the second reader.

16. The access control system of claim 11, wherein the location information is provided to the reader from a central host.

17. The access control system of claim 11, wherein the location information is provided to the reader via a communication network.

18. The access control system of claim 11, wherein the mobile device comprises a cellular phone.

19. The access control system of claim 11, wherein the operations further comprise:

selectively communicating credential information to the reader, the credential information selected based at least in part on the determined reader identity.

20. The access control system of claim 11, wherein the operations further comprise:

performing mutual authentication with the reader.