Architecture for access management

• US 9,858,781 B1
• Filed: 05/16/2017
• Issued: 01/02/2018
• Est. Priority Date: 09/09/2016
• Status: Active Grant

• Current Assignee: Johnson Controls Tyco IP Holdings LLP (Johnson Controls International plc)
• Original Assignee: Tyco Integrated Security LLC (Johnson Controls International plc)
• Inventors: Campero, Richard, Davis, Sean, Jarvis, Graeme, Rumble, Terezinha
• Primary Examiner(s): Haupt, Kristy A
• Application Number:
  US15/596,028
• Time in Patent Office: 231 Days
• Field of Search: None
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 17/142 Fast Fourier transforms, e.g. using a Cooley-Tukey type algorithm
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06Q 20/363 with the personal data of a user
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G07C 9/00 Individual registration on entry or exit
• CPC Class Codes: G07C 9/00182 operated with unidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07F 7/0826 Embedded security module
• CPC Class Codes: G08B 13/19682 Graphic User Interface [GUI] presenting system data to the user, e.g. information on a screen helping a user interacting with an alarm system
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 : using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/107 : wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/06 : the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/08 : Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0825 : using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 : using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3242 : involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/068 : using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/084 : using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/021 : Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences

Abstract

Disclosed are techniques that render a graphical user interface on a display device for performing transactions with a security system. The techniques include listening by a user device for a beacon from the security system, the beacon including a message and imitating by the user device the transaction with the security system in response to the message, with the message causing the user device to render a graphical user interface that has fields for entering an email address and a password to register the user device with a security server, with the graphical user interface rendering on the display a public key stored in a user digital wallet and a user digital wallet identification and sending in response to the message, a user'"'"'s public key that is stored in the user'"'"'s wallet and which is embedded in a code.

Claims

1. A method comprises:

listening by a user device for a beacon from a security system, the beacon including a message;

rendering a graphical user interface on a display associated with the user device, with the graphical user interface including fields for entering an email address and a password to register the user device with the security server, and a user public key stored in a digital wallet and a user digital wallet identification associated with the user device;

initiating by the user device a transaction with a security server in response to the message; and

sending in response to the message, the user public key that is stored in the digital wallet, and which public key is embedded in a code.

2. The method of claim 1 further comprising:

rendering by the user'"'"'s display device a control that causes the device to embed the public key as a matrix barcode.

3. The method of claim 1 further comprising:

requesting by the user device from a security wallet of the security system an access code having a facility public key and a universal identifier configured as a matrix barcode; and

testing the facility public key and identifier against the scanned the facility access code to determine whether the facility public key and identifier are legitimate.

4. The method of claim 3 further comprising:

rendering by the user device an interface that has a control that causes the digital wallet in the user device to send a user profile corresponding the user associated with the user device, to the security server when the facility public key and identifier are determined to be legitimate.

5. The method of claim 1 further comprising:

rendering by the user device an interface that allows the user device to select multiple user profiles.

6. A user device comprises:

a processor device;

memory operatively coupled to the processor device;

a display operatively coupled to the processor device;

a communication device operatively coupled to the processor device;

the user device configured to;

listen for a beacon from the security system, with the beacon including a message;

render a graphical user interface on the display, with the graphical user interface including fields for entering an email address and a password to register the user device with the security server, and a user public key stored in a digital wallet and a user digital wallet identification associated with the user device;

embedded the user public key into a code;

initiate a transaction with a security server in response to the message; and

send in response to the message, the user public key embedded in a code to the security server.

7. The device of claim 6 further configured to:

render in the display a control that causes the device to embed the public key as a matrix barcode.

8. The device of claim 6 further configured to:

send request to a security wallet of the security system for a facility access code having a facility public key and a facility universal identifier configured as a matrix barcode;

scan a facility access code; and

test the facility public key and identifier against the scanned the facility access code to determine whether the test the facility are legitimate.

9. The device of claim 8 further configured to:

render an interface that has a control that causes the digital wallet in the user device to send a user profile corresponding the user associated with the user device, to the security server when the facility public key and identifier are determined to be legitimate based on the test.

10. The device of claim 8 further configured to:

render an interface that allows the user device to select from multiple user profiles.

11. A computer program product tangibly stored on a computer readable hardware storage device, the computer program product comprising instructions to cause a user device to:

listen for a beacon from a security system, the beacon including a message;

render a graphical user interface on a display associated with the user device, with the graphical user interface including fields for entering an email address and a password to register the user device with the security server, and a user public key stored in a digital wallet and a user digital wallet identification associated with the user device;

initiate a transaction with a security server in response to the message; and

send in response to the message, the user public key that is stored in the digital wallet, and which public key is embedded in a code.

12. The computer program product of claim 11, further comprising instructions to cause the user device to:

render in the display a control that causes the user device to embed the public key as a matrix barcode.

13. The computer program product of claim 11, further comprising instructions to cause the user device to:

request from a security wallet of the security system an access code having a facility public key and a universal identifier configured as a matrix barcode; and

test the facility public key and identifier by causing the user device to render a control that allows the user device to scan a facility access code.

14. The computer program product of claim 11 further comprising instructions to:

render an interface that has a control that causes the digital wallet in the user device to send a user profile corresponding the user associated with the user device to the security server when the facility public key and identifier are determined to be legitimate.

15. The computer program product of claim 11 further comprising instructions to:

render an interface that allows the user device to select from multiple user profiles.