Method and apparatus for making a decision on a card

• US 10,742,630 B2
• Filed: 05/25/2018
• Issued: 08/11/2020
• Est. Priority Date: 08/09/2006
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Caterino, Mark Anthony, Einberg, Fredrik Carl Stefan, Hoyer, Philip, Berg, Daniel, Davis, Masha Leah, Wamsley, Robert, Hulusi, Tam
• Primary Examiner(s): Abrishamkar, Kaveh
• Application Number:
  US15/990,178
• Publication Number:
  US 20180270214A1
• Time in Patent Office: 809 Days
• Field of Search: None
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G07C 9/23 by means of a password
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: G07C 9/29 the pass containing active electronic elements, e.g. smartcards
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Method and devices for making access decisions in a secure access network are provided. The access decisions are made by one or more portable credentials using data and algorithms stored on or received by two or more credentials. Since access decisions are made by the portable credential or credentials, non-networked hosts or local hosts can be employed that do not necessarily need to be connected to a central access controller or database, thereby reducing the cost of building and maintaining the secure access network.

Claims

1. A method, comprising:

presenting a first and/or a second credential to a reader, said reader being associated with an access control system;

said reader transmitting data comprising at least one of a host identifier and timestamp to the first and/or second credential;

analyzing, with the first and/or second credential, the at least one of a host identifier and timestamp;

making an access control decision based on the analysis of the at least one of a host identifier and timestamp, the access control decision comprising a determination as to whether or not the first and/or second credential is allowed access to an asset protected by said reader;

generating, with the first and/or second credential, a first message containing results of said access control decision; and

sending, with the first and/or second credential, said first message to said reader.

2. The method of claim 1, wherein the data transmitted by the reader further comprises at least one of a PIN, a password, biometric identification information, a user selection, and information gathered from one or more sensors.

3. The method of claim 1, further comprising:

said reader transmitting results of said access control decision to an access controller.

4. The method of claim 3, wherein said access controller comprises at least one of a lock for an individual door, a lock for a computer system, a lock for a computer, and a lock for a database.

5. The method of claim 3, wherein said access control decision comprises a grant of access to an asset associated with said access control system, the method further comprising:

said access controller granting a user of the first and/or second credentials access to said asset; and

said reader saving content of said first message in a log.

6. The method of claim 3, wherein said access control decision comprises a denial of access to an asset associated with said access control system, the method further comprising:

said access controller denying a user of the first and/or second credential access to said asset; and

said reader saving content of said first message in a log.

7. The method of claim 1, wherein said first message is encrypted prior to being sent to said reader.

8. The method of claim 1, wherein the data transmitted by the reader further comprises at least one of a control key, a control or access schedule, and an expiration time.

9. The method of claim 1, wherein said reader is a non-networked reader.

10. The method of claim 1, further comprising performing authentication between said reader and the first and/or second credential prior to said reader transmitting data to the first and/or second credential.

11. The method of claim 1, wherein the first credential is a wearable device comprising a processor and memory.

12. An access control system, comprising:

at least one local host for controlling access to an asset;

comprising first credential, comprising;

a memory for storing an access decision application that is capable of making an access decision for the first credential based on data received, either directly or indirectly, from the at least one local host, the access decision comprising a determination as to whether or not the first credential and/or a second credential is allowed access to the asset protected by said at least one local host; and

a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of causing a message to be generated after executing said access decision application and causing said message to be transmitted to the at least one local host, and wherein said message comprises results of said access decision for said credential.

13. The system of claim 12, wherein the second credential is configured to receive the access decision from the first credential and provide the message to the at least one local host.

14. The system of claim 12, wherein said received data comprises at least one of a local host identifier assigned to the at least one local host, authentication information, and a timestamp.

15. The system of claim 12, wherein the at least one local host comprises:

a reader for communicating with one or both of the first credential and second credential; and

an access control device in communication with said reader, wherein results of said access decisions received at said reader are transmitted to said access control device for performance by the access control device consistent with said access decisions.

16. The system of claim 12, wherein the first credential comprises a contact smartcard, a contactless smartcard, a proximity card, a passport, a key fob, a cellular phone, a portable computer, or a Personal Digital Assistant (PDA).

17. A credential for use in a secure access system, comprising:

a memory for storing an access decision application that is capable of making an access decision based on data received from a local host, the access decision comprising a determination as to whether or not the credential and/or a second credential is allowed access to an asset protected by the local host; and

a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of generating a message after executing said access decision application and causing said message to be transmitted to the local host, and wherein said message comprises results of said access decision for said credential.

18. The credential of claim 17, wherein said data received from the local host comprises at least one of a control or access schedule, a control key, an expiration time, a PIN, a password, biometric identification information.

19. The credential of claim 17, wherein the access decision is made for the second credential only in response to determining that the second credential is within a communication range of the local host or the credential itself.

20. The credential of claim 17, a first wireless communication interface that enables communications with the local host;

and a second wireless communication interface that enables communications with the second credential.