Methods and systems for access control to secure facilities

• US 10,783,506 B2
• Filed: 08/26/2016
• Issued: 09/22/2020
• Est. Priority Date: 08/28/2015
• Status: Active Grant

• Current Assignee: Transparent Wireless Systems, LLC
• Original Assignee: Transparent Wireless Systems, LLC
• Inventors: Dutta, Santanu, Chakravartti, Partha
• Primary Examiner(s): Flynn, Kevin H
• Assistant Examiner(s): Simpson, Dione N.
• Application Number:
  US15/248,486
• Publication Number:
  US 20170061410A1
• Time in Patent Office: 1,488 Days
• Field of Search: 705 13
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: G06Q 50/40 Business processes related to the transportation industry shipping G06Q10/083
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for controlling access to a facility including: sending a first signal from a handset to a plurality of beacon modules using a low energy wireless technology, the signal comprising an identification of the handset or a user; determining received signal strength indication from each of the plurality of beacon modules and determining a time averaged received signal strength indication from each of the plurality of beacon modules. The method also includes determining the location of the handset based on the pattern of the received time-averaged signal strength indications from the plurality of beacon modules, sending a second signal from the beacon modules to an authentication server, the second signal comprising (i) the identification of the handset or a user and (ii) the time-averages received signal strength indication or individual received signal strength indication from each of the plurality of beacon modules and determining at the authentication server the nearest user or handset to an access controlled gate of the facility if a signal from more than one handset is received. The method also includes determining if the handset or user is authorized to enter the facility and opening a gate to allow access to the facility if the handset or user is authorized.

Claims

1. A method for controlling entrance or egress access to a facility having an access controlled gate controlled by a server in which a plurality of handsets located at a plurality of distances from the gate are sending signals, the method comprising:

sending a first signal from each handset to a plurality of beacon modules using a wireless technology, the signal comprising an identification of the handset or a user;

for each of the first signals, determining at each of the plurality of beacon modules, a plurality of Advertisement packets having received signal strength indication values received from each of the plurality of handsets;

averaging the received signal strength indication values to determine averaged values of signal strength indication, received by each of the beacon modules for each of the first signals;

sending second signals from the beacon modules to the server, the second signal comprising (i) the identification of each handset or a user and (ii) the averaged received signal strength indication values or non averaged received signal strength indication values from the plurality of beacon modules;

determining at the server, the nearest user or handset relative to an expected location based on the averaged received signal strength indication values or non averaged received signal strength indication values;

determining, based on authenticating the nearest handset or user, if the nearest handset or user is authorized to enter the facility; and

opening a gate to allow access to the facility if the nearest handset or user is authorized,

wherein a location of the nearest handset or user is determined relative to the locations of other handsets or users, and a determination is made that the user who is allowed access to the facility is the one that is most likely to be in the expected location.

2. The method of claim 1, wherein the facility is a parking garage.

3. The method of claim 1, wherein first signal further comprises a password.

4. The method of claim 3, wherein all signals involving the handset comprises exclusively short range wireless technologies with no use of long range wireless technologies.

5. The method of claim 4, wherein the short range technologies comprise Bluetooth.

6. The method of claim 1, wherein the plurality of beacon modules surround a location where the user is expected to be positioned.

7. The method of claim 6, wherein an actual location of the user is within 0-5 feet a gate.

8. The method of claim 1, wherein the expected location is within 0-5 feet of an access gate.

9. The method of claim 8, wherein the expected location is within 1-3 feet of an access gate.

10. The method of claim 1, further comprising using strong authentication of the user, wherein strong authentication comprises:

authenticating the user to the handset; and

responsive to successful authentication of the user performed in the handset, the handset executing digital signatures using the user'"'"'s private key stored in the handset.

11. The method of claim 10, wherein authenticating the user to the handset comprises using a biometric signature comprising voice, fingerprint or a combination thereof.

12. The method of claim 11, further comprising:

sending a request_positive_confirmation message together with a token comprising a random data string from the sever to a beacon module;

forwarding the request_positive_confirmation message and the token from the beacon module to the handset;

confirming to the handset an intention to enter the facility;

responsive to confirming the intention to enter the facility, the handset encrypting the token with a private key and returning to the beacon module the encrypted token and a digital certificate that contains a public key corresponding to the private key used to encrypt the token;

forwarding the encrypted token and the digital certificate from the beacon module to the server;

checking the validity of the public key contained in the received digital certificate with the server and, responsive to confirmation of validity, decrypting the token data with the said public key, and subject to the decrypted token matching the sent token, declaring the user as authenticated and opening the gate.

13. The method of claim 11, wherein the authentication transaction involves the steps of:

the server sending a request_positive_confirmation message together with a token comprising a random data string to a beacon module,

the beacon module forwarding the request_positive_confirmation message and the token to the handset,

the user confirming to the handset his intention to enter,

responsive to the user indicating his intention to enter, the handset encrypting the token with a secret symmetric key and returning to the beacon module the encrypted token,

forwarding the encrypted token from the beacon module to the server; and

decrypting on the server, token data with the same symmetric key used by the handset, and opening the gate when the decrypted token matches the sent token.

14. The method of claim 10, where strong authentication comprises public key infrastructure.

15. The method of claim 10, wherein strong authentication comprises symmetric encryption.

16. The method of claim 1, wherein the method of controlling access is used for both entrance and egress of the garage.

17. The method of claim 1, wherein the second signals comprises Wi-Fi.

18. The method of claim 1, wherein the location of the handset or user determined relative to other handsets or users comprises comparing patterns of received signal strength indication values as received by the plurality of beacons from each handset located in a coverage range of the beacons.

19. The method of claim 18, wherein the handset determined to be in the expected location is the handset whose pattern of received signal strength indication values most closely matches an expected pattern for the expected location.

20. The method of claim 1, wherein the server performs time averaging of the non-time averaged received signal strength indication values.

21. A system for controlling access to a facility comprising:

a plurality of beacon modules using a wireless technology, wherein each beacon module has a beacon module identification; and

a server performing handset or user authentication,

wherein the plurality of beacon modules are configured to;

receive an identification signal from each of a plurality of radio transmitters, each radio transmitter being associated with a user;

measure a radio signal attribute which depends on the distance of the radio transmitter from the beacon module receiver;

determine a relative location of each radio transmitter, based on the radio signal attribute, with respect to an expected location compared to the relative locations of other radio transmitters with respect to the expected location; and

determine that the user who is allowed access to the facility is the one that is most likely to be in the expected location.

22. The system of claim 21, wherein the relative location of the handset is determined from average values of the received signal strength indications corresponding to the handset as received by the plurality of beacon modules.

23. The system of claim 21, wherein the plurality of beacon modules are configured to surround the handset.

24. The system of claim 21, wherein the facility is a parking garage.

25. The system of claim 21, wherein the system is configured to use strong authentication.

26. The system of claim 21, wherein the strong authentication comprises public key infrastructure.

27. The system of claim 21, wherein strong authentication comprises symmetric encryption.

28. The system of claim 21, wherein the beacon modules are configured to determine the location of the handset within 0-5 feet of a gate.

29. The system of claim 28, wherein the beacon modules are configured to determine the location of the handset within 1-3 feet of a gate.

30. The system of claim 21, further comprising a biometric sensor.

31. The system of claim 21, where the determination of the relative location is made by analyzing distributions of the measured radio signal attribute over the beacon module identifications.

32. The system of claim 21, where the radio signal attribute is the time-averaged received signal strength indication received by each beacon module from each radio transmitter.