SYSTEMS AND METHODS FOR CONTROLLING ACCESS WITHIN A SYSTEM OF NETWORKED AND NON-NETWORKED PROCESSOR-BASED SYSTEMS

• US 20070219950A1
• Filed: 02/21/2007
• Published: 09/20/2007
• Est. Priority Date: 02/25/2002
• Status: Active Grant

• Current Assignee: Crawford Cs
• Original Assignee: Crawford Cs
• Inventors: Crawford, C.S.
• Granted Patent: US 7,464,858 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder

Abstract

In one embodiment, a method controls access rights within a system. The method comprises: physically transporting a portable card by the first end-user from a networked processor-based system to multiple non-networked processor-based systems; processing respective access attempts from the first end-user by the multiple non-networked processor-based systems, wherein the access attempts occur when the first-end user is in physical proximity to the multiple non-networked processor-based systems; and in conjunction with processing of the respective access attempts by the multiple non-networked processor-based systems, reading the revocation data from the portable card of the first-end user by the multiple non-networked processor-based systems and locally storing the revocation data by the multiple non-networked processor-based systems, wherein upon storing the updated revocation data, the multiple non-networked processor-based systems become operable to deny access to a second end-user.

Claims

1. A method of controlling access rights within a system, the system comprising at least one security server for managing access rights and at least one networked processor-based system that processes access attempts to provide or deny access and multiple non-networked processor-based systems that process access attempts to provide or deny access, the method comprising:

processing an access attempt from a first end-user by the at least one networked processor-based system, wherein the access attempt occurs when the first-end user is in physical proximity to the at least one networked processor-based system, wherein the first end-user does not manage, control, or modify access rights within the system;

in conjunction with processing of the access attempt by the networked processor-based system, reading a portable card by the at least one networked processor-based system, wherein the portable card belongs to the first end-user and comprises data identifying the first end-user and data relevant to the access rights associated with the first end-user;

obtaining revocation data by the networked processor-based system from the at least one security server, the revocation data indicating previously existing access rights allowing access that are specific to a second end-user have been revoked, wherein the second end-user does not manage, control, or modify access rights within the system, and wherein the first-end user and the second end-user are employees of a common organization;

in conjunction with processing of the access attempt by the networked processor-based system, writing the obtained revocation data by the networked processor-based system to the portable card of the first end-user;

physically transporting the portable card by the first end-user from the networked processor-based system to multiple non-networked processor-based systems;

processing respective access attempts from the first end-user by the multiple non-networked processor-based systems, wherein the access attempts occur when the first-end user is in physical proximity to the multiple non-networked processor-based systems; and

in conjunction with processing of the respective access attempts by the multiple non-networked processor-based systems, reading the revocation data from the portable card of the first-end user by the multiple non-networked processor-based systems and locally storing the revocation data by the multiple non-networked processor-based systems, wherein upon storing the updated revocation data, the multiple non-networked processor-based systems become operable to deny access to the second end-user.

2. The method of claim 1 wherein the at least one security server maintains one or several databases that store and associate data pertaining to the end-user employees of the common organization, networked and non-networked processor-based systems of the common organization, and access rights specific to the common organization

3. The method of claim 1 further comprising:

clearing out-dated revocation data from local memory by the non-networked processor based systems.

4. The method of claim 1 further comprising:

cryptographically processing the revocation data for writing the revocation data on the portable card of the first end-user.

5. The method of claim 1, wherein information stored on the portable card of the first-end user that identifies the first-end user is a serial number that is correlated to the first-end user by an entry in a database associated with the at least one security server.

6. The method of claim 1, wherein the revocation data identifies the second end-user utilizing another serial number that is correlated to the second end-user by an entry in a database associated with the at least one security server.

7. The method of claim 1, wherein the revocation data identifies the second end-user utilizing a cryptographic key or digital signature that is correlated to the second end-user by an entry in a database associated with the at least one security server.