DETECTING AND RESPONDING TO AN ATYPICAL BEHAVIOR

• US 20170116798A1
• Filed: 01/06/2017
• Published: 04/27/2017
• Est. Priority Date: 08/24/2007
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Hulusi, Tam, Wamsley, Robert, Davis, Michael L.
• Granted Patent: US 10,403,064 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G07C 2209/08 With time considerations, e.g. temporary activation, valid time window or time limitations
• CPC Class Codes: G07C 9/00896 specially adapted for particular uses
• CPC Class Codes: G07C 9/27 with central registration
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, devices, and systems are provided for optimizing the dissemination of information in various types of systems such as an access control system. More specifically, there are provided herein various mechanisms to provide a modified agent path such that an agent following the modified agent path, may update at least one non-networked reader. The update of the at least one non-networked reader not occurring if the agent follows an unmodified agent path.

Claims

1. A method, comprising:

creating a number of records each associated with a number of presentations of a credential device to a reader for authentication;

determining a predicted behavior from the number of records;

setting an indicator upon determining at least one of the number of records indicates a behavior atypical of the determined predicted behavior.

2. The method of claim 1, further comprising, in response to the indicator being set, performing at least one of requiring a secondary authentication, denying access to a resource, indicating a user associated with the credential device may warrant additional scrutiny, placing an indicia of the atypical behavior on the credential device, alerting other personnel, and triggering an alarm.

3. The method of claim 1, wherein the predicted behavior includes an acceptable amount of deviation.

4. The method of claim 1, wherein, the number of records is further associated with a plurality of credential devices.

5. The method of claim 1, wherein the atypical behavior is an authorized behavior.

6. The method of claim 5, wherein the atypical behavior is determined by at least one of a time of day, day of the week, day of the month, day of the year, and operational status of the site comprising the reader.

7. The method of claim 5, wherein the atypical behavior is determined by at least one of the number of records created within a unit of time.

8. The method of claim 5, wherein the atypical behavior is determined by the location of the reader.

9. The method of claim 5, wherein the atypical behavior is determined by number of records associated with a plurality individuals having a similar predicted behavior.

10. A system, comprising:

a reader operable to read a credential device;

a storage medium; and

a processor operable to;

create a number of records, ones of the records being associated with the presentation of the credential device to the reader,

store the records in the storage medium,

determine an expected behavior from fields of the records, and

set an indicator upon determining that at least one of the records deviates from the determined expected behavior.

11. The system of claim 10, further comprising:

an indicator reader operable to read the indicator; and

a response processor operable to respond to the indicator.

12. The system of claim 11, wherein the response processor causes at least one of requiring a secondary authentication, denying access to a resource, indicating a user associated with the credential device may warrant additional scrutiny, and triggering an alarm.

13. The system of claim 10, wherein the processor determines expected behavior from fields of the records associated with at least one of time of day, day of the week, day of the month, day of the year.

14. The system of claim 10, wherein the processor determines expected behavior from fields of the records associated with the location of the reader.

15. The system of claim 10, wherein the processor determines expected behavior from fields of the records associated with the number of records created within a unit of time.

16. The system of claim 10, wherein the processor determines expected behavior from fields of the records associated with a plurality individuals having a similar predicted behavior.

17. A portable credential device, comprising:

a storage medium; and

a processor operable to;

create a number of records, each record associated with the presentation of the credential device to the reader,

store the records in the storage medium,

determine an expected behavior from fields of the records, and

set an indicator upon determining that at least one of the records deviates from the determined expected behavior.

18. The portable credential device of claim 17, wherein the processor is operable to:

set the indicator upon determining the at least one of the records is associated with an attempt to authenticate the credential device that is in progress, and

block the authentication such that the portable credential device is not authenticated.

19. The portable credential device of claim 18, wherein the processor is further operable to:

require a secondary authentication, and

make a decision to remove the block upon the secondary authentication being determined to be successful.

20. The portable credential device of claim 19, wherein the secondary authentication is a code entered by a user on at least one of the portable credential device.