Identity token based security system and method

Patent metadata

Field	Value
Publication number	US-10013826-B2
Application number	US-201615240569-A
Country	US
Kind code	B2
Filing date	Aug 18, 2016
Priority date	Aug 18, 2015
Publication date	Jul 3, 2018
Grant date	Jul 3, 2018

Abstract

An identity token based access control system and method is disclosed. A distributed security system that manages access to business and/or governmental entities creates an identity credential for a user and obtains or generates a globally unique identity token for the user, and loads the identity credential and the identity token onto a user device. The user then presents the user device including the identity credential and the identity token to an access control system (ACS) of the security system of the business entity that generated the identity token to obtain access to its security system, or to an ACS of a security system of one or more third party business entities that support the use of identity tokens to obtain access to the security systems of the third party business entities. The identity tokens are preferably random numbers or strings. The identity credentials typically include biometric information for users.

First claim

What is claimed is:

1. A distributed security system, comprising:
an access control system that controls access to an access point of a first entity based on identity credentials presented by user devices of users;
a local identity issuance service of the first entity that loads the identity credentials onto user devices and globally unique identity tokens;
a token issuance service that provides the globally unique identity tokens to the local identity issuance service for the users;
an access control system that controls access to an access point of a second entity based on identity credentials presented by user devices of users; and
a local identity issuance service of the second entity that loads the identity credentials onto user devices and the globally unique identity tokens from the token issuance service;

wherein the local identity issuance service of the second entity extracts the globally unique identity tokens from the identity credentials and then creates a new association between the globally unique identity token and a locally created credential for the second entity.

2. The system as claimed in claim 1 , wherein the globally unique identity tokens are random numbers or strings.

3. The system as claimed in claim 1 , wherein the access control system receives the identity credentials wirelessly from the user devices.

4. The system as claimed in claim 1 , wherein the identity credentials are transmitted using Bluetooth Low Energy (BLE) signals.

5. The system as claimed in claim 1 , wherein the identity credentials include biometric information for the user.

6. The system as claimed in claim 1 , wherein the identity credentials include challenge questions and matching answers.

7. The system as claimed in claim 1 , wherein each of the first entity and the second entity has a respective local identity enrollment location at which the users present credentials to obtain the identity credentials.

8. The system as claimed in claim 7 , wherein the presented credentials include biometric information.

9. The system as claimed in claim 1 , wherein the local identity issuance service of the second entity performs a lookup of the identity credentials of the users against the token identity service to determine whether the users are valid users of the first entity.

10. A distributed security method, comprising:
providing an access control system that controls access to an access point of a first entity based on identity credentials presented by user devices of users;
using a local identity issuance service of the first entity to load the identity credentials onto user devices and globally unique identity tokens; and
providing the globally unique identity tokens to the local identity issuance service for the users from a token issuance service;
an access control system of a second entity controlling access to access points of the second entity based on identity credentials presented by user devices of users;
a local identity issuance service of the second entity loading the identity credentials onto user devices and the globally unique identity tokens from the token issuance service; and
the local identity issuance service of the second entity extracting the globally unique identity tokens from the identity credentials and then creating a new association between the globally unique identity token and a locally created credential for the second entity.

11. The distributed security method as claimed in claim 10 , wherein the globally unique identity tokens are random numbers or strings.

12. The distributed security method as claimed in claim 10 , wherein the access control system receives the identity credentials wirelessly from the user devices.

13. The distributed security method as claimed in claim 10 , wherein the identity credentials are transmitted using Bluetooth Low Energy (BLE) signals.

14. The distributed security method as claimed in claim 10 , wherein the identity credentials include biometric information for the user.

15. The distributed security method as claimed in claim 10 , wherein the identity credentials include challenge questions and matching answers.

16. The distributed security method as claimed in claim 10 , wherein the local identity issuance service of the second entity performs a lookup of the identity credentials of the users against the token identity service to determine whether the users are valid users of the first entity.

Assignees

• Sensormatic Electronics Llc

Inventors

• Ouellette Jason M

Classifications

• G07C9/257

  electronically (G07C9/26 takes precedence) · CPC title

• G07C9/21 Primary

  having a variable access code · CPC title

• G07C2209/02

  Access control comprising means for the enrolment of users · CPC title

• G07C9/25

  using biometric data, e.g. fingerprints, iris scans or voice recognition · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title