Method and system for credential management

Patent metadata

Field	Value
Publication number	US-10728244-B2
Application number	US-201615046058-A
Country	US
Kind code	B2
Filing date	Feb 17, 2016
Priority date	Feb 17, 2015
Publication date	Jul 28, 2020
Grant date	Jul 28, 2020

Abstract

A security system comprises an access control node broadcasting a beacon including a time stamp and user devices generating replies to the beacon that are based on credential information for the user of the user device and the time stamp. The system relies on the users' wireless-capable mobile computing devices such as smartphones, tablets, or wireless fobs. A credential management system proves a system for the authentication of users and then issues security tokens as credential information to the users' mobile computing devices. These tokens are presented wirelessly by the devices to the security system's access control nodes, for example, where the access control nodes then decide whether to grant or deny access.

First claim

What is claimed is:

1. A security system comprising:
an access control node broadcasting a beacon including a time stamp, wherein the access control node manages access to an access point, wherein the beacon is broadcast as a Bluetooth transmission; and
smartphone user devices receiving the broadcast of the beacon and generating replies to the beacon that are based on credential information for the user of the user device and the time stamp, and enabling virtual credentialing of users with tokens obtained from a pool of credentials, wherein issued security tokens expire after a certain period of time, and wherein if a user is still validated, then new tokens are issued as part of a rotation, and
wherein the replies are transmitted as a Bluetooth transmission after a random wait time from receipt of the broadcast of the beacon;
wherein the access control node only processes the replies from the user devices received within a predetermined time and includes at least one antenna for receiving the replies from the smartphone user devices to determine positions of the smartphone user devices relative to the access point.

2. A security system as claimed in claim 1 , wherein the beacon further includes a node identification for the node.

3. A security system as claimed in claim 1 , wherein the beacon is broadcast as a Bluetooth low energy transmission.

4. A security system as claimed in claim 1 , wherein the predetermined time is less than 1 second or about 500 milliseconds.

5. A security system as claimed in claim 1 , wherein the replies of the user devices comprise user identifiers for the users of the devices and device identifiers for the user devices.

6. A security system as claimed in claim 1 , wherein the credential information is issued by a third party authentication system server.

7. A security system as claimed in claim 1 , wherein the access control node receives the replies from the user devices and places the replies in a queue for processing.

8. An access control method for a security system, comprising:
broadcasting a beacon including a time stamp at an access control node using Bluetooth transmission, wherein the access control node manages access to an access point; and
receiving replies to the beacon based on the time stamp, wherein the replies are transmitted as a Bluetooth transmission after a random wait time from receipt of the broadcast of the beacon, the replies including credential information of users of smartphone user devices, and enabling virtual credentialing of users with tokens obtained from a pool of credentials, wherein issued security tokens expire after a certain period of time, and wherein if a user is still validated, then new tokens are issued as part of a rotation, and
wherein the access control node includes at least one antenna for receiving the replies from the smartphone user devices to determine positions of the smartphone user devices relative to the access point; and
the access control node only processing the replies from the user devices received within a predetermined time.

9. A method as claimed in claim 8 , wherein the beacon further includes a node identification for the node.

10. A method as claimed in claim 8 , further comprising broadcasting the beacon using Bluetooth low energy transmission protocol.

11. A method as claimed in claim 8 , wherein the predetermined time is less than 1 second.

12. A method as claimed in claim 8 , wherein the replies of the user devices comprise user identifiers for the users of the devices and device identifiers for the user devices.

13. A method as claimed in claim 8 , further comprising issuing the credential information from a third party authentication system server.

14. A method as claimed in claim 8 , further comprising placing the replies from the user devices in a queue for processing.

15. An access control method for a security system, comprising:
broadcasting a beacon including a time stamp and a node identification at an access control node using Bluetooth transmission, wherein the access control node manages access to an access point;
receiving replies to the beacon based on the time stamp, wherein the replies are transmitted as a Bluetooth transmission, the replies including credential information of users of smartphone user devices and being transmitted after a random wait time from receipt of the broadcast of the beacon, and enabling virtual credentialing of users with tokens obtained from a pool of credentials, wherein issued security tokens expire after a certain period of time, and wherein if a user is still validated, then new tokens are issued as part of a rotation, and
wherein the access control node includes at least one antenna for receiving the replies from the smartphone user devices to determine positions of the smartphone user devices relative to the access point;
only placing the replies in a queue that are received within less than 1 second;
retrieving encrypted card identifiers from the replies;
requesting the decryption key from an access control headend;
decrypting the card identifiers using the decryption keys and determining if there are access rights for the users for the access point;
if there are access rights, determining a location of the smartphone user devices; and
only granting access if the smartphone user devices are determined to be adequately close to the access point.

16. A method as claimed in claim 15 , wherein
determining the location of the smartphone user devices includes determining a signal strength of replies from the smartphone user devices.

17. A method as claimed in claim 15 , wherein
determining the location of the smartphone user devices includes determining a time of flight of packet data received at each antenna of the access control node.

Assignees

• Sensormatic Electronics Llc

Inventors

• Trani James
• Martin Walter A

Classifications

• G07C9/00309 Primary

  operated with bidirectional data transmission between data carrier and locks · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04W12/06

  Authentication · CPC title

• H04W12/08

  Access security · CPC title

• G07C2209/08

  With time considerations, e.g. temporary activation, valid time window or time limitations · CPC title