Method and apparatus for making a decision on a card

Patent metadata

Field	Value
Publication number	US-10742630-B2
Application number	US-201815990178-A
Country	US
Kind code	B2
Filing date	May 25, 2018
Priority date	Aug 9, 2006
Publication date	Aug 11, 2020
Grant date	Aug 11, 2020

Abstract

Method and devices for making access decisions in a secure access network are provided. The access decisions are made by one or more portable credentials using data and algorithms stored on or received by two or more credentials. Since access decisions are made by the portable credential or credentials, non-networked hosts or local hosts can be employed that do not necessarily need to be connected to a central access controller or database, thereby reducing the cost of building and maintaining the secure access network.

First claim

What is claimed is:

1. A method, comprising:
presenting a first and/or a second credential to a reader, said reader being associated with an access control system;
said reader transmitting data comprising at least one of a host identifier and timestamp to the first and/or second credential;
analyzing, with the first and/or second credential, the at least one of a host identifier and timestamp;
making an access control decision based on the analysis of the at least one of a host identifier and timestamp, the access control decision comprising a determination as to whether or not the first and/or second credential is allowed access to an asset protected by said reader;
generating, with the first and/or second credential, a first message containing results of said access control decision; and
sending, with the first and/or second credential, said first message to said reader.

2. The method of claim 1 , wherein the data transmitted by the reader further comprises at least one of a PIN, a password, biometric identification information, a user selection, and information gathered from one or more sensors.

3. The method of claim 1 , further comprising: said reader transmitting results of said access control decision to an access controller.

4. The method of claim 3 , wherein said access controller comprises at least one of a lock for an individual door, a lock for a computer system, a lock for a computer, and a lock for a database.

5. The method of claim 3 , wherein said access control decision comprises a grant of access to an asset associated with said access control system, the method further comprising: said access controller granting a user of the first and/or second credentials access to said asset; and said reader saving content of said first message in a log.

6. The method of claim 3 , wherein said access control decision comprises a denial of access to an asset associated with said access control system, the method further comprising: said access controller denying a user of the first and/or second credential access to said asset; and said reader saving content of said first message in a log.

7. The method of claim 1 , wherein said first message is encrypted prior to being sent to said reader.

8. The method of claim 1 , wherein the data transmitted by the reader further comprises at least one of a control key, a control or access schedule, and an expiration time.

9. The method of claim 1 , wherein said reader is a non-networked reader.

10. The method of claim 1 , further comprising performing authentication between said reader and the first and/or second credential prior to said reader transmitting data to the first and/or second credential.

11. The method of claim 1 , wherein the first credential is a wearable device comprising a processor and memory.

12. An access control system, comprising:
at least one local host for controlling access to an asset; comprising first credential, comprising:
a memory for storing an access decision application that is capable of making an access decision for the first credential based on data received, either directly or indirectly, from the at least one local host, the access decision comprising a determination as to whether or not the first credential and/or a second credential is allowed access to the asset protected by said at least one local host; and
a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of causing a message to be generated after executing said access decision application and causing said message to be transmitted to the at least one local host, and wherein said message comprises results of said access decision for said credential.

13. The system of claim 12 , wherein the second credential is configured to receive the access decision from the first credential and provide the message to the at least one local host.

14. The system of claim 12 , wherein said received data comprises at least one of a local host identifier assigned to the at least one local host, authentication information, and a timestamp.

15. The system of claim 12 , wherein the at least one local host comprises: a reader for communicating with one or both of the first credential and second credential; and an access control device in communication with said reader, wherein results of said access decisions received at said reader are transmitted to said access control device for performance by the access control device consistent with said access decisions.

16. The system of claim 12 , wherein the first credential comprises a contact smartcard, a contactless smartcard, a proximity card, a passport, a key fob, a cellular phone, a portable computer, or a Personal Digital Assistant (PDA).

17. A credential for use in a secure access system, comprising:
a memory for storing an access decision application that is capable of making an access decision based on data received from a local host, the access decision comprising a determination as to whether or not the credential and/or a second credential is allowed access to an asset protected by the local host; and
a processor for executing said access decision application in connection with said received data, wherein said processor is further capable of generating a message after executing said access decision application and causing said message to be transmitted to the local host, and wherein said message comprises results of said access decision for said credential.

18. The credential of claim 17 , wherein said data received from the local host comprises at least one of a control or access schedule, a control key, an expiration time, a PIN, a password, biometric identification information.

19. The credential of claim 17 , wherein the access decision is made for the second credential only in response to determining that the second credential is within a communication range of the local host or the credential itself.

20. The credential of claim 17 , a first wireless communication interface that enables communications with the local host; and a second wireless communication interface that enables communications with the second credential.

Assignees

• Assa Abloy Ab

Inventors

• Caterino Mark Anthony
• Einberg Fredrik Carl Stefan
• Hoyer Philip
• Berg Daniel
• Davis Masha Leah
• Wamsley Robert
• Hulusi Tam

Classifications

• G07C9/27

  with central registration · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04W12/062

  Pre-authentication · CPC title

• H04W12/06

  Authentication · CPC title