Access management

Patent metadata

Field	Value
Publication number	US-11200307-B2
Application number	US-201515777807-A
Country	US
Kind code	B2
Filing date	Dec 3, 2015
Priority date	Dec 3, 2015
Publication date	Dec 14, 2021
Grant date	Dec 14, 2021

Abstract

According to an example aspect of the present invention, there is provided an apparatus comprising a memory configured to store an encryption key and a list of access tokens and at least one processing core configured to select a first access token from the list of access tokens based, at least partly, on at least one of a current time and a sequence number, decide, based at least partly on the first access token, whether to grant a user device access to the apparatus, and cause the apparatus to receive a second list of access tokens from at least one of the user device and a second user device.

First claim

The invention claimed is:

1. An apparatus comprising:
at least one processing core, and
at least one memory including computer program code,
the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to:
select a first access token from a list of access tokens, stored in the apparatus, each access token comprising cryptographic information, the selecting of the first access token being based, at least partly, on at least one of a current time and a sequence number indicating a sequence of access tokens in the list;
decide, based at least partly on the first access token, whether to grant a user device access to the apparatus, the user device being distinct from the apparatus;
cause the apparatus to receive a second list of access tokens from a second user device and use the second list of access tokens in deciding on granting access to the apparatus to user devices other than the second user device, and
store a plurality of lists of access tokens, each list of access tokens comprising access tokens that are usable in obtaining a different level of access to the apparatus, the second list comprising a second plurality of lists of access tokens.

2. The apparatus according to claim 1 , wherein the at least one processing core is further configured, with the least one memory including computer program code, to cause the apparatus to receive the second list of access tokens over a short-range wireless interface.

3. The apparatus according to claim 2 , wherein the short-range wireless interface comprises a short-range radio interface.

4. The apparatus according to claim 1 , wherein each list corresponds to a distinct role a user may assume with respect to the apparatus.

5. The apparatus according to claim 1 , wherein the at least one processing core is further configured to select the first access token based at least partly on the current time, wherein each access token is associated with a validity time interval.

6. The apparatus according to claim 1 , wherein the at least one processing core is further configured, with the at least one memory including computer program code, to select the first access token based at least partly on the sequence number by allowing each access token to be used a set number of times.

7. The apparatus according to claim 1 , wherein the at least one processing core is further configured, with the at least one memory including computer program code, to select the first access token based at least partly on the sequence number, wherein each access token is enabled for a preconfigured time duration, after which the sequence number used is incremented.

8. The apparatus according to claim 1 , wherein the at least one processing core is further configured, with the at least one memory including computer program code, to cause the apparatus to advertise at least one of the current time and the sequence number.

9. The apparatus according to claim 1 , wherein the at least one processing core is further configured, with the at least one memory including computer program code, to cause the apparatus to decrypt the second list of the access tokens, using an encryption key stored in the apparatus, and to authenticate the second list of the access tokens based at least partly based on a result of the decrypting.

10. An apparatus comprising at least one processing core, at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to:
obtain a list of access tokens, each access token comprising cryptographic information;
process information, the information comprising at least one of a sequence number and a current time indication;
select, based at least partly on the at least one of the sequence number and the current time indication, a first access token from the list of the access tokens and establish a connection with a first device based at least partly on the first access token, the first device being an access controlled device or a controller of the access controlled device, and
obtaining, in the apparatus, a second list of access tokens, the second list comprising a plurality of lists of access tokens, each list of access tokens comprising access tokens that are usable in obtaining a different level of access to the first device, and providing the second list of access tokens to the first device to use in deciding on granting access to the first device to user devices other than the apparatus, the apparatus comprising a user device which is distinct from the first device.

11. The apparatus according to claim 10 , wherein the at least one memory and the computer program code are further configured to, with the at least one processing core, cause the apparatus to select the first access token based at least partly on the current time, wherein each access token is associated with a validity time interval.

12. The apparatus according to claim 10 , wherein the at least one memory and the computer program code are further configured to, with the at least one processing core, cause the apparatus to select the first access token based at least partly on the sequence number, each access token being allowed to be used a set number of times.

13. The apparatus according to claim 10 , wherein the at least one memory and the computer program code are further configured to, with the at least one processing core, cause the apparatus to select the first access token based at least partly on the sequence number, wherein each access token is enabled for a preconfigured time duration, after which the sequence number used is incremented.

14. A method comprising:
storing, in an apparatus, an encryption key and a list of access tokens, each access token comprising cryptographic information;
selecting a first access token from the list of the access tokens based, at least partly, on at least one of a current time and a sequence number indicating a sequence of access tokens in the list;
deciding, based at least partly on the first access token, whether to grant a user device access to an apparatus, the user device being distinct from the apparatus, and
causing the apparatus to receive a second list of access tokens from at least one of the user a second user device and using the second list of access tokens in deciding on granting access to the apparatus to user devices other than the second user device, wherein the storing comprises storing a plurality of lists of access tokens, each list of access tokens comprising access tokens that are usable in obtaining a different level of access to the apparatus, the second list comprising a second plurality of lists of access tokens.

15. The method according to claim 14 , comprising receiving the second list of the access tokens over a short-range wireless interface.

16. The method according to claim 15 , wherein the short-range wireless interface comprises a short-range radio interface.

17. The method according to claim 14 , wherein each list corresponds to a distinct role a user may assume with respect to the apparatus.

Assignees

• Nokia Technologies Oy

Inventors

• Koskimies Olli Oskari
• Mikola Timo Tapani
• Blants Lioudmila Lucy

Classifications

• H04W12/61

  Time-dependent · CPC title

• G06F2221/2109

  Game systems · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04W4/80

  Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication · CPC title