Wireless access credential system

Patent metadata

Field	Value
Publication number	US-11388595-B2
Application number	US-201916578747-A
Country	US
Kind code	B2
Filing date	Sep 23, 2019
Priority date	Sep 21, 2018
Publication date	Jul 12, 2022
Grant date	Jul 12, 2022

Abstract

An access control system and methods according to at least one embodiment leverage wireless access credentials to allow a user to securely gain access to a secured area using his or her mobile device. As such, a credentialed mobile device may permit access to the secured area without requiring a real-time connection to a credential management system and/or an administrative system.

First claim

What is claimed is:

1. A method of using a wireless access credential in an access control system including at least a server system, a mobile device, and an access control edge device, the method comprising:
encrypting, by the server system and using a symmetric cryptographic key stored by the server system and the access control edge device, a credential blob including the wireless access credential and a first public cryptographic key provided by the mobile device, wherein the first public cryptographic key and a first private cryptographic key are a first asymmetric cryptographic key pair stored by the mobile device;
transmitting, by the server system, the encrypted credential blob to the mobile device for storage by the mobile device;
establishing a secure wireless communication connection between the mobile device and the access control edge device including generating a shared cryptographic key;
encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob;
cryptographically signing, by the mobile device and using the first private cryptographic key, the encrypted credential message;
transmitting, by the mobile device, the encrypted and signed credential message to the access control edge device;
decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob;
decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential; and
unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential.

2. The method of claim 1 , further comprising:
cryptographically signing, by the mobile device and using the first private cryptographic key, a credential request including the first public cryptographic key;
transmitting, by the mobile device, the signed credential request to the server system; and
verifying, by the server system, the credential request signature based on the first public cryptographic key retrieved from the signed credential request;
wherein encrypting the credential blob comprises encrypting the credential blob in response to successful verification of the credential request signature.

3. The method of claim 2 , further comprising:
generating, by the server system, a keyed hash of the encrypted credential blob using the symmetric cryptographic key;
wherein transmitting the encrypted credential blob further comprises transmitting the keyed hash to the mobile device for storage by the mobile device; and
wherein the credential message further includes the keyed hash.

4. The method of claim 3 , wherein the keyed hash comprises a keyed-hash message authentication code (HMAC).

5. The method of claim 3 , further comprising:
verifying, by the access control edge device and using the symmetric cryptographic key, the keyed hash in the credential message in response to decrypting the encrypted and signed credential message; and
verifying, by the access control edge device, the credential message signature based on the first public cryptographic key extracted from the decrypted credential blob.

6. The method of claim 2 , further comprising:
encrypting, by the access control edge device and using the shared cryptographic key, challenge data;
transmitting, by the access control edge device, the encrypted challenge data to the mobile device; and
decrypting, by the mobile device and using the shared cryptographic key, the encrypted challenge data;
wherein the credential message further includes the challenge data.

7. The method of claim 6 , further comprising:
verifying, by the access control edge device, the challenge data in response to decrypting the encrypted and signed credential message.

8. The method of claim 2 , further comprising:
cryptographically signing, by the server system, the encrypted credential blob using a second private cryptographic key, wherein the second private cryptographic key and a second public cryptographic key are a second asymmetric cryptographic key pair stored by the server system, and wherein the second public cryptographic key is stored by the access control edge device;
wherein transmitting the encrypted credential blob comprises transmitting the signed and encrypted credential blob to the mobile device for storage by the mobile device; and
wherein the credential message includes the signed and encrypted credential blob.

9. The method of claim 8 , further comprising:
verifying, by the access control edge device, the encrypted credential blob signature based on the second public cryptographic key retrieved from a memory of the access control edge device; and
verifying, by the access control edge device, the credential message signature based on the first public cryptographic key extracted from the decrypted credential blob.

10. The method of claim 1 , further comprising: encrypting, by the access control edge device and using the shared cryptographic key, pin request data; transmitting, by the access control edge device, the encrypted pin request data to the mobile device; and decrypting, by the mobile device and using the shared cryptographic key, the pin request data.

11. The method of claim 10 , further comprising: receiving, by the mobile device, a pin value entered by a user of the mobile device; encrypting, by the mobile device and using the shared cryptographic key, a pin response including the pin value and the pin request data; and transmitting, by the mobile device, the encrypted pin response to the access control edge device.

12. The method of claim 11 , further comprising:
decrypting, by the access control edge device and using the shared cryptographic key, the pin response;
verifying, by the access control edge device, the pin request data in response to decrypting the pin response; and
authenticating the pin value in response to successful verification of the pin request data.

13. The method of claim 12 , wherein unlocking the lock mechanism comprises unlocking the lock mechanism in response to successful authentication of the wireless access credential and successful authentication of the pin value.

14. The method of claim 1 , wherein the first asymmetric cryptographic key pair comprises an elliptical curve cryptography key pair.

15. The method of claim 1 , wherein generating the shared cryptographic key comprises performing an Elliptical Curve Diffie-Hellman key exchange.

16. The method of claim 1 , further comprising:
encrypting, by the mobile device and using a third public cryptographic key, the encrypted credential blob received from the server system prior to storage of the encrypted credential blob, wherein the third public cryptographic key and a second private cryptographic key are a third asymmetric cryptographic key pair stored by the mobile device; and
decrypting, by the mobile device and using the third private cryptographic key, the stored encrypted credential blob prior to building the credential message.

17. An access control system, comprising:
an access control edge system comprising a lock mechanism;
a mobile device; and
a server system to (i) encrypt, using a symmetric cryptographic key stored by the server system and the access control edge system, a credential blob including a wireless access credential and a first public cryptographic key provided by the mobile device, wherein the

Assignees

• Schlage Lock Co Llc

Inventors

• Everson Jonathan R
• Ross Gregory
• Kaufman Seth
• Johnson Dakoda
• Bauer Christopher
• Luif John
• Evenson John
• Santhanakrishnan Lakshmi
• Duckworth Mark
• Broerman Keith R
• Baumgarte Joseph W
• Dexter Matthew
• Hopkins Benjamin J
• Studt David

Classifications

• G07C9/00309

  operated with bidirectional data transmission between data carrier and locks · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04W12/08 Primary

  Access security · CPC title

• G07C2009/00388

  code verification carried out according to the challenge/response method · CPC title