Networked access control system

Patent metadata

Field	Value
Publication number	US-2016014131-A1
Application number	US-201514796501-A
Country	US
Kind code	A1
Filing date	Jul 10, 2015
Priority date	Jul 10, 2014
Publication date	Jan 14, 2016
Grant date	—

Abstract

Methods and systems for controlling a network access control system that includes a server encrypting a first identifier that can be related to a registered user and communicating the encrypted first identifier to the mobile device. The lock device receives, from the mobile device, a first data set that includes at least the encrypted first identifier. The lock device may encrypt the first data set to generate a second data set and communicates the encrypted second data set to the mobile device. The server receives a third data set that includes at least the encrypted second data set and a second identifier that can also be related to the registered user. The server extracts from the communicated third data set the first and second identifiers, and the extracted first and second identifiers are compared to verify that the second identifier is indeed related to the first identifier.

First claim

1 . A method for controlling a network access control system having a server, a mobile device, and a lock device, the method comprising:
encrypting, by the server, a first identifier related to a registered user of the mobile device; communicating the encrypted first identifier to the mobile device; receiving, by the lock device from the mobile device, a first data set, the first data set including at least the encrypted first identifier; encrypting, by the lock device, at least the received first data set to generate a second data set; communicating the encrypted second data set from the lock device to the mobile device; receiving, by the server from the mobile device, a third data set, the third data set including at least the encrypted second data set and a second identifier, the second identifier being related to a registered user of the mobile device; extracting, by the server, from the communicated third data set the first and second identifiers; and comparing the extracted first and second identifiers to verify that the second identifier is related to the first identifier.

2 . The method of claim 1 , wherein the first and second identifiers relate to an application that is installed on the mobile device.

3 . The method of claim 1 , wherein the step of extracting the first and second identifiers includes the steps of:
retrieving, by the server, an encryption key; decrypting, using the retrieved encryption key, at least a portion of the second data set that was included in the received third data set to extract the first data set; and decrypting the extracted first data set to extract the first identifier.

4 . The method of claim 3 , wherein the step of retrieving the encryption key further includes the steps of extracting a non-encrypted identifier from the second data set and accessing a database to identify the encryption key based on the extracted non-encrypted identifier.

5 . The method of claim 4 , wherein the database is a database of the server.

6 . The method of claim 5 , wherein the sever is a cloud-based server.

7 . The method of claim 4 , wherein the database is an auxiliary database.

8 . A method for controlling a network access control system having a server, a mobile device, and a lock device, the method comprising:
installing on the lock device an encryption key; communicating to an application on the mobile device an encrypted application token, the encrypted application token including a first identifier; receiving, by the lock device from the application, the encrypted application token; encrypting, by the lock device using the assigned encryption key, at least the communicated encrypted application token to generate lock encrypted data; communicating, from the lock device to the application, the lock encrypted data; receiving, by the server from the application, the lock encrypted data and a second identifier, the first and second identifiers being related to each other; decrypting, by the server using the assigned encryption key, the lock encrypted data to extract the encrypted application token and the second identifier; decrypting, by the server, the extracted encrypted application token to extract the first identifier; verifying, by the server, that the extracted first identifier is related to the extracted second identifier; encrypting, based on verification that the first and second identifiers are related and using the assigned encryption key, lock capture data, the lock capture data including a first key for decrypting the encrypted application token; and decrypting, by the lock device using the assigned encryption key, the lock capture data.

9 . The method of claim 8 , further including the steps of:
terminating communications between the lock device and the application following the decryption of the lock capture data; receiving, by the lock device from the application after termination of the communications, a request for communication with the lock device; communicating, in response to the request for communication, a query from the lock device to the application; receiving, by the lock device from the application, a response to the query; evaluating, by the lock device, the accuracy of the received response; and authenticating, by the lock device, a communication from the application if the evaluation indicates the received response is accurate.

10 . The method of claim 8 , further including the steps of:
recording, by the lock device, the first key extracted from the lock capture data; receiving, by the lock device from the application, the encrypted application token; decrypting, by the lock device using the first key, the encrypted application token to extract data from the encrypted application token; and authorizing, by the lock device, based on at least extracted data from the encrypted application token, communications between the lock device and the mobile device.

11 . The method of claim 10 , further including the steps of:
determining whether a predetermined interval has expired; discarding, by the lock device, at least a portion of the data extracted by the lock device from the encrypted application token upon determining the expiration of the predetermined interval; and de-authorizing, by the lock device, receipt of further communications from the application that utilize discarded extracted data.

12 . The method of claim 11 , wherein the data extracted from the encrypted application token by the lock device includes a temporary encryption key, and wherein the step of discarding data includes discarding the temporary encryption key.

13 . The method of claim 8 , wherein the first and second identifiers are identifiers of the application.

14 . A method for controlling a network access control system having a server, a mobile device, and a lock device, the method comprising:
assigning a registered user account a first key; assigning the lock device an encryption key; encrypting at least a first identifier related to the registered user account using the first key to generate an encrypted application token; communicating the encrypted application key from the server to the mobile device; receiving, by the lock device, the encrypted application token and a second identifier from the mobile device, the second identifier related to the registered user account; encrypting, by the lock device using the encryption key, the encrypted application token and the second identifier to generate lock encrypted data; communicating the lock encrypted data from the lock device to the mobile device; receiving, by the server, the lock encrypted data from the mobile device; decrypting, by the server, the lock encrypted data using the assigned encryption key to extract the second identifier; decrypting, using the first key, the encrypted application token from the decrypted lock encrypted data to extract the first identifier; and comparing the extracted first and second identifiers to verify that the second identifier is related to the first identifier.

15 . The method of claim 14 , wherein the step of communicating the lock encrypted data from the lock device further includes communicating a lock identifier from the lock device to the mobile device, and wherein the step of receiving, by the server the lock encrypted data further includes receiving the lock identifier.

16 . The method of claim 15 , further including the steps of locating, by the server, the encryption key in a database using the lock identifier and retrieving the encryption key from the database.

17 .

Assignees

• Schlage Lock Co Llc

Inventors

• Neafsey Jeffrey Scott
• Baumgarte Joseph Wayne
• Dexter Matthew
• Harrold Ed

Classifications

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title