# US 10,769,872 B2 · Multi-factor authentication with geolocation and short-range communication with indoor-outdoor detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,872 B2 - Document ID: US10769872B2 - Status: Granted - Kind: B2 - Application number: 16/226,089 - Filed: 2018-12-19 - Published: 2020-06-25 - Granted: 2020-09-08 - Earliest claimed: 2018-12-19 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Michael Zhong; Dragos Lazar; Omar Hassan - Web page: https://patentgrep.com/patent/US10769872B2 ## CPC - G07C 9/00309: {operated with bidirectional data transmission between data carrier and locks} - G07C 9/00182: {operated with unidirectional data transmission between data carrier and locks} - G07C 9/00571: {operated by interacting with a central unit} - H04B 17/318: Received signal strength - H04W 4/02: Services making use of location information - H04W 4/023: {using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/64: using geofenced areas - G07C 2009/00317: {keyless data carrier having only one limited data transmission range} - G07C 2009/00769: {with data transmission performed by wireless means} - G07C 2209/63: Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle - H04L 2463/082: applying multi-factor authentication - H04W 4/027: {using movement velocity, acceleration information} - H04W 4/10: Push-to-Talk [PTT] or Push-On-Call services - H04W 4/21: for social networking applications - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE - H04B: TRANSMISSION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of controlling user access to a protected area is performed by an access control device. In response to detecting a beacon signal transmitted by a user equipment (UE) via a short-range radio access technology (RAT) the access control device determines whether the UE is within the protected area or in an exterior area that is outside the protected area. In some aspects, the access control device determines whether the UE is within the protected area or in the exterior area based on the received beacon signal. In response to determining that the UE is in the exterior area, the access control device performs a multi-factor authentication procedure. If the access control device determines that the UE is within the protected area, the access control device is configured to deny access to the protected area. ## Claims ### Claim 1 A method of controlling user access to a protected area, performed by an access control device, the method comprising: detecting, by the access control device, at least one beacon signal of a plurality of beacon signals periodically transmitted by a user equipment (UE) via a short-range radio access technology (RAT); determining, by the access control device, whether the UE is within the protected area or in an exterior area that is outside the protected area based on the at least one beacon signal; in response to determining that the UE is within the protected area, denying, by the access control device, access to the protected area; and in response to determining that the UE is in the exterior area, performing, by the access control device, an authentication procedure that includes: sending a query to a location server for a current location of the UE; receiving an indication of the current location of the UE from the location server in response to sending the query; determining whether the UE is within a threshold distance of the access control device based on the indication of the current location of the UE; and generating an access signal in response to determining that the UE is within the threshold distance of the access control device based on the indication of the current location of the UE, wherein the access signal indicates that a user associated with the UE is authorized to access the protected area. ### Claim 2 (depends on 1) The method of claim 1, wherein determining whether the UE is within the protected area or outside the protected area comprises: receiving a first beacon signal of the plurality of beacon signals at a first antenna of the access control device; receiving the first beacon signal at a second antenna of the access control device; determining, by the access control device, a first signal strength of the first beacon signal received at the first antenna; determining, by the access control device, a second signal strength of the first beacon signal received at the second antenna; and comparing, by the access control device, the first signal strength to the second signal strength. ### Claim 3 (depends on 2) The method of claim 2, wherein the protected area and the exterior area are separated by a barrier, wherein the first antenna is disposed within the exterior area on a first side of the barrier, and wherein the second antenna is disposed within the protected area on a second side of the barrier, the method further comprising: determining, by the access control device, that the UE is in the exterior area in response to the first signal strength being greater than the second signal strength; and determining, by the access control device, that the UE is within the protected area in response to the second signal strength being greater than the first signal strength. ### Claim 4 (depends on 2) The method of claim 2, wherein determining the first signal strength and the second signal strength comprises determining, by the access control device, a received signal strength indication (RSSI) of the first beacon signal. ### Claim 5 (depends on 1) The method of claim 1, wherein determining whether the UE is within the protected area or outside the protected area comprises: receiving a first beacon signal of the plurality of beacon signals at a first antenna of the access control device; receiving the first beacon signal at a second antenna of the access control device; determining, by the access control device, a first time of arrival of the first beacon signal received at the first antenna; determining, by the access control device, a second time of arrival of the first beacon signal received at the second antenna; and comparing, by the access control device, the first time of arrival with the second time of arrival. ### Claim 6 (depends on 5) The method of claim 5, wherein the protected area and the exterior area are separated by a barrier, wherein the first antenna is disposed within the exterior area on a first side of the barrier, and wherein the second antenna is disposed within the protected area on a second side of the barrier, the method further comprising: determining, by the access control device, that the UE is in the exterior area in response to the first time of arrival being less than the second time of arrival; and determining, by the access control device, that the UE is within the protected area in response to the second time of arrival being less than the first time of arrival. ### Claim 7 (depends on 1) The method of claim 1, wherein the at least one beacon signal includes a unique identifier of the UE, the method further comprising: maintaining, at the access control device, a list of trusted UEs and associated unique identifiers; determining, by the access control device, whether the unique identifier of the UE corresponds to a trusted UE included in the list of trusted UEs, wherein sending the query to the location server for the current location of the UE is in response to determining that the unique identifier of the UE is included in the list of trusted UEs; and denying, by the access control device, access to the protected area in response to determining that the unique identifier of the UE does not correspond to any trusted UEs included in the list of trusted UEs. ### Claim 8 (depends on 7) The method of claim 7, wherein the unique identifier comprises an Integrated Circuit Card Identifier (ICCID) of a subscriber identity module (SIM) card of the UE, an International Mobile Equipment Identity (IMEI) of the UE, or an International Mobile Subscriber Identity (IMSI) of the UE. ### Claim 9 (depends on 1) The method of claim 1, wherein generating the access signal comprises sending, by the access control device, the access signal to a locking mechanism to actuate the locking mechanism between a locked position and an unlocked position. ### Claim 10 (depends on 1) The method of claim 1, wherein generating the access signal comprises sending, by the access control device, the access signal to an automatic door opener to actuate a door between an open position and a closed position. ### Claim 11 An access control device for controlling user access to a protected area, comprising: at least one processor; and at least one memory coupled to the at least one processor, the at least one memory having instructions stored therein, which when executed by the at least one processor, direct the access control device to: detect at least one beacon signal of a plurality of beacon signals periodically transmitted by a user equipment (UE) via a short-range radio access technology (RAT); determine whether the UE is within the protected area or in an exterior area that is outside the protected area based on the at least one beacon signal; in response to determining that the UE is within the protected area, deny access to the protected area; and in response to determining that the UE is in the exterior area, perform an authentication procedure, the authentication procedure comprising instructions to direct the access control device to: send a query to a location server for a current location of the UE; receive an indication of the current location of the UE from the location server in response to sending the query; determine whether the UE is within a threshold distance of the access control device based on the indication of the current location of the UE; and generate an access signal in response to determining that the UE is within the threshold distance of the access control device based on the indication of the current location of the UE, wherein the access signal indicates that a user associated with the UE is authorized to access the protected area. ### Claim 12 (depends on 11) The access control device of claim 11, further comprising: a first antenna; and a second antenna, wherein the instructions to determine whether the UE is within the protected area or outside the protected area comprise instructions to direct the access control device to: receive a first beacon signal of the plurality of beacon signals at the first antenna; receive the first beacon signal at the second antenna; determine a first signal strength of the first beacon signal received at the first antenna; determine a second signal strength of the first beacon signal received at the second antenna; and compare the first signal strength to the second signal strength. ### Claim 13 (depends on 12) The access control device of claim 12, wherein the protected area and the exterior area are separated by a barrier, wherein the first antenna is disposed within the exterior area on a first side of the barrier, and wherein the second antenna is disposed within the protected area on a second side of the barrier, the at least one memory further comprising instructions to direct the access control device to: determine that the UE is in the exterior area in response to the first signal strength being greater than the second signal strength; and determine that the UE is within the protected area in response to the second signal strength being greater than the first signal strength. ### Claim 14 (depends on 12) The access control device of claim 12, wherein the instructions to determine the first signal strength and the second signal strength comprise instructions to determine a received signal strength indication (RSSI) of the first beacon signal. ### Claim 15 (depends on 11) The access control device of claim 11, further comprising: a first antenna; and a second antenna, wherein the instructions to determine whether the UE is within the protected area or outside the protected area comprises instructions to direct the access control device to: receive a first beacon signal of the plurality of beacon signals at the first antenna of the access control device; receive the first beacon signal at the second antenna of the access control device; determine a first time of arrival of the first beacon signal received at the first antenna; determine a second time of arrival of the first beacon signal received at the second antenna; and compare the first time of arrival with the second time of arrival. ### Claim 16 (depends on 15) The access control device of claim 15, wherein the protected area and the exterior area are separated by a barrier, wherein the first antenna is disposed within the exterior area on a first side of the barrier, and wherein the second antenna is disposed within the protected area on a second side of the barrier, the at least one memory further comprising instructions to direct the access control device to: determine that the UE is in the exterior area in response to the first time of arrival being less than the second time of arrival; and determine that the UE is within the protected area in response to the second time of arrival being less than the first time of arrival. ### Claim 17 (depends on 11) The access control device of claim 11, wherein: the at least one memory has a list of trusted UEs and associated unique identifiers; and the authentication procedure comprises further instructions to direct the access control device to: determine whether a unique identifier of the UE corresponds to a trusted UE included in the list of trusted UEs, wherein sending the query to the location server for the current location of the UE is in response to determining that the unique identifier of the UE is included in the list of trusted UEs; and deny access to the protected area in response to determining that the unique identifier of the UE does not correspond to any trusted UEs included in the list of trusted UEs. ### Claim 18 One or more non-transitory computer-readable media storing computer-executable instructions, which when executed by at least one processor of an access control device that is configured to control user access to a protected area, direct the access control device to: detect at least one beacon signal of a plurality of beacon signals periodically transmitted by a user equipment (UE) via a short-range radio access technology (RAT); determine whether the UE is within the protected area or in an exterior area that is outside the protected area based on the at least one beacon signal; in response to determining that the UE is within the protected area, deny access to the protected area; and in response to determining that the UE is in the exterior area, perform an authentication procedure, the authentication procedure comprising instructions to direct the access control device to: send a query to a location server for a current location of the UE; receive an indication of the current location of the UE from the location server in response to sending the query; determine whether the UE is within a threshold distance of the access control device based on the indication of the current location of the UE; and generate an access signal in response to determining that the UE is within the threshold distance of the access control device based on the indication of the current location of the UE, wherein the access signal indicates that a user associated with the UE is authorized to access the protected area. ### Claim 19 (depends on 18) The one or more non-transitory computer-readable media of claim 18, wherein the instructions to direct the access control device to determine whether the UE is within the protected area or in the exterior area comprises instructions to direct the access control device to: receive a first beacon signal of the plurality of beacon signals at a first antenna of the access control device; receive the first beacon signal at a second antenna of the access control device; determine a first property of the first beacon signal received at the first antenna; determine a second property of the first beacon signal received at the second antenna; and compare the first property to the second property. ### Claim 20 (depends on 18) The one or more non-transitory computer-readable media of claim 18, wherein the authentication procedure comprises further instructions to direct the access control device to: determine whether a unique identifier of the UE corresponds to a trusted UE included in a list of trusted UEs maintained by the access control device, wherein sending the query to the location server for the current location of the UE is in response to determining that the unique identifier of the UE is included in the list of trusted UEs; and deny access to the protected area in response to determining that the unique identifier of the UE does not correspond to any trusted UEs included in the list of trusted UEs.