# US 10,769,877 B2 · Secure handsfree proximity-based access control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,877 B2 - Document ID: US10769877B2 - Status: Granted - Kind: B2 - Application number: 16/416,429 - Filed: 2019-05-20 - Published: 2019-09-05 - Granted: 2020-09-08 - Earliest claimed: 2017-03-02 - Assignees: Openpath Security Inc. - Applicants: OpenPath Security Inc. - Inventors: Cameron Kaye; Samy Kamkar; Alexander A. Kazerani - Web page: https://patentgrep.com/patent/US10769877B2 ## CPC - G07C 9/28: the pass enabling tracking or indicating presence - H04W 48/16: Discovering, processing access restriction or access information - G07C 9/00309: {operated with bidirectional data transmission between data carrier and locks} - G07C 9/00571: {operated by interacting with a central unit} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/00: Security arrangements; Authentication; Protecting privacy or anonymity - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04W 48/02: Access restriction performed under specific conditions - H04W 48/18: Selecting a network or a communication service - H04W 64/00: Locating users or terminals {or network equipment} for network management purposes, e.g. mobility management - G07C 2009/00769: {with data transmission performed by wireless means} - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Secure handsfree proximity-based access control is provided by a system that includes one or more system devices located near different secured resources. Each system device may broadcast a changing unique identifier to user devices in wireless range of the system device. The system may also include an application that runs on each user device, and that obtains a signal strength measurement in response to receiving or detecting a current identifier advertised from a system device. The application may request access to a secured resource over one or more available wireless networks in response to satisfying the signal strength threshold. The system may include an access control unit that authorizes access to the secured resource based on the earliest arriving request, and further based on an identifier of the request matching to the current identifier, and the current identifier not having been previously used to obtain access to the secured resource. ## Claims ### Claim 1 A method comprising: receiving, at a user device, an identifier from a system device after the user device enters in range of a wireless network created by the system device; obtaining a signal strength measurement in response to said receiving; determining that the signal strength satisfies a signal strength threshold; providing the identifier as part of an authorization procedure to access a secured resource in response to said determining; and obtaining access to the secured resource in response to (i) the user device or an associated user of the user device being authorized to access the secured resource, (ii) the identifier matching to a most recent identifier broadcast from the system device, and (iii) the identifier not having been previously used to obtain access to the secured resource. ### Claim 2 (depends on 1) The method of claim 1 further comprising: establishing a first network connection with the system device over the wireless network created by the system device after said receiving and in response to initiating the authorization procedure upon determining that the signal strength satisfies the signal strength threshold. ### Claim 3 (depends on 2) The method of claim 2 further comprising: establishing a different second network connection with an access control unit over a different second wireless network contemporaneously with establishing the first network connection and further in response to initiating the authorization procedure upon determining that the signal strength satisfies the signal strength threshold. ### Claim 4 (depends on 3) The method of claim 3, wherein said providing comprises: transmitting a set of access control messaging with the identifier through the wireless network created by the system device via the first network connection; and transmitting a redundant set of access control messaging with the identifier through the second wireless network via the second network connection. ### Claim 5 (depends on 1) The method of claim 1 further comprising: receiving a different second identifier from the system device in response to a user directly interacting with the system device. ### Claim 6 (depends on 1) The method of claim 1, wherein said obtaining the signal strength measurement comprises: measuring a strength of signaling from the wireless network created by the system device. ### Claim 7 (depends on 1) The method of claim 1, wherein said providing comprises: exchanging access control messaging with the identifier over two or more wireless networks in parallel from the user device, wherein the two or more wireless networks comprise the wireless network created by the system device. ### Claim 8 (depends on 7) The method of claim 7, wherein the two or more wireless networks further comprise a Bluetooth network, a WiFi network, and a network of a wireless telecommunications service provider. ### Claim 9 (depends on 1) The method of claim 1, wherein said determining occurs at a first time when the user device is within a specified proximity of the system device, the method further comprising: determining that the signal strength does not satisfy the signal strength threshold at a second time when the user device is not within the specified proximity of the system device; and aborting the authorization procedure until the signal strength satisfies the signal strength threshold. ### Claim 10 A method comprising: detecting a user interaction with a system device; advertising, in response to said detecting, a request identifier to a plurality of user devices that are in range of a wireless network created by the system device; triggering an authorization procedure on a subset of the plurality of user devices based on the request identifier and a signal strength of the wireless network to the subset of user devices satisfying a signal strength threshold; receiving a first identifier with a first request to access a secured resource from a first user device of the subset of user devices at a first time, before receiving a second identifier with a second request to access the secured resource from a second user device of the subset of user devices at a second time; authorizing access to the secured resource at the first time based on (i) the first identifier matching to the request identifier, and (ii) the request identifier not having been previously used to obtain access to the secured resource; authorizing access to the secured resource at the second time based on (i) the first user device or an associated first user of the first user device not being authorized to access the secured resource, (ii) the first identifier not matching to the request identifier, or (iii) the request identifier not having been previously used to obtain access to the secured resource; and providing access to the secured resource in response to earliest successful authorization occurring at the first time or the second time. ### Claim 11 (depends on 10) The method of claim 10 further comprising: successfully authorizing access to the secured resource at the first time based on (i) the first user device or the associated first user of the first user device being authorized to access the secured resource, (ii) the first identifier matching to the request identifier, and (iii) the request identifier not having been previously used to obtain access to the secured resource; and discarding the second request in response to the second identifier matching to the first identifier, and the first identifier being used at the first time to obtain access to the secured resource. ### Claim 12 (depends on 10) The method of claim 10 further comprising: discarding the first request in response to the first identifier not matching to the request identifier; successfully authorizing access to the secured resource at the second time based on (i) the second user device or an associated second user of the second user device being authorized to access the secured resource, (ii) the second identifier matching to the request identifier, and (iii) the request identifier not having been previously used to obtain access to the secured resource as a result of discarding the first request. ### Claim 13 (depends on 10) The method of claim 10, wherein the wireless network created by the system device is a first wireless network, and where said receiving comprises: forwarding the first identifier and the first request from a first network connection created over the first wireless network to an access control unit; and forwarding the second identifier and the second request from a second network connection created over a different second wireless network to the access control. ### Claim 14 (depends on 10) The method of claim 10, wherein said receiving further comprises: receiving the first identifier with a redundant first request at a third time, wherein the first request originates over a first wireless network, and the redundant first request originates over a different second wireless network; and discarding the redundant first request in response to successfully authorizing access at the first time based on the first request. ### Claim 15 (depends on 10) The method of claim 10 further comprising: reducing a range of the wireless network by reducing power to a radio of the system device in response to said detecting and before said advertising. ### Claim 16 (depends on 10) The method of claim 10 further comprising: detecting a second user interaction with the system device; generating a different second request identifier in response to detecting the second user interaction; and advertising the second request identifier to the plurality of user devices that are in range of the wireless network created by the system device. ### Claim 17 An access control system controlling access to at least one secured resource, the access control system comprising: a system device located adjacent to a secured resource, the system device comprising: a radio that advertises a changing request identifier over a wireless network created by the system device; an access control unit comprising: a network interface receiving a first identifier with a first request to access the secured resource from a first user device at a first time, before receiving a second identifier with a second request to access the secured resource from a second user device of the subset of user devices at a second time; one or more processors configured to: authorize access to the secured resource at the first time based on (i) the first identifier matching to a current request identifier advertised from the system device, and (ii) the current request identifier not having been previously used to obtain access to the secured resource; and authorize access to the secured resource at the second time based on (i) the first user device or an associated first user of the first user device not being authorized to access the secured resource, (ii) the first identifier not matching to the current request identifier, or (iii) the current request identifier not having been previously used to obtain access to the secured resource; and provide access to the secured resource in response to earliest successful authorization occurring at the first time or the second time. ### Claim 18 (depends on 17) The access control system of claim 17, wherein the system device further comprises a sensor detecting a user interaction with the system device, and wherein the system device generates the current request identifier and advertises the current request identifier in response to the detecting the user interaction. ### Claim 19 (depends on 17) The access control system of claim 17 further comprising: an access control application installed on the first user device, wherein the access control application uses one or more radios and processors of the first user device to: receive the current request identifier; obtain a signal strength measurement in response to said receiving; determine that the signal strength satisfies a signal strength threshold; and provide the first identifier and the first request via a first wireless network in response to determining that the signal strength satisfies the signal strength threshold. ### Claim 20 (depends on 17) The access control system of claim 17, wherein the access control application further uses one or more radios and processors of the first user device to: provide the first identifier and a duplicate first request via a different second wireless network in response to determining that the signal strength satisfies the signal strength threshold.