Systems and methods for updating a mobile device

A method of providing a key update to a mobile device, comprising:

• receiving, via a network interface of a key issuance device, a key update request originated by a mobile device and forwarded by an update reader to the key issuance device over a communication network, wherein the mobile device comprises a network interface that is at least one of:
• limited in functionality, disabled, or otherwise prevented from directly transmitting requests to the key issuance device and wherein the update request was communicated to the update reader via a proximity-based communication channel between the mobile device and the update reader;
• verifying that the mobile device is authorized to receive a key update;
• sending, by a processor of the key issuance device, a retrieval request for the key update from the key issuance device to a key vault that is physically separate from the key issuance device;
• receiving the key update from the key vault in response to the retrieval request, the key update comprising an access control key, wherein the access control key is configured to be provided by the mobile device to an access control reader, different than the update reader, and authorizes access to a physical asset protected by the access control reader;
• and
• sending to the update reader, via the network interface, the key update for the mobile device.

A physical access control system, comprising:

• one or more access control readers that protect one or more respective physical assets;
• an update reader device, different than the one or more access control readers;
• and
• a key issuance backend comprising:
• a network interface that facilitates communications with the update reader via a communication network;
• a processor;
• and
• memory including instructions that, when executed by the processor, enable the key issuance backend to:
• receive from the update reader, via the network interface, a key update request originated by a mobile device and forwarded by the updater reader on behalf of the mobile device to the key issuance backend, wherein the mobile device comprises a network interface that is at least one of:
• limited in functionality, disabled, or otherwise prevented from directly transmitting requests to the key issuance backend and wherein the update request was communicated to the update reader via a proximity-based communication channel between the mobile device and the update reader;
• verify that the mobile device is authorized to receive a key update;
• generate a key update, the key update comprising an access control key, wherein the access control key is configured to be provided by the mobile device to at least one of the one or more access control readers and authorizes access to one or more physical assets protected by the at least one of the one or more access control readers;
• and
• send to the updater reader, via the network interface, the key update for the mobile device.