# US 12,602,962 B2 · Contactless optical internet of things user identification device and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,962 B2 - Document ID: US12602962B2 - Status: Granted - Kind: B2 - Application number: 17/407,997 - Filed: 2021-08-20 - Published: 2023-02-23 - Granted: 2026-04-14 - Earliest claimed: 2021-08-20 - Assignees: U.S. Bank National Association - Applicants: U.S. Bank National Association - Inventors: Justin P Yunke; Adam J. Achterhoff - Web page: https://patentgrep.com/patent/US12602962B2 ## CPC - G07C 9/22: in combination with an identity check of the pass holder - G07C 11/00: Arrangements, systems or apparatus for checking, e.g. the occurrence of a condition, not provided for elsewhere - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 21/35: communicating wirelessly - G06F 21/606: {by securing the transmission between two devices or processes} - G06K 7/1413: {1D bar codes} - G06K 7/1417: {2D bar codes} - G07C 9/20: involving the use of a pass - G07C 9/27: with central registration - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS ## Abstract A contactless optical device is useable to identify a user, and allows an enterprise to authorize access by that user to enterprise facilities and/or cause presentation of user information of the user. The device is specifically adapted for secure usage within an enterprise network via a wired network interface. The device avoids storage of user-identifying data in persistent memory, to avoid compromise of user data if the device were lost or stolen, or otherwise removed from the enterprise network. ## Claims ### Claim 1 A contactless optical user identification device comprising: an optical code capture device comprising an optical image capture device and an optical code translation circuit, the optical code translation circuit configured to recognize and translate a machine-readable optical label captured in an image by the optical image capture device into a binary code; a wired network access interface communicatively connected to a control circuit and providing both a wired network access connection and power connection for the contactless optical user identification device; a control circuit communicatively connected to the optical code capture device, the control circuit comprising: one or more processors; and a memory comprising: a non-volatile memory storing a general purpose operating environment and bootstrap instructions, the bootstrap instructions, when executed by the one or more processors, initialize the device, wherein to initialize the device includes to: establish communication with a bootstrap server identified in the bootstrap instructions; transmit an identifier of the contactless optical user identification device identified in the bootstrap instructions to the bootstrap server; and receive, from the bootstrap server, special-purpose operating instructions, wherein the bootstrap server validates the identifier and selects the special-purpose operating instructions based at least in part on a role assigned to the contactless optical user identification device, wherein the role is determined, based at least in part, on the identifier; a volatile memory configured to receive the special-purpose operating instructions, the special-purpose operating instructions causing the device to: in response to capture of an image of the machine-readable optical label presented by a user and translation of the machine-readable optical label into a binary code: securely transmit the translated binary code to an identification server; and receive, in response to the translated binary code, an indication of a result of identification of the user from the identification server; wherein the memory is configured such that, when power is not supplied to the memory, the bootstrap instructions persist in the memory and the special-purpose operating instructions do not persist in the memory. ### Claim 2 (depends on 1) The contactless optical user identification device of claim 1, wherein the non-volatile memory lacks special-purpose operating instructions allowing the contactless optical user identification device to authenticate a user in response to capture of an image of an optical label. ### Claim 3 (depends on 1) The contactless optical user identification device of claim 1, wherein the identification server is identified in the special-purpose operating instructions. ### Claim 4 (depends on 1) The contactless optical user identification device of claim 1, wherein the one or more processors and the identification server do not receive the image of the machine-readable optical label. ### Claim 5 (depends on 1) The contactless optical user identification device of claim 1, wherein the bootstrap server is accessible only from within an enterprise network. ### Claim 6 (depends on 1) The contactless optical user identification device of claim 1, wherein the special-purpose operating instructions cause the contactless optical user identification device to: at a predetermined time, transmit a message to the identification server; in response to the message, receive one or more updates to the special-purpose operating instructions. ### Claim 7 (depends on 1) The contactless optical user identification device of claim 1, wherein the device does not persist any association between a translated binary code and a result of identification of the user in non-volatile memory. ### Claim 8 (depends on 1) The contactless optical user identification device of claim 1, wherein the optical code capture device communicates the translated binary code to the control circuit without retaining or communicating the image of the machine-readable optical label. ### Claim 9 A method comprising: in response to execution of a bootstrap instruction from nonvolatile memory, initializing a contactless optical user identification device, wherein the initializing includes: establishing communication with a bootstrap server identified by the bootstrap instructions; transmitting a unique identifier of the contactless optical user identification device to the bootstrap server; downloading special-purpose operating instructions from the bootstrap server identified by the bootstrap instruction into volatile memory of the contactless optical user identification device, the bootstrap server being positioned within an enterprise network, the bootstrap server providing the special-purpose operating instructions after validating the unique identifier of the contactless optical user identification device and selecting the special-purpose operating instructions based at least in part on a role assigned to the contactless optical user identification device, wherein the role is determined, based at least in part, on the unique identifier; in response to execution of the special-purpose operating instructions: capturing, at the contactless optical user identification device, an image of a machine-readable optical label presented by a user; translating the image of the machine-readable optical label into a translated binary code; securely transmitting the translated binary code from the contactless optical user identification to an identification server via the enterprise network, the special-purpose operating instructions identifying the identification server; and based on a response from the identification server, providing feedback to the user regarding a result of identification of the translated binary code; ceasing providing power to the memory, wherein responsive to the power not being supplied, the special-purpose operating instructions cease to persist in the volatile memory and the bootstrap instructions persist in non-the volatile memory. ### Claim 10 (depends on 9) The method of claim 9, wherein execution of the bootstrap instruction is performed upon power up of the contactless optical user identification device. ### Claim 11 (depends on 9) The method of claim 9, wherein providing feedback to the user includes presenting on a display of the contactless optical user identification device, a message personalized to the user. ### Claim 12 (depends on 11) The method of claim 11, wherein the message personalized to the user includes instructions for access to a location within the enterprise. ### Claim 13 (depends on 9) The method of claim 9, further comprising, prior to downloading the special- purpose operating instructions, validating that the contactless optical user identification device is connected to the bootstrap server via a wired network connection within the enterprise network. ### Claim 14 (depends on 9) The method of claim 9, wherein the machine-readable optical label is periodically refreshed on a display of a mobile device associated with the user, the machine-readable optical label representing a rolling passcode associated with the user at the identification server and synchronized to the mobile device via a mobile application downloaded to the mobile device. ### Claim 15 (depends on 9) The method of claim 9, further comprising, based on the response from the identification server, authorizing access to a location within the enterprise. ### Claim 16 An access management system comprising: one or more enterprise servers; a contactless optical user identification device communicatively coupled to the one or more enterprise servers via an enterprise network, the contactless optical user identification device being installed at an access portal within an enterprise, the contactless optical user identification device comprising: an optical code capture device comprising an optical image capture device and an optical code translation circuit, the optical code translation circuit configured to recognize and translate a machine-readable optical label captured in an image by the optical image capture device into a binary code; a wired network access interface communicatively connected to the control circuit and providing a wired network access connection to the one or more enterprise servers; a control circuit communicatively connected to the optical code capture device, the control circuit comprising: one or more processors; and a memory comprising: a non-volatile memory storing a general purpose operating environment and first instructions, the first instructions configured to initialize the contactless optical user identification device, when executed by the one or more processors, by causing the contactless optical user identification device to: establish communication with a server, transmit an identifier of the contactless optical user identification device identified in the first instructions to the server; and receive, from the server, second instructions, wherein the server validates the identifier and selects the second instructions based at least in part on a role assigned to the contactless optical user identification device, wherein the role is determined based at least in part on the identifier; a volatile memory configured to receive the second instructions, the second instructions causing the contactless optical user identification device to: in response to capture of an image of the machine-readable optical label presented by a user and translation of the machine-readable optical label into a binary code, securely transmit the translated binary code to an identification server; wherein the one or more enterprise servers communicates a result of identification of the user based on the translated binary code to authorize access by the user at the access portal; wherein the memory is configured such that, when power is not supplied to the memory, the first instructions persist in the memory and the second instructions do not persist in the memory. ### Claim 17 (depends on 16) The access management system of claim 16, wherein the wired network access interface provides a power connection for the contactless optical user identification device. ### Claim 18 (depends on 16) The access management system of claim 16, wherein the access portal comprises an access door to an equipment storage location at an enterprise location. ### Claim 19 (depends on 16) The access management system of claim 16, wherein the one or more enterprise servers comprises the server and the identification server.