Physical access control system with secure relay
AssigneeAssa Abloy AB
InventorMatvey Mukha
Life of this patent
Estimating the term…
Abstract
A method of operating an access control system comprises receiving, by a mobile device, an identification of a physical access portal; verifying access credential information stored in the mobile device using a verification application of the mobile device; establishing a secure communication channel with a secure relay device associated with the physical access portal; sending an encrypted access token stored in the mobile device to the secure relay device; and granting access by the secure relay device to the physical access portal according to the encrypted access token.
Claims20
A method of operating an access control system, the method comprising:
- receiving, by a mobile device, an identification of a physical access portal;
- establishing, by a verification application of the mobile device, a secure communication channel with a secure relay device using out of band signaling, wherein the secure relay device is local to the physical access portal and controls access to the physical access portal local to the secure relay device;
- sending, by the verification application of the mobile device, an encrypted access token pre-stored in the mobile device prior to establishing the secure communication channel to the secure relay device using the secure communication channel and out of band signaling;
- and
- decrypting, by the secure relay device, the encrypted access token;
- comparing the access token to a revocation list of access tokens that are invalid for the secure relay device for the physical access portal;
- and
- granting access by the secure relay device to the physical access portal according to information stored in the encrypted access token.
A secure relay device of an access control system, the device comprising:
- memory storing a revocation list of access tokens that are invalid only for the secure relay device for the physical access portal;
- physical layer circuitry configured to receive information wirelessly;
- and
- processing circuitry operatively coupled to the physical layer circuitry and configured to:
- control access to a physical access portal local to the secure relay device;
- decode first authentication information received wirelessly from a mobile device using out of band signaling that is out of band of the mobile device;
- encode second authentication information for sending to the mobile device to establish a secure communication channel with the mobile device using the out of band signaling;
- decrypt an access token received from the mobile device via the secure communication channel using the out of band signaling in response to the second authentication information;
- determine validity of the access token by comparing the access token to the revocation list for the secure relay device;
- and
- grant access to the physical access portal according to the access token.
A machine-readable storage medium comprising instructions that, when executed by processing circuitry of a mobile device, cause the mobile device to perform acts comprising:
- receiving an identification of a physical access portal;
- comparing an access token for the physical access portal stored in the mobile device to a revocation list of invalid access tokens;
- exchanging authentication information with a secure relay device local to the physical access portal and establishing a secure communication channel with the secure relay device using out of band signaling;
- and
- sending an encrypted access token to the secure relay device using the secure communication channel and out of band signaling.
Dependencies are inferred from the claim text.