# US 2018/0324166 A1 · Presence-based credential updating > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324166 A1 - Document ID: US20180324166A1 - Status: Published application - Kind: A1 - Application number: 16/032,185 - Filed: 2018-07-11 - Published: 2018-11-08 - Earliest claimed: 2012-07-27 - Assignees: Assa Abloy AB - Applicants: Assa Abloy AB - Inventors: Stig LAGERSTEDT; Daniel BERG; Daniel BAILIN; Mark ROBINTON; Masha Leah Davis - Web page: https://patentgrep.com/patent/US20180324166A1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0492: {by using a location-limited connection, e.g. near-field communication or limited proximity of entities} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 12/08: Access security - H04W 12/63: Location-dependent; Proximity-dependent - H04W 12/64: using geofenced areas - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods, systems, and devices for updating access permissions of users in an access control system are described. The access permissions are capable of being updated based on rules and thresholds that include as at least one variable presence or contextual information associated with a user. The presence or contextual information associated with a user may be analyzed to trigger a credential update process for that user or other users within the access control system. ## Claims ### Claim 1 A method, comprising: receiving contextual information regarding a first user; based on the received contextual information, determining a credential update to perform in connection with at least one device associated with the first user; generating a first message that contains at least one instruction to update at least one credential; and transmitting the first message to the at least one device associated with the first user. ### Claim 2 (depends on 1) The method of claim 1, wherein the at least one device comprises a user device that is capable of exchanging messages via a communication network. ### Claim 3 (depends on 2) The method of claim 2, wherein the first message is transmitted to the at least one device via the communication network in at least one of an SMS message, an email, and an HTTP request. ### Claim 4 (depends on 2) The method of claim 2, wherein the user device comprises an NFC-enabled smart phone. ### Claim 5 (depends on 4) The method of claim 4, wherein the user device further comprises a secure element that stores the at least one credential as sensitive data. ### Claim 6 (depends on 5) The method of claim 5, wherein the secure element corresponds to at least one of a SIM card, microSD card, removeable IC, and embedded IC. ### Claim 7 (depends on 1) The method of claim 1, wherein the at least one device comprises a local host that is protecting at least one asset. ### Claim 8 (depends on 1) The method of claim 1, wherein the at least one instruction to update the at least one credential comprises an instruction to at least one of modify, add, remove, activate, and deactivate a logical credential on the at least one device. ### Claim 9 (depends on 1) The method of claim 1, wherein the contextual information regarding the first user comprises presence information. ### Claim 10 (depends on 1) The method of claim 1, wherein the contextual information regarding the first user comprises location information. ### Claim 11 (depends on 1) The method of claim 1, wherein the contextual information regarding the first user comprises information regarding the first user's usage of the at least one device. ### Claim 12 (depends on 1) The method of claim 1, further comprising: based on the received contextual information, determining a credential update to perform in connection with at least one device associated with a second user, the second user being different than the first user; generating a second message that contains at least one instruction to update at least one credential for the second user; and transmitting the second message to the at least one device associated with the second user. ### Claim 13 (depends on 1) The method of claim 1, further comprising: generating a second message that contains the at least one instruction to update the at least one credential; and transmitting the second message to a local host within an access control system, the local host protecting at least one asset and conditioning availability of the at least one access to users that present a physical credential having a valid logical credential stored thereon. ### Claim 14 (depends on 1) A computer-readable medium comprising processor-executable instructions that, when executed by a processor, perform the method of claim 1. ### Claim 15 An access control system, comprising: a credential control authority configured to receive at least one of presence information and contextual information associated with a first user of the access control system and then determine whether a credential update process is to be performed for at least one device associated with the first user, the credential control authority further configured to invoke the credential update process upon determining that the first user has crossed at least one of a physical and logical threshold based on the received at least one of presence information and contextual information. ### Claim 16 (depends on 15) The system of claim 15, wherein the at least one of a physical and logical threshold corresponds to a predetermined distance away from a predetermined location. ### Claim 17 (depends on 15) The system of claim 15, wherein the at least one of a physical and logical threshold corresponds to a predetermined action of the first user detected at the at least one device associated with the first user. ### Claim 18 (depends on 15) The system of claim 15, further comprising one or more local hosts configured to control access to one or more assets. ### Claim 19 (depends on 18) The system of claim 18, wherein the one or more assets include at least one of a physical and logical asset. ### Claim 20 (depends on 18) The system of claim 18, wherein the one or more local hosts correspond to an RFID reader, wherein the at least one device associated with the first user comprises an NFC-enabled communication device, and wherein the credential update process includes transmitting a first credential update message to the one or more local hosts as well as transmitting a second credential update message to the at least one device associated with the first user. ### Claim 21 A credential control authority configured to communicate with a contextual information source and based on information received from the contextual information source, determine whether a credential update process is to be performed for at least one device associated with a first user, the credential control authority further configured to invoke the credential update process upon determining that the first user has crossed at least one of a physical and logical threshold based on the information received from the contextual information source. ### Claim 22 (depends on 21) The credential control authority of claim 21, wherein the contextual information source is executed on a server that is separate from a server on which the credential control authority is operated. ### Claim 23 (depends on 22) The credential control authority of claim 22, wherein the contextual information source is connected with the credential control authority via a communication network. ### Claim 24 (depends on 21) The credential control authority of claim 21, wherein the information received from the contextual information source includes at least one of presence information, communication context information, location context information, group context information, and calendar information.