Key delegation for controlling access

An electronic key device for controlling access to an access object, the electronic key device comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, causes the electronic key device to:
• communicate with an access control device to obtain an identity of the access control device;
• send an access request to a server, the access request comprising an identity of the electronic key device and the identity of the access control device;
• receive a response from the server, the response comprising a key delegation to the electronic key device;
• and
• send a grant access request to the access control device, the grant access request comprising the key delegation, to allow the access control device to evaluate whether to grant access to the access object based on a plurality of delegations comprising a sequence of delegations from the access control device to the electronic key device such that, in the sequence of delegations, the delegator of the first delegation is the access control device, and the last delegation is the key delegation, wherein each delegation is a delegation of an access right for the access object from a delegator to a receiver, and each delegation comprises a delegator identifier and a receiver identifier.

A computer program for controlling access to an access object, the computer program comprising computer program code which, when run on an electronic key device causes the electronic key device to:

• communicate with an access control device to obtain an identity of the access control device;
• send an access request to a server, the access request comprising an identity of the electronic key device and the identity of the access control device;
• receive a response from the server, the response comprising a key delegation to the electronic key device;
• and
• send a grant access request to the access control device, the grant access request comprising the key delegation, to allow the access control device to evaluate whether to grant access to the access object based on a plurality of delegations comprising a sequence of delegations from the access control device to the electronic key device such that, in the sequence of delegations, the delegator of the first delegation is the access control device, and the last delegation is the key delegation, wherein each delegation is a delegation of an access right for the access object from a delegator to a receiver, and each delegation comprises a delegator identifier and a receiver identifier.