Co-signing delegations

A lock device for controlling access to a physical space using a co-sign delegation, the lock device comprising:

• a processor;
• and
• a memory storing instructions that are configured to, when executed by the processor, cause the lock device to:
• receive an access request from an electronic key;
• obtain a plurality of delegations, wherein each delegation is a delegation from a delegator to a delegatee, the plurality of delegations collectively forming a chain of delegations wherein when two delegations are chained together, the delegatee of one delegation is the delegator of the next delegation;
• determine that a delegation in the chain of delegations is a co-sign delegation, the co-sign delegation indicating that all further delegations need to be cryptographically signed by both the delegator of the respective delegation and by an access controller;
• and grant access to the physical space when the chain of delegations start in an owner of the lock device and ends in the electronic key;
• and when all delegations in the chain of delegations after the co-sign delegation are cryptographically signed by both the delegator of the respective delegation and by the access controller, by verifying that each co-sign delegation has been transmitted to all the delegatees in the chain of delegations after the co-sign delegation, and that a co-signed delegation has been signed by the delegator, has been provided to the access controller, and has been signed by the access controller.

A computer program for controlling access to a physical space using a co-sign delegation, the computer program comprising computer program code which is configured to cause, when run on a processor of a lock device, the lock device to:

• receive an access request from an electronic key;
• obtain a plurality of delegations, wherein each delegation is a delegation from a delegator to a delegatee, the plurality of delegations collectively forming a chain of delegations wherein when two delegations are chained together, the delegatee of one delegation is the delegator of the next delegation;
• determine that a delegation in the chain of delegations is a co-sign delegation, the co-sign delegation indicating that all further delegations need to be cryptographically signed by both the delegator of the respective delegation and by an access controller;
• and
• grant access to the physical space when the chain of delegations start in an owner of the lock device and ends in the electronic key;
• and when all delegations in the chain of delegations after the co-sign delegation are cryptographically signed by both the delegator of the respective delegation and by the access controller, by verifying that each delegation has been transmitted to all the delegatees in the chain of delegations, and that a co-signed delegation has been signed by the delegator, has been provided to the access controller, and has been signed by the access controller.