# US 2023/0054831 A1 · Contactless optical internet of things user identification device and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0054831 A1 - Document ID: US20230054831A1 - Status: Published application - Kind: A1 - Application number: 17/407,997 - Filed: 2021-08-20 - Published: 2023-02-23 - Earliest claimed: 2021-08-20 - Assignees: U.S. Bank National Association - Applicants: U.S. Bank National Association - Inventors: Justin P. Yunke; Adam J. Achterhoff - Web page: https://patentgrep.com/patent/US20230054831A1 ## CPC - G07C 9/22: in combination with an identity check of the pass holder - G07C 11/00: Arrangements, systems or apparatus for checking, e.g. the occurrence of a condition, not provided for elsewhere - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 21/35: communicating wirelessly - G06F 21/606: {by securing the transmission between two devices or processes} - G06K 7/1413: {1D bar codes} - G06K 7/1417: {2D bar codes} - G07C 9/20: involving the use of a pass - G07C 9/27: with central registration - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS ## Abstract A contactless optical device is useable to identify a user, and allows an enterprise to authorize access by that user to enterprise facilities and/or cause presentation of user information of the user. The device is specifically adapted for secure usage within an enterprise network via a wired network interface. The device avoids storage of user-identifying data in persistent memory, to avoid compromise of user data if the device were lost or stolen, or otherwise removed from the enterprise network. ## Claims ### Claim 1 A contactless optical user identification device comprising: an optical code capture device comprising an optical image capture device and an optical code translation circuit, the optical code translation circuit configured to recognize and translate a machine-readable optical label captured in an image by the optical image capture device into a binary code; a wired network access interface communicatively connected to the control circuit and providing both a wired network access connection and power connection for the contactless optical user identification device; a control circuit communicatively connected to the optical code capture device, the control circuit comprising: a processor; and a memory comprising: a non-volatile memory storing a general purpose operating environment and bootstrap instructions; a volatile memory configured to receive special-purpose operating instructions from a bootstrap server identified in the bootstrap instructions in response to execution of the bootstrap instruction, the special-purpose operating instructions causing the device to: in response to capture of an image of the machine-readable optical label presented by a user and translation of the machine-readable optical label into a binary code: securely transmit the translated binary code to an identification server; receive, in response to the translated binary code, an indication of a result of identification of the user from the identification server. ### Claim 2 (depends on 1) The contactless optical user identification device of claim 1, wherein the non-volatile memory lacks special-purpose operating instructions allowing the contactless optical user identification device to authenticate a user in response to capture of an image of an optical label. ### Claim 3 (depends on 1) The contactless optical user identification device of claim 1, wherein identification server is identified in the special-purpose operating instructions. ### Claim 4 (depends on 1) The contactless optical user identification device of claim 1, wherein the processor and the identification server do not receive the image of the machine-readable optical label. ### Claim 5 (depends on 1) The contactless optical user identification device of claim 1, wherein the bootstrap instructions cause the contactless optical user identification device to transmit a unique identifier of the contactless optical user identification device identified in the bootstrap instructions to the bootstrap server and receive the special-purpose operating instructions from the bootstrap server in response to validation of the unique identifier. ### Claim 6 (depends on 5) The contactless optical user identification device of claim 5, wherein the bootstrap server is accessible only from within an enterprise network. ### Claim 7 (depends on 1) The contactless optical user identification device of claim 1, wherein the special-purpose operating instructions cause the contactless optical user identification device to: at a predetermined time, transmit a message to the identification server; in response to the message, receiving one or more updates to the special-purpose operating instructions. ### Claim 8 (depends on 1) The contactless optical user identification device of claim 1, wherein the device does not persist any association between a translated binary code and a result of identification of the user in non-volatile memory. ### Claim 9 (depends on 1) The contactless optical user identification device of claim 1, wherein the optical code capture device communicates the translated binary code to the control circuit without retaining or communicating the image of the machine-readable optical label. ### Claim 10 A method comprising: in response to execution of a bootstrap instruction from nonvolatile memory, downloading special-purpose operating instructions from a bootstrap server identified by the bootstrap instruction into volatile memory of a contactless optical user identification device, the bootstrap server being positioned within an enterprise network; capturing, at the contactless optical user identification device, an image of a machine-readable optical label presented by a user; translating the image of the machine-readable optical label into a translated binary code; securely transmitting the translated binary code from the contactless optical user identification to an identification server via the enterprise network; and based on a response from the identification server, providing feedback to the user regarding a result of identification of the translated binary code. ### Claim 11 (depends on 10) The method of claim 10, further comprising powering on the contactless optical user identification device in response to connection of a wired power-over-ethernet connection to a wired network connection within the enterprise network. ### Claim 12 (depends on 10) The method of claim 10, wherein providing feedback to the user includes presenting on a display of the contactless optical user identification device, a message personalized to the user. ### Claim 13 (depends on 12) The method of claim 12, wherein the message personalized to the user includes instructions for access to a location within the enterprise. ### Claim 14 (depends on 10) The method of claim 10, further comprising, prior to downloading the special-purpose operating instructions, validating that the contactless optical user identification device is connected to the bootstrap server via a wired network connection within the enterprise network. ### Claim 15 (depends on 10) The method of claim 10, wherein the machine-readable optical label is periodically refreshed on a display of a mobile device associated with the user, the machine-readable optical label representing a rolling passcode associated with the user at the identification server and synchronized to the mobile device via a mobile application downloaded to the mobile device. ### Claim 16 (depends on 10) The method of claim 10, further comprising, based on the response from the identification server, authorizing access to a location within the enterprise. ### Claim 17 An access management system comprising: one or more enterprise servers; a contactless optical user identification device communicatively coupled to the one or more enterprise servers via an enterprise network, the contactless optical user identification device being installed at an access portal within an enterprise, the contactless optical user identification device comprising: an optical code capture device comprising an optical image capture device and an optical code translation circuit, the optical code translation circuit configured to recognize and translate a machine-readable optical label captured in an image by the optical image capture device into a binary code; a wired network access interface communicatively connected to the control circuit and providing a wired network access connection to the one or more enterprise servers; a control circuit communicatively connected to the optical code capture device, the control circuit comprising: a processor; and a memory comprising: a non-volatile memory storing a general purpose operating environment and bootstrap instructions; a volatile memory configured to receive special-purpose operating instructions from a bootstrap server identified in the bootstrap instructions in response to execution of the bootstrap instruction, the special-purpose operating instructions causing the device to: in response to capture of an image of the machine-readable optical label presented by a user and translation of the machine-readable optical label into a binary code, securely transmit the translated binary code to an identification server; wherein the one or more enterprise servers communicates a result of identification of the user based on the translated binary code to authorize access by the user at the access portal. ### Claim 18 (depends on 17) The access management system of claim 17, wherein the wired network access interface provides a power connection for the contactless optical user identification device. ### Claim 19 (depends on 17) The access management system of claim 17, wherein the access portal comprises an access door to an equipment storage location at an enterprise location. ### Claim 20 (depends on 17) The access management system of claim 17, wherein the one or more enterprise servers comprises a bootstrap server and an identification server.