# US 2026/0074904 A1 · Systems and methods for access to access-controlled resources using digital keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0074904 A1 - Document ID: US20260074904A1 - Status: Published application - Kind: A1 - Application number: 19/323,875 - Filed: 2025-09-09 - Published: 2026-03-12 - Earliest claimed: 2024-09-09 - Assignees: Skeleton Key Systems, LLC - Applicants: Skeleton Key Systems, LLC - Inventors: Adam Phillip TREISER; Michael BURNS; Eric GOLDBERG - Web page: https://patentgrep.com/patent/US20260074904A1 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/10: {for controlling access to devices or network resources} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods control access across access systems. A reader receives a token from a user authenticator, and permission is determined by validating the token. When permitted, a digital key bound to a target resource is generated. A receiver of an access system obtains and verifies the digital key—optionally offline—and actuates the access system to perform an authorized operation. The token may include a first identifier portion usable by a first access system and an appended extension portion encoding data usable by one or more additional access systems. Extensions may be written or removed via a server-supplied amendment package or a locally unlocked package on a device or a first or third-party application, thereby augmenting or revoking privileges while preserving usability of the token by the first access system. The approach applies to locks, enclosures, compartments, devices, vehicles, and other access-controlled resources. ## Claims ### Claim 1 A system for amending one or more authorization states of a user authenticator, the system comprising: a user authenticator that provides a user with first access rights to a first resource, access to the first resource being limited by a first access system; and a device comprising one or more processors and memory storing instructions that, when executed by the one or more processors, cause the device to: (i) receive data indicative of a user's altered access rights with respect to a second resource, access to the second resource being limited by a second access system distinct from the first access system; and (ii) write the data to the user authenticator, or cause the data to be written to the user authenticator, to provide the user authenticator with the altered access rights with respect to the second resource; wherein the user authenticator is configured to store the data; wherein, upon presentation of the user authenticator to the second access system, the user authenticator provides the user access rights to the second resource in accordance with the altered access rights; and wherein, after the writing of the data to the user authenticator, the user authenticator continues to provide the user with the first access rights to the first resource. ### Claim 2 (depends on 1) The system of claim 1, wherein the altered access rights provide increased access to the second resource or decreased access to the second resource. ### Claim 3 (depends on 1) The system of claim 1, wherein the user authenticator stores a token comprising a first identifier portion usable by the first access system and an extension portion appended to the first identifier portion, the extension portion encoding the data indicative of the altered access rights and being usable by the second access system. ### Claim 4 (depends on 3) The system of claim 3, wherein writing the data comprises writing (i) the extension portion encoding the data indicative of the altered access rights and (ii) a cryptographic authenticator generated over at least the first identifier portion and the extension portion to the user authenticator. ### Claim 5 (depends on 3) The system of claim 3, wherein the extension portion comprises an access descriptor comprising a resource identifier identifying the second resource and validity data, and the extension portion is configured to include a plurality of access descriptors for additional resources distinct from the first resource and the second resource. ### Claim 6 (depends on 5) The system of claim 5, wherein each access descriptor further comprises (i) an operation-type indicator identifying an access operation and (ii) an anti-replay value comprising at least one of a nonce or a counter. ### Claim 7 (depends on 1) The system of claim 1, wherein receiving the data comprises receiving an amendment package comprising the data from a server. ### Claim 8 (depends on 1) The system of claim 1, wherein the device is a user device and receiving the data comprises acquiring an amendment package comprising the data locally stored on the device. ### Claim 9 (depends on 3) The system of claim 3, wherein writing the data comprises rewriting, in its entirety, the token stored on the user authenticator such that the rewritten token comprises the first identifier portion and the extension portion. ### Claim 10 (depends on 1) The system of claim 1, wherein the data encodes a single-use or maximum-use count, and the device is further configured to delete at least a portion of the data from the user authenticator when the single-use or maximum-use count has been consumed. ### Claim 11 A computer-implemented method for amending one or more authorization states of a user authenticator, the method comprising: providing, with a user authenticator, a user with first access rights to a first resource limited by a first access system; receiving data indicative of the user's altered access rights with respect to a second resource limited by a second access system distinct from the first access system; and writing the data to the user authenticator, or causing the data to be written to the user authenticator, to provide the user authenticator with the altered access rights with respect to the second resource; wherein the user authenticator stores the data; wherein, upon presentation of the user authenticator to the second access system, the user authenticator provides the user access rights to the second resource in accordance with the altered access rights; and wherein, after the writing of the data to the user authenticator, the user authenticator continues to provide the user the first access rights to the first resource. ### Claim 12 (depends on 11) The method of claim 11, wherein the altered access rights provide increased access to the second resource or decreased access to the second resource. ### Claim 13 (depends on 11) The method of claim 11, wherein the user authenticator stores a token comprising a first identifier portion usable by the first access system and an extension portion appended to the first identifier portion, the extension portion encoding the data indicative of the altered access rights and being usable by the second access system. ### Claim 14 (depends on 13) The method of claim 13, wherein writing comprises writing (i) the extension portion encoding the data indicative of the altered access rights and (ii) a cryptographic authenticator generated over at least the first identifier portion and the extension portion to the user authenticator. ### Claim 15 (depends on 13) The method of claim 13, wherein the extension portion comprises an access descriptor comprising a resource identifier identifying the second resource and validity data, and the extension portion is configured to include a plurality of access descriptors for additional resources distinct from the first resource and the second resource. ### Claim 16 (depends on 15) The method of claim 15, wherein each access descriptor further comprises (i) an operation-type indicator identifying an access operation and (ii) an anti-replay value comprising at least one of a nonce or a counter. ### Claim 17 (depends on 11) The method of claim 11, wherein receiving the data comprises receiving an amendment package comprising the data from a server. ### Claim 18 (depends on 11) The method of claim 11, wherein the method is performed by a user device and receiving the data comprises acquiring an amendment package comprising the data locally stored on the user device. ### Claim 19 (depends on 13) The method of claim 13, wherein writing the data comprises rewriting, in its entirety, the token stored on the user authenticator such that the rewritten token comprises the first identifier portion and the extension portion. ### Claim 20 (depends on 11) The method of claim 11, wherein the data encodes a single-use or maximum-use count, and the method further comprises deleting at least a portion of the data from the user authenticator when the single-use or maximum-use count has been consumed. ### Claim at position 21 -51. (canceled)