Back to results
US 8,474,026 B2Granted
Realization of access control conditions as boolean expressions in credential authentications
AssigneeAssa Abloy AB
InventorScott B. Guthery
Life of this patent
Estimating the term…
Abstract
A method, reader, and system are provided for performing group authentication processes. In particular, a group access decision can be made upon the analysis of a group rule. The group rule may contain a Boolean expression including one or more Boolean conditions. If an appropriate group of credentials are presented to a reader such that the Boolean expression is satisfied, then the group of credentials and the holders thereof are allowed access to a protected asset.
Claims15
A method comprising:
- detecting the presence of a group of credentials comprising at least one of a first credential and a second credential in proximity to a reader, wherein at least one of the first and second credentials are a portable device;
- determining that group authentication is required to make an access control decision;
- invoking a group authentication process at a selected one of the first and second credentials that includes:
- determining if sequential processing is allowed;
- obtaining a first value based on an exchange of data between the reader and the first credential;
- obtaining a second value based on an exchange of data between the reader and the second credential;
- analyzing a group authentication rule with the first and second values;
- and
- making a group authentication decision based on the analysis step;
- wherein in response to determining that sequential processing is allowed, group access is permitted in the absence of exchanging data between the reader and at least one credential in the group of credentials;
- wherein in response to determining that sequential processing is not allowed, group access is conditioned upon each credential in the group of credentials exchanging data with the reader;
- implementing an action consistent with the group authentication decision, wherein the action is one of admitting access to an asset protected by the reader, denying access to the asset protected by the reader, communicating an indication to the reader admitting access to an asset protected by the reader, and communicating an indication to the reader denying access to the asset protected by the reader.
9 more elements
An access control system, comprising:
- memory including instructions in the form of machine-readable code, the instructions including an authentication module and authentication data;
- a processor, configured to execute the instructions stored in the memory;
- and
- wherein the authentication module is configured to detect the presence of a group of credentials comprising at least one of a first credential and a second credential in proximity to a reader, determine that group authentication is required to make an access control decision, and invoke a group authentication process at a selected one of the first and second credentials that includes:
- determining if sequential processing is allowed;
- obtaining a first value based on an exchange of data between the reader and the first credential;
- obtaining a second value based on an exchange of data between the reader and the second credential;
- analyzing a group authentication rule contained within the authentication data with the first and second values;
- and
- making a group authentication decision based on the analysis step;
- wherein in response to determining that sequential processing is allowed, group access is permitted in the absence of exchanging data between the reader and at least one credential in the group of credentials;
- wherein in response to determining that sequential processing is not allowed, group access is conditioned upon each credential in the group of credentials exchanging data with the reader;
- wherein the authentication module is configured to communicate an indication of an access control decision to the reader, the access control decision consistent with the group authentication decision and is one of admitting access to an asset protected by the reader and denying access to the asset protected by the reader.
10 more elements
Dependencies are inferred from the claim text.