# US 8,474,026 B2 · Realization of access control conditions as boolean expressions in credential authentications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,026 B2 - Document ID: US8474026B2 - Status: Granted - Kind: B2 - Application number: 12/724,071 - Filed: 2010-03-15 - Published: 2010-09-16 - Granted: 2013-06-25 - Earliest claimed: 2009-03-13 - Assignees: Assa Abloy AB - Applicants: Scott B. Guthery - Inventors: Scott B. Guthery - Web page: https://patentgrep.com/patent/US8474026B2 ## CPC - G06F 21/31: User authentication - G06F 21/40: by quorum, i.e. whereby two or more security principals are required - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G07C 9/22: in combination with an identity check of the pass holder - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE ## Abstract A method, reader, and system are provided for performing group authentication processes. In particular, a group access decision can be made upon the analysis of a group rule. The group rule may contain a Boolean expression including one or more Boolean conditions. If an appropriate group of credentials are presented to a reader such that the Boolean expression is satisfied, then the group of credentials and the holders thereof are allowed access to a protected asset. ## Claims ### Claim 1 A method comprising: detecting the presence of a group of credentials comprising at least one of a first credential and a second credential in proximity to a reader, wherein at least one of the first and second credentials are a portable device; determining that group authentication is required to make an access control decision; invoking a group authentication process at a selected one of the first and second credentials that includes: determining if sequential processing is allowed; obtaining a first value based on an exchange of data between the reader and the first credential; obtaining a second value based on an exchange of data between the reader and the second credential; analyzing a group authentication rule with the first and second values; and making a group authentication decision based on the analysis step; wherein in response to determining that sequential processing is allowed, group access is permitted in the absence of exchanging data between the reader and at least one credential in the group of credentials; wherein in response to determining that sequential processing is not allowed, group access is conditioned upon each credential in the group of credentials exchanging data with the reader; implementing an action consistent with the group authentication decision, wherein the action is one of admitting access to an asset protected by the reader, denying access to the asset protected by the reader, communicating an indication to the reader admitting access to an asset protected by the reader, and communicating an indication to the reader denying access to the asset protected by the reader. ### Claim 2 (depends on 1) The method of claim 1, wherein sequential processing is allowed in the group authentication process when the group authentication rule does not contain one or both of a NOT and XOR operation. ### Claim 3 (depends on 1) The method of claim 1, wherein the group authentication rule comprises a Boolean expression and at least one Boolean operation. ### Claim 4 (depends on 1) The method of claim 1, wherein the first credential performs the group authentication process because it is one of a designated credential and a randomly selected credential. ### Claim 5 (depends on 1) The method of claim 1, wherein the second credential performs the group authentication process. ### Claim 6 (depends on 1) The method of claim 1, wherein determining that group authentication is required involves determining that one or more of the following conditions exist: a plurality of credentials are detected within proximity of the reader; a plurality of users are detected within proximity of the reader; and access to an asset protected by the reader is only allowed upon satisfaction of a group rule. ### Claim 7 An access control system, comprising: memory including instructions in the form of machine-readable code, the instructions including an authentication module and authentication data; a processor, configured to execute the instructions stored in the memory; and wherein the authentication module is configured to detect the presence of a group of credentials comprising at least one of a first credential and a second credential in proximity to a reader, determine that group authentication is required to make an access control decision, and invoke a group authentication process at a selected one of the first and second credentials that includes: determining if sequential processing is allowed; obtaining a first value based on an exchange of data between the reader and the first credential; obtaining a second value based on an exchange of data between the reader and the second credential; analyzing a group authentication rule contained within the authentication data with the first and second values; and making a group authentication decision based on the analysis step; wherein in response to determining that sequential processing is allowed, group access is permitted in the absence of exchanging data between the reader and at least one credential in the group of credentials; wherein in response to determining that sequential processing is not allowed, group access is conditioned upon each credential in the group of credentials exchanging data with the reader; wherein the authentication module is configured to communicate an indication of an access control decision to the reader, the access control decision consistent with the group authentication decision and is one of admitting access to an asset protected by the reader and denying access to the asset protected by the reader. ### Claim 8 (depends on 7) The system of claim 7, wherein sequential processing is allowed in the group authentication process when the group authentication rule does not contain one or both of a NOT and XOR operation. and condition group access upon each credential in the group of credentials exchanging data with the reader. ### Claim 9 (depends on 7) The system of claim 7, wherein the group authentication rule comprises a Boolean expression and at least one Boolean operation. ### Claim 10 (depends on 7) The system of claim 7, wherein the authentication module is configured to determine that group authentication is required by determining that one or more of the following conditions exist: a plurality of credentials are detected within proximity of the reader; a plurality of users are detected within proximity of the reader; and access to an asset protected by the reader is only allowed upon satisfaction of a group rule. ### Claim 11 (depends on 1) The method of claim 1, wherein the first credential performs the group authentication process. ### Claim 12 (depends on 1) The method of claim 1, wherein the second credential performs the group authentication process. ### Claim 13 (depends on 7) The system of claim 7, wherein the first credential performs the group authentication process because it is one of a designated credential and a randomly selected credential. ### Claim 14 (depends on 7) The system of claim 7, wherein the first credential performs the group authentication process. ### Claim 15 (depends on 7) The system of claim 7, wherein the second credential performs the group authentication process.