# US 8,789,146 B2 · Dual interface device for access control and a method therefor

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,146 B2
- Document ID: US8789146B2
- Status: Granted
- Kind: B2
- Application number: 13/447,536
- Filed: 2012-04-16
- Published: 2012-10-18
- Granted: 2014-07-22
- Earliest claimed: 2011-04-14
- Assignees: Yubico AB
- Applicants: Jakob Ehrensvard
- Inventors: Jakob Ehrensvard
- Web page: https://patentgrep.com/patent/US8789146B2

## CPC

- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- G06F 21/35: communicating wirelessly
- G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]}
- H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/08: Access security
- H04W 12/47: using near field communication [NFC] or radio frequency identification [RFID] modules
- G06F 2213/0038: System on Chip
- G06F 2221/2105: Dual mode as a secondary aspect
- G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen
- G07C 9/00817: {where the code of the lock can be programmed}
- G07C 9/28: the pass enabling tracking or indicating presence
- H04W 12/03: Protecting confidentiality, e.g. by encryption
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE

## Abstract

The invention provides a low-cost access control device for identification and authentication in both the “digital” and “physical” worlds by contact-bound respectively contact-less interfaces and where individual users of the device can securely update access control credentials and cryptographic keys from a remote system without the need for any additional hardware or specialized software. The access control credentials and the at least one cryptographic key shall be readable by an access control system via the contact-less interface of the device, thereby enabling or denying the holder of the device access.

## Claims

### Claim 1

An access control device having dual interfaces comprising:
a contact-bound interface for communication with a remote system, the contact-bound interface comprising a USB interface with a USB type A plug and configured to receive access control credentials and cryptographic keys transmitted as files to the access control device; and
a contact-less interface for communication with an access control system using an emulated RFID card;
wherein the access control device further comprises a cryptographic processor, a virtual file system comprising a USB Mass Storage Device file system, a pre-configured unique identifier and a cryptographic key allowing for authentication and verification of access control credentials and cryptographic keys, the access control credentials and cryptographic keys stored in a storage upon acceptance, and being accessible to the emulated RFID card for transmission via the contact-less interface to the access control system; and
wherein the files of access control credentials and cryptographic keys are handled as blocks of wrapped and/or Authenticated Encryption with Associated Data (AEAD) files.

### Claim 2 (depends on 1)

The access control device in accordance with claim 1, wherein the blocks of AEAD files are encrypted by symmetric encryption.

### Claim 3 (depends on 1)

The access control device in accordance with claim 1, wherein the blocks of AEAD files are encrypted by asymmetric encryption.

### Claim 4 (depends on 1)

The access control device according to claim 1, wherein the access control device functions as a USB Human Interface Device (HID) responsive to the access control device being attached to a remote system via the contact-bound interface, the USB HID providing an activation switch for resetting the access control device to expose the USB Mass Storage Device file system.

### Claim 5 (depends on 1)

The access control device according to claim 1, wherein the USB Mass Storage Device file system is removable media which by default is not mounted to a host computer and responsive to an explicit command of a holder of the device pressing an activation switch, the device sends a digital signal to the host computer, thereby causing the file system to be mounted and visible to the remote system.

### Claim 6 (depends on 1)

The access control device in accordance with claim 1, wherein data derived from an access control credential and encryption key is transmitted over the contactless interface in the form of NFC Data Exchange Format (NDEF) records.

### Claim 7 (depends on 6)

The access control device in accordance with claim 6, wherein the contactless interface is a Near Field Communication (NFC) interface.

### Claim 8

A method for secure communication with an access control device comprising:
receiving access control credentials and cryptographic keys transmitted as files to the access control device over a contact-bound interface, the contact-bound interface comprising a USB interface with a USB type A plug; and
communicating data derived from an access control credential and cryptographic key to an access control system over a contact-less interface using an emulated RFID card;
wherein the access control device comprises a cryptographic processor, a virtual file system comprising a USB Mass Storage Device file system, a pre-configured unique identifier and a cryptographic key allowing for authentication and verification of access control credentials and cryptographic keys, the access control credentials and cryptographic keys stored in a storage upon acceptance, and being accessible to the emulated RFID card for transmission via the contact-less interface to the access control system; and
wherein the files of access control credentials and cryptographic keys are handled as blocks of wrapped and/or Authenticated Encryption with Associated Data (AEAD) files.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
encrypting the blocks of AEAD files by at least one of symmetric encryption and asymmetric encryption.

### Claim 10 (depends on 8)

The method of claim 8, further comprising:
providing USB Human Interface Device (HID) functions responsive to the access control device being attached to a remote system via the contact-bound interface, the USB HID providing an activation switch for resetting the access control device to expose the USB Mass Storage Device file system.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
responsive to an explicit command of a holder of the access control device pressing an activation switch, sending a digital signal to a host computer, thereby causing the USB Mass Storage Device file system of the access control device to be mounted and visible to the remote system, wherein the USB Mass Storage Device file system is removable media which by default is not mounted to the host computer.

### Claim 12 (depends on 8)

The method of claim 8, further comprising:
transmitting the data derived from an access control credential and cryptographic key over the contactless interface of the access control device in the form of NFC Data Exchange Format (NDEF) records.

### Claim 13 (depends on 12)

The method of claim 12, wherein the contactless interface is a Near Field Communication (NFC) interface.