System and method for secure and distributed physical access control using smart cards

A method of controlling access to a resource comprising:

• reading a first code from a user carried device, wherein the first code comprises an encoded form of at least an ID of a user and at least one privilege, and wherein the privilege embodies a policy defining the user's access to the resource;
• comparing the first code to a second code;
• and
• permitting access only if the first code substantially matches the second code;
• wherein the comparing of the first code to a second code comprises:
• computing the second code based on the user ID, the privilege, a secret key, and a common key, wherein the secret key applies only to the user, and wherein the common key applies to a plurality of users;
• and
• comparing the first code to the computed second code.

A method of controlling access to a resource comprising:

• storing a first code on a user carried device, wherein the first code is based on at least an ID of a user, at least one privilege, a first secret key, and an encoding function, and wherein the privilege defines the user's access to the resource;
• computing a second code from the user ID, the privilege, a second secret key, and the encoding function, wherein the first and second secret keys are symmetrical, and wherein the second secret key is stored in a user carried device reader;
• comparing the first code to a second code;
• and
• permitting access only if the first code substantially matches the second code;
• wherein the computing of the second code comprises:
• generating an intermediate code based at least on the user ID and the second secret key;
• concatenating the intermediate code and the privilege;
• and
• applying the encoding function to the concatenation of the intermediate code and the privilege so as to produce the second code.

A method of controlling access to a resource comprising:

• storing a first code on a user carried device, wherein the first code is based on at least an ID of a user, at least one privilege, a first secret key, and an encoding function, and wherein the privilege defines the user's access to the resource;
• computing a second code from the user ID, the privilege, a second secret key, and the encoding function, wherein the first and second secret keys are symmetrical, and wherein the second secret key is stored in a user carried device reader;
• comparing the first code to a second code;
• and
• permitting access only if the first code substantially matches the second code;
• wherein the computing of the second code comprises:
• generating an intermediate code based at least on the user ID and the second secret key;
• concatenating the intermediate code, the privilege, and a common key;
• and,
• applying an encoding function to the concatenation of the intermediate code, the privilege, and the common key so as to produce the second code.

A reader of an access control system that controls access to a resource comprising:

• a memory that stores a secret key;
• and,
• a processor that reads the secret key from the memory, that reads an ID of a user, at least one privilege, and a first code from an user carried device carried by the user, that computes a second code based on the secret key read from the memory and the user ID and privilege read from the user carried device, that compares the first code to the second code, and that permits access to the resource based on the comparison, wherein the privilege defines the user's access to the resource, and wherein the first code comprises an encoded form of at least the user ID and the privilege;
• wherein the reader computes the second code by:
• generating an intermediate code based at least on the user ID and the secret key;
• concatenating the intermediate code and the privilege;
• and,
• applying an encoding function to the concatenation of the intermediate code and the privilege so as to produce the second code.

A reader of an access control system that controls access to a resource comprising:

• a memory that stores a secret key;
• and
• a processor that reads the secret key from the memory, that reads an ID of a user, at least one privilege, and a first code from an user carried device carried by the user, that computes a second code based on the secret key read from the memory and the user ID and privilege read from the user carried device, that compares the first code to the second code, and that permits access to the resource based on the comparison, wherein the privilege defines the user's access to the resource, and wherein the first code comprises an encoded form of at least the user ID and the privilege;
• wherein the reader computes the second code based on the secret key read from the memory, the user ID and privilege read from the user carried device, and a common key.