TRANSFERRING RESPONSIBILITY OF A PHYSICAL KEY FROM A TRANSFERER TO A TRANSFEREE

It is provided method of transferring responsibility of a physical key (3) from a transferer (5a) to a transferee (5b). The method is performed by a transferee device (2b), being a user device (2b) of the transferee (5b). The method comprises: establishing (40) a local communication channel (4) with a user device (2a) of the transferer (5a): receiving (42), over the local communication channel (4), a request to register that the responsibility of the physical key (3) is transferred from the transferer (5a) to the transferee (5b): receiving (44) user input indicating that the responsibility of the physical key (3) is accepted by the transferee (5b); and transmitting (46) a confirmation of registration of transferring the responsibility of the physical key (3) to the transferee (5b).

TECHNICAL FIELD

The present disclosure relates to the field of transferring responsibility of a physical key from a transferer to a transferee.

BACKGROUND

Traditionally, for automated key cabinets keeping track of physical keys, a transfer of a physical key from a transferer to a transferee is performed by the transferer depositing the key in the automated key cabinet and the transferee subsequently retrieving the key from the automated key cabinet.

A direct transfer process, where the physical key is handed from a transferer to a transferee improves the procedure. This transfer of responsibility is updated in the automated key cabinet and/or in other systems to keep track of who has the responsibility of the key.

The authentication for the transfer of the key can be inconvenient in terms of the user interface actions of the transferer and the transferee.

SUMMARY

One object is to improve convenience for transfer of responsibility of a physical key from a transferer to a transferee.

According to a first aspect, it is provided a method of transferring responsibility of a physical key from a transferer to a transferee, the method being performed by a transferee device, being a user device of the transferee. The method comprises: establishing a local communication channel with a user device of the transferer; receiving, over the local communication channel, a request to register that the responsibility of the physical key is transferred from the transferer to the transferee; receiving user input indicating that the responsibility of the physical key is accepted by the transferee; and transmitting a confirmation of registration of transferring the responsibility of the physical key to the transferee.

The receiving user input may comprise receiving accelerometer data, from the transferee device, indicating a bump against an object and correlating the accelerometer data with corresponding accelerometer data from the user device of the transferer.

The local communication channel is based on at least one of Bluetooth, Bluetooth Low Energy, Near-Field Communication and ZigBee.

The method may further comprise: verifying that the transferee is a valid receiver of the physical key.

The verifying may comprise verifying against locally stored data that is cryptographically signed.

The transferee may be a valid receiver when the transferee is licensed to drive a vehicle associated with the physical key.

The transferee may be a valid receiver when the transferee belongs to an organisation associated with an asset secured by the physical key.

The method may further comprise: authenticating the transferee.

According to a second aspect, it is provided a transferee device being a user device of a transferee when transferring responsibility of a physical key from a transferer to the transferee. The transferee device comprises: a processor; and a memory storing instructions that, when executed by the processor, cause the transferee device to: establish a local communication channel with a user device of the transferer; receive, over the local communication channel, a request to register that the responsibility of the physical key is transferred from the transferer to the transferee; receive user input indicating that the responsibility of the physical key is accepted by the transferee; and transmit a confirmation of registration of transferring the responsibility of the physical key to the transferee.

The instructions to receive user input comprise instructions that, when executed by the processor, cause the transferee device to receive accelerometer data, from the transferee device, indicating a bump against an object and correlate the accelerometer data with corresponding accelerometer data from the user device of the transferer.

The local communication channel is based on at least one of Bluetooth, Bluetooth Low Energy, Near-Field Communication and ZigBee.

The transferee device may further comprise instructions that, when executed by the processor, cause the transferee device to: verify that the transferee is a valid receiver of the physical key.

The instructions to verify may comprise instructions that, when executed by the processor, cause the transferee device to verify against locally stored data that is cryptographically signed.

The transferee may be a valid receiver when the transferee is licensed to drive a vehicle associated with the physical key.

The transferee may be a valid receiver when the transferee belongs to an organisation associated with an asset secured by the physical key.

The transferee device may further comprise instructions that, when executed by the processor, cause the transferee device to: authenticate the transferee.

According to a third aspect, it is provided a computer program for transferring responsibility of a physical key from a transferer to a transferee. The computer program comprising computer program code which, when executed on a transferee device being a the user device of the transferee causes the user device of the transferee to: establish a local communication channel with a user device of the transferer; receive, over the local communication channel, a request to register that the responsibility of the physical key is transferred from the transferer to the transferee; receive user input indicating that the responsibility of the physical key is accepted by the transferee; and transmit a confirmation of registration of transferring the responsibility of the physical key to the transferee.

According to a fourth aspect, it is provided a computer program product comprising a computer program according to the third aspect and a computer readable means comprising non-transitory memory in which the computer program is stored.

DETAILED DESCRIPTION

The aspects of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the invention are shown. These aspects may, however, be embodied in many different forms and should not be construed as limiting; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and to fully convey the scope of all aspects of invention to those skilled in the art. Like numbers refer to like elements throughout the description.

FIG.1is a schematic diagram illustrating an environment in which embodiments presented herein can be applied.

A physical key3is used for gaining access to an asset8, such as a vehicle. On occasion, access to the asset8needs to be transferred from one person, here denoted a transferer5a, to another person, here denoted a transferee5b, e.g. for access to a vehicle. The person being responsible for the physical key3can be tracked in a system6, such as an automated key cabinet.

The transferer5ahas a user device, here denoted a transferer device2aand the transferee5bhas a user device, here denoted a transferee device2b. While using different terms, the transferer device2aand the transferee device2bcan be of the same type, even identical device performing different parts of the same software. It is also possible that the devices2a-bare of different types.

Each one of the transferer device2aand the transferee device2bcan e.g. be a smartphone, a wearable device (e.g. smartwatch or smart ring) or a tablet computer. The transferer device2aand the transferee device2bcan communicate over local communication, i.e. point-to-point communication. The local communication4can be based on any one or more of Bluetooth, Bluetooth Low Energy (BLE), Near-Field Communication and ZigBee, etc.

The functions disclosed herein performed by the transferer device2aand the transferee device2bcan be performed by applications (also known as apps) respectively executing in the transferer device2aand the transferee device2b.

When registering a transfer of the physical key3, the local communication4is used between the transferer device2aand the transferee device2bas a handshake between the apps of the transferer device and the transferee device.

Optionally, a suitable transferrer5ais determined prior to performing the actual transfer of the key. For example, a transferee5adesires a certain type of vehicle and when no keys are stored within an automated key cabinet for the desired type of vehicle, a push notification is transmitted to the user device2aof all potential transferers5a, being key holders of that type of vehicle. This process can include a quick survey of which key holders (potential transferers5a) via their respective devices2a, are happy to transfer the key (a time dependent yes/no push notification prompt) and then collates the survey result (in real time) and provides the transferee with a real-time visual means of picking which transferer. The survey is then suspended, the transfer occurs and, when successful, the survey ends. Where multiple potential transferers5aare identified, locality of those users could be considered, particularly if other users are some distance away e.g. at offsite storage.

FIG.2is a schematic diagram illustrating a bump between the transferer device2aand the transferee device2b.

The bump7occurs by tapping the transferer device2aand the transferee device2bagainst each other. Accelerometers9in the two devices2a-bdetect the bump. The bump is used to confirm the transfer of the physical key from the transferer device2ato the transferee device2b, resulting in a registration of a transfer of responsibility of the physical key from the transferer5ato the transferee5b.

FIG.3is a flow chart illustrating embodiments of methods for transferring responsibility of a physical key from a transferer to a transferee. The method is performed in the transferee device2b. Prior to this method starting, the transferer5aand/or the transferee5bhave indicated (using the transferer device2aand/or the transferee device2b) the identity of the physical key3that is transferred.

In an establish local communication channel step40, the transferee device2bestablishes a local communication channel4with a user device of the transferer5a(i.e. with the transferer device2a). The local communication channel4can be based on at least one of Bluetooth, Bluetooth Low Energy, Near-Field Communication and ZigBee. The local communication channel4can be considered to be a peer-to-peer communication channel.

In a receive request step42, the transferee device2breceives, over the local communication channel4, a request to register that the responsibility of the physical key3is transferred from the transferer5ato the transferee5b. The request can be received from the transferer device2a.

In an optional verify valid transferee step43, the transferee device2bverifies that the transferee5bis a valid receiver of the physical key3. For instance, when the asset for which access is given by the physical key is a vehicle, this step can comprise verifying (against data or a database, e.g. in the automated key cabinet6or elsewhere) that the transferee5ahas a valid driver's license with appropriate certification to drive the vehicle. In other words, the transferee is then a valid receiver when the data indicates that the transferee is licensed to drive a vehicle associated with the physical key. Alternatively or additionally, the transferee is a valid receiver when the data indicates that transferee belongs to an organisation associated with an asset secured by the physical key. Alternatively or additionally, the transferee is a valid receiver when the data indicates that the transferee is authorised to take responsibility of assets up to a certain value, that is greater than the value of the asset associated with the physical key. In one embodiment, the verifying comprises verifying against locally stored data that is cryptographically signed by a a trusted third party. The signed data that indicates that the transferee is a valid receiver of the physical key can be communicated to the transferor device, allowing the transferor to also verify the authority if the transferee to take over responsibility of the physical key. All of this can occur using only local communication. While this verification does not stop the transferer5afrom handing over the physical key3to the transferee5b, any failed verification is noted and the transferer5aand central functions can be informed of the invalid transfer.

In a receive user input step44, the transferee device2breceives user input indicating that the responsibility of the physical key3is accepted by the transferee5b.

This receiving of user input can comprise receiving accelerometer data, from the transferee device2b, indicating a bump10against an object. In this case, this also includes correlating the accelerometer data with corresponding accelerometer data from the user device2aof the transferer, to verify that the bump occurred between the two devices and that the bump is not against any other object. In other words, in this embodiment, the transferer5aand the transferee5bsimply bump their devices2a,2bagainst each other to confirm the transfer of responsibility. This is verified by the transferee device2b(and optionally the transferer device) by the bumps (indicated by respective accelerometers) correspond to each other in time.

Alternatively, the user input is a user input of a touchscreen of the transferee device2b.

In an optional authenticate step45, the transferee device2bauthenticates the transferee. This can occur using any suitable authentication method of the transferee device2b, e.g. passcode, face recognition, fingerprint recognition, etc. The authentication provides an indication that it is indeed the transferee5bthat accepts responsibility of the physical key.

In a transmit confirmation step46, the transferee device2btransmits a confirmation of registration of transferring the responsibility of the physical key3to the transferee5b. The confirmation can be transmitted to the transferer device2aand/or a central component such as the automated key cabinet6. In this way, the automated key cabinet6can keep track of who is responsible for the physical key3even when there is a direct transfer from the transferer5ato the transferee5bwithout depositing the physical key3in the automated key cabinet6. Optionally, if the transferee device2bdoes not have network access at the time of transfer of the physical key, the confirmation can be stored in a queue in the transferee device2band is transmitted when network connectivity returns. This enables direct transfer of the portable key to occur even in environments with poor network reception, e.g. in underground garages, etc.

Optionally, a slightly different process of registering transfer of the physical key can be provided. This optional process is suited for certain scenarios, for example where an employee of a car repair workshop is handing the customer the key after delivering their vehicle to their home (and therefore nominating the last transferee of the key to be the customer rather than the employee who delivered) or where the employee is handing the key to a third party body shop or car transport.

In this optional process, although the key is being transferred from transferer to transferee, the exchange is based on a greater level of verification and the transferee's device does not need to be part of the same ecosystem.

In this scenario, a Time-based One-time Password (TOTP) can be used (displayed or presented via a QR (quick response) Code or transmitted via local communication such as Bluetooth/NFC (Near-Field Communication)), such that the transferee device2b(of the customer in this scenario) displays or provides the code and the transferer device2ainputs the code. The code input can be based on any of manual entry, QR code reading (via a camera) or Bluetooth/NFC communication with the transferee device. This procedure provides a greater level of trust over the transaction.

This would also enable the untrusted third party without requiring the same app/device, and instead the TOTP code could be generated by another trusted app with integration or issued to the third party (and not the transferer) as part of an automated system (for example as part of an electronic work order to collect the car or digital paperwork a customer receives).

The TOTP may have extended duration e.g. 24 hours, and, in one embodiment, the TOTP is known to the (electronic) transferer device2awithout being visible to the user transferer5a(human) in order to facilitate verification of transferee5band device2bin an environment with poor network reception.

Using embodiments presented herein, a convenient yet secure way of performing a direct transfer of a physical key3from the transferer5ato the transferee5bis achieved. By using the local communication, there is no requirement to have network access at the time of (registering) the transfer. Moreover, latency is reduced compared to communicating via a central node.

FIG.4is a schematic diagram illustrating components of the transferee device2bofFIG.1. A processor60is provided using any combination of one or more of a suitable central processing unit (CPU), graphics processing unit (GPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions67stored in a memory64, which can thus be a computer program product. The processor60could alternatively be implemented using an application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc. The processor60can be configured to execute the method described with reference toFIG.3above.

The memory64can be any combination of random-access memory (RAM) and/or read-only memory (ROM). The memory64also comprises non-transitory persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid-state memory or even remotely mounted memory.

A data memory66is also provided for reading and/or storing data during execution of software instructions in the processor60. The data memory66can be any combination of RAM and/or ROM.

The transferee device2bfurther comprises an I/O interface62for communicating with external and/or internal entities. The I/O interface62also includes a user interface.

Other components of the transferee device2bare omitted in order not to obscure the concepts presented herein.

FIG.5shows one example of a computer program product90comprising computer readable means. On this computer readable means, a computer program91can be stored, which computer program can cause a processor to execute a method according to embodiments described herein. In this example, the computer program product is in the form of a removable solid-state memory, e.g. a Universal Serial Bus (USB) drive. As explained above, the computer program product could also be embodied in a memory of a device, such as the computer program product64ofFIG.4. While the computer program91is here schematically shown as a section of the removable solid-state memory, the computer program can be stored in any way which is suitable for the computer program product, such as another type of removable solid-state memory, or an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a Blu-Ray disc.

The aspects of the present disclosure have mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims. Thus, while various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.