Marking for authentication and access

An authentication system for managing access to an access-restricted system is provided. The system includes a user interface panel for receiving a request for access rights from a user. A processing device is also provided for assigning the access rights to the user and storing them in a database. An ink deposition station coupled to the processing device is operable to print access credentials on an authentication object in accordance with the access rights assigned to the user. The user may then gain access to at least a portion of the access-restricted system by interfacing with a credentials reader. The reader scans the access credentials from the authentication object and transmits the credentials to the processing device, which grants access to the access-restricted system upon authentication of the access credentials.

FIELD OF INVENTION

The present invention relates to authentication systems for authenticating access privileges and, in particular, authentication systems for managing access rights associated with an access-restricted system.

BACKGROUND OF THE INVENTION

Authentication systems for providing users with access privileges are well known. Such systems typically provide a means by which authorized users may authenticate access privileges for gaining access to at least a portion of an access-restricted system, such as an access-restricted venue, room, compartment, computer, area, etc. For example, manufactures of electronic locker systems typically provide a means by which users can authenticate access to rented compartments. Such systems typically include a bank of compartments and a kiosk that allows a customer to rent and access one or more of the compartments using credit cards, cash or other forms of payment. After completing the rental process, the user secures his/her personal belongings in the rented compartment. To access the compartment, the user typically enters a personal identification code (e.g., a PIN or password) into the kiosk, which then opens the rented compartment electronically. An example of an electronic locker system employing PINs may be found in co-owned U.S. patent application Ser. No. 15/084,298, the entire contents of which are expressly incorporated herein by reference.

While PINs and passwords provide means to authenticate access privileges for electronic lockers and other access-restricted systems, they may suffer from security issues. For example, it is possible for a person to obtain the PIN of another user by observing him/her entering the PIN into a kiosk or other device to gain access to an access-restricted system. The person may then use the PIN at a later time to gain unauthorized access to the system. It is also possible for a user to give his/her PIN to another user, thereby allowing another person to continue use of the access-restricted system. Such PIN transfers not only allow unauthorized access, but may also lead to reduced profits for an establishment at which the authentication system is installed. For example, with respect to electronic locker systems, transfer of PINs and passwords may prevent an establishment from earning rental fees from persons who would otherwise have paid for a rental.

Some companies have developed authentication means that seek to address these issues. For example, some authentication systems have been developed that use biometric scanners, such as fingerprint and eyeball recognition scanners, for authenticating access to an access-restricted system. Other companies have developed authentication systems that use wristbands with imprinted barcodes that are scanned by a reader in order to gain access. While these authentication systems provide better security and reduce the likelihood of transfer of access rights, they require very expensive hardware and software. They also typically require the replacement of certain disposable or consumable goods (such as wristbands), which is time consuming and costly.

SUMMARY OF THE INVENTION

Embodiments of the present invention solve these and other disadvantages of the prior art by providing an authentication system for managing access to an access-restricted system using an authentication object with access credentials printed thereon. To gain access, a user first requests access rights from a user interface panel, such as a kiosk. Once rights are obtained, the user places an authentication object within an ink deposition station, which proceeds to print access credentials on the authentication object in accordance with the user's access rights. The user may then access the access-restricted system by interfacing with a credentials reader, which reads the access credentials from the authentication object and grants access upon authentication of the credentials.

In certain embodiments, invisible inks or dyes are used to print the access credentials on the authentication object. Use of invisible inks or dyes reduces the likelihood that unauthorized persons can obtain the access credentials surreptitiously.

Various embodiments of the present invention also permit the access credentials to be printed on a variety of different authentication objects, including authentication objects supplied by the user. This eliminates the need for and expense associated with consumable authentication objects supplied by the authentication system itself (such as wristbands, RFID chips, etc.), as well as the hardware and software required to dispense such consumables. With respect to certain embodiments, an authentication object may also include a body part of the user, such as the back of a hand or wrist of the user. With respect to these embodiments, and when using invisible inks or dyes, transfer of authentication credentials to an unauthorized user may be greatly reduced, if not eliminated altogether. Printing inks and dyes on the body part of a user may also permit operators at certain venues to improve patron security, for example, by providing a means by which operators can scan the code of lost children to identify and ultimately locate their parents.

DETAILED DESCRIPTION

Referring now toFIG. 1, there is seen an authentication system100in accordance with the present invention. Authentication system100includes components configured to permit a user to acquire access rights and to subsequently gain access to one or more portions of an access-restricted system105, such as, for example, an access-restricted charging station, service, venue, area, room, device, facility, computer, tablet or other computing mechanism, etc. Authentication system100may also be used to manage access to an electronic locker system, such as, for example, the electronic locker systems described and claimed in co-owned U.S. patent application Ser. No. 15/084,298. System100may also be employed to track time units associated with certain events. For example, in one embodiment, authentication system100is used to track time worked by employees at a work site. In other embodiments, authentication system100may be used to authenticate credit payments, such as, for example, at casinos and other venues. In still other embodiments, authentication system100may be used to track objects through a system, venue or other location.

Authentication system100includes a user interface panel145(which may take the form of a kiosk), an ink deposition station110, and credentials reader115communicatively coupled to a processing device120(with a database135) via network medium140. To gain access to access-restricted system105, a user first obtains access rights from kiosk145. The access rights may include rights to access the entirety of access-restricted system105or, alternatively, may include rights to access only a portion of system105. After the access rights are obtained, the user employs ink deposition station110to print access credentials130on an authentication object135. The user may then interface with credentials reader115, which reads access credentials130from authentication object125and communicates them to processing device120. Processing device120then authenticates access credentials130and, if valid, permits the user access to those portions of access-restricted system105associated with the user's access rights.

As shown inFIG. 1, authentication system100is separate and distinct from access-restricted system105and, in this manner, functions as a stand-alone collection of components for managing access functions for access-restricted system105. It should be appreciated, however, that authentication system100may form a part of access-restricted system105itself, such as, for example, with respect to an electronic locker system built to include one or more components of authentication system100. The present invention, however, is not intended to be limited to any specific positioning or arrangement of authentication system100or its components with respect to access-restricted system105.

Network medium140is operable to permit electronic communications among components of authentication system100and access-restricted system105. Network medium140may include, for example, a wired Ethernet network, a wireless communication network (such as Wi-Fi or Bluetooth), direct conduit wiring, satellite, and/or any combination of these or other communication mediums. It should be appreciated, however, that embodiments of the present invention are not intended to be limited to any particular type of communication medium, and that the full scope of the invention contemplates various additional communication mediums.

Authentication object125acts as a “key” that allows a user to gain access to access-restricted system105. For this purpose, authentication object125may include, for example, any object capable of being carried by a user and receiving printed ink or dye, such as, for example, a blank medium (such as a blank sheet of paper, card, or other similar medium), a ticket (such as a ticket to an entertainment venue or receipt therefor), a driver's license, a credit card, a wristband, etc. Authentication object125may also include or comprise one or more body parts of a person, such as, for example, the back of a hand or wrist of the user or other person.

Access credentials130printed on authentication object125may include, for example, any data printable on authentication object125that identifies a user (or group of users) authorized to access access-restricted system105, such as, for example, an image or picture, a symbol, a barcode, a number (such as a PIN number), letters, and/or any combination of these.

Processing device120manages all authentication and access functions of authentication system100. For this purpose, processing device120may include a general purpose computer or other off-the-shelf components executing appropriate software or, alternatively, may include special purpose hardware and/or software. In one embodiment, processing device120consists of a rack mounted personal computer (PC) operable to execute specially designed software for performing all authentication and access functions of authentication system100. It will be appreciated, however, that various embodiments of the present invention are not intended to be limited to any particular processing hardware and/or software. It should also be appreciated that various embodiments of the present invention are not intended to be limited to a particular location for processing device120. Processing device120may consist of a single processing device positioned at a centralized location or, alternatively, may include multiple processing devices distributed throughout authentication system100and/or at other locations.

Kiosk145includes components configured to permit a user to request (and/or purchase) access rights from processing device120in order to gain access to at least a portion of access-restricted system105. For this purpose, kiosk145includes a touchscreen interface155and associated software/hardware for displaying information to and receiving inputs from a user. With respect to embodiments that require payment of a fee to gain access to access-restricted system105, kiosk145also includes payment interface equipment150for receiving various forms of payment from the user, such as credit cards, debit cards, cash, etc. In one embodiment, payment interface equipment150includes a bill acceptor for accepting payment in the form of cash or other negotiable instruments, a card reader (which may include an EMV chip reader) for retrieving payment and related information from credit and debit cards, a Radio Frequency Identification Device (RFID)/Near Field Communication (NFC) reader for retrieving payment and related information from various RFID/NFC devices, such as from a transponder embedded within a wristband provided by the venue at which authentication system100is installed or from an NFC-enabled smartphone/tablet running, e.g., Apple Pay or Android Pay, and/or barcode reader for retrieving payment and other information from a barcode, such as, for example, a barcode imprinted on a wristband, receipt or other medium.

Referring now toFIG. 2, there is seen a flow chart detailing a process for requesting access rights using kiosk145. The process begins at step200and proceeds to step205, at which touchscreen interface155of kiosk145displays options associated with various different access rights obtainable by the user. These options may include, for example, a duration of the access rights, portions of access-restricted system105available for access (such as available seats in a theatre or available lockers in an electronic locker system), number of authorized users associated with the access rights, and/or any other customizable characteristic or feature related to the access rights. To shorten the time required to select options, various embodiments of the present invention provide the user with the ability to pre-select options at an earlier time using the user's computer or other computing device. In this embodiment, authentication system100(or a computer server associated with and in communication with authentication system100) is connected to the Internet, and the user is provided access to authentication system100via an Internet web portal. The web portal presents and allows the user to select various options associated with his/her request for access. The options selected by the user are associated with the user's access rights and assigned a barcode, which is then printed on a standard sheet of paper via a printer connected to the user's computer or saved as a barcode image on a portable Smart Device, such as a Tablet or Smartphone. The barcode on the paper or Smart Device may then be scanned at kiosk145via a barcode scanner (not shown) to retrieve the user's access options.

After the user selects various options associated with the access rights, the process proceeds to step210. At step210, the user is prompted for payment to obtain the access rights. In various embodiments, the payment required may depend on options selected by the user at step205. For example, selecting a longer duration of the access rights or more than one user may require a larger payment. It should be appreciated, however, that various embodiments of the present invention may not require payment, and that access rights may be provided to the user free of charge.

After the user provides proper payment, the process proceeds to step215. At step215, processing device120stores data indicative of the access rights in database135and associates the access rights with the user (or group of users in the event of more than one authorized user, such as, for example, a group of friends or family members).

The process then proceeds to step220, at which a message is displayed on touchscreen interface155directing the user to place an authentication object125within ink deposition station110for printing access credentials130thereon. The process then ends at step225.

Referring now toFIG. 3, there is seen an ink deposition station110in accordance with the present invention. Ink deposition station110includes a frame305and a printing unit310within frame305and disposed over a printing area315. Ink deposition station110also includes a platform325within printing area315for receiving authentication object125, a camera355for imaging authentication object125, a distance sensor330for acquiring the distance of authentication object125relative to printing unit310, a motion sensor335to detect motion of authentication object125, a translation mechanism340for moving printing unit310(or an ink head associated with printing unit310) into a proper position for printing access credentials130on authentication object125, a curing device345for curing an ink or dye printed by printing unit310onto authentication object125, and an ink reader350for verifying access credentials130after printing and/or detecting previously printed access credentials130.

Printing unit310is controllable by processing device120to print access credentials130on authentication object125. For this purpose, printing unit310may include any type of ink printing unit310, such as, for example, a continuous or non-continuous printing unit310employing a piezoelectric ink jet printing head, a thermal ink jet printing head, a dye sublimation print head, a laser print head, a phase change print head, an impact print head, etc. Printing unit310may also be configured to print any type of visible or invisible ink or dye medium, such as, for example, base and polymer curable ultraviolet (“UV”) inks and dyes, infrared (“IR”) inks and dyes, sublimation inks and dyes, water or solvent based inks and dyes, and/or magnetic inks and dyes. Such inks and dyes may be provided via ink/dye cartridges or, alternatively, may be provided via a refillable reservoir, such as a reservoir of a continuous ink supply (“CIS”) system. It should be appreciated, however, that various embodiments of the present invention are not intended to be limited to any specific type of printing unit, printing head, ink or dye.

The type of ink or dye employed may depend, for example, on particular uses of authentication system100and access-restricted system105. For example, with respect to applications requiring additional security, invisible inks or dyes may be employed to render it difficult for unauthorized users to observe and copy access credentials130to a different authentication object125. For applications in which authentication object125includes a body part of a person (such as the back of a hand or wrist of a user), the ink and/or dye may also be biocompatible and/or hypoallergenic. Alternatively, where authentication object125includes licenses, tickets and other media intended for other uses, it may be desirable to print inks or dyes that are easily removable, such as, for example, via a hand wipe containing Isopropyl alcohol (IPA), rubbing alcohol or other solvent.

In some embodiments, printing unit310(or other device, such as curing device345) is also operable to apply a pre-treatment or primer agent to authentication object125in order to prepare authentication object125to receive a particular type of ink or dye for printing access credentials130. In other embodiments, the pre-treatment or primer is applied by the user manually, such as, for example, via a hand wipe. In still other embodiments, a dryer is employed to dry authentication object125before printing unit310deposits ink or dye thereon. Drying authentication object125may be desirable in situations where authentication object125is expected to acquire moisture throughout a rights period, such as, for example, when authentication system100is used to manage access rights for an electronic locker system installed at a water park.

In various embodiments, printing unit310is controllable by processing device120to print access credentials130using photolithography techniques. Specifically, a UV-curable ink is sprayed onto authentication object125and then selectively exposed to intense UV light by a scanning laser or a stencil. The laser follows a path to expose and cure only portions of the ink or dye corresponding to access credentials130. The unexposed ink or dye is then washed away, thereby leaving behind cured access credentials130on the surface of authentication object125. In an alternative embodiment, a diffuse light source is employed to expose the UV-curable ink through a masking stencil. The masking stencil, which may be positioned at a distance from authentication object125sufficient to ensure a well-defined print, is configured to mask areas of the ink or dye that do not correspond to access credentials130. This leaves only cured access credentials130after exposure.

Translation mechanism340is controllable by processing device120for moving printing unit310or an associated ink head into a proper position for printing access credentials130on authentication object125. Proper positioning of printing unit310may be desirable in some embodiments to better ensure that access credentials130are printed at the right location on authentication object125and/or to properly focus the printing of access credentials130. In one embodiment, translation mechanism340includes a linear translation system capable of moving printing unit310into various positions along X, Y, and Z axes. In another embodiment, the linear translation system moves printing unit310into various positions along X and Y axes, and a separate, zooming mechanism positions printing unit310properly along the Z axis. In yet another embodiment, printing unit310is positioned on the end of an articulated-arm robot configured and operable to properly position printing head310in three-dimensions with respect to authentication object125.

WhileFIG. 3shows translation mechanism340positioned and operable to move printing unit310, translation mechanism340may instead be positioned and operable to move platform325(with authentication object125thereon) into a proper position with respect to a fixed, stationary printing unit310. In other embodiments, translation mechanism340may be configured to move both printing unit310and platform325to ensure proper positioning of authentication object125with respect to printing unit310. Regardless, it should be appreciated that various embodiments of the present invention are not intended to be limited to any particular type of translation mechanism340, and that the full scope of the present invention contemplates various additional ways of ensuring proper positioning of authentication object125with respect to printing unit310.

Distance sensor330and motion sensor335may include any technology for determining distance and detecting motion of authentication object125with respect to printing unit310. Determining distance and detecting motion of authentication object125may be useful in some embodiments to better ensure proper positioning of printing unit310and/or proper timing of ink or dye printing. Distance sensor330may include, for example, an optical range finder, a laser range finder, and/or an electroacoustic range finder. Motion sensor335may include, for example, an optical motion sensor, a passive IR motion sensor, a microwave motion sensor, an ultrasonic motion sensor, and/or a tomographic motion sensor. In one embodiment, distance and motion of authentication object125are determined using images captured from camera355, thereby dispensing with the need for distance sensor330and/or motion sensor335. In another embodiment, distance and motion of authentication object125are determined from a single integrated detecting device. It should be appreciated, however, that various embodiments of the present invention are not intended to be limited to any particular types or configurations of distance and motion sensors.

Curing device345includes components controllable by processing device120to cure an ink or dye after being deposited by printing unit310onto authentication object125. With respect to embodiments employing standard water or solvent based inks or dyes, whether visible or invisible, curing device345may include, for example, a forced air dryer for drying the ink or dye after application. In embodiments employing a UV-curable ink or dye, such as a UV-curable polymer ink or dye, curing device345may include a UV light for curing the ink or dye. In other embodiments, curing device345is operable to apply a pre-treatment or primer agent to authentication object125in order to prepare authentication object125to receive a particular type of ink or dye for printing. In still other embodiments, curing device345may be configured to apply a sealer to the surface of authentication object125to seal the ink or dye after application, thereby providing enhanced protection and longevity of the printed access credentials130.

Referring now toFIG. 4, there is seen a flow chart detailing a process for printing new access credentials130non authentication object125using ink deposition station110. The process begins at step400and proceeds to step405, at which the user places authentication object125on platform325. Placement of authentication object125on platform325causes motion sensor335to trigger and communicate a motion signal to processing device120, thereby allowing processing device120to determine the presence of authentication object125. It should be appreciated, however, that presence of authentication object125may be determined using other methods, such as, for example, via analysis of images captured by camera355, signals generated by distance sensor330, and/or a combination of these or other methods.

After authentication object125is placed on platform325and detected by processing device120, the process proceeds to step410. At step410, processing device120employs ink reader350to determine whether authentication object125already includes old access credentials130printed thereon, such as expired access credentials130or access credentials130associated with a different authentication system100.

If processing device120detects old access credentials130on authentication object125, the process proceeds to step415. At step415, processing device120determines whether old access credentials130are legible and suitable for use in connection with the user's current request for access. If so, the process proceeds to step420, at which processing device120stores data in database135associating old access credentials130with the user and his/her access rights. The process then ends at step465, after which the user may employ credentials reader115to read old access credentials130on authentication object125to gain access to at least a portion of access-restricted system105in accordance with his/her access rights.

If processing device120does not detect old access credentials130at step410or determines at step415that old access credentials130are illegible or otherwise unsuitable for use, the process proceeds to step422. At step422, processing device120checks various system parameters and/or settings to determine whether authentication system100should abort printing new access credentials130nand, instead, switch to an alternative method of granting and authenticating access privileges, such as, for example, via barcoded wristbands, personal identification codes, biometric scanning and/or any other alternative method. For instance, processing device120may check the level of ink and/or dye to be printed by ink deposition station110and, if too low or empty, switch to an alternative means of access. In such an embodiment, for example, a sensor positioned within an ink reservoir communicates a signal to processing device120when an ink and/or dye therein reaches a preset or programmable threshold. Processing device120may also abort printing new access credentials130nbased on other system parameters, such as, for example, whether certain components of authentication system100are determined by processing device120to be defective or based on a general system error associated with authentication system100and/or one or more components or software modules of authentication system100. In an alternative embodiment, processing device120is also operable (via suitable sensors) to abort printing new access credentials130nbased on environmental variables, such as, for example, the air temperature, air moisture level, weather conditions and/or any other environmental variable. Processing device120may also be operable to abort printing new access credentials130nbased on a programmable system setting, thereby allowing system operators to selectively disable access credentials printing in favor of other methods of granting and authenticating access privileges.

If it is determined at step422that printing should be aborted, authentication system100switches to an alternative method of granting and authenticating access privileges, and the process ends at step465. Otherwise, the process proceeds to step425, at which processing device120generates new access credentials130nand stores data in database135associating new access credentials130nwith the user and his/her access rights. In an alternative embodiment, new access credentials130nare not generated by processing device120, but rather are provided by the user via touchscreen interface155of kiosk145. New access credentials130nprovided by the user may include, for example, a personal identification code (such as a 4-digit identification code or alphanumeric password). For security, mask characters, such as “XXXX” or “****”, may hide the identification code from view upon entry.

The process then proceeds to step430. At step430, processing device120controls printing unit310and/or curing device345to apply a pre-treatment or primer agent to authentication object125in order to prepare authentication object125to receive a particular type of ink or dye for printing new access credentials130n. It should be appreciated, however, that application of a pre-treatment and/or primer agent is not necessary and may be omitted from various embodiments of the present invention.

The process next proceeds to step435, at which processing device120processes data from distance sensor330and/or camera355to determine the distance of authentication object125with respect to printing unit310. The distance information is then used by processing device120at step440to control translation mechanism340to move printing unit310and/or platform325into a proper position for printing new access credentials130non authentication object125.

After printing unit310and/or platform325is properly positioned, the process proceeds to step445. At step445, processing device120processes signals from motion sensor335to determine whether authentication object125has moved (or is moving) with respect to printing unit310. If so, the process reverts back to steps435and440to recalculate distance of authentication object125and reposition printing unit310and/or platform325accordingly for printing new access credentials130non authentication object125.

If the motion sensor does not detect motion of authentication object125at step445, the process proceeds to step450, at which processing device120controls printing unit310to print new access credentials130non authentication object125. In the event that processing device120detected illegible or otherwise unsuitable old access credentials130at step415, processing device120controls printing unit310to print new access credentials130nat a location on authentication object125that does not overlap old access credentials130. In this way, it can be better ensured that new access credentials130nare legible when subsequently used to gain access to access-restricted system105via credentials reader115.

After new access credentials130nare printed on authentication object125, the process proceeds to step455. At this step, ink reader350scans new access credentials130non authentication object125to determine whether credentials130nare legible and suitable for use in connection with the user's current request for access.

If new access credentials130nare not legible, the process reverts back to step450, at which ink deposition station110reprints new access credentials130non authentication object125. In one embodiment, processing device120controls printing unit310to print new access credentials130nat a location on authentication object125that does not overlap the illegible credentials130npreviously printed and/or old access credentials130. In another embodiment, processing device120prints new access credentials130non authentication object125a limited number of times (defined by a preset or programmable threshold), after which authentication system100switches to an alternative method for associating new access credentials130nwith the user's access rights. For example, with a threshold set to “3,” processing device120would attempt to print and verify the legibility of new access credentials130nthree times, after which authentication system100would switch to the use of a personal identification code (such as a 4-digit identification code or alphanumeric password). In this embodiment, touchscreen interface155of kiosk145(or some other device or screen) prompts the user to enter a 4-digit code, which may then be employed by the user to gain access to access-restricted system105. In another embodiment, the personal identification code is generated by processing device120and displayed to the user via touchscreen interface155. In still another embodiment, authentication system100switches to the use of barcoded wristbands or other means for granting the user access to access-restricted system105. It should be appreciated, however, that various embodiments of the present invention are not intended to be limited to any particular alternative method for access, and that the full scope of the invention contemplates other manners and methods for granting a user alternative ways to gain access to access-restricted system105.

If it is determined at step455that new access credentials130nare legible and suitable for use, the process proceeds to step460. At step460, processing device120controls curing device345to cure new access credentials130nand/or to apply a protective sealer to authentication object125. The process then ends at step465, after which the user may employ credentials reader115to read new access credentials130non authentication object125to gain access to at least a portion of access-restricted system105.

Credentials reader115of authentication system100is operable to read access credentials130from authentication object125and communicate information indicative of credentials130to processing device120for processing. For example, with respect to embodiments employing bar-coded access credentials130, credentials reader115may include a barcode reader, optical reader or other suitable reading device operable to scan and retrieve data contained within a bar code. Credentials reader115may also include a standard optical reader, such as a camera or other suitable device, in the event that access credentials130include a combination of numbers and/or letters, symbols or images. In such cases, optical character recognition and/or other techniques known in the art may be employed to extract relevant information from access credentials130for transmission to processing device120.

Features of credentials reader115may also depend on the type of ink or dye used to print access credentials130on authentication object125. For example, in the event that magnetic ink or dye is used, credentials reader115may include a magnetic ink reader and employ Magnetic Ink Character Recognition (“MICR”) techniques to extract relevant information from access credentials130. Or, if invisible UV and/or IR inks or dyes are used, credentials reader115may include UV and/or IR scanners capable of detecting such inks or dyes (or, alternatively, may include a standard camera and a UV or IR illumination source for making UV and/or IR inks or dyes visible). It should be appreciated, however, that various embodiments of the present invention are not intended to be limited to any particular type of credentials reader115, and that the full scope of the present invention contemplates various additional methods for detecting and reading authentication credentials130. It should also be appreciated that authentication system100may include a single credentials reader115or employ multiple credentials readers115positioned throughout authentication system100and/or at other locations. Providing multiple credentials readers115enhances convenience by providing users with multiple different locations to gain access to access-restricted system105. In other embodiments, credentials reader115forms a component of ink deposition station110, thereby allowing ink deposition station110to both print and authenticate access credentials130. In such an embodiment, credentials reader115may utilize camera355and appropriate software (executed by processing device120or another device) for performing authentication functions. In still other embodiments, credentials reader115forms a component of a user portal, such as the user portal of various electronic locker systems described and claimed in co-owned U.S. patent application Ser. No. 15/084,298.

Referring now toFIG. 5, there is seen a flow chart detailing a process for using credentials reader115to gain access to access-restricted system105in accordance with access rights obtained by a user. The process begins at step500and proceeds to step505, at which a user places authentication object125against credentials reader115. At step510, credentials reader115attempts to read access credentials130from authentication object125. If access credentials130are illegible or non-existent on authentication object125, credentials reader115informs the user via a screen or other communication device (not shown) and may, for example, instruct the user to contact administrative support staff to solve the issue. In another embodiment, credentials reader115requests the user to authenticate access credentials130via an alternative method, such as, for example, via the use of a personal identification code or password. Credentials reader115may request the alternative authentication method after the first failed scan of access credentials130or, alternatively, may request the alternative authentication method after a predetermined number of failed attempts to scan access credentials130. The predetermined number of failed attempts may be a preset number or may be programmable to allow system operators flexibility to customize authentication system100.

If credentials reader115successfully reads access credentials130at step510, credentials reader115transmits data indicative of access credentials130to processing device120. The process then proceeds to step515, at which processing device120queries database135to determine whether access credentials130scanned by credentials reader115were previously associated with the user and his/her access rights (see, for example, steps420and425of the process flow chart ofFIG. 4). If access credentials130are not associated with the user and his/her access rights, access to access-restricted system105is not granted and the process ends at step520. If access credentials130are associated with the user and his/her access rights, the process proceeds to step525, at which processing device120grants the user access to at least a portion of access-restricted system105in accordance with his/her access rights. The process then ends at step520.

In an alternative embodiment, the user may gain access to access-restricted system105in other ways. For example, with respect to embodiments in which the user or system100provides access credentials130in the form of a PIN or password, the PIN or password may be entered manually by the user via touchscreen interface155of kiosk145(or at other locations) in order to gain access. In the event that access credentials130are printed using invisible UV or IR ink or dye, a separate reading station may be provided to remind the user of his/her PIN or password. The reading station may include, for example, a black light or other source of illumination that causes access credentials130to become visible when authentication object125is inserted into the reading station. The reading station may also include a shield, cover or other means of blocking the view of authentication credentials130from unauthorized persons standing within the vicinity of the user, thereby enhancing security of authentication system100.

In yet another embodiment, access credentials130scanned from authentication object125may be used to identify certain individuals associated with the authentication object. For example, in the event that access credentials130are associated with members of the same family, venue operators may use credentials reader115(or a separate portable reader) to scan access credentials130of lost children to identify their parents. This information may then be used to locate the parents within the venue and reunite them with their lost children.

Referring now toFIG. 6, there is seen an electronic storage system600employing an authentication system100in accordance with the present invention. Electronic storage system600includes a system housing605, a plurality of securable units610, such as storage compartments610, arranged in a matrix-like configuration of multiple columns, a kiosk145with processing device120(not shown) and touchscreen interface155in electronic communication with storage compartments610, ink deposition station110and one or more credentials readers115disposed on rails625between the columns of storage compartments610. Electronic storage system600is intended for use by customers at various entertainment venues, such as amusement and water parks, ski resorts, theatres and other venues where securable storage of customer property is desired. The system achieves this by enabling a customer to rent a storage compartment610for storage of personal belongings using kiosk145and thereafter to controllably access the storage compartment610for a duration using credentials readers115.

Referring now toFIG. 7, there is seen a storage compartment610according to the present invention. Various different sized storage compartments610(e.g., small, medium, large and extra-large) may be included within electronic storage system600. Each compartment610includes a cubicle705for storing customer belongings, a door710for securing cubicle705, a compartment identifier730(e.g., an ID number or other information uniquely identifying storage compartment610) and an electronic locking mechanism715positioned within rail625alongside and adjacent to door710of cubicle705(in other embodiments, locking mechanism715is positioned on or within door710). When door710is closed, locking mechanism715automatically secures cubicle705by engaging a pin720within an associated receptacle725of door710(or a receptacle within rail625, in the event locking mechanism715is positioned on or within door710), thereby securing door710firmly against rail625in a closed and secure position. When electronically controlled to unlock, locking mechanism715retracts pin720and opens door710, thereby allowing access to cubicle705.

Referring now toFIG. 8, there is seen a flow chart detailing a process for renting a storage compartment610using kiosk145. The process beings at step800and proceeds to step805, where a user is presented with an introductory splash screen via touchscreen interface155of kiosk145. The splash screen displays various information to the user, such as information relevant to the venue at which electronic storage system600is installed. The splash screen, or other screen presented to the user during the rental process, may also display appropriate terms and conditions, such as when electronic storage system600is configured as a “ride” system operable to offer free compartment rentals for limited periods of time.

After exiting the splash screen, the process proceeds to step810, at which the user is presented with various options associated with the rental of storage compartment610. In one embodiment, the user is presented with a display on touchscreen interface155showing options permitting him/her to select a desired size (e.g., small, medium, large or extra-large) for a storage compartment610to be rented. Size options correlate to respective prices for available compartments, whereas options for unavailable sizes are not presented or, alternatively, are presented in a non-selectable form (e.g., greyed out) with a suitable message, such as “Sold Out.” Size options provide flexibility by permitting the user to select an amount of storage commensurate with his/her needs at a particular time. For example, an individual wishing to store only one or a few items may select a small compartment, whereas a larger compartment may be selected to accommodate bulky items or belongings of multiple individuals.

In another embodiment, the user is also presented with a display showing options permitting him/her to select a desired vertical location (or height) of storage compartment610, if available. Height options are presented in accordance with the compartment size option selected by the user (e.g., medium). In this manner, the user can ensure comfortable access of the assigned storage compartment610based on preferences and attributes, such as the height of the user, physical disabilities, etc. The user may also be presented with options permitting him/her to select the duration of the rental and/or to select a fixed price, to which the electronic storage system600assigns a rental duration. For example, in one embodiment, the user is presented with options permitting him/her to select a number of hours to rent storage compartment610or a multi-day rental, whereby the user can select a number of days to rent storage compartment610.

After selecting various options associated with the rental, the process proceeds to step815where the user is presented with payment options for renting storage compartment610. As described above, kiosk145of electronic storage system600is configured to accept various forms of payment, such as cash, credit cards, debit cards, and payments via RFID/NFC devices and barcodes (some embodiments may omit one or multiple forms of payment or offer locker access free of charge). In the event the user pays with a credit or debit card or RFID/NFC device, kiosk145processes and verifies payment over the Internet using standard processing communications with appropriate clearing houses.

After payment is verified, the process proceeds to step820. At this step, processing device120of kiosk145assigns access rights to the user and associates these rights to an available storage compartment610consistent with the options selected by the user at step810, such as size and height preferences. Processing device120then stores the access rights (with associated user information) in database135.

The process then proceeds to step825. At this step, processing device120causes touchscreen interface155to display a message to the user directing him/her to place an authentication object125(such as the back of the user's hand or wrist) within ink deposition station110for printing access credentials130thereon. After the user positions authentication object125within ink deposition station110, the process proceeds to step830, at which ink deposition station110proceeds to print access credentials130(or use old access credentials130already printed) in accordance with an ink deposition process, such as the one described with respect to the flow chart ofFIG. 4. Data indicative of access credentials130is then stored in database135and associated with the access rights of the user and assigned storage compartment610. In one embodiment, ink deposition station110employs an invisible ink or dye (such as a UV or IR ink or dye) to better ensure that unauthorized users cannot discover access credentials130from merely looking at authentication object125.

The process then proceeds to step835. At this step, processing device120of kiosk145unlocks and opens the assigned storage compartment610by controlling the associated locking mechanism715of the compartment and communicates compartment identifier730and the rental time to the user via touchscreen interface155. This information may also be provided to the user via a receipt, which may be printed and/or emailed to the user. The process then ends at step840.

After the rental process is completed at step840, the user locates the assigned storage compartment610using compartment identifier730provided by kiosk145. An indicator light (not shown) on or adjacent to door710of compartment610may provide a visual indication to aid the user in locating the assigned storage compartment610. After the user locates and places his/her personal belongings in the assigned storage compartment610, the compartment is secured by closing door710, which automatically engages the associated locking mechanism715within rail625. The user may then access the assigned storage compartment610during the rental period by using one or more credentials readers115to read access credentials130on authentication object125.

Referring now toFIG. 9, there is seen a flow chart detailing a process for accessing a rental of an assigned storage compartment610using one or more credentials readers115. The process beings at step900and proceeds to step905, at which a user places authentication object125(with access credentials130printed thereon) against one of credentials readers115. At step910, the selected credentials reader115detects and reads access credentials130from authentication object125and transmits data indicative of access credentials130to processing device120of kiosk145.

The process then proceeds to step915, at which processing device120queries database135to determine whether access credentials130scanned by credentials reader115were previously associated with the user and his/her access rights (see, for example, steps420and425of the process flow chart ofFIG. 4). If not, access to assigned storage compartment610is not granted and the process ends at step925. In one embodiment, a suitable message, such as “Access Denied,” “Invalid Code” or other suitable message, is displayed to the user via touchscreen interface155or other screen (not shown). If access credentials130are associated with the user and his/her access rights, the process proceeds to step920, at which processing device120retrieves the stored compartment identifier730and transmits an unlock signal to the locking mechanism715associated with the assigned storage compartment610, thereby causing door710of the assigned storage compartment610to unlock and open automatically to permit access thereto. In another embodiment, processing device120communicates information indicative of the match to a screen (not shown), which may then present the user with a message such as “success” or other suitable message informing the user that access to assigned storage compartment610has been granted. The process then ends at step925.

After the access process is completed, the user locates the assigned storage compartment610using compartment identifier730. An indicator light (not shown) on or adjacent to door710of compartment610may provide a visual indication to aid the user in locating the assigned storage compartment610. After the user locates and places his/her personal belongings in the assigned storage compartment610, the compartment is secured by closing door710, which automatically engages the associated locking mechanism715within rail625.

Referring now toFIG. 10, there is seen a flow chart detailing a process for using authentication system100to track time worked by employees at a work site. The process begins at step1000and proceeds to step1005, at which an employee at the work site uses touchscreen interface155to identify himself/herself using identifying credentials, such as a user name and password.

The process then proceeds to step1010, at which the employee is directed by touchscreen interface155to place an authentication object125(such as his/her hand, a badge or other object) within ink deposition station110.

After the employee places authentication object125within ink deposition station110, the process proceeds to step1015. At this step, ink deposition station110proceeds to print access credentials130(or use old access credentials130already printed) in accordance with an ink deposition process, such as the one described with respect to the flow chart ofFIG. 4. Data indicative of access credentials130is then stored in database135and associated with the employee. In one embodiment, ink deposition station110employs an invisible ink or dye (such as a UV or IR ink or dye) to better ensure that unauthorized users (such as other employees) cannot discover access credentials130from merely looking at authentication object125.

To clock-in or clock-out of the work site, the employee interfaces with credentials reader115at step1020. At this step, the employee places authentication object125(with access credentials130printed thereon) against credentials reader115. At step1025, credentials reader115detects and reads access credentials130from authentication object125and transmits data indicative of access credentials130to processing device120of kiosk145.

The process then proceeds to step1030, at which processing device120queries database135to determine whether access credentials130scanned by credentials reader115were previously associated with the employee (see, for example, steps420and425of the process flow chart ofFIG. 4). If not, processing device120does not record a clock-in or clock-out time or perform any other function and the process ends at step1035. On the other hand, if access credentials130were associated with the employee, the process proceeds to step1040, at which processing device120notes the clock-in or clock-out time and associates it with the employee in database135. The clock-in and clock-out times may then be used by an employer to track work time of the employee.

Using authentication system100to track time worked by employees may be particularly beneficial, as it prevents employees from clocking in and out for other employees. Security may be enhanced even further by requiring that access credentials be printed on a body part of the employee, such as a specific hand or wrist (e.g., only a right or left hand). With respect to this embodiment, authentication system100may be configured to detect multiple access credentials130and flag an error in the event another person working at the worksite (which person's hand already includes his/her own access credentials130) attempts to clock-in or clock-out for another employee. Security and accuracy may be further enhanced by using access credentials130that are indecipherable or otherwise unreadable by the user, for example, by using invisible ink to print encrypted access credentials on the employee's hand or wrist. Security may be enhanced even further by requiring different access credentials each working day, thereby eliminating the ability of the employee to provide credentials130to another individual for recording erroneous working hours on a subsequent working day.

In other embodiments, system100tracks objects through a system in a manner similar to tracking check-in and check-out times of employees at a work site. With respect to these embodiments, ink deposition station110prints different access credentials130on different objects to track, such as rentable computers, shopping carts, strollers, etc. Scanning the objects at various different locations (each with an associated credentials reader115) allows authentication system100to track the different objects, for example, by noting the time and locations of the objects as they are scanned. System100may also correlate the different objects to various authorized users. For example, requiring an authorized user to “check-out” a particular object by scanning a badge or other identifying indicia allows system100to determine the identity of the authorized user and associate it with the object being tracked. The authorized user may then “check-in” the object at a later time by scanning his/her badge before returning the object. Using authentication system100in this manner better ensures accountability for the return of various objects rented or otherwise acquired by users on a temporary basis.

While the present invention has been illustrated by description of various embodiments and while those embodiments have been described in considerable detail, it is not the intention of applicant to restrict or in any way limit the scope of the invention to such details. Additional advantages and modifications will readily appear to those skilled in the art. The invention in its broader aspects is therefore not limited to the specific details and illustrative examples shown and described. Accordingly, departures may be made from such details without departing from the spirit or scope of the invention.