Near field communication based key sharing techniques

A computer-implemented technique includes storing keychains in a memory of a computer. A login identifier and a password are received from a mobile device. The login identifier and the password are verified. Subsequent to the verification, one of the keychains is downloaded from the computer to the mobile device. The keychain includes N keys that are each associated with one of M physical locks of M locking devices, where N and M are integers greater than or equal to 1. The M locking devices or another locking device are monitored. Information in a key log is recorded when each of the N keys is used on one of the M locking devices or the other locking device. The information includes a locking device identifier and a key identifier. The mobile device is alerted when each of the N keys is used based on the key log.

FIELD

The present disclosure relates to physical lock entry techniques using wireless communication.

BACKGROUND

Physical keys are typically used to unlock or open doors or locks on various items. There are different types of physical keys. A traditional turn style key is typically formed of a metallic material and includes teeth. The key is inserted into a lock and turned to unlock the lock. An example of another physical key is an access card. The access card may be magnetic or programmable and have a unique electronic signature. The electronic signature is read when the card is slid through an electronic reader of a locking device attached to a lock. The electronic reader reads the unique electronic signature and unlocks the lock via the locking device. An advantage of a magnetic or programmable access card is that the electronic reader can be reprogrammed to accept a different unique electronic signature when the access card is lost or stolen.

The physical keys are often carried on a keychain, in a wallet or carry bag, copied to create additional physical keys, and/or physically shared. The physical keys may be easily lost because the keys are often small in size.

When a turn style key is lost, an owner of a lock associated with the key has basically two options. The owner may have the lock replaced or rekeyed or may leave the lock unchanged in hopes that an unauthorized user does not obtain and/or use the lost key to unlock the lock and gain access to a restricted area. Although the key is lost, the key may be used to unlock the lock when found unless the lock is changed or rekeyed. Also, other copies of the key may be used to unlock the lock. Thus, the lost key may not be cancelled (i.e. remains valid) when lost. When a previously used lock is replaced with a new lock and/or rekeyed, the keys that were used to unlock the previously used lock are now invalid (i.e. the previously used keys cannot be used to unlock the new lock or rekeyed lock). For this reason, the previously used lock and/or keys may be disposed.

Once a physical key is provided from an owner to a receiving party, the physical key remains valid and is able to unlock a lock until the lock is changed or rekeyed, or reprogrammed in the case of an access card-based locking device. If the owner wants to prevent the receiving party from unlocking the lock, the owner typically needs to request that the key be returned to the receiving party, change the lock, rekey the lock, and/or reprogram the locking device. An additional access card must be purchased and programmed when the locking device is reprogrammed.

Physical keys can be difficult to carry and to share. Also, once a key is physically shared with another party, the owner has limited ability to prevent copying of the key. For this reason, an owner may not be aware of all of the parties that have a copy of the key.

SUMMARY

A computer-implemented technique is provided and includes storing keychains in a memory of one of a computer and a server. Each of the keychains is associated with one of first mobile devices and includes keys. Each of the keys unlocks one or more physical locks. A login identifier and a password are received from a first mobile device via a control module of the one of the computer and the server. The login identifier and the password are verified via the control module. Subsequent to the control module approving the login identifier and the password, one of the keychains is downloaded from the one of the computer and the server to the first mobile device. The one of the keychains includes N keys, where N is an integer greater than or equal to 1. Each of the N keys is associated with one or more of M physical locks of M locking devices, where M is an integer greater than or equal to 1.

A key sharing request is received from the first mobile device. Keys of the one of the keychains are shared with second mobile devices based on a rank of the first mobile device and the key sharing request. The M locking devices or another locking device not included in the M locking devices are monitored via a log update module. Information is recorded in a key log via a log update module when each of the N keys is used on one of the M locking devices or the other locking device by one of the first mobile devices and the second mobile devices. The information includes a mobile device identifier, a locking device identifier and a key identifier. The first mobile device is alerted when each of the N keys is used via an alert module based on the key log including reporting to the first mobile device the mobile device identifier, the locking device identifier and the key identifier.

In other features, a computer-implemented technique is provided and includes remotely logging into one of a computer and a server via a control module of a first mobile device. The logging into the one of the computer and the server includes entering a unique identifier and a password. Subsequent to the computer or the server approving the password based on the unique identifier, a keychain from one of the computer and the server is downloaded to a memory of the first mobile device. The keychain comprises N keys, where N is an integer greater than 1. Each of the N keys unlocks one or more of M physical locks, wherein M is an integer greater than or equal to 1. One of the N keys is transferred from the first mobile device to a locking device using near field communication to unlock one of the M physical locks.

In other features, a computer-implemented technique is provided and includes storing keychains in a memory of one of a computer and a server. Each of the keychains includes keys. Each of the keys unlocks one or more physical locks. A login identifier and a password are received from a first mobile device via a control module of the one of the computer and the server. The login identifier and the password are verified via the control module. Subsequent to the control module approving the login identifier and the password, one of the keychains is downloaded from the one of the computer and the server to the first mobile device. The one of the keychains includes N keys, where N is an integer greater than or equal to 1. Each of the N keys is associated with one or more of M physical locks of M locking devices, where M is an integer greater than or equal to 1. The M locking devices or another locking device not included in the M locking devices are monitored via a log update module. Information in a key log is recorded via a log update module when each of the N keys is used on one of the M locking devices or the other locking device. The information includes a locking device identifier and a key identifier. The first mobile device is alerted when each of the N keys is used via an alert module based on the key log including reporting to the first mobile device the locking device identifier and the key identifier.

In other features, a computer-implemented technique is provided and includes receiving a unique identifier and a first key from a first mobile device via a lock control module of the locking device near field communication. The first key is one of multiple keys in a keychain stored in the first mobile device. The technique further includes determining whether the first key is a trusted key or a restricted key via a lock control module. A physical lock is unlocked when the first key is a trusted key via the lock control module. Verification information is requested from the first mobile device when the first key is a restricted key via a key verification module. The first key and the verification information are verified via the key verification module. The physical lock is unlocked when the first key and the verification information are valid via the lock control module.

DESCRIPTION

InFIG. 1, a key sharing network10is shown. The key sharing network10may include mobile devices12, communication networks14, a service provider network16, locking devices18, and a central facility20. The mobile devices12may be mobile phones, computers, electronic notepads, tablet computers, personal data assistants and/or other mobile devices. The mobile devices12may each have a keychain22with associated keys, which may be shared and used to unlock respective locks of the locking devices18.

The keys are not physical keys, but rather are, for example, digital unique strings of bits and/or characters. The keys may be encrypted and may include a unique identifier, hash, certificate, alpha-numeric string, string of bits, string of characters and/or other unique credentials. The keychains22are not physical keychains, but rather are sets of keys generated for one or more of the mobile devices12and/or one or more central computer(s) (one central computer24is shown) of the central facility20. The keychains22may be tracked by the service provider network16and/or central computer24. The central computer24may be owned by the same owner of one or more of the locking devices18.

The mobile devices12may include a first (or primary) mobile device30of one or more of the locking devices18and any number of other (or secondary) mobile devices32. The primary mobile device30may be an owner device of an owner of one or more of the locking devices18. The secondary mobile devices32may be, for example, mobile devices of family, friends, associates, clients, customers, and/or employees of the owner of the first mobile device30. The mobile devices12may be, for example, mobile phones of customers of a hotel and/or a car rental company and used to access a hotel room or unlock a rental vehicle. The other mobile devices32may also include a mobile device of, for example, a bystander or someone unrelated or affiliated with the owner.

The mobile devices12may each include a mobile control module34and memory36. The memories36store the respective keychains22. Each of the mobile control modules34may request a keychain or keys from the service provider network16and/or the central computer24. The mobile control modules34may communicate with the service provider network16and the central facility20via the communication networks14. The communication networks14may include an Internet, base stations, satellites, gateways, computers, network stations and/or servers.

The service provider network16provides services to the mobile devices12, the locking devices18, and/or the central computer24. The services may include key sharing services, key tracking services, mobile device verification services, and/or other services disclosed herein. The service provider network16may include a server40with a server control module42and a memory44. The keychains22may be stored in the memory44and accessed by and/or provided to the mobile devices12based on criteria disclosed herein. The server control module42may control access to, update, and/or assign the keychains22. The server control module42may also control access to, monitor, update, revoke, assign, limit, and/or track usage of each of the keys.

Each of the locking devices18may include a lock control module46and one or more physical locks48. The lock control modules46may unlock the physical locks48based on keys received from the mobile devices12. The physical locks48may include door locks, padlocks, desk, cabinet, chest locks, or other locks. The physical locks48may include ignition switches, vehicle starting switches, electronic control switches, or other locking or switching device that requires a key. The physical locks48may be located on or in, for example, homes, vehicles, businesses, facilities, hotel rooms, desks, bike chains, trailers, storage containers, or other lockable items. The vehicles may include automobiles, motorcycles, boats, battery powered vehicles, or other vehicles having one or more locks, locking devices or keyed devices. Keyed devices may include locks, ignition switches, vehicle activation switches, electronic start switches, or other switching devices requiring a key. The terms “lock” and “keyed device” are used interchangeably herein. A lock may refer to a keyed device and a keyed device may refer to a lock.

In use, the mobile devices12are placed within a near field communication (NFC) distance (e.g., less than 0.2 meters(m)) of, brought in contact with, or tapped on the locking devices18in order to transfer the keys to the locking devices18. NFC includes wirelessly communicating over short-ranges at, for example, 13.56 MHz with data rates of 106-848 kbit/s. Of course, other frequencies and/or data rates may be used. In one implementation, the NFC distance is less than 4 centimeters (cm).

The central facility20may be, for example, a residential home or a commercial or institutional building. The central facility20may include the central computer24(or server). The central computer24may: communicate with the mobile devices12or the service provider network16; be used to manage, monitor, assign, track, update, revoke, share, verify, and audit the keys; modify criteria and/or key update information disclosed herein; and update other verification information disclosed herein. The criteria, the update information and the verification information are described in further detail below. The central computer24may include a computer control module50and memory52. The memory52may store the keychains22.

The central computer24may perform tasks performed by one of the mobile devices12(e.g., a master mobile device) and/or the server40and provide the keychains22to the mobile devices12. A master mobile device may refer to one of the mobile devices12with a rank (or trust level) of 1 and/or be owned by an owner of one or more locking devices18.

The key sharing network10may not include the service provider network16and/or the central facility20. When the key sharing network10includes both the service provider network16and the central facility20, key chain managing, monitoring, assigning, tracking, updating, revoking, sharing, verifying, and other related tasks may be performed by and/or shared between the service provider network16and the central facility20.

The first mobile device30, one of the other mobile devices32with sharing privileges, the central computer24, and/or the server40may selectively share one or more keys of one of the keychains22with any one of the other mobile devices12. The sharing privileges may be assigned by the first mobile device30, the central computer24, and/or the server40. The owner of the lock for which a key is being shared may determine and assign the sharing privilege via the first mobile device30, one of the other mobile devices32, and/or the central computer24. The sharing privileges may be different for different mobile devices. The sharing privileges may be assigned based on a rank of the mobile device sharing the key and/or the rank of the mobile device receiving the key.

As an example, a rank of 1 may be assigned to a master mobile device. The master mobile device may receive the key and have unlimited use of the key. A rank of 2 may be assigned to a mobile device of a friend, family member, associate, or employee of the owner of the lock. The mobile devices with a rank of 2 may receive the key and have limiting sharing rights. A rank of 3 may be assigned to a mobile device of a client or customer of the owner of the lock. The mobile devices with a rank of 3 may receive the key, have restricted use of the key, and may not share the key. A rank of 4 may be assigned to a mobile device of a bystander or person not affiliated with the owner of the lock. The mobile devices with a rank of 4 may receive the key and have, for example, one-time use of the key and may not share the key.

Referring now also toFIG. 2, one of the mobile devices12is shown. The mobile device12may be a mobile device of an owner of one or more locking devices18. As an alternative, the mobile device12may be a mobile device that has received one or more keys shared by a mobile device or a central computer of the owner of the one or more locking devices18. The mobile device12includes a mobile network60with the mobile control module34and the memory36. The mobile control module34may include the memory36or the memory36may be separate from the mobile control module34, as shown. Each of the mobile devices of the key sharing network10may include the modules and the memory shown inFIG. 2.

The mobile control module34includes a mobile transceiver62, a lock access module64, a key information module66, and a log auditing module68. The mobile control module34may directly communicate with the locking devices using NFC via the mobile transceiver62. The mobile control module34communicates with the service provider network16and/or the central computer24via the mobile transceiver62over one or more of the communication networks14via the mobile transceiver62.

The lock control modules46associated with the locking devices18may include modules within and/or external to the locking devices18. As an example, a vehicle70is shown that includes vehicle network72with a locking device74and a vehicle control module76. The locking device74includes a locking device transceiver78and a lock control module79, which actuates a physical lock80. The lock control module79communicates with the mobile control module34via the locking device transceiver78, which may be included in the lock control module79. The vehicle control module76controls operations of the vehicle70and is in communication with the locking device74and/or the mobile device12. The vehicle control module76may be a powertrain control module, an interior control module or other vehicle control module. The vehicle control module76may communicate with the mobile control module34via a vehicle transceiver82.

The NFC communication between the mobile control module34and the locking devices18may be used initially to unlock the locks and to initiate wireless connections of other wireless communication protocols, such as a Bluetooth connection or a Wi-Fi connection. The mobile control module34may communicate with the locking devices18and/or control modules (e.g., the control modules associated with the locking devices using the other wireless communication protocols.

The Bluetooth connection may be used, for example, to sink personal information from the mobile device to the vehicle network, such as seat settings, temperature settings, radio settings (e.g., radio station and volume settings), powertrain or suspension settings (e.g., an economy or sport setting), or other vehicle settings. These setting may be stored in the memory36as vehicle settings. The vehicle control module76may than adjust settings to match the vehicle settings received from the mobile device after the mobile device is used to unlock a lock on a door and/or switch ON an ignition or starter switch of the vehicle70.

As another example, a facility90is shown that includes a facility network92with a locking device94and a facility control module96. The locking device94includes a locking device transceiver98, a lock control module100, which actuates a physical lock102. The lock control module100communicates with the mobile control module34via the locking device transceiver98, which may be included in the lock control module100. The facility control module96controls operations of electrical networks in the facility90and is in communication with the locking device94and/or the mobile device12. The facility control module96may communicate with the mobile control module34via a facility transceiver104.

A Wi-Fi connection with the facility control module96may be established when the mobile device12is used to unlock a door of the facility. The Wi-Fi connection may be used, for example, to sink personal information from the mobile device to a facility network (e.g., a home, commercial, or institutional network). The personal information may include, for example, temperature settings, television or stereo settings, light settings or other facility settings. The facility control module96may then adjust settings to match the settings received from the mobile device12.

The lock access module64communicates with the locking devices18via the mobile transceiver62. The mobile control module34, the memory36and the mobile transceiver62may be implemented as part of a single integrated circuit (IC) or may each be ICs and incorporated in single system-in-a-package (SIP). As an example, the mobile transceiver62or a portion of the mobile transceiver62may be separate from the mobile control module34and include a NFC chip for communicating with the locking devices18within a NFC distance.

The lock access module64may access keys118of one or more keychains120stored in the memory36. The lock access module64may then provide one or more of the keys118to a locking device to unlock a lock of the locking device and obtain access to a restricted area. The keys118stored in the memory36may be encrypted or decrypted via an encryption and decryption module122prior to being provided to the locking device.

The key information module66may be used when the locking device is requesting additional verification information124in addition to the key(s), such as, for example, a password, a passcode, a pin (e.g., string of characters or bits), or other personal, account and/or credential information. The additional verification information124may be stored in the memory36and used to verify whether the mobile device12is authorized to access a restricted area associated with a lock. As an alternative, the key information module66may contact the server40to obtain the additional verification information124. The server40may verify the mobile device12and then provide the additional verification information124to the key information module66.

When verifying the mobile device12, the server40may request information from the mobile device12, such as a unique identifier of the mobile device12, a username and/or password of a user of the mobile device12, an account identifier, and/or other personal information. Once the requested information is approved by the server40, the server40transmits the additional verification information124to the mobile device12. The key information module66may forward the additional verification information124from the server40to the locking device to obtain access to the restricted area. The locking device may request the additional verification information124to verify that a key provided by the mobile device12has not been revoked.

The log auditing module68may be used to monitor: which of the mobile devices of the key sharing network10are using the keys118of the mobile device12; which of the keys118each of the mobile devices are using; when each of the keys118are used, how often each of the keys118are used; and whether access to the restricted areas associated with each of the keys118was provided when the keys118were used. A key log130of this information may be stored in the memory36and/or stored in the server40and/or the central computer24. The server40and/or the central computer24may wirelessly communicate with and monitor the locks associated with the keys118and maintain the key log130. The key log130may be associated with an account of the owner of the mobile device12and/or of one or more locking devices of the owner. The key log130or a portion thereof may be transmitted from the server40and/or the central computer24to the mobile device12and displayed to a user on the mobile device. The key log130may be displayed via a display132, such as a touch screen, on the mobile device12.

The mobile control module34may further include a key sniffer module134. The key sniffer module134may use NFC to read a card (or physical key), memory device, and/or other device storing a key. The key sniffer module134may copy and/or store the key in the memory36as one of the keys118and use the key to unlock a locking device associated with the key. This allows a user to discard, for example, a card having the key and use the mobile device12to access a restricted area associated with the locking device.

The memory36stores verification information135including the keychain(s)120with respective sets of keys118. The keychains120and/or the keys118may not be directly accessible to a user of the mobile device12. In other words, a user of the mobile device12may be able to use the keys118via the mobile device12to unlock locks, but the keys118may not be displayed for the user to see on the mobile device12. If the keys are not displayed on the display132, the user is unable to directly see and copy the keys118. As an alternative, the keys118may be displayed (e.g., on a master mobile device) to allow the owner of the mobile device12to directly see and copy and/or provide the key to another user. The mobile device12may be instructed by the user to copy and/or share the keys118with other mobile devices. The keys118may be copied and shared without displaying the keys118to the user.

The memory36also stores user preferences140. The user preferences140may include the vehicle settings142, the facility settings144, authorization criteria146, log information148, alert criteria150and key update information152. The authorization criteria146may be provided by the mobile device12to the server40and/or to one of the locking devices18. Alternatively, the server40may provide the authorization criteria146to one or more of the locking devices18. The authorization criteria146indicate verification information requirements to unlock a lock. The authorization criteria146and may include determining whether the mobile device12or other mobile devices of the key sharing network10provide the correct keys and/or additional verification information.

The authorization criteria146may be based on the rank of the mobile device12. An example of some ranks is disclosed above. When the rank of the mobile device12is 1, a locking device may, for example, trust the mobile device12, unlock a lock and provide access without requesting additional verification information from the mobile device12. When the rank is equal to 2, 3, or 4 or is not equal to 1, the locking device may request additional verification information from the mobile device12prior to unlocking the lock. Examples of some additional verification information are disclosed above.

The mobile control module34and/or log auditing module68may determine log information for the server40and/or central computer24to track and report. The mobile control module34and/or log auditing module68may transmit the log information to the server40and/or central computer24via the mobile transceiver62. The log information indicates what information to track and store in the key log130. The log information may include: key identifiers, when a key is used, identification of a mobile device that used a key; how many times a key was used in a predetermined period; how many times a mobile device used a key within a predetermined period; identification of mobile devices that used an outdated or incorrect key, and/or other user and/or service provider defined log information.

The mobile device12may determine and store the alert criteria150in the memory36. The alert criteria150may indicate when the server40and/or the central computer24are to alert the mobile device12of tracked log information. The mobile device12may set the alert criteria150based on user inputs and transmit the alert criteria150to the server40and/or the central computer24.

The alert criteria150may include: sending an alert each time a key is used; when a key is used by a mobile device with a rank greater than a predetermined rank; when an outdated key is used; when a key is used that was not previously assigned to a mobile device using the key, the server40and/or the central computer24; when a key is used for an incorrect locking device; and/or other user and/or service provider defined criteria.

The mobile control module34and/or key information module66may provide the key update information152to the server40and/or the central computer24. The key update information152may include: how often to update each of the keys118; which ones of the keys118to update and not to update; whether to update each of the keys118stored in respective locking devices and/or in mobile devices of the key sharing network10; and/or other user and/or service provider defined key update information.

Referring now also toFIG. 3, the service provider network16is shown. The service provider network16may be a cloud computing network and includes the server40. The server40may include a server control module42, which may include a server transceiver160, an information verification module162, a log update module164, an alert module166, a key update module168, and/or the memory44. The memory44may be separate from the server control module42, as shown. The server40communicates with the mobile devices12, the locking devices18, and the central computer24via the server transceiver160. Although the service provider network16is shown as including a single transceiver and a single server, the server provider network16may include any number of transceivers and servers providing the services disclosed herein.

The server control module42may control the transfer of keys, other verification information, and/or user preferences between the server40and the mobile devices12, between the server40and the locking devices18, and between the server40and the central computer24. The other verification information and user preferences may include the additional (or other) verification information124and user preferences140disclosed above.

The information verification module162may be used to determine whether additional verification information, such as keys, passwords, usernames, passcodes, pins and/or other verification information provided by a mobile device to a locking device is correct. For example, one of the locking devices18may request an update with regard to verification information for a particular mobile device, which has provided a key or unique identifier to the locking device. The information verification module162may provide the requested information and/or instruct the locking device to request additional verification information from the mobile device. The locking device may then transfer the additional verification information from the mobile device to the server40. The server40may verify the additional verification information received based on the authorization criteria146and respond back to the locking device indicating whether the mobile device is authorized to unlock a lock of the locking device.

The information verification module162may generate and/or provide the authorization criteria146to selected ones of the mobile devices12, the locking devices18, and/or the central computer24. By providing the authorization criteria146to selected mobile devices, the selected mobile devices may provide the verification information along with the key or unique identifier when initially communicating with a locking device. By providing the authorization criteria146to the locking devices18, the locking devices18may verify information received from a mobile device without contacting the server40. By providing the authorization information to the central computer24, the central computer24may be contacted by the locking devices18to verify information transmitted from the mobile devices12to the locking devices18.

In use, the information verification module162may receive a key from a locking device (e.g., one of the locking devices18) and a mobile device identifier and compare the key to keys in a keychain of the mobile device associated with the mobile device identifier. The information verification module162transmits via the server transceiver160a verification response signal to the locking device based on the comparison. In a similar manner the information verification module162may receive other verification information from the locking device, compare the information to corresponding information stored in the memory44and send a verification response signal back to the locking device.

The log update module164updates log entries in key log(s)170based on the log information148stored in the memory44. Examples of log information and/or corresponding log entries are disclosed above. The log update module164may update the key log170based on log information received from the mobile devices12and/or from the central computer24. The log update module164may monitor one or more of the locking devices18. The locking devices18may transmit log information to the server40when a key is used to allow the log update module164to track the log information. The log update module164may periodically request log information from the locking devices18regardless of whether a key has been used.

Not all of the information stored in a key log170for one of the mobile devices12and/or the central computer24may be sent to the mobile device. A subset of the log information tracked and stored in the key log170may be transmitted to the mobile device and/or the central computer24. For example, the mobile device and/or the central computer24may request a subset of the log information tracked. As another example, certain log entries may be monitored by the central computer24and not by the mobile devices12and vice versa.

The alert module166may generate an alert (or notification) signal based on the alert criteria150disclosed above. The alert signal may be transmitted to one or more of the mobile devices12and the central computer24at which an owner of one or more of the locking devices18is logged into. The alert module166may receive a key usage signal from one of the locking devices18when a key and/or unique identifier is received at the locking device. The key usage signal may include: the key; a unique identifier of the mobile device that used the key; a unique identifier of the locking device; whether the locking device provided access when the key was received at the locking device; or other key, mobile device and/or locking device related information.

The alert module166generates the alert signal when the key usage signal, information in the key usage signal, and/or information updated based on the key usage signal satisfy the alert criteria150. The alert signal may: be from a short message service (SMS); include text; an email message; a video and/or audio message; or other suitable message, which may be conveyed to a user at a mobile device and/or the central computer24.

The key update module168periodically or after each predetermined period updates the keys in the keychains based on the key update information152. When updating a key, the key update module168may modify the key or replace the key with a different key. The key update module168may transmit the key update information152to a locking device or one or more of the mobile devices12. The key update module168may provide the updated keys to a mobile device when the mobile device is powered up, requesting a keychain, and/or at another suitable time.

The memory44stores client accounts180and corresponding verification information182, the corresponding key log(s)170, and user preferences. The verification information182includes a key bank (i.e. portion of the memory44)184with one or more keychain(s)186and other verification information188, such as passwords, usernames, passcodes, pins, or other personal or credential information. Each of the keychains includes respective keys187. The key log(s)170include the log entries for the corresponding log information148. The server control module42may manage each of the client accounts180and corresponding verification information, key log(s) and user preferences. This may include: setting up the client accounts; verifying client information when a client via one of the mobile devices12and/or the central computer24accesses a client account; and controlling the updating, modifying, and distributing of keys and/or information associated with each of the client accounts180.

The keychains186stored in the memory44may be owner and/or user specific and/or mobile device specific. In other words, each of the keychains186may be assigned to (i) a single owner or user of the locks associated with the keys in the keychain or (ii) a single mobile device. An owner and/or user may have multiple mobile devices. Each of the mobile devices of the owner and/or user may have a different keychain. The keychains may have one or more of the same keys and one or more different keys. An owner and/or user may have a key sharing (or client) account at the service provider network16and/or server40. The key sharing account may have one or more keychains. Each keychain may be assigned to one or more mobile devices of the owner and/or user. The keychains may be associated with an identifier of a networking account, such as a social or information sharing network account and may be shared using the networking account. The owner and/or user may log into the key sharing account and/or the networking account from any one of the mobile devices12and/or the central computer24and obtain access to their keychains, key log, and/or the other account information disclosed herein, which is stored at the server40.

The server control module42may also include an encryptor and/or decryptor198for encrypting and/or decrypting keys and other verification information transmitted between (i) the server control module42and the mobile devices12, (ii) the server control module42and the central computer24, and/or (iii) the server control module42and the locking devices18.

Referring now also toFIG. 4, one of the locking devices18is shown. The locking device18includes a lock control module200, a physical lock202and a memory204. The lock control module200may include the memory204or the memory204may be separate from the lock control module200, as shown. The other locking devices of the key sharing network10may include modules, a physical lock (or physical keyed device) and a memory similar to the modules, physical lock and memory of the locking device18.

The lock control module200may include a lock transceiver206, a lock actuation module208, an information verification module210, and a log update module212. The lock control module200communicates with the mobile devices12, the server40and/or the central computer24via the lock transceiver206. The locking device18may communicate with the mobile devices12using NFC. The locking device18may use a wireless communication protocol, such as Wi-Fi, and/or a cellular network to communicate with the server40and/or the central computer24.

The lock actuation module208controls actuation of the physical lock202including locking and unlocking the lock202and/or changing the state of the lock202(e.g., when the lock202is a switch). The lock actuation module208may include electrical and mechanical components to unlock the lock202. The lock control module200controls actuation of the lock202based on the key(s) and/or other verification information209received from a mobile device. Examples of other verification information are disclosed above. The lock control module200maintains the lock202in a locked (or first) state or transitions the lock202to an unlocked (or second) state based on the key(s) and/or the other verification information209.

When the rank of a mobile device accessing the locking device18is 1, the lock control module200may, for example, trust the mobile device and provide access without requesting additional information. When the rank of the mobile device is equal to 2, 3, or 4 or is not equal to 1, the lock control module200may request additional information from the mobile device attempting to unlock the lock202.

The information verification module210may be used to verify whether a key received from one of the mobile device(s) is up to date and/or valid. The information verification module210may also verify keys received from the mobile devices with trusted keys214and/or restricted access keys216stored in the memory204of the locking device18and/or request verification of the keys by the server40. When the key is a restricted access key, the information verification module210may request additional information from a mobile device that transmitted the key. The information verification module210may forward a key received from a mobile device to the server40. This may be performed when the key is a trusted or restricted access key. The server40may check whether the key is updated and/or valid and respond back to the locking device18accordingly. The lock actuation module208may unlock the lock when the key is verified as being updated and valid.

The locking device18upon receiving a key and/or a unique identifier from the mobile device may request additional verification information from the mobile device and verify the additional verification information against information stored in the memory204of the locking device18and/or verify the additional verification information with the server40.

The log update module212may transmit log information to the server40and/or the central computer24when a key is used to allow the log update module212of the server40to track the log information. The log update module212may transfer the log information periodically, every predetermined period, and/or when requested from the server40and/or the central computer24.

The memory204may store the authorization criteria146and/or verification information218. The verification information218may include the trusted keys214, the restricted access keys216, and/or the other verification information209disclosed herein. The lock actuation module208and/or the information verification module210may compare key(s) received from one of the mobile devices12with the keys214,216. When there is a match, the lock actuation module208may unlock the lock202.

The lock control module200may also include a decryptor219for decrypting keys and other verification information transmitted between (i) the lock control module200and the mobile devices12, (ii) the lock control module200and the central computer24, and/or (iii) the server control module42and the locking devices18.

Referring now toFIG. 5, the central computer24is shown. The central computer24includes the computer control module50and memory52. The computer control module50may include the memory52or the memory52may be separate from the computer control module50, as shown. The computer control module50may include a computer transceiver230, an information verification module232, a log update module234, an alert module236, a key update module238, and/or the memory52. The computer control module50communicates with the mobile devices12, the locking devices18, and/or the server40via the computer transceiver230. Other central computer(s) of the central facility20may include similar modules and memory as the central computer24.

The computer control module50may perform some of the tasks performed by the mobile control modules34of the mobile devices12and/or may perform the tasks performed by the server40. As an example, the computer control module50may provide the user preferences140including the settings142,144, authorization criteria146, log information148, alert criteria150, and/or key update information152to the server40. The user preferences140may be based on user inputs received at the central facility20and/or received from the mobile devices12. The computer control module50may control the transfer of keys240and other verification information242between the central facility20and the mobile devices12, between the central facility20and the locking devices18, and between the central facility20and the server40.

The information verification module232may be used to determine whether verification information provided by a mobile device to a locking device is correct. For example, one of the locking devices18may request an update with regard to verification information for a particular mobile device, which has provided a key or unique identifier to the locking device. The information verification module232may provide the requested information and/or instruct the locking device to request additional verification information from the mobile device. The locking device may then transfer the additional verification information from the mobile device to the computer control module50. The computer control module50may verify the additional verification information received based on the authorization criteria146and respond back to the locking device indicating whether the mobile device is authorized to unlock a lock of the locking device.

The information verification module232may generate and/or provide the authorization criteria146to selected ones of the mobile devices12, the locking devices18, and/or the server40. By providing the authorization information to the server40, the server40may be contacted by the locking devices18to verify information transmitted from the mobile devices12to the locking devices18.

In use, the information verification module232may receive a key from a locking device and a mobile device identifier and compare the key to keys in a keychain of the mobile device. The information verification module232transmits via the computer transceiver230a verification response signal to the locking device based on the comparison. In a similar manner, the information verification module232may receive the other verification information242from the locking device, compare the information to corresponding information stored in the memory52and send a verification response signal back to the locking device.

The log update module234updates log entries in key log(s)250. Examples of log entries associated with log information are disclosed above. The log update module234may update the key logs250based on log information received from the mobile devices12and/or from the server40. The log update module234may monitor one or more of the locking devices18. The locking devices18may transmit log information to the computer control module50when a key is used to allow the log update module234to track the log information148. The log update module234may periodically request log information from the locking devices18regardless of whether a key has been used.

Not all of the information stored in the key logs250for one of the mobile devices12and/or the memory52may be sent to the mobile device. A subset of the log information tracked and stored in the key logs250may be transmitted to the mobile devices12and/or the server40. For example, the mobile devices12and/or server40may request a subset of the log information tracked. As another example, certain log entries may be monitored by the computer control module50and not by one of the mobile devices12and vice versa.

The alert module236may generate an alert (or notification) signal based on the alert criteria150disclosed above. The alert signal may be transmitted to one or more of the mobile devices12. The alert module236may receive a key usage signal from one of the locking devices18when a key and/or unique identifier is received at the locking device. The key usage signal may include: the key; a unique identifier of the mobile device that used the key; a unique identifier of the locking device; whether the locking device provided access when the key was received at the locking device; or other key, mobile device and/or locking device related information.

The alert module236generates the alert signal when the key usage signal, information in the key usage signal, and/or information updated based on the key usage signal satisfy the alert criteria150. The alert signal may include text, an email message, a video and/or audio message, or other suitable message, which may be conveyed to a user at the mobile device.

The key update module238is used to periodically or each predetermined period update the keys240in keychains252based on the key update information152. When updating a key, the key update module238may modify the key or replace the key with a different key. The key update module238may transmit the updated information to a locking device or one or more of the mobile devices12. The key update module238may provide the updated keys to a mobile device when the mobile device is powered up, requesting a keychain, and/or at another suitable time.

The memory52stores user data sets254and corresponding verification information256, the corresponding key log(s)250, and the user preferences140. The verification information256includes a key bank258(i.e. portion of the memory) with one or more of the keychain(s)252and the other verification information242, such as passwords, usernames, passcodes, pins, or other personal or credential information. The key log(s)250include the log information148. The computer control module50may manage each of the user data sets254and corresponding verification information, key log(s) and user preferences. This may include: setting up the user data sets; verifying user information when a user via one of the mobile devices12and/or the central computer24accesses a user data set; and controlling the updating, modifying, and distributing of keys and/or information associated with each of the user data sets.

The computer control module50may also include an encryptor and/or decryptor260for encrypting and/or decrypting keys and other verification information transmitted between (i) the computer control module50and the mobile devices12, (ii) the computer control module50and the central computer24, and/or (iii) the computer control module50and the locking devices18.

Additional Limited Access Techniques

A master mobile device (e.g., one of the mobile devices12) and/or the central computer24may limit access to certain ones of the other mobile devices12for a limited access period. For example, the master mobile device or the central computer24may request that the server40provides a second mobile device with a key to unlock a lock of a locking device. As an alternative, the master mobile device or the central computer24may directly transmit a key for the locking device from the master mobile device to the second mobile device.

The master mobile device and/or the central computer24may limit the number of times, the number of times within a predetermined period, and/or the dates and/or times that the second mobile device may unlock the lock. The key provided to the second mobile device may be valid for the limited access period. As a lock of a locking device may have multiple keys and/or be modified, a master key may remain valid when a key provided to the second mobile device is no longer valid. The master mobile device may store and/or have access to the master key.

Revoking Access Techniques

A master mobile device and/or the central computer24directly and/or via the server40may revoke access to a restricted area. The master mobile device and/or the central computer24may revoke one or more keys provided to other mobile devices when certain conditions are satisfied. A user of the master mobile device and/or the central computer24may set a date and time that the key is to be revoked and/or may request that the key is immediately revoked. For example, a key may be revoked when a limited access period is up, the key has been used a predetermined number of times, the key is used by an unauthorized mobile device, and/or the key is provided to a locking device that does not have a lock which can be unlocked using the key. The server40may indicate to the locking device that the key received by the locking device is invalid (may be referred to as active revocation). Certain keys of a keychain may be revoked after a predetermined period of time or number of uses (referred to as passive revocation). A key may be pulled from a signal keychain, from a set of keychains, or from every keychain that the key is on.

One-Time Access Techniques

In another implementation, an authorized user (or owner) may obtain access to a restricted area (e.g., interior of vehicle), when the authorized user's mobile device is locked inside of the restricted area. The authorized user may find a person (bystander) with a mobile device that includes a mobile network as disclosed above. The mobile device may contact the server40and/or the central computer24and provide information, such as a password and username provided by the authorized user. The server40and/or central computer24may transmit a key to the mobile device to unlock a lock associated with the restricted area. The key provided may be a one-time key that may be used one time to unlock the lock. Once used the key may be invalid (i.e. can no longer be used to unlock the lock) by the mobile device of the bystander.

Verification information provided by the server40and/or the central computer24to one of the mobile devices may be one-time verification items, such as one-time passwords, one-time pins, and/or one-time passcodes. The one-time verification items may only be used once to access the restricted area. Once one-time verification items may be invalid. The one-time verification items may be different than and/or variations of a master key.

Locking Device Setup Techniques

A locking device may be setup for a key of a mobile device by placing the mobile device within a NFC distance of the locking device and/or distance appropriate for communication between the locking device and the mobile device. The mobile device may instruct the locking device to learn the key of the mobile device. As an alternative, the mobile device may request a key from the locking device to learn the key of the locking device. As yet another alternative, the locking device and/or the mobile device may communicate with the server40or the central computer24to request the key. The key may be initially stored and/or generated by the locking device, the mobile device, the server40or the central computer24. The key may then be shared with the other ones of the locking device, the mobile device, the server40and/or the central computer24.

The networks disclosed herein may each be identified as a system. For example, the key sharing network10, the mobile network60, the vehicle network72and the facility network92may be identified respectively as a key sharing system, a mobile system, a vehicle system and a facility system.

The above-described key sharing network10may be operated using numerous techniques, an example technique (or computer-implemented method) is provided inFIG. 6. InFIG. 6, a key sharing technique is shown. Although the following tasks are primarily described with respect to the implementations ofFIGS. 1-5, the tasks may be easily modified to apply to other implementations of the present disclosure. The tasks may be iteratively performed. The technique may begin at300.

At302, a mobile device (e.g., the mobile device12ofFIG. 2) is unlocked by a user. A mobile control module (e.g., the mobile control module34) may receive an unlock signal and a login ID and/or password from the user via, for example, a display (e.g., the display132). At304, the mobile device may transmit a keychain request signal to the server40and/or the central computer24. At306, the server40and/or the central computer24may transmit a verification request signal to the mobile device in response to the keychain request signal. The verification request signal may request verification information from the mobile device, such as a username, a password, a pin, and/or other personal, account, or device specific information prior to transmitting a keychain, a key and/or other information to the mobile device. The other information may include user preferences (e.g., the user preferences) stored at the server40and/or the central computer24.

At308, the mobile device transmits a verification response signal back to the server40and/or the central computer24in response to the verification request signal. The verification response signal may include information entered by the user and/or stored in the mobile device.

At310, the server40and/or the central computer24may transmit (push) one or more keychain(s) and/or key(s) and/or other information to the mobile device. This may occur: each time the mobile device is activated, logged into, the user logs into an account at the server40and/or into the central computer24, and/or when the mobile device is new and used for a first time.

At310, the server40and/or the central computer24may permit key sharing by the mobile device. The mobile device may directly share keys and/or keychains received from the server40and/or the central computer24directly with other mobile devices. The mobile device may share the keys and/or keychains indirectly with other mobile devices by sending a key sharing request to the server40and/or central computer24. The key sharing request may identify, for example, keys and/or keychains selected by the mobile device and IDs of other mobile devices to which the keys and/or keychains are to be shared. The keys and/or keychains may be shared based on a rank of the mobile device sharing the keys and/or keychains. The key sharing request may also indicate key sharing privileges and/or rank of the selected mobile devices. Key sharing may be performed prior to task210and using any mobile device and/or computer at which the owner of the locking devices and/or an authorized user with appropriate key sharing privileges is logged into.

The mobile device may be locked, deactivated (powered down), unlocked and/or reactivated (powered up) subsequent to task310and prior to tasks312and314. Also, the mobile device may be placed within a NFC distance of the locking device prior to performing tasks312and314. The mobile device may tap or be placed within a NFC distance of a locking device (e.g., the locking device18ofFIG. 4) to transfer a mobile device identifier and/or a key to the locking device.

At312, the mobile control module may receive a user input requesting that a physical lock be unlocked and/or attempt to detect the locking device in response to being tapped on the locking device. The user request may include an ID of the lock and/or locking device. When the mobile device is tapped on the locking device or placed within the NFC distance of the locking device, task314may be performed instead of task312.

At314, the mobile control module when in the NFC distance may detect the lock and/or locking device and determine an appropriate key to unlock a lock of the locking device. As an example, the mobile control module may receive an ID signal from the locking device indicating the ID(s) of the lock and/or locking device. As another example, the mobile control module may read the locking device to acquire the ID(s) of the lock and/or locking device. As yet another example, the locking device may detect the mobile device and/or transmit a request for a key from the mobile device. The request may indicate the ID(s) of the lock and/or locking device.

At316, prior to sending a key to the locking device, the mobile device may request additional verification information from the user. The keys stored on the mobile device may be, for example, password (or pin) protected and/or protected based on other verification information (examples of which are disclosed herein). At317, the mobile control module34receives verification information from the user via, for example, the display. At318, the mobile control module34and/or an information verification module (e.g., one of the information verification modules162,210,232) determines whether the verification information is correct. The information verification module may transmit the received verification information to the server40and/or the central computer24and request verification from the server40and/or the central computer24.

If the verification information is not approved, the technique may end at319. At320, the mobile device may transfer a unique ID of the mobile device, one or more keys and/or other verification information to the locking device when the additional verification information is approved by the mobile device, the server40and/or the central computer24.

At321, a lock control module (e.g., the lock control module200) and/or the information verification module of the locking device verifies the unique ID, the key(s) and/or other verification information received from the mobile device. The information verification module may request verification of this information by the server40and/or the central computer24. The unique ID, key(s) and other verification information may be transmitted from the locking device to the server40and/or the central computer24.

At322, if the unique ID, the key(s), and/or other verification information received are not valid, the technique may end at324. At326, the lock control module may determine a rank of the mobile device based on the verification information received from the mobile device. The verification information received from the mobile device may include a rank. At328, if the rank is not greater than a predetermined rank (e.g., rank of 1), task330may be performed. If the rank is greater than the predetermined rank, task334is performed.

At330, a lock actuation module (e.g., the lock actuation module208) of the locking device unlocks the lock using the key(s). The technique may end at332after unlocking the lock.

At334, the locking device may request additional verification information from the mobile device. After a key is provided from the mobile devices to a locking device, the locking device or an associated network of the locking device (e.g., vehicle network) may challenge the mobile device. This may occur before or after the locking device unlocks a lock. The additional verification information may include a password, a passcode, a pin or other verification information.

At336, the mobile device transmits the additional verification information requested at334. The mobile device may request the additional verification information from the server40and/or the central computer24prior to transmitting the additional verification information to the locking device. Upon receiving the additional verification information, the mobile device may forward the additional verification information to the locking device.

At338, the locking device verifies and/or requests verification of the additional verification information by the server40and/or the central computer24, as described above. At340, the locking device proceeds to task342if the additional verification information received at336is valid, otherwise the technique may end at348.

At342, the lock actuation module unlocks the lock. At344, the locking device and/or associated network (e.g., the vehicle network or facility network) may establish communication link(s) to communicate with the mobile device, the server40and/or the central computer24. The communication link(s) may include Bluetooth and/or Wi-Fi communication links via which Bluetooth and Wi-Fi protocols are respectively used for communication. The communication links may be established prior to task344, such as at tasks320or321.

The NFC communication used to unlock the lock may also be used to initiate wireless connections of other communication protocols. For example, when the mobile device is used to unlock a lock on a home or a vehicle, the mobile device may initiate a Wi-Fi or Bluetooth connection to communicate with a home network or a vehicle network (e.g., the networks72,92). As an example, a Bluetooth connection may then be used to sink personal or verification information from the mobile device to the vehicle network, such as seat settings, temperature settings, radio settings (e.g., radio station and volume settings), powertrain or suspension settings (e.g., an economy or sport setting), or other vehicle settings. The vehicle network may then adjust settings to match the vehicle settings received from the mobile device. As another example, the locking device may establish a Wi-Fi link with the mobile device, the server40and/or the central computer24and communicate with and request additional information from the mobile device, the server40and/or the central computer24for verification purposes.

At346, the locking device and/or associated network may download user preferences (e.g., the vehicle settings or facility settings) from the mobile device, the server40and/or the central computer24. The technique may end at348after performing task346.

In a vehicle application and subsequent to tasks330and342, the mobile device may request that the locking device unlock a lock on a vehicle door. The locking device unlocks the vehicle door to allow access to an interior of a vehicle. A vehicle network may then request additional information from the mobile device prior to allowing the vehicle to start. If the mobile device does not provide the correct information, the vehicle network may prevent an engine and/or the vehicle from starting and/or transmit a signal to the mobile device, the other mobile device, the server40and/or the central computer24indicating that an unauthorized device has accessed the vehicle. A second key may need to be provided by the mobile device and verified by the vehicle network to start the vehicle.

The above-described tasks are meant to be illustrative examples; the tasks may be performed sequentially, synchronously, simultaneously, continuously, during overlapping time periods or in a different order depending upon the application. Also, any of the tasks may not be performed or skipped depending on the implementation and/or sequence of events.

Although the terms first, second, third, etc. may be used herein to describe various elements, devices, modules and/or servers, these elements, devices, modules and/or servers should not be limited by these terms. These terms may be only used to distinguish one element, device, module and/or server from another elements, devices, modules and/or servers. Terms such as “first,” “second,” and other numerical terms when used herein do not imply a sequence or order unless clearly indicated by the context. Thus, a first element, device, module and/or server discussed below could be termed a second element, device, module and/or server without departing from the teachings of the example embodiments.

As used herein, the term module may refer to, be part of, or include: an Application Specific Integrated Circuit (ASIC); an electronic circuit; a combinational logic circuit; a field programmable gate array (FPGA); a processor or a distributed network of processors (shared, dedicated, or grouped) and storage in networked clusters or datacenters that executes code or a process; other suitable components that provide the described functionality; or a combination of some or all of the above, such as in a system-on-chip. The term module may also include memory (shared, dedicated, or grouped) that stores code executed by the one or more processors.

Certain aspects of the described techniques include process steps (or tasks) and instructions described herein in the form of an algorithm. It should be noted that the described process steps (tasks) and instructions could be embodied in software, firmware or hardware, and when embodied in software, could be downloaded to reside on and be operated from different platforms used by real time network operating systems.