Patent Description:
An access control system operates by encoding data on a physical key card that indicates access rights. Some access control systems are generally operated in an online mode where readers communicate with a centralized server of the access control system via a network to determine whether or not to grant access. In such online systems, the access rights are often a reference identifier or some other similar element. Other access control systems are offline with access rights encoded as data that can be decoded and interpreted by offline locks to retrieve access rights. An example is a hotel locking system in which a front desk worker encodes a guest card and an offline, battery powered lock on a guest room door decodes the key card and thus permits or denies access based on the encoded access rights. Some methods of encoding access rights include sequencing where subsequent access rights have a sequence number that is greater than the prior access rights. Some methods of encoding access rights also include utilizing a mobile device to deliver the access credential.

In addition to access rights for opening doors, guests or visitors that arrive at hotels or office buildings often need Wi-Fi credentials to securely access networks in their rooms or office buildings. Currently, hotels distribute such credentials using no security at all, using semi-secure access codes or by way of special systems that require web servers, firewalls and complicated software.

<CIT> discloses an electronically activated access control system using mobile wireless communication devices. <CIT> discloses methods and devices for controlling access in multi-room facilities with cascading access levels. Document <CIT> discloses methods and devices for access in multi-room facilities and in-room safes.

According to one aspect of the invention, an access control system is provided according to claim <NUM> and includes a credential authenticator; a first device comprising a door lock configured to restrict access to a first secured element and configured to operate in first and second modes, wherein the first secured element is a guest room; and a second device which is a Wi-Fi credential database configured to restrict access to a second secured element provided as WiFi access in the guest room and configured to operate in first and second modes. The first device is responsive to a request for first access to the first secured element delivered thereto by a mobile device and the second device is responsive to a request for second access to the second secured element delivered thereto via the first device by the mobile device. In the respective first modes, the first and second devices maintain the first and second access restrictions to the first and second secured elements, respectively. In the respective second modes, the first and second devices permit the first and second access, respectively. The respective second modes are effectuated based on credentials being transmitted from the mobile device to and authenticated by the credential authenticator.

Optionally, the credential authenticator is provided within a Bluetooth ™ module.

Optionally, the credential authenticator is remote from the first and second devices.

Optionally, the credential authenticator is a component of one of the first and second devices.

Optionally, the mobile device includes one or more of a portable computing device, a smartphone and a tablet.

Optionally, the first device includes a door lock.

Optionally, the first device includes a set top box and the second device includes an environmental controller.

Optionally, the first device includes an elevator kiosk and the second device includes an elevator dispatch system.

Optionally, the first device comprises a refrigeration unit.

Optionally, the access control system includes a module having a credential authenticator whereby an application with credentials stored thereon is executable to establish a connection between a mobile device and the module such that the credentials are transmittable thereto for authentication by the credential authenticator.

According to another aspect of the invention, an access control method is <NUM>. provided according to claim <NUM>. The access control method includes storing mobile credentials in an application of a mobile device, identifying that the mobile device is within range of a module having a credential authenticator, executing the application to establish a connection with the module whereby the mobile credentials are transmittable to the module for authentication by the credential authenticator and operating a first device comprising a door lock and a second device which is a Wi-Fi credential database in respective secure-pass-through modes such that the first and second devices permit access to first and second secured elements, respectively, based on the credentials being authenticated by the credential authenticator and a type of the credentials in respective response to first and second requests. The first request is for first secured element access issued by the mobile device to the first device and the second request is for second secured element access issued by the mobile device to the second device via the first device operating in the secure-pass-through mode. The first secured element is a guest room and the second secured element provides WiFi access in the guest room.

Optionally, mobile credential transmission for authentication includes sending the mobile credentials from the mobile device to the module, validating the credentials at the module and establishing the secure-pass-through mode.

As will be described below, an access control system is provided in which a person with a mobile device, also called a mobile unit, can obtain access to a secure element through an access control device by a secure "pass-through" mode of communication between the mobile device and the access control device which is allowed after authentication of access rights with mobile credentials. The secure "pass-through" mode of communication allows the mobile device to communicate with or exchange additional data with the secure element in addition to accessing the secured element by way of the access control device.

In an operation of the access control system, an access control device is typically communicated with or accessed, for example, to open a lock and enter a secure room or space, to open a cabinet, to enable use of equipment or, more generally, to access a secured element. Additional data for the secure element may be used in various ways including reading the data, writing the data or a combination thereof. The system is deployed in use cases such as where a phone authenticates to a guest room door and requests/receives Wi-Fi credentials for the guest Wi-Fi network, where a phone authenticates to a reader by an entrance door and requests/receives Wi-Fi credentials for the building Wi-Fi network. In effect, the access control system provides for authentication and validation of a user with a mobile device to access a secured element and, in addition, provides for additional access to a secured element that otherwise would have required a completely separate authentication and validation to access.

With reference to <FIG>, an access control system <NUM> is provided and may be deployed in a building <NUM>, such as a hotel or an office building. The access control system <NUM> includes a mobile device <NUM>, a server <NUM>, a plurality of access controls 16a, 16b,. , 16n and an authentication module <NUM> which may be provided as a Bluetooth ™module <NUM>. The mobile device <NUM> may be a wireless capable handheld device, such as a smartphone or tablet, which is operable to communicate with the server <NUM>, the access controls 16a, 16b,. , 16n and the authentication module <NUM>. The server <NUM> may provide mobile credentials and other data to the mobile device <NUM>, such as firmware or software updates to be communicated to one or more of the access controls 16a, 16b,. Although the server <NUM> is depicted herein as a single device, it should be appreciated that the server <NUM> may alternatively be embodied as a multiplicity of systems from which the mobile device <NUM> receives mobile credentials and other data. Each of the access controls 16a, 16b,. , 16n is a wireless-capable, restricted-access or restricted-use device such as wireless locks, access control readers for building entry, electronic banking controls, data transfer devices, key dispenser devices, tool dispensing devices, elevator kiosks, vehicle control systems and other restricted-use machines. As such, each of the access controls 16a, 16b,. , 16n is disposed to restrict access to a corresponding secured element 17a, 17b,.

That is, access control 16a is provided as a first device as a door lock, with the secured element 17a thus being provided as a guest room and access control 16b may be provided as a second device as a database including Wi-Fi passwords for Wi-Fi access in the secured element 17a, with the secured element 17b being provided as the password for the guest room.

In typical access control systems, the mobile device <NUM> may be configured to submit credentials to the access controls 16a, 16b,. , 16n to thereby gain access for the user. For example, a user may use the mobile device <NUM> to submit a credential to an electromechanical lock to unlock it to thus gain access to his guest room. The mobile device <NUM> may store multiple types of credentials and some credentials may be used for multiple access controls 16a, 16b,.

With reference to <FIG>, a block diagram of an example electronic lock system <NUM> includes the access control 16a, the mobile device <NUM>, the server <NUM> and the authentication module <NUM>. The access control 16a generally includes a lock actuator <NUM>, a lock controller <NUM>, a lock antenna <NUM>, a lock transceiver <NUM>, a lock processor <NUM>, a lock memory <NUM>, a lock power supply <NUM> and a lock card reader <NUM> and a credential module <NUM>. The access control 16a is responsive to credentials from the mobile device <NUM>, and may, for example, be the lock of a lockbox, a door lock or a lock core. Although the present disclosure focuses primarily on credentials for access control, it should be appreciated that other systems wherein credentials are transmitted from a mobile device to an access control so as to identify the user to an online system or validate user access rights or permissions in an offline system will benefit herefrom. Such systems include virtual or electronic banking systems, machine operation systems, dispensing systems, human conveyance systems (e.g. elevators, turnstiles, subways, trains and the like) and data access system.

Upon receiving and authenticating an appropriate credential from the mobile device <NUM> using the credential module <NUM> or after receiving card data from lock card reader <NUM>, the lock controller <NUM> commands the lock actuator <NUM> to lock or unlock a mechanical or electronic lock. The lock controller <NUM> and the lock actuator <NUM> may be parts of a single electronic or electromechanical lock unit, or may be components sold or installed separately.

The lock transceiver <NUM> is capable of transmitting and receiving data to and from at least the mobile device <NUM>. The lock transceiver <NUM> may, for instance, be a near field communication (NFC), Bluetooth, or Wi-Fi transceiver, or another appropriate wireless transceiver. The lock antenna <NUM> is any antenna appropriate to the lock transceiver <NUM>. The lock processor <NUM> and lock memory <NUM> are, respectively, data processing and storage devices. The lock processor <NUM> may, for instance, be a microprocessor that can process instructions to validate card data and determine the access rights contained in the card data or to pass messages from a transceiver to a credential module <NUM> and to receive a response indication back from the credential module <NUM> with card data. The lock memory <NUM> may be RAM, EEPROM or other storage medium where the lock processor <NUM> can read and write data including but not limited to lock configuration options and the lock audit trail. The lock audit trail may be a unified audit trail that includes events initiated by accessing the lock via the lock card reader <NUM> or the mobile device <NUM>. The lock power supply <NUM> is a power source such as line power connection, a power scavenging system, or a battery that powers the lock controller <NUM>. In other embodiments, the lock power supply <NUM> may only power the lock controller <NUM>, with the lock actuator <NUM> powered primarily or entirely by another source, such as user work (e.g. turning a bolt).

The credential module <NUM> is in communication with the lock processor <NUM> and is operable to decrypt and validate a credential to extract virtual card data communicated into the lock controller <NUM> as a "virtual card read. " That is, the access control 16a has essentially two readers, one reader <NUM> to read a physical key card <NUM> and the credential module <NUM> to communicate with the mobile device <NUM> via the lock processor <NUM> and the transceiver <NUM> and antenna <NUM>.

While <FIG> shows the lock antenna <NUM> and the transceiver <NUM> connected to the processor <NUM>, this is not to limit other embodiments that may have additional antenna <NUM> and transceiver <NUM> connected to the credential module <NUM> directly. The credential module <NUM> may contain a transceiver <NUM> and antenna <NUM> as part of the credential module <NUM> or the credential module <NUM> may have a transceiver <NUM> and antenna <NUM> separately from the processor <NUM> which also has a separate transceiver <NUM> and antenna <NUM> of the same type of different. In some embodiments, the processor <NUM> may route communication received via transceiver <NUM> to the credential module <NUM>. In other embodiments the credential module <NUM> may communicate directly to the mobile device <NUM> through the transceiver <NUM>. In other embodiments the credential module may be a software module whole executed within the processor <NUM>.

The mobile device <NUM> generally includes a key antenna <NUM>, a key transceiver <NUM>, a key processor <NUM>, a key memory <NUM>, a GPS receiver <NUM>, an input device <NUM>, an output device <NUM> and a key power supply <NUM>. The key transceiver <NUM> is a transceiver of a type corresponding to the lock transceiver <NUM>, and the key antenna <NUM> is a corresponding antenna. In some embodiments, the key transceiver <NUM> and the key antenna <NUM> may also be used to communicate with the server <NUM>, the access controls 16a, 16b,. , 16n and the authentication module <NUM>. In other embodiments, one or more separate transceivers and antennas may be included to communicate with the server <NUM>, the access controls 16a, 16b,. , 16n and the authentication module <NUM>. The key memory <NUM> is of a type to store a plurality of credentials locally on the mobile device <NUM>. In other embodiments, the mobile device <NUM> communicates with the server <NUM> at the same time as it communicates to the access control 16a. This is the online configuration and in this embodiment a mobile credential is retrieved in real time and is passed to the credential module <NUM> without storing first in the key memory <NUM> on the mobile device <NUM>.

In some embodiments, the authentication module <NUM> is used in one or more of the access controls 16a, 16b,. , 16n as the credential module <NUM>. In other embodiments, the authentication module <NUM> is used to connect to other equipment (not shown), such as a secure element which is protected by the authentication module <NUM>.

With reference to <FIG>, during an operation of the electronic lock system <NUM>, a user of the mobile device <NUM> stores an application in the key memory <NUM> and registers to stay in a hotel in which the electronic lock system <NUM> is deployed. Upon such registration, which may be completed by way of the application, or at another point, a set of mobile credentials for the user are generated which grant the user access rights to certain secured elements (e.g., the user's room, the weight room and spa, Wi-Fi access in the user's room, etc.) of the hotel during the days of his stay. These mobile credentials are forwarded to the mobile device <NUM> and stored in the key memory <NUM>. As shown in <FIG>, at the time of his reservation and once the user approaches the proximity of the hotel property and thus comes in range of the authentication module <NUM>, which again may be provided as a Bluetooth ™ module <NUM> or as the credential module <NUM> with an integrated transceiver <NUM> and antenna <NUM>, the application signals an intent to the key memory <NUM> and thereby causes the mobile device <NUM> to establish a connection with the authentication module <NUM>. With this connection established, the mobile credentials are transmitted from the key memory <NUM> to the authentication module <NUM> whereupon they are either validated or invalidated. If the mobile credentials are invalidated, the user is not and cannot be granted access to secured elements. On the other hand, if the mobile credentials are validated, the authentication module <NUM> and the electronic lock system <NUM> effectively generate a secure pass-through state for the mobile device <NUM> and the user.

The authentication module <NUM> will receive the encrypted mobile credential and then validate and decrypt the mobile credentials to retrieve virtual card data. The decryption and validation may include, but is not limited to, validating a digital signature, validating the type of the mobile credential, validating that the mobile credential identifier matches an identifier in the lock memory <NUM>, validating a starting date and an expiring date of the mobile credential, validating the source of the mobile credential, etc. Once the mobile credential is validated and decrypted, the virtual card data is extracted.

Additionally, for an authentication module <NUM> in the form of a credential module <NUM> in access control 16a, once the mobile credential is validated and decrypted, virtual card data can be extracted and sent to the lock processor <NUM> for additional validation. Once the application on the mobile device <NUM> has successfully traversed the authentication to an authentication module <NUM> with the mobile credential as described above, the authentication module <NUM> will allow additional messages to be sent over the connection.

With the secure pass-through state generated, the application can be further executed to cause the mobile device <NUM> to issue a first request to a first one of the access controls 16a, 16b,. , 16n (access control 16a, for example) for access to the secured element 17a and to issue a second secure request to a second one of the access controls 16b,. , 16n (access control 16b, for example) via the first access control 16a for access to the second secured element 17b. In such a case, if the access control 16a is the user's guest room door and the user's mobile credentials have already been validated by the authentication module <NUM>, the authentication module <NUM> will communicate with the access control 16a to instruct the access control 16a that the user's mobile credentials have been validated so that the access control 16a permits the user to access the guest room in response to the first request and so that the access control 16b can respond to the second secure request with a secure response visa the access control 16a.

According the invention access control 16a is provided as a first device serving as a door lock, the first secured element 17a is provided as the guest room, the access control 16b is provided as a second device serving as a Wi-Fi credential database and the second secured element 17b is provided as the set of Wi-Fi login and password combinations for each guest room in a hotel. In other examples the access control 16a may be provided as a first device serving as a set top box, the first secured element 17a may be provided as the television in a guest room, the access control 16b may be provided as a second device serving as an environmental controller and the second secured element 17b may be provided as the environmental controls for each guest room in a hotel. In other examples, the access control 16a may be provided as a first device serving as an elevator kiosk, the first secured element 17a may be provided as elevator controls, the access control 16b may be provided as a second device serving as an elevator dispatch system and the second secured element 17b may be provided as the elevator cars in a hotel.

With reference to <FIG>, a method <NUM> to facilitate communication of a credential representative of data that would normally be physically encoded on a key card <NUM> (see <FIG>) is provided. The method includes retrieving card data in digital form (block <NUM>), encapsulating the card data in an encrypted mobile credential (block <NUM>) and downloading the mobile credential to the mobile device <NUM> (block <NUM>). The method further includes securely passing to the authentication module <NUM> (block <NUM>) when the user and the mobile device <NUM> are within the range of the authentication module <NUM> (i.e., on the property of a hotel). The authentication module <NUM> then decrypts and validates the mobile credential (block <NUM>), extracts the card data (block <NUM>) and passes the card data into the lock controller <NUM> as a "virtual card read' (block <NUM>).

This, for example, permits a user to bypass a front desk of a hotel and go directly to their room. The encrypted mobile credential may be generated by the server <NUM> using well known techniques for digital certificate creation and encryption using cryptographic algorithms such as AES, ECC, RSA, and the like. For example, the mobile credential may contain but is not limited to including a mobile credential identifier, unique access control identifier, unique credential module identifier, an identifier shared with multiple access controls, a parameter indicating the type or format of the credential, it may contain encrypted data such as the virtual card data, and it may contain a digital signature. The encrypted data may be encrypted with an AES-<NUM> encryption key that can be known to the authentication module <NUM> or it may be encrypted with a derived encryption key that can be determined from information contained in the mobile credential. Further, the digital signature may be a CBC-MAC type signature based on an AES-<NUM> encryption key, for example, that can be known by the authentication module <NUM> or it could be a digital signature based on a private key known to the server <NUM> and can be validated by a public key known to the authentication module <NUM>.

With reference to <FIG>, in an exemplary case, a user first reserves a hotel room (block <NUM>) through any process supported by a hotel, such as mobile reservations, web sites, travel agents, etc., and then completes a check-in procedure to confirm their stay (block <NUM>). A room is then assigned in a hotel property management system <NUM> based on the guest preferences and the room availability on check-in (block <NUM>). The hotel property management system <NUM> may use a software-to-software application programming interface (API) provided by a front desk application <NUM> to request card data in a digital form (block <NUM>). The front desk application <NUM> may range from a stand-alone encoder <NUM> to a complete software package running in a cloud that is operable to encode a virtual card for the room that was selected and return the virtual card data back to the hotel system (block <NUM>). Next, the hotel property management system <NUM> will make another software-to-software API call to a credential service <NUM> after the hotel system has allocated a room (block <NUM>). The pertinent information is communicated to the credential service <NUM> with an indication to include, for example, what hotel property, what room, what guest (e.g. User ID), what dates and also the virtual card data for the stay. The hotel property management service <NUM> may also communicate an indication to the user (again, through any conventional method) that the check-in is confirmed and the room is assigned (block <NUM>).

A mobile device <NUM> based hotel loyalty mobile application <NUM> will utilize a software-to-software API in a mobile library <NUM> (block <NUM>) to download mobile credentials from the credential service <NUM> (block <NUM>). The mobile library <NUM> will securely authenticate to the credential service <NUM> with a prior established shared secret that may change on every successful connection.

Once authenticated, the credential service <NUM> generates at the time of the communication from the mobile library <NUM> the mobile credentials for the user and encrypts into the mobile credentials the virtual card data received in block <NUM> for the guest associated with this instance of the mobile library <NUM>. One credential may be generated for each access control 16a, 16b,. , 16n and the virtual card data will be the same in each of these separate mobile credentials but may be encrypted with unique keys for each. The method of encryption may be AES, 3DES or other such encryption method. The method and type of credential used may be a compressed digital certificate or a standard based certificate like X. <NUM> or certificate format known to the art. That is, for example, the virtual card data is encrypted into the mobile credential with a unique key known by the authentication module <NUM> and know or determinable by the credential service <NUM>. The mobile library <NUM> will download and store the list of mobile credentials on the mobile device <NUM> using native OS protections and additional encryption of data with device specific information, e.g., UDID, IMEI, IMSI, MAC addresses, etc..

Once the mobile credentials are validated by the authentication module <NUM> (block <NUM>), the user will be able to operate the access controls 16a, 16b,. , 16n that he is authorized to operate in an offline mode at any later time without the mobile device <NUM> being required to be connected to the credential service <NUM>. Thus, when the user wishes to access his room (block <NUM>), the user may indicate such intent through a gesture, a click of a button, a tap on the screen, a finger print read, password, proximity to the lock, touching the lock, etc. In response to this intent, the hotel loyalty mobile application <NUM> again calls the software-to-software API in the mobile library <NUM> to initiate the secure mobile device/unit request to the corresponding access control 16a (block <NUM>).

More particularly, with reference to <FIG>, an access control method is provided. As shown in <FIG>, the access control method includes storing mobile credentials in an application of a mobile device (block <NUM>) and identifying that the mobile device is within range of a module having a credential authenticator (block <NUM>). At this point, if the mobile device is within the range of the module, the access control method further includes executing the application to establish a connection between the mobile device and the module whereby the mobile credentials stored in the application are transmittable from the mobile device and to the module for authentication by the credential authenticator (block <NUM>).

Subsequently, it is determined whether the mobile credentials are authenticated (block <NUM>). In an event the mobile credentials are not authenticated, the access control method ends and no access will be permitted to be granted in response to any request (block <NUM>). On the other hand, in an event the mobile credentials are authenticated, the access control method includes operating first and second devices in respective secure-pass-through modes (block <NUM>). As such, the first device will permit access to a first secured element based on the credentials being authenticated by the credential authenticator and a type of the credentials being determined to be consistent with a type of the access being requested in response to a first request for first secured element access which is issued by the mobile device to the first device. Meanwhile, the second device will permit access to a second secured element based on the credentials being authenticated by the credential authenticator and a type of the credentials being determined to be consistent with a type of the access being requested in response to a second request for second secured element access which is issued by the mobile device to the second device via the first device while the first device is operating in the secure-pass-through mode.

That is, in the case where the access control 16a is the first device and is serving as a door lock and the access control 16b is the Wi-Fi credential database, a guest whose smartphone has already had its mobile credentials authenticated may request access to his assigned guest room by causing his smartphone to issue a first request to the door lock. At this point, the door lock will permit the user to enter the guest room. In addition, if the user were to request the Wi-Fi login and password combination for his guest room from the Wi-Fi credential database, such request could be issued by the mobile device to the door lock as a second secure request which is responded to by the Wi-Fi credential database via the door lock.

Claim 1:
An access control system, comprising:
a credential authenticator;
a first device (16a) comprising a door lock configured to restrict access to a first secured element (17a) and configured to operate in first and second modes, wherein the first secured element is a guest room; and
a second device (16b) which is a Wi-Fi credential database including Wi-Fi passwords, said database configured to restrict access to a second secured element (17b) being provided as the Wi-Fi password for the guest room and configured to operate in first and second modes;
the first device being responsive to a request for first access to the first secured element delivered thereto by a mobile device (<NUM>),
the second device being responsive to a request for second access to the second secured element issued by the mobile device and delivered thereto via the first device operating in the second mode,
wherein:
in the respective first modes, the first and second devices maintain the first and second access restrictions to the first and second secured elements, respectively,
in the respective second modes, the first and second devices permit the first and second access, respectively, and
the respective second modes are effectuated based on credentials being transmitted from the mobile device to and authenticated by the credential authenticator.