Patent Description:
This invention relates generally to access, and more particularly, to enhanced access control.

People have been known to wait in lengthy time-consuming queues to access places like transportation hubs, stadiums, and concert halls which provide transportation services, sports entertainment services, and music entertainment services, respectively. In transportation hubs, queue lengths vary with fluctuating traveler volumes, traveler behavior, and resource constraints of transportation hubs, and are known to be particularly burdensome for travelers during or around holiday seasons and during inclement weather. Such burdensome queues may cause travelers to miss, for example, an airplane flight and perhaps a connecting flight resulting in inconvenient, frustrating delays. Additionally, hotels and individuals planning to collect the traveler may need to be notified of delays. Long burdensome queues have also been known to form and cause people to miss part of a sporting event or concert.

Because people are typically close to each other in queues, people are more likely to contract pathogens from each other while in the queue. Additionally, people are typically close to each other at sporting events and while attending concerts. Such queue conditions and proximity may thus present a dangerous health risk for people who are vulnerable to lethal pathogens like the coronavirus.

Transportation hub operators are known to use historical user data to predict the timing of daily, weekly, and holiday user volume surges and allocate resources according to the predictions. Similarly, operators of stadiums and concert halls attempt to use historical data to implement measures to reduce queue lengths and to increase spacing between people during an event. However, despite their best efforts overcrowded queues continue to develop.

Additionally, commercial and non-commercial entities like transportations hubs and governments are known to issue form of identification to, for example, employees and people who use services provided at their facilities. One form of identification typically used is a badge which can be attached to clothing or to a chain which is put around a person's neck. Badges generally include, amongst other things, the name and photograph of the person to whom the badge was issued. Typically, badges are checked by an automated security system or by security personnel in order to access services provided at the facility.

However, it is easy and inexpensive to make a fraudulent badge, for example, by modifying a genuine badge to include a different name, photograph, or both. Fraudulent badges compromise security of facilities and of services available at the facilities. Additionally, it is time consuming and expensive to issue badges, check badges, provide replacement badges and to keep records regarding issued and replacement badges. Thus, it can be seen from the above that known techniques for managing queues, and known techniques for issuing and checking forms of identification have drawbacks.

<CIT> discloses a device and a method for user authentication using a security card. The device for user authentication comprises: a card reader which, when a card is recognized, acquires a face image stored in the card; an infrared light source which emits infrared rays toward a user; an infrared camera which acquires an infrared image including the facial region of the user; a color camera which acquires a color image including the facial region of the user; and a control unit which determines a result of user authentication on the basis of at least one of the infrared image, the color image, and the face image, and generates a control signal according to the result of user authentication. The control unit performs a liveness test on the basis of the infrared image, and when it is determined that the result of the liveness test is successful, determines a result of face authentication on the basis of information about the facial region shown in at least one of the color image and the infrared image and on the basis of the face image acquired from the card.

<CIT> discloses a method of host-directed illumination for verifying the validity of biometric data of a user that includes capturing biometric data from a user with an authentication device during authentication and directing illumination of the biometric data from a host authentication system during the capturing operation. Moreover, the method includes comparing illumination characteristics of the captured biometric data against illumination characteristics expected to result from the directing operation, and determining that the user is a live user when the illumination characteristics of the captured biometric data match the illumination characteristics expected to result from the directing operation.

Thus, it would be advantageous and an improvement over the relevant technology to provide method, a computer, and computer-readable recording medium capable of enhancing user access control to reduce user inconvenience and health risks, as well as to increase security and reduce costs associated with providing secure facilities.

The present invention provides a method as detailed in claim <NUM>. Also provided is a system according to claim <NUM>. Advantageous features are provided in the dependent claims.

An aspect of the present disclosure provides a method according to claim <NUM>.

In an embodiment of the present disclosure, the computer or a different computer determines whether the facial image data was taken of a live person.

In an embodiment of the present disclosure, the method further comprises the step of discarding the at least one credential and the facial image data when the identity of the user is verified as true.

In an embodiment of the present disclosure the at least one credential is cryptographically signed biometric data of the user.

Another aspect of the present disclosure provides a system according to claim <NUM>.

The following detailed description is made with reference to the accompanying drawings and is provided to assist in a comprehensive understanding of various example embodiments of the present disclosure. The following description includes various details to assist in that understanding, but these are to be regarded merely as examples and not for the purpose of limiting the present disclosure as defined by the appended claims. The words and phrases used in the following description are merely used to enable a clear and consistent understanding of the present disclosure. In addition, descriptions of well-known structures, functions, and configurations may have been omitted for clarity and conciseness.

<FIG> is a schematic diagram of an example computing system <NUM> for enhanced access control according to an embodiment of the present disclosure. As shown in <FIG>, the main elements of the system <NUM> include a computing device <NUM>, a verification server <NUM>, and an access control management computer (ACMC) <NUM> communicatively connected via a network <NUM>.

In <FIG>, the computing device <NUM> can be any wireless hand-held consumer electronic device capable of at least downloading applications over the Internet, running applications, capturing and storing data temporarily and/or permanently, and otherwise performing any and all functions described herein by any computer, computer system, server or computing device included in the system <NUM>. One example of the computing device <NUM> is a smart phone. Other examples include, but are not limited to, a cellular phone, a tablet computer, a phablet computer, a laptop computer, and any type of hand-held consumer electronic device having wired or wireless networking capabilities capable of performing the functions, methods, and/or algorithms described herein.

Each computing device <NUM> is typically associated with a single person who operates the device. However, it is contemplated by the present disclosure that each computing device <NUM> may alternatively be associated with more than one person, for example, a husband and wife. The person who is associated with and operates the computing device <NUM> is referred to herein as a user. Users include, but are not limited to, airline company employees, university students and faculty, Transportation Security Administration (TSA) security personnel, sports fans, museum goers, concert goers, and any person desiring access to a physical location.

The verification server <NUM> can be, for example, any type of server or computer implemented as a network server or network computer. The computing device <NUM> and verification server <NUM> may alternatively be referred to as an electronic device or an information system.

The ACMC <NUM> can be any wireless consumer electronic device capable of at least downloading applications over the Internet, running applications, capturing and storing data temporarily and/or permanently, conducing verification transactions and liveness detection, and otherwise performing any and all functions described herein by any computer, computer system, server or computing device included in the system <NUM>. One example of the ACMC <NUM> is a tablet computer. Other examples include, but are not limited to, a phablet computer, a laptop computer, and any type of consumer electronic device having wired or wireless networking capabilities capable of performing the functions, methods, and/or algorithms described herein. The ACMC <NUM> can be mounted to or otherwise connected to an access control mechanism (ACM) <NUM>. Additionally, the ACMC <NUM> can communicate with the ACM <NUM> via a wired or wireless connection.

The ACMC <NUM> can at least obtain data stored in a chip of a document to verify a user's identity. For example, biometric template data stored in the chip may be obtained and transmitted to the verification server <NUM> for biometrically verifying the identity of the user. Additionally, the ACMC <NUM> may capture data regarding biometric modalities of users. An ACM <NUM> is an electronic gate (eGate). In response to the identity of a user being successfully verified, the ACM <NUM> causes a physical barrier such as a gate or turnstile to open and permit access to a service. Thus, access control to a service is enhanced.

It is contemplated by the present disclosure that the operations performed by the ACMC <NUM> and the verification server <NUM> may be implemented by a single computer system, for example, the ACMC <NUM> only or the verification server <NUM> only. When implemented by the ACMC <NUM> the verification server <NUM> may not be included in the system <NUM>.

The network <NUM> may be implemented as a <NUM> communications network. Alternatively, the network <NUM> may be implemented as any wireless network including, but not limited to, <NUM>, <NUM>, Wi-Fi, Global System for Mobile (GSM), Enhanced Data for GSM Evolution (EDGE), and any combination of a LAN, a wide area network (WAN) and the Internet. The network <NUM> may also be any type of wired network or a combination of wired and wireless networks.

It is contemplated by the present disclosure that the number of computing devices <NUM>, verification servers <NUM>, and ACMCs <NUM> is not limited to the number of computing devices <NUM>, verification servers <NUM>, and ACMCs <NUM> shown in <FIG>.

<FIG> is a more detailed schematic diagram illustrating the computing device <NUM>, the verification server <NUM>, and the ACMC <NUM> in the system <NUM> for enhanced access control according to an embodiment of the present disclosure. Although <FIG> shows one computing device <NUM>, one ACMC <NUM>, and one verification server <NUM>, the computing device <NUM>, the ACMC <NUM>, and the verification server <NUM> in the figure are meant to be representative of additional computing devices <NUM>, ACMCs <NUM>, and verification servers <NUM> that may be included in the system <NUM> shown in <FIG>.

The computing device <NUM> includes components such as, but not limited to, one or more processors <NUM>, a memory <NUM>, a communications interface <NUM>, a bus <NUM>, a camera <NUM>, a user interface <NUM>, a display <NUM>, and a sensing device <NUM>. General communication between the components in the computing device <NUM> is provided via the bus <NUM>.

The processor <NUM> executes software instructions, or computer programs, stored in the memory <NUM>. As used herein, the term processor is not limited to just those integrated circuits referred to in the art as a processor, but broadly refers to a computer, a microcontroller, a microcomputer, a programmable logic controller, an application specific integrated circuit, and any other programmable circuit capable of executing at least a portion of the functions and/or methods described herein. The above examples are not intended to limit in any way the definition and/or meaning of the term "processor.

The memory <NUM> may be any non-transitory computer-readable recording medium. Non-transitory computer-readable recording media may be any tangible computer-based device implemented in any method or technology for short-term and long-term storage of information or data. Moreover, the non-transitory computer-readable recording media may be implemented using any appropriate combination of alterable, volatile or non-volatile memory or non-alterable, or fixed, memory. The alterable memory, whether volatile or non-volatile, can be implemented using any one or more of static or dynamic RAM (Random Access Memory), a floppy disc and disc drive, a writeable or re-writeable optical disc and disc drive, a hard drive, flash memory or the like. Similarly, the non-alterable or fixed memory can be implemented using any one or more of ROM (Read-Only Memory), PROM (Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), and disc drive or the like. Furthermore, the non-transitory computer-readable recording media may be implemented as smart cards, SIMs, any type of physical and/or virtual storage, or any other digital source such as a network or the Internet from which computer programs, applications or executable instructions can be read.

The memory <NUM> may be used to store any type of data, for example, data records of users. Each data record is typically for the user or users associated with a respective computing device <NUM>. The data record for each user may include data such as, but not limited to, electronic tokens, health questionnaires, messages for prompting users to perform an action, biometric modality data, biometric templates, and personal data. Biometric modality data is the data of a biometric modality of a person captured by the computing device <NUM>. Biometric modalities include, but are not limited to, voice, face, finger, iris, palm, any other modalities, and any combination of modalities. Biometric modality data may be in any form including, but not limited to, image data and audio data. Image data may be a digital image, a sequence of digital images, or a video. Each digital image is included in a frame. The biometric modality data in the data record may be processed to generate at least one biometric template.

Biometric modality data may be captured in any manner. For example, for voice biometric data the computing device <NUM> may record a user speaking. For face biometric data, the camera <NUM> may record image data of the face of a user by taking one or more photographs or digital images of the user, or by taking a video of the user. The camera <NUM> may record a sequence of digital images at irregular or regular intervals. A video is an example of a sequence of digital images being captured at a regular interval. Captured biometric modality data may be temporarily or permanently stored in the computing device <NUM> or in any device capable of communicating with the computing device <NUM> via the network <NUM>. As used herein, capture means to record temporarily or permanently, any data including, for example, biometric modality data of a person.

The process of verifying the identity of a person is known as a verification transaction. Typically, during a verification transaction a biometric template is generated from biometric modality data of a person captured during the transaction. The generated biometric template is compared against a corresponding record biometric template of the person and a matching score is calculated for the comparison. If the matching score meets or exceeds a threshold score, the identity of the person is verified as true. Alternatively, the captured biometric modality data may be compared against corresponding record biometric modality data to verify the identity of the person. An authentication data requirement is the biometric modality data desired to be captured during a verification or identification transaction.

Biometric data includes data from a unique biological or behavioral characteristic of a human that can be used to identify a person. Examples of biometric data include, but are not limited to, biometric modality data, biometric data, features, embeddings, and summary statistics.

The term "personal data" as used herein includes any demographic information regarding a user as well as contact information pertinent to the user. Such demographic information includes, but is not limited to, a user's name, age, date of birth, street address, email address, citizenship, marital status, and contact information. Contact information can include devices and methods for contacting the user.

Any type and number of credentials may also be stored in the memory <NUM>. Example credentials include, but are not limited to, a biometric credential, a health credential and a reservation credential. The memory <NUM> may also store an identifier for the computing device <NUM>. The identifier may include any type of character and may be, for example, all numbers, all letters, and alphanumeric. The identifier may be of any length.

Additionally, the memory <NUM> can be used to store any type of software. As used herein, the term "software" is intended to encompass an executable computer program that exists permanently or temporarily on any non-transitory computer-readable recordable medium that causes the computing device <NUM> to perform at least a portion of the functions, methods, and/or algorithms described herein. Application programs are software and include, but are not limited to, operating systems, Internet browser applications, enrolment applications, applications for accessing various types of services like travel services, and any other software and/or any type of instructions associated with algorithms, processes, or operations for controlling the general functions and operations of the computing device <NUM>. The application for accessing various types of services can be downloaded from a digital distribution service via the network <NUM> using the computing device <NUM> or similar device. The software may also include computer programs that implement buffers and use RAM to store temporary data.

When executed by the processor <NUM>, the applications for accessing various services can cause the computing device <NUM> to perform operations such as, but not limited to, capturing personal data about a user, capturing answers to a health questionnaire, creating a health credential for a user, creating a reservation credential for a user, creating an electronic token based on the health and reservation credentials for a user, displaying the electronic token, displaying an icon that includes a message for performing an action, determining whether or not a health credential was created within a period of time, and determining whether or not a reservation credential is for a current time. One example of the message is "Show QR Code".

The communications interface <NUM> may include various network cards, and circuitry implemented in software and/or hardware to enable wired and/or wireless communications with other computing devices <NUM> (not shown), the verification server <NUM>, and the ACMC <NUM> via the network <NUM>. Communications include, for example, conducting cellular telephone calls and accessing the Internet over the network <NUM>. By way of example, the communications interface <NUM> may be a digital subscriber line (DSL) card or modem, an integrated services digital network (ISDN) card, a cable modem, or a telephone modem to provide a data communication connection to a corresponding type of telephone line. As another example, the communications interface <NUM> may be a local area network (LAN) card (e.g., for Ethemet. or an Asynchronous Transfer Model (ATM) network) to provide a data communication connection to a compatible LAN. As yet another example, the communications interface <NUM> may be a wire or a cable connecting the computing device <NUM> with a LAN, or with accessories such as, but not limited to, other computing devices. Further, the communications interface <NUM> may include peripheral interface devices, such as a Universal Serial Bus (USB) interface, a PCMCIA (Personal Computer Memory Card International Association) interface, and the like.

The communications interface <NUM> also allows the exchange of information across the network <NUM>. The exchange of information may involve the transmission of radio frequency (RF) signals through an antenna (not shown). Moreover, the exchange of information may be between the computing device <NUM>, the verification server <NUM>, the ACMC <NUM>, other computing devices (not shown), and other computer systems (not shown) capable of communicating over the network <NUM>.

Examples of other computer systems (not shown) include computer systems of service providers such as, but not limited to, financial institutions, medical facilities, national security agencies, merchants, and authenticators. The computing devices (not shown) may be associated with any user or with any type of entity including, but not limited to, commercial and non-commercial entities.

The camera <NUM> captures image data. The camera <NUM> can be one or more imaging devices configured to record image data of at least a portion of the body of a user including any biometric modality of the user while utilizing the computing device <NUM>. Image data captured using the imaging devices may be used for implementing liveness detection techniques based on depth perception, and if arranged into a three-dimensional (3D) camera system can implement liveness detection techniques based on structural lighting techniques.

The camera <NUM> is capable of recording image data under any lighting conditions including infrared light. The camera <NUM> may be integrated into the computing device <NUM> as one or more front-facing cameras and/or one or more rear facing cameras that each incorporates a sensor, for example and without limitation, a CCD or CMOS sensor. Alternatively, the camera <NUM> can be external to the computing device <NUM>.

The user interface <NUM> and the display <NUM> allow interaction between a user and the computing device <NUM>. The display <NUM> may include a visual display or monitor that displays information. For example, the display <NUM> may be a Liquid Crystal Display (LCD), an active matrix display, plasma display, or cathode ray tube (CRT). The user interface <NUM> may include a keypad, a keyboard, a mouse, an illuminator, a signal emitter, a microphone, and/or speakers.

Moreover, the user interface <NUM> and the display <NUM> may be integrated into a touch screen display. Accordingly, the display may also be used to show a graphical user interface, which can display various data and provide "forms" that include fields that allow for the entry of information by the user. Touching the screen at locations corresponding to the display of a graphical user interface allows the person to interact with the computing device <NUM> to enter data, change settings, control functions, etc. Consequently, when the touch screen is touched, the user interface <NUM> communicates this change to the processor <NUM>, and settings can be changed or user entered information can be captured and stored in the memory <NUM>. The display <NUM> may function as an illumination source to apply illumination to an object while image data for the object is captured.

For user interfaces <NUM> that include an illuminator, the illuminator may project visible light, infrared light or near infrared light on a biometric modality, and the camera <NUM> may detect reflections of the projected light off the biometric modality. The reflections may be off of any number of points on the biometric modality. The detected reflections may be communicated as reflection data to the processor <NUM> and the memory <NUM>. The processor <NUM> may use the reflection data to create at least a three-dimensional model of the biometric modality and a sequence of two-dimensional digital images. For example, the reflections from at least thirty thousand discrete points on the biometric modality may be detected and used to create a three-dimensional model of the biometric modality. Alternatively, or additionally, the camera <NUM> may include the illuminator.

The sensing device <NUM> may include Radio Frequency Identification (RFID) components or systems for receiving information from other devices in the system <NUM> and for transmitting information to other devices in the system <NUM>. The sensing device <NUM> may alternatively, or additionally, include components with Bluetooth, Near Field Communication (NFC), infrared, or other similar capabilities. Communications between the computing device <NUM> of the user and the ACMC <NUM> may occur via NFC, RFID, Bluetooth or the like only so a network connection from the computing device <NUM> is not necessary. Similarly, communications between the ACMC <NUM> and the AMC <NUM> may occur via NFC, RFID, Bluetooth or the like.

The verification server <NUM> can be, for example, any type of server or computer implemented as a network server or network computer and can include components similar those described herein with reference to the computing device <NUM>. More specifically, the verification server <NUM> can include components such as, but not limited to, one or more processors <NUM>, a memory <NUM>, a communications interface <NUM>, a bus <NUM>, a display <NUM>, and a user interface <NUM>. General communication between the components in the verification server <NUM> is provided via the bus <NUM>.

The processor <NUM> is similar to the processor <NUM> described herein with regard to the computing device <NUM>. Additionally, the memory <NUM> is similar to the memory <NUM> described herein with regard to the computing device <NUM>. However, the non-alterable or fixed memory can additionally be implemented using an optical ROM disc, such as a CD-ROM or DVD ROM disc. The memory <NUM> may be used to store any type of data, for example, user data records similar to those described herein for the memory <NUM>. The memory <NUM> may temporarily or permanently store image data including, but not limited to; photographs obtained from an external source, for example, an employer; photographs taken from a picture of the drivers license or other identity document of a user; and, photographs taken from the electronic record read from a passport chip or other electronic document of a user. The biometric templates created from such photographs may also be temporarily or permanently stored in the memory <NUM> and can be referred to as record biometric templates. Furthermore, the memory <NUM> can be used to store any type of software including, for example, the software described herein as being stored in the memory <NUM>.

The user interface <NUM> is similar to the user interface <NUM> described herein with regard to the computing device <NUM>. Moreover, the display <NUM> and communications interface <NUM> are similar to the display <NUM> and communications interface <NUM>, respectively, described herein with regard to the computing device <NUM>.

Information such as, but not limited to, test results for a pathogen, a vaccination card, biometric data, and government mandated immigration entry forms may be used as credentials. It is contemplated by the present disclosure that the verification server <NUM> may also create a credential from any of this information alone or in combination. For example, the verification server <NUM> can create biometric credentials from facial image data captured by the computing device <NUM>. The biometric credential can be transmitted to the computing device <NUM>.

Additionally, the verification server <NUM> can verify the identity of users, detect whether or not captured biometric modality data was taken of a live person and check user documents, for example, driver licenses and passports. Checking user documents includes, for example, conducting optical character recognition so information can be extracted from the document to determine the authenticity of the document and whether or not the credential has expired.

The ACMC <NUM> can be any wireless consumer electronic device capable of at least downloading applications over the Internet, running applications, capturing and storing data temporarily and/or permanently, conducting verification transactions and liveness detection, and otherwise performing any and all functions described herein by any computer, computer system, server or computing device included in the system <NUM>. One example of the ACMC <NUM> is a tablet computer. Other examples include, but are not limited to, a phablet computer, a laptop computer, and any type of consumer electronic device having wired or wireless networking capabilities capable of performing the functions, methods, and/or algorithms described herein. The ACMC <NUM> can be mounted to or otherwise connected to an access control mechanism (ACM) <NUM>. Additionally, the ACMC <NUM> can communicate with the ACM <NUM> via a wired or wireless connection. The AMC <NUM> is an electronic gate (eGate).

The ACMC <NUM> can obtain data stored in a chip of a document and can transmit the obtained data to a computer system, for example, the verification server <NUM> which can verify the identity of the user based on the obtained data. Alternatively, the ACMC <NUM> may verify the identity of the user utilizing the obtained data. For example, biometric template data stored in the chip of a document may be obtained and used to biometrically verify a user's identity. The ACMC <NUM> may also verify the identity of users, detect whether or not captured biometric modality data was taken of a live person and check user documents, for example, driver licenses and passports.

The data can be obtained from the chip using RFID, Bluetooth, NFC, infrared, or other similar capabilities. In response to the identity of a user being successfully verified, a message can be transmitted to the ACM <NUM> which causes a physical barrier such as a gate or turnstile to open and to permit access to a service. Thus, access control is enhanced.

The ACMC <NUM> can include components such as, but not limited to, one or more processors <NUM>, a memory <NUM>, a communications interface <NUM>, a bus <NUM>, a sensing device <NUM>, a display <NUM>, a user interface <NUM>, and a camera <NUM>. General communication between the components in the ACMC <NUM> is provided via the bus <NUM>.

The processor <NUM> and memory <NUM> are similar to the processor <NUM> and memory <NUM>, respectively, described herein with regard to the computing device <NUM>. Additionally, the memory <NUM> may be used to store any type of data, for example, data of a biometric modality captured during a verification transaction, data of a biometric modality of a user obtained from a document presented by the user, any other type of biometric data, and personal data about the user. Furthermore, the memory <NUM> can be used to store any type of software including the software described herein as being stored in the memory <NUM> as well as, for example, software for conducting verification transactions.

The communications interface <NUM>, sensing device <NUM>, and display <NUM> are similar to the communications interface <NUM>, sensing device <NUM>, and display <NUM>, respectively, described herein with regard to the computing device <NUM>. The camera <NUM> may be similar to the camera <NUM> in the computing device <NUM> or may be any camera suitable for capturing data of biometric modalities.

The user interface <NUM> can be similar to the user interface <NUM> described herein with regard to the computing device <NUM>. Additionally, the user interface <NUM> includes a scanner for scanning documents presented by users. By virtue of scanning a document, for example, a passport the ACMC <NUM> can capture information about the user associated with the passport and check whether the document is authentic and whether or not the document has expired. The ACMC <NUM> may also scan electronic tokens displayed by the computing device <NUM> of a user, and the scanned token and/or data related to the token may be communicated to another device included in the system <NUM>, for example, the verification server <NUM>. Alternatively, or additionally, the ACM <NUM> may scan and check documents, scan electronic tokens displayed by the computing device <NUM>, and may transmit the scanned data to other devices in the system <NUM>, for example, the verification server <NUM> and the ACMC <NUM>.

<FIG> is a top view of an example security checkpoint <NUM> that can be deployed at any location where security may be a concern. Such locations include, but are not limited to, transportation hubs, museums, banks, public libraries, convention centers, sports stadiums, office buildings, shopping malls, warehouses, and movie theaters. Example modes of transportation include, but are not limited to, airplanes, trains, subways, automobiles, and buses. Transportation hubs can be any facility that accommodates a mode of transportation and include, but are not limited to, airports, train stations, and bus depots.

The security checkpoint <NUM> can include, for example, ACMCs <NUM>, a lane or aisle <NUM> corresponding to the space between pairs of ACMCs <NUM>, and an area <NUM> for providing security services to users. The area <NUM> is an example location to which users may desire physical access in order to access the security services. The ACMs <NUM> may each include a mechanism <NUM> for preventing users from entering the area <NUM>. Such mechanisms <NUM> include, but are not limited to, a turnstile, an electronic door, and a swing gate. Although an ACMC <NUM> is shown mounted on two of the ACM's <NUM>, it is contemplated by the present disclosure that each ACM <NUM> may have a corresponding ACMC <NUM> mounted thereon or otherwise connected thereto.

Each lane or aisle <NUM> accommodates a queue of users desiring to pass through a respective pair of ACMs <NUM> to access the security service in the area <NUM>. The area <NUM> can also include a walk-through metal detector <NUM> for screening users and X-ray machines <NUM> for screening personal belongings. It is contemplated by the present disclosure that any deployment of the area <NUM> may include the metal detector <NUM> and X-ray machine <NUM>, the metal detector <NUM> or X-ray machine <NUM>, or neither the metal detector <NUM> nor the X-ray machine <NUM>.

The information shown in <FIG> is the same information shown in <FIG> as described in more detail below. As such, features illustrated in <FIG> that are identical to features illustrated in <FIG> are identified using the same reference numerals used in <FIG>.

<FIG> is a top view of another example security checkpoint <NUM> similar to the checkpoint <NUM> shown in <FIG>. However, each ACM <NUM> is located at the entrance to an aisle <NUM> which allows identifying a user without a valid electronic token before the user enters a queue. Thus, the number of users in a queue is facilitated to be reduced. As a result, user delays, inconvenience, and frustration are facilitated to be reduced. Moreover, with fewer users in the queue it is easier to practice social distancing to facilitate reducing transmission of pathogens between users.

People have been known to wait in lengthy time-consuming queues to access physical entities like transportation hubs, stadiums, and concert halls. In transportation hubs, queue lengths vary with fluctuating traveler volumes, traveler behavior, and resource constraints of transportation hubs, and are known to be particularly burdensome for travelers during or around holiday seasons and during inclement weather. Such burdensome queues may cause travelers to miss, for example, an airplane flight and perhaps a connecting flight resulting in inconvenient, frustrating delays. Additionally, hotels and individuals planning to collect the traveler may need to be notified of delays. Long burdensome queues have also been known to form and cause people to miss part of a sporting event or concert.

To address this problem, each user can utilize his or her computing device <NUM> to create and display an electronic token for scanning by the ACMC <NUM>. The electronic token can be created from any type of credential including, but not limited to, a biometric credential, a health credential, a reservation credential, a vaccination card, a test result for a pathogen, a government mandated immigration entry form, and any combination thereof. In one example embodiment, to address these problems the ACMC <NUM> can transmit the scanned token and/or data about the token, to the verification server <NUM> which can determine whether or not the token is valid. If valid, the verification server <NUM> can transmit a message to the ACMC <NUM> indicating the token is valid and the user associated with the token is authorized to pass through the ACM <NUM> and access the security service in the area <NUM>. Otherwise, if the token is invalid a message can be transmitted to the ACMC <NUM> indicating the token is invalid and the user is not authorized to access the security service area <NUM>. Thus, access control to the security service is enhanced.

In order to obtain an electronic token based on health and reservation credentials, each user can be required to obtain a health credential and a reservation credential before arriving at a location, for example, the area <NUM> in a transportation hub. Alternatively, users may obtain the credentials at the transportation hub but before attempting to pass through an ACMC <NUM>. The health credential can be obtained by satisfactorily completing a health questionnaire which is a series of questions about the health of the user. The questions may enquire about, for example, whether the user has been tested for a pathogen and if so the result and date of the test. Additional questions may include, but are not limited to, whether the user has a fever and has been in contact with a person infected with a pathogen. If the user has been in contact with a person infected with a pathogen, another question may enquire about the length of time since contact. It is contemplated by the present disclosure that the questionnaire may include any number of questions and that any question relating to the health of a user may be included.

A user may utilize his or her computing device <NUM> to download the questionnaire over the network <NUM> and to answer the questions. The answers can be transmitted to the verification server <NUM> to determine if the user constitutes a health risk to other users based on the answers. After determining the user does not constitute a health risk, an electronic health credential is created and transmitted to the computing device <NUM> of the user.

A user is considered a risk to other users when an answer indicates he or she may transmit a pathogen like the coronavirus to others. For example, it is recommended that people who may have been in contact with an infected person quarantine for fourteen days. Thus, a person who answers that he or she was in contact with an infected person within fourteen days of the travel date is considered a health risk to others.

It is contemplated by the present disclosure that the health credential be created no more than twenty-four hours before a user attempts to access, for example, the security service in the area <NUM>. Alternatively, the health credential may be created any period of time before attempting to access a service that inhibits the spread of a pathogen like the coronavirus.

The computing device <NUM> of a user can also be used to obtain an electronic reservation credential. More specifically, a user can operate his or her computing device <NUM> to reserve a period of time to wait in a queue and physically access the security service in the area <NUM>. The period of time may be, for example, fifteen minutes. Alternatively, the period of time may be of any duration that enables users to pass through the security checkpoint <NUM> without delay while ensuring social distancing and other health safety measures can be practiced. Such health safety measures include, but are not limited to, checking users for a fever. After reserving a period of time, the verification server <NUM> can create and transmit a reservation credential to the computing device <NUM> of the user. The reservation credential is valid during the reserved time only.

<FIG> is an enlarged plan view of the computing device <NUM> displaying buttons and/or icons. One button <NUM> includes a message that reads "Scan QR Code". The displayed button <NUM> is typically pressed, touched or otherwise operated when the user arrives at an ACM <NUM>. In response to the "Scan QR Code" button <NUM> being pressed, touched or otherwise operated, the computing device <NUM> can create an electronic token based on the health credential and the reservation credential of the user. The token can include, for example, the identifier of the user's computing device <NUM>, the user's email address, and any other information relating to the user. Additionally, it is contemplated by the present disclosure that the electronic token may be any type of token, including, but not limited to, a QR code and a bar code. The created electronic token can also be displayed by the computing device <NUM>.

The user presents the computing device <NUM> displaying the electronic token to the scanner in the ACMC <NUM>. The ACMC <NUM> scans the token and can transmit the scanned token and/or data about the token, to the verification server <NUM> which can determine whether or not the token is valid. If valid, the verification server <NUM> can transmit a message to the ACMC <NUM> indicating the token is valid and the user associated with the token is authorized to access the security service in the area <NUM>. In response, the ACMC <NUM> can transmit a message to the ACM <NUM> which causes the mechanism <NUM> to open and permit the user to access the security service in the area <NUM>. Additionally, the ACMC <NUM> can transmit a message to the computing device <NUM> and in response the computing device <NUM> may display a message indicating the user is authorized to access the security service in the area <NUM>.

Otherwise, if the token is invalid a message can be transmitted to the ACMC <NUM> indicating the token is invalid and the user is not authorized to access the security service in the area <NUM>. In response, the ACMC <NUM> does not transmit a message to the ACM <NUM> so the mechanism <NUM> does not open and the user is not granted access to the security service in the area <NUM>. The ACMC <NUM> may also transmit a message to the computing device <NUM> indicating the user is not authorized. In response, the computing device <NUM> may display a message indicating the user is denied access to the security service in the area <NUM>. The token is invalid when at least one of the health and reservation credentials is invalid.

Although the ACMC <NUM> can transmit the scanned token and/or data about the token to the verification server <NUM> after scanning the electronic token, the ACMC <NUM> may alternatively transmit the scanned token and/or data about the token to the computing device <NUM>. Thus, it is contemplated by the present disclosure that the computing device <NUM> may alternatively determine whether or not the token is valid and as a result that the user is authorized or not authorized to access the security service in the area <NUM>. The computing device <NUM> may transmit a message to the ACMC <NUM> indicating the user is authorized or not authorized to access the security service. After receiving the message, the ACMC <NUM> may communicate with the ACM <NUM> according to the received message and the mechanism <NUM> is operated according to the received message. Additionally, the computing device <NUM> may display a message indicating the user is authorized or not authorized to access the security service in the area <NUM>.

Although the button <NUM> includes a message that reads "Scan QR Code", the button <NUM> may alternatively include a message that reads "Show QR Code" when the token is a QR code or "Scan the bar code" or "Show the Bar Code" when the token is a bar code. Instead of the electronic token being created by the computing device <NUM> in response to the button <NUM> being touched, pressed or otherwise operated, the computing device <NUM> may communicate with the verification server <NUM> such that the verification server <NUM> creates the electronic token and transmits the token to the computing device <NUM> for display. Although the message is displayed as part of a button, it is contemplated by the present disclosure that the message may alternatively be displayed in any manner, for example, as large bold text across the display <NUM>. For such a message, the electronic token may be created when the large bold text is touched or pressed.

<FIG> is an enlarged plan view of the computing device <NUM> displaying a QR Code <NUM> created in response to pressing, touching or otherwise operating the button <NUM>.

<FIG> is an enlarged plan view of the computing device <NUM> displaying a message "ACCESS GRANTED" <NUM> which indicates that the user is authorized to access a service, for example, the security service. Alternatively, a message that reads "ACCESS DENIED" may be displayed when the user is not authorized to access a service. It is contemplated by the present disclosure that the computing device <NUM> may alternatively display any message that indicates the user is authorized or not authorized to access any location.

<FIG> is a top view of an example train platform <NUM> including a train <NUM> on each side of the platform <NUM>. The train is an example mode of transportation. Each train <NUM> includes standard cars <NUM> and a car <NUM> reserved for users who desire to practice social distancing from other users. The trains <NUM> may include any number of standard cars <NUM> and any number of reserved cars <NUM>. Additionally, a scanner <NUM> can be located at the entry to each car <NUM>. Some airports are known to use trains to transport people to and between terminals. Thus, it is contemplated by the present disclosure that the train platform <NUM> may be located in an airport or other transportation hub like a train station.

Users are required to present a valid electronic credential to access the reserved car <NUM>. Thus, as users arrive at a scanner <NUM> on the platform <NUM> he or she touches, presses or otherwise operates the button <NUM> to create and display an electronic token which is presented to the scanner <NUM> for scanning. Alternatively, the electronic token created for accessing the security service in the area <NUM> may be scanned. The electronic token for accessing the security service in the area <NUM> has a finite life, for example, half an hour. It is contemplated by the present disclosure that the life of the electronic token for accessing the security service in the area <NUM> may be any length of time in which a user may conveniently pass through the security checkpoint <NUM> and then board a reserved train car <NUM> without rushing, for example, within the range of about ten to forty-five minutes.

The scanner <NUM> can transmit the scanned token and/or data about the token, to the verification server <NUM> which can determine whether or not the token is valid. If valid, a message can be transmitted to the scanner <NUM> indicating the token is valid and the user associated with the token is authorized to board the car <NUM>. Otherwise, if the token is invalid a message is transmitted to the scanner <NUM> indicating the token is invalid and authorization to board the car <NUM> is denied. Thus, access control to the car <NUM> is enhanced.

Although the scanner <NUM> can transmit the scanned token and/or data about the token to the verification server <NUM> after scanning the electronic token, the scanner <NUM> may alternatively transmit the scanned token and/or data about the token to the computing device <NUM>. Thus, it is contemplated by the present disclosure that the computing device <NUM> may alternatively determine whether or not the token is valid and as a result determine that the user is authorized or not authorized to board the car <NUM>. The computing device <NUM> may also transmit a message to the scanner <NUM> indicating the user is authorized or not authorized to board the car <NUM>. After receiving the message, the scanner <NUM> permits or does not permit a user to board the car <NUM> according to the message. Additionally, the computing device <NUM> and/or the scanner <NUM> may display a message indicating the user is authorized or not authorized to board the car <NUM>. Thus, access control to the car <NUM> is enhanced.

<FIG> is an example method and algorithm for creating a health credential and a reservation credential according to an embodiment of the present disclosure. <FIG> illustrates example operations performed when the processor <NUM> executes software stored in the memory <NUM> and the processor <NUM> executes software stored in the memory <NUM> to create a health credential and a reservation credential.

The method and algorithm start in step S1, then in step S2 the software executed by the processor <NUM> causes the computing device <NUM> to record answers to a health questionnaire entered by a user and transmit the completed questionnaire to the verification server <NUM> via the network <NUM>. In response to receiving the completed questionnaire, in step S3, the software executed by the processor <NUM> causes the verification server <NUM> to determine if the user constitutes a health risk to others based on the completed questionnaire. The verification server <NUM> determines a user does not constitute a health risk when the answers in the completed questionnaire evidence the user presents little or no risk of facilitating transmission of a pathogen to others.

Upon determining the user constitutes a health risk to others, in step S4, the verification server <NUM> transmits via the network <NUM> to the computing device <NUM> a message indicating a health credential will not be created for the user. Next, in step S15, the method and algorithm end. However, upon determining the user does not constitute a health risk to others, in step S6, the software executed by the processor <NUM> causes the verification server <NUM> to create a health credential and transmit the health credential to the computing device <NUM> via the network <NUM>. The computing device <NUM> receives the health credential and can store the health credential in the memory <NUM>.

In step S17, the software executed by the processor <NUM> causes the computing device <NUM> to record a time period selected by the user for accessing a service, for example, the security service in the area <NUM> and transmits the selected time period to the verification server <NUM> using the network <NUM>. In step S8, the software executed by the processor <NUM> causes the verification server <NUM> to determine if the selected period of time is available by comparing the selected period against available periods of time. If the selected period is not available, in step S7, another period of time is selected. However, if the selected period is available, in step S9, the verification server <NUM> creates a reservation credential and transmits via the network <NUM> the reservation credential to the computing device <NUM>. The reservation credential can be stored in the memory <NUM>. Next, in step S5, the method and algorithm end.

Although the health credential is created and received by the computing device <NUM> before the reservation credential in the method and algorithm described herein with reference to <FIG>, it is contemplated by the present disclosure that the reservation credential may be created and received before the health credential. Moreover, it is contemplated by the present disclosure that the time between receiving and storing the health credential in the computing device <NUM> and selecting a time for accessing the security service in the area <NUM> may be any period of time.

<FIG> is an example method and algorithm for enhanced access control according to an embodiment of the present disclosure. More specifically, <FIG> illustrates example operations performed when the processor <NUM> executes software stored in the memory <NUM> and the processor <NUM> executes software stored in the memory <NUM> for enhanced access control to a service, for example, the security service in the area <NUM>.

The method and algorithm start in step S10, and then in step S11 the software executed by the processor <NUM> causes the computing device <NUM> to create an electronic token for the user based on the user's health and reservation credentials created according to the method and algorithm described herein with reference to <FIG>. More specifically, when the user arrives at the ACMC <NUM>, the user touches, presses or otherwise operates a button displayed by the computing device <NUM> that causes the computing device <NUM> to create an electronic token based on the user's health and reservation credentials. The button may be, for example, an icon that reads "Scan QR Code" or "Show QR Code" when the token is a QR code or "Scan the bar code" or "Show the Bar Code" when the token is a bar code. The electronic token may be any type of token, including, but not limited to, a QR code and a bar code. It is contemplated by the present disclosure that the token may include the user's email address, identifier of the computing device <NUM> associated with the user, and any other information relating to the user.

In step S12, the computing device <NUM> displays the electronic token for the ACMC <NUM> to scan, and the ACMC <NUM> transmits the scanned electronic token and/or data relating to the electronic token, to the verification server <NUM> using the network <NUM>. Next, in step S13, software executed by the processor <NUM> causes the verification server <NUM> to determine whether or not the health credential for the user was created within the preceding twenty-four hours. If not, in step S14, the verification server <NUM> determines the electronic token is invalid so user access to the security service in the area <NUM> is denied. Thus, access control to the security service is enhanced. Next, in step S15, the method and algorithm end.

However, if the health credential was created within the preceding twenty-four hours, in step S16, the software executed by the processor <NUM> causes the verification server <NUM> to determine whether or not the user's reservation credential is for the current time. If not, in step S14, the verification server <NUM> determines the electronic token is invalid so user access to the security service in the area <NUM> is denied. Thus, access control to the security service is enhanced. Next, in step S15, the method and algorithm end. It is contemplated by the present disclosure that when the health credential or the reservation credential is invalid, a message may be displayed by the computing device <NUM> indicating access to the security service in the area <NUM> is denied.

However, if the verification server <NUM> determines that the reservation credential is for the current time, the electronic token is considered valid. A message indicating the user is authorized to access the security service in the area <NUM> can be transmitted to the ACMC <NUM> and the computing device <NUM>. The message can be displayed by the computing device <NUM> for the user to see. Next, in step S17, the ACMC <NUM> transmits a message to the ACM <NUM> indicating the user is authorized to access the security service. In response the ACM <NUM> operates the mechanism <NUM> to permit access to the security service in the area <NUM>. Thus, access control to the security service is enhanced. Next, in step S15, the method and algorithm end.

Although the ACMC <NUM> transmits the scanned token and/or data about the token to the verification server <NUM> after scanning the electronic token in the method and algorithm described herein with regard to <FIG>, the ACMC <NUM> may alternatively transmit the scanned token and/or data about the token to the computing device <NUM>. Thus, it is contemplated by the present disclosure that the computing device <NUM> may alternatively determine whether or not the token is valid and as a result that the user is authorized or not authorized to access the security service in the area <NUM>. The computing device <NUM> may transmit a message to the ACM <NUM> indicating the user is authorized or not authorized to access the security service in the area <NUM>. After receiving the message, the ACM <NUM> operates the mechanism <NUM> according to the received message. Thus, access control to the security service is enhanced. Additionally, the computing device <NUM> may display a message indicating the user is authorized or not authorized to access the security service.

<FIG> is another example method and algorithm for enhanced access control according to an embodiment of the present disclosure. <FIG> illustrates other example operations performed when the processor <NUM> executes software stored in the memory <NUM> and the processor <NUM> executes software stored in the memory <NUM> for enhanced access control to a mode of transportation in a transportation hub, for example, the train <NUM>.

The method and algorithm start in step S16, and then in step S19 the software executed by the processor <NUM> causes the computing device <NUM> to display the electronic token created using the method and algorithm described herein with reference to <FIG>. The electronic token is scanned by the ACMC <NUM> which can transmit the scanned electronic token and/or data relating to the electronic token to the verification server <NUM> using the network <NUM>.

Next, in step S20, software executed by the processor <NUM> causes the verification server <NUM> to determine whether or not the user's health credential was created within the preceding twenty-four hours. If not, in step S21, the verification server <NUM> determines the health credential is invalid so access to the reserved train car <NUM> is denied and the user is not authorized to board the car <NUM>. Thus, access control to the car <NUM> is enhanced. Next, in step S22, the method and algorithm end. However, if the health credential was created within the preceding twenty-four hours, in step S23, the verification server <NUM> determines whether or not the user's reservation credential is for the current time. If not, in step S21, the verification server <NUM> determines the electronic token is invalid so access to the reserved train car <NUM> is denied and the user is not authorized to board the car <NUM>. Thus, access control to the car <NUM> is enhanced. Next, in step S22, the method and algorithm end. It is contemplated by the present disclosure that when the health credential or the reservation credential is invalid, a message may be displayed by the computing device <NUM> indicating the user is not authorized to board the reserved train car <NUM>.

However, if the verification server <NUM> determines that the reservation credential is for the current time, in step S24, the electronic token is deemed valid so the user is authorized to board the reserved train car <NUM>. A message indicating the user is authorized to board the train <NUM> may be displayed by the computing device <NUM>. Next, in step S22, the method and algorithm end.

Although the scanner <NUM> transmits the scanned token and/or data about the token to the verification server <NUM> after scanning the electronic token in the method and algorithm described herein with reference to <FIG>, the scanner <NUM> may alternatively transmit the scanned token and/or data about the token to the computing device <NUM>. Thus, it is contemplated by the present disclosure that the computing device <NUM> may alternatively determine whether or not the token is valid and as a result determine whether or not the user should be granted access to the car <NUM>. The computing device <NUM> may also transmit a message to the scanner <NUM> indicating the user is authorized or not authorized to board the car <NUM>. After receiving the message, the scanner <NUM> permits or does not permit a user to board the car <NUM> according to the message. Additionally, the computing device <NUM> and/or the scanner <NUM> may display a message indicating the user is authorized or not authorized to board the car <NUM>.

Although the health credential is deemed invalid if not created within the preceding twenty-four hours, it is contemplated by the present disclosure that the health credential may alternatively be created within any period of time before scanning the electronic token by the scanner <NUM> that enables reducing user inconvenience and frustration and inhibits the spread of a pathogen like the coronavirus. Although the electronic token is created based on the health and reservation credentials as described herein, it is contemplated by the present disclosure that the electronic token may alternatively be created based on any type or combination of credentials and that such credentials may be created from information different than health and reservation information.

Commercial and non-commercial entities like transportations hubs and governments are known to issue forms of identification to, for example, employees and people who use services provided at their facilities. One form of identification typically used is a badge which can be, for example, attached to clothing or attached to a chain put around a person's neck. Badges generally include, amongst other things, the name and photograph of the person to whom the badge was issued. Typically, badges are checked by an automated security system or by security personnel in order to access services provided at the facility. However, it is easy and inexpensive to make fraudulent badges, for example, by modifying a genuine badge to include a different name, photograph, or both. Fraudulent badges compromise security of facilities and of services available at the facilities.

To address this problem, the computing device <NUM> can display buttons that each correspond to a different service. When the computing device <NUM> receives input regarding a selected service, the credentials for the service can be transmitted to the ACMC <NUM>. In response to receiving the credentials, a camera can capture facial image data of a user and a determination can be made regarding whether the facial image data was taken of a live person. If the facial image data was taken of a live person, a verification transaction can be conducted based on the credential and the facial image data. When the user is successfully verified, the user can be granted access to the selected service.

If the liveness detection or the verification transaction are unsuccessful, the user is not authorized to access the selected service. Thus, access control to the selected service is enhanced.

<FIG> is an enlarged plan view of the computing device <NUM> displaying example buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> that are each for accessing a different service. More specifically, the buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> are for accessing the security service, a university dormitory, a convention center, a sports stadium, a museum, and a movie theater, respectively. Although six example buttons are displayed by the computing device <NUM>, it is contemplated by the present disclosure that any number of buttons may be displayed. Moreover, the buttons may be scrolled up and/or down to display additional different buttons.

In order to access the service associated with each button, the credentials for accessing the service should be provided. Thus, each of the buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> corresponds to one or more credentials required for accessing the respective service. More specifically, the button <NUM> corresponds to one or more credentials required to access the security service, the button <NUM> corresponds to one or more credentials required to access services available at a university dormitory, the button <NUM> corresponds to one or more credentials required to access services at a convention center, the button <NUM> corresponds to one or more credentials required to access services available at a sports stadium, the button <NUM> corresponds to one or more credentials required to access services available at a museum, and the button <NUM> corresponds to one or more credentials required to access services available at a movie theater.

Credentials can be any information about a person including, but not limited to, test results for a pathogen, a vaccination card, biometric data, a biometric credential, and government mandated immigration entry forms. It is contemplated by the present disclosure that the verification server <NUM> may also create a credential from any of this information alone or in combination. For example, the verification server <NUM> can create biometric credentials from facial image data captured by the computing device <NUM>.

It is contemplated by the present disclosure that any of the credentials may be used for accessing any of the services. That is, the credentials may be mixed and matched to access any of the services. For example, the credentials for accessing the sports stadium and convention center may be a biometric credential and a vaccination card evidencing vaccination against a pathogen. Additionally, the credentials for accessing the museum may be a positive test result for a pathogen and a vaccination card while the credentials for accessing the university dormitory may be a biometric credential only.

Services available at a convention center include, but are not limited to, entertainment services like a concert. Services available at a sports stadium include, but are not limited to, entertainment services like baseball games and concerts. Services available at a museum include, but are not limited to, educational services. Services available at a movie theater include, but are not limited to, entertainment services like movies.

The computing device <NUM> may be operated to display the buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> when the user desires access to any of the services. For example, when access to a dormitory is desired the button <NUM> is pressed, touched or otherwise operated to thus enable accessing the dormitory. As a result of pressing, touching, or otherwise operating a button <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, the user enters input that selects a service.

The credential for accessing the security service in the area <NUM> may require biometric modality data and thus be considered a biometric credential. A biometric credential may be encrypted biometric data cryptographically signed, for example, by the verification server <NUM> or the ACMC <NUM> to evidence the provenance of the credential and that the credential has not been modified since creation. Additionally, biometric credentials can include a unique identifier for the user whose biometric template or biometric modality data is included in the credential. The unique user identifier is a string of characters, for example letters or numbers. The unique user identifier may include any type of character and may be, for example, all numbers, all letters, and alphanumeric. The unique user identifier may be of any length.

<FIG> is an example method and algorithm for creating a biometric credential. <FIG> illustrates example operations performed when the processor <NUM> executes software stored in the memory <NUM> and the processor <NUM> executes software stored in the memory <NUM> to create a biometric credential.

The method and algorithm start in step S25 and then in step S26 the software executed by the processor <NUM> causes the computing device <NUM> to capture biometric data of a user and capture data of an identity document provided by the user, for example, a driver's license or a passport. The captured data includes facial image data and image data of the identity document. The captured data can be transmitted via the network <NUM> to the verification server <NUM>. Alternatively, the captured data can be transmitted via the network <NUM> to the ACMC <NUM>. Instead of transmitting the captured data, information about the captured data may be included in a QR Code which is transmitted to the verification server <NUM>.

In this example method, the biometric data is biometric modality data of the user and the biometric modality is face. In step S27, the software executed by the processor <NUM> causes the verification server <NUM> to perform optical character recognition on the identity document image to determine if the document is genuine and has not expired. If the document is not genuine or has expired, a biometric credential is not created and, in step S28, the method and algorithm end. However, if the document is genuine and has not expired, in step S29, the software executed by the processor <NUM> causes the verification server <NUM> to determine whether or not the captured biometric data was taken of a live person using, for example, three-dimensional (3D) camera systems based on structural light techniques, depth perception techniques, and passive user liveness detection techniques, or any combination of these or other liveness detection techniques. Passive liveness techniques analyze biometric modality data, for example, facial image data, for artifacts indicative of a spoofing attack. For facial image data artifacts include, but are not limited to, a mask in an image, an imbalance in color in an image, less resonance in the facial area of an image compared to other areas of the image, and anything that is not a face, for example, a TV, car radio, or a computer printer.

When the captured biometric data is deemed not taken of a live person, the biometric data is considered to have been provided by an imposter so a credential is not created and, in step S28, the method and algorithm end. However, when the biometric data is deemed to have been taken of a live person, in step S30, the software executed by the processor <NUM> causes the verification server <NUM> to conduct a verification transaction. More specifically, the verification server <NUM> creates a biometric template from the captured biometric data and compares the created biometric template against a corresponding record biometric template for the user and calculates a matching score for the comparison. When the matching score is less than a threshold score, a biometric credential is not created, instead, in step S28 the method and algorithm end.

However, when the matching score at least equals the threshold score, in step S31, the verification server <NUM> cryptographically signs the created biometric template and couples the signed biometric template with a unique identifier to create a biometric credential. The created biometric template is cryptographically signed to evidence the provenance of the credential and that the credential has not been modified since creation. The verification server <NUM> can transmit via the network <NUM> the biometric credential to the computing device <NUM> which can store the credential in the memory <NUM>. Next, in step S28, the method and algorithm end.

It is contemplated by the present disclosure that the ACMC <NUM> may alternatively implement all or some of the operations described herein as being performed by the verification server <NUM> in the method and algorithm described herein with regard to <FIG>. For example, the ACMC <NUM> can receive the captured data, check that the identity document is genuine and current, confirm the captured biometric data was taken of a live user, and conduct the verification transaction. As another example, the ACMC <NUM> can receive the captured data, check that the identity document of the user is genuine and current, and confirm the captured biometric data was taken of a live user, while the verification server <NUM> conducts the verification transaction.

Communication between the computing device <NUM> of the user and the ACMC <NUM> may occur via NFC, RFID, Bluetooth and the like only so a network connection from the computing device <NUM> is not necessary.

<FIG> is yet another example method and algorithm for enhanced access control according to another embodiment of the present disclosure. More specifically, <FIG> illustrates example operations performed when the processor <NUM> executes software stored in the memory <NUM> and the processor <NUM> executes software stored in the memory <NUM> for enhanced access control to a service, for example, entertainment services available at a movie theater.

The method and algorithm start in step S32, and then in step S33 the software executed by the processor <NUM> causes the computing device <NUM> to display buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> that each correspond to a different service. In step S34, the computing device <NUM> receives input regarding a selected service. Typically, a user presses, touches or otherwise operates one of the buttons <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> to select the service to which access is desired. For this example method, access to entertainment services available at a movie theater is desired, so the button <NUM> is touched, pressed or otherwise operated to select entertainment services available at a movie theater.

Next, in step S35, the computing device <NUM> creates an electronic token based on the credentials for the selected service, and displays the token which is presented to the ACMC <NUM>. The user can move the computing device <NUM> so the displayed token is scanned by the ACMC <NUM>. Alternatively, the token can be scanned by the ACM <NUM>. In step S36, the computing device <NUM> transmits the credentials for the selected service to the ACMC <NUM>. The credentials for the entertainment services available at the movie theater include a biometric credential of the user.

In step S37, the camera <NUM> of the ACMC <NUM> captures facial image data of the user and the software executed by the processor <NUM> causes the ACMC <NUM> to determine whether or not the facial image data was taken of a live person. More specifically, the software executed by the processor <NUM> causes the ACMC <NUM> to analyze the facial image data using passive liveness detection. Passive liveness techniques analyze the captured biometric modality data for artifacts indicative of a spoofing attack. Artifacts include, but are not limited to, a mask in an image, an imbalance in color in an image, less resonance in the facial area of an image compared to other areas of the image, and anything that is not a face, for example, a TV, car radio, or a computer printer.

If the facial image data is deemed not taken of live user the facial image data is considered the result of a spoof attack. As a result, in step S39, user access to the selected service is denied so the user is not permitted through the ACM <NUM>. Thus, access control to the selected service is enhanced. Next, in step S40, the method and algorithm end.

However, if the facial image data is deemed to be of a live person, in step S41, the ACMC <NUM> creates a biometric template from the captured facial image data, extracts the biometric template of the user from the biometric credential of the user, compares the created and record templates against each other, and calculates a matching score for the comparison. If the matching score is less than a threshold score, the identity of the user is not verified as true, so in step S39 user access to the selected service is denied. Thus, access control to the selected service is enhanced. Next, in step S40, the method and algorithm end.

However, if the matching score at least equals the threshold score the identity of the user is verified as true. That is, the identity of the user is successfully verified so the user is granted access to the selected service. More specifically, in step S42, the ACMC <NUM> can transmit a message to the computing device <NUM> indicating the user is granted access to the selected service, and can discard the credentials for the selected service and the captured facial image data. The message can be displayed by the computing device <NUM> for the user to see. The message may also be transmitted to, for example, the ACM <NUM> or other access control device. In response to receiving the message, the ACM <NUM> can operate the mechanism <NUM> to facilitate access to the selected service. Thus, access control to the selected service is enhanced. Next, in step S40, the method and algorithm end.

It is contemplated by the present disclosure that some or all of the operations performed by the ACMC <NUM> with regard to the method and algorithm described herein with regard to <FIG>, may alternatively be performed by the verification server <NUM>.

Using the methods and algorithms for enhanced access control facilitates reducing user delays and related user inconvenience and frustration associated with accessing desired services, facilitates reducing risks that users will contract a pathogen like the coronavirus while accessing a desired service, for example, traveling, and enhances security.

The example methods and algorithms described herein may be conducted entirely by the computing device <NUM>, partly by the computing device <NUM> and partly by the verification server <NUM> via the network <NUM>, or partly by the computing device <NUM> and the ACMC <NUM> via the network <NUM>. Additionally, the methods and algorithms described herein may be conducted partly by the computing device <NUM>, partly by the verification server <NUM> and partly by the ACMC <NUM> via the network <NUM>. For example, the ACMC <NUM> may determine whether the facial image data was taken of a live person while the verification server <NUM> may conduct verification transactions, or vice versa. Moreover, the example methods described herein may be conducted entirely on other computer systems (not shown) other computing devices <NUM> (not shown). Thus, it should be understood that it is contemplated by the present disclosure that the example methods and algorithms described herein may be conducted using any combination of computers, computer systems, and computing devices (not shown). Furthermore, data described herein as being stored in the memory <NUM> may alternatively be stored in any computer system (not shown) or computing device <NUM> (not shown) operable to communicate with the computing device <NUM> over the network <NUM>.

Additionally, the example methods and algorithms described herein may be implemented with any number and organization of computer program components. Thus, the methods and algorithms described herein are not limited to specific computer-executable instructions. Alternative example methods and algorithms may include different computer-executable instructions or components having more or less functionality than described herein.

Claim 1:
A method for enhanced access control comprising the steps of:
displaying, by an electronic device, buttons, each button corresponding to a different service, and each of the buttons corresponding to at least one credential required for accessing the respective service;
causing, in response to one of the buttons being operated, the electronic device to receive input regarding a selected service, wherein the at least one credential required to access said selected service comprises test results for a pathogen;
transmitting the at least one credential for the selected service to a computer;
capturing, by a camera in communication with the computer, facial image data of a user;
analyzing the facial image data for artifacts indicative of a spoofing attack;
in response to analyzing the facial image data and determining that the analyzed facial image data is free of artifacts indicative of a spoofing attack, determining that the facial image data was taken of a live person;
in response to determining the facial image data was taken of a live person, conducting a verification transaction based on the at least one credential and facial image data; and
in response to verifying the identity of the user as true, operating an electronic gate to grant the user access to the selected service.