Method and system for access control and awareness management

Abstract

Methods and systems for access control and awareness management are provided. The disclosed system can facilitate multi-unit real estate management using mobile devices, local mesh networks, access control devices, and wireless communications. Mobile devices can download and use credentials to access appropriate areas and units in a building through local wireless communications with access control devices.

Description

[0001] This application is a divisional application of the patent application with application number "201780068142.3", application date "September 6, 2017", and title "Method and system for access control and awareness management".

[0002] Related Applications

[0003] This application claims priority to U.S. patent application No. 15 / 257,750, filed on September 6, 2016, entitled “METHODS AND SYSTEMS FOR ACCESS CONTROL AND AWARENESS MANAGEMENT,” which is a continuation-in-part of and claims the benefit under 35 U.S.C. §120 of U.S. patent application No. 14 / 589,805, filed on January 5, 2015, entitled “METHODS AND SYSTEMS FOR MULTI-UNIT REAL ESTATES MANAGEMENT,” which claims the benefit under 35 U.S.C. §119(e) of U.S. Provisional Application No. 61 / 923,643, filed on January 4, 2014, entitled “A system of multi-unit real estate management,” the contents of which are incorporated herein by reference in their entirety. Technical Field

[0004] The present invention relates to systems and methods for access control management designed for multi-unit buildings. Background Art

[0005] There is an ongoing need to manage access for various parties involved in the occupancy and operation of multi-unit buildings. Access management can have a significant impact on overall security, legal liability, and personal comfort, for example. Security in multi-unit buildings is an important and complex issue, particularly the management of keys that can grant access to building units and common spaces. Each individual unit in a building may have different access control requirements, and occupants or other individuals associated with the operation and maintenance of these buildings may periodically need to access different facilities within the building to perform specific functions, such as package deliveries or cleaning.

[0006] Over time, various systems have emerged to help manage these types of environments. Prior art physical key management systems, while effective when operated correctly, can be expensive and cumbersome for most users. For example, installation costs and the costs and time associated with training employees on the systems can be high. Additionally, high ongoing costs associated with maintenance and poor compliance with system policies can render these systems ineffective.

[0007] Other prior art systems provide digital access control management through radio frequency identification (RFID) or other types of magnetic or electronic keys centrally controlled by a management interface. Such prior art systems allow door control and management from a central server, while users can authenticate and gain access through the use of a "numeric keypad" and "card reader" on site. These systems require locally deployed management hardware, which creates security risks. For example, when digital codes are shared between authorized and unauthorized parties as a form of convenience, numeric keypads are often insecure.

[0008] Using biometric identifiers for authentication purposes is an alternative to access control PIN codes or badges. However, the use of biometric locks is difficult to manage in a multi-unit environment. For example, collecting biometric data (such as fingerprints) and storing and programming them into an access control system can be complex. In addition, the storage of biometric data can be costly for a typical building owner due to the additional security requirements associated with the storage of sensitive biometric data. In addition, users may become uncomfortable when they are asked to provide biometric data for authentication and storage.

[0009] Other prior art systems utilize a mobile phone or other mobile device as a physical identifier for a single owner building or a single unit. These systems allow the user's mobile phone to be used as an authentication identifier when interacting with the access control system through a network connection or a locally transmitted radio frequency connection. Systems utilizing mobile devices typically require a persistent Internet connection to operate, which may be suitable for a single owner building. However, for multi-unit buildings, this can become quite problematic.

[0010] Bluetooth is another communication standard employed in some prior art systems for providing tracking suitable for following a user within a confined space using a Bluetooth-enabled device. However, in those systems, Bluetooth communications are only used to track a user to create a timeline of activities for the user through a silent and imperceptible handshake between the user's device and hardware installed within a geographic area. Other prior art systems utilize Bluetooth technology to distribute and manage keys, but they require that access control points be centrally updated with new information to update new keys and users added to the system. Finally, other Bluetooth-enabled prior art systems use rotating authentication credentials that do not require updates from a central server; however, they present security risks.

[0011] Therefore, there is a need for a secure access management system for multi-unit buildings that can control interactions between occupants, visitors, service providers, and building owners that is not provided by prior art systems. Summary of the invention

[0012] A system and method for secure access control management are provided, which include an access control point, a mobile device, a local mesh network, and a unified credential system.

[0013] According to aspects of the present invention, an exemplary access control management system may include a plurality of access control devices, each of which includes a wireless transceiver and a wireless transmitter. When a mobile device is within the range of the access control device, each access control device may communicate with the mobile device and control a locking mechanism in response to a wireless signal received from the mobile device. Access control devices and mobile devices within the range of any access control device in the system may form a local mesh network. In the local mesh network, the access control device may communicate with mobile devices and other access control devices in the system. The mobile device may store credentials that may control access to one or more access control devices and may unlock a locking mechanism controlled by one or more access control devices. According to aspects of the present invention, mobile devices of other approved users may receive credentials to their mobile devices, which may also grant permission to unlock a locking mechanism controlled by one or more access control devices. The mobile device may also store system updates and may be configured to transmit system updates to access control devices within the range via wireless signals. The access control device may transmit the received system updates to other access control devices within the range via the local mesh network.

[0014] According to an alternative embodiment of the present invention, an exemplary method for access control management may include providing a plurality of access control devices each including a wireless transceiver and a wireless transmitter, each access control device being capable of communicating with a mobile device and being capable of controlling a locking mechanism in response to a wireless signal received from the mobile device when the mobile device is within range of the access control device. The method may also include: forming a local mesh network in the system by coupling access control devices within range of each other and mobile devices within range of any access control device. The method may also include: storing credentials by the mobile device, the credentials being capable of controlling access to one or more access control devices and unlocking a locking mechanism controlled by one or more access control devices in response to a wireless signal transmitted by the mobile device. The method may also include providing credentials to mobile devices of other approved users to be granted permission to unlock a locking mechanism controlled by one or more access control devices. The method may also include storing a system update by the mobile device and transmitting the system update to an access control device within range of the mobile device via a wireless signal. The method may also transmit the received system update to other access control devices within range via the local mesh network by the access control device.

[0015] According to an alternative embodiment of the present invention, a mobile device for providing access control management may be configured to communicate with multiple access control devices each including a wireless transceiver and a wireless transmitter when the mobile device is within the range of the access control device. The mobile device may also be configured to control the locking mechanism in one or more access control devices within the range by a wireless signal sent from the mobile device. The mobile device may also be configured to log into a local mesh network of access control devices within the range of each other and within the range of other mobile devices. The mobile device may also be configured to store credentials that can control access to one or more access control devices and unlock the locking mechanism controlled by one or more access control devices. The mobile device may also be configured to provide credentials to the mobile devices of other approved users to be granted permission to unlock the locking mechanism controlled by one or more access control devices. The mobile device may also be configured to store system updates and transmit the system updates to the access control devices within the range of the mobile device via wireless signals. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1A An exemplary access control management system according to an embodiment of the present invention is shown.

[0017] Figure 1B An exemplary system architecture for an access control management system according to an embodiment of the present invention is shown.

[0018] Figure 2 An exemplary access control device according to an embodiment of the present invention is shown.

[0019] Figure 3 An exemplary method for providing visitor access to a multi-unit building according to an embodiment of the present invention is shown.

[0020] Figure 4 An exemplary method for setting a security level for access control management according to an embodiment of the present invention is shown.

[0021] Figure 5 An exemplary method for providing access to a multi-unit building according to an embodiment of the present invention is shown.

[0022] Figure 6 An exemplary method for updating components of an access control management system according to an embodiment of the present invention is shown.

[0023] Figure 7 An exemplary device communication encryption process according to an embodiment of the present invention is shown.

[0024] Figure 8 An exemplary method for tracking building utilization information according to an embodiment of the present invention is shown.

[0025] Fig. 9 An exemplary method for configuring an access control management system according to an embodiment of the present invention is shown.

[0026] Figure 10-12 Exemplary screenshots of an application running on a mobile device for providing access control management according to an embodiment of the present invention are shown.

[0027] Figures 13A-13C An exemplary access control management system according to an embodiment of the present invention is shown.

[0028] Fig.14 An exemplary method for providing access to a zone according to an embodiment of the present invention is shown.

[0029] Figures 15A-15B An exemplary access control management system according to an embodiment of the present invention is shown.

[0030] Figure 16-17 An exemplary access control management system according to an embodiment of the present invention is shown.

[0031] Fig.18 An exemplary method for managing access to a zone according to an embodiment of the present invention is shown.

[0032] Fig.19 An exemplary access and awareness control method according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] According to an embodiment of the present invention, a method and system for access control management designed for multi-unit buildings are provided. The exemplary system can replace a physical key management system using mobile devices, local mesh networks, installed access control hardware, communication standards, and a credential layer. In addition, the disclosed system can eliminate the need for physical keys or access cards and rekeying faced by many operators in the multi-unit real estate management industry.

[0034] Figure 1A An exemplary access control management system is shown. Specifically, the system 100 may include: one or more access control devices (102, 104, and 106), at least one mobile device 108 configured to communicate with the access control device via a wireless communication protocol 110, and a local mesh network constructed by the access control devices (102, 104, and 106) and the mobile devices 108. The access control device can communicate with other access control devices within range, for example, via a wireless communication protocol 112, which can be of the same type as the wireless communication protocol 110. It will be appreciated by those of ordinary skill that the local mesh network can be a dynamic network in which mobile devices become part of the network when they come within range of an access control device and leave the network when they leave the range of all access control devices in the network. The access control devices (102, 104, and 106) may be off-the-shelf, custom-made, or retrofitted hardware devices (e.g., wireless sensors added to existing hardware or bolted onto an attachment to an existing mechanical lock) that may be installed in various access points in a multi-unit building, including, but not limited to, building entry doors, auxiliary entry doors, auxiliary service doors, common room area doors, gym doors, individual unit doors, doors within units, and other relevant entry points. The mobile device 108 may include a smartphone, tablet, phablet, or other custom wireless communication-enabled device that may communicate with the access control devices (102, 104, and 106) via a wireless local communication protocol 110, such as Bluetooth, Z-wave, ZigBee, Thread, or other radio frequency (RF) communication network. The mobile device 108 may also store user credentials that may be paired with the user mobile device 108.

[0035] According to an embodiment of the present invention, a local mesh network can connect an access control device to a mobile device to activate various functions as described in detail below. According to aspects of the present invention, a credential can be a digital file of encrypted code lines. When a credential is paired with a user mobile device, the credential can provide authentication and authorized access to the user. For example, the access control device 102 can grant access to the following unit, which can be owned or rented by a tenant carrying a mobile device 108 and storing appropriate credentials. When a user approaches their unit, the access control device 102 and the user mobile device 108 can wirelessly communicate to grant access rights to the unit to the user, such as unlocking a door. In addition, a single credential can grant a user access to all buildings and institutions implementing the disclosed system. For example, a user can use the credential stored in their mobile device to access their office, their gym, their private club, or any area where an access control device that can control access to a secure area has been installed. Users can conveniently manage all of their access, visitors, and service provider supplies through the same interface (e.g., a website or an app running on their mobile phone).

[0036] According to aspects of the present invention, Figure 1B An exemplary system architecture is shown in FIG. Figure 1BA server 152 is shown in communication with a database 154 and also in communication with a building manager device 156, a user mobile device 158, a visitor mobile device 160, and a service provider device 162. The server 152 can generate and manage credentials that can be stored in the database 154. A building manager using a device 156 (e.g., a computer, tablet, or cell phone) can request from the server 152 that credentials be generated for a user (e.g., a new building tenant) according to user-specific access rules. When requesting credential generation, the building manager can specify access rules for a particular user, such as granting access to a user unit, granting access to a building gym, etc. The building manager can modify the access rules at any time, such as when a user's gym membership has expired, and the building manager can request new credentials for the user from the server 152 through an interface running on the building manager device 156. The user can receive the credentials from the server 152 and can store the credentials in the mobile device 158. According to the rules specified by the building manager, the server can allow different rights to the user. For example, the server can enable a user to grant access to its building to its visitors. The user can use the application running on the mobile device 158 to request from the server 152 to generate the credentials for their visitors using the mobile device 160. For example, the user can use the access control management app to send the visitor an invitation to an event that occurs in their building. According to aspects of the present invention, the credentials can be requested automatically. Once the server 152 generates the credentials, it can send it to the visitor mobile device 160. The visitor mobile device 160 and the generated credentials will be paired, and the authentication of the visitor can be provided. The visitor can then use their mobile device 160 to access the building and the unit. For example, the server can enable the user to grant access to its building to its visitors. The user can also use the application running on the mobile device 158 to request from the server 152 to generate the credentials for the service provider using the mobile device 162. The service provider mobile device 162 and the generated credentials will be paired, and the authentication of the service provider can be provided.

[0037] It will be understood by those of ordinary skill that the disclosed systems and methods are implemented using mobile devices and more specifically through the specific characteristics of mobile devices and how people interact with their mobile devices. For example, people carry mobile devices with them all the time. Mobile devices are turned on most of the time and can passively communicate with sensors in their environment without the need for active user participation. In addition, mobile devices have a wide variety of radio frequency communication capabilities through built-in hardware, making them ideal for communicating through different types of communication standards. Mobile devices can install and run the following applications or apps, which enable functions that are not available through website browsers running on computers (for example, by utilizing device-specific hardware attributes such as radios, cameras, and security biometric sensors). In addition, mobile devices can be automatically updated in the background without the need for active user participation to provide updated security keys, instructions, and permissions.

[0038] According to an embodiment of the present invention, a local mesh network eliminates the need for a persistent Internet connection. As described above, other prior art methods require that the access control device is always connected to the Internet. In contrast, the disclosed system can link the access control device with the mobile device through a local mesh network. The mobile device can provide a bridge to the Internet for the entire mesh network. For example, compared to a system that requires a persistent Internet connection to operate and update the access control device, this allows the access control system to be operated at low cost and with minimal power requirements. In the described system, the access control devices can be connected to each other, and the system can utilize a handshake performed between the user device and the access control device to deliver any system updates to the access control device. The user device typically has an Internet connection and sufficient capacity to utilize the installed access control hardware to passively deliver system update data packets through the required handshake process. Therefore, for the access control device, there is no additional requirement for the installation of a persistent Internet connection.

[0039] Figure 2 An exemplary access control device is shown in . Specifically, the access control device 200 may include a wireless communication module 202, which is configured to communicate with a user's mobile device and other access control devices in its vicinity via a wireless transmitter and a wireless receiver. Communications from the user device may involve granting access to a particular area or unit to the user of the mobile device. In addition, communications from the user device and other access control devices may also involve system updates. The access control device 200 may also include a long-life battery 204 and a handle 206 to move a latch 208 and unlock a passage lock, deadbolt, or other locking mechanism, such as a door, to the user's unit. The access control device 200 may also include a digital display 210 to provide information to the user. Those skilled in the art will appreciate that Figure 2The access control devices are for illustration purposes only, and other types of access control devices may be used.

[0040] According to aspects of the present invention, each access control device may have a unique identification (ID) that can identify them in the system. For example, the access control ID may be based on the MAC address of the access control device radio. The server 152 may maintain an encryption key table that may be indexed by the access control device ID. Each credential associated with the access control device ID may be configured into an appropriate lock during installation. When access to the lock is requested, the appropriate credential may be securely transmitted to an application running on a mobile device, for example using a secure transmission such as SSL / TLS, and the credential may be stored in the mobile device. The credential may be used to generate an authenticated unlock request, for example using an unlocking protocol. When a user requests a credential, for example, for a visitor or service provider, from a server, the server may determine the appropriate credential to be sent to the visitor or service provider. The server determines the appropriate credential based on the authenticated user requesting the credential. For example, a user may be authenticated in the system by user account authentication, for example, by providing user details when setting up an account using the system.

[0041] According to an embodiment of the present invention, the disclosed access control device may have pre-installed keys, such as authentication information. These pre-installed keys may be pre-installed at the access control device from the factory, may be stored in the access control device during installation, or may be updated regularly or occasionally. These keys may also be mirrored in a server, which may generate credentials for a user or visitor. This may enable the use of the access control system even when the access control device is intermittently connected or not connected to the Internet or a local area network. Based on the keys stored in the access control device, the keys mirrored on the server may generate appropriate credentials that may grant access to the area controlled by the access control device.

[0042] According to embodiments of the present invention, the systems and methods described herein eliminate the need for physical key management. For example, the system enables a building manager to create account holders within a given multi-unit building without regard to the issuance of physical keys. Once a user-tenant has an account, they are responsible for managing their own keys, whether in the form of a mobile device or a third-party device of supplied RF-enabled hardware. Thus, a building manager may no longer be burdened with, for example, visitor access management, because the disclosed system may enable the user-tenant to be responsible for all aspects of visitor access management.

[0043] This is Figure 3300 is generally shown in FIG. When a visitor of a unit owner / tenant in a multi-unit building arrives at the building, he can request access to the unit (step 302). The visitor and the owner can then enter a transaction, for example, through a mobile device application or app (step 304). As an illustrative example, the access request from the visitor can appear as a notification from an app running on the user's mobile device. The owner can then determine whether to grant access to the visitor (steps 308 and 310). If the owner decides to grant access to the visitor, the owner can optionally specify a time period during which the visitor will access the unit (step 312). The visitor then receives the necessary credentials for the building (step 314), which will authorize the visitor's mobile device to provide access to the building and all necessary access points up to the user's unit (step 316). When the visitor's mobile device moves within the vicinity of the access notification point of the user's unit (step 318), the access control point sensor can detect the visitor's device (step 320), which will allow the visitor to access the unit (step 322). Since the user can receive notification and authorize access to the visitor through an application running on a mobile device, the user can authorize access to the visitor from anywhere without the user having to be present in the unit. It will be appreciated by those of ordinary skill that the visitor can be authorized access even before the visitor arrives at the building, and that access can be automatically granted (e.g., in the case of authorized deliveries or repairs).

[0044] In addition to providing access to units, users can also provide access credentials to their guests with appropriate constraints, allowing them to describe which facilities the visitor can access throughout the building with time limits and other binding characteristics. This can improve the user experience for both those occupying the building and those visiting the building, creating value for building managers.

[0045] According to embodiments of the present invention, the system can be viewed and managed through a dedicated and secure portal to the server on any number of devices, including computers, mobile devices, and other interfaces. For example, building managers and users with appropriate privileges can provide, remove, or modify privileges and access rights for visitors and service providers through a web page or application securely connected to the server.

[0046] As described above, some prior art systems based on PINs face security challenges because digital codes can be easily shared between authorized and unauthorized parties. Although users will still likely share their mobile devices with visitors for verification purposes, the essential and multi-purpose nature of mobile devices will provide limiting elements for this type of behavior. Security is important for operators and users in multi-unit buildings, and the system described herein allows for the implementation of a variety of security levels, which can further enhance security, which goes beyond the advantages presented by simply using the user's mobile device for authentication. These security elements range from single-level authentication (the presence of the user's mobile device) to three-level authentication activated by the presence of the user's mobile device, the use of memorized passwords (possibly entered on the user's mobile device), and biometric scanning (possibly provided by the user's mobile device). When setting their own preferences and preferences for their visitors, managers or individual users can activate this flexible security capability on a building-wide basis.

[0047] Figure 4 This hierarchical authentication system is shown. Specifically, Figure 4 An exemplary method 400 for setting a security level for access control management is shown. For example, a user may access security preferences through an app running on a mobile device or a web page (step 402). The user may then select a security level for a particular visitor or service provider (step 404). As described above, the user may select a single-level authentication 406, which may require authentication only by proximity 412. For example, a visitor with a mobile device that has received appropriate credentials may be authorized to access the unit when the mobile device and the access control device are within an appropriate distance (414).

[0048] Alternatively, the user can select a two-level authentication 408, which can require authentication by approaching 416 and by entering a PIN 418. For example, a visitor with a mobile device that has received appropriate credentials can be granted access to the unit (420) when the mobile device and the access control device are within an appropriate distance and after the visitor enters a PIN, for example, in a prompt on the mobile device. The PIN can be provided to the visitor by the user. According to aspects of the present invention, the user can set a separate PIN for each visitor so that a specific visitor mobile device is paired with a unique PIN to increase security. The access control device 200 can also include a digital display 210 to provide information to the user and input methods for communicating with the device.

[0049] Finally, the user may select three levels of authentication 410, which may require authentication by proximity 422, by entry of a PIN 424, and by use of biometrics. For example, a visitor with a mobile device that has received the appropriate credentials may be granted access to the unit (428) when the mobile device and the access control device are at an appropriate distance, such as after the visitor enters a PIN in a prompt on the mobile device, and after the visitor identifies himself on the mobile device, such as by use of biometrics.

[0050] According to embodiments of the present invention, access credentials can be easily extended to service personnel to perform routine functions when the user is away. The large waiting windows typically provided by service providers (e.g., cable company technicians) have been a major cause of frustration for users. The disclosed system can reduce the time burden on consumers of these services. Users can request services from a specific service provider, receive an approximate time window for the service to be performed, and therefore provide access to that period without the user staying in their unit. This may be valuable for various service providers (e.g., housekeeping service providers, grocery delivery services, and other sensitive package delivery services). All of these service providers ideally have access to secure areas assigned to specific users for the purpose of performing their service functions, and the disclosed system can significantly increase the ease with which they will perform their services.

[0051] According to an embodiment of the present invention, the system may include an application programming interface (API) suitable for automatically providing access based on relevant purchases. For example, when a user can order groceries from Amazon.com, the API can automatically provide access to their building, their apartment, or even a suitable room at checkout, so that their perishable groceries can be delivered directly to their cold storage as part of the checkout process. The API can also have important applications in the hotel management industry, where users can securely access their rented rooms and hotel rooms (at checkout), such as via AirBNB or similar services, thereby eliminating the current trouble associated with key acquisition and exchange between renters and homeowners. The disclosed system can also provide real-time updates to all interested parties about the behavior of all visitors during the building's house time.

[0052] Based on the above discussion, Figure 5An exemplary method 500 for providing access to a multi-unit building is shown in FIG. Specifically, a user may register with a service provider, for example, through a service access provider website, for a service to be performed (such as a cable service installation) (step 502). In addition, the user may configure specific instructions for the service provider (step 504). The user may register for delivery or other instructions with the service provider directly in a proprietary application or via an API relationship between the disclosed system and the service provider. The user may then schedule the service and may authorize access to the provider via a digital credential mechanism based on the scheduled time (step 506). For example, the user may use an application running on a mobile device to decide what type of credentials to provide and set appropriate constraints around those credentials. The types of credentials available may include Bluetooth-based credentials, digital copies of physical keys (KeyMe), alphanumeric passwords, or even pre-programmed digital radio frequency credentials.

[0053] The disclosed system may then synchronize the digital credentials and instructions to the appropriate service provider mobile device (step 508). The service provider mobile device may then receive the appropriate instructions and credentials that will provide access to the user unit (step 510). For example, the service provider may receive a password over the phone, a digital credential downloaded to proprietary hardware (e.g., a UPS handheld), a digital credential downloaded to a service-provided smartphone, a text message, or an email with instructions.

[0054] The user device may optionally receive a notification, such as a push notification, email, text, or call, informing them that the service provider device has received appropriate credentials for the service provider (step 512). Additionally, other appropriately connected devices (e.g., access control devices for building entrances and user units) may also receive appropriate instructions and credentials to allow service provision (step 514). The credentials may be matched through a set of pre-programmed parameters on the connected device or via a message from the network.

[0055] As mentioned above, it is not required that the user is present in the unit, so once the service provision is arranged and the credentials and instructions have been distributed, the user can leave their location (step 516). The service provider can arrive at the location to provide services, and can use the credentials and instructions to access and enter the user unit (step 518). Once the service provider device and the access control device are within the appropriate distance, the credentials from the service provider device can authorize access to the service provider according to the action specified by the user (step 520). For example, the access control device can perform functions such as unlocking, locking, turning off the thermostat, turning on the video recording system or activating additional sensors. The access control device can also notify the user of the service provider activity, and respond to other devices and services on the active activation location (step 522). According to an embodiment of the present invention, the access control device can also ensure appropriate service provider behavior (step 524), for example, by monitoring. Abnormal or suspicious behavior can be reported to the user, law enforcement agencies or other service providers as appropriate.

[0056] The disclosed systems and methods can provide unique advantages to operators of multi-unit buildings, such as tenant activity tracking around various amenities, entrance tracking for insurance and security purposes, access management for service and delivery personnel, behavior tracking that can help assist operators in retaining or acquiring new tenants, secure communications, and local services (in the event of a natural disaster).

[0057] Specifically, the disclosed system can provide a real-time view of building management of all visitors who desire to visit and all visitors who are currently visiting through individual users' visitor logs and instructions. This is particularly important in multi-unit buildings, whereby the disclosed system can track which doors users and users' visitors have accessed and which paths they have taken within the building in order to provide the highest degree of security for users and other visitors within the premises.

[0058] As described above, the access control device can have almost permanent access to an Internet connection through a handshake with the user's mobile device. This can eliminate the need for the system to have a dedicated Internet connection and create a system of connections that can be isolated from service interruptions. User devices in the system will most likely be provided through hosts of different service providers, thus creating redundancy in the event that one service provider is unable to provide access at any given moment.

[0059] Even if the system has almost permanent access to the Internet, the disclosed systems and methods can robustly manage access even during long periods of time without Internet connectivity. For example, keys or mobile devices can be provisioned and sent to a visitor or service provider without requiring updates or notifications to the access control device. If for some reason the system does not have access to a network connection between the time the key is provisioned and the time the visitor arrives, the visitor's mobile device can actually provide update packets to the access control device and network while using their keys on-site.

[0060] An exemplary method 600 for updating a component of an access control management system is described in Figure 6 . Periodically, the system can provide available software updates for connected devices (e.g., access control devices) when these devices require or will benefit from software updates to improve or enhance their functionality (step 602). After the software update becomes available, the system can notify the user, visitor, or service provider mobile device of the software update when they are connected to the Internet (step 604). The mobile device can download the software update for the connected device (step 606) and can store the update in their memory (step 608). The download and storage process can occur in the background, and the user and service provider can perform their normal activities (step 610) without any special user action to update the device. When the mobile device is within a suitable distance from the access control device, they can determine whether a particular access control device requires a software update (step 612). In this case, the mobile device can send the stored software update to the access control device (step 614), and the access control device can receive the update (step 616). Once the access control device receives the update, it can transmit the software update to other access control devices in its vicinity that also require the update (step 618). In this manner, other connected devices may receive and install required software updates (step 620).

[0061] According to an embodiment of the present invention, this data transfer will occur in a manner that is completely transparent to the user, where the update packet is embedded in the handshake required to enter a building or perform other functions. Through this mechanism, the update packet will be properly processed throughout the mesh network, where all access control and other system elements are updated through the network connection provided by any user device interacting with any other part of the system.

[0062] refer to Figure 1A, the user mobile device 108 can communicate with the access control device 102 for access control or other purposes. The access control device 102 can verify the handshake and receive a security update data packet with the same handshake from the remote management server via the user's network connection. The access control device 102 can then pass the update to the access control device 104 for distribution to another access control device 106 on the same mesh network. In this way, interaction with any device in the network can update the entire network. This function can be important for visitor management, general operational efficiency, and preventing any problems associated with lost or lost authentication devices. According to aspects of the present invention, mobile devices and access control devices can be in central / master mode or peripheral / slave mode. Devices in central / master mode can send software updates to other devices in peripheral / slave mode within range. Once a device in peripheral / slave mode receives a software update, it can switch to central / master mode. These devices can switch between central mode and peripheral mode as needed to receive and send updates.

[0063] The disclosed system can mitigate the negative impact that theft or misplacement of a mobile device or other authenticator has on the operation of the system. If an authenticating element is misplaced, a user can report the incident to a central server, for example, via an Internet interface, a cellular interface, or in person. Once the central server receives the report, it can push a system update to the affected network to modify or delete the access credentials provided to the misplaced or stolen device. This update can be sent via the above-described method.

[0064] According to an embodiment of the present invention, the system allows encrypted communications between system devices. Figure 7An exemplary device communication encryption flow for devices that can be connected or disconnected from a mesh network is shown. The connected or disconnected device can be pre-programmed with an encryption key (step 702). For example, the access control device can be programmed with a security key at the factory or at the time of setup, which can be updated as needed. The user or service provider mobile device can be programmed with the ability to relay encrypted data packets or other credentials (step 704). The user or service provider can download an application that can be pre-programmed or updated with appropriate credentials. The user or service provider mobile device can then receive credentials (e.g., encrypted data packets and instruction sets) from a server (e.g., server 152) or other device to grant certain privileges and indicate certain access constraints (step 706). For example, the downloaded application can be updated via an invitation to interact with other devices and can receive different capabilities based on the preferences of the user who shared the invitation. After the mobile device receives the encrypted data packet, it can store the encrypted data packet for later use (step 708) (e.g., when the mobile device is in contact with the associated connected device). The user or service provider device can sense a device that is connected or disconnected nearby (step 710) and provide an encrypted data packet or instruction (step 712). The device may then process the encrypted data packet and may perform the desired function without having to connect to the network to obtain additional information (step 714).

[0065] The disclosed system can also track amenities and facility utilization across multi-unit buildings. Building managers may spend a large portion of their budget on amenities expenditures to retain users. The disclosed system can quantify the use of amenities across an entire building, a group of buildings, or an entire real estate layout through handshake tracking between user devices and the local system. By positioning access control devices and other sensors within the larger envisioned system architecture, a complete record of building utilization can be generated. This information can be used to determine, for example, how many users in a particular building utilize on-site fitness facilities, for the purpose of evaluating the relative value of the service, or other purposes that may be useful. Building managers may find this desirable when determining how to retain current users or attract new users, manage amenities, and spend their resources.

[0066] Installed hardware can be used throughout the building to facilitate a complete record of building utilization through background handshaking, where the user's activities remain completely uninterrupted by these background processes. By creating this record, the system can detect if credentials are being used in a suspicious manner. For example, the system can detect that a particular user arrives and stays in their unit, and then use this information to flag an attempt to use the user's credentials at one of the building's other access points. If this is determined to be suspicious, the system can alert the building manager. By directly tying access to a user's location within a multi-unit building, the system can overcome security risks created by other systems that rely on untraceable or non-associated access credentials. By tying authentication to the user's mobile device, it becomes less likely that the user will share their access privileges by any other means other than those dictated by the building management system. The tight connection between the user and the authentication device creates a better audit trail for the building manager.

[0067] Tracking information on building utilization can also provide significant benefits to users of the building, as they will be able to view utilization data in real time to make decisions about when to use certain amenities. For example, a user can use their mobile device to access information from the local mesh network about how many people are using the on-site laundry facilities at that given moment. This can enable users to improve their amenity utilization experience by timing them so that they avoid wait times and other issues associated with overuse of certain resources at certain times.

[0068] An exemplary method 800 for tracking building utilization information is provided in Figure 8 . Users can carry out their regular activities in the building while carrying their mobile devices, such as visiting a lounge area, a terrace, a gym, a laundry room (step 802). Access control devices located throughout the building can track the active and passive activities of users within the building (step 804). For example, an active activity can be visiting a laundry room. Passive activities can include, for example, the presence of five tenants in the fitness area of ​​the building, ten tenants on the rooftop deck of the building, or three tenants in the lobby of the building, which can be identified by the unique signature of their mobile phone. The system can generate active and passive activity logs, and the logs can be transmitted to a server, for example, via the user's mobile device (step 806). The activity logs can be analyzed, appropriately anonymized, and available to building managers and users (step 808). For example, users can see the activity logs on their mobile devices (step 810). Based on this information, they can make appropriate decisions, such as avoiding waiting times at busy locations in the building (step 812). In addition, user behavior can be provided to building management to improve building operations (step 814).

[0069] Building management can change amenities to suit the analyzed data (step 816). In addition, this information can be utilized when designing new buildings and / or proposing renovations to existing buildings (step 818).

[0070] According to embodiments of the present invention, users may also set up smart triggers to notify them about building events or to notify them about the behavior of the user's visitors in the building. For example, notifications may be provided when a visitor enters the front door of the building, arrives at an individual unit door, or when they access other facilities within the building. These smart triggers may be activated within the envisioned platform or may be activated by merging with other services such as the "if this then that" (IFTTT) protocol.

[0071] While many of these events, associated triggers, and actions can help users behave more efficiently or improve their quality of life, this type of system also provides security advantages in terms of building widespread notifications. In the event of a network service outage, natural disaster, or other catastrophic event, the disclosed system can provide key functionality through a local mesh network by pushing updates to the user's device via the building's network. In the event of a natural disaster, the disclosed system can also track the location of building occupants in real time for rescue purposes. By activating the mesh networking capabilities of access control devices and user devices within the building, the local network can potentially search for and locate building occupants by looking up their radio frequency identifiers. This capability can allow rescue workers and building managers to determine if there are individuals remaining in a particular building and engage with them through their devices.

[0072] The localized network communication capabilities of the system can also be utilized to provide communications between tenants in a building without the need for a persistent network connection. This can provide a number of capabilities to building operators or users, such as localized social networking, advertising, and promotional communications. For example, a user can receive a message from another user via a localized network, allowing both parties to know that the other party is co-located in the premises. Such localized networks can extend the functionality of existing networks and create new functionality over time.

[0073] Those skilled in the art will appreciate that the disclosed system may be installed in existing buildings as well as new buildings. Fig. 9An exemplary method for installing and configuring the disclosed system is shown. Access control devices are first installed at one or more locations in a building (step 902) and registered with a central server (step 904). The central server can then assign ownership and credentials to the access control devices based on instructions from the building manager, such as through a user interface (step 906). Subsequently, the building manager can assign users as owners of the access control devices (step 908). Users can delegate credentials and instructions to their mobile devices and other users and service provider devices (step 910). As described above, the credentials and instructions can be sent to the visitor or service provider mobile device via some digital transmission method (step 912), and the mobile device can download and store the credentials for future use.

[0074] According to an embodiment of the present invention, Figure 10-12 An exemplary screen shot of an application for providing access control management running on a mobile device is shown. Specifically, Fig.10 Exemplary screenshots 1002 and 1004 are shown that can provide tracking information to a user of a mobile device. For example, screenshot 1002 provides access information 1008 when, for example, a user accesses an access control device. In a specific example, the application can provide information related to the "front door", "gym", and "garage" access control points 1006. Screenshot 1004 provides specific access information 1012 related only to the "front door" access control point.

[0075] Fig.11 Exemplary screenshots 1102 and 1104 are shown that can provide information to a user of a mobile device about a scheduled event 1106. For example, screenshot 1102 can provide instructions 1108 about the date of a party, the access control devices that need to be accessed for the event, and the people invited to the event. Screenshot 1104 provides a list of events associated with the user of mobile device 1110 and a list of invited guests.

[0076] Fig.12 An exemplary screenshot for granting access to a guest by a user is shown. Screenshot 1200 is a screenshot of an application running on a user's mobile device. The user can select a specific guest 1206 and can use the app to specify specific access control devices and associated time windows 1208 to grant the guest access to those access control devices. The application can request from the server to generate appropriate credentials for the guest, and the server can send the credentials to the visitor's mobile device.

[0077] Figures 13A-13C An exemplary system 1300 for voice-based authentication according to an embodiment of the present invention is shown. Specifically, Fig.13A13. User 1302 holding mobile device 1306 is shown approaching door 1304. Door 1304 may be locked and / or unlocked by access control device 1308. Access control device 1308 may include microphone 1310 and speaker 1312. When user 1302 approaches access control device 1308, as shown in FIG. Fig. 13B As shown, access control device 1308 can sense mobile device 1306, and in response, if the mobile device has credentials that provide authority to the area protected by door 1304, a password can be generated that can be used to unlock door 1304. For example, access control device 1308 can generate a random numeric password or a language password. Once the password is generated, access control device 1308 can push the password to mobile device 1306. Mobile device 1306 can receive the password and can display it in an application running on mobile device 1306. Mobile device 1306 can also provide instructions to user 1302 for unlocking door 1304. For example, mobile device 1306 can determine the type of specific password received by access control device 1308, such as a language password or a numeric password, and can instruct user 1302 appropriately. Fig. 13B As shown, the application running on the mobile device 1306 instructs the user to "unlock by saying COUNTRY 17603" 1314. The user 1302 can then speak the password (COUNTRY 17603), and the access control device 1308 can receive the language input from the user 1302, for example from the microphone 1310, can process it, and determine whether it corresponds to the password it pushed to the mobile device 1306. If the received language input corresponds to the generated password (1316), the access control device 1308 can unlock the door 1304. For example, when the user 1302 provides the correct password (1316) or an incorrect password, the access control device can provide an audio instruction or an appropriate message to the user 1302, for example, through the speaker 1312. According to an alternative embodiment, if the generated password is a numeric password, the application running on the mobile device 1306 can provide a numeric keypad, where the user 1302 can enter the password. Once the numeric password has been entered, the mobile device 1306 can transmit a signal to the access control device 1308, which can then determine whether the received signal corresponds to the correct password. According to an alternative embodiment, if the generated password is a numeric password, the user 1302 can enter the numeric password on the access control device 1308.

[0078] According to an embodiment, if the access control device determines that the received language input does not correspond to a password, the access control device may notify the user to speak the password again. According to an alternative embodiment, if the access control device determines that the received language input does not correspond to a password, the access control device may notify the user to enter the password using the numeric keypad of the access control device.

[0079] As described above, when a user with valid credentials approaches a facility where the access control device is installed, the access control device can authenticate the user. According to an embodiment, in addition to authorizing access, the access control device can also capture and store data related to the access, such as temperature, time, date, visual data, audio data, motion data, and battery status data. The data can be stored locally on the access control device and can be later transmitted to various parties, such as a central system that can analyze access patterns and statistics. The data can be transmitted to the central system using, for example, a wireless connection with a nearby mobile device that is authorized to passively or actively receive and transmit data from the access control device. Data transmission can also occur through a connection to another device near the access control device or through a direct network connection within the access control device.

[0080] Fig.14 An exemplary method for providing access to an area according to an embodiment of the present invention is shown. For example, a user may approach a door with an access control device while carrying a mobile device that holds credentials granting permission to the area behind the door 1402. When the user is within range of the access control device, the user may receive a notification from the access control device, such as on a mobile device, that includes an access code 1404. After the user receives the access code, the user may speak the access code or may enter the access code according to instructions provided in the notification 1406. The access control device may receive the access code 1408, may verify it 1410, and may authorize access to the area protected by the door it is installed 1412. After the user enters the area, the access control device may secure the door 1414, such as by locking the door.

[0081] Depending on the embodiments, the disclosed methods and systems may provide valuable features in addition to capturing and storing access data. For example, personnel managing facilities may be interested in monitoring the utilization of their facilities and tracking the behavior of users and / or tenants of the facilities. It may be valuable to monitor the number of users or people that pass through a particular access point (e.g., a store or public area). Knowing how many people have passed through a particular access point (either securely with valid credentials or through an unsecured process) can be very helpful in assessing the utilization of a space and the relative demand for that space. For example, a retailer may install the disclosed access control device and track the number of times per day that an access point is utilized as a data point related to sales volume and, for example, to predict longer term trends.

[0082] According to an embodiment, the access control device can determine how many times an access point has been activated and how many people have passed through it, for example, through one or more sensors and various algorithms. For example, an access control device mounted on a door can be programmed to detect whenever the door is opened or closed. It can also be programmed to detect when the door has been opened and the number of subsequent people who have entered through the door by detecting movement when the door is open. Similarly, the disclosed access control device can detect when the door is opened and when a person is leaving through the door.

[0083] According to an embodiment, the disclosed access control device can detect the presence of other users and their mobile devices. For example, the access control device can have a persistent Bluetooth or other wireless communication protocol to broadcast or receive input from other mobile devices for marketing and other notification generation purposes. Specifically, the access control device can track mobile devices within range, record interactions with the mobile devices, and store, transmit and / or utilize this information.

[0084] The detection of a particular device may also be linked to other data sources to discover more information about the presence of a particular device and its user. According to an embodiment, an access control device may capture data related to a user's online or other remote interactions with a product or service, and then link that information to the physical proximity of the user's device when the user's device is within a space within range of the access control device. This may allow advertisers to link online or other remote interactions with a particular visit to a particular location, thereby providing a user with customized notifications based on previously collected data when the user enters the vicinity, or providing other notifications after entering the vicinity based on additional collected data.

[0085] All of the various ways and devices described for detecting access and user awareness are valuable for tracking how users and devices specifically interact with designated spaces within a building. One example use case for such access control devices is for managing delivery to a specific space (e.g., a storage room) at a building. That specific space can be monitored by an access control device, which can regulate access and limit access to only authorized users, with their activities within that space being tracked, stored, and utilized for future use.

[0086] Similarly, access control devices can monitor the utilization of specific spaces in a building for the purpose of evaluating the use of these areas. This usage data can be used to dynamically price access to specific areas based on the demand for that space for the amenities within the space. By capturing and comparing this data, predictive models of space utilization can be created to optimize the operation and performance of the space, and also influence the design of future buildings to consider the appropriate resources in a given space, thereby maximizing the monetization and functional possibilities of the space. These capabilities can allow owners of such systems to quantify and measure the performance of various marketing campaigns and systems.

[0087] Fig.15A and 15B An exemplary access control management system 1500 is shown, which can also provide "awareness" information, such as information about people accessing or using a particular area. Technologies that provide awareness information can include cameras, proximity beacons, motion sensors, WiFi sensors, infrared (IR) sensors, audio sensors, visual sensors, accelerometers, location sensors, and other sensors that can detect the presence of one or more people. For example, Fig.15A One or more users 1502 entering an area protected by a gate 1504 are shown. The gate 1504 has an access control device 1506, which can communicate with a cloud service 1510, for example, wirelessly. The access control device 1506 can detect the presence of one or more users 1502 and / or identify one or more users 1502, and can send information to the cloud service 1510, for example, information about the identified users. The area protected by the gate 1504 can be a retail store, which can have a counter with a computing device 1508, such as a computer, a tablet device, a smart phone. The computing device 1508 can receive information from the access control device 1506 through the cloud service 1510 or directly (e.g., through a local area network), where both the access control device 1506 and the computing device 1508 are connected to the same network, or a peer-to-peer network (e.g., Bluetooth). The computing device 1508 can use the received information to generate statistics 1512, such as foot traffic or revenue amounts broken down by day, week, or other time period.

[0088] Fig.16 and 17 Exemplary access control management systems 1600 and 1700 are shown, respectively, which can also provide proximity-based notifications. Fig.16A door 1602 with an access control device 1604 is shown. The access control device 1604 can detect the presence of different users walking in its vicinity, such as user 1606. For example, the access control device 1604 can identify a mobile device 1608, such as through installed credentials in the mobile device, and can determine to send a notification 1610, such as an advertisement, announcement, or reminder, to the mobile device. For example, the notification 1610 ("Get a free iced coffee when you buy a cake at the Bakehouse") can be displayed in a text message, email, or on the lock screen of the mobile device. For example, by identifying a user's registered mobile device (sensing the mobile device) or by identifying that the user has specific access credentials associated with their profile (e.g., the user has entered a specific area using specific credentials, which are, for example, credentials that authorize access to a common area or gym at a building). According to an embodiment, the access control device can, for example, Wi-Fi After identifying the specific mobile device, the access controlling device may respond, for example, with a notification on a screen of the access control device, a notification on a screen that communicates with the access control device (such as a notification screen), through a notification on a screen of the mobile device, through SMS, email, chat message, and / or other types of communication.

[0089] According to embodiments, the disclosed systems and methods may provide targeted advertising notifications to users based on, for example, relevance to their particular interests (e.g., specified in a user profile), proximity, time of day (e.g., notification of lunch deals), time of year (e.g., holiday season), socioeconomic data, prior shopping history, prior Internet browsing history, and user physical presence history. Notifications may relate to non-targeted advertising, such as general advertising about a building or another venue.

[0090] Similarly, Fig.17 Door 1702 is shown with access control device 1704. Access control device 1704 can detect the presence of user 1706. For example, access control device 1704 can identify mobile device 1708, such as through credentials installed in the mobile device, and can determine to send reminder 1710 to the mobile device, such as a reminder related to maintenance in the building. For example, notification 1710 ("Elevator 'A' is out of service") can be displayed in a text message, email, or on the lock screen of the mobile device.

[0091] Fig.18An exemplary access control management system 1800 is shown. For example, a door 1802 may provide access to a storage area 1810, such as a room for storing packages 1812, through an access control device 1804. A user 1806 may be a manager of package deliveries and may provide credentials to a delivery person 1808, such as through a mobile device 1814. For example, the delivery person 1808 may be scheduled to deliver or pick up packages to / from the storage area 1810 during a specific time window. The mobile device 1810 of a member of the delivery person 1808 may receive access credentials, such as a numeric password, which may be entered on a keypad of the access control device 1804.

[0092] Fig.19 An exemplary method 1900 for access control and awareness using an access control device is shown. For example, a non-credentialed user may approach an area controlled by an access control device (step 1902) or multiple access control devices. The access control device may detect the presence and / or movement of a user or user device (step 1904). Based on the captured information, the access control device may assess the number of users present in the area and the type or duration of their activities (step 1906). The access control device may optionally store the information locally (e.g., at a memory installed in the access control device) and may later send the store information to a central system for aggregate processing (step 1908). The access control device may transmit the information to the central system. The central system may combine the information received from one or more access control devices and may aggregate the data to generate statistics (step 1910). For example, the system may compare the presence of a user (and its mobile device) with known users (and mobile devices) and may provide relevant data to the system (step 1912). Based on the data, the system may determine whether the user or device can be associated with a previously known advertising impression or engagement target (step 1914). For example, the access control device may store historical information about the user and his or her mobile device. Alternatively, the mobile device may store information about the access control device and then respond when the mobile device detects a particular access control device. The system may then send relevant notifications about the access and awareness at the particular location to all relevant parties (step 1916). The relevant parties may include, for example, service providers such as ), delivery services (such as or ), building management, security companies, insurance providers and advertisers.

[0093] While the disclosed subject matter has been described and illustrated in the foregoing exemplary embodiments, it is to be understood that the invention is made by way of example only and that numerous changes may be made in the details of the implementation of the disclosed subject matter without departing from the spirit and scope of the disclosed subject matter.

Claims

1. A system comprising: an access control device storing a first access credential, wherein the access control device is not permanently connected to the Internet; A mobile device comprising a memory and a wireless interface; as well as a server storing an instance of the first access credential and configured to communicate with the mobile device via the wireless interface; Wherein, the mobile device is configured to: receive the first access credential from the server via the wireless interface; wherein the mobile device is configured to: transmit the first access credential to the access control device via a wireless communication protocol; and Wherein, the access control device is configured to: allow access to the area based on the first access credential; The server is configured to generate a second access credential for the access control device and transmit the second access credential to the mobile device, wherein the mobile device is configured to transmit the second access credential to the access control device, wherein the access control device is configured to be updated based on receipt of the second access credential.

2. The system according to claim 1, wherein: The first access credential is pre-installed on the access control device and is mirrored in a database of the server.

3. The system according to claim 1, wherein: The access control device is configured to allow access to an area based on receiving a second instance of the second access credential from the mobile device after the access control device is updated.

4. The system according to claim 1, wherein: The first access credential comprises a key that is pre-installed on the access control device and mirrored in a database of the server.

5. The system according to claim 4, wherein: The server is configured to generate the second access credential based on the secret key.

6. A method comprising: receiving, by a mobile device from a server, a first access credential for an access control device that is not permanently connected to the Internet, wherein the first access credential is pre-installed on the access control device; and transmitting, by the mobile device via a wireless communication protocol, the first access credential to the access control device to cause the access control device to authorize access to an area; receiving, by the mobile device from the server, a second access credential for the access control device; and The second access credential is transmitted by the mobile device to the access control device, causing the access control device to be updated based on the second access credential.

7. The method according to claim 6, wherein: The first access credential is mirrored in a database of the server. 8 . The method of claim 6 , further comprising, after updating the access control device: transmitting, by the mobile device, the second access credential to the access control device, so that the access control device authorizes access to an area based on the second access credential.

9. The method according to claim 6, wherein: The first access credential comprises a key that is pre-installed on the access control device and mirrored in a database of the server.

10. The method according to claim 9, wherein: The server is configured to generate the second access credential based on the secret key.

11. The method according to claim 10, wherein: The server is configured to generate a plurality of additional access credentials based on the secret key.

12. The method according to claim 10, wherein: The wireless communication protocol is at least one of: Bluetooth, Z-wave, ZigBee or NFC.

13. A machine-readable medium comprising code which, when executed, causes a machine to perform the method according to any one of claims 6 to 12.

14. An apparatus comprising: means for receiving, by a mobile device from a server, a first access credential for an access control device, the access control device not being permanently connected to the Internet, wherein the first access credential is pre-installed on the access control device; means for transmitting, by the mobile device via a wireless communication protocol, the first access credential to the access control device to cause the access control device to authorize access to an area; means for receiving, by the mobile device from the server, a second access credential for the access control device; as well as Means for transmitting, by the mobile device, the second access credential to the access control device to cause the access control device to be updated based on the second access credential.

15. The device according to claim 14, wherein: The first access credential is mirrored in a database of the server.

16. The apparatus according to claim 14, further comprising, after updating the access control device: Means for transmitting, by the mobile device, the second access credential to the access control device to cause the access control device to authorize access to an area based on the second access credential.

17. The device according to claim 14, wherein: The first access credential comprises a key that is pre-installed on the access control device and mirrored in a database of the server.

18. The device according to claim 17, wherein: The server is configured to generate the second access credential based on the secret key.

19. The device according to claim 14, wherein: The wireless communication protocol is at least one of: Bluetooth, Z-wave, ZigBee or NFC.

Images