Method and system for managing access to assets

Abstract

Methods and systems for managing access to assets are disclosed. The method includes: receiving credentials from a key device using a first wireless connection, wherein the first wireless connection uses a low-power communication protocol; validating the credential; establishing a second wireless connection with the key device using ultra wide band (UWB); determining a probability that a user of the key device intends to physically access the asset based on the second wireless connection; determining that the probability exceeds a threshold, where the threshold is adjusted based on at least one of access rights or access history of the user; and in response to verifying the credential and determining that the probability exceeds a threshold, granting access to the asset by the user.

Description

[0001] This application is a divisional application of the invention patent application with application number 202080023681.7, application date March 24, 2020, and invention name “Physical access control system with location-based intention detection”. Technical Field

[0002] Implementations described herein relate generally to physical access control systems, and more particularly to physical access control systems with credential location detection capabilities. Background Art

[0003] Physical access to an area may be controlled by an electronic physical access control system (PACS) (e.g., through a door). People may have a key card or mobile device to provide their credentials to the PACS. The environment of the PACS may vary with the number of people and the number of entry points that may provide access. For example, a company's building may have a single entry point that provides entry access to all employees. Within the building, there may be multiple offices and private meeting rooms that provide entry access to selected employees. Another example may be a hotel that has many entry points for each room, but each room can only be accessed by a selected individual. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] In the drawings that are not necessarily drawn to scale, similar reference numerals may describe similar components in different views. Similar reference numerals with different letter suffixes may represent different instances of similar components. The drawings generally illustrate various embodiments discussed in this document by way of example and not by way of limitation.

[0005] Figure 1 An example of a user interacting with a PACS according to some embodiments is shown.

[0006] FIG. 2A to FIG. 2D An example of a key device interacting with a PACS according to some embodiments is shown.

[0007] Figure 3 An example is shown of a person approaching three doorways directly in accordance with some embodiments.

[0008] Figure 4 An example of a person approaching three doorways is shown in accordance with some embodiments.

[0009] Figure 5 A flow diagram showing a technique for managing access to assets is shown, according to some implementations.

[0010] Figure 6 A flow chart showing a technique for managing access to an asset using a key device is shown in accordance with some implementations.

[0011] Figure 7 A flow diagram showing a technique for managing access to assets is shown, according to some implementations.

[0012] Figure 8 A flow diagram showing a technique for managing access to assets is shown, according to some implementations.

[0013] Fig. 9 A flow diagram showing a technique for managing access to assets is shown, according to some implementations.

[0014] Fig.10 A flow diagram showing a technique for managing access to assets is shown, according to some implementations.

[0015] Fig.11 is a block diagram illustrating an example of a machine upon which one or more embodiments may be implemented. DETAILED DESCRIPTION

[0016] When attempting to enter a secure area, a person may be frustrated by a delayed response between their approach to an entry point and the unlocking of a security entry mechanism (e.g., an electronically controlled door lock). For example, an employee may pass through an entry point to a secure area multiple times a day. Additionally, in some conventional PACS, a user may be required to physically present their credentials (e.g., a card / badge or mobile device) to a reader located on a wall, which may inconvenience the user or cause further unnecessary delays in certain situations (e.g., if the user's hands are full). Therefore, a PACS that can more easily and seamlessly identify a user (e.g., authenticate a user's permission to exit a secure area) may produce a more user-friendly and preferred experience. Additionally, an entry user with a PACS may find benefit in a PACS that determines the user's intent so that the PACS can perform preemptive credential verification so that the security entry mechanism can be unlocked as the user approaches an entry point.

[0017] In some cases, the systems and methods described herein may allow for a seamless experience by obtaining or receiving credentials from a user without requiring the user to actively present a device (e.g., a card or mobile device) containing the credentials. That is, in some cases, the systems and methods described herein may include automatically sending credentials to a reader when the user approaches the reader (e.g., without active input from the user).

[0018] In some cases, the systems and methods described herein may implement various methods of detecting a user's intent so that an entry point will open not only when a user with appropriate credentials is within a defined proximity of an entry point, but also once it is sufficiently determined that an authenticated user intends to pass through the entry point. A challenge in performing preemptive credential verification may be identifying false positives, which would result in the security entry mechanism being released when it should not be unlocked (e.g., false intent detection). This may be problematic because an unauthorized person may gain access to the entrance. For example, an authorized person may walk down a hallway and pass by a security entry point. If the PACS misidentifies a person's proximity to a security entry point, the PACS may unlock the security entry mechanism. A person may pass by the door, and another person may enter through the security entry point while the security entry mechanism is unlocked.

[0019] A wireless PACS may have commonly used wireless communication technologies, such as near field communication (NFC), such as radio frequency identification (RFID) technology, and personal area network (PAN) technology, such as IEEE 802.15.1 and Bluetooth Low Energy (BLE). These technologies may have deficiencies in terms of seamless user experience and access. For example, NFC has a limited range, so that credential exchange typically does not occur until a user attempts to gain access (e.g., standing in front of a door, holding a key card against a reader). It may take several seconds for the credential to be transmitted to the reader and for the host server to respond, which can create a frustrating user experience. In addition, for example, a user may typically need to remove a key card or access device from their pocket and place the key card or access device on or very close to the reader to start the process.

[0020] BLE devices have a range of tens of meters (e.g., ten to twenty meters). Therefore, credential exchange can be performed when the user approaches the reader. The PAN standard can feature secure handshakes, encryption, and favorable energy profiles for discovery and data transmission. However, the PAN standard does not provide accurate physical tracking of devices (e.g., ranging, positioning). Therefore, without any additional evidence of intent, it may be difficult for the reader to determine whether the user's insider actually obtains access to the secure area. Additional evidence of intent may include touching a door handle and making gestures with a key device. However, this may still be a less than ideal user experience compared to the user simply walking up to the reader and gaining access to the secure area.

[0021] Ultra-wideband (UWB) wireless communication protocols can be used for communication by encoding data via time modulation (e.g., pulse position coding). With UWB, symbols are specified by pulses on a subset of time units in a set of available time units. Other examples of UWB coding can include amplitude modulation and polarity modulation. Broadband transmissions tend to be more robust to multipath fading than carrier-based transmission techniques. In addition, the lower power of pulses at any given frequency tends to reduce interference with carrier-based communication techniques.

[0022] UWB can be used for radar operation and provide positioning accuracy on the scale of tens of centimeters. Due to the possibility of variable absorption and reflection of different frequencies in the pulse, the surface and blocking (e.g., coverage) characteristics of the object can be detected. In some cases, in addition to providing range or distance, positioning can also provide angle of incidence.

[0023] Physical access control can include a range of systems and methods for managing, for example, human access to secure areas. Physical access control can include identification of authorized users or devices (e.g., vehicles, drones) and actuation of gates, doors, or other facilities used to protect areas. A PACS can include a reader (e.g., an online or offline reader) that stores authorization data and can be able to determine whether the provided credentials are authorized for an actuator (e.g., a door lock, a door opener, a shutdown alarm). An online reader or system can include a system connected to a network or the Internet for determining authorization. An offline reader or system can be a self-contained system that is not connected to any external resources. For example, a PACS for a residence can be offline.

[0024] The PACS may include a host server to which readers and actuators (e.g., via a controller) are connected in a centrally managed configuration. In a centrally managed configuration, the reader may obtain credentials from a key device (e.g., a radio frequency identification (RFID) chip in a card, a key fob, or a personal electronic device such as a mobile phone) and pass these credentials to the PACS host server. The host server may determine whether the credentials authorize access to a secure area and command the actuator accordingly.

[0025] To address the problem of identifying intent, positioning techniques (e.g., using secure UWB ranging) can be combined with PAN discovery and key exchange. The key device and reader can coordinate secure ranging using PAN techniques. This can include the reader providing a secret (e.g., a scrambled timestamp (STS)) used to mark ranging messages to prevent spoofing. The key device can provide credentials during the same PAN session that shares the secret. Unless the credentials are cached until the intent trigger occurs, the reader can decrypt or otherwise prepare the credentials as it normally would.

[0026] The reader can use UWB to physically locate the key device. In some examples, UWB is activated after the secret is shared to save energy, which may be useful for battery-powered readers or key devices.

[0027] Compared to other technologies, identifying the physical location of a key device using UWB is more accurate and can be accurate to tens of centimeters, providing both range and direction to the reader. This accuracy exceeds the approximately 10-meter accuracy of PAN when the reader is not coordinated. The precision of UWB accuracy can provide the details required for user intent determination. For example, multiple areas (such as different distance ranges from the reader) can be defined to provide different contexts for understanding user intent. In addition, the accuracy of tracking enables an accurate model of user movement from which intent can be discerned. Therefore, the reader can classify user movement as likely to approach the reader or simply walk by.

[0028] Intent thresholds or intent triggers may be in place, where once the likelihood of intent exceeds the intent threshold, the intent trigger may activate a series of events, such as causing the reader to act on cached credentials. For offline readers, the reader may control an actuator (e.g., a lock on a disconnected door lock). In a centrally managed PACS, the reader may forward the credentials to a host server for action (e.g., sending the credentials to a controller to make a determination and further actuate a door lock if appropriate).

[0029] The systems and methods described herein can be implemented so that a first transmission or exchange with a key device via a communication protocol with longer range capabilities or, in some cases, lower accuracy (e.g., BLE, Wi-Fi) can be used to provide the user's credentials to the reader. These credentials can be stored in a cache location within the reader until and unless it is determined that the user does intend to enter a secure area (e.g., open the door where the reader is installed) during a second transmission or exchange with the key device via a communication protocol with higher accuracy and precision (e.g., UWB). Once the user's intention is determined, the reader can then release the credentials (sometimes referred to as PACS bits) for processing, such as sending the credentials to a controller to determine the user's access permission or directly unlocking the door (e.g., in the case of an offline reader). This two-step authentication sequence can reduce the computation time that may cause delays (also known as latency) in the user opening the door. Using this method, authentication and communication between the reader and the key device have been efficiently performed when the system has determined that the user does intend to enter the door and the user arrives at the door.

[0030] In some implementations, if an intent trigger does not occur within a time period, or a counter-intent trigger occurs—such as moving away from the reader—the cached credentials may be cleared. Since many credentials may be cached in the reader, the above operations may be performed, but it may be that a smaller subset of the cached credentials may actually be used for the authentication process (e.g., based on a later predicted intent).

[0031] In some embodiments, if the reader has identified whether the credential provides access to the secure area (such as in the case of an offline reader), the credential is not cached if it is determined that the credential does not provide access to the secure area. In addition, UWB positioning may not be activated.

[0032] In some embodiments, the reader may include a persistent authentication of the credential. The persistence may be based on a timeout value. The amount of time the credential is stored or its persistence depends on the timeout value. If the timeout is long, the need to re-exchange the PAN credential may be reduced.

[0033] For example, the key device is within the PAN range of the reader. The reader can cache the PACS ID (e.g., a 26-bit PACS for legacy systems) read from the credentials provided by the key device. A seed for a time-based one-time password (TOTP) technique is generated by the reader and shared with the key device via the PAN. The UWB ranging received from the key device includes the TOTP verified by the reader. If the UWB measures that the key device is close enough (within a few meters) to the reader or other target (e.g., the center of a door), the reader sends the cached PACS ID to the host server. The host server triggers the door to open. The reader can then delete the cached PACS ID. Conversely, if the UWB does not range the key device after a certain timeout (e.g., 5 minutes), the TOTP is invalid. The key device must then connect to the reader to obtain a new TOTP. In addition, PAN authentication may expire after certain authentication timeouts (e.g., a few hours).

[0034] When using secure UWB positioning, any reader involved may require a seed or secret for secure ranging, such as an STS, in order to operate efficiently in the system. For example, if multiple readers can be connected (e.g., via BLE, mesh network, etc.) to distribute the same secret among all participating readers. This may reduce the need to exchange STS between each reader and the key device. In addition, this shared exchange can exchange a cached PACS ID, for example, from one initial reader connected to the key device to all readers. By doing this, each key device requires a credential and STS exchange.

[0035] A coordinated PACS can use a gateway device to coordinate multiple readers within a PACS, whether the readers are centrally managed or offline. The reader can operate as a remote radio head to a gateway, where the gateway performs credential caching, intent determination, and credential forwarding to a host server or command actuator operations. A coordinated PACS facilitates UWB positioning of key devices with one or more connected readers. In some examples, the gateway can load balance UWB positioning responsibilities. This can be helpful in dense key device scenarios, such as at ticket speed gates.

[0036] In some embodiments, the credentials sent to the reader may include encoded or encrypted information, such as HID Global's Credentials, NXP Voucher or Sony's FeliCa TM Credentials. The reader may decrypt or obtain various information based on the credentials received from the key device and provide that information to an access server (e.g., a controller) to determine the user's permissions (e.g., access permissions). In some cases, the reader may decrypt the credentials and obtain access control identification information about the user (e.g., PACS bits) and send that information to the controller to determine whether the user has permission to access the controlled area or system to which they are attempting to gain access.

[0037] Figure 1 An example 100 of a user interacting with a PACS according to some embodiments is shown. A doorway 105 may be secured with an electronic lock controlled by the PACS. The PACS receives credentials from a user 115 wishing to enter the doorway 105 using a reader 110 .

[0038] When the user 115 approaches the door 105 and the reader 110, the first wireless communication 120 communicates with the key device of the user 115. The first wireless communication 120 can be a low-power communication such as BLE. The first wireless communication 120 can have the ability to communicate with the key device at a longer distance, but may not be able to perform positioning and ranging of the key device. Using the first wireless communication 120, the reader 110 can receive the credential and other identification information from the key device. The reader 110 can cache the credential or can send the credential to the verification system of the PACS, which can determine whether the user 115 can enter the door 105.

[0039] As the user 115 continues to approach the doorway 105 and the reader 110, the second wireless communication 125 begins to communicate with the key device of the user 115. The second wireless communication 125 can be a high power and advanced communication such as UWB. The second wireless communication 125 can include positioning and ranging to track the movement of the user 115. The second wireless communication 125 can track the user 115 and use factors such as the speed at which the user 115 moves to determine whether the user 115's intention is to enter the doorway 105. For example, if the user 115 does not intend to enter the doorway 115, their speed can remain constant. Conversely, if the user 115's intention is to enter the doorway 105, the user 115 can slow down their pace as they approach the doorway 105 and touch the door handle.

[0040] The PACS can use the data received from the reader 110 using the second wireless communication 125 to determine the likelihood or probability that the user 115 intends to pass through the doorway 105. The determination can be calculated using the received data or the received data can be provided to a fixed or evolving model. If the determined probability of intent exceeds a predetermined threshold, the PACS can unlock the door so that the user 115 can seamlessly enter the doorway 105. The threshold value can vary depending on how accurate the probability determination is and how secure the doorway 105 may need to be. For example, the threshold value for the probability of intent for a conference room can be 50% because there is no risk if the conference room is unlocked due to a false alarm. However, the threshold value for the probability of intent for a door of a laboratory for new product development can be 90%. In addition, the threshold value can be adjusted for each user using the user credentials available to the system to associate additional information, such as, but not limited to, access rights and access history.

[0041] FIG. 2A to FIG. 2D An example 200 for a key device to interact with a PACS is shown according to some embodiments. The example 200 of the PACS includes a doorway 205 secured with a reader 210 and a lock 215. The reader includes a cache 220 for storing credentials and other data received from the key device. The reader 210 communicates with an access control 225. The access control 225 can be a server connected to a local internal network. The access control 225 can be a remote system connected via the Internet for managing access to multiple locations.

[0042] exist Figure 2A , key device A 230, key device B 235, and key device C 240 come within BLE range (as an example of low energy wireless communication) of reader 210. Upon establishing a connection with reader 210, each of key device A 230, key device B 235, and key device C 240 provides credentials to reader 210.

[0043] exist Figure 2BIn the reader 210, a preliminary authentication of the credential can be performed. For example, the reader 210 can include a blacklist or a whitelist to make an immediate decision about tracking the key device. Using UWB for ranging and positioning provides additional information about the movement of the key device, but also requires more energy. Therefore, it is advantageous to be able to make a determination whether the key device should be tracked. In Figure 2B In example 200 of FIG. 205 , reader 210 determines that key device B 235 does not have credentials to enter doorway 205 . Therefore, reader 210 does not range key device B 235 using UWB because key device B 235 will not be allowed to access doorway 205 .

[0044] In some embodiments, the reader 210 may send the credential to the access control 225 for authorization. If the access control 225 determines that the credential associated with the key device is authorized to enter the doorway 205 associated with the reader 210, the access control 225 may provide a token for the credential to the reader 210. The reader 210 may store each token with its corresponding credential. Similarly, in this embodiment, if the reader 210 does not receive a token, the credential is removed and the key device, such as key device B 235, is not tracked.

[0045] In some embodiments, the reader 210 can cache the credentials when the credentials are first received via BLE. The reader 210 can save the credentials in the cache until ranging is performed using UWB. Once the key device is within a certain range, the reader 210 can release the credentials for authentication by access control 225 or an authentication server.

[0046] exist Figure 2C In FIG. 2 , key device A 230 and key device C 240 have been moved closer to reader 210 and UWB can be used for communication. Using UWB, positioning or ranging can be performed. The location information of key device A 230 and key device C 240 is provided to reader 210. The location information can be used to determine the intention of the person with each corresponding key device. The location information can be derived from UWB, for example, by performing range detection.

[0047] exist Figure 2D, key device A 230 and key device C 240 continue to move and the location information of their respective movements is provided to reader 210 via UWB communications. Key device C 240 moves away from reader 210, and therefore the determined intent of key device C 240 to enter doorway 205 is low. Reader 210 may continue to track key device C 240 until it is out of range. Reader 210 may be battery aware and hardware aware to monitor how power and processing are used. This may include discarding credentials from a cache once it is determined that the credential is no longer needed (e.g., if intent drops below a threshold). Managing credentials stored in a cache based on the confidence or intent of a person accessing an entry point may be necessary for a PACS that manages access to a collection of gates, such as a set of turnstiles. This type of entry point, such as an entrance to a subway or stadium, may receive a large number of credentials at certain times.

[0048] Key device A 230 continues to approach doorway 205, so the intention of key device A 230 to access doorway 205 is high. Reader 210 may release the token of key device A 230 to access control 225. When access control 225 receives the token, access control 225 may send a command to door lock 215 to unlock, so that the person holding key device A 230 can enter doorway 205 easily and without delay. If no token is provided, the reader may send the credentials of key device A 230 to access control 225 to unlock door lock 215. For an offline system, reader 210 may directly control door lock 215 and send a command to door lock 215 to unlock directly.

[0049] Many factors may be used to determine when the reader 210 should send a release, such as a token, to the access control 225. If the doorway 205 is for a secure area, the determined intent or probability of accessing the doorway 205 may need to be very high, and therefore have a high threshold so that the doorway 205 is not opened unintentionally. Other factors, such as the frequency with which people access the doorway 205 or known contextual data, such as a meeting that is about to start in the room at the doorway 205, may help determine the threshold of intent.

[0050] For security, the reader 210 can generate a session key for communicating with a key device such as key device A 230. Each side such as the reader 210 and key device A 230 can have a counter. The counter can be hashed as part of the session key. In order to track the movement of the key device A 230, the reader 210 continuously communicates with the key device A 230 to determine the distance. For each communication, the reader 210 or the key device A 230 can increase the count of the hash counter respectively. Then, the session key is changed with each communication to prevent malicious attacks, while the reader 210 and the key device A 230 can continue to communicate because the reader 210 and the key device A 230 each know what the count should be and can decrypt the hash.

[0051] Identifying a person's intent to enter a doorway can be used to speed up the process of authenticating credentials and unlocking the doorway, making the person unhindered and presenting a seemingly seamless transition. The previous discussion focused on identifying intent at a single doorway. When there are multiple doorways and multiple readers, identifying intent presents challenges, such as Figure 3 and Figure 4 Found in the example.

[0052] Figure 3 An example 300 of a person 335 approaching three doorways directly according to some embodiments is shown. Person 335 may approach a set of doorways directly in front of it. For each of doorway 305, doorway 315, and doorway 325, corresponding readers 310, readers 320, and readers 330 may have difficulty identifying which doorway person 335 intends to enter. For example, if reader 310, reader 320, and reader 330 use ranging alone, person 335 will be within the same relatively large range of reaching the reader. Identifying the location of person 335 and performing continuous positioning of person 335 (through its key device) can provide the direction in which person 335 is moving. Using the determined direction, the reader can identify an angle of arrival 340. The angle of arrival 340 can be used to determine which doorway person 335 intends to enter among the multiple doorways.

[0053] Figure 4 An example 400 of a person 435 approaching three doorways is shown in accordance with some embodiments. Person 435 may approach a collection of doorways that may be on one side of person 435, such as if person 435 is walking along a hallway of an office building. For each of doorway 405, doorway 415, and doorway 425, corresponding readers 410, 420, and 430 may have difficulty identifying which doorway person 435 intends to enter. Person 435 may stop at any of these doorways even though person 435 is at a different distance from each of readers 410, 420, and 430.

[0054] When person 435 moves along the corridor and passes by a reader, such as reader 430 in example 400, doorway 425 can be immediately removed from the possible intended doorways. This can free up the cache of reader 430 and change the probability that person 435 intends to enter doorway 405 or doorway 415.

[0055] The PACS may attempt to monitor the speed at which person 435 is moving. The speed at which a person moves in this case may be relatively constant until the person is just before their intended doorway, at which point their pace slows. This type of movement information can be used to identify intended doorways. A neural network can be trained using movement data of how people move along hallways and how their movements vary relative to the doorways they enter. The neural network can be used in conjunction with the PACS and location data provided by the reader via UWB to identify intended doorways.

[0056] In example 400, the PACS can use contextual data to identify the intended doorway. For example, the PACS can access the company's calendar system. The PACS can recognize that a meeting is about to start in the room corresponding to doorway 415. Therefore, although the intended doorway of person 435 cannot be determined by movement alone, using the calendar, the PACS can determine that the intention of person 435 is to enter doorway 415. The accuracy of the intent can be further improved if the PACS accesses the individuals invited to the meeting and then cross-references the authentication of person 435 (from their key device) with the list of invitees.

[0057] Another scenario for this example may be where doorway 405 with reader 410, doorway 415 with reader 420, and doorway 425 with reader 430 are hallways of a hotel. Identifying the guest's intent may not be easy because the guest will have credentials that correspond to only one doorway. Therefore, as the guest walks down the hotel hallway, the hotel's PACS may be able to predict the guest's intent even before the guest enters the reader range of their room because the PACS may recognize that there is only one doorway / room that the guest has credentials to access.

[0058] The PACS may have access to communication systems such as email, instant messaging, and short message service (SMS), which may provide information for determining the doorway a person intends to enter. For example, if John sends an instant message to Bob, asking Bob to meet John at lab B, when Bob approaches the doorway of the lab, the PACS may recognize that Bob intends to enter lab B based on John's request.

[0059] Different types of doorways or entry points can change how intent is utilized and when a reader sends a release to the access control system. For example, an entry point may be a turnstile, and if there are a large number of turnstiles, the intent turnstile may not be recognized until a person has stepped into the turnstile. Types of doorways or entry points may include manual locks, automatic locks, manual doors, automatic doors, turnstiles, transit express doors, parking doors, or elevators.

[0060] The time to release the credential and unlock the doorway can be determined by data received from ranging and positioning performed by UWB. The intent can be changed by the distance radius from the reader. Different entry environments may change this time. For example, an open area of ​​an office with multiple secure doorways may result in waiting until the key device is at a specific doorway before the release occurs because a sufficiently high probability of intent cannot be determined due to the multiple secure doorways. Conversely, the front door lock of a house may be released well before the person reaches that door because there will be no other doors for the person to enter.

[0061] The key device can be a mobile device, such as a smartphone or tablet. Devices such as smartphones include different types of sensors that can provide information to the PACS. Since the key device communicates with the reader and PACS via BLE and UWB wireless connections, data collected from sensors on the key device can be sent to the reader and PACS. The key device can include sensors such as gyroscopes, accelerometers, barometers, global positioning systems (GPS), microphones, and cameras. The key device can collect information from communication protocols such as Wi-Fi, BLE. The data provided from these sensors and communication protocols can be used to determine the relative position, movement, and speed of the key device.

[0062] Sensor data can provide information for determining the intent of a person with a key device. For example, the PACS can determine that the key device is approaching a doorway quickly. Using data provided from the gyroscope and accelerometer, the PACS can identify that the person is running. Based on the determination that the person is running, different actions can be taken. In one case, if there is only one doorway that a person has credentials to access, the PACS can unlock the door faster because the person will reach the door faster than if they were walking. In another case, if the person has credentials to multiple conference rooms, but using the calendar system, the PACS identifies that a meeting started in one of the conference rooms 10 minutes ago, the PACS can determine that conference room is the intended destination based on the person running.

[0063] Data stored in the mobile device and the current capabilities of the mobile device can be passed to the PACS and used to determine intent. If the PACS is not connected to a calendar system, the mobile device can provide information from reminders or calendars or in the mobile device. For example, a person living in an apartment building may share childcare responsibilities with another tenant and each may have access to the other's apartment. The person may have a reminder to pick up the other tenant's child from school, which is used to identify the person's intent to enter the other tenant's apartment.

[0064] The current function of the mobile device can be communicated to the PACS, such as whether the person is talking on the phone or playing a game on the mobile device. For example, if a person is playing a game on their mobile device while walking along the corridor, it can be determined that the intention to enter the conference room is low.

[0065] Cameras, noise sensors (microphones), and environmental sensors such as thermometers and barometers can be used to provide information to the PACS to identify intent. For example, cameras can be used to help identify which turnstile a user intends to enter. The temperature outside may affect the user's path or habits. For example, if two doorways are close to each other, but one leads outside, the PACS can determine that the outside doorway is likely the intended doorway if it is freezing outside.

[0066] The PACS may be connected to additional systems that may not require a key device to access but provide an indication of the actions of a person who may subsequently attempt to enter a doorway controlled by the PACS. This may include Internet of Things (IoT) devices. Examples of devices and systems that a person may interact with that may provide indications of intent and behavior patterns to the PACS may include garage door openers, thermostats, smart lighting, televisions, and appliances.

[0067] A PACS can use a neural network trained with user habits to predict and recognize a user's intent to enter a door. This can include recognizing different actions or connections that a user may be performing, such as using their mobile device. For example, an office may have a gym that people use. As part of Tara's normal work day, she may walk past the gym's door and reader multiple times a day. However, when Tara does use the gym, she is usually listening to music using her Bluetooth earbuds. The PACS neural network can use this data to recognize that Tara usually intends to enter the gym when using her earbuds, but has very low intent to enter at other times.

[0068] The habits of each user can be used to train the PACS neural network to identify common user actions and action sequences, which can be used to identify intended doorways and entry points. For example, a typical day for a person may include: entering a building access point, entering an access point on their floor, and then accessing a secure room. Some of these access points may have multiple options, such as different doors for different tenant floors. The habit data may include other data to identify changes in habits. For example, the previously described habits may be for when a person arrives at the office in the morning. However, at lunch time, a person may return with lunch and enter the lunch room through a different doorway on the floor.

[0069] A trained neural network can be used to identify the intent of an unknown or new user. For example, a new employee may start a job and therefore no specific habit data exists for that employee. The PACS neural network identifies that the employee works in accounting, thereby using trained data of other accounting employees to identify the intent of the new employee.

[0070] The PACS can receive data about other applications and functions that users perform with their mobile devices. For example, a user may have a Wi-Fi-connected light in an office or conference room. The user may turn on the light with their mobile device before they reach the door of such a room. The PACS can use this motion data to recognize that the user intends to enter the room.

[0071] The PACS neural network can combine multiple factors to identify the intent of a person to enter a door and the time at which the credentials used to enter the door were released. For example, determining a user's normal routine may be affected by temperature.

[0072] When receiving credentials via BLE, the reader can perform preliminary authentication to identify whether the credentials provided by the key device should be authenticated and whether any further communication with the key device should occur, such as ranging using UWB. If the reader can determine using extensive verification that the provided credentials will not be authenticated, the power and processing cost of using UWB to range the key device is eliminated.

[0073] Initial authentication can be performed using a blacklist or a whitelist. Blacklists and whitelists can have conditional factors, such as time conditions. For example, a building may restrict access at night, so a whitelist that only includes security and maintenance is used from 8:00 pm to 6:00 am.

[0074] Preliminary authentication can be performed through regular expression matching and similar pattern recognition. The reader can receive the credential through BLE communication with the key device. The reader can use a regular expression of the format sequence of the credential accepted at the reader for entry to identify whether the received credential is the correct format sequence. If not, the reader can discard the credential and stop communicating with the key device. As an example, the format sequence of the credential accepted by the reader for entry can be the letters "K" followed by six digits. If the format sequence of the credential provided is the letters "WX" followed by seven digits, the reader can ignore the credential and not cache or authenticate it, including stopping any communication or ranging to save power and processing.

[0075] The PACS can initiate additional precautions for accessing a secure doorway based on people in the vicinity of the person attempting to access the secure doorway, such as to prevent tailgaters (e.g., people trying to gain access by following an authorized person). If the PACS identifies an unauthorized key device in the vicinity of an authorized key device, this can increase the threshold for identifying intent and only unlock the doorway if the authorized key device is in close proximity to the doorway. The same scenario can apply if a camera is used with the PACS and there is a person without a key device in the vicinity of a person with an authorized key device.

[0076] Figure 5 A flow diagram showing a technique 500 for managing access to an asset is shown according to some implementations. The technique 500 can be used to manage access to an asset where the asset is a physical location, such as a room, building, or home. The technique 500 can be used to manage access to an asset where the asset is an electronic device, such as a computer, a computer network, a smart phone, or a specific device such as an ATM.

[0077] Technique 500 includes an operation 502 of establishing a first connection with a key device (e.g., a connection between a key device and a reader). The first connection may be NFC, such as RFID technology, or PAN technology, such as IEEE 802.15.1, Wi-Fi, or BLE. The key device may be a physical card with an integrated circuit that stores information such as credentials and information about the holder of the key device. The key device may be a mobile device such as a smartphone. The mobile device may include an application for interfacing with the reader or include a secure element.

[0078] Technique 500 includes an operation 504 of receiving a user's credentials via a first connection. After establishing the first connection between the reader and the key device, the key device may send the credentials (e.g., the user's credentials) to the reader. Technique 500 may include an operation of storing the credentials in a cache memory of the reader. The credentials may be stored in other memory or sent to another computer system for storage in a corresponding memory of the system.

[0079] Technique 500 includes an operation 506 of establishing a second connection with a key device. The second connection may be UWB. Technique 500 may include an operation of using the second connection to maintain a location or position of the key device. The location or position may be determined using range detection. The operation of establishing the second connection with the key device may occur based on the interaction of the key device using the first connection.

[0080] Technique 500 may include an operation of authenticating the credentials of a user associated with the credentials for accessing the asset. Authentication may include sending the credentials to an authentication authority. Technique 500 may include an operation of receiving a verification indication from an authentication service and thereby allowing access to the asset.

[0081] Technique 500 includes an operation 508 of providing credentials to an access controller. Providing credentials to an access controller may include an operation of transferring credentials from a cache memory. The credentials may be provided to the access controller based on determining that a user intends to access an asset. The access controller may include a physical access control system controller.

[0082] When determining that the user intends to access the asset, the technique 500 may include an operation of determining a set of location points of the key device using the second connection. The location point may be a location, position, or range from a reader detected by UWB. The technique 500 may include an operation of calculating a probability that the user will access the asset using the set of location points. The technique 500 may include an operation of determining that the probability exceeds a predetermined threshold. Depending on the type of asset and secure access, the threshold may be adjusted so that a high probability threshold may be set for more secure assets and a low probability threshold may be set for less secure assets.

[0083] Technique 500 may include operations for receiving a verification indication from an access controller and allowing access to an asset. For example, a user's credentials for accessing an asset may be verified. The asset may be a doorway or a secure entry point, or the asset may be an electronic device.

[0084] Technique 500 may include an operation to remove credentials from a cache memory. The credentials may be removed from the cache memory based on receiving an indication that the user is not allowed to access the asset. For example, the credentials may not be verified, and the reader may receive an indication that the user may not be able to access the asset. The credentials may be removed from the cache memory based on the loss of the second connection with the key device. For example, if the key device moves out of range of the second connection, this may indicate that the key device (and the user) is no longer close to the reader, and therefore the intent to access the asset is low, so the credentials are removed from the cache memory. The credentials may be removed from the cache memory based on the passage of a predetermined time. For example, from the time the second connection is established, if the key device has not been used to access the asset within a predetermined time period, the credentials may be removed from the cache memory. This may be performed to save memory and resources. The user may need to perform an action such as placing the key device on the reader to transmit the credentials again and attempt to access the asset.

[0085] Figure 6 A flow chart showing a technique 600 for managing access to an asset using a key device is shown according to some embodiments. The technique 600 can be used to manage access to an asset where the asset is a physical location, such as a room, building, or home. The technique 600 can be used to manage access to an asset where the asset is an electronic device, such as a computer, a computer network, or a smart phone.

[0086] Technique 600 includes an operation 502 of establishing a first connection between the key device and the reader when the key device enters a first connection range. The first connection may be a PAN, such as over BLE. Technique 600 includes an operation 604 of providing credentials associated with a user from the key device to the reader using the first connection.

[0087] Technique 600 includes an operation 606 of establishing a second connection between the key device and the reader. The second connection may be UWB. The second connection is based on the key device entering the range of the second connection. For example, UWB does not have as large a range as BLE. The key device may first establish a connection with the reader via BLE. When the key device moves closer to the reader and is within the range of UWB, the key device and the reader may establish a second connection via UWB. Through UWB, the range or location of the key device may be determined.

[0088] Technique 600 includes an operation 608 of providing credentials from the reader to the authorization service. The reader may send the credentials to receive authorization for the user of the key device to access the asset. Technique 600 includes an operation 610 of receiving verification of the credentials from the authorization service at the reader. If the credentials do not have permission to access the asset, the reader may receive a rejection from the authorization service.

[0089] Technique 600 includes an operation 612 of sending a command from the reader to the access controller to grant access to the asset. This may be a command to unlock a door or a command to unlock an electronic device for use. Credentials may be provided to the access controller based on a determination that the user intends to access the asset. Upon determining that the user intends to access the asset, technique 600 may include an operation of determining a set of location points for the key device at the reader using a second connection. This may be performed by range detection using UWB. Technique 600 may include an operation of calculating a probability that the user will access the asset using the set of location points and determining that the probability exceeds a predetermined threshold.

[0090] The user's intent to access an asset may be determined based in part on sensor data collected from sensors of the key device. For example, the key device's GPS may provide location information, or the key device's accelerometer may provide movement information (e.g., the user is running).

[0091] Figure 7 A flow chart showing a technique 700 for managing access to an asset is shown in accordance with some embodiments. The technique 700 includes an operation 702 of receiving a first message from a wireless key device associated with a user using a first wireless connection. The PACS may receive the first message at a reader for a secure entry point. The first message may include user credentials. The first wireless connection may be NFC, such as RFID technology, or PAN technology, such as IEEE 802.15.1 and BLE.

[0092] Technique 700 includes an operation 704 of receiving a message set from a wireless key device using a second wireless connection. The second wireless connection may be UWB. The message set may be a series of communications back and forth between the reader and the key device. The communications may include a seed or hash counter to provide security and prevent spoofing of the key device.

[0093] Technique 700 includes an operation 706 of identifying a set of location points of the wireless key device for the set of messages using the second wireless connection. The PACS may identify the location of the key device or the range of the key device to the reader or readers using a communication technology such as UWB.

[0094] Technique 700 includes an operation 708 of determining that the user intends to physically access a secure entry point based on the set of location points. The secure entry point can be one of a plurality of secure entry points within the range of the second wireless connection. Technique 700 includes other operations of determining a secure entry point that the user intends to physically access from among the plurality of secure entry points based on calculating a trajectory from the set of location points.

[0095] Technique 700 includes other operations of calculating the probability that a user will physically access a secure access point using the set of location points and determining that the probability exceeds a predetermined threshold. For example, the reader may identify multiple radial ranges from the reader. The probability may increase for each progressively approaching range in which the key device is determined. The probability may decrease if it is determined that the key device stops within one of the ranges or if the key device returns to a farther range. The predetermined threshold may be used to identify when the probability or intent is high enough that the secure access point should be released. The threshold may depend on factors such as the security level of the area being accessed (i.e., a conference room or development lab), the number of other access points nearby, and the frequency with which a particular key device accesses the secure access point.

[0096] Technique 700 includes an operation 710 of sending a command to unlock a secure entry point. There are many types of secure entry points, such as doorways, turnstiles, pass-through doors, elevators, and parking arms. Unlocking a secure entry point includes any applicable method for that type of secure entry point that will provide restricted access to become unrestricted to the key device holder.

[0097] Technique 700 includes other operations of sending the credential to an authorization service. The authorization service may be local to the reader, such as in a residence. The authorization service may be connected to the reader via a network or the Internet to provide credential authorization to multiple locations or access points. The authorization service may be integrated into the reader. Technique 700 includes other operations of receiving from the authorization service an indication that the user is authorized to access a secure access point. The authorization service may verify the credential and return to the reader an indication that the credential holder is authorized or not authorized to enter the secure access point.

[0098] Figure 8 A flow chart showing a technique 800 for managing access to an asset is shown according to some implementations. The technique 800 includes an operation 802 of receiving credentials from a key device associated with a user using a first wireless connection. The first wireless connection can be NFC, such as RFID technology, or PAN technology, such as IEEE 802.15.1 and BLE.

[0099] Technique 800 includes an operation 804 of verifying the credential using a preliminary authentication of the asset. The preliminary authentication may occur at a reader or a device local to the reader. The preliminary authentication may include using pattern matching to identify that the credential includes a pattern. The pattern may be defined using a regular expression. Technique 800 includes an operation of verifying the credential using a preliminary authentication by comparing the credential to a whitelist of credentials. The whitelist may be applied to the preliminary authentication based on the time of day. For example, a whitelist may identify a group of people who are allowed to enter an office building at night and on weekends.

[0100] Technique 800 includes establishing a second wireless connection with the key device in response to verifying the credentials using preliminary authentication 806. The second wireless connection can be UWB. The PACS can use communication technology such as UWB to identify the location of the key device or the range of the key device to the reader or readers.

[0101] Technique 800 includes operations of sending credentials to an authorization service and receiving an indication from the authorization service that the user is authorized to access the asset. A preliminary authorization is performed to help eliminate any credentials that would be automatically rejected by the authorization service because the credentials may not conform to the correct format or pattern. This can eliminate the time and processing of sending and authenticating these credentials. Technique 800 includes operations 808 of providing a command to grant access to the asset.

[0102] Fig. 9 A flow chart showing a technique 900 for managing access to an asset is shown according to some embodiments. The technique 900 includes an operation 902 of receiving a credential for an asset from a key device associated with a user using a first wireless connection. The first wireless connection can be NFC, such as RFID technology, or PAN technology, such as IEEE 802.15.1 and BLE.

[0103] Technique 900 includes an operation 904 of storing the credential in a cache of memory. The PACS may cache the credential in a memory (e.g., a memory of a reader) for future authentication when the user intends to enter the asset. The intent threshold for authenticating the credential may be below the intent threshold for unlocking access to the asset. For example, as the user moves toward a doorway, the PACS may determine that there is a 60% probability that the user intends to enter the doorway and send the credential to the authentication service. As the user continues toward the doorway, the probability may change to 90% and the reader then sends a command to unlock the doorway.

[0104] Technique 900 includes an operation 906 of establishing a second wireless connection with the key device. The second wireless connection may be UWB. The PACS may use a communication technology such as UWB to identify the location of the key device or the range of the key device to the reader or readers.

[0105] Technique 900 includes an operation 908 of requesting verification of the credential from an authorization service in response to establishing a second wireless connection with the key device. The authorization service may be local to the reader, such as in a residence. The authorization service may be connected to the reader via a network or the Internet to provide credential authorization to multiple locations or entry points. The authorization service may be integrated into the reader.

[0106] Technique 900 includes an operation 910 of receiving a verification token from an authorization service. The verification token can be used to send to an authorization service or access control service to indicate that the provided credentials have been verified. Technique 900 includes an operation 912 of storing the verification token in a cache.

[0107] Technique 900 may also include an operation of determining, using a second wireless connection, that the key device is within a first range radius of a plurality of range radii, wherein the plurality of range radii extend from a wireless key device reader. The PACS may identify distance ranges from the reader. For example, the PACS may specify three ranges, a first within a five foot radius of the reader, a second within a five foot to ten foot radius of the reader, and a third within a ten foot to fifteen foot radius of the reader.

[0108] Technique 900 may also include an operation of determining, using a second wireless connection, that the key device is within a second range radius of the plurality of range radii, wherein the second range radius is closer to the wireless key device reader than the first range radius. Based on the previous example of three ranges, the PACS may use UWB to determine that the key device was initially within the third range and has moved into the second range.

[0109] Technique 900 may also include an operation to calculate a probability that the user intends to physically access the asset based on determining that the wireless key device is within a second range radius. Based on the previous example, the key device has moved from a longer range to a shorter range, thereby increasing the probability that the user is moving toward the reader.

[0110] The technique 900 may also include an operation of determining that the probability exceeds a predetermined threshold. The technique 900 may also include an operation of sending a verification token to an access control service. Based on the probability exceeding the threshold, the PACS may send the verification token to the access control service to indicate that the asset should be unlocked. The technique 900 may also include an operation of receiving a command to grant access to the asset. The authorization service and the access control service may be integrated into the PACS, may be networked to the PACS, or may be separate services to the PACS.

[0111] Technique 900 may also include the operation of determining using a second wireless connection that the key device is within a second range radius of the plurality of range radii, wherein the second range radius is farther from the wireless key device reader than the first range radius. Based on the previous example of three ranges, the PACS may use UWB to determine that the key device was initially within the second range and has moved farther into the third range.

[0112] Technique 900 may also include operations to remove verification tokens and credentials from the cache. Based on the previous example, the key device has been moved from a closer distance range to a farther distance range, thereby increasing the probability that the user does not intend to access the asset, and therefore the stored information (e.g., credentials and verification tokens) is removed from the cache.

[0113] Technique 900 may also include an operation for determining that a response from the key device has not been received within a predetermined time period. When the PACS sends the message, the PACS may start a timer. When the PACS receives a response from the wireless key device, the timer may be canceled. If the timer times out, based on the determined timeout period, the PACS may determine that the wireless key device is no longer in range and therefore the probability that the user intends to access the asset is very low. Technique 900 may also include an operation for removing verification tokens and credentials from the cache based on no longer being needed.

[0114] Fig.10 A flow chart showing a technique 1000 for managing access to an asset is shown according to some implementations. The technique 1000 includes an operation 1002 of receiving a user's credentials from a key device associated with the user using a first wireless connection. The first wireless connection can be NFC, such as RFID technology, or PAN technology, such as IEEE 802.15.1 and BLE.

[0115] Technique 1000 includes an operation 1004 of establishing a second wireless connection with the key device. The second wireless connection may be UWB. The PACS may use a communication technology such as UWB to identify the location of the key device or the range of the key device to a reader or readers.

[0116] The technique 1000 includes an operation 1006 of determining the user's intent to access the asset based on a generated data set derived from a second wireless connection. The PACS can determine location information based on the second wireless connection using UWB. The second wireless connection can include information from a key device, such as sensor data from a sensor of the key device. The data set can include both data provided from the key device and derived from the second wireless connection that can be used to determine the user's intent.

[0117] When determining that a user intends to access an asset, the technique 1000 may include operations for determining a probability that the user intends to access the asset using a data set and a trained machine learning model. The trained machine learning model is trained using a data set collected from multiple users. The data set may include movement data of multiple users within the asset. The data set may include movement data from multiple users. The information received from the wireless key device may include movement data of the user collected from an accelerometer of the wireless key device.

[0118] For example, for a particular asset or secure entry point, location data and movement data of how different people approach the secure entry point and move toward the secure entry point when entering the secure entry point and data when people are not entering the secure entry point can be used to train a machine learning model. This training can provide a machine learning model to recognize how people are likely to move and the angles at which they approach when their intention is to enter the secure entry point. The data set can include a timestamp of the time of day and the user's data set can be timestamped. Including time in the training of the machine learning model can indicate different patterns and actions based on the time of day. For example, people may be less likely to visit a secure entry point during lunch time.

[0119] The determination of the user's intent to access the asset may include using data received from a calendar system. The technique 1000 may also include an operation of identifying an event in the calendar system that is associated with the asset. For example, the calendar system may indicate that a meeting is ongoing in a room attached to a secure entry point. The technique 1000 may also include an operation of identifying an indication that the user is present at the event. The calendar system may provide a list of attendees for the meeting and the PACS may identify that the user is one of those attendees, which may increase the probability that the user intends to enter the secure entry point. The technique 1000 includes an operation 1008 of sending a command to grant access to the asset.

[0120] Fig.11 A block diagram of an example machine 1100 on which any one or more of the techniques (e.g., methods) discussed herein can be performed is shown. In alternative embodiments, the machine 1100 can be operated as an independent device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine 1100 can operate in a server-client network environment with the capabilities of a server machine, a client machine, or both. In an example, the machine 1100 can act as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. The machine 1100 can be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a web application, a network router, a switch or a bridge, or any machine capable of (sequentially or otherwise) executing instructions specifying the actions to be taken by the machine. In addition, although only a single machine is shown, the term "machine" can also be considered to include any collection of machines that execute a set (or multiple sets) of instructions individually or jointly to execute any one or more of the methods such as cloud computing, software as a service (SaaS) or other computer cluster configurations discussed herein.

[0121] As described herein, examples may include logic or multiple components or mechanisms, or may be operated by logic or multiple components or mechanisms. A circuit group is a collection of circuits implemented in a tangible entity including hardware (e.g., simple circuits, gates, logic, etc.). The circuit group members may be flexible over time and underlying hardware variability. A circuit group includes members that can perform specified operations individually or in combination when operating. In an example, the hardware of the circuit group may be designed to perform specified operations (e.g., hardwired) invariably. In an example, the hardware of the circuit group may include variably connected physical components (e.g., execution units, transistors, simple circuits, etc.) to encode instructions for specified operations, and the variably connected physical components include computer-readable media that are physically modified (e.g., magnetically, electrically, removably placed particles of constant mass, etc.). When the physical components are connected, the underlying electrical properties of the hardware components are changed, such as being changed from an insulator to a conductor or from a conductor to an insulator. Instructions enable embedded hardware (e.g., execution units or loading mechanisms) to create members of the circuit group in hardware via variable connections to perform parts of specified operations when operating. Thus, when the device is in operation, the computer-readable medium is communicatively coupled to other components of the circuit group members. In an example, any component of the physical component can be used in more than one member of more than one circuit group. For example, in operation, an execution unit can be used in a first circuit of a first circuit group at one point in time and reused by a second circuit in the first circuit group or by a third circuit in the second circuit group at a different time.

[0122] The machine (e.g., computer system) 1100 may include a hardware processor 1102 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, a field programmable gate array (FPGA), or any combination thereof), a main memory 1104, and a static memory 1106, some or all of which may communicate with each other via an interconnect (e.g., a bus) 1108. The machine 1100 may also include a display unit 1110, an alphanumeric input device 1112 (e.g., a keyboard), and a user interface (UI) navigation device 1114 (e.g., a mouse). In an example, the display unit 1110, the input device 1112, and the UI navigation device 1114 may be a touch screen display. The machine 1100 may additionally include a storage device (e.g., a drive unit) 1116, a signal generating device 1118 (e.g., a speaker), a network interface device 1120, and one or more sensors 1121 such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 1100 may include an output controller 1128, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0123] The storage device 1116 may be a machine-readable medium 1122 on which is stored one or more data structure sets or instructions 1124 (e.g., software) that implement or are used by any one or more of the techniques or functions described herein. The instructions 1124 may also reside, in whole or in part, within the main memory 1104, within the static memory 1106, or within the hardware processor 1102 during execution of the instructions by the machine 1100. In an example, one or any combination of the hardware processor 1102, the main memory 1104, the static memory 1106, or the storage device 1116 may constitute a machine-readable medium.

[0124] Although the machine-readable medium 1122 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database, and / or associated caches and servers) configured to store one or more instructions 1124 .

[0125] The term "machine-readable medium" may include any medium capable of storing, encoding, or carrying instructions for execution by the machine 1100 and causing the machine 1100 to perform any one or more of the techniques of the present disclosure, or capable of storing, encoding, or carrying data structures used by such instructions or data structures associated with such instructions. Non-limiting machine-readable medium examples may include solid-state memory and optical and magnetic media. In an example, a large-capacity machine-readable medium includes a machine-readable medium having a plurality of particles, the particles having a constant (e.g., stationary) mass. Therefore, the large-capacity machine-readable medium is not a transient propagation signal. Specific examples of large-capacity machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.

[0126] The instructions 1124 may also be sent or received over a communication network 1126 using a transmission medium via the network interface device 1120 using any of a number of transmission protocols (e.g., frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile telephone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network (e.g., a wireless network known as a cellular network). The Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards, known as 16 family of standards), IEEE 802.15.4 family of standards, peer-to-peer (P2P) networks, etc. In an example, the network interface device 1120 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas for connecting to the communication network 1126. In an example, the network interface device 1120 may include multiple antennas to communicate wirelessly using at least one of single-input multiple-output (SIMO) technology, multiple-input multiple-output (MIMO) technology, or multiple-input single-output (MISO) technology. The term "transmission medium" should be taken to include any intangible medium that can store, encode, or carry instructions for execution by the machine 1100, and includes digital or analog communication signals or other intangible media to facilitate the communication of such software.

[0127] The above detailed description includes reference to the accompanying drawings, which form a part of the detailed description. The accompanying drawings show specific embodiments that can be put into practice by way of illustration. These embodiments are also referred to as "examples" in this article. Such examples may include elements other than the elements shown or described. However, the inventors also consider examples in which only the elements shown or described are provided. In addition, the inventors also consider examples using any combination or permutation of these elements (or one or more aspects of these elements) shown or described with respect to a specific example (or one or more aspects of a specific example) or with respect to other examples (or one or more aspects of other examples) shown or described in this article.

[0128] All publications, patents, and patent documents mentioned in this document are incorporated herein by reference in their entirety, as if individually incorporated by reference. If there is an inconsistent usage between this document and those documents incorporated by reference, the usage in the incorporated (one or more) reference documents should be considered to supplement the usage of this document; for contradictory inconsistencies, the usage in this document shall prevail.

[0129] In this document, as is common in patent documents, the terms "a" or "an" are used to include one or more than one, regardless of any other instance or use of "at least one" or "one or more". In this document, unless otherwise indicated, the term "or" is used to represent a non-exclusive or, such that "A or B" includes "A but not B", "B but not A", and "A and B". In the appended claims, the terms "including" and "in which" are used as the plain English equivalents of the respective terms "comprising" and "wherein". In addition, in the following claims, the terms "including" and "comprising" are open-ended, that is, systems, devices, articles, or processes that include elements other than those listed after such terms in a claim are still considered to fall within the scope of the claim. In addition, in the following claims, the terms "first", "second", and "third", etc. are used merely as labels and are not intended to impose numerical requirements on their objects.

[0130] The above description is intended to be illustrative, not restrictive. For example, the above examples (or one or more aspects of the above examples) can be used in combination with each other. After viewing the above description, other embodiments can be used, for example, by a person of ordinary skill in the art. The abstract is to enable the reader to quickly determine the nature of the technical disclosure, and the abstract is submitted with the understanding that the abstract will not be used to interpret or limit the scope or meaning of the claims. In addition, in the above specific embodiments, various features can be combined together to simplify the present disclosure. This should not be interpreted as intended to be a public feature that is not claimed for protection is necessary for any claim. Instead, the subject matter of the invention may be less than all the features of a specific disclosed embodiment. Therefore, the following claims are hereby incorporated into the specific embodiments, wherein each claim is independently used as a separate embodiment. The scope of this embodiment should be determined with reference to the attached claims and the full range of equivalents given by these claims.

[0131] In addition, the present disclosure also includes the following embodiments.

[0132] Embodiment 1. A method for managing access to an asset, comprising:

[0133] receiving credentials of a user from a key device associated with the user using a first wireless connection;

[0134] Establishing a second wireless connection with the key device;

[0135] determining, based on a generated data set derived from the second wireless connection, that the user intends to access the asset; and

[0136] A command is sent granting access to the asset.

[0137] Embodiment 2. The method of embodiment 1, wherein the first wireless connection is Bluetooth low energy and the second wireless connection is ultra-wideband.

[0138] Embodiment 3. The method according to embodiment 1 or embodiment 2, wherein determining that the user intends to access the asset further comprises:

[0139] determining a probability that the user intends to access the asset using the dataset and a trained machine learning model, wherein the trained machine learning model is trained using a dataset collected from a plurality of users; and

[0140] It is determined that the probability exceeds a predetermined threshold.

[0141] Embodiment 4. The method of embodiment 3, wherein the data set includes movement data of the plurality of users within range of the asset.

[0142] Embodiment 5. The method of embodiment 4, wherein the data set includes a timestamp of a time of day, and wherein the data set for the user is timestamped.

[0143] Embodiment 6. The method of Embodiment 3, wherein the data set includes movement data from the plurality of users, and wherein the key device provides the movement data from an accelerometer of the key device.

[0144] Embodiment 7. The method of any preceding embodiment, wherein determining the user's intent to access the asset comprises using data received from a calendar system.

[0145] Embodiment 8. The method according to embodiment 7 further comprises:

[0146] identifying an event in the calendar system that is associated with the asset; and

[0147] An indication of the user's attendance at the event is identified.

[0148] Embodiment 9. A method according to any preceding embodiment, wherein the asset is a physical location.

[0149] Embodiment 10. A method according to any preceding embodiment, wherein the asset is an electronic device.

[0150] Embodiment 11. A system for managing access to an asset, comprising:

[0151] at least one processor; and

[0152] A memory comprising instructions, which, when executed by the at least one processor, cause the at least one processor to perform the following operations:

[0153] receiving credentials of a user from a key device associated with the user using a first wireless connection;

[0154] Establishing a second wireless connection with the key device;

[0155] determining, based on a generated data set derived from the second wireless connection, that the user intends to access the asset; and

[0156] A command is sent granting access to the asset.

[0157] Embodiment 12. The system of Embodiment 11, wherein the first wireless connection is Bluetooth Low Energy and the second wireless connection is Ultra Wideband.

[0158] Embodiment 13. The system of embodiment 11 or embodiment 12, wherein determining that the user intends to access the asset further comprises instructions for:

[0159] determining a probability that the user intends to access the asset using the dataset and a trained machine learning model, wherein the trained machine learning model is trained using a dataset collected from a plurality of users; and

[0160] It is determined that the probability exceeds a predetermined threshold.

[0161] Embodiment 14. The system of Embodiment 13, wherein the data set includes movement data of the plurality of users within range of the asset.

[0162] Embodiment 15. The system of Embodiment 14, wherein the data set includes a timestamp of a time of day, and wherein the user's data set is timestamped.

[0163] Embodiment 16. The system of Embodiment 13, wherein the data set includes movement data from the plurality of users, and wherein the key device provides the movement data from an accelerometer of the key device.

[0164] Embodiment 17. The system of any one of Embodiments 11 to 16, wherein determining the user's intent to access the asset comprises using data received from a calendar system.

[0165] Embodiment 18. The system according to embodiment 17 further comprises instructions for performing the following operations:

[0166] identifying an event in the calendar system that is associated with the asset; and

[0167] An indication of the user's attendance at the event is identified.

[0168] Embodiment 19. The system of any one of Embodiments 11 to 18, wherein the asset is a physical location.

[0169] Embodiment 20. The system of any one of Embodiments 11 to 19, wherein the asset is an electronic device.

Claims

1. A method for managing access to an asset in an access control system, the method comprising: receiving a credential from a key device using a first wireless connection, wherein the first wireless connection uses a low power communication protocol; verifying the credentials; Establishing a second wireless connection with the key device using ultra-wideband UWB; determining a probability that a user of the key device intends to physically access the asset based on the second wireless connection; determining that the probability exceeds a threshold, wherein the threshold is adjusted based on at least one of access rights or access history of the user; as well as In response to verifying the credentials and determining that the probability exceeds a threshold, the user is granted access to the asset.

2. The method according to claim 1, wherein: The threshold is adjusted based on the access history of the user.

3. The method according to claim 1, wherein: The key device is a mobile device.

4. A method for managing access to an asset in an access control system, the method comprising: receiving a plurality of credentials from a corresponding plurality of key devices using a first wireless connection, wherein the first wireless connection uses a low power communication protocol; For each credential in the plurality of credentials: verifying the credentials; Use ultra-wideband UWB to establish a second wireless connection with the corresponding key device; determining, based on the second wireless connection, a probability that a user of the corresponding key device intends to physically access the asset; determining that the probability exceeds a threshold; as well as In response to verifying the credential and determining that the probability exceeds a threshold, granting the user access to the asset; The threshold for each of the plurality of credentials is adjusted based on at least one of an access right or an access history corresponding to the corresponding credential.

5. The method according to claim 4, wherein: The threshold for each credential of the plurality of credentials is adjusted based on an access history corresponding to the respective credential.

6. The method according to any one of claims 1 to 5, wherein: The first wireless connection is Bluetooth Low Energy (BLE).

7. The method according to any one of claims 1 to 5, wherein: The asset is a physical location.

8. The method according to any one of claims 1 to 5, wherein: The asset is an electronic device.

9. The method according to any one of claims 1 to 5, wherein: Verifying the credential includes providing the credential to an access controller of the access control system for verification.

10. The method according to any one of claims 1 to 5, wherein: Validating the credential is performed after determining that the probability exceeds the threshold.

11. The method according to any one of claims 1 to 5, wherein: Establishing the second wireless connection is performed after verifying the credentials.

12. The method according to any one of claims 1 to 5, wherein: A trained machine learning model is used to determine a probability that the user intends to physically access the asset.

13. The method according to any one of claims 1 to 5, wherein: Determining the probability that the user intends to physically access the asset is also based on the user's habits.

14. A system for managing access to an asset, the system comprising: at least one processor; as well as a memory comprising instructions that, when executed by the at least one processor, cause the at least one processor to: receiving a credential from a key device using a first wireless connection, wherein the first wireless connection uses a low power communication protocol; verifying the credentials; Establishing a second wireless connection with the key device using ultra-wideband UWB; determining a probability that a user of the key device intends to physically access the asset based on the second wireless connection; determining that the probability exceeds a threshold, wherein the threshold is adjusted based on at least one of access rights or access history of the user; as well as In response to verifying the credentials and determining that the probability exceeds a threshold, providing a command to grant the user access to the asset.

15. The system of claim 14, wherein: The threshold is adjusted based on the access history of the user.

16. The system of claim 14, wherein: The key device is a mobile device.

17. The system of claim 14, wherein: The first wireless connection is Bluetooth Low Energy (BLE).

18. The system of claim 14, wherein: The asset is a physical location.

19. The system of claim 14, wherein: The asset is an electronic device.

20. The system of claim 14, wherein: The instructions causing the at least one processor to verify the credential include instructions causing the at least one processor to provide the credential to an access controller of the access control system for verification.

21. A system according to any one of claims 14 to 20, wherein: The instructions to cause the at least one processor to verify the credential include instructions to cause the at least one processor to verify the credential after determining that the probability exceeds the threshold.

22. A system according to any one of claims 14 to 20, wherein: The instructions causing the at least one processor to establish the second wireless connection include instructions causing the at least one processor to establish the second wireless connection after verifying the credentials.

23. A system according to any one of claims 14 to 20, wherein: A trained machine learning model is used to determine a probability that the user intends to physically access the asset.

24. A system according to any one of claims 14 to 20, wherein: The instructions causing the at least one processor to determine the probability that the user intends to physically access the asset include instructions causing the at least one processor to determine the probability that the user intends to physically access the asset further based on habits of the user.

25. A method of managing access to an asset in an access control system, the method comprising: establishing a first wireless connection with the key device using a low power communication protocol; receiving, via the first wireless connection, credentials of a user of the key device; Establishing a second wireless connection with the key device using ultra-wideband UWB; determining, using the second wireless connection, that the user intends to access the asset based on a plurality of communications with the key device, each communication including a session key, wherein a counter is hashed as part of the session key; as well as In response to determining that the user intends to access the asset, access to the asset is allowed.

26. The method according to claim 25, wherein: The counter is incremented with each communication over the second wireless connection.

27. The method of claim 25, wherein: Determining that the user intends to access the asset includes: determining that the user satisfies a first intent threshold based on the plurality of communications; and Allowing access to the asset further includes allowing access to the asset in response to determining that the user satisfies a second intent threshold based on the plurality of communications.

28. The method according to claim 27, wherein: The first intent threshold is lower than the second intent threshold.

29. The method of claim 1, further comprising: providing the credentials to an authorization service for verification; as well as A verification indication is received from the authorization service.

30. The method of claim 29, wherein: Responsive to determining that the user intends to access the asset, providing the credentials to an authorization service for verification occurs.

31. The method of claim 29, wherein: In response to receiving the verification indication from the authorization service, establishing the second wireless connection is performed.

32. The method of claim 30, wherein: Allowing access to the asset is additionally responsive to receiving the verification indication from the authorization service.

33. The method of claim 29, wherein: The authorization service is local to a reader establishing the first wireless connection and the second wireless connection.

34. The method of claim 29, wherein: The authorization service is networked with a reader that establishes the first wireless connection and the second wireless connection.

35. The method of claim 29, further comprising: The credentials are stored in a cache memory.

36. The method of claim 35, further comprising: Based on losing the second connection to the key device, removing the credential from the cache memory.

37. The method of claim 35, further comprising: Based on the lapse of a predetermined time, the credential is removed from the cache memory.

38. The method of claim 35, wherein: Providing the credentials to the authorization service includes transferring the credentials from the cache memory.

39. The method of claim 25, wherein: The low power communication protocol is Bluetooth Low Energy.

40. The method of claim 25, wherein: The asset is a physical location.

41. The method of claim 25, wherein: The asset is an electronic device.

42. The method of claim 25, further comprising: The plurality of communications are used to monitor the location of the key device.

43. An access control system comprising: at least one processor; A memory comprising instructions which, when executed by the at least one processor, cause the at least one processor to perform a method according to any one of claims 25 to 42.

44. A non-transitory machine-readable medium comprising instructions which, when executed by at least one processor, cause the at least one processor to perform the method of any one of claims 25 to 42.

Images