Physical access control system with intent detection based on location estimation

Abstract

To provide an improved system and method for a physical access control system performing intent detection based on location estimation.SOLUTION: The access control system can restrict access to assets. The access control system is configured to receive credentials for the asset from a key device associated with a user using a first wireless connection. The access control system is further configured to cache the credentials in memory. The access control system is further configured to establish a second wireless connection with the key device. The access control system is further configured to request confirmation of the credentials from an authorization service in response to establishing the second wireless connection with the key device. The access control system may receive a confirmation token from the authorization service. The access control system is further configured to cache the confirmation token.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] TECHNICAL FIELD The embodiments described herein relate generally to physical access control systems, and more specifically to physical access control systems with credential location capabilities. [Background technology]

[0002] Physical access to an area, such as walking through a doorway, can be controlled by an electronic physical access control system (PACS). A person may have a key card or a mobile device to present credentials to the PACS. PACS environments can vary in the number of people and entry points that may be granted access. For example, a corporate building may have a single entry point that allows entry access to all employees. Within the building, there may be multiple offices and private conference rooms that allow entry access to selected employees. Another example may be a hotel with many entry points per room, but each room is only accessible to selected individuals. [Brief description of the drawings]

[0003] [Figure 1] 1 illustrates an example of a user interacting with a PACS, according to some embodiments. [Figure 2A] 1 illustrates an example of key devices interacting with a PACS, according to some embodiments. [Figure 2B] 1 illustrates an example of key devices interacting with a PACS, according to some embodiments. [Figure 2C] 1 illustrates an example of key devices interacting with a PACS, according to some embodiments. [Figure 2D] 1 illustrates an example of key devices interacting with a PACS, according to some embodiments. [Diagram 3] 1 is an example of a person directly approaching three entrances, according to some embodiments. [Figure 4] 1 illustrates an example of a person approaching three doorways, according to some embodiments. [Diagram 5] 1 shows a flow diagram illustrating a method for restricting access to an asset according to some embodiments. [Figure 6] 1 shows a flow diagram illustrating a method for restricting access to assets using a key device, according to some embodiments. [Figure 7] 1 shows a flow diagram illustrating a method for restricting access to an asset according to some embodiments. [Figure 8] 1 shows a flow diagram illustrating a method for restricting access to an asset according to some embodiments. [Figure 9] 1 shows a flow diagram illustrating a method for restricting access to an asset according to some embodiments. [Figure 10] 1 shows a flow diagram illustrating a method for restricting access to an asset according to some embodiments. [Figure 11] FIG. 1 is a block diagram illustrating an example of a machine in which one or more embodiments may be implemented. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0004] In the drawings, which are not necessarily drawn to scale, like numbers refer to like elements in different views. Like numbers with different letter suffixes may represent different instances of like elements. The drawings generally illustrate, by way of example, but not by way of limitation, various embodiments discussed in the present document.

[0005] When an individual attempts to gain access to a secured area, the individual may be frustrated by the slow response of the unlocking of the secured access mechanism (e.g., electronic door lock) to the approach of the access point. For example, an employee may pass through the secured area access point multiple times a day. In addition, some conventional PACS may require the user to physically present a credential (e.g., card / badge or mobile device) to a wall-mounted reader, which may cause inconvenience or additional unnecessary delays in some situations, such as when the user's hands are full. Thus, a PACS that can more easily and seamlessly identify the user (e.g., authenticate the user's permission to unlock the secured area) would provide a more user-friendly and favorable experience. Furthermore, a user who gains access using a PACS may find advantages in a PACS that determines the user's intent, such as the PACS being able to proactively perform credential validation, such as unlocking the secured access mechanism as the user accesses the access point.

[0006] In some cases, the systems and methods described herein can provide a seamless experience by obtaining or receiving a credential from a user without requiring the user to actively present a device (e.g., a card or mobile device) that contains the credential. That is, in some cases, the systems and methods described herein can include a credential being automatically sent to a reader (e.g., without active input from the user) when the user accesses the reader.

[0007] In some cases, the systems and methods described herein may implement various schemes for detecting user intent so that an access point is opened not only when a user with proper credentials is in a defined vicinity of the access point, but also when an authenticated user is properly determined to intend to cross the access point. A difficulty with proactively performing credential validation would be to identify a false positive, resulting in unlocking a secured access mechanism when it should not be (e.g., a false intent positive). This is potentially problematic because it allows entry to unauthorized individuals. For example, an authorized individual may walk down a hallway and pass a secured access point. If the PACS misidentifies the individual's approach to the secured access point, the PACS may unlock the secured access mechanism. Although the individual has passed the door, another individual may enter through the secured access point while the secured access mechanism is unlocked.

[0008] Wireless PACS have typically used wireless communication technologies such as near field communication (NFC) such as radio frequency identification (RFID) and personal area network (PAN) technologies such as IEEE 802.15.1 and Bluetooth Low Energy (BLE). These technologies may have shortcomings for seamless user experience and entry. For example, the range of NFC is limited such that the exchange of credentials does not typically occur until the user attempts to gain access (e.g., standing at the door and holding a key card over a reader). The transfer of credentials to the reader and the response from the host server may take several seconds, resulting in user frustration. Furthermore, the user may typically be required to remove a key card or access device from, for example, his / her pocket and place it on or near the reader to initiate a transaction.

[0009] BLE devices have a range of tens of meters (e.g., 10-20 meters). Thus, when a user approaches a reader, a credential exchange can take place. The PAN standard may feature a secure handshake, encryption, and a favorable energy profile for discovery and data transmission. However, the PAN standard does not provide precise physical tracking of devices (e.g., ranging, location determination). Thus, it may be difficult for the reader to determine without further evidence of intent that the user's intent is to actually access a secured area. Further evidence of intent may include touching a door handle and fiddling with a key device. However, this may still be a less than ideal user experience compared to a user simply walking up to a reader and being granted access to a secured area.

[0010] Ultra-Wide Band (UWB) wireless communication protocols can be used for communication by encoding data via time modulation (e.g., pulse position coding). In UWB, symbols are designated by pulses emitted at a subset of the available set of time units. Other examples of UWB coding can include amplitude modulation and polar modulation. Wideband transmissions tend to be more resistant to multipath attenuation than carrier-based transmission techniques. Additionally, because the power of the pulses is weaker at any given frequency, they tend to interfere less with carrier-based communication techniques.

[0011] UWB can be used in radar operations to provide localization with an accuracy of tens of centimeters. Because the pulses can vary in absorption and reflection of different frequencies, both surface and occluded (e.g., covered) features of objects can be detected. In some cases, localization can provide angle of incidence in addition to range or distance.

[0012] Physical access control may include, for example, systems and methods governing access by people to a secured area. Physical access control may include identification of authorized users or devices (e.g., vehicles, drones) and activation of gates, doors, or other equipment used to secure the area. A PACS may include readers (e.g., online or offline readers) that hold authorization data and may be able to determine whether a provided credential is authorized to an actuator (e.g., door lock, door opener, deactivate an alarm). An online reader or system may include a network or internet connected system that determines authorization. An offline reader or system may be a self-contained system that does not connect to any external resources. For example, a residential PACS may be offline.

[0013] A PACS may include a host server to which readers and actuators are connected (e.g., via a controller) in a centralized configuration. In a centralized configuration, readers can obtain credentials from a key device (e.g., a card, fob, or a radio frequency identification (RFID) chip in a personal electronic device such as a cell phone) and pass these credentials to the PACS host server. The host server can determine whether the credentials grant access to a secured area and instruct the actuators accordingly.

[0014] To address issues with intent identification, location estimation techniques (e.g., using secure UWB ranging) can be combined with PAN discovery and key exchange. The key device and reader can coordinate secure ranging with PAN technology. This may include providing a secret (e.g., a scrambled time stamp (STS)) that the reader uses to mark ranging messages to prevent spoofing. The key device can provide credentials during the same PAN session where the secret is shared. The reader can decrypt or otherwise prepare the credentials as it normally would, except that the credentials are cached until an intent trigger occurs.

[0015] The reader can use UWB to physically estimate the location of the key device, in some examples UWB is activated after the secret is shared to conserve energy, which may be useful for battery-powered readers or key devices.

[0016] Using UWB to determine the physical location of the key device can be more accurate than other techniques and can be accurate to tens of centimeters, thus providing distance and direction to the reader. This accuracy is better than the approximately 10 meters accuracy of PAN when the readers are not coordinated. The precision of UWB accuracy provides the required details to determine the user's intent. For example, several zones may be defined, such as ranges of different distances from the reader, to understand the user's intent from different perspectives. Furthermore, the accuracy of the tracking allows for an accurate model that can distinguish the intent from the user's movements. Thus, the reader can classify the user's movements as likely to be approaching the reader or simply walking past it.

[0017] An intent threshold or intent trigger may be set. If the likelihood of intent exceeds the intent threshold, the intent trigger may initiate a series of events, such as operating the reader on a cached credential. In the case of an offline reader, the reader may control an actuator (e.g., the lock on a door lock being unlocked). In a centralized PACS, the reader may forward the credential to a host server that acts upon it (e.g., sending the credential to a controller for evaluation and activating a door lock appropriately).

[0018] By implementing the systems and methods described herein, a first transmission or exchange with a key device over a communication protocol with long distance ranging capabilities or, in some cases, low accuracy (e.g., BLE, Wi-Fi) can be used to provide the user's credentials to the reader. These credentials can be stored in a cached location in the reader until and unless a second transmission or exchange with the key device over a communication protocol with increased accuracy and precision (e.g., UWB) determines that the user truly intends to enter the secured area (e.g., to open the door in which the reader is installed). Once the user's intent is determined, the reader can then release the credentials (sometimes referred to as PACS bits) for processing, such as sending the credentials to a controller to determine the user's access permissions, or (e.g., in an offline reader) directly unlock the door. This two-step authentication sequence can reduce computation time that can lead to a delay (also referred to as latency) in opening the door for the user. With this scheme, authentication and communication between the reader and the key device has in fact already been performed by the time the system determines that the user intends to enter the door and that the user has arrived at the door.

[0019] In some embodiments, if an intent trigger does not occur within a certain time period, or if an unintended trigger occurs, such as moving away from the reader, the cached credentials may be cleared. This may be done because many credentials may be cached in the reader, but potentially a smaller subset of the cached credentials may actually be used in the authentication process (e.g., based on later predicted intent).

[0020] In some examples, for example, with an offline reader, if the reader identifies whether the credential allows access to a secured area, if it is determined that the credential does not allow access to the secured area, the credential is not cached and UWB position estimation may not be initiated.

[0021] In some embodiments, the reader may include persistent authentication of the credential. The persistence may be based on a timeout value. The length of time the credential is stored, or its persistence, depends on the timeout value. If the timeout is very long, the need to re-exchange the PAN credential is reduced.

[0022] For example, a key device is within PAN range to a reader. The reader can cache the PACS ID (e.g., 26-bit PACS in legacy systems) read from the credentials provided by the key device. A time-based one-time password (TOTP) technology seed is generated by the reader and shared with the key device over the PAN. The UWB ranging received from the key device includes the TOTP, which the reader verifies. If the UWB ranges the key device close enough (within a few meters) to the reader or other target (e.g., the center of the door), the reader sends the cached PACS ID to the host server. The host server triggers the door to open. The reader may then delete the cached PACS ID. Alternatively, if the UWB does not range the key device after a certain timeout period (e.g., 5 minutes), the TOTP is invalid. The key device must then connect to the reader to obtain a new TOTP. In addition, the PAN authentication may expire after a certain authentication timeout period (eg, several hours).

[0023] When using secure UWB position estimation, to function effectively in the system, all participating readers may require a seed or secret for secure ranging, e.g., STS, etc. For example, several readers may be connected (e.g., via BLE, mesh network, etc.) to distribute the same secret to all participating readers. This potentially reduces the need for an STS exchange between each reader and the key device. Furthermore, this sharing exchange may exchange a cached PACS ID (e.g., from one initial reader to which the key device is connected) with all readers. This way, one credential and STS exchange is required per key device.

[0024] A federated PACS, whether centralized or offline, can use a gateway device to coordinate multiple readers in the PACS. The readers can act as remote radio heads to the gateway, with the gateway performing credential caching, intent determination, and credential forwarding to a host server or instructing actuators to act. A federated PACS can enable UWB location determination of key devices using one or more of the connected readers. In some examples, the gateway can load balance the UWB location estimation performance. This can be useful in situations where key devices are densely packed, such as at ticketing speed-gates.

[0025] In some embodiments, the credential being sent to the reader may include encoded or encrypted information stored on a key device, such as a SEOS® credential by HID Global, a MIFARE® DESFire® credential by NXP, or a FeliCa® credential by Sony. The reader may decode or obtain various information from the credential received from the key device and provide that information to an access server (e.g., controller) to determine the authorization, e.g., access permissions, for the user. In some cases, the reader may decode the credential and obtain access control identification information (e.g., PACS bits) for the user and send these to the controller to determine whether the user has authorization to access the controlled area or system that he or she is attempting to access.

[0026] 1 shows an example 100 of a user interacting with a PACS, according to some embodiments. A doorway 105 can be secured by an electronic lock controlled via the PACS. The PACS uses a reader 110 to receive credentials from a user 115 who wishes to gain access to the doorway 105.

[0027] When the user 115 approaches the doorway 105 and the reader 110, the first wireless communication 120 communicates with the user's 115 key device. The first wireless communication 120 may be a low power communication such as BLE. The first wireless communication 120 may have the ability to communicate with the key device at a longer distance, but may not be able to perform key device location estimation and ranging. The reader 110 may use the first wireless communication 120 to receive the credential and other identifying information from the key device. The reader 110 may cache the credential or send the credential to a verification system of the PACS that may determine whether the user 115 may enter the doorway 105.

[0028] As the user 115 continues to approach the doorway 105 and the reader 110, the second wireless communication 125 begins to communicate with the user's 115 key device. The second wireless communication 125 may be a higher power and more advanced communication such as UWB. The second wireless communication 125 may include location estimation and ranging to track the user's 115 movements. The second wireless communication 125 may track the user 115 and use factors such as the speed at which the user 115 is moving to determine whether the user's 115 intention is to enter the doorway 105. For example, if the user 115 does not intend to enter the doorway 115, the speed may be constant. Conversely, if the user's 115 intention is to enter the doorway 105, the user 115 slows down his or her pace as he or she approaches the doorway 105 and reaches for the door handle.

[0029] The PACS can use the data received from the reader 110 using the second wireless communication 125 to determine the likelihood or probability that the user 115 intends to pass through the doorway 105. The determination can be a calculation using the received data, or the received data can be fed into a fixed or evolutionary model. If the determined intent probability exceeds a predefined threshold, the PACS can unlock the door to allow the user 115 to seamlessly enter the doorway 105. The threshold can vary depending on how accurate the probability determination is and how secure the doorway 105 needs to be. For example, a conference room may have a threshold of 50% intent probability since there is no risk if it is unlocked due to a false positive. However, a door in a new product development lab may have a threshold of 90% intent probability. Furthermore, the threshold can be modified for each user by associating additional information such as, but not limited to, access privileges and access history with the user credentials available to the system.

[0030] 2A-2D show an example 200 of a key device interacting with a PACS, according to some embodiments. The example PACS 200 includes a doorway 205 secured by a reader 210 and a lock 215. The reader includes a cache 220 that stores credentials and other data received from the key device. The reader 210 communicates with an access control 225, which may be a server connected to a local internal network, or a remote system connected via the Internet to coordinate access to multiple locations.

[0031] 2A, key device A 230, key device B 235, and key device C 240 are within BLE range (as an example of low energy wireless communication) of reader 210. Upon establishing a connection with reader 210, each of key device A 230, key device B 235, and key device C 240 provides a credential to reader 210.

[0032] In FIG. 2B, the reader 210 can perform a preliminary authentication of the credential. For example, the reader 210 may include a blacklist or a whitelist to make an immediate decision on tracking the key device. Using UWB for ranging and location estimation provides additional information on the movement of the key device, but at the same time, it requires more energy. Therefore, it may be advantageous if a decision is made whether to track the key device or not. In the example 200 of FIG. 2B, the reader 210 determines that the key device B 235 does not have a credential to access the doorway 205. Therefore, the reader 210 does not range the key device B 235 by UWB because the key device B 235 is not allowed to access the doorway 205.

[0033] In some embodiments, the reader 210 can send the credential to the access control 225 for authorization. If the access control 225 determines that the credential associated with the key device is authorized for access to the doorway 205 associated with the reader 210, the access control 225 can provide the reader 210 with a token for that credential. The reader 210 can store each token with each credential. Similarly, in this embodiment, if the reader 210 does not receive a token, the credential is deleted and the key device, such as key device B 235, is not tracked.

[0034] In some embodiments, the reader 210 can cache the credentials initially received via BLE. The reader 210 can keep the credentials in the cache until ranging using UWB occurs. Once the key device comes within range, the reader 210 can release the credentials for authentication by the access control 225 or an authentication server.

[0035] In Figure 2C, key device A 230 and key device C 240 are closer to the reader 210 and can use UWB for communication. UWB allows for location estimation or ranging. Location information for key device A 230 and key device C 240 is provided to the reader 210. The location information can be used to determine the person's intentions with respect to each key device. Location information can be derived from UWB, such as by performing distance sensing.

[0036] In FIG. 2D, key device A 230 and key device C 240 continue to move, and their location information is provided to the reader 210 via UWB communication. Key device C 240 is moving away from the reader 210, and therefore it is determined that key device C 240 has low intent to enter the doorway 205. The reader 210 can continue to track key device C 240 until it goes out of range. The reader 210 may have high battery and hardware sensitivity to monitor power and processing usage. This may include removing credentials from the cache immediately when it is determined that the credentials are no longer needed, such as intent dropping below a certain threshold. Managing cached credentials based on the trust or intent of the person accessing the entry point may be essential for a PACS that manages a set of entry points, such as turnstiles. This type of entry point may receive a large number of credentials at a particular time, such as entry to a subway or sports arena.

[0037] The key device A230 continues to approach the doorway 205, and therefore the intention of the key device A230 to access the doorway 205 is high. The reader 210 can release the token of the key device A230 to the access control 225. When the access control 225 receives the token, the access control 225 can send an unlock command to the door lock 215, allowing the person holding the key device A230 to easily and without delay to enter the doorway 205. If the token is not provided, the reader can send the credential of the key device A230 to the access control 225 to unlock the door lock 215. In the case of an offline system, the reader 210 can directly control the door lock 215 and send the unlock command directly to the door lock 215.

[0038] Many factors can be used to determine when the reader 210 should send a release, such as sending a token, to the access control 225. If the doorway 205 is in a secured area, the determined intent or probability to access the doorway 205 must be very high and therefore have a high threshold to prevent the doorway 205 from being opened inadvertently. Other factors may contribute to the intent threshold determination, such as how often a person accesses the doorway 205 or known situational data, such as a meeting about to start in the room of the doorway 205.

[0039] For security purposes, the reader 210 can generate a session key for communication with a key device such as the key device A230. For example, both the reader 210 and the key device A230 may have a counter. The counter can be hashed as part of the session key. To track the movement of the key device A230, the reader 210 communicates continuously with the key device A230 to determine the distance. With each communication, the reader 210 or the key device A230 can each increment the count value of the hashed counter. While the session key is thus changed with each communication to prevent malicious attacks, the reader 210 and the key device A230 can communicate continuously because each knows the correct contents of the counter and can decrypt the hash.

[0040] Identifying the intent of a person entering an entrance can be used to expedite the process of authenticating the credential and unlocking the entrance, so that the person is guided through the process in a manner that feels seamless, without being interrupted by the process. The above description has focused on identifying intent for a single entrance. Difficulties arise when identifying intent when there are multiple entrances and multiple readers, as in the examples of Figures 3 and 4.

[0041] FIG. 3 illustrates an example 300 of a person 335 directly approaching three doorways, according to some embodiments. The person 335 may approach a set of doorways directly in front of him / her. For each doorway 305, doorway 315, and doorway 325, it may be difficult for each reader 310, reader 320, and reader 330 to identify which doorway the person 335 intends to enter. For example, if the reader 310, reader 320, and reader 330 only use ranging, the person 335 will be within the same relative range from the reader. Once the position of the person 335 is identified, the direction of movement of the person 335 may be obtained by continuously performing position estimation of the person 335 (via his / her key device). The reader may use the determined direction to identify the angle of arrival 340. The angle of arrival 340 can be used to determine which of multiple doorways the person 335 intends to enter.

[0042] 4 illustrates an embodiment 400 of a person 435 approaching three doorways, according to some embodiments. The person 435 may approach a set of doorways that are side-by-side on one side of the person 435, such as when the person 435 is walking down a hallway in an office building. For each of the doorways 405, 415, and 425, it may be difficult for each of the readers 410, 420, and 430 to identify which doorway the person 435 intends to enter. The person 435 may stop at any of the doorways, even though the person 435 is at a different distance from each of the readers 410, 420, and 430.

[0043] As person 435 moves down the hallway and passes a reader, such as reader 430 in example 400, doorway 425 can be immediately removed from the set of possible intended entry doors. This can free up the cache of reader 430 and change the probability that person 435 intended entry through doorway 405 or doorway 415.

[0044] The PACS can attempt to monitor the speed of movement of the person 435. The speed of movement of the person in this situation may be relatively constant until the person reaches the intended doorway, at which point the pace of movement may slow down. This type of movement information can be used to identify the intended doorway. A neural network can be trained with movement data that shows how a person moves through a hallway and how their movement changes with respect to the doorway they enter. Using the PACS in conjunction with location data provided by the reader via UWB, the neural network can identify the intended doorway.

[0045] In example 400, the PACS can use context data to identify the intended entry / exit point. For example, the PACS can have access to a corporate calendar system. The PACS can identify that a meeting is about to begin in the room corresponding to entry / exit point 415. Thus, although the intended entry / exit point of person 435 cannot be determined by movement alone, the PACS can use the calendar to determine that person 435's intent is to enter entry / exit point 415. The accuracy of intent can be further improved if the PACS has access to people invited to the meeting and can match attributes of person 435 (from their key device) against the list of invitees.

[0046] Another situation in this example is when doorways 405, 415, and 425 with readers 410, 420, and 430 are in a hotel hallway. Identifying the intent of a visitor may not be easy since the visitor is likely to have credentials for only one doorway. Thus, as the visitor walks down the hotel hallway, the hotel PACS can predict the visitor's intent even before the visitor comes within range of the reader in his or her room, since the PACS can identify that the visitor has access credentials for only one doorway / room.

[0047] The PACS may have access to communication systems such as email, instant messaging, and short message service (SMS) that can provide information used to determine which entrance a person intends to enter. For example, if John sends Bob an instant message asking Bob to meet John in Lab B, as Bob approaches the lab entrance, the PACS can recognize that Bob intends to enter Lab B based on John's request.

[0048] Different types of entry points or points of entry may vary in the way the intent is used and when the reader sends a release to the access control system. For example, the entry point may be a turnstile, and if there is a long queue for the turnstile, identification of the intended turnstile may not occur until the person enters the turnstile. Types of entry points or points of entry may include manual lock, automatic lock, manual door, automatic door, turnstile, transfer speed gate, car park gate, or elevator.

[0049] The timing of the release of the credential and the unlocking of the entryway may be determined by the data received via ranging and location estimation performed by UWB. The intent may vary depending on the radius of the distance from the reader. Different entry environments may alter the above timing. For example, an open space in an office with multiple secured entryways may cause the key device to wait until it is at a specific entryway before releasing the credential, since the intent cannot be determined with a high enough probability due to the multiple secured entryways. Conversely, the front door lock of a house may be unlocked well before the person reaches the front door if there are no other doors to access for the person.

[0050] The key device may be a mobile device such as a smartphone or tablet. Devices such as smartphones contain different types of sensors that can provide information to the PACS. As the key device communicates with the reader and the PACS via BLE and UWB wireless connections, data collected from the sensors on the key device can be sent to the reader and the PACS. The key device may include sensors such as gyroscopes, accelerometers, barometers, global positioning systems (GPS), microphones, and cameras. The key device can gather information from communication protocols such as Wi-Fi and BLE. The data provided by these sensors and communication protocols can be used to determine the relative position, movement, and speed of the key device.

[0051] The sensor data can provide information to determine the intent of a person with a key device. For example, the PACS can determine that the key device is approaching a doorway quickly. The PACS can use data provided by the gyroscope and accelerometer to identify that the person is running. Different actions can be taken based on the determination that the person is running. In one situation, if the person has credentials to access only one doorway, the PACS can unlock the door early because the person will likely arrive at the door faster than if they were walking. In another situation, if the person has credentials for multiple conference rooms, but the PACS uses a calendar system to identify that a meeting in one conference room started 10 minutes ago, the PACS can determine that the conference room is the intended destination based on the person running.

[0052] Data stored on the mobile device and data of the current capabilities of the mobile device can be transmitted to the PACS and used to determine intent. If the PACS is not connected to a calendar system, the mobile device can provide information from a calendar or reminders in the mobile device. For example, a person living in an apartment building may share child care responsibilities with other residents and each may have access to the other's residence. The person may have a reminder to pick up the other resident's child for school, which is used to identify the person's intent to enter the other resident's residence.

[0053] The current function of the mobile device, for example, whether the person is talking on the mobile device or playing a game, can be transmitted to the PACS. For example, if a person walks down a hallway while playing a game on their mobile device, it can be determined that the intent to enter a conference room is low.

[0054] Cameras, noise sensors (microphones), and environmental sensors such as thermometers and barometers can be used to provide information to the PACS to identify intent. For example, cameras can be used to assist in identifying which turnstile the user intends to enter. Outdoor temperature can affect a user's path or habits. For example, if two entrances are close to each other but one leads to the outdoors, the PACS can determine that the outside entrance is more likely to be the intended entrance if it is currently below freezing outside.

[0055] The PACS may be connected to additional systems that may not require a key device to access and that provide indications of human behavior that may continue to attempt to gain access to a PACS controlled entryway. This may include Internet-of-Things (IoT) devices. Examples of devices and systems with which a person can interact that can provide indications of intent and behavioral patterns to the PACS may include garage door openers, thermostats, smart lighting, televisions, and home appliances.

[0056] The PACS can use a neural network trained with user habits to predict and identify the intent of a user accessing an entrance or exit. This may include identifying various actions or connections a user may be performing, such as with their mobile device. For example, an office may have a gym that people use. Tara may pass by the gym door and reader several times a day as part of a normal workday. However, when Tara uses the gym, she is typically listening to music on her Bluetooth earbuds. Using this data, the PACS neural network can identify that if Tara is using the earbuds, she typically intends to enter the gym, but otherwise the intent is very low.

[0057] The PACS neural network can be trained with each user's habits to identify common user actions and sequences of actions that can be used to identify intended entrances and entry points. For example, a typical day for a person may include entering an access point in the building, entering an access point to a floor of the building, and then accessing a secured room. Some of these access points may have multiple options, such as a floor having different doors for different tenants. The habit data may include other data to identify changes in habits. For example, the above habits may be from when the person arrived at the office in the morning. However, at lunchtime, the person may come back with their lunch and go to the cafeteria through a different entrance on the floor.

[0058] A trained neural network can be used to identify the intent of an unknown or new user. For example, a new employee has just started working, so there is no specific habit data for that employee. The PACS neural network identifies that the employee is an accountant, and therefore uses the trained data for other accountant employees to identify the intent of the new employee.

[0059] The PACS can receive data regarding other applications and functions that the user runs on his / her mobile device. For example, a user may have Wi-Fi connected lights in an office or conference room. The user can turn on the lights on his / her mobile device before arriving at the doorway of such a room. The PACS can use the behavioral data to identify that the user intends to enter the room.

[0060] The PACS neural network can combine multiple factors to identify the intent of a person entering a doorway and when to release a credential to enter the doorway, for example, determining that a user's normal routine may be affected by temperature.

[0061] The reader can perform pre-authentication when receiving the credential over BLE to identify whether to authenticate the credential provided by the key device and whether to perform further communication with the key device, such as ranging over UWB. If the reader can determine through rough validation that the credential provided is not authenticated, the power and processing cost of ranging the key device using UWB is reduced.

[0062] Pre-authentication can be performed using blacklists or whitelists. Blacklists and whitelists may have conditional elements, such as time conditions. For example, a building may restrict access at night, thus using a whitelist that includes only security and maintenance from 8:00 PM to 6:00 AM.

[0063] Pre-authentication can be performed by regular expression matching and similar pattern identification. The reader can receive the credential via BLE communication with the key device. The reader can use the regular expression of the format sequence of the credential accepted by the reader for ingress to identify whether the received credential is the correct format sequence. If not, the reader can discard the credential and stop communication with the key device. As an example, the credential accepted by the reader for ingress may be the format sequence of the letter "K" followed by six digits. If the provided credential is the format sequence of the letters "WX" followed by seven digits, the reader will ignore the credential and not cache or authenticate it, including stopping all communication or ranging to save power and processing.

[0064] The PACS can initiate additional precautions against access to a secured entry based on people in the vicinity of a person attempting to access the entry, such as preventing tailgaters (e.g., people who attempt to gain access by following an authorized person). If the PACS identifies an unauthorized key device in the vicinity of an authorized key device, not only will the threshold for identifying intent be increased, but the entry will only be unlocked if an authorized key device is in close proximity to the entry. The same applies when cameras are used in conjunction with the PACS and people without a key device are in the vicinity of a person with an authorized key device.

[0065] 5 shows a flow diagram illustrating a method 500 for restricting access to an asset, according to some embodiments. Method 500 may be used to restrict access to an asset when the asset is a physical location such as a room, a building, or a house. Method 500 may be used to restrict access to an asset when the asset is a computer, a computer network, an electronic device such as a smart phone, or a specific device such as an automated teller machine.

[0066] The method 500 includes an act 502 of establishing a first connection with a key device, e.g., a key device to reader connection. The first connection may be NFC, such as RFID, or PAN technology, such as IEEE 802.15.1, Wi-Fi, or BLE. The key device may be a physical card with an integrated circuit that stores information, such as credentials, and information about the holder of the key device. The key device may be a mobile device, such as a smartphone. The mobile device may include an application that interfaces with the reader or may include a secured element.

[0067] Method 500 includes an act of receiving 504 a user credential over a first connection. Once the first connection between the reader and the key device is established, the key device can transmit the credential, e.g., the user's credential, to the reader. Method 500 may include an act of storing the credential in a cache memory of the reader. The credential may be stored in another memory or transmitted to another computer system and stored in a respective memory of that system.

[0068] The method 500 includes an act of establishing 506 a second connection with the key device. The second connection may be UWB. The method 500 may include an act of maintaining a position or location of the key device using the second connection. The position or location may be determined using distance sensing. The act of establishing the second connection with the key device may occur based on an interaction with the key device using the first connection.

[0069] The method 500 may include an act of authenticating a user's credentials associated with the credential to access the asset. The authentication may include transmitting the credential to an authentication authority. The method 500 may include an act of receiving a confirmation indication from an authentication service to grant access to the asset.

[0070] The method 500 includes an act of providing 508 the credential to an access controller. Providing the credential to the access controller may include an act of transferring the credential from a cache memory. Providing the credential to the access controller may be based on a determination that the user intends to access the asset. The access controller may include a physical access control system controller.

[0071] The method 500 may include, upon determining that the user intends to access the asset, determining a location estimate of the key device using the second connection. The location estimate may be a location, place, or distance from the reader sensed via UWB. The method 500 may include calculating a probability that the user will access the asset using the set of location estimates. The method 500 may include determining that the probability exceeds a predefined threshold. The threshold may be adjusted depending on the type of asset and security access, such that a higher probability threshold may be set for assets with higher security and a lower probability threshold may be set for assets with lower security.

[0072] The method 500 may include receiving a verification instruction from an access controller to allow access to an asset. For example, a credential may verify that a user may access the asset. The asset may be a doorway or a secured entry point, or the asset may be an electronic device.

[0073] The method 500 may include an act of deleting the credential from the cache memory. Deletion of the credential from the cache memory may be based on receiving an indication that the user is not authorized to access the asset. For example, the credential cannot be verified and the reader may receive an indication that the user is not authorized to access the asset. Deletion of the credential from the cache memory may be based on loss of a second connection with the key device. For example, if the key device goes out of range of the second connection, this may indicate that the key device (and the user) is no longer in the vicinity of the reader and therefore has little intent to access the asset, and therefore the credential is removed from the cache memory. Deletion of the credential from the cache memory may be based on the passage of a predetermined time. For example, if the key device has not been used to access the asset within a predetermined time from the time the second connection was established, the credential may be deleted from the cache memory. This may be performed to conserve memory and resources. The user may be prompted to take an action, such as placing the key device on the reader, in order to transfer the credential again and attempt to access the asset.

[0074] 6 shows a flow diagram illustrating a method 600 for restricting access to an asset using a key device, according to some embodiments. Method 600 can be used to restrict access to an asset when the asset is a physical location such as a room, a building, or a house. Method 600 can be used to restrict access to an asset when the asset is a computer, a computer network, or an electronic device such as a smartphone.

[0075] The method 600 includes an act 502 of establishing a first connection between the key device and the reader when the key device enters a first connection range. The first connection may be, for example, a PAN over BLE. The method 600 includes an act 604 of providing a credential associated with the user from the key device to the reader using the first connection.

[0076] The method 600 includes an act 606 of establishing a second connection between the key device and the reader. The second connection may be UWB. The second connection is based on the entry of the key device into a second connection range. For example, UWB does not range as far as BLE. The key device may first establish a connection with the reader via BLE. Once the key device approaches the reader and is within range of UWB, the key device and reader may establish a second connection via UWB. Via UWB, the distance or location of the key device may be determined.

[0077] The method 600 includes an act 608 of providing the credential from the reader to an authorization service. The reader can transmit the credential to receive authorization for a user of the key device to access the asset. The method 600 includes an act 610 of receiving confirmation of the credential from the authorization service at the reader. If the credential does not have permission to access the asset, the reader may receive a rejection from the authorization service.

[0078] The method 600 includes an act of transmitting 612 a command from the reader to the access controller to grant access to the asset. This may be a command to unlock an entryway or a command to unlock an electronic device for use. Providing the credential to the access controller may be based on a determination that the user intends to access the asset. Upon determining that the user intends to access the asset, the method 600 may include an act of determining at the reader a set of location estimates of the key device using a second connection. This may be performed by distance sensing using UWB. The method 600 may include an act of calculating a probability that the user will access the asset using the set of location estimates and determining that the probability exceeds a predetermined threshold.

[0079] The determination that the user intends to access the asset may be based in part on sensor data collected from sensors on the key device, for example, a GPS on the key device may provide location information or an accelerometer on the key device may provide movement information, e.g., that the user is running, etc.

[0080] 7 shows a flow diagram illustrating a method 700 of restricting access to an asset, according to some embodiments. The method 700 includes an operation 702 of receiving a first message from a wireless key device associated with a user using a first wireless connection. The PACS can receive the first message at a reader for the secured entry point. The first message can include user credentials. The first wireless connection can be NFC, such as RFID, or PAN technology, such as IEEE 802.15.1 and BLE.

[0081] The method 700 includes an act 704 of receiving a set of messages from a wireless key device using a second wireless connection. The second wireless connection may be UWB. The set of messages may be a series of communications back and forth between the reader and the key device. The communications may include a seed or hashed counter to ensure security and prevent spoofing of the key device.

[0082] Method 700 includes an act of identifying 706 a set of location estimates of the wireless key device for the set of messages using a second wireless connection. The PACS can use communications technology such as UWB to identify the location of the key device or to measure the distance between the key device and the reader or readers.

[0083] The method 700 includes an operation 708 of determining that the user intends to physically access the secured entry point based on the set of location estimates. The secured entry point may be one of a plurality of secured entry points within range of the second wireless connection. The method 700 includes a further operation of determining that the user intends to physically access the secured entry point from a plurality of secured entry points based on a trajectory calculation from the set of location estimates.

[0084] The method 700 includes the further act of calculating a probability that a user will physically access a secured entry point using the set of location estimates and determining that the probability exceeds a predefined threshold. For example, the reader may identify multiple ranging radii from the reader. The probability increases each time the key device is determined to be within an increasingly closer range. The probability may decrease if the key device is determined to stop within one of the multiple distances or if the key device returns to a greater distance. A predefined threshold may be used to identify when the probability or intent is high enough that the secured entry point should be opened. The threshold may depend on factors such as the security level of the area being accessed (i.e., a conference room or a development lab), the number of other entry points in the vicinity, and the frequency of a particular key device accessing the secured entry point.

[0085] Method 700 includes an act 710 of sending a command to unlock a secured point of entry. There are many types of secured points of entry, such as entrance doors, turnstiles, through gates, elevators, and parking arms. Unlocking the secured point of entry includes any method applicable to each type of secured point of entry that allows restricted access to be unrestricted to the holder of the key device.

[0086] Method 700 includes a further act of sending the credential to an authorization service. The authorization service may be provided in the vicinity of the reader, such as in the residence. The authorization service may be connected to the reader over a network or the Internet to provide authorization of the credential at multiple locations or entry points. The authorization service may be integrated into the reader. Method 700 includes a further act of receiving an indication from the authorization service that the user is authorized to access the secured entry point. The authorization service may validate the credential and send an indication back to the reader of whether the holder of the credential is authorized to enter the secured entry point.

[0087] 8 illustrates a flow diagram of a method 800 for restricting access to an asset, according to some embodiments. The method 800 includes an act 802 of receiving a credential from a key device associated with a user using a first wireless connection. The first wireless connection may be NFC, such as RFID, or PAN technologies, such as IEEE 802.15.1 and BLE.

[0088] The method 800 includes an act of verifying 804 the credential with a pre-authentication for the asset. The pre-authentication may be performed at the reader or on a device proximate to the reader. The pre-authentication may include identifying that the credential includes a pattern using pattern matching. The pattern may be defined using a regular expression. The method 800 includes an act of verifying the credential with a pre-authentication by comparing the credential to a whitelist of credentials. The whitelist may be applied in the pre-authentication based on the time of day. For example, the whitelist may identify groups of people allowed into an office building at night and on weekends.

[0089] The method 800 includes an act of establishing 806 a second wireless connection with the key device in response to verifying the credentials through the pre-authentication. The second wireless connection may be UWB. The PACS may use a communication technology such as UWB to identify the location of the key device or to measure the distance between the key device and the reader or readers.

[0090] Method 800 includes acts of transmitting a credential to an authorization service and receiving an indication from the authorization service that the user is authorized to access the asset. The pre-authentication is performed to help eliminate credentials that may not match the correct format or pattern and therefore may be automatically rejected by the authorization service, thereby reducing the time and processing required to transmit and authenticate the credential. Method 800 includes an act 808 of providing a command to allow access to the asset.

[0091] 9 illustrates a flow diagram of a method 900 for restricting access to an asset, according to some embodiments. The method 900 includes an act 902 of receiving an asset credential from a key device associated with a user using a first wireless connection. The first wireless connection may be NFC, such as RFID, or PAN technologies, such as IEEE 802.15.1 and BLE.

[0092] The method 900 includes an act 904 of caching the credential in a memory. The PACS may cache the credential in a memory, such as the memory of the reader, for future authentication when the user intends to enter the asset. The intent threshold for authenticating the credential may be lower than the intent threshold for unlocking access to the asset. For example, as the user moves toward a doorway, the PACS may determine that there is a 60% probability that the user intends to enter the doorway and transmits the credential to an authentication service. As the user continues to move toward the door, the probability may change to 90%, causing the reader to transmit a command to unlock the doorway.

[0093] The method 900 includes an act of establishing 906 a second wireless connection with the key device. The second wireless connection may be UWB. The PACS may use communications technologies such as UWB to identify the location of the key device or to measure the distance between the key device and the reader or readers.

[0094] The method 900 includes an act 908 of requesting validation of the credential from an authorization service in response to establishing a second wireless connection with the key device. The authorization service may be provided in the vicinity of the reader, such as in a residence. The authorization service may be connected to the reader over a network or the Internet to provide authorization of the credential at multiple locations or entry points. The authorization service may be integrated into the reader.

[0095] The method 900 includes an act of receiving 910 a validation token from an authorization service. The validation token may be sent to an authorization service or an access control service to indicate that the provided credentials have been validated. The method 900 includes an act of storing 912 the validation token in a cache.

[0096] The method 900 may further include determining, using the second wireless connection, that the key device is within a first of a plurality of radii, the plurality of radii extending from a reader of the wireless key device. The PACS may identify distance ranges from the reader. For example, the PACS may specify three ranges, a first range within a 5-foot radius of the reader, a second range within a 5-10-foot radius of the reader, and a third range within a 10-15-foot radius of the reader.

[0097] The method 900 may further include determining, using the second wireless connection, that the key device is within a second of the multiple ranging radii, the second ranging radius being closer to the wireless key device reader than the first ranging radius. From the above example using three distances, the PACS may use UWB to determine that the key device was originally within a third range but has moved to the second range.

[0098] The method 900 may further include calculating a probability that the user intends to physically access the asset based on determining that the wireless key device is within the second ranging radius. From the above example, the key device is moving from a greater distance to a closer distance, thus increasing the probability that the user is moving toward the reader.

[0099] Method 900 may further include an act of determining that the probability exceeds a predefined threshold. Method 900 may further include an act of sending a verification token to an access control service. Based on the probability exceeding the threshold, the PACS may send a verification token to the access control service indicating that the asset should be unlocked. Method 900 may further include an act of receiving a command to allow access to the asset. The authorization service and the access control service may be embedded in the PACS, networked to the PACS, or may be separate services to the PACS.

[0100] The method 900 may further include determining, using the second wireless connection, that the key device is within a second of the multiple ranging radii, the second ranging radius being farther away from the wireless key device reader than the first ranging radius. From the above example using three distances, the PACS may use UWB to determine that the key device was originally within the second range but has moved farther into a third range.

[0101] Method 900 may further include an operation of removing the validation token and credentials from the cache. From the above example, as the key device moves from a closer range to a farther range, the probability that the user does not intend to access the asset increases, and therefore, stored information such as the credentials and validation token are removed from the cache.

[0102] Method 900 may further include an act of determining that no response is received from the key device within a predetermined time. If the PACS sent the message, a timer may be started. If the PACS receives a response from the wireless key device, the timer may be canceled. If the timer times out, the PACS may determine, based on the determined timeout period, that the wireless key device is no longer in range and therefore, the probability that the user intends to access the asset is extremely low. Method 900 may further include an act of deleting the validation token and credentials from the cache based on the validation token and credentials being no longer needed.

[0103] 10 illustrates a flow diagram of a method 1000 of restricting access to an asset, according to some embodiments. The method 1000 includes an act 1002 of receiving a user's credentials from a key device associated with the user using a first wireless connection. The first wireless connection may be NFC, such as RFID, or PAN technologies, such as IEEE 802.15.1 and BLE.

[0104] The method 1000 includes an act 1004 of establishing a second wireless connection with the key device. The second wireless connection may be UWB. The PACS may use communications technologies such as UWB to identify the location of the key device or to measure the distance between the key device and the reader or readers.

[0105] The method 1000 includes an act 1006 of determining that the user intends to access the asset based on a generated data set derived from a second wireless connection. The PACS can determine location information from the second wireless connection using UWB. The second wireless connection can include information from the key device, such as sensor data from a sensor on the key device. The data set can include both data provided by the key device and data derived from the second wireless connection that can be utilized to determine the user's intent.

[0106] The method 1000 may include an act of, upon determining that the user intends to access the asset, determining a probability that the user intends to access the asset using the dataset and a trained machine learning model. The trained machine learning model is trained using a dataset collected from a plurality of users. The dataset may include movement data of a plurality of users within range of the asset. The dataset may include movement data from a plurality of users. The information received from the wireless key device may include user movement data collected from an accelerometer of the wireless key device.

[0107] For example, for a particular asset or secured entry point, a learning machine model can be trained with location and movement data showing how different people approach and move towards the secured entry point when entering the secured entry point, and data when people do not enter the secured entry point. This training sets the learning machine model up to recognize how people move and the angle of approach when their intent is to enter the secured entry point. The data set can include a time timestamp, and a user's data set can be time-stamped. Including time in the training of the learning machine model can reveal different patterns and behaviors based on time of day. For example, people may be less likely to access a secured entry point during lunch hours.

[0108] The determination that a user intends to access an asset may include the use of received data from a calendar system. Method 1000 may further include an operation of identifying an event of the calendar system associated with the asset. For example, the calendar system may be able to indicate that a meeting is being held in a room attached to a security-protected access point. Method 1000 may further include an operation of identifying an indication that the user will attend the event. The calendar system may be able to provide a list of meeting attendees, and the PACS may identify that the user is one of the attendees, thereby increasing the probability that the user intends to access the security-protected access point. Method 1000 includes an operation 1008 of transmitting a command to permit access to the asset.

[0109] FIG. 11 shows a block diagram of an exemplary machine 1100 capable of executing any one or more of the techniques (e.g., methods) described herein. In alternative embodiments, machine 1100 may operate as a stand-alone device or may be connected (e.g., networked) to other machines. In a networked configuration, machine 1100 may operate as a server machine, a client machine, or both in a server / client network environment. In one example, machine 1100 may operate as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. Machine 1100 may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular phone, a web appliance, a network router, a switch or bridge, or any machine capable of executing (sequentially or otherwise) instructions specifying actions to be taken by that machine. Further, although only a single machine is illustrated, the term "machine" shall be understood to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methods described herein, such as cloud computing, software as a service (SaaS), other computer cluster configurations.

[0110] Examples may include or operate with logic or multiple elements or mechanisms as described herein. A circuit set is a collection of circuits implemented in tangible entities (e.g., simple circuits, gates, logic, etc.) including hardware. The constituent members of a circuit set may be flexible over time and with variability in the underlying hardware. A circuit set includes members that can perform a specified operation, either alone or in concert, when operated. In one example, the hardware of a circuit set may be invariably designed (e.g., hardwired) to perform a specific operation. In one example, the hardware of a circuit set may include variably connected physical elements (e.g., execution units, transistors, simple circuits, etc.) that include a computer-readable medium that is physically modified (e.g., magnetic, electrical, movable arrangement of immutable massive particles, etc.) to encode instructions for a specific operation. In connecting the physical elements, the underlying electrical properties of the hardware elements are modified, for example, from an insulator to a conductor or vice versa. The instructions enable embedded hardware (e.g., an execution unit or a load mechanism) to generate circuit set members in the hardware via variable connections to perform multiple portions of a particular operation when in operation. Thus, when the device is in operation, the computer readable medium is communicatively coupled to other elements of the circuit set members. In one example, any one of the physical elements may be used in multiple members of multiple circuit sets. For example, during operation, an execution unit may be used in a first circuit of a first circuit set at one time and reused by a second circuit in the first circuit set or by a third circuit in the second circuit set at a different time.

[0111] The machine (e.g., computer system) 1100 may include a hardware processor 1102 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, a field programmable gate array (FPGA), or any combination thereof), a main memory 1104, and a static memory 1106), some or all of which may communicate with each other via an interlink (e.g., a bus) 1108. The machine 1100 may further include a display device 1110, an alphanumeric input device 1112 (e.g., a keyboard), and a user interface (UI) navigation device 1114 (e.g., a mouse). In one example, the display device 1110, the input device 1112, and the UI navigation device 1114 may be touch screen displays. The machine 1100 may also include a storage device (e.g., a drive unit) 1116, a signal generating device 1118 (e.g., a speaker), a network interface device 1120, and one or more sensors 1121, such as a Global Positioning System (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 1100 may include an output controller 1128, such as a serial (e.g., Universal Serial Bus (USB)), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection, to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0112] The storage device 1116 may include a machine-readable medium 1122 having stored thereon data structures or one or more sets of instructions 1124 (e.g., software) that implement or are used in any one or more of the methods or functions described herein. The instructions 1124 may also reside, completely or at least partially, in the main memory 1104, in the static memory 1106, or in the hardware processor 1102 during execution by the machine 1100. In one example, one or any combination of the hardware processor 1102, the main memory 1104, the static memory 1106, or the storage device 1116 may constitute a machine-readable medium.

[0113] Although machine-readable medium 1122 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) configured to store one or more instructions 1124.

[0114] The term "machine-readable medium" may include any medium capable of storing, encoding, or carrying instructions executed by the machine 1100, causing the machine 1100 to perform any one or more of the methods of the present disclosure, or capable of storing, encoding, or carrying data structures used by or associated with such instructions. Non-limiting examples of machine-readable media include solid-state memory, and optical and magnetic media. In one example, a massive machine-readable medium includes a machine-readable medium having a plurality of particles having a fixed (e.g., stationary) mass. Thus, a massive machine-readable medium is not a transient propagating signal. Specific examples of massive machine-readable media may include non-volatile memory such as semiconductor memory elements (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices, magnetic disks such as internal hard disks and removable disks, magneto-optical disks, and CD-ROM and DVD-ROM disks.

[0115] The instructions 1124 may further be transmitted or received over a communications network 1126 using a transmission medium via a network interface device 1120 utilizing any one of a number of transport protocols (e.g., Frame Relay, Internet Protocol (IP), Transmission Control Layer Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc.). Exemplary communications networks may include local area networks (LANs), wide area networks (WANs), packet data networks (e.g., the Internet), mobile telephone networks (e.g., cellular networks), plain old telephone service (POTS) networks, and wireless data networks (e.g., the Institute of Electrical and Electronics Engineers (IEEE) 802.11 family of standards known as Wi-Fi®, the IEEE 802.16 family of standards known as WiMax®, the IEEE 802.15.4 family of standards), peer-to-peer (P2P) networks, among others. In one example, the network interface device 1120 may include one or more physical jacks (e.g., Ethernet, coaxial cable, or telephone jacks) or one or more antennas for connecting to the communications network 1126. In one example, the network interface device 1120 may include multiple antennas for wireless communication using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technologies. The term "transmission medium" includes any intangible medium capable of storing, encoding, or carrying instructions executed by the machine 1100 and facilitating communication of such software, including digital or analog communications signals or other intangible media.

[0116] The above detailed description includes references to the accompanying drawings, which form a part of the detailed description. The drawings show, through illustrations, specific embodiments that may be practiced. These embodiments are also referred to herein as "examples." Such examples may include elements in addition to those shown or described. However, the inventors also contemplate examples in which only those elements shown or described are provided. Moreover, the inventors also contemplate examples using any combination or permutation of those elements (or one or more aspects thereof) as shown or described, with respect to a particular example (or one or more aspects thereof), or with respect to any other example (or one or more aspects thereof) shown or described herein.

[0117] All publications, patents, and patent documents referred to herein are hereby incorporated by reference in their entirety as if individually cited. In the event of any inconsistent usage between this specification and any of the references cited above, the usage of the cited references shall be deemed to be complementary to that of this specification, and in the event of any irreconcilable inconsistencies, the usage in this specification shall prevail.

[0118] The terms "a" or "an" are used herein, as is common in patent documents, to include one or more, independent of any other occurrence or use of "at least one" or "one or more." In this specification, the term "or" is intended to be non-exclusive unless expressly stated otherwise, i.e., "A or B" includes "A but not B," "B but not A," "A and B." In the appended claims, the terms "including" and "in which" are used as the plain English equivalents of the terms "comprising" and "wherein," respectively. Also, in the following claims, the terms "including" and "comprising" are open-ended, i.e., a system, apparatus, article, or process that includes multiple elements in addition to the elements listed following such terms will still be considered to be within the scope of the claim. Moreover, in the following claims, the terms "first," "second," "third," etc. are used merely as labels and are not intended to impose numerical requirements on the objects they cover.

[0119] The above description is illustrative and not intended to be limiting. For example, the above examples (or one or more aspects thereof) may be used in combination with each other. Other embodiments may be used by those skilled in the art with reference to the above description. The Abstract is intended to allow the reader to quickly ascertain the nature of the technical disclosure, and is not intended to be used to interpret or limit the scope or meaning of the claims. In addition, in the above detailed description, various features may be summarized for ease of understanding of the disclosure. This should not be construed as intending that unclaimed disclosed features are essential to any claim. Rather, the subject matter of the invention may be comprised in some features of a particular disclosed embodiment. Thus, the following claims are to be referenced in the detailed description, with each claim standing on its own as a separate embodiment. The scope of the embodiments should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claims

1. 1. A method of restricting access to an asset in an access control system, comprising: Establishing a first wireless connection with a key device using a low power communication protocol; receiving credentials for a user of the key device over the first wireless connection; establishing a second wireless connection with the key device using Ultra Wide Band (UWB); determining that a user intends to access the asset; and determining that a user intends to access the asset includes determining that a user meets a first intent threshold based on the second wireless connection; determining that a user intends to access the asset, and in response to determining that the user meets a second intent threshold based on the second wireless connection, allowing access to the asset.

2. The method of claim 1 , wherein the first intent threshold is lower than the second intent threshold.

3. The method of claim 2 , wherein the low power communication protocol is Bluetooth Low Energy.

4. The method of claim 2 , wherein the asset is a physical location.

5. The method of claim 2 , wherein the asset is an electronic device.

6. providing said credentials to an authorization service for authorization; The method of claim 1 , further comprising the step of: receiving an approval indication from the authorization service.

7. The method of claim 6 , wherein providing the credentials to the authorization service for approval occurs in response to determining that a user intends to access the asset.

8. The method of claim 6 , wherein the step of establishing the second wireless connection occurs in response to receiving the authorization indication from the authorization service.

9. The method of claim 6 , wherein the step of granting access to the asset is additionally performed in response to receiving the approval indication from the authorization service.

10. The method of claim 6 , wherein the authorization service is local to a reader that establishes the first and second wireless connections.

11. The method of claim 6 , wherein the authorization service is networked with a reader that establishes the first and second wireless connections.

12. storing said credentials in a cache memory; 2. The method of claim 1, further comprising: deleting the credential from the cache memory based on a loss of the second wireless connection with the key device.

13. storing said credentials in a cache memory; 2. The method of claim 1, further comprising: removing the credential from the cache memory based on the passage of a predetermined amount of time.

14. 14. A non-transitory machine-readable medium comprising instructions that, when executed by at least one processor, cause the processor to perform the method of any one of claims 1 to 13.

15. 1. A method for restricting access to a plurality of assets in an access control system, comprising: Establishing a plurality of first wireless connections with a plurality of key devices using a low power communication protocol; receiving credentials of individual users of the plurality of key devices over the first wireless connection; establishing a plurality of second wireless connections with the plurality of key devices using ultra-wideband (UWB); determining, for each user, whether the user intends to access one or more of the plurality of assets; and determining whether a given user intends to access a given one of the plurality of assets includes determining whether the given user satisfies an intent threshold for the given one of the assets based on one or more of the plurality of second wireless connections, the intent threshold for each asset being based on a security level for that asset, and the intent thresholds for at least two of the plurality of assets being different; and controlling access to the plurality of assets based on determining whether a user intends to access one or more of the plurality of assets.

Images