SYSTEM AND METHOD FOR SECURE ACCESS TO STORAGE DEVICES - Patent application

Abstract

A system and method for secure access are provided. The secure access system includes a contactless card, a user device, a processor, and a storage device. The processor receives a first authentication request from the user device. The processor then transmits first authentication credentials associated with user login data to the user device. The processor then receives a second authentication request from the user device. Upon receiving the second authentication request, the processor transmits second authentication credentials associated with the contactless card to the user device. The processor then receives a first code from the user device, and the storage device performs one or more access operations based on the first code.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Patent Application No. 17 / 667,417, filed February 8, 2022, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Disclosure Fields The present disclosure relates to systems and methods for secure access to storage devices. [Background technology]

[0003] Electronic commerce is becoming more and more popular and common. Similarly, online shopping, where goods are purchased online and shipped to customers at their residential, commercial or other locations, constitutes a growing part of the world economy. Concurrent with the rise of online shopping has been the use of storage devices to store packages for later retrieval by the purchasing customer. Secure, authentication-locked containers are a common method of storing valuables. Such methods are often used to safely store important documents and packages. Parcels, documents, and other valuables are becoming more and more common among consumers of online commerce. Summary of the Invention [Problem to be solved by the invention]

[0004] The demand for secure containers is increasing, and correspondingly, so is the need for secure methods to access these containers. Storing valuables within locked containers poses many security concerns, including unauthorized access. For example, if the container is not properly stored or has weak security, valuables may be at risk of being stolen or lost. As another example, containers located in public spaces, such as lobbies or off-site facilities, may be at risk of being stolen or tampered with by unauthorized parties. As another example, containers located in private spaces, such as medicine cabinets or safes, may be at risk of being accessed by children or other unauthorized parties.

[0005] These and other deficiencies exist, and therefore there is a need to provide a system and method that overcomes these deficiencies to verify customers in a secure and efficient manner. [Means for solving the problem]

[0006] Disclosure Summary Aspects of the disclosed technology include systems and methods for secure access to storage devices.

[0007] An embodiment of the present disclosure provides a secure access system. The secure access system includes a storage device, a user device, and a card. The storage device includes a memory and a processor. The processor is configured to receive a first authentication request from the user device. After the first authentication request is received, the processor is configured to send a first authentication credential associated with the user login data to the user device. Upon receiving the first authentication credential, the processor is configured to receive a second authentication request from the user device. In response to the second authentication request, the processor is configured to send a second authentication credential associated with the input of the card into the communication field to the user device. Upon receiving the second authentication credential, the user device is configured to send a first code to the processor. Upon receiving the first code, the processor is configured to perform one or more actions based on the first code.

[0008] An embodiment of the present disclosure provides a method for a secure access system, the method comprising the following steps: receiving a first authentication request and sending first authentication credentials; receiving a second authentication request; Sending second authentication credentials; Receiving a first code; performing one or more access operations based on the first code; Includes.

[0009] An embodiment of the present disclosure provides a non-transitory medium including computer-executable instructions for performing a procedure including the steps of: Receiving a first authentication request; Transmitting first authentication credentials; receiving a second authentication request; Sending second authentication credentials; Receiving a first code; performing one or more access operations based on the first code; Perform the steps, including:

[0010] Further features of the disclosed system and method, as well as advantages offered thereby, are described in more detail below with reference to specific exemplary embodiments that are illustrated in the accompanying drawings.

[0011] Various embodiments of the present disclosure, together with further objects and advantages, may best be understood by reference to the following description taken in conjunction with the accompanying drawings, in which the drawings should not be construed as limiting the invention, but are intended only to illustrate different aspects and embodiments of the invention, in which: [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram of a system for a secure access system in accordance with an exemplary embodiment. [Figure 2A] 1 is a diagram of a contactless card according to an exemplary embodiment; [Figure 2B] 1 is a diagram of a contactless card according to an exemplary embodiment; [Figure 3A] 1 is a flowchart illustrating a secure access method according to an example embodiment. [Figure 3B] 1 is a method flow diagram illustrating a method of key diversification according to an example embodiment. [Figure 4] FIG. 2 is a sequence diagram illustrating a secure access method according to an exemplary embodiment. [Diagram 5] FIG. 1 is an illustration of a secure access system in accordance with an illustrative embodiment. [Figure 6] FIG. 1 is a sequence diagram of a secure access system in accordance with an exemplary embodiment. [Figure 7] FIG. 1 is a method diagram of a secure access system in accordance with an exemplary embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Detailed explanation The following description of the embodiments provides a non-limiting representative example that refers to numbers to specifically describe the features and teachings of different aspects of the present invention. It should be recognized from the description of the embodiments that the described embodiments can be implemented separately or in combination with other embodiments. Those skilled in the art who review the description of the embodiments should be able to learn and understand the various described aspects of the present invention. The description of the embodiments is not specifically exhaustive, but should facilitate the understanding of the present invention to the extent that other embodiments within the knowledge of those skilled in the art who read the description of the embodiments are understood to be consistent with the application of the present invention.

[0014] The present disclosure provides a system and method for a secure access system.

[0015] Advantages of the systems and methods disclosed herein include improved security and efficient access to storage devices. Exemplary embodiments of the present disclosure provide systems and methods for secure access systems. A contactless card or other device can be tapped to a device (e.g., a smartphone) to interface with the secure access system and method. Thus, the delivery person can be sure that they are delivering the package to the correct person, and the person receiving the package can be sure that the delivery person is authorized to deliver.

[0016] In some embodiments, when a contactless card or other device is tapped to a person's phone, a certificate signed by the employer (e.g., a courier) is also transferred. This transfer can be done directly from the contactless card or person's mobile phone, or indirectly after verifying their identity online.

[0017] In some embodiments, when a contactless card is tapped to a package delivery device, the identity of the person tapping the contactless card can be determined and verified to match the package destination. This can also be implemented with Host Card Emulation (HCE) to emulate a contactless card. The address on the package can be a loose address (stored preference), a tight address with a digitally signed certificate, or scoped to an individual delivery transaction.

[0018] Exemplary embodiments of the present disclosure can facilitate the efficiency and safety of transactions such as package pickup and delivery transactions, and purchases of goods or services that are subject to age restrictions, quantity restrictions, and other restrictions. Moreover, identity verification can be performed quickly, without degrading the user experience, and without the need for consumers, employees, and other personnel to carry ID documents or other materials. It should be appreciated that exemplary embodiments of the present disclosure are applicable to a wide range of purposes where identity verification is required, including, but not limited to, package pickup, package delivery, security (e.g., access to buildings and restricted areas), and travel (e.g., purchasing tickets, boarding planes and trains, etc.).

[0019] Exemplary embodiments of the present disclosure can promote safety and privacy for a user, such as securing access to a safe or medicine cabinet or other storage container located in a user's personal home. The verification required by the present disclosure protects the storage device from unauthorized third parties.

[0020] FIG 1 illustrates a system 100 according to an example embodiment. System 100 may include a contactless card 110, a user device 120, a server 130, a network 140, a database 150, and a storage device 160. Although FIG 1 illustrates a single example of components of system 100, system 100 may include any number of components.

[0021] The system 100 may include one or more contactless cards 110, which are described further below with reference to Figures 2A-2B. In some embodiments, the contactless cards 110 may be in wireless communication with the user device 120, using, by way of example, NFC.

[0022] System 100 may include a user device 120. User device 120 may be a network-enabled computing device. Exemplary network-enabled computing devices include, but are not limited to, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, network-enabled computing devices include an Apple® iPhone®, iPod®, iPad®, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0023] The user device 120 may include a processor 121, a memory 122, and an application 123. The processor 121 may be a processor, microprocessor, or other processor, and the user device 120 may include one or more of these processors. The processor 121 may include processing circuitry, which may include additional components, including additional processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware necessary to perform the functions described herein.

[0024] The processor 121 may be coupled to the memory 122. The memory 122 may be a read-only memory, a write-once-read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the user device 120 may include one or more of these memories. The read-only memory may be factory programmable as read-only or may be programmable only once. One-time programmability provides the opportunity to write once and read many times. The write-once-read-multiple memory may be programmed at a time after the memory chip leaves the factory. Once programmed, the memory cannot be rewritten, but it can be read many times. The read / write memory may be programmed and reprogrammed many times after leaving the factory, and it can be read many times. The memory 122 may be configured to store one or more software applications, such as application 123, and other data, such as the user's personal data and financial account information.

[0025] The application 123 may consist of one or more software applications, such as a mobile application or a web browser, that include instructions for execution on the user device 120. In some examples, the user device 120 may execute one or more applications, such as software applications, that enable network communication with one or more components of the system 100, transmit and / or receive data, and perform the functions described herein. Upon execution by the processor 121, the application 123 may provide the functionality described herein, and in particular, may perform and execute the steps and functions of the process flows described below. Such processing may be implemented in software, such as software modules, for execution on a computer or other machine. The application 123 may provide a graphical user interface (GUI) through which a user may view and interact with other components and devices in the system 100. The GUI may be formatted, for example, as a Hyper Text Markup Language (HTML), Extensible Markup Language (XML) web page, or in any other suitable format for display on a display device depending on the application the user uses to interact with the system 100.

[0026] The user device 120 may further include a display 124 and input devices 125. The display 124 may be any type of device for presenting visual information, such as a computer monitor, a flat panel display, a mobile device screen, etc., such as a liquid crystal display, a light emitting diode display, a plasma panel, a cathode ray tube display, etc. The input devices 125 may include any device available and supported by the user device 120 for inputting information into the user device 120, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder, etc. These devices may be used to input information and interact with the software and other devices described herein.

[0027] The system 100 may include a server 130. The server 130 may be a network-enabled computing device. Exemplary network-enabled computing devices include, but are not limited to, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, network-enabled computing devices include an Apple® iPhone, an iPod, an iPad, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0028] The server 130 may include a processor 131, a memory 132, and an application 133. The processor 131 may be a processor, microprocessor, or other processor, and the server 130 may include one or more of these processors. The processor 131 may include processing circuitry, which may include additional components, including additional processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware, necessary to perform the functions described herein.

[0029] The processor 131 may be coupled to the memory 132. The memory 132 may be a read-only memory, a write-once-read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the server 130 may include one or more of these memories. The read-only memory may be programmable as read-only at the factory or may be one-time programmable. One-time programmability provides the opportunity to write once and read many times. The write-once-read-multiple memory may be programmed at some point after the memory chip leaves the factory. Once programmed, the memory cannot be rewritten or may be read many times. The read / write memory may be programmed and reprogrammed many times after leaving the factory, and may be read many times. The memory 132 may be configured to store one or more software applications, such as the application 133, and other data, such as a user's personal data and financial account information.

[0030] The application 133 may be comprised of one or more software applications including instructions for execution on the server 130. In some examples, the server 130 may execute one or more applications, such as software applications, that enable network communication with one or more components of the system 100, transmit and / or receive data, and perform the functions described herein. Upon execution by the processor 131, the application 133 may provide the functionality described herein, and in particular, may perform and execute the steps and functions of the process flows described below. For example, the application 133 may be executed to receive web form data from the user device 120 and the storage device 160, to maintain a web session between the user device 120 and the storage device 160, and to mask private data received from the user device 120 and the storage device 160. Such processing may be implemented in software, such as software modules, for execution on a computer or other machine. The application 133 may provide a GUI through which a user can view and interact with other components and devices in the system 100. The GUI may be formatted, for example, as a web page in Hyper Text Markup Language (HTML), Extensible Markup Language (XML), or in any other suitable format for display on a display device, depending on the application that a user uses to interact with system 100.

[0031] Server 130 may further include a display 134 and input devices 135. Display 134 may be any type of device for presenting visual information, such as a computer monitor, a flat panel display, a mobile device screen, etc., such as a liquid crystal display, a light emitting diode display, a plasma panel, a cathode ray tube display, etc. Input devices 135 may include any device available and supported by server 130 for inputting information to server 130, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder, etc. These devices may be used to input information and interact with the software and other devices described herein.

[0032] The system 100 may include one or more networks 140. In some examples, the network 140 may be one or more of a wireless network, a wired network, or any combination of wireless and wired networks and may be configured to connect the user devices 120, the server 130, the database 150, and the storage device 160. For example, the network 140 may be an optical fiber network, a passive optical network, a cable network, an Internet network, a satellite network, a wireless local area network (LAN), a global system for mobile communications, a personal communication service, a personal area network, a wireless application protocol, a multimedia messaging service, an enhanced messaging service, a short message service, a time division multiplexing based system, a code division multiple access based system, a D-AMPS, Wi-Fi, fixed wireless data, IEEE 802.11b, 802.15.1, 802.11n and 802.11g, Bluetooth, NFC, Radio Frequency Identification (RFID), Wi-Fi, etc.

[0033] Additionally, network 140 may include, but is not limited to, a telephone line, optical fiber, IEEE Ethernet 902.3, a wide area network, a wireless personal area network, a LAN, or a global network such as the Internet. Additionally, network 140 may support an Internet network, a wireless communication network, a cellular network, or the like, or any combination thereof. Network 140 may further include one network, or any number of the exemplary types of networks described above, operating as a standalone network or in cooperation with one another. Network 140 may utilize one or more protocols of one or more network elements to which they are communicatively coupled. Network 140 may translate from other protocols to one or more protocols of the network device, or from other protocols to one or more protocols of the network device. Although network 140 is depicted as a single network, according to one or more examples, it should be understood that network 140 may include and be configured with multiple interconnected networks, such as, for example, the Internet, a service provider network, a cable television network, an enterprise network such as a credit card association network, and a home network. Network 140 may further include or be configured to create one or more front channels that are publicly accessible and through which communications may be observable, and one or more secure back channels that are not publicly accessible and through which communications may not be observable.

[0034] The system 100 may include a database 150. The database 150 may be one or more databases configured to store data. These include, but are not limited to, a user's personal data, a user's financial accounts, a user's identity, a user's transactions, and authenticated and unauthenticated documents. The database 150 may be comprised of a relational database, a non-relational database, or other database implementations, and any combination thereof. The database 150 includes multiple relational and non-relational databases. In some examples, the database 150 may comprise a desktop database, a mobile database, or an in-memory database. Furthermore, the database 150 may be hosted internally by the server 130 or may be hosted outside the server 130, such as on a server, a cloud-based platform, or any storage device in data communication with the server 130.

[0035] System 100 may include storage device 160. Storage device 160 may be a network-enabled computing device. Exemplary network-enabled computing devices include, but are not limited to, a server, a network appliance, a personal computer, a workstation, a telephone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, network-enabled computing devices include an Apple® iPhone, iPod, iPad, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0036] Storage device 160 may include processor 161, memory 162, and application 163. Processor 161 may be a processor, microprocessor, or other processor, and storage device 160 may include one or more of these processors. Processor 161 may include processing circuitry, which may include additional components, including additional processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, and anti-tamper hardware necessary to perform the functions described herein.

[0037] The processor 161 may be coupled to the memory 162. The memory 162 may be a read-only memory, a write-once-read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the storage device 160 may include one or more of these memories. The read-only memory may be programmed at the factory to be read-only or one-time programmable. One-time programmable means that it is written once and can be read many times. The write-once-read-multiple memory may be programmed at a time after the memory chip leaves the factory. Once programmed, the memory cannot be rewritten, but it can be read many times. The read / write memory may be programmed and reprogrammed many times after it leaves the factory, and it can be read many times. The memory 162 may be configured to store one or more software applications, such as application 163, and other data, such as a user's personal data and financial account information.

[0038] The application 163 may be comprised of one or more software applications that include instructions for execution on the storage device 160. In some examples, the storage device 160 may execute one or more applications, such as software applications, that enable network communication with one or more components of the system 100, transmit and / or receive data, and perform functions described herein. Upon execution by the processor 161, the application 163 may provide the functionality described herein, and in particular, perform and execute steps and functions in the process flows described below. For example, the application 163 may be executed to receive web form data from the user device 120 and the storage device 160, to maintain a web session between the user device 120 and the storage device 160, and to mask private data received from the user device 120 and the storage device 160. Such processing may be implemented in software, such as software modules, for execution on a computer or other machine. The application 163 may provide a GUI through which a user can view and interact with other components and devices in the system 100. The GUI may be formatted, for example, as a web page in Hyper Text Markup Language (HTML), Extensible Markup Language (XML), or in any other suitable format for display on a display device, depending on the application that a user uses to interact with system 100.

[0039] Storage device 160 may further include a display 164 and an input device 165. Display 164 may be any type of device for presenting visual information, such as a computer monitor, a flat panel display, a mobile device screen, etc., such as a liquid crystal display, a light emitting diode display, a plasma panel, a cathode ray tube display, etc. Input device 165 may include any device available and supported by server 130 for inputting information to server 130, such as a touch screen, a keyboard, a mouse, a cursor control device, a touch screen, a microphone, a digital camera, a video recorder or camcorder, etc. These devices may be used to input information and interact with the software and other devices described herein.

[0040] 2A illustrates a contactless card 110 according to an example embodiment. The contactless card 110 may comprise a payment card, such as a credit card, debit card, or gift card issued by a service provider 205 displayed on the front or back of the card 110. In some examples, the contactless card 110 is unrelated to a payment card and comprises, without limitation, an ID card, a membership card, a transportation card, or an access card. In some examples, the payment card may comprise a dual interface contactless payment card.

[0041] The contactless card 110 may include a substrate 210 including a single layer or one or more laminated layers of plastic, metal, or other materials. Exemplary substrates include polyvinyl chloride, polyvinyl chloride acetate, acrylonitrile butadiene styrene, polycarbonate, polyester, anodized titanium, palladium, gold, carbon, paper, biodegradable materials, and the like. In some examples, the contactless card 200A may have physical characteristics conforming to the ID-1 format of the ISO / IEC 7810 standard, and the contactless card may otherwise conform to the ISO / IEC 14443 standard. However, it should be understood that the contactless card 110 according to the present disclosure may have different characteristics, and the present disclosure does not require that the contactless card be implemented in a payment card.

[0042] The contactless card 110 may also include identification information 215 displayed on the front and / or back of the card, and a contact pad 220. The contact pad 220 may be configured to establish contact with another communication device, such as a user device, a smartphone, a laptop, desktop, or a tablet computer. The contactless card 110 may also include processing circuitry, an antenna, and other components not shown in FIG. 2A. These components may be located behind the contact pad 220 or elsewhere on the substrate 210. The contactless card 110 may also include a magnetic strip or tape, which may be located on the back of the card (not shown in FIG. 2A).

[0043] FIG. 2B illustrates a contactless card 110 according to an example embodiment.

[0044] 2B, the contact pad 220 may include processing circuitry 225 for storing and processing information, including the microprocessor 111 and memory 112. It will be understood that the processing circuitry 225 may include additional components, including processors, memory, error and parity / CRC checkers, data encoders, anti-collision algorithms, controllers, command decoders, security primitives, anti-tamper hardware, etc., necessary to perform the functions described herein.

[0045] The memory 112 may be a read-only memory, a write-once-read-multiple memory, or a read / write memory, e.g., RAM, ROM, and EEPROM, and the contactless card 200B may include one or more of these memories. Read-only memory may be factory programmable as read-only or may be one-time programmable. One-time programmability offers the opportunity to write once and read many times. Write-once / read-multiple memory may be programmed at some point after the memory chip leaves the factory. Once programmed, memory cannot be rewritten, but it can be read many times. Read / write memory may be programmed and reprogrammed many times after leaving the factory, and it can be read many times.

[0046] The memory 112 may be configured to store one or more applets 113, one or more counters 114, and a customer identifier 115. The one or more applets 113 may be comprised of one or more software applications configured to run on one or more contactless cards, such as a Java Card applet. However, it is understood that the applet 113 is not limited to a Java Card applet, but may be any software application operable on a contactless card or other device having limited memory. The one or more counters 114 may be comprised of a numeric counter sufficient to store an integer number. The customer identifier 115 may be comprised of a unique alphanumeric identifier assigned to the user of the contactless card 110, which identifier may distinguish the user of the contactless card from users of other contactless cards. In some examples, the customer identifier 115 may identify both the customer and the account assigned to the customer, and may further identify the contactless card associated with the customer's account.

[0047] Although the processor and memory elements of the foregoing exemplary embodiments are described with reference to contact pads, the disclosure is not limited thereto, and it will be understood that these elements may be implemented outside of the pads 220, may be implemented entirely separate from the pads 220, or may be implemented as additional elements in addition to the processor 111 and memory 112 elements disposed within the contact pads 220.

[0048] In some examples, the contactless card 110 may include one or more antennas 255. The one or more antennas 255 may be disposed within the contactless card 110 and around the processing circuit 225 of the contact pads 220. For example, the one or more antennas 255 may be integral with the processing circuit 225, or the one or more antennas 255 may be used with an external booster coil. As another example, the one or more antennas 255 may be external to the contact pads 220 and the processing circuit 225.

[0049] In one embodiment, the coil of the contactless card 110 can function as the secondary of an air-core transformer. The terminal can communicate with the contactless card 110 by disconnecting the power or amplitude modulation. The contactless card 110 can utilize a gap in the power connection of the contactless card to estimate the data transmitted from the terminal, which is functionally maintained by one or more capacitors. The contactless card 110 can return communication by switching the load or performing load modulation on the coil of the contactless card. Load modulation may be detected on the terminal coil by interference.

[0050] As described above, the contactless card 110 can be built on a software platform capable of running on a smart card or other device with limited memory, such as JavaCard, and can securely execute one or more applications or applets. An applet can be added to the contactless card to provide a one-time password (OTP) for multi-factor authentication (MFA) in a variety of mobile application-based use cases. The applet is configured to respond to one or more requests, such as a near-field data exchange request, from a reader, such as a mobile NFC reader, and generate an NDEF message that includes the encrypted secure OTP encoded as an NDEF text tag.

[0051] 3A is a flow chart of a secure access method 300A according to an embodiment of the present disclosure. FIG. 3 may refer to components that are the same as or similar to those illustrated in FIGS.

[0052] The method 300A may begin at step 305 where a first authentication request is received. The first authentication request is sent by a user device and received by a processor. The processor may be associated with a storage device, a server, or other device.

[0053] In step 310, the first authentication credential is transmitted to the user device. The first authentication credential may be transmitted by a processor, which may be associated with a storage device, a server, or other device.

[0054] In step 315, the second authentication request is received by a processor, which may be associated with a storage device, a server, or other device.

[0055] In step 320, the second authentication credentials are transmitted to the user device. The second authentication credentials may be transmitted by a processor, which may be associated with a storage device, a server, or other device.

[0056] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It is understood that five is one example of a threshold and that the processor may attempt five transmissions, less than five, or more than five.

[0057] The processor may delay execution of the one or more access operations if attempts to transmit the first and second authentication credentials exceed a predetermined threshold.

[0058] The processor may transmit a third authentication request and attempt to receive third authentication credentials associated with biometric data in response to the third authentication request, which may include one or more predetermined types of data, such as, but not limited to, voice recognition, fingerprint scan, hand print scan, hand shape recognition, ear shape recognition, vein pattern recognition, face recognition, iris recognition, retina recognition, heart rate recognition, body temperature recognition, DNA recognition, etc.

[0059] In step 325, a first code is received by a processor, which may be associated with a storage device or other server, and the processor may receive a second code if the first code is not received within a predetermined time.

[0060] In step 330, an action associated with the first code is performed. The action may be performed by the storage device. One or more of the access actions may include opening the safe, closing the safe, unlocking the safe, and locking the safe. As another example, one or more of the access actions may include opening the cabinet, closing the cabinet, unlocking the cabinet, and locking the cabinet. As another example, the one or more actions may include notifying the user that the package has been picked up.

[0061] Step 330 may include one or more access operations for a given type of transaction, which may include one or more from a non-limiting list of cash transactions, credit transactions, debit transactions, other non-cash transactions, point-of-sale transactions, and other consumer-based transactions. It is understood that this list is exemplary and other example transactions may be included.

[0062] Step 330 may include one or more access operations for a predetermined period of time. For example, the access operation may be available for one minute, one hour, or other predetermined period of time. After this period has elapsed, further authentication as described herein may be required to re-perform the access operation. Alternatively, if the time required for the access operation is short, further authentication as described herein may be required to terminate the access operation before the predetermined time has elapsed.

[0063] Step 325 may include one or more operations for authenticating remote access for one or more users. The processor may perform one or more access operations on a smart device, including, but not limited to, a server, a network appliance, a personal computer, a workstation, a phone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, a network-enabled computing device may include an Apple® iPhone, iPod, iPad, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0064] 3B is a flow chart of a method 300B of key diversification according to an embodiment of the present disclosure. FIG. 3B may refer to components that are the same as or similar to those illustrated in FIGS.

[0065] For example, a sender and a receiver may wish to exchange data via a sending device (e.g., a user device) and a receiving device (e.g., a storage device and / or a user device). As explained above, it is understood that one or more sending devices and one or more receiving devices may be involved, so long as each party shares the same shared secret key. In some examples, the sending device and the receiving device are provided with the same master symmetric key. In other examples, the sending device is provisioned with diverse keys created using the master key. In some examples, the symmetric key may consist of a shared secret symmetric key that is kept secret from all parties other than the sending device and the receiving device involved in the secure data exchange. Furthermore, it is understood that a portion of the data exchanged between the sending device and the receiving device includes at least a portion of the data that may be referred to as a counter value. The counter value may consist of a numerical value that changes each time data is exchanged between the sending device and the receiving device.

[0066] The transmitting device and receiving device may be configured to communicate via NFC, Bluetooth, RFID, Wi-Fi, etc.

[0067] The method 300B may begin at step 350. In step 350, the sending device and the receiving device may be provisioned with the same master key, such as the same master symmetric key. The sending device may be the user device 120. The receiving device may be the contactless card 110. When the sending device prepares to process the sensitive data with a symmetric encryption process, the sending device may update a counter. Furthermore, the sending device may select an appropriate symmetric encryption algorithm, including at least one of a symmetric encryption algorithm, an HMAC algorithm, and a CMAC algorithm. In some examples, the symmetric algorithm used to process the diversification value may consist of any symmetric encryption algorithm used as needed to generate a symmetric key diversified to a desired length. Non-limiting examples of symmetric algorithms may include symmetric encryption algorithms such as 3DES and AES128, including, for example, a symmetric HMAC algorithm such as HMAC-SHA-256 and a symmetric CMAC algorithm such as AES-CMAC.

[0068] In step 352, the sending device may take the selected encryption algorithm and use the master symmetric key to process the counter value 114. For example, the sender may select a symmetric encryption algorithm and use a counter that is updated for each conversation between the sending device and the receiving device. The counter or counters 114 may consist of a numeric counter sufficient to store an integer number. The processor may increment the counter one or more times.

[0069] The sending device generates two session keys, one ENC (encryption) session key and one MAC (message authentication code) session key, in step 354. The sending device may use the master symmetric key to encrypt the counter value with a selected symmetric encryption algorithm to create the session keys.

[0070] In step 356, the processor generates a MAC over the counter 114, the unique customer identifier 115, and the shared secret MAC session key. The customer identifier 115 may consist of a unique alphanumeric identifier assigned to the user of the contactless card 110 that can distinguish the user of the contactless card from other users of contactless cards. In some examples, the customer identifier 115 can identify both the customer and the account assigned to that customer, and can further identify the contactless card associated with the customer's account.

[0071] In step 358, the processor encrypts the MAC with the ENC session key. Once encrypted, the MAC becomes a ciphertext. In some examples, cryptographic operations other than encryption may be performed, and multiple cryptographic operations may be performed using diversified common keys before transmitting the protected data.

[0072] In some examples, the MAC cipher can be a digital signature used to verify the user information. Other digital signature algorithms, such as public key asymmetric algorithms, such as the Digital Signature Algorithm or the RSA algorithm, or zero-knowledge protocols, can be used to perform this verification.

[0073] In step 360, the processor transmits the cryptogram to the receiving device. The receiving device may receive the contactless card 110. The cryptogram may include the applet information 113, the unique customer identifier 115, the counter value 114, and the encrypted MAC.

[0074] In step 362, the server validates (verifies) the encryption. The server may be part of the sending device or the receiving device, or the server may be a separate entity.

[0075] In step 364, the receiving device generates its own UDK (Unique Diversified Key) using the unique customer identifier 115 and the master key. The unique customer identifier 115 is derived from the verified cryptogram. The receiving device is already provisioned with the master key.

[0076] In step 366, the receiving device generates two session keys: one ENC (Encryption) session key and one MAC (Message Authentication Code) session key. The receiving device generates the session keys from the UDK and the counter value 114. The counter value 114 can be derived from the ciphertext.

[0077] In step 368, the receiving device uses the session key to decrypt the MAC from the ciphertext sent by the transmitting device. The output of the encryption may be the same diversified symmetric key value that the sender created. For example, the receiving device may use a counter to independently create copies of the first and second diversified session keys. The receiving device may then decrypt the protected data using the second diversified session key to reveal the output of the MAC created by the transmitting device. The receiving device may then process the resulting data through a MAC operation using the first diversified session key.

[0078] In step 370, the receiving device verifies the MAC with the MAC session key generated in step 366. The receiving device can verify the MAC on the unique customer identifier 115 and the counter value 114.

[0079] 4 shows a sequence diagram 400 of a secure access system. FIG. 4 may reference components that are the same as or similar to those illustrated in FIGS.

[0080] The sequence 400 may begin at step 405, where a sending device (e.g., a user device) sends a first authentication request to a server. The server may be part of a storage device. It is understood that the sending device may have data communication with the server via one or more intermediary devices, such as one or more user devices.

[0081] In step 410, the server sends the first authentication credential to the sending device.

[0082] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It is understood that five is one example of a threshold and that the processor may attempt five transmissions, less than five, or more than five.

[0083] In step 415, the sending device encrypts the information or data required to satisfy the first authentication credential. The encryption method is further described with reference to FIG. 3B. The first authentication credential can be associated with user login data. It should be understood that the user login data can include many different types of information, such as identification information, financial information, location information, timing information, or other types of information.

[0084] In step 420, the sending device sends the encrypted information to a storage device, which may include a server.

[0085] In step 425, the storage device decrypts and validates (authenticates) the information sent by the sending device, thereby validating (authenticates) the first authentication required to perform the access operation.

[0086] In step 430, the sending device sends a second authentication request to a server, which may be part of the storage device.

[0087] In step 435, the server sends the second authentication credentials to the sending device.

[0088] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It is understood that five is one example of a threshold and that the processor may attempt five transmissions, less than five, or more than five.

[0089] The processor may delay execution of the one or more access operations if attempts to transmit the first and second authentication credentials exceed a predetermined threshold.

[0090] In step 440, the sending device encrypts the data or information required to satisfy the second authentication credential. The encryption method is further described with reference to FIG. 3B. The second authentication credential can be associated with a contactless card. The user login data can include various types of information, such as identification information, financial information, location information, timing information, etc.

[0091] In step 445, the sending device sends the encrypted information to a storage device, which may include a server.

[0092] In step 450, the storage device decrypts and verifies the information sent by the sending device, thereby verifying the second authentication required to perform the access operation.

[0093] In step 455, the transmitting device transmits the first code to the storage device. The processor can receive a second code if the first code is not received or entered within a predetermined time.

[0094] In step 460, the storage device performs one or more actions associated with the first code. One or more of the access actions may include opening the safe, closing the safe, unlocking the safe, and locking the safe. As another example, one or more of the access actions may include opening the cabinet, closing the cabinet, unlocking the cabinet, and locking the cabinet. As another example, the one or more actions may include notifying the user that the package has been picked up.

[0095] Step 460 may include one or more access operations for a given type of transaction. These transactions may include one or more transactions from the following non-limiting list: cash transactions, credit transactions, debit transactions, other non-cash transactions, point-of-sale transactions, and other consumer-based transactions. It should be understood that this list is exemplary and other example transactions may be included.

[0096] Step 460 may include one or more access operations for a predetermined period of time.

[0097] Step 460 may include one or more actions to authenticate remote access for one or more users. The processor may perform one or more access operations on a smart device, including, but not limited to, a server, a network appliance, a personal computer, a workstation, a phone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, a network-enabled computing device may include an Apple® iPhone, iPod, iPad, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0098] Figure 5 shows a diagram 50 of a secure access system. Figure 5 may reference components that are the same as or similar to those illustrated in Figures 1-4.

[0099] Fig. 50 may include a user device 505, further described with reference to Fig. 1. User login data associated with the user device 505 serves as a first authentication credential. The user login data may include various types of information, such as identification information, financial information, location information, timing information, etc.

[0100] The user device 505 can interact with a contactless card 510, which is further described with reference to Figures 2A-2B. Information associated with the contactless card 510 may function as a second authentication credential.

[0101] If the user device 505 and contactless card 510 meet the authentication requirements, information can be shared via Bluetooth or wireless signals 515 .

[0102] The user device 505 and contactless card 510 can satisfy the authentication requirements required by the storage device 520, which will be further described with reference to FIG. 1. The storage device 520 can request, receive, and authenticate information stored on either or both of the user device 505 and the contactless card 510. Once the storage device 520 has authenticated a sufficient amount of information, it can perform one or more actions. In FIG. 50, the storage device 520 performs an operation related to opening a storage locker with valuables therein. It should be understood that the storage device 520 can include not only storage lockers, but also luggage lockers, medicine chests, parcel lockers, postal boxes, post office boxes, safes, or other containers used by consumers to store deliveries and other personal items.

[0103] The storage device 520 can be opened to allow a user to retrieve an item 525 .

[0104] Figure 6 is a sequence diagram of a secure access system using exemplary authentication credentials of user login data, contactless card, and biometric data. Figure 6 is an exemplary process illustrating secure access to a storage device according to one embodiment. Figure 6 may reference components that are the same or similar to those illustrated in Figures 1-5.

[0105] It will be appreciated that the encryption method with reference to FIG.

[0106] Sequence 60 describes the sequence of operations between the contactless card, the user device, the processor, and the storage device. The contactless card is further described with reference to Figures 2A-2B. Each of the user device, the processor, and the storage device is further described with reference to Figure 1.

[0107] The sequence 60 may begin at step 605. In step 605, a processor receives a first authentication request from a user device. The processor may be associated with a storage device or other server.

[0108] In step 610, the processor transmits the first authentication credential to the user device.

[0109] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It is understood that five is one example of a threshold and that the processor may attempt five transmissions, less than five, or more than five.

[0110] In step 615, the user device fills in the authentication credentials via user login data on the user device or some other processor. The user login data can include various types of information, such as identification information, financial information, location information, timing information, etc.

[0111] In step 620, the processor receives a second authentication request from a user device, which is further described with reference to FIG.

[0112] In step 625, the processor transmits the second authentication credentials to the user device, which is further described with reference to FIG.

[0113] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It should be understood that five is an example threshold and the processor may attempt to transmit five times, less than five times, or more than five times.

[0114] The processor may delay execution of the one or more access operations if attempts to transmit the first and second authentication credentials exceed a predetermined threshold.

[0115] In step 630, the contactless card and the user device interact to satisfy second authentication credentials.

[0116] In step 635, the processor receives a third authentication request from a user device, which is further described with reference to FIG.

[0117] In step 640, the processor transmits the third authentication credential to the user device, which is further described with reference to FIG.

[0118] In step 645, the user device fills in the third authentication credential associated with biometric data, which may include one or more predetermined types of data, such as, but not limited to, voice recognition, fingerprint scan, hand print scan, hand shape recognition, ear shape recognition, vein pattern recognition, face recognition, iris recognition, retina recognition, heart rate recognition, body temperature recognition, DNA recognition, etc.

[0119] In step 650, the processor receives a first code from the user device. The processor may receive a second code if the first code is not received or entered within a predetermined period of time.

[0120] In step 655, the storage device performs one or more actions based on the first code. One or more of the access actions may include opening the safe, closing the safe, unlocking the safe, and locking the safe. As another example, one or more of the access actions may include opening the cabinet, closing the cabinet, unlocking the cabinet, and locking the cabinet. As another example, the one or more actions may include notifying the user that the package has been picked up.

[0121] Step 655 may include one or more access operations for a given type of transaction, which may include one or more transactions from the following non-limiting list of transactions: cash transactions, credit transactions, debit transactions, other non-cash transactions, point-of-sale transactions, other consumer-based transactions, etc. It should be understood that this list is exemplary and may include other example transactions.

[0122] Step 655 may include one or more access operations for a predetermined period of time.

[0123] Step 655 may include one or more actions to authenticate remote access for one or more users. The processor may perform one or more access operations on a smart device, including, but not limited to, a server, a network appliance, a personal computer, a workstation, a phone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, a network-enabled computing device may include an Apple® iPhone, iPod, iPad, or other mobile device running Apple's iOS® operating system, a device running Microsoft's Windows® Mobile operating system, a device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0124] 7 illustrates an exemplary process for securely accessing a storage device, according to one embodiment. FIG. 7 may reference the same or similar components as those illustrated in FIGS. 1-6.

[0125] Method 70 describes an exemplary sequence of operations between a contactless card, a user device, a processor, and a storage device. The contactless card is further described with reference to Figures 2A-2B. The user device, processor, and storage device are each further described with reference to Figure 1. The encryption method is further described with reference to Figures 3B and 4.

[0126] The method 70 may include step 705 in which the processor receives a first authentication request from the user device.

[0127] In step 710, the processor transmits the first authentication credential to the user device.

[0128] In step 715, the user device encrypts the login data associated with the first authentication credentials.

[0129] In step 720, the user device transmits the now encrypted user login data to a storage device or processor.

[0130] In step 725, the processor or storage device decrypts the usage login data and validates (authenticates) the first authentication credentials.

[0131] In step 730, the processor receives a second authentication request from the user device.

[0132] In step 735, the processor transmits the second authentication credentials to the user device.

[0133] The user device communicates with the contactless card and encrypts the card information associated with the second authentication credentials at step 740. It should be appreciated that the information shared between the card and the user device can include various types of information, such as identification information, financial information, location information, timing information, etc.

[0134] In step 745, the user device transmits the encrypted card information to a processor or storage device.

[0135] In step 750, the processor or storage device decrypts the card information and verifies the second authentication credentials.

[0136] The processor may attempt to transmit the first and second authentication credentials up to a predetermined threshold number. For example, the processor may attempt to transmit the first authentication credentials up to a threshold of five times if the first four attempts are not met. It is understood that five is one example of a threshold and that the processor may attempt five transmissions, less than five, or more than five.

[0137] The processor may delay execution of the one or more access operations if attempts to transmit the first and second authentication credentials exceed a predetermined threshold.

[0138] In step 755, the processor may receive a third authentication request from the user device.

[0139] In step 760, the processor may send the third authentication credential to the user device.

[0140] In step 765, the user device may encrypt the user's biometric information associated with the third authentication credential. This biometric data may include one or more predetermined types of data, such as, but not limited to, voice recognition, fingerprint scan, hand print scan, hand shape recognition, ear shape recognition, vein pattern recognition, face recognition, iris recognition, retina recognition, heart rate recognition, body temperature recognition, DNA recognition, etc.

[0141] In step 770, the user device transmits the encrypted biometric information to a processor or storage device.

[0142] In step 775, the processor or storage device decrypts the user biometric information and verifies the third authentication credential.

[0143] A first code is received by either the processor or the storage device or both in step 780. The processor may receive a second code if the first code is not received and entered within a predetermined time.

[0144] In step 785, the storage device performs one or more actions based on receipt of the first code. The one or more access actions may include opening the safe, closing the safe, unlocking the safe, locking the safe, etc. As another example, one or more of the access actions may include opening the cabinet, closing the cabinet, unlocking the cabinet, locking the cabinet. As another example, the one or more actions may include notifying the user that the package has been picked up.

[0145] Step 785 may include one or more access operations for a given type of transaction, which may include one or more transactions from the following non-limiting list: cash transactions, credit transactions, debit transactions, other non-cash transactions, point-of-sale transactions, other consumer-based transactions, etc. It should be understood that this list is exemplary and may include other example transactions.

[0146] Step 785 may include one or more access operations for a predetermined period of time.

[0147] Step 785 may include one or more actions to authenticate remote access for one or more users. The processor may perform one or more access operations on a smart device, including, but not limited to, a server, a network appliance, a personal computer, a workstation, a phone, a handheld personal computer, a personal digital assistant, a thin client, a fat client, an Internet browser, a mobile device, a kiosk, a contactless card, or other computing or communication device. For example, a network-enabled computing device may include an Apple® iPhone, iPod, iPad, or other mobile device running Apple's iOS® operating system, any device running Microsoft's Windows® Mobile operating system, any device running Google's Android® operating system, and / or other smartphones, tablets, or similar wearable mobile devices.

[0148] Throughout this disclosure, the following terms take at least the meaning explicitly associated therewith herein, unless the context clearly dictates otherwise. The term "or" is intended to mean an inclusive "or." Additionally, the articles "a," "an," and "the" are intended to mean one or more, unless otherwise specified or clearly directed to the singular from the context.

[0149] Numerous specific details have been described herein. However, it should be understood that embodiments of the disclosed technology may be practiced without these specific details. In other instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure an understanding of the present specification. References to "several examples," "other examples," "one example," "one example," "various examples," "one embodiment," "one embodiment," "several embodiments," "exemplary embodiments," "various embodiments," "one implementation," "implementation," "exemplary implementation," "various implementation," "several implementations," and the like indicate that the implementation(s) of the disclosed technology thus described may include a particular feature, structure, implementation, various implementations, several implementations, or indicate that the implementation(s) of the disclosed technology thus described may include a particular feature, structure, or characteristic, but not all implementations necessarily include a particular feature, structure, or characteristic. Furthermore, repeated use of the phrases "in one example," "in one embodiment," or "in one embodiment" does not necessarily refer to the same example, embodiment, or implementation.

[0150] As used herein, unless otherwise specified, the use of hierarchical adjectives "first," "second," "third," etc. to describe a common object is intended merely to indicate that different instances of a similar object are being referred to, and is not intended to imply that the objects so described must be in a particular order, whether in time, space, ranking, or otherwise.

[0151] It is understood that the systems and methods described herein may be embodied in one or more physical media, such as, but not limited to, a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a hard drive, a read-only memory (ROM), a random access memory (RAM), and other physical media capable of storing data. For example, a data storage device may include a random access memory (RAM) or a read-only memory (ROM), which is configured to access and store data, information, and computer program instructions. A data storage device may also include a storage medium or other suitable type of memory (e.g., RAM, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disk, optical disk, floppy disk, hard disk, removable cartridge, flash drive, any type of tangible and non-transitory storage medium, etc.), where an operating system, application programs, such as a web browser application, an email application, and / or other applications, and data files are stored. Data storage in a network-enabled computer system includes electronic information, files, and documents stored in a variety of ways, such as flat files, indexed files, hierarchical databases, relational databases, such as Oracle Corporation, Microsoft Excel files, Microsoft Access files, solid-state storage devices, including flash arrays, hybrid arrays, server-side products, enterprise storage devices, online storage devices, cloud storage devices, and other storage mechanisms. Additionally, the diagram illustrates various components (e.g., servers, computers, processors, etc.) separately. Functions described as being performed by various components may be performed by other components, and the various components may be combined or separated.Other variations are also possible.

[0152] While particular embodiments of the disclosed technology have been described in connection with what are presently considered to be the most practical and various embodiments, it is to be understood that the disclosed technology is not limited to the disclosed embodiments. On the contrary, it is intended to cover various modifications and equivalent arrangements that are within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

[0153] The present specification uses examples to disclose specific embodiments of the disclosed technology, including the best mode, and also enables any person of ordinary skill in the art to practice specific implementations of the disclosed technology, including making and using any device or system, and performing any method incorporated therein. The scope of the specific embodiments of the disclosed technology is defined in the claims, and may include other examples that occur to those of ordinary skill in the art. Such other examples are intended to be within the scope of the claims if they have structural elements that do not differ from the literal language of the claims, or if they include equivalent structural elements that do not differ substantially from the literal language of the claims.

Claims

1. A secure access system comprising a memory and a processor, The processor, Receiving a first authentication request; transmitting first authentication credentials in response to the first authentication request, where the first authentication credentials are associated with user login data; The processor, receiving a second authentication request; transmitting second authentication credentials in response to the second authentication request, where the second authentication credentials are associated with input of the card into a communication field; The processor, Receiving a first code; configured to perform one or more access operations based on the first code; Secure access system.

2. The processor is further configured to: attempt to transmit the first and second authentication credentials up to a predetermined threshold.

10. The secure access system of claim 1.

3. the processor is further configured to delay execution of one or more access operations if attempts to transmit the first and second authentication credentials exceed a predetermined threshold.

3. The secure access system of claim 2.

4. The one or more access actions include at least one selected from the group including opening the safe, closing the safe, unlocking the safe, and locking the safe.

10. The secure access system of claim 1.

5. The processor further comprises: receiving a third authentication request; configured to transmit third authentication credentials in response to the third authentication request; the third authentication credential is associated with biometric data; 10. The secure access system of claim 1.

6. the processor is further configured to perform one or more access operations for a given type of transaction.

10. The secure access system of claim 1.

7. The processor is further configured to authenticate remote access for one or more users.

10. The secure access system of claim 1.

8. The processor is further configured to perform one or more access operations on the smart device.

10. The secure access system of claim 1.

9. The processor is further configured to receive a second code if the first code is not received within a predetermined time.

10. The secure access system of claim 1.

10. the processor is further configured to perform one or more access operations for a predetermined period of time.

10. The secure access system of claim 1.

11. A processor receiving a first authentication request; the processor transmitting first authentication credentials in response to the first authentication request, the first authentication credentials being associated with user login data; receiving a second authentication request by the processor; and transmitting, by the processor, in response to the second authentication request, second authentication credentials, the second authentication credentials being related to an input of a card into a communication field, the method comprising: The method of the secure access system includes: receiving a first code from the processor; and performing, by the processor, one or more access operations based on the first code. Methods for secure access systems.

12. the processor further comprising: attempting to transmit the first and second authentication credentials up to a predetermined threshold. The method of claim 11.

13. and wherein the processor delays execution of one or more access operations if the first and second authentication credential transmission attempts exceed the predetermined threshold. The method of claim 11.

14. The one or more access actions include at least one selected from the group including opening a cabinet, closing a cabinet, unlocking a cabinet, and locking a cabinet. The method of claim 11.

15. receiving a third authentication request by the processor; the processor transmitting a third authentication credential in response to a third authentication request, the third authentication credential being associated with biometric data; The method of claim 11 further comprising:

16. the processor performing one or more access operations for a given type of transaction; The method of claim 15 further comprising:

17. The method of claim 16 , further comprising the processor authenticating remote access to one or more users.

18. and wherein the processor performs one or more access operations on the smart device.

17. The method of claim 16.

19. and if the first code is not received or entered within a predetermined time, the processor receives a second code. The method of claim 11.

20. A non-transitory computer-readable medium comprising computer-executable instructions that, when executed on a processor, perform a procedure including the steps of: The procedure includes: Receiving a first authentication request; transmitting first authentication credentials in response to the first authentication request, the first authentication credentials being associated with user login data; receiving a second authentication request; transmitting second authentication credentials in response to the second authentication request, the second authentication credentials being associated with input of the card into a communication field; Receiving a code; performing one or more access operations based on said code; A non-transitory computer readable medium comprising:

Images